studio-engine 0.74.0 → 0.74.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a6961114226763cef0af1b1500c982609412516d95c78c0985f63012882e92e
-  data.tar.gz: 4694c467547769140156eac7824a72fd0d510d84f0c30637cba40a87c3344187
+  metadata.gz: 6694226dcc9e100149692ef60162478d4927a69280343c5047c0222517f1f68c
+  data.tar.gz: 8e6b5c07f8bb5fa60466049f321c7be0a09168fb750766202a5d122734cb6699
 SHA512:
-  metadata.gz: 509affb42c8bf58a11289e0e0c16cfb2b298625456284b0d56775373fba4ac225c9bc6ba6bd695acb028a44a517836989204dfbb97bd96b1ed69ca2f1e9e7023
-  data.tar.gz: 36ed3258453f8025f591335348f989e333a6d805de78979e325c2a005a197d74c17f04995c6fcf6776bbebb2dae9d4404c483f0effe1e095bf29f2e02947ca83
+  metadata.gz: 6ec39596a087d56cc64f3a211ea349bf6a00b7a21c6eb1d1c70b36136dda3f3ab7f8fe1a1f61b26593661283f12707501727d9f3d5119f01b3fa28995ece7bd7
+  data.tar.gz: 3d65093bf62c9088976d9ea56e756cabd7e01e65aaae06205419e337a0d8b6a1a1b93c60b93631bf724d254f01bcdc5fb0c7360c50525c1f519b35b6b7b49946

