studio-engine 0.74.8 → 0.74.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8073dcfcec3579f3a3fa810e5b851ac3eb38a99e38bb184183b4d6a13d8da6e
-  data.tar.gz: 3f7bc2747c4101c7785b3f3c22b673f80467e600b88af943900d1c3a4c79fdbd
+  metadata.gz: 91281f58c1fc5ccba013b728eaaa3fb8b8e1fc40b451e45893b832c83fc02151
+  data.tar.gz: 39ffd06a4758929bbd1af758d17b631596f3b9a4e8cf8df8b54c67c49a0bb8ee
 SHA512:
-  metadata.gz: d57ba1e14f875f76dd2cc2e5d75c5db00decb0f5235222dfabec4501c9ae3f6b821720188f6c84aca67b68d3b2abb99d0a9022eaa8da205955820029d2e9a19b
-  data.tar.gz: 1165eedf5e6bce8f56d60c83f0cdf96cd87bdd0c297c48906c88f782d20bbb8af102913272cf3663b73972cfd6d76474452e6900489ab2035dfee98d777673ca
+  metadata.gz: 7140c3b5cc09362d78f88924764c6fb8954727e65cc584a25cbaaf58496fc8b50703ebd08146b5b20cb353689150dd0704b9920ca06541025142f8b039f6f8d0
+  data.tar.gz: cae0907183d7e649afbcb450bfcaed6223e2b376337ef0eda86518169c695474b6416dfde78a9fdba0bece899014f16954916560a0dcb431c50a93a67727a963

data/CHANGELOG.md

@@ -1,11 +1,120 @@
 # Changelog
 
-The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Consumer Rails apps install the released RubyGems package and pin the floor each one needs — the pins differ on purpose, and every consumer records why beside its own. Bumping the gem version and updating consumer lockfiles is a release; `bin/release prepare` allocates the version and does both (see [`docs/RELEASE.md`](./docs/RELEASE.md)). `prepare` does NOT roll this file: renaming `## Unreleased` to the allocated version and opening a fresh empty one is a manual conductor step (see [`docs/RELEASE.md`](./docs/RELEASE.md), *Rolling `Unreleased` into a version*), guarded by `test/docs/changelog_structure_test.rb`.
+The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Consumer Rails apps install the released RubyGems package and pin the floor each one needs — the pins differ on purpose, and every consumer records why beside its own. Bumping the gem version and updating consumer lockfiles is a release; `bin/release prepare` allocates the version and does both (see [`docs/RELEASE.md`](./docs/RELEASE.md)). Write entries under `## Unreleased` and never write a version heading: when `prepare` allocates a version it rolls this file in the same commit, moving everything under `## Unreleased` beneath a new `## <version> — <date>` heading (written even when the bucket is empty) and leaving `## Unreleased` first and empty. It refuses the sweep, with nothing published, when the roll would lie or it cannot read this file; when it skips allocation, nothing rolls. [`docs/RELEASE.md`](./docs/RELEASE.md), *Rolling `Unreleased` into a version*, says when each happens and what to do by hand. `test/docs/changelog_structure_test.rb` guards the shape.
 
