Before sketching anything, here is what we heard. Anything we’d push back on is in the dark card.
The kennel volunteer on a phone in a metal-roofed building is the canonical user. The office admin on desktop is the minority. Bulk & pivot live on desktop; everything else starts mobile.
Aggressive autosave. Undo by default with a 10s toast. No “Are you sure?” except for genuinely irreversible actions (euthanasia, deceased, permanent delete). Empty states welcome; never scold.
Touch targets 48px floor, 56–64px for primary. Primary action lives at the bottom. Hover is decoration, never function. Swipe is an accelerator; tap is the path.
Every form saves locally first and reconciles. Every record carries a sync state — synced / pending / conflict — and conflicts are surfaced honestly with both edits visible.
16px body floor, 1.5 leading. EN+ES at v1, structured for VI/TL/ZH/HT/PT/SO/HMN/RU/BN/HY/KM/FA. SMS is a first-class channel, not a notification afterthought.
Okabe-Ito-leaning palette. No red/green pair. No autoplay. prefers-reduced-motion honored wholesale. No sound on load.
Difficult content is opt-in, not default. A “Take a break” affordance exits image-heavy panels into a calm view. An “In memory of” mode globally softens forever-home copy.
Closer to GOV.UK / USWDS than current pet-tech marketing. Plain language. Honest hierarchy. No dark patterns. An open standard other tools can implement.
A. The “60-question Common App” framing risks reproducing gatekeeping at scale. Propose minimal common profile + per-rescue add-ons, and surface required fields up-front so applicants opt in knowingly.
B. “AI bio generator” carries reputational risk for civic infra. Propose Bio Draft, never auto-publish, require human edit, watermark with disclosure metadata.
C. ActivityPub is a strong commitment. Propose RSS + JSON Feed + Schema.org AnimalListing first; ActivityPub in v1.1 once data model is stable.
All three sit in “calm civic.” They differ in voice and surface temperature. The two we didn’t pick are sketched so you can override.
Cool sky-blues against a sand neutral. Geometric sans throughout. Reads like a children’s hospital site — soft, specifically un-corporate. Risk: too soft; reads “wellness app,” less authority.
Warm-paper neutral, near-black ink, single sage primary. Newsreader serif for display + numerals; Plex Sans for UI; Plex Mono for status, codes, IDs. Reads like a printed field manual or a public-records system that respects the work.
Stronger character — slab serif display, woodblock chip styling, brick accents. Beautiful, but the brick reads as an emergency color and we explicitly want to avoid red urgency. Risk: too distinctive; competes with the photos.
Color, type, space, motion, status. Every screen below is composed from these. If a screen needs something that isn’t here, the token list is wrong.
Six surfaces. Mobile primary; desktop where it has a real role. Photography is the emotional core; chrome is structural.
Mobile-primary unless the surface is fundamentally desktop (bulk + pivot). Bottom-thumb-zone primary actions everywhere; 56–64px hit targets on every primary control.
The shared concerns: notifications, command palette, sync state, public verification.
Each calls back to a surface above. Treat each as a hypothesis with a failure mode named on it — these are explicit risks, not features.
Where we want a decision before we leave wireframe and start mocking pixels.