data/CHANGELOG.md

@@ -6,6 +6,196 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **The email banner assembled two attributes INCLUDING THEIR OWN QUOTES in Ruby,
+  so ERB escaping never ran on them.** `_layered_banner.html.erb` wrote
+  `background="..."` and `bgcolor="..."` as Ruby strings and marked them
+  `html_safe` — the one shape ERB's attribute escaping can never reach. Both now
+  go through `tag.attributes`. This is the EMAIL half of the family PR #303 closed
+  in the modal/Alpine partials.
+
+  **THE RULE IS THE OPPOSITE OF #303'S, and that is the whole point.** There the
+  locals are Alpine EXPRESSIONS: they stay `html_safe` so a handler reaches the
+  browser byte-identical. A background URL and a colour are CONTENT, so they take
+  the FULL escaping a content attribute is owed — the treatment #303 gave the four
+  input constraints. Mark by what the value IS, not by which file it lives in.
+
+  **MEASURED, and worse than the sibling seams.** A double quote in
+  `background_url` did not merely inject an attribute, it ATE the rest of the tag:
+  the cell came back carrying `background`, `quote"`, a lone backslash, `<` and
+  `script`, having LOST `bgcolor`, `width`, `height`, `valign` and `style`
+  outright — five attributes gone from one quote. The failure is
+  a structurally wrecked email — no fallback colour, no dimensions, no
+  background-image CSS — not merely a tainted one.
+
+  **`bgcolor` WAS CLASSIFIED AND CLEARED BEFORE BEING TOUCHED**, because #303's
+  warning was that two of its six candidate sites were already safe.
+  `scrim_solid_hex` formats three integers the model has already clamped to 0-255,
+  so it returns a hash and six hex digits for every input — proven by rendering a
+  hostile scrim, not by reading the method. It is repaired anyway, and the reason
+  is measured: simulating the plausible refactor (the method learning to pass a
+  named colour through) injects an `onload` into every email with the attribute
+  hand-assembled, and merely renders a wrong colour with `tag.attributes` on it.
+
+  **NOTHING MOVED FOR REAL INPUT.** Seven banner shapes rendered before and after,
+  in both email and preview mode, are byte-identical. The one input whose bytes
+  change is a signed CDN URL, whose `&` now ships as `&amp;` — a correction, since
+  the CSS twin and the VML `src` on the SAME element already escaped it and the
+  hand-assembled `background` was the odd one out shipping a bare `&`. Verified in
+  a real browser: the client decodes the attribute, requests the URL with its
+  signature intact, and paints the banner.
+
+- **The Rails guard sweep's non-vacuity check tested a COPY of the scanner, so
+  the scanner could go blind and the suite stayed green.**
+  `rails_guard_sweep_test.rb` is a source scan, and a scan is only trustworthy
+  with a control proving its predicate can still say NO. That control re-typed
+  the rule as string operations on a sample instead of calling the scan's own
+  path: the predicate existed twice, at line 78 and line 101. Measured — typing
+  one typo into line 78 ALONE (`\bRails\.` → `\bRailz\.`), which blinds the net so
+  it can never flag anything no matter what `lib/` contains, left all three tests
+  passing, 0 failures. The floor was being measured against a duplicate
+  implementation, so it certified the copy and never the instrument.
+
+  **THE REPAIR IS ONE DEFINITION, NOT A BETTER COPY.** The rule now lives in a
+  single `offending_line?`, and both the scan and every control call it. The same
+  mutation now reddens `test_the_predicate_still_flags_the_shape_that_was_fixed`
+  by name — while the scan itself still passes, which is precisely the "passes for
+  free" the control exists to catch.
+
+  **THE CONTROLS ARE SPLIT ONE PER CLAUSE**, because `offending_line?` decides on
+  four (comment exemption, mentions `defined?(Rails)`, not already asking
+  `Rails.respond_to?`, and calls a method on the constant) and one combined
+  assertion would go red without saying which clause went inert — the same
+  blindness as the copy, one level in. Each of the four now reddens its own named
+  test. The scan also asserts its EXIT-BLINDNESS FLOOR inside the test that trusts
+  the result — the three named files were swept, and more than 1,000 lines were
+  read — because a scan whose loop never runs reports zero offenders and passes
+  having proved nothing. Six mutations, applied one at a time, each verified red.
+
+  **TWO CLAIMS IN THE ENTRIES BELOW WERE FALSE, and are corrected in this same
+  change.** *The Rails guard sweep really is finished now* said a bare
+  `require "action_view"` is what defines the namespace-only `module Rails`. It is
+  not — measured, that require leaves `Rails` UNDEFINED and never loads
+  rails-html-sanitizer. What defines it is naming a constant under
+  `ActionView::Helpers`, which autoloads the helpers tree; in `studio/js_literal`
+  that is line 66's `extend ActionView::Helpers::JavaScriptHelper`. The same loose
+  sentence had propagated into three test files and is corrected there too. And
+  *`Studio::S3` no longer mistakes a Rails NAMESPACE* said `lib/studio.rb` used the
+  repaired form "in three places" — the sweep in this same unreleased block made it
+  FOUR, so a false completeness claim was shipping one sentence above the entry
+  announcing a fix for exactly that.
+
+- **A quote in a host local can no longer close an Alpine attribute and turn the
+  rest of the element into markup.** Four partials built an attribute — its OWN
+  QUOTES included — as a Ruby String and marked it `html_safe`, which is the one
+  shape ERB's attribute escaping can never reach: the marking tells ERB to stand
+  down, so a double quote in the local ended the attribute and the HTML parser read
+  the remainder as new attributes. Measured, not reasoned: one hostile
+  `auto_redirect_seconds` turned the success card's root into an element carrying
+  attributes named `quote"`, `\`, `<` and `script`, with its `class` swallowed
+  whole. This is strictly worse than the JS-string-literal class fixed in
+  *Host-supplied locals can no longer brick an Alpine component* below, which at
+  least stayed inside its attribute.
+
+  **THE REPAIR IS NOT ESCAPING.** These locals are Alpine EXPRESSIONS by contract —
+  the caller is handing the engine JS on purpose — so `escape_javascript` would
+  break the feature it was protecting. The partials stop writing the quotes and let
+  ActionView write them: `tag.attributes("x-init": expr.html_safe)`. `tag_option`
+  runs `gsub('"', "&quot;")` on the finished value UNCONDITIONALLY, on the line
+  AFTER the escape branch it skips for a marked String, so the expression keeps its
+  apostrophes, angle brackets and backslashes byte-for-byte and still cannot end the
+  attribute. `blocks/_rail_row:112` already did exactly this and was the worked
+  example.
+
+  **WHAT MOVED — twelve splices in four files.** `blocks/_success_card` (the
+  Ruby-built `x-data` countdown object, and the `x-init` call list that splices
+  `auto_redirect_url_key`), `blocks/_processing_card` (one assembled `x-data`/`x-init`
+  pair carrying TWO locals — `resolve_expr` and `min_duration`, which only LOOKS
+  numeric because just its guard calls `.to_i`), `blocks/_leveling_activity` (the
+  Next Quest `@click`, plus `minlength` / `maxlength` / `pattern` / `title` on the
+  form input), and `components/_sidebar_panel` (`@click.outside`,
+  `@keydown.escape.window` and `@turbo:before-cache.window` on the root of the shell
+  every link menu hangs from). No default or in-repo value contains a character tag
+  encoding touches, so every shipped page renders byte-for-byte what it did — a
+  render-level test asserts that directly.
+
+  **THE MARKING NOW FOLLOWS WHAT THE VALUE IS.** Code stays `html_safe` and reaches
+  the browser unchanged; CONTENT does not. The four input constraint attributes are
+  a length, a regex and a tooltip, so they take the full escaping a content
+  attribute is owed — which also closes a second latent bug the marking carried, a
+  bare `&` in a `title` or `pattern` reaching the browser as the start of an entity.
+
+  **TWO OF THE SIX SITES ON THE ORIGINAL LIST WERE ALREADY SAFE and were left
+  alone.** `blocks/_rail_row:112` routes its handler through `content_tag`, and
+  `board/_card_shell:54` escapes both halves of its arbitrary-attribute passthrough
+  through ERB. Both were re-verified by rendering them with a hostile value, not by
+  reading them. Filing a fix for either would have bought a guard that can never
+  bite.
+
+  **HOW THE GUARDS ASSERT.** `test/views/assembled_attribute_locals_test.rb` reads
+  every seam through Nokogiri's HTML5 parser — the algorithm a browser runs — and
+  asserts on the DECODED attribute value, never on the template's output bytes,
+  because ERB entity-escapes an unmarked value too and a raw-markup structural
+  assertion therefore cannot fail. (HTML5 rather than HTML4 on purpose: HTML4
+  silently drops an `@click`, so every Alpine assertion made through it reads nil on
+  a correct page.) Each seam makes two claims — the element carries exactly the
+  attributes a benign value gives it, and the browser recovers the whole expression
+  — plus a non-vacuity control that fails if the partial ever stops splicing the
+  local at all. All twelve were mutated back to their assembled form ONE AT A TIME
+  and each was killed by its own test; the shared `_processing_card` call was also
+  mutated per-local. `test/lib/studio/attribute_encoding_contract_test.rb` pins the
+  ActionView property the whole repair stands on, so a future Rails moving that
+  `gsub` reports itself as one dependency change rather than twelve partial bugs.
+
+  **STILL OPEN, and named rather than quietly folded in:**
+  `studio/mailers/_layered_banner:69,100` assemble `background=` and `bgcolor=` the
+  same way. Same shape, different family — email attributes, no Alpine, no JS — so
+  they are left for their own ticket rather than widened into this one.
+
+- **The Rails guard sweep really is finished now, and a test says so instead of a
+  comment.** Fixing `Studio::S3` left THREE sites still guarding a Rails method
+  call on a bare `defined?(Rails)`: both keyword defaults in
+  `Studio::MailTransport.configure!` (`rails_env:` reading `Rails.env`, `logger:`
+  reading `Rails.logger`) and the developer-desk route guard in
+  `Studio.routes`. All three now ask `Rails.respond_to?` first.
+
+  **THE MAIL TRANSPORT ONE WAS ARMED, not theoretical.** `lib/studio.rb` requires
+  `studio/js_literal` (line 11) BEFORE it requires `studio/mail_transport`
+  (line 25), and loading `js_literal` is what puts the namespace-only `module
+  Rails` in memory. **Not its `require "action_view"`** — measured, that require
+  alone leaves `Rails` UNDEFINED and never loads the sanitizer at all. It is line
+  66, `extend ActionView::Helpers::JavaScriptHelper`: naming anything under
+  `ActionView::Helpers` autoloads the helpers tree, which requires
+  rails-html-sanitizer, and that gem is what ships `module Rails` — with
+  `Rails.methods(false) == []`, no singleton methods at all. The distinction is
+  not pedantry: a file that requires `action_view` and never reaches into
+  `Helpers` does not arm this trap. Measured at this branch's head, a bare
+  `Studio::MailTransport.configure!(env: {}, action_mailer: mailer)` died with
+  `NoMethodError: undefined method 'env' for module Rails`. No shipped app can
+  reach it (every host configures mail from an initializer, where `Rails.env`
+  exists, and all four in-repo callers pass `rails_env:` explicitly) — the cost
+  lands on the next gem unit test that omits the kwarg, which is the same
+  half-hour the `Studio::S3` fix already paid once.
+
+  **THE TWO DEFAULTS ARE SEPARATE STRAGGLERS**, and the first hid the second: Ruby
+  evaluates only the defaults a caller omitted, and `rails_env:` is declared above
+  `logger:`, so a bare call raised out of `Rails.env` and never reached
+  `Rails.logger`. `test/lib/studio/mail_transport_namespace_only_rails_test.rb`
+  supplies one argument and omits the other in each test, so each guard is pinned
+  independently rather than behind its neighbour.
+
+  **THE ROUTE GUARD IS PINNED BY A SCAN, deliberately.** `Studio.routes` only
+  loads inside a real Rails application, where `Rails.env` exists — so the
+  condition under test cannot be constructed where the file loads, and no
+  behavioural test can reach it. `test/lib/studio/rails_guard_sweep_test.rb` is
+  the tree-wide net instead, and it asserts both that it really read the files and
+  that its predicate still flags the original shape, so it cannot pass for free.
+
+  **The completeness claim itself was the other half of the bug.** `lib/studio/s3.rb`
+  and this changelog both said that fix "was the straggler" — while one of the
+  remaining three sat in `lib/studio.rb`, the very file the comment cited as
+  already clean. Both claims are corrected, and the comment now points at the test
+  rather than restating that the sweep is done.
+
 - **The app census in these comments was short by the most important app.** Ten
   sites said this engine is mounted by SIX apps and that THREE of them bundle no
   `solana-studio`. Measured 2026-09-07 by the criterion that reproduces it — a
@@ -362,8 +552,12 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   long before any application does — ships a namespace-only `module Rails` with no
   singleton methods, so that guard reads true and the next call raises
   `NoMethodError: undefined method 'env' for module Rails`. It now asks
-  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` already uses in three
-  places; this was the straggler. No shipped app can reach it — every host boots a
+  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` now uses in FOUR
+  places: the three it already carried (lines 701, 707 and 742) plus the route
+  guard at line 859. **This entry originally called it "the straggler"; that was
+  wrong** — three more sites carried the bare form, line 859 among them, and all
+  three are swept in *The Rails guard sweep really is finished now* above, in this
+  same unreleased block. No shipped app can reach it — every host boots a
   real application — but the engine's own pure-Ruby unit lane can, and it did:
   adding one `require` for a file that needs `action_view` turned an untouched
   `email_catalog_test` red with two errors about email uploads.