 ## Unreleased
 
+## 0.74.10 — 2026-09-13
+
+### Fixed
+
+- **The auth resend footer's error line failed WCAG AA in both themes; it now
+  uses the danger ink.** `studio/modals/auth/_resend_footer` painted its
+  `role="alert"` paragraph with the static `text-red-400`, which Tailwind v4
+  compiles to about `#FF6467`: 3.86:1 on the dark modal card and 2.89:1 on the
+  light one, both under the 4.5:1 that 12px text needs. It is now
+  `text-danger-ink`, the red `Studio::ThemeResolver` derives per theme to clear
+  4.5:1 on every surface: 4.50:1 dark and 5.76:1 light on the default modal
+  card. The resend spinner stays the engine's `.spinner`, tuned to
+  turf-monster's currentColor ring (`--spinner-track: currentColor;
+  --spinner-color: transparent`), so a host that drops its fork sees no change.
+  Guarded by `test/views/resend_footer_error_contrast_test.rb`.
+- **The sign-in overlay blurs in every consumer, and the eight engine classes
+  that painted nothing are fixed.** The class vocabulary guard
+  (`test/views/engine_class_vocabulary_test.rb`) listed them as open defects;
+  its allow-list now holds only deliberate JS and test hooks.
+  - `sessions/new`'s SSO overlay used turf-monster's `backdrop-overlay`, so
+    mcritchie-industries showed it with no blur and no scrim. It now carries
+    `backdrop-blur-[2px] backdrop-brightness-70 bg-primary-900/20`, which
+    compiles to turf's `blur(2px) brightness(0.7)` over a 20% primary-900.
+    Guarded by `test/integration/sign_in_overlay_blur_test.rb`, which renders
+    the page and compiles the overlay's classes without the motion layer.
+  - `_email_field`'s `email-reject` shake lived only in turf. The engine's
+    motion layer now owns it under the same name, with byte-compatible
+    keyframes and a reduced-motion variant that keeps the border flash.
+  - `text-danger`, `hover:text-danger`, `text-warning`, `bg-warning/10`,
+    `border-warning/30` and `placeholder-muted` compiled to nothing. The
+    text forms are now `text-danger-ink` and `text-warning-ink`, the fills
+    compile, and `placeholder-muted` is `placeholder:text-muted`. The same
+    fix reaches the success and warning badges in `studio/emails/show` and
+    the flash panel in `studio/email_images/index`, whose classes sit in Ruby
+    strings the guard's scanner cannot read; a raw-source check now covers
+    them. The flash panel is now `bg-surface` with a role border, because
+    danger-ink on a danger tint measures 4.10 to 4.18:1, under AA.
+  - **For consumers:** turf-monster can delete its `@utility backdrop-overlay`
+    (no turf view uses it now) and its `@utility email-reject` plus keyframes.
+    Until it does, turf's utilities-layer copy outranks the engine's rule, so
+    turf keeps its own shake and does not get the reduced-motion variant.
+- **The wallet callback page no longer names one vendor, and a host intent can
+  now narrate the wait.** `solana_sessions/phantom_callback` opened on
+  "Processing Phantom response..." and changed that line only on the legacy
+  sign-in path. So a transaction resumed through `walletOps` showed one sentence
+  for the whole cosign, broadcast and confirm leg: 18 seconds measured on a QA
+  iPhone for a contest entry. That sentence was also wrong for Solflare and
+  Backpack, which the redirect transport serves too. The page now opens on
+  "Processing your wallet's response...". Before it resumes, it listens for a
+  `studio:wallet-progress` event and writes `detail.text` into the status line
+  as text. A push with no text is ignored, so the default stays until something
+  real replaces it. The engine still knows nothing of what the user was doing.
+  Guarded by `test/views/phantom_callback_test.rb` and
+  `test/views/phantom_callback_resume_test.rb`.
+  - **For consumers:** no host edit is needed to get the neutral copy. To
+    narrate, dispatch the event from the intent's `complete()`:
+    `document.dispatchEvent(new CustomEvent('studio:wallet-progress', { detail:
+    { text: '…' } }))`. On the inline transport nothing listens, so the same
+    line is a harmless no-op there.
+
+### Added
+
+- **Warning and success inks, and fills for all three status roles.**
+  `Studio::ThemeResolver` now emits `--color-warning-ink` and
+  `--color-success-ink` beside `--color-danger-ink`, and the preset maps them
+  to `text-warning-ink` and `text-success-ink`. It also registers `success`,
+  `warning` and `danger` as background and border colours, so `bg-warning/10`
+  and `border-danger/30` compile. It deliberately registers no bare
+  `text-<role>`: every default role colour fails AA as text on the light
+  surfaces (warning #FF7C47 2.04:1, success #4BAF50 2.22:1, danger #EF4444
+  3.01:1). The warning and success inks are read inside their own
+  `bg-<role>/10` badge, so `ThemeResolver#status_ink` also counts that tint as
+  a surface; tuned to the bare surfaces alone, the warning ink measured 3.91:1
+  there. `--color-danger-ink` is unchanged. Danger text belongs on a theme
+  surface, never a danger tint, and the vocabulary guard now refuses that
+  combination in engine views. `Studio::ColorScale.blend` composites a
+  translucent fill over a surface. Guarded by
+  `test/lib/status_ink_contrast_test.rb`.
+
+### Changed
+
+- **The vocabulary guard's Tailwind build reads only its probe.** Tailwind v4
+  auto-detects sources from the working directory, which is this repo, so an
+  empty probe compiled to 75 KB. `source(none)` now makes the probe the only
+  source. The build recipe moved to `test/support/engine_tailwind_build.rb`,
+  where the overlay test shares it.
+
 ### Docs
 
