Order-book figures: vaults are market PDAs, and every account box sits beside its dot

WRITING-PLAN.md

@@ -8,6 +8,7 @@ How the manuscript gets produced, verified, reviewed, and kept alive. The table
 - Diagrams are the longest-lived medium. Every chapter budget includes them: a state machine, and a figure for every walkthrough step. The step figures share one column layout and accumulate into the program's full account map, so no map is drawn up front.
 - Style is inherited wholesale from the [companion AI plugin](https://github.com/quicknode/solana-finance-claude-plugin): onchain and offchain unhyphenated, "instruction handlers" for the functions and "instructions" for their input, "minor unit" not "base unit", "network" for Solana and "program" for onchain code with "protocol" never used for either, one name per role enforced within each chapter, concrete two-asset examples, real handler names in lifecycle prose, persona-driven walkthroughs. Also from the skill, and deliberately not repeated below: handler naming (`initialize_x()` for setup, the domain's verb otherwise), PDA versus account, mint versus token, example assets, plain language and concrete definitions, emphasis, stating the mechanism rather than gesturing at it, and talking to readers rather than about the document. **A rule that would apply to any Solana finance writing belongs in the skill; this file adds only what is specific to the book.** `scripts/lint-manuscript.mjs` still enforces several of the skill's rules over the manuscript, so a rule can live there and be guarded here.
 - Banned phrases, enforced by `scripts/lint-manuscript.mjs` (`npm run lint`) over the manuscript files: "the oracle problem", "instrument" (say "financial software" or "program"), the hyphenated chain words, and em-dashes. The lint also bans a group of phrases that read as machine-written, on the same grounds as the em-dash: a reader clocks them before finishing the sentence, and every one of them stands in for a mechanism rather than stating it. "Load-bearing" is the type specimen; say what depends on the thing and what breaks without it. The rest are "delve", "tapestry", "intricate", "multifaceted", "holistic", "myriad", "seamless", "robust", "pivotal", "crucial", "elevate", "testament to", "deep dive", "paradigm shift", "game-changer", "unlock the power", "realm of", "landscape of", "in today's", "it is worth noting", and "underscores the". A second group is banned for announcing that a point exists instead of making it, each one written in this manuscript and each replaced by the content it stood in front of: "what matters", "the point is", "that is the whole reason", and "does the work of". "What matters here is the unit" became "the index advances by slots, not seconds"; delete the announcement and keep what followed it. The same announcement came back wearing a pronoun once the plain forms were banned, so "that is the point", "which is exactly the point", "is the one that matters", "matters more than it looks" and "it is worth being" are banned too. A related group points the reader at the page instead of telling them what is on it: "Note what is pledged", "Notice who did nothing", "Watch K in the story below". Each is one word longer than the sentence that says the thing, and the fix is to say it. Watching a real market or looking away from the chain is the reader doing something in the world, and stays. "Treats" meaning "discusses" ("the *Lending and Borrowing* chapter treats it fully") is banned; say "explains" or "covers". "Treats X as Y" is a different verb and stays. "Pin" is banned in both of its uses here: a test enforces, checks, or asserts, and a value is fixed or recorded at creation. "Capstone" is banned for rating a chapter's place instead of saying what it does; say "this chapter" or name it. "Walks" with a chapter, book, or suite as its subject is banned as tour-guide framing: a chapter explains or builds, and a suite follows or runs a path; a loop that walks a tree or the states of a machine is mechanism and stays. "Works" meaning succeeds or functions stays ("the deadline arithmetic flips which handler works"); what is banned is working an example ("the chapter works an example"), where the chapter shows or builds it instead. A third group rates the writing instead of doing it, and each was found many times over in one audit: "honest" and "honestly" (twenty uses, none about honesty), "quietly" as an intensifier, "the discipline" and "hygiene" as names for a rule, "by now you", and "worth stealing", "worth copying", "worth noticing", "worth printing", "worth studying". The paragraph-closing maxim ("A wall that has never been pushed on is a hypothesis") is the same tell with no regex to catch it, so the companion AI plugin describes it and the lint does not. A fourth group is mannered prose: an idiom, a slang word, or a metaphor standing where a literal phrase of the same length was available, and each was found in one audit: "a single whale" (a single large backer), "config foot-guns" (dangerous configurations), "zombie positions", "cannot be rugged", "by fat-finger", "after the whistle", "mid-flight", "the hot path", "hand-rolled", "comes off the top", "pays for itself", "comes home", "the ladder has three rungs". A metaphor drags in connotations the writer did not choose, so the fix is to say what you mean. The teaching analogy that carries a mechanism stays (a mint is a factory, Solana is one giant computer), and so does the finance term the field uses (a deep pool, seeding a pool, the rails); the lint catches the words above, and the companion AI plugin describes the rule in general. "Fail open" and "fail closed" are banned for a different reason: an open circuit stops and an open door lets everything through, so readers split on which way each one points. Say what the program does instead: it refuses the transaction, or it lets every request through. The lint also rejects negative framing of offchain truth (any "cannot verify the price" phrasing): the manuscript teaches the positive mechanism, checking a fact's provenance, freshness, and confidence against a source the program trusts. "Property test" is banned in favor of "invariant test", the companion AI plugin's rule, because "property" also names an account's fields; the one exception is the testing chapter's single pointer to the libraries' own term, "property-based testing". "Smart contract" is banned in favour of "program", with exactly two exceptions, both contrastive: the Introduction's line telling a reader arriving from another chain what a Solana program is, and the glossary's definition.