data/app/views/components/_sidebar_panel.html.erb

@@ -34,9 +34,19 @@
   <% if id.present? %>id="<%= id %>"<% end %>
   x-cloak
   x-show="<%= open %>"
-  <%= %(#{outside_action.present? ? "@click.outside=\"#{outside_action}\"" : ""}).html_safe %>
-  <%= %(#{escape_action.present? ? "@keydown.escape.window=\"#{escape_action}\"" : ""}).html_safe %>
-  <%= %(#{close_action.present? ? "@turbo:before-cache.window=\"#{close_action}\"" : ""}).html_safe %>
+  <%# THE THREE DISMISSAL HANDLERS, EMITTED BY tag.attributes. Each was built as
+      %(@name="#{action}").html_safe — the attribute's OWN quotes assembled in Ruby
+      and then marked safe, which is the one shape ERB's escaping can never reach. A
+      double quote in any of the three actions closed the attribute and everything
+      after it became markup on the panel's root element.
+
+      The actions stay html_safe: they are Alpine EXPRESSIONS the host wrote (see the
+      @click at the close button below, and `open` above). tag_option's
+      gsub('"', "&quot;") runs on the finished value whether or not it is marked, so
+      the expression reaches Alpine unchanged and cannot end the attribute. %>
+  <%= tag.attributes("@click.outside": outside_action.html_safe) if outside_action.present? %>
+  <%= tag.attributes("@keydown.escape.window": escape_action.html_safe) if escape_action.present? %>
+  <%= tag.attributes("@turbo:before-cache.window": close_action.html_safe) if close_action.present? %>
   x-transition:enter="transition ease-out duration-300"
   x-transition:enter-start="translate-x-full"
   x-transition:enter-end="translate-x-0"

data/app/views/studio/board/_card_shell.html.erb

@@ -32,6 +32,20 @@
     attrs:         Hash of extra root attributes ({ "x-data" => "…", "data-foo" => 1 }),
                    values are HTML-escaped — the rebase seam for a card that carries
                    its own Alpine/data-* on the root.
+
+                   NOT A CANDIDATE FOR THE ASSEMBLED-ATTRIBUTE SWEEP: nothing here is
+                   marked html_safe, so ERB escapes both halves. A double quote in a
+                   VALUE becomes " and the parser decodes it back — the value half
+                   cannot break out. Verified 2026-09-08 by rendering, not reading.
+
+                   THE NAME HALF IS A DIFFERENT QUESTION, and entity decoding is not
+                   what answers it. html_escape does not touch a SPACE, and a space
+                   ENDS an attribute name: a name of `data-y=1 x-init` renders as
+                   `data-y=1 x-init="…"` and the parser builds a real SECOND attribute
+                   — measured, an injected x-init Alpine will run. What makes this seam
+                   safe today is that nothing passes attrs: at all — zero call sites in
+                   studio-engine, turf-monster and mcritchie-studio. Its first caller
+                   owes an allow-list on the NAME before this emits it.
 %>
 <%
   id            = local_assigns.fetch(:id)

data/app/views/studio/mailers/_layered_banner.html.erb

@@ -66,7 +66,25 @@
 <table role="presentation" width="<%= banner.width %>" cellpadding="0" cellspacing="0" border="0"
        style="width:<%= banner.width %>px;border-collapse:collapse;">
   <tr>
-    <td <%= %(background="#{banner.background_url}").html_safe if banner.background_url.present? %>
+    <%# THE BACKGROUND ATTRIBUTE, EMITTED BY tag.attributes. It was assembled as a
+        Ruby string carrying its OWN quotes and then marked html_safe, which is the
+        one shape ERB's attribute escaping can never reach.
+
+        MEASURED on the unrepaired template, not reasoned about: a double quote in
+        background_url closed the attribute, and the browser read the remainder of
+        the tag as markup. The td came back carrying attributes named `quote"`,
+        `\`, `<` and `script`, and LOST bgcolor, width, height, valign and style
+        outright. That is worse than an injected attribute — the cell loses the
+        fallback colour and both dimensions the whole banner is laid out from, so
+        the failure is a wrecked email, not just a tainted one.
+
+        The URL is CONTENT, not code, so it is passed UNMARKED and takes the full
+        escaping a content attribute is owed. That also closes the latent half: a
+        bare ampersand in a signed-URL query string used to reach the client as the
+        start of an entity. Contrast the Alpine handlers elsewhere in this engine,
+        which stay html_safe precisely because they are expressions the host wrote
+        on purpose. The rule follows what the value IS, not which file it is in. %>
+    <td <%= tag.attributes(background: banner.background_url) if banner.background_url.present? %>
         bgcolor="<%= Studio.theme_primary %>"
         width="<%= banner.width %>" height="<%= banner.height %>" valign="middle"
         style="width:<%= banner.width %>px;height:<%= banner.height %>px;<%= "background-image:url(#{banner.background_url});background-size:cover;background-position:center;background-repeat:no-repeat;" if banner.background_url.present? %>">
@@ -97,7 +115,24 @@
                     contrast case the scrim exists for, in the one client that
                     cannot be spot-checked. Every other client honours the rgba
                     declaration and overrides the flat attribute. %>
-                <%= %(bgcolor="#{banner.scrim_solid_hex}").html_safe if banner.scrim_opacity.positive? %>
+                <%# SAME SHAPE AS THE background ABOVE, AND — stated honestly — NOT
+                    THE SAME LIVE DEFECT. This one was assembled with its own quotes
+                    and marked html_safe too, but the value cannot currently carry a
+                    quote to exploit it: scrim_solid_hex formats three integers the
+                    model has already clamped to 0-255, so it returns a hash sign
+                    and six hex digits for EVERY input. Checked by rendering rather
+                    than by reading, which is the only way that claim is worth
+                    anything: a scrim of `0.5" onload="alert(1)` still came back as
+                    the hex #4C4860, with all five of this cell's attributes intact.
+
+                    It is converted anyway because the SHAPE is the hazard. Safety
+                    here rests on an implementation detail one refactor away from
+                    changing — a scrim that ever learned to accept a named colour
+                    would reopen it silently — and leaving a hand-assembled
+                    attribute beside a repaired one is how the wrong pattern gets
+                    copied next. Same encoder, same reasoning, zero byte movement
+                    for a hex triplet. %>
+                <%= tag.attributes(bgcolor: banner.scrim_solid_hex) if banner.scrim_opacity.positive? %>
                 style="height:<%= banner.height %>px;padding:0 <%= side_padding %>px;<%= "background-color:rgba(24,16,64,#{banner.scrim_opacity});" if banner.scrim_opacity.positive? %>">
               <% if preview || banner.header.present? %>
                 <p<%= hook.call("header") %> style="margin:0 0 <%= gap_after_header %>px;font-family:Montserrat,'Segoe UI',Helvetica,Arial,sans-serif;font-size:<%= header_size %>px;line-height:<%= header_line %>px;font-weight:700;color:#ffffff;">

data/app/views/studio/modals/blocks/_leveling_activity.html.erb

@@ -138,10 +138,23 @@
           <% if input %>
             <input type="<%= input_type %>" x-model="value" class="input-field w-full"
                    placeholder="<%= placeholder %>"
-                   <%= "minlength=\"#{min_length}\"".html_safe if min_length.to_i.positive? %>
-                   <%= "maxlength=\"#{max_length}\"".html_safe if max_length.present? %>
-                   <%= "pattern=\"#{pattern}\"".html_safe if pattern.present? %>
-                   <%= "title=\"#{pattern_title}\"".html_safe if pattern_title.present? %>
+                   <%# FOUR CONSTRAINT ATTRIBUTES, ENCODED AND — unlike the Alpine
+                       handlers in this file — DELIBERATELY NOT html_safe. Each was
+                       assembled as `attr="#{value}"`.html_safe, which handed ERB a
+                       String it must not touch, so a double quote in any of the four
+                       closed the attribute and the rest became markup. minlength
+                       looks numeric and is not: only the GUARD calls .to_i, the
+                       interpolation splices the local raw.
+
+                       These are CONTENT, not code — a length, a regex, a tooltip
+                       sentence — so they take the full escaping a content attribute
+                       is owed and the parser decodes it back. That also repairs a
+                       second latent bug the marking carried: a bare & in a title or
+                       pattern used to reach the browser as the start of an entity. %>
+                   <%= tag.attributes(minlength: min_length) if min_length.to_i.positive? %>
+                   <%= tag.attributes(maxlength: max_length) if max_length.present? %>
+                   <%= tag.attributes(pattern: pattern) if pattern.present? %>
+                   <%= tag.attributes(title: pattern_title) if pattern_title.present? %>
                    autofocus>
           <% end %>
           <% if consent_label.present? %>
@@ -180,7 +193,12 @@
       </div>
 