+- **The README stops describing a sign-in card the engine no longer ships.**
+  Its "credential slot" section still named `style/modals/_auth` — deleted with
+  the other mirrors in PR #319 — as the renderer of solana-studio's
+  `solana_studio/auth/_wallet_credential`, while `lib/studio.rb` already said the
+  engine ships no auth card. It now says so too, names turf-monster's
+  `app/views/modals/_auth.html.erb` as the authority both cite, and states that
+  the wallet slot currently has NO host: nothing renders it. Whether it should
+  have one is left as an open call. The store-name paragraph now reflects that
+  every store-taking partial validates through `Studio::JsIdentifier`, and
+  `Studio::JsLiteral.in_attribute` is described exactly (it runs
+  `escape_javascript`; ERB does the HTML half).
+- **"Silent no-op" is gone from the modal partials, specimens and escapers.** A
+  quote or apostrophe that breaks an Alpine expression mounts a dead card, but the
+  vendored Alpine logs `Alpine Expression Error` for it. About a dozen comments —
+  shipped partials, specimens, the e2e lab, `JsLiteral` and `JsIdentifier` — said
+  otherwise; `_age_gate`'s also blamed `to_json`, which ERB entity-escapes. Four
+  files also claimed mcritchie-studio and turf-monster fork `studio/modals/_host`;
+  neither has since 2026-08-28. Pinned in `test/docs/modal_host_contract_docs_test.rb`,
+  whose census reads `studio/modals`, `style/modals`, the dummy app, the two
+  modules and the README. The phrase still survives outside it, in the two e2e
+  specs, `studio/emails/show` and `test/integration/style_page_test.rb`.
+
 - **Thirty-five minor versions of shipped entries left `## Unreleased` and moved
   under the version that actually shipped them.** The block spanned 2,382 lines and every
   entry in it had already been published — `accepted` sat on the `v0.74.4` release
@@ -32,8 +141,29 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   fails loudly rather than passing vacuously, and — the one that would have caught
   this in week one — `Studio::VERSION` no more than two minor versions ahead of the
   newest heading. Against the pre-change file it reports "35 minor versions of
-  entries are still filed under `## Unreleased`". Automating the roll inside
-  `bin/release prepare` (mcritchie-studio) is the real fix and is not done.
+  entries are still filed under `## Unreleased`". ~~Automating the roll inside
+  `bin/release prepare` (mcritchie-studio) is the real fix and is not done.~~ —
+  **superseded after 0.74.8:** mcritchie-studio#1344 made `prepare` roll this
+  file whenever it allocates a version, so "it never touches this file" above
+  describes the tooling as of 0.74.8. See the entry on the automatic roll below.
+
+- **The docs called the `## Unreleased` roll a manual conductor step; `bin/release
+  prepare` does it now, and the docs say exactly when it does not.**
+  mcritchie-studio#1344 made prepare roll this file into the allocated version in
+  the commit that sets `lib/studio/version.rb` and `Gemfile.lock`, and REFUSE the
+  sweep, with nothing published, when the roll would lie. `docs/RELEASE.md`
+  (*Rolling `Unreleased` into a version*), this file's preamble and the README's
+  release paragraph still said the roll was yours, by hand. They now name the
+  three outcomes (ALLOCATE rolls, SKIP rolls nothing, REFUSE aborts), each
+  refusal and its fix, and the reach limit: a SKIP (a version set by hand, or a
+  re-run after an abort before the tag) rolls nothing. They also settle three
+  conventions. An entry-less release still gets its heading; a heading never
+  lands before its version does, because `accepted` lags `release`; and a merge
+  that crosses a roll gets checked, because git can merge a new bullet CLEAN
+  under a version that shipped without it. The manual procedure stays, as the
+  remedy for those cases. No runtime code changed;
+  `test/docs/changelog_structure_test.rb` changed only its comments and its
+  failure message.
 
 ## 0.74.3 — 2026-09-08
 

data/README.md

@@ -240,35 +240,79 @@ the block:
 
 #### Writing a modal's content partial — two rules the host imposes
 
-Both of these fail SILENTLY. Nothing raises, nothing logs, and the card renders;
-it just does less than it looks like it does.
-
-**1. SINGLE ROOT.** A content partial's outer `<div>` is the host's required
-root. Alpine's `<template x-if>` clones only the FIRST root element of its
-content, so a second top-level sibling — a stray `<span>`, a trailing `<style>`
-block, a comment-turned-node — is dropped on the floor. Bake anything extra
-inside the wrapping `<div>`.
-
-**2. NO DOUBLE QUOTE INSIDE `x-data`.** The attribute is double-quoted, so an
-inner double quote CLOSES it. Alpine then mounts a component whose expression is
-truncated mid-statement: every element still renders and every handler does
-nothing. Single-quote everything inside `x-data`.
+Both rules let the card render and then do less than it looks like it does.
+They differ in whether anything reaches the CONSOLE, which is the first thing
+to check when a registered partial misbehaves.
+
+**1. SINGLE ROOT — fails in total silence.** A content partial's outer `<div>`
+is the host's required root. Alpine's `<template x-if>` clones only the FIRST
+root element of its content, so a second top-level sibling — a stray `<span>`,
+a trailing `<style>` block, a comment-turned-node — is dropped on the floor.
+Nothing raises and nothing logs: `x-if` takes `.firstElementChild` and asks no
+questions. (Alpine DOES warn on a multi-root `x-for` template — *"x-for
+templates require a single root element, additional elements will be ignored"*
+— which is exactly why this one catches people out. The modal host is `x-if`,
+and `x-if` ships no such check.) Bake anything extra inside the wrapping
+`<div>`.
+
+**2. NO DOUBLE QUOTE INSIDE `x-data` — this one LOGS.** The attribute is
+double-quoted, so an inner double quote CLOSES it. Alpine then mounts a
+component whose expression is truncated mid-statement: every element still
+renders and every handler does nothing. It is NOT silent. The truncation
+leaves a JavaScript syntax error, Alpine's evaluator catches it, and the
+default handler prints `Alpine Expression Error: …` together with the
+offending expression — a `console.warn`, followed by an async rethrow. That
+warning is the best clue this rule was broken, so send a debugging engineer to
+the console rather than to the markup. Single-quote everything inside
+`x-data`.
+
+Interpolated values are the same rule arriving from the server, and Rails
+already guards the ordinary case: `<%= value %>` inside `x-data` renders a
+double quote as `&quot;`, and the HTML tokenizer never reads a character
+reference as the closing quote — it decodes it straight into the value — so
+the attribute survives. The vector is a value that SKIPS that escaping —
+`raw`, `.html_safe`, or a helper returning a SafeBuffer — which puts a bare
+`"` into the attribute and closes it exactly as a typed one would.
+`escape_javascript` (`j`) is NOT the guard here: it escapes for a JavaScript
+string literal (`\"`) and PRESERVES the html_safe flag, so the raw quote still
+reaches the attribute. Let Rails escape it.
+
+That settles the ATTRIBUTE, not the JavaScript inside it. A value spliced into
+a single-quoted JS string — the shape rule 2 steers you to — has a second way
+out: a `'`. ERB escapes it to `&#39;`, the parser decodes that straight back
+into the value, and the bare `'` ends the string: the same
+`Alpine Expression Error`. Route such a value through
+`Studio::JsLiteral.in_attribute(value)`. It runs `escape_javascript` and
+returns an UNMARKED String, so ERB's `<%= %>` does the HTML half on output —
+both escapers, in the order that works, provided you never `raw` it; `lib/studio/js_literal.rb` carries the full contract, identifier
+position (`Studio::JsIdentifier`) included.
 
