Design systems that survive the second product

Most design systems are built for one product and quietly break when a second one arrives. The failure is rarely visual — it is naming. Tokens called `card-bg` and `nav-height` encode a single layout instead of a shared language.

We name tokens by role, not by location: surface, surface-raised, on-surface, accent, accent-muted. A second product can adopt them without renaming anything, and a theme swap becomes a values change rather than a refactor.

Governance matters more than tooling. We keep one owner per token group, a written rule for when a new component earns its place in the library, and a deprecation window measured in releases rather than in weeks.

The test is simple: can a designer start a new product on Monday and ship a coherent screen by Friday without asking anyone for permission? If not, the system is documentation, not infrastructure.