       <% if next_label.present? && next_open.present? %>
-        <button type="button" @click="<%= next_open %>" class="btn btn-primary btn-lg w-full">
+        <%# next_open is html_safe (:102) because it is a developer-authored Alpine
+            EXPRESSION — so ERB steps aside here and a double quote in it used to
+            close the @click attribute outright. tag.attributes writes the quotes and
+            entity-encodes any of its own that appear in the value, leaving the
+            expression otherwise byte-identical. %>
+        <button type="button" <%= tag.attributes("@click": next_open) %> class="btn btn-primary btn-lg w-full">
           <%= next_label %>
         </button>
       <% end %>

data/app/views/studio/modals/blocks/_processing_card.html.erb

@@ -41,8 +41,27 @@
   # JS sides of the convention agree on the same floor.
   min_duration = local_assigns[:min_duration] || 1400
   resolve_expr = local_assigns[:resolve_expr]
+
+  # THE AUTO-RESOLVE PAIR, ENCODED RATHER THAN ASSEMBLED. This line used to build
+  # ` x-data="{}" x-init="…"` as one html_safe String, quotes and all, so ERB had
+  # nothing left to escape: a double quote in EITHER local — min_duration as much as
+  # resolve_expr, since min_duration is interpolated raw and only its GUARD calls
+  # .to_i — closed the attribute and turned the remainder into markup.
+  #
+  # tag.attributes writes the quotes instead. The x-init value stays html_safe
+  # because it is CODE the caller handed us, and tag_option's unconditional
+  # gsub('"', """) still fires on an html_safe value, so the JS arrives intact
+  # and the attribute cannot end early. safe_join supplies the separating space
+  # without a second hand-marked String.
+  resolve_attrs =
+    if resolve_expr
+      safe_join([" ", tag.attributes(
+        "x-data": "{}",
+        "x-init": "window.StudioModals.holdAtLeast(#{min_duration}).then(() => { #{resolve_expr} })".html_safe
+      )])
+    end
 %>
-<div class="text-center py-6"<%= " x-data=\"{}\" x-init=\"window.StudioModals.holdAtLeast(#{min_duration}).then(() => { #{resolve_expr} })\"".html_safe if resolve_expr %>>
+<div class="text-center py-6"<%= resolve_attrs %>>
   <div class="mx-auto <%= spinner_class %> rounded-full border-<%= color %>/30 border-t-<%= color %> animate-spin mb-5"></div>
   <% if local_assigns[:title_key] %>
     <p class="text-base font-bold text-heading mb-1" x-text="<%= title_key %>"></p>

data/app/views/studio/modals/blocks/_success_card.html.erb

@@ -122,9 +122,26 @@
   init_calls = []
   init_calls << "fireConfetti()" if fire_confetti
   init_calls << "startCountdown(#{local_assigns[:auto_redirect_url_key]})" if has_redirect
+  init_expr = init_calls.join("; ").html_safe
 %>
-<div x-data="<%= data_attr %>"
-     <%= "x-init=\"#{init_calls.join('; ')}\"".html_safe if init_calls.any? %>
+<%# BOTH ALPINE ATTRIBUTES ARE EMITTED BY tag.attributes, NOT ASSEMBLED BY HAND.
+    Each carries Ruby-built JS that splices a host local — redirect_secs into the
+    x-data object, auto_redirect_url_key into startCountdown() — and both blobs are
+    html_safe, because they are CODE and the caller is owed the JS it wrote.
+
+    THAT MARKING USED TO BE THE HOLE. html_safe tells ERB to step aside, so a double
+    quote in either local closed the ATTRIBUTE and everything after it became markup:
+    x-data="{ _remaining: it's a " quote" …  — measured, not reasoned.
+
+    tag.attributes closes it without touching the JS. ActionView's tag_option runs
+    gsub('"', "&quot;") on the finished value UNCONDITIONALLY, outside the escape
+    branch it skips for an html_safe string (actionview tag_helper.rb, the line after
+    the escape ternary), so the attribute cannot be closed early and the HTML parser
+    decodes the entity back before Alpine ever sees it. Every other character reaches
+    the attribute byte-for-byte as it does today. blocks/_rail_row:112 is the same
+    move on a whole tag and its comment carries the rest of the reasoning. %>
+<div <%= tag.attributes("x-data": data_attr) %>
+     <%= tag.attributes("x-init": init_expr) if init_calls.any? %>
      class="text-center py-6">
 
   <%# Icon — emoji takes priority over the default circular green check %>

data/app/views/style/_modals.html.erb

@@ -468,14 +468,6 @@
                     resolve_expr: "$store.dsModals.close()" %></div>
         </template>
 
-        <%# wallet-setup — registered here with the other cards this page opens.
-            Its CARD lives in the Web3 section (it is about getting a wallet); the
-            3-of-3 pill it renders is the HOST's onboarding chain position, which
-            is not this page's business. The Onboarding section that used to own
-            it was folded into Profile on 2026-08-24. %>
-        <template x-if="$store.dsModals.current().id === 'wallet-setup'">
-          <div><%= render "style/modals/wallet_setup" %></div>
-        </template>
 
         <%# --- Batch 3: the modals that had no card on EITHER page --- %>
         <template x-if="$store.dsModals.current().id === 'it-begins'">
@@ -504,21 +496,12 @@
         <template x-if="$store.dsModals.current().id === 'ds-onramp-hub'">
           <div><%= render "style/modals/ds_onramp_hub" %></div>
         </template>
-        <template x-if="$store.dsModals.current().id === 'ds-buy-entry-token'">
-          <div><%= render "style/modals/ds_buy_entry_token" %></div>
-        </template>
-        <template x-if="$store.dsModals.current().id === 'ds-cdp-ramp'">
-          <div><%= render "style/modals/ds_cdp_ramp" %></div>
-        </template>
         <template x-if="$store.dsModals.current().id === 'ds-newsletter-success'">
           <div><%= render "style/modals/ds_newsletter_success" %></div>
         </template>
         <template x-if="$store.dsModals.current().id === 'rate-limit-general'">
           <div><%= render "style/modals/rate_limit_general" %></div>
         </template>
-        <template x-if="$store.dsModals.current().id === 'wallet-changed'">
-          <div><%= render "style/modals/wallet_changed" %></div>
-        </template>
 
         <%# --- Newsletter exit + the off-page quest celebration --- %>
         <template x-if="$store.dsModals.current().id === 'quest-success'">
@@ -534,9 +517,6 @@
         </template>
 