 These are properties of the HOST, not of any one card, and they apply to every
-consumer partial an app registers — not only to the specimens in this gem. They
-are recorded here because they used to be recorded only in the style guide's
-specimen headers, which made them deletable by a change that removed a specimen:
-retiring the `style/modals/_network_guard` and `_wallet_deposit` mirrors on
-2026-09-09 would otherwise have taken the single-root rule out of both this repo
-and the app that inherited those cards.
-
-**Wallet modals moved to `solana-studio`.** The Connect Wallet picker, the Web3
-step-up card and the Phantom deep link used to ship here as
-`studio/modals/wallet_connect`, `studio/modals/web3_step_up` and
-`studio/solana/phantom_deeplink`. They now live in the **solana-studio** gem as
-`solana_studio/modals/wallet_connect`, `solana_studio/modals/web3_step_up` and
-`solana_studio/phantom_deeplink`; render them from those paths and read that
-gem's README for their locals and hooks.
+consumer partial an app registers — not only to the specimens in this gem.
+
+They are recorded HERE because this is the host's CONTRACT, and nothing else
+in the repo is. Plenty of files state one or both rules, but each of them is
+describing ITSELF — a specimen header explaining its own markup, an asset
+partial explaining its own root. Someone writing a NEW partial has no specimen
+to read; they read the host's documentation, so that is where the rules have
+to live.
+
+And a specimen could not DEMONSTRATE rule 1 even in principle — many specimen
+headers state it, but none can show it failing — which is what settles it: the style guide wraps EVERY registration's partial in a `<div>` of its own
+— `<template x-if="…"><div><%= render … %></div></template>` — and that
+wrapper supplies the single root the rule is about. A specimen that broke the
+rule would still render correctly in the guide, so the specimens cannot
+demonstrate the failure they would be documenting. Pinned by
+`test/docs/modal_host_contract_docs_test.rb`.
+
+#### Wallet modals moved to `solana-studio`
+
+The Connect Wallet picker, the Web3 step-up card and the Phantom deep link used
+to ship here as `studio/modals/wallet_connect`, `studio/modals/web3_step_up`
+and `studio/solana/phantom_deeplink`. They now live in the **solana-studio**
+gem as `solana_studio/modals/wallet_connect`, `solana_studio/modals/web3_step_up`
+and `solana_studio/phantom_deeplink`; render them from those paths and read
+that gem's README for their locals and hooks.
 
 This is the two-template split: **BASE** is studio-engine + mcritchie-studio,
 **WEB3 ADD** is solana-studio + turf-monster. The engine has no business
@@ -281,53 +325,59 @@ What the engine **keeps** is the SESSION half of Solana sign-in:
 `Studio.wallet_sign_in_statement` — the single source for the signed statement,
 which the gem's deep link reads so the two cannot drift.
 
-#### The auth modal's credential slot
-
-The **sign-in modal itself stays here** and is never forked: every app in the
-ecosystem signs people in, and most of them are web2. What varies is *which
-credentials it offers*. Google and magic-link are implemented by this engine and
-render directly. The wallet button is implemented by the web3 layer, so it is
-**contributed** — `style/modals/_auth` looks for a partial at one fixed path and
-renders whatever it finds:
+The callback view is also where a redirect-transport transaction waits while
+the server cosigns and confirms, and it does not know what the user was doing.
+The registered intent does, so the intent narrates: from its `complete()` it
+dispatches `studio:wallet-progress` with `{ detail: { text: '…' } }`, and the
+page writes that text into its status line. With nothing pushed the line reads
+"Processing your wallet's response...", which names no wallet brand. On the
+inline transport nothing listens, so the dispatch is a harmless no-op there.
 