+- A key pair is two keys, and only its public key is an address: prose never calls a key pair an address or an account, never puts one on or off the curve, and never says a PDA has one. In the figures, an address made from a key pair is an unlabeled `r="6"` dot on the curve with its account's box beside it; it is never an offcurve dot with a caption, and no caption names a key pair. `scripts/lint-manuscript.mjs` fails the prose and the captions, and `scripts/check-figure-geometry.mjs` fails a public-key dot off the curve, a derived-address dot on it, and any dot more than 20 units from an account box. Seven order-book figures once drew the order book and its vaults as offcurve dots captioned `A CLIENT KEYPAIR`. The vaults are now PDAs of the market; the book, which the client must create, has its box above the curve at the top right, beside its dot.
 - No sentence runs past forty-five words, enforced by `scripts/lint-manuscript.mjs` over prose, list items, and boxouts. The ceiling is deliberately loose, because it is catching a specific failure rather than policing rhythm: every sentence it first caught was a list that had been glued into a paragraph, or two separate claims joined by a colon, and the fix each time was to split at the punctuation already sitting there. The same pass bans a short list of words that have a plain equivalent and carry no meaning of their own here: "utilize", "commence", "prior to", "subsequent to", "in order to", "in the event that", "due to the fact that", "whilst", "amongst", "thus", "hence", "therefore", "approximately", "numerous", and "sufficient". Words that only *look* bureaucratic stay, because they are exact in this domain: a transaction **executes**, a supplier earns **yield**, a maker **provides** liquidity, a program signs by **presenting** seeds, and a firm **operates** a venue. "Confirm" is banned as a loose synonym for "check", because `confirmed` is one of Solana's three commitment levels and the book teaches them. This is the one rule taken from ASD-STE100 Simplified Technical English; the rest of that standard is written for aircraft maintenance procedures, and its bans on direct address, rhetorical questions, and metaphor would flatten a book that teaches with a story.
 - An address is written as a markdown link, `[host.tld](https://host.tld)`, never as loose prose, because the PDF build only reaches links. It prints in italic, which is what technical publishing does with an address (O'Reilly's house style and No Starch's) and needs no machine face to tell a reader it is copied exactly; the monospace face stays with `program_id`, where it separates code from the prose around it. Never underlined: underlining is a screen convention and collides with descenders in a serif face. The scheme prints, because it is part of the address and because technical publishing prints one: O'Reilly sets a link as "words (https://host/path)". A leading `www.` does not, being a subdomain nobody types and every browser supplies. The link keeps whatever it was written with, and the link is what a click follows, so write the link text as the host and path alone and let the markdown target carry the full address. A link whose text is words rather than an address gets that address printed after it in parentheses, since nobody can click a printed page. Both are done by `scripts/build-pdf.mjs`; the lint catches an address written as prose. A long address may break across lines, at a slash; what may not break is where it points, so `npm run build-pdf` reads the link annotations back out of the finished PDF and fails unless every line of a broken address carries the whole destination. But an address does not belong in running prose at all: it is a string of punctuation inside a justified measure, and a reader holding the book cannot act on it while reading the sentence anyway. It goes in a footnote, which names the page it points at, so the sentence keeps its words and the address waits at the foot of the page for a reader who wants it. Two things stay inline. `solanabook.org` is short and is the thing its sentence is naming, and the Glossary is reference matter already, whose entries would read oddly with notes hanging off them.
 - American spelling throughout, which the lint guards in two batches: the "-our" and "-ise" endings, and the doubled-l forms and noun/verb splits British English keeps ("canceling", "modeling", "cancelable", "center", "license"). Identifiers keep whatever the companion repository shipped, so the `Cancelled` enum variant is written capitalized and left alone. Typography in the source is one apostrophe and one set of quotes, both straight, and one italic marker, the asterisk. The figures are typed the same way. The build sets the quotes the way a typeset book carries them, ’ and “ ” in prose, headings, and figure labels, and straight inside code, which is O'Reilly's convention and every other technical publisher's; the lint rejects a curly quote, as a character or an entity, in a chapter or a figure, so that grep and the build only ever meet one form. A single quote is always an apostrophe, never a quotation inside a quotation, and the lint holds the manuscript to that too. Underscore italics are not a second house style: an underscore is a word character, so `\b` never fires against the start of `_Arithmetic of Money_`, and a chapter reference written that way reads clean to the cross-reference check. The lint bans them for that reason.