         <%# --- Web3 --- %>
-        <template x-if="$store.dsModals.current().id === 'cosign-rejected'">
-          <div><%= render "style/modals/cosign_rejected" %></div>
-        </template>
         <%# Both web3 sign-in cards render from SOLANA-STUDIO, and both are the
             REAL shipped partials rather than style-guide forks — the same files
             turf-monster renders in production, so what is reviewed here IS the
@@ -1187,9 +1167,9 @@
           listed for reference but <strong>cannot be opened here</strong>. Nothing
           registers them, so a trigger would open an empty panel.
         <% end %>
-        The cards run in the order a player meets them &mdash; <strong>get a wallet,
-        prove it, spend from it</strong>: Connect wallet &rarr; Setup Wallet &rarr;
-        the two Sign Wallet states &rarr; Processing &rarr; success or error &rarr;
+        The cards run in the order a player meets them &mdash; <strong>connect a
+        wallet, prove it, spend from it</strong>: Connect wallet &rarr; the two
+        Sign Wallet states &rarr; Processing &rarr; success or error &rarr;
         top-up &rarr; Entry confirmed. Inside that, <strong>Connect Wallet &rarr;
         Processing on-chain transaction &rarr; On-chain success</strong> is a
         <strong>walked flow</strong> and the live card <strong>glows</strong>,
@@ -1212,14 +1192,7 @@
         <strong>standard web3 auth button</strong>: a wallet row (brand mark, the
         wallet&rsquo;s own name, Installed badge, chevron) rather than a filled
         CTA, glowing via <code class="font-mono text-2xs">pulse-cta</code> because
-        it is the one thing to press. Do not confuse them with <strong>Setup
-        Wallet</strong>, immediately before them: that one asks an account to
-        <strong>get</strong> a wallet, these ask an account to
-        <strong>prove</strong> the one it already has &mdash; opposite populations
-        (<code class="font-mono text-2xs">WalletSetupPolicy</code> exits at its own
-        step 1 for an account that holds a wallet), so no user ever meets both.
-        They sit next to each other anyway, because the pair is easiest to keep
-        straight when you can read them side by side.
+        it is the one thing to press.
       </p>
     </div>
     <%# ONE ordered run, read left to right as a player meets it: get a wallet,
@@ -1261,30 +1234,6 @@
           section's business.
           ONE card with a "Wallet detected" toggle rather than two cards sharing a
           modal id: the two Sign Wallet cards below are what that shape costs. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Setup Wallet",
-            reference: %(the "Set up your wallet" card (style/modals/_wallet_setup) — how an account with NO wallet gets one, and the host's third onboarding step (it renders a 3-of-3 pill, which is the host's chain position, not this section's). An APP-SPECIFIC flow: the engine owns only the chrome (shell, progress_pill, wallet_brand_sprite) and the house wallet-row idiom, while extension detection, the 90-second walkthrough video, the Detailed Guide route and the managed-wallet fallback stay in the host (turf-monster's own is ~576 lines). Toggle "Wallet detected" to swap the row between INSTALL and Installed. NOTE it is the OPPOSITE population to the two Sign Wallet cards immediately below — WalletSetupPolicy exits at its own step 1 for an account that already holds a wallet, so no user ever meets both. Open with $store.dsModals.open('wallet-setup', { detected: false })),
-            card_data: "opts: { detected: false }",
-            toggles:   [{ model: "opts.detected", label: "Wallet detected" }],
-            open_expr: "$store.dsModals.open('wallet-setup', { detected: opts.detected })",
-            glow_when: ds_glow.call("wallet-setup"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2">
-          <span class="block h-2 w-20 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <%# the 3-of-3 pill, filled — the whole reason this card sits here %>
-          <span class="flex gap-1">
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-          </span>
-          <span class="flex items-center gap-1.5 h-7 w-full rounded-lg border px-1.5" style="border-color: var(--color-border-strong)">
-            <span class="w-4 h-4 rounded shrink-0" style="background: var(--color-primary)"></span>
-            <span class="block h-1.5 w-8 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <%# the walkthrough placeholder, the card's second half %>
-          <span class="block w-full rounded" style="height: 1.6rem; background: var(--color-text); opacity: .10"></span>
-        </div>
-      <% end %>
 
       <%# SIGN WALLET — the web2-session-on-a-wallet-account card. NOT part of the
           walk above: that walk is one on-chain transaction, this is an AUTH state
@@ -1411,20 +1360,6 @@
           no — refusing to co-sign because the transaction it was handed did not
           match the entry it prepared. They sit together because a reviewer
           reading either alone would not know the other existed. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Co-sign refused",
-            reference: %(the "Transaction not signed" card (style/modals/_cosign_rejected) — turf-monster's modals/_cosign_rejected, opened when POST confirm_onchain_entry answers 422 with code tx_rejected: the server refused to co-sign because the submitted transaction did not match the entry it had prepared. APP-SPECIFIC — the engine owns no entry preparation, no co-signing and no verdict; it lends card_header and nothing else. THE COPY IS DELIBERATELY VAGUE and should stay that way: good actors never see this card (it fires on a tampered or mismatched transaction), so naming WHICH server-side check failed would help an attacker probe the validation. What the copy does commit to is the part the one honest user needs — nothing was submitted, the funds are safe. Open with $store.dsModals.open('cosign-rejected')),
-            open_expr: "$store.dsModals.open('cosign-rejected')",
-            glow_when: ds_glow.call("cosign-rejected"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2">
-          <div class="text-2xl leading-none">&#128737;&#65039;</div>
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="block h-1.5 w-full rounded" style="background: var(--color-text); opacity: .3"></span>
-          <span class="block h-1.5 w-28 mx-auto rounded" style="background: var(--color-text); opacity: .3"></span>
-          <span class="block h-5 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
 
       <%# Wallet deposit — standalone top-up card (not part of the walk). %>
       <%= render layout: "style/modal_specimen", locals: {
@@ -1486,41 +1421,7 @@
         </div>
       <% end %>
 
-      <%# ds-buy-entry-token — reached with a lineup picked and no way to pay. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Buy entry token",
-            reference: %(the entry-token purchase (style/modals/_ds_buy_entry_token) — turf-monster's modals/_buy_entry_token, built from blocks/_close_x and two blocks/_rail_row. Reached when a player has picked a lineup and has no way to pay for it, which is why the copy says the lineup is SAVED: losing their picks is the one thing they are afraid of at that moment. The ranking is a PRODUCT decision rather than a visual one — Coinflow leads and carries the "New" badge because it mints a spendable entry token directly, the shortest path from here to being in the contest, while Stripe swaps into the auth wizard's tokens picker, the older and longer path, and defers. Open with $store.dsModals.open('ds-buy-entry-token')),
-            open_expr: "$store.dsModals.open('ds-buy-entry-token')",
-            glow_when: ds_glow.call("ds-buy-entry-token"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2">
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="flex items-center gap-1.5 rounded-md p-1.5" style="border: 2px solid var(--color-primary)">
-            <span class="block h-4 w-4 rounded" style="background: var(--color-cta)"></span>
-            <span class="block h-1.5 flex-1 rounded" style="background: var(--color-text); opacity: .3"></span>
-          </span>
-          <span class="flex items-center gap-1.5 rounded-md p-1.5 border border-subtle">
-            <span class="block h-4 w-4 rounded" style="background: var(--color-text); opacity: .25"></span>
-            <span class="block h-1.5 flex-1 rounded" style="background: var(--color-text); opacity: .18"></span>
-          </span>
-        </div>
-      <% end %>
 
-      <%# ds-cdp-ramp — ONE of thirteen states, and the card says so. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Coinbase ramp (preflight)",
-            reference: %(the Coinbase ramp's BUY PREFLIGHT (style/modals/_ds_cdp_ramp) — turf-monster's modals/_cdp_ramp. DELIBERATELY PARTIAL: that modal is a TWO-FLOW step machine (buy and cash-out) across THIRTEEN states — preflight, opening, waiting, awaiting-cdp, send, settling and the rest — and this cards exactly one of them, the buy preflight, which is the state both funding cards hand off to and therefore the only one a player reaches without already being mid-flow. The other twelve are uncarded BY DECISION (operator, 2026-08-26), which is a different thing from an oversight — a cabinet that shows one state of a thirteen-state machine without admitting it teaches a reader that the machine is simpler than it is. /tasks/port-cdp-ramp-specimen holds the full state map if that decision reverses. Open with $store.dsModals.open('ds-cdp-ramp')),
-            open_expr: "$store.dsModals.open('ds-cdp-ramp')",
-            glow_when: ds_glow.call("ds-cdp-ramp"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2 relative">
-          <span class="absolute top-1 right-2 text-secondary leading-none">&times;</span>
-          <span class="block h-2 w-28 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="block h-1.5 w-full rounded" style="background: var(--color-text); opacity: .12"></span>
-          <span class="block h-1.5 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .12"></span>
-          <span class="block h-4 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
 