-    solana_studio/auth/_wallet_credential     (shipped by the solana-studio gem)
-
-Bundling the gem **is** the registration. There is no registry call and no
-config flag; an app without that layer renders nothing there, so a web2 app
-carries no wallet markup at all rather than markup hidden behind a flag. This is
-the same optional-partial convention as `modals/_host_extras` above, and it uses
-the same three-term `lookup_context.exists?`.
-
-Copying the auth modal into the gem was rejected deliberately: it would fork a
-surface both apps sign in through, and the two copies would drift — which is how
-the wallet picker reached three copies before it was promoted.
+#### The auth modal's credential slot
 
-**Two layers answer two different questions, and they are not merged:**
+**This engine ships no sign-in card.** Each app owns its own and computes its
+credential buttons itself: turf-monster's is `app/views/modals/_auth.html.erb`,
+which is also the authority `lib/studio.rb` cites beside the Solana routes. The
+engine's one auth card was the living style guide's MIRROR of turf's,
+`style/modals/_auth`, and it was retired with the other mirrors on 2026-09-09
+(PR #319). For sign-in the engine now ships fragments, not a card:
+`studio/modals/shared/_email_field` and `studio/modals/auth/_resend_footer`,
+each carded on the style guide.
+
+**The wallet credential slot has no host today.** solana-studio still ships
+`solana_studio/auth/_wallet_credential`, a Solana button written to be
+*contributed* into a sign-in card rather than copied into one. The retired
+mirror was its only renderer. Neither turf-monster nor mcritchie-studio names
+the path; turf's card draws its wallet button directly. So bundling solana-studio
+no longer puts a wallet button anywhere. Whether the engine should host the slot
+again, or the convention should be retired, is an open call, not a fact this
+README can settle.
+
+**A card that does host it owns the gate.** The retired mirror's rules still
+hold; they simply live in that app's view now. Two layers answer two different
+questions, and they are not merged:
 
 | Question | Answered by | Where it is decided |
 |---|---|---|
-| Is it **implemented**? | the picker is registered, **and** the credential partial resolves | Ruby, in `style/modals/_auth` — gates the render |
+| Is it **implemented**? | the picker is registered, **and** the credential partial resolves (`lookup_context.exists?`, the same three-term check as `modals/_host_extras`) | Ruby, in the hosting card — gates the render |
 | Should it **show**? | `methodOn('wallet')`, falling back to `Studio.auth_method?(:wallet) && Studio.feature?(:web3)` | Alpine, inside the contributed partial — gates visibility |
 
 Both terms of the Ruby gate are load-bearing, and they fail differently. Without
 the **registration** term a layer that ships the credential but not the picker
 draws a button that opens an empty panel — not hypothetical, solana-studio 0.5.2
-shipped exactly that pair. Without the **existence** term an app whose picker
+shipped exactly that pair. Without the **existence** term a card whose picker
 resolves but whose credential does not raises `Missing partial` in front of
-someone signing in, instead of quietly rendering no button.
-
-Policy stays **out** of the Ruby gate on purpose. Folding
-`auth_method?(:wallet)` and `feature?(:web3)` into the render would delete the
-button from the DOM on a web3-off app that bundles the gem — and the "or"
-divider reads `methodOn('wallet')` too, so ticking Solana Wallet on the style
-guide's Sign in card would then float a divider above a button that is not
-there.
+someone signing in, instead of quietly rendering no button. Keep policy out of
+the Ruby gate: folding `auth_method?(:wallet)` and `feature?(:web3)` into the
+render deletes the button from the DOM, while an "or" divider that reads
+`methodOn('wallet')` still draws above the gap.
 
-A contributed partial renders inside the modal's own Alpine scope, so it may use
+The partial renders inside the hosting card's Alpine scope, so it may use
 `methodOn(...)`, `attested()` (the legal-age gate — call it, or wallet becomes
 the one credential that skips attestation) and `props.submitting`. It receives
-one local, `modal_store`: the engine's real host is `"modals"`, the living style
-guide's page-scoped host is `"dsModals"`.
+one local, `modal_store`, the store backing that card's host. solana-studio's
+own header for the partial still describes the engine as its renderer; that is
+the same stale claim, one repo over.
 
 **Name a store like a JavaScript identifier.** Partials splice this local in as a
 bare name — `$store.<name>.current()` — rather than as a string, so a value
@@ -336,10 +386,11 @@ SyntaxError in the whole `x-data`, and Alpine mounts a component that renders
 every element and does nothing. Escaping is not the repair (an escaped identifier
 is a different SyntaxError); a name that matches `/\A[A-Za-z_$][A-Za-z0-9_$]*\z/`
 is. `studio/modals/onboarding/_first_name` enforces exactly that and raises
-`ArgumentError` on anything else — the first partial to do so, not yet the fleet.
-Note the shape decides the repair, not the name of the local: `blocks/_birthday`
-and `blocks/_leveling_activity` pass `modal_store` in *string* position and
-correctly `escape_javascript` it instead.
+`ArgumentError` on anything else, and every store-taking partial now does the
+same through `Studio::JsIdentifier.validate!` — the shell, the blocks and the
+templates alike. Note the shape decides the repair, not the
+name of the local: `blocks/_birthday` passes `modal_store` in *string* position
+(`store: '…'`) and correctly `escape_javascript`s it instead.
 
 It also keeps two blocks the gem renders **by name** across the gem boundary:
 `studio/modals/blocks/wallet_brand_sprite` and `studio/modals/blocks/card_header`.
@@ -366,11 +417,13 @@ default to `"modals"`, so existing call sites are unchanged. The engine's
 
 Two things that will bite you:
 
-- **Render `scoped_host`, not `host`.** This is a non-isolated engine, so an app
-  view at the same path shadows the engine's — and `mcritchie-studio` and
-  `turf-monster` both ship their own `app/views/studio/modals/_host.html.erb`.
-  A page rendering `studio/modals/host` in those apps silently gets the app's
-  fork. `scoped_host` is unforked everywhere.
+- **Render `scoped_host`, not `host`.** `scoped_host` mounts the page's modals
+  on the page's OWN store, which is the point of a page-scoped host; `host` is
+  the app's shared one. The path matters too: this is a non-isolated engine, so
+  an app view at `app/views/studio/modals/_host.html.erb` would shadow the
+  engine's. No consumer ships one today — mcritchie-studio and turf-monster
+  deleted their forks on 2026-08-28 — but nothing stops the next app, and
+  `scoped_host` has never been forked.
 - **Guard registrations with `current()?.id`.** The outer template unmounts one
   tick *after* the stack empties, so a bare `.id` throws on every close.
 
@@ -815,11 +868,14 @@ let it allocate the version — it derives the bump, commits `lib/studio/version
 with its `Gemfile.lock` onto **`origin/release`**, then publishes, tags, and bumps
 each consumer's lock. **Do not set the version by hand.** A hand-set number makes
 the allocation read the current version as already past the last tag and skip, so
-the hand number silently wins over the derived one. **`prepare` does not touch
-[`CHANGELOG.md`](./CHANGELOG.md)** — renaming `## Unreleased` to the allocated
-version and opening a fresh empty one is a manual last step, and skipping it is
-how thirty-five minor versions of entries ended up filed as pending. Details and the
-exact commands are in [`docs/RELEASE.md`](./docs/RELEASE.md).
+the hand number silently wins over the derived one, and the skip rolls no
+changelog. **When it allocates, `prepare` also rolls
+[`CHANGELOG.md`](./CHANGELOG.md)** in the same commit: everything under
+`## Unreleased` moves beneath the new version's heading, written even when the
+bucket is empty, and `## Unreleased` stays first and empty. It refuses the sweep,
+with nothing published, when the roll would lie or it cannot read the file.
+[`docs/RELEASE.md`](./docs/RELEASE.md), *Rolling `Unreleased` into a version*,
+says exactly when it rolls, refuses or skips, and what to do by hand.
 
 **Semver guide** — the release *derives* the bump from its members (a `breaking`
 risk tag → major, a `feature` → minor, otherwise patch), so this is what those

data/app/assets/tailwind/studio_engine/engine-motion.css

@@ -26,6 +26,7 @@
   Action:
     .hold-btn             press-and-hold confirm button       (ported, TM)
     .hold-stack/.fizz-bit the carbonation behind it           (ported, TM)
+    .email-reject         email field rejection shake + fade  (extracted, TM)
 