       <%# Entry confirmed — the GENERIC web3 celebration (tx link + heading + drain
           CTA). seedsEarned: 0 so no seeds bar even where leveling is on: this card
@@ -1567,30 +1468,6 @@
         </div>
       <% end %>
 
-      <%# wallet-changed — the extension switched accounts underneath the session.
-          Both addresses are shown because recognising your own is the only way to
-          tell a deliberate switch from an accident. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Wallet changed",
-            reference: %(the Web3 "Wallet changed" reconciliation (style/modals/_wallet_changed) — turf-monster's modals/_wallet_changed, fired when the person switches accounts inside their wallet extension while signed in. Composes the engine's blocks/_card_header; the switch itself belongs to turf's wallet store (continueSwitch) and the engine owns no wallet. Nothing is broken — but the session and the extension now disagree about who this is, and every on-chain action from here would use an identity the page is not showing. So it prints BOTH addresses, truncated the Solana way, because recognising your own is the one check the app cannot make for you. Continuing re-derives a session against the new wallet, which is a round trip, so the button carries a busy state rather than looking dead. Open with $store.dsModals.open('wallet-changed', { currentAddress: '…', newAddress: '…' })),
-            open_expr: "$store.dsModals.open('wallet-changed', { currentAddress: '7xKpDemoSignedInWallet9JZ2Q', newAddress: '9mQtDemoSwitchedWalletLd4V' })",
-            glow_when: ds_glow.call("wallet-changed"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2">
-          <div class="text-2xl leading-none">🔀</div>
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <%# the two truncated addresses — the comparison IS the card %>
-          <span class="flex items-center justify-between gap-2">
-            <span class="block h-1.5 w-10 rounded" style="background: var(--color-text); opacity: .18"></span>
-            <span class="block h-1.5 w-12 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <span class="flex items-center justify-between gap-2">
-            <span class="block h-1.5 w-10 rounded" style="background: var(--color-text); opacity: .18"></span>
-            <span class="block h-1.5 w-12 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <span class="block h-5 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
     </div>
   </section>
 

data/lib/studio/js_literal.rb

@@ -43,6 +43,39 @@ module Studio
   # safe). The name says `in_attribute` so that the next person reaching for this in
   # a <script> has to stop and notice the difference.
   #
+  # AND IT IS THE WRONG REPAIR FOR AN ATTRIBUTE THE PARTIAL ASSEMBLES ITSELF —
+  # `<%= "x-init=\"#{expr}\"".html_safe %>`, where the attribute's OWN QUOTES are
+  # built in Ruby. Nothing here helps: escaping the value would break the Alpine
+  # EXPRESSION the caller deliberately handed the engine, and the marking has already
+  # told ERB to stand down, so a double quote closes the ATTRIBUTE and the remainder
+  # is parsed as MARKUP. The repair is to stop writing the quotes and let ActionView
+  # write them — `tag.attributes("x-init": expr.html_safe)` — because tag_option
+  # quote-escapes the finished value UNCONDITIONALLY, outside the escape branch it
+  # skips for a marked String. The expression survives byte-for-byte and cannot end
+  # the attribute. modals/blocks/_rail_row:112 and components/_sidebar_panel carry
+  # the worked examples; test/lib/studio/attribute_encoding_contract_test.rb pins the
+  # ActionView behaviour the whole thing rests on.
+  #
+  # THE MARKING IS A JUDGEMENT ABOUT THE VALUE, NOT ABOUT THE FILE, and it is the
+  # half of that repair most easily got backwards. `tag.attributes` takes both kinds
+  # and does the right thing with each:
+  #
+  #   EXPRESSION (an Alpine handler, a JS number, a store path) — pass it MARKED.
+  #     Only the double quotes move, so the code the caller deliberately handed the
+  #     engine still parses. Escaping it would be corruption of the same kind the
+  #     script-body note above describes.
+  #   CONTENT (a URL, a colour, a length, a regex, a tooltip sentence) — pass it
+  #     UNMARKED and let it take the full escaping a content attribute is owed. The
+  #     parser hands the value back decoded, and a bare `&` stops reaching the client
+  #     as the start of an entity.
+  #
+  # Both repairs live in this engine and neither is the default: the four input
+  # constraints in modals/blocks/_leveling_activity are the content case beside the
+  # handlers in the same file, and studio/mailers/_layered_banner is the content case
+  # in an EMAIL, where the consumer is a mail client rather than a browser and the
+  # margin for a malformed attribute is smaller. Choosing by which file a value sits
+  # in, rather than by what the value is, gets one of those two wrong every time.
+  #
   # AND IT IS THE WRONG REPAIR FOR IDENTIFIER POSITION. A local spliced in as a bare
   # NAME — `$store.<%= modal_store %>.close()` — must be VALIDATED, never escaped:
   # escape_javascript also escapes `$`, so a legitimate store name like `dsModals$2`

data/lib/studio/mail_transport.rb

@@ -6,9 +6,9 @@ module Studio
 
     class << self
       def configure!(env: ENV,
-                     rails_env: defined?(Rails) ? Rails.env : "development",
+                     rails_env: defined?(Rails) && Rails.respond_to?(:env) ? Rails.env : "development",
                      action_mailer: defined?(ActionMailer) ? ActionMailer::Base : nil,
-                     logger: defined?(Rails) ? Rails.logger : nil,
+                     logger: defined?(Rails) && Rails.respond_to?(:logger) ? Rails.logger : nil,
                      mailer_from: defined?(Studio) && Studio.respond_to?(:mailer_from) ? Studio.mailer_from : nil,
                      resend_loader: method(:load_resend!),
                      resend_configurer: method(:configure_resend!))

data/lib/studio/s3.rb

@@ -128,10 +128,18 @@ module Studio
         # before any Rails APPLICATION does — defines a namespace-only `module
         # Rails` with no singleton methods on it. Against that, a bare
         # `defined?(Rails)` reads TRUE and the very next call dies with
-        # NoMethodError: undefined method `env` for module Rails. lib/studio.rb
-        # already spells the guard this way in three places; this was the
-        # straggler, and it turned an unrelated green suite red the first time a
-        # unit test pulled action_view in.
+        # NoMethodError: undefined method `env` for module Rails. It turned an
+        # unrelated green suite red the first time a unit test pulled action_view
+        # in.
+        #
+        # THIS WAS NOT THE LAST ONE, though it was described that way when it
+        # landed. Three sites still carried the bare form afterwards — both
+        # keyword defaults in lib/studio/mail_transport.rb and the developer-desk
+        # route guard in lib/studio.rb — and the claim that the sweep was finished
+        # is how they survived a second review. The whole tree is swept now, and
+        # test/lib/studio/rails_guard_sweep_test.rb is what keeps it that way; do
+        # not restate completeness here, because a comment cannot notice the next
+        # straggler and that test can.
         defined?(Rails) && Rails.respond_to?(:env) && Rails.env&.production? ? "production" : "dev"
       end
     end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.74.0"
+  VERSION = "0.74.2"
 end