   Leveling:
     .level-badge(-1..-10) progressive level pill ladder       (ported, TM)
@@ -74,9 +75,9 @@
   - Every tuning knob (duration, size, color, %, delay) is a CSS custom property
     with a sensible themed default, so a caller retunes via `style="--x: ..."`
     or a `:root` override WITHOUT forking the rule.
-  - Namespacing: the two extracted primitives keep their source names
-    (`.studio-border-glow`, `.loading-dots`) so the follow-up de-fork is a pure
-    delete-the-local-copy swap with no view churn; their gem rules are byte-
+  - Namespacing: the extracted primitives keep their source names
+    (`.studio-border-glow`, `.loading-dots`, `.email-reject`) so the follow-up
+    de-fork is a pure delete-the-local-copy swap with no view churn; their gem rules are byte-
     compatible with the app copies, so a transient co-load is a harmless
     duplicate. The reconciled/fresh primitives use fresh generic names
     (`.spinner`, `.sheen`, `.ping`, `.fade-edge`, `.progress-meter`) that no app
@@ -191,6 +192,13 @@
    Usage:  <span class="spinner"></span>
            <span class="spinner" style="--spinner-size: 2rem"></span>
            on a colored button:  <span class="spinner" style="--spinner-color: currentColor"></span>
+           the currentColor RING the engine's own CTA blocks use, matching the
+           ring turf-monster's host-only .cta-spinner draws:
+             <span class="spinner" style="--spinner-track: currentColor; --spinner-color: transparent; opacity: 0.85"></span>
+           Mind the mapping, it reads backwards: --spinner-track paints the
+           WHOLE ring and --spinner-color only the leading segment. Untuned on a
+           .btn-primary, the head is --color-cta, the button's own fill, so the
+           spinner shows nothing but its faint track.
    Tune:   --spinner-size / --spinner-thickness / --spinner-track /
            --spinner-color / --spinner-speed
    ========================================================================== */
@@ -1865,4 +1873,44 @@ body.modal-open { overflow: visible; }
     transition: none !important;
   }
 }
+
+/* =============================================================================
+   13. email-reject — the email field's submit-rejection "no" (extracted, TM)
+   A short horizontal shake plus a danger border that fades back to the resting
+   border .input-field uses (border-strong), so it settles with no flash.
+   studio/modals/shared/_email_field binds it as :class="{ 'email-reject':
+   _rejecting }" when rendered with validator: true; the consumer's
+   emailValidator factory owns the _rejecting STATE, and the engine paints it.
+
+   The name and keyframes are byte-compatible with turf-monster's local
+   @utility, so the two co-load harmlessly until turf deletes its copy. Turf's
+   utilities-layer rule outranks this one until then, so the reduced-motion
+   branch below reaches turf only after that delete.
+
+   Tune:   --email-reject-duration (default 0.55s)
+   ========================================================================== */
+.email-reject {
+  animation: email-reject var(--email-reject-duration, 0.55s) ease-in-out;
+}
+
+@keyframes email-reject {
+  0%   { transform: translateX(0);    border-color: var(--color-danger); }
+  15%  { transform: translateX(-7px); }
+  30%  { transform: translateX(7px);  }
+  45%  { transform: translateX(-5px); }
+  60%  { transform: translateX(4px);  }
+  75%  { transform: translateX(-2px); }
+  100% { transform: translateX(0);    border-color: var(--color-border-strong, inherit); }
+}
+
+/* Reduced motion keeps the signal and drops the shake: the border still flashes
+   danger and fades back, and nothing moves. */
+@keyframes email-reject-fade {
+  0%   { border-color: var(--color-danger); }
+  100% { border-color: var(--color-border-strong, inherit); }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .email-reject { animation-name: email-reject-fade; }
+}
 }

data/app/views/components/_avatar_cropper.html.erb

@@ -34,7 +34,7 @@
       <span x-text="croppedUrl ? 'Change Photo' : 'Upload Photo'"></span>
     </button>
     <template x-if="croppedUrl">
-      <button type="button" @click="removePhoto()" class="text-muted hover:text-danger text-xs transition">Remove</button>
+      <button type="button" @click="removePhoto()" class="text-muted hover:text-danger-ink text-xs transition">Remove</button>
     </template>
   </div>
 

data/app/views/error_logs/index.html.erb

@@ -23,7 +23,7 @@
           }
         ">
     <input type="text" name="q" value="<%= params[:q] %>" placeholder="Search errors... (Esc to clear)" autofocus x-ref="input"
-           class="input-field pr-10 py-2.5 text-sm placeholder-muted"
+           class="input-field pr-10 py-2.5 text-sm placeholder:text-muted"
            :readonly="loading" />
     <div x-show="loading" x-cloak class="absolute right-3 top-1/2 -translate-y-1/2">
       <svg class="animate-spin h-4 w-4 text-primary" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">

data/app/views/schema/index.html.erb

@@ -7,7 +7,7 @@
   <div class="mb-6 relative">
     <input type="text" placeholder="Filter tables..." x-model="search"
            @keydown.escape.prevent="search = ''"
-           class="input-field pr-10 py-2.5 text-sm placeholder-muted" />
+           class="input-field pr-10 py-2.5 text-sm placeholder:text-muted" />
     <button x-show="search.length > 0" x-cloak @click="search = ''"
             class="absolute right-3 top-1/2 -translate-y-1/2 text-muted hover:text-heading transition">
       <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
@@ -47,7 +47,7 @@
                   <td class="px-4 py-1.5">
                     <span class="inline-flex gap-1.5 flex-wrap">
                       <% unless col.null %>
-                        <span class="text-warning font-medium">NOT NULL</span>
+                        <span class="text-warning-ink font-medium">NOT NULL</span>
                       <% end %>
                       <% if col.default.present? %>
                         <span class="text-muted">default: <span class="text-secondary font-mono"><%= col.default %></span></span>