data/lib/studio.rb

@@ -856,7 +856,7 @@ module Studio
       # Developer-desk tools. Drawn outside production, and each controller
       # re-checks Studio.local_tool_enabled? per request (loopback only) — the
       # route being absent is the outer gate, not the only one.
-      unless defined?(Rails) && Rails.env.production?
+      unless defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
         get "_studio/local_emails", to: "studio/local_emails#index", as: :studio_local_emails
         get "_studio/local_review", to: "studio/local_reviews#show",  as: :studio_local_review
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.0
+  version: 0.74.2
 platform: ruby
 authors:
 - Alex McRitchie
@@ -521,9 +521,6 @@ files:
 - app/views/style/modals/_age_gate.html.erb
 - app/views/style/modals/_auth.html.erb
 - app/views/style/modals/_birthday.html.erb
-- app/views/style/modals/_cosign_rejected.html.erb
-- app/views/style/modals/_ds_buy_entry_token.html.erb
-- app/views/style/modals/_ds_cdp_ramp.html.erb
 - app/views/style/modals/_ds_close_x.html.erb
 - app/views/style/modals/_ds_newsletter_success.html.erb
 - app/views/style/modals/_ds_onramp_hub.html.erb
@@ -539,11 +536,9 @@ files:
 - app/views/style/modals/_rate_limit_general.html.erb
 - app/views/style/modals/_unsubscribe_confirm.html.erb
 - app/views/style/modals/_unsubscribe_goodbye.html.erb
-- app/views/style/modals/_wallet_changed.html.erb
 - app/views/style/modals/_wallet_connect.html.erb
 - app/views/style/modals/_wallet_connect_slot.html.erb
 - app/views/style/modals/_wallet_deposit.html.erb
-- app/views/style/modals/_wallet_setup.html.erb
 - app/views/theme_settings/edit.html.erb
 - app/views/user_mailer/magic_link.html.erb
 - app/views/user_mailer/magic_link.text.erb

data/app/views/style/modals/_cosign_rejected.html.erb

@@ -1,36 +0,0 @@
-<%#
-  Living style guide specimen — the "we did not co-sign that" refusal.
-
-  APP-SPECIFIC FLOW, engine chrome only. What this card names is turf-monster's:
-  POST confirm_onchain_entry answered 422 with code `tx_rejected`, meaning the
-  server refused to co-sign because the submitted transaction did not match the
-  entry it had prepared. The engine owns no entry preparation, no co-signing and
-  no verdict — it lends `blocks/_card_header` and nothing else, exactly as
-  style/modals/_entry_tokens borrows chrome for a flow the engine does not own.
-
-  WHY THE COPY IS VAGUE, and why a reviewer should not "improve" it: good actors
-  never see this card. It fires on a tampered or mismatched transaction, so the
-  copy is deliberately reassuring and deliberately silent about WHICH
-  server-side check failed — naming the check would help an attacker probe the
-  validation. The reassurance ("nothing was submitted and your funds are safe")
-  is the part that matters to the one honest user who ever hits it.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div x-data="{}">
-  <%= render "studio/modals/blocks/card_header",
-        icon_emoji: "🛡️",
-        title: "Transaction not signed" do %>
-    <p class="text-sm text-body">
-      For your security we didn&rsquo;t co-sign this transaction &mdash; it
-      didn&rsquo;t match the entry we prepared, so nothing was submitted and your
-      funds are safe. Please close this and try entering again. If it keeps
-      happening, <span class="text-primary">contact support</span>.
-    </p>
-  <% end %>
-
-  <%# One button, because there is exactly one thing to do. The host also closes
-      on escape and click-outside; this card is dismissible by design. %>
-  <button type="button" @click="$store.dsModals.close()"
-          class="btn btn-primary btn-lg w-full">Got it</button>
-</div>

data/app/views/style/modals/_ds_buy_entry_token.html.erb

@@ -1,40 +0,0 @@
-<%#
-  Living style guide specimen — Buy an Entry Token.
-
-  APP-SPECIFIC flow, engine chrome throughout (blocks/_close_x + two
-  blocks/_rail_row). Reached when a player has picked a lineup and has no way to
-  pay for it, which is why the copy says the lineup is SAVED: the one thing they
-  are afraid of at that moment is losing their picks.
-
-  TWO RAILS, RANKED, and the ranking is a product decision rather than a visual
-  one. Coinflow leads and carries the "New" badge because it mints a spendable
-  entry token directly — it is the shortest path from here to being in the
-  contest. Stripe still swaps into the auth wizard's tokens picker, which is the
-  older, longer path, so it defers.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div class="relative">
-  <%= render "studio/modals/blocks/close_x", modal_store: "dsModals" %>
-
-  <div class="text-center pt-1 mb-2">
-    <h3 class="text-heading font-bold text-lg leading-tight">Buy an Entry Token</h3>
-  </div>
-  <p class="text-xs text-body mb-4 text-center">
-    1 token = 1 contest entry. Your lineup is saved &mdash; pick how to pay.
-  </p>
-
-  <div class="space-y-3">
-    <%= render "studio/modals/blocks/rail_row",
-          emphasis: :primary, on_click: "$store.dsModals.close()",
-          icon_label: "CF", icon_bg: "#14B8A6",
-          title: "Coinflow · $19", subtitle: "Buy 1 entry with a card · fastest",
-          badge: "New", data: { ds_rail: "coinflow" } %>
-
-    <%= render "studio/modals/blocks/rail_row",
-          on_click: "$store.dsModals.close()",
-          icon_label: "S", icon_bg: "#635BFF",
-          title: "Card · $19", subtitle: "Buy an entry token with a card",
-          data: { ds_rail: "stripe" } %>
-  </div>
-</div>

data/app/views/style/modals/_ds_cdp_ramp.html.erb

@@ -1,41 +0,0 @@
-<%#
-  Living style guide specimen — the Coinbase ramp, BUY PREFLIGHT only.
-
-  DELIBERATELY PARTIAL, and saying so is the point. turf's modals/_cdp_ramp is a
-  TWO-FLOW step machine — buy and cash-out — across thirteen states: preflight,
-  opening, waiting, awaiting-cdp, send, settling and the rest. This cards ONE of
-  them: the buy preflight, which is the state both funding cards hand off to and
-  therefore the only one a player reaches without already being mid-flow.
-
-  The other twelve are uncarded BY DECISION (operator, 2026-08-26: minimal
-  migration is fine here). That is a different thing from an oversight, and the
-  reference blurb on this card says so, because a cabinet that shows one state of
-  a thirteen-state machine without admitting it teaches a reader that the machine
-  is simpler than it is. /tasks/port-cdp-ramp-specimen holds the full state map
-  if the decision reverses.
-
-  APP-SPECIFIC, engine chrome: blocks/_close_x plus the centred title this whole
-  funding family uses.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div class="relative">
-  <%= render "studio/modals/blocks/close_x", modal_store: "dsModals" %>
-
-  <div class="text-center pt-1 mb-3">
-    <h3 class="text-heading font-bold text-lg leading-tight">Buy USDC with Coinbase</h3>
-  </div>
-
-  <p class="text-xs text-body mb-4 text-center">
-    You&rsquo;ll finish the purchase in a Coinbase tab. We&rsquo;ll update here
-    automatically once the USDC lands in your wallet.
-  </p>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="btn btn-primary btn-lg w-full">Continue to Coinbase</button>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">
-    Not now
-  </button>
-</div>