data/app/views/sessions/new.html.erb

@@ -22,7 +22,7 @@
                x-transition:leave="transition ease-in duration-500"
                x-transition:leave-start="opacity-100"
                x-transition:leave-end="opacity-0"
-               class="absolute inset-0 z-10 rounded-2xl cursor-pointer flex items-center justify-center backdrop-overlay">
+               class="absolute inset-0 z-10 rounded-2xl cursor-pointer flex items-center justify-center backdrop-blur-[2px] backdrop-brightness-70 bg-primary-900/20">
             <span class="text-secondary text-xs font-medium uppercase tracking-wider">Click to show other options</span>
           </div>
     <% end %>

data/app/views/solana_sessions/phantom_callback.html.erb

@@ -1,7 +1,14 @@
 <div class="flex flex-col items-center justify-center min-h-[60vh] px-4">
   <div class="text-center">
     <div id="phantom-spinner" class="inline-block w-10 h-10 border-4 border-primary border-t-transparent rounded-full animate-spin mb-4"></div>
-    <p id="phantom-status" class="text-secondary text-sm">Processing Phantom response...</p>
+    <%# THE ONE SENTENCE THE USER READS for the whole return leg, and on a
+        transaction that leg includes the server's cosign, broadcast and confirm.
+        It names the act and not a vendor: the redirect transport returns
+        Phantom, Solflare and Backpack users here alike. The id keeps its old name
+        because the script below addresses it by that name. A registered intent
+        replaces this text through the studio:wallet-progress event (see the
+        resume branch below); with nothing pushed it stays, and stays true. %>
+    <p id="phantom-status" class="text-secondary text-sm">Processing your wallet's response...</p>
     <p id="phantom-error" class="text-red-400 text-sm mt-2 hidden"></p>
   </div>
 
@@ -169,6 +176,37 @@
   if (hasResumer && studio.walletJournal.peek()) {
     dbg('Transport', 'wallet_dl journal present — resuming through walletOps');
 
+    // THE PROGRESS SEAM — the intent speaks, this page listens.
+    //
+    // THE DEFECT IT CLOSES. The status line used to change only on the legacy
+    // path below, past this branch's return, so a transaction resumed here read
+    // one unchanging sentence while the server cosigned, broadcast and
+    // confirmed: 18 seconds measured on a QA iPhone for a contest entry. That
+    // reads as a hang. The registered intent knows what the server is doing and
+    // has no surface on this document; this page has the surface and, by
+    // design, no idea. So the intent dispatches, from its complete():
+    //
+    //   document.dispatchEvent(new CustomEvent('studio:wallet-progress',
+    //     { detail: { text: 'Cosigning and submitting to Solana...' } }));
+    //
+    // An EVENT, not a function the intent must find, because complete() runs on
+    // both transports: on the inline one there is no listener and the dispatch
+    // is a harmless no-op, so the intent needs no check for which document it
+    // is on. And an event, not an option handed through resume, because
+    // solana-studio's resume calls complete() with ctx, result and state and
+    // nothing else, so there is no bag to carry one in.
+    //
+    // INSTALLED BEFORE resume, never after: resume calls complete() in the same
+    // tick, so a push made before its first await would land on no listener.
+    // textContent, never markup. A push with no text is ignored, because a blank
+    // status line reads as the hang this seam exists to end.
+    document.addEventListener('studio:wallet-progress', function(e) {
+      var text = e && e.detail && e.detail.text;
+      if (typeof text !== 'string' || !text.trim()) { return; }
+      dbg('Progress', text);
+      statusEl.textContent = text;
+    });
+
     studio.walletOps.resume(params, {
       navigate: function(url) { window.location.href = url; }
     }).then(function(result) {

data/app/views/studio/email_images/index.html.erb

@@ -26,7 +26,7 @@
   <% end %>
 
   <% flash.each do |type, message| %>
-    <div class="mb-4 rounded-lg px-4 py-3 text-sm <%= type.to_s == "alert" ? "bg-danger/10 text-danger" : "bg-success/10 text-success" %>">
+    <div class="mb-4 rounded-lg px-4 py-3 text-sm bg-surface border <%= type.to_s == "alert" ? "border-danger/30 text-danger-ink" : "border-success/30 text-success-ink" %>">
       <%= message %>
     </div>
   <% end %>

data/app/views/studio/emails/index.html.erb

@@ -15,9 +15,10 @@
      rather than the app's shared `modals` store, so this page works identically
      in an app that renders a shared modal host (mcritchie-studio, turf-monster)
      and one that renders none at all (mcritchie-industries, moms-app). It uses
-     studio/modals/scoped_host, NOT studio/modals/host — the latter is forked by
-     mcritchie-studio and turf-monster, and an app fork shadows the engine's
-     partial in this non-isolated engine. %>
+     studio/modals/scoped_host, NOT studio/modals/host — host is the app's
+     shared store, and in this non-isolated engine an app copy of it would shadow
+     the engine's partial. mcritchie-studio and turf-monster deleted theirs on
+     2026-08-28; scoped_