data/app/views/style/modals/_wallet_changed.html.erb

@@ -1,70 +0,0 @@
-<%#
-  Living style guide specimen — the wallet switched underneath the session.
-
-  APP-SPECIFIC, engine chrome only (`blocks/_card_header`). The switch itself is
-  the host's: turf's wallet store owns continueSwitch, and the engine owns no
-  wallet.
-
-  THE SITUATION IT NAMES: the person changed accounts inside their wallet
-  extension while signed in here. Nothing is broken and nobody did anything
-  wrong — but the session and the extension now disagree about who this is, and
-  every on-chain action from here would use an identity the page is not showing.
-
-  SO IT SHOWS BOTH ADDRESSES, truncated the way every Solana UI truncates them
-  (4 leading, 4 trailing). Recognising your own address is the only way to tell a
-  deliberate switch from an accident, and it is the one check the app cannot make
-  for them.
-
-  The busy state matters: continuing re-derives a session against the new wallet,
-  which is a round trip. Without it the button looks dead and gets double-clicked.
-
-  Single root; x-data single-quoted throughout.
-%>
-<div x-data="{
-       busy: false,
-       get props() { var c = $store.dsModals.current(); return (c && c.props) || {} },
-       short(addr) {
-         addr = addr || '';
-         return addr.length > 12 ? (addr.slice(0, 6) + '...' + addr.slice(-4)) : addr;
-       },
-       go() {
-         if (this.busy) return;
-         this.busy = true;
-         var s = this;
-         // Demo: the real card awaits the host's wallet store. Hold briefly so
-         // the pending state is visible rather than skipped.
-         setTimeout(function () { s.busy = false; $store.dsModals.close(); }, 600);
-       }
-     }">
-  <%= render "studio/modals/blocks/card_header",
-        icon_emoji: "🔀",
-        title: "Wallet changed" do %>
-    <p class="text-sm text-body">
-      Your wallet is now on a different account than the one you signed in with.
-      Continue with the new one, or switch back in your wallet.
-    </p>
-  <% end %>
-
-  <div class="rounded-lg border border-subtle bg-surface-alt p-3 mb-4 text-sm">
-    <div class="flex items-center justify-between gap-3">
-      <span class="text-secondary">Signed in as</span>
-      <span class="font-mono text-heading" x-text="short(props.currentAddress) || '7xKp...JZ2Q'"></span>
-    </div>
-    <div class="flex items-center justify-between gap-3 mt-2">
-      <span class="text-secondary">Wallet now</span>
-      <span class="font-mono text-heading" x-text="short(props.newAddress) || '9mQt...Ld4V'"></span>
-    </div>
-  </div>
-
-  <button type="button" @click="go()" :disabled="busy"
-          class="btn btn-primary btn-lg w-full disabled:opacity-60">
-    <span x-show="!busy">Continue with this wallet</span>
-    <span x-show="busy" class="inline-flex items-center justify-center gap-2" style="display: none;">
-      <span class="spinner" aria-hidden="true"></span>
-      Switching&hellip;
-    </span>
-  </button>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">Not now</button>
-</div>

data/app/views/style/modals/_wallet_setup.html.erb

@@ -1,112 +0,0 @@
-<%#
-  Living style guide specimen — the onboarding chain's LAST step, "Set up your
-  wallet" (chain step 3 of 3).
-
-  This documents an APP-SPECIFIC flow. The engine deliberately does NOT own it:
-  turf-monster's app/views/modals/_wallet_setup.html.erb is ~576 lines of
-  extension-presence polling, a hosted 90-second walkthrough video, a Detailed
-  Guide route that resolves at render time, and a managed-wallet fallback for
-  grandfathered web2 accounts. None of that is shareable — it is one app's
-  answer to "how do we get this person a wallet".
-
-  What IS shared, and all this specimen composes, is the CHROME:
-    studio/modals/blocks/shell               — title row + close
-    studio/modals/blocks/progress_pill       — the 3-of-3 chain position
-    studio/modals/blocks/wallet_brand_sprite — inline brand marks, no per-app PNG
-  plus the house wallet-row idiom (brand tile, the wallet's own name, status on
-  the right, chevron) and pulse-cta, so a wallet reads identically here, in the
-  connect picker, and on the web3 step-up card.
-
-  ONE card, ONE id, a `detected` TOGGLE for the two ends of the real progression
-  (install -> waiting -> Installed -> connect). Deliberately not two specimens
-  sharing a modal id: that shape is what left the two web3-step-up cards unable
-  to tell each other apart in the glow, fixed in the same pass that added this.
-
-  WHO SEES IT — the half worth remembering. This card and the web3 step-up card
-  are OPPOSITE populations and no user can ever meet both. WalletSetupPolicy
-  exits at its own step 1 for an account that already holds a wallet; the step-up
-  card is only ever shown to accounts that DO hold one. "Get a wallet" vs "prove
-  the wallet you have".
-
-  Self-contained: no install detection, no video embed, no real routes. The
-  walkthrough is represented as a still placeholder rather than an <iframe>,
-  because the video is the app's asset and an embed here would reach off-host.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div x-data="{
-       get props() { var c = Alpine.store('dsModals').current(); return (c && c.props) || {}; },
-       get detected() { return !!this.props.detected; }
-     }"
-     class="relative">
-  <%= render "studio/modals/blocks/wallet_brand_sprite" %>
-
-  <%= render layout: "studio/modals/blocks/shell",
-        locals: { title: "Set up your wallet", modal_store: "dsModals" } do %>
-
-    <%# Chain position — the HOST's, not this page's. It is the only one of the
-        three onboarding steps that fills the pill, which is why the pill is here
-        even though the card sits in the Web3 section beside the wallet cards. %>
-    <div class="mb-3">
-      <%= render "studio/modals/blocks/progress_pill", current: 3, total: 3 %>
-    </div>
-
-    <p class="text-sm text-body text-center mb-4">
-      This app runs on the Solana public blockchain; you will need a wallet to
-      enter contests and collect winnings.
-    </p>
-
-    <%# THE wallet row — the house idiom, glowing because it is the one thing to
-        press. Same shape the connect picker and the step-up card use. The right
-        side is the only part that moves: INSTALL before the extension exists,
-        an Installed badge once it answers. %>
-    <button type="button" @click="$store.dsModals.close()"
-            style="--pulse-cta-color: var(--color-primary); --pulse-cta-strength: 0.4; --pulse-cta-scale: 1.02"
-            class="pulse-cta w-full flex items-center gap-3 p-3 rounded-xl bg-surface-alt border border-strong hover:bg-surface transition text-left">
-      <span class="w-9 h-9 rounded-lg overflow-hidden flex items-center justify-center shrink-0">
-        <svg class="w-9 h-9" aria-hidden="true"><use href="#se-wallet-phantom"></use></svg>
-      </span>
-      <span class="font-semibold text-heading">Phantom</span>
-      <span class="ml-auto flex items-center gap-2">
-        <span x-show="!detected" class="text-xs text-muted uppercase tracking-wide">Install</span>
-        <span x-show="detected" class="badge border-primary text-primary">Installed</span>
-        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4 text-muted">
-          <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
-        </svg>
-      </span>
-    </button>
-
-    <%# The teaching half. A brand-new player does not know what a wallet IS, so
-        the card carries its own explainer rather than sending them away to find
-        one. Represented, not embedded — see the header. %>
-    <div class="mt-4 pt-4 border-t border-strong">
-      <h4 class="text-heading font-bold text-sm mb-1">New to Solana &#129300;</h4>
-      <p class="text-sm text-body mb-3">Set up your wallet in <strong>90 seconds</strong>.</p>
-
-      <div class="rounded-lg border border-subtle bg-inset aspect-video flex flex-col items-center justify-center gap-1">
-        <span class="text-2xl leading-none" aria-hidden="true">&#9654;&#65039;</span>
-        <span class="text-2xs text-muted">walkthrough &mdash; the app supplies the video</span>
-      </div>
-
-      <button type="button" @click="$store.dsModals.close()"
-              class="btn btn-primary btn-lg w-full mt-3 flex items-center justify-center gap-2">
-        Detailed Guide
-        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4">
-          <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
-        </svg>
-      </button>
-    </div>
-
-    <%# Dismissible by design, and the fine print says what dismissing costs. The
-        chain is skippable; the entry gate is not, and the card is honest that
-        the two are different things. %>
-    <button type="button" @click="$store.dsModals.close()"
-            class="block mx-auto mt-4 text-sm text-secondary hover:text-heading transition">
-      Maybe later
-    </button>
-    <p class="mt-2 text-center text-2xs text-muted">
-      Rather pay by card? Link a wallet first &mdash; an entry token needs
-      somewhere to land.
-    </p>
-  <% end %>
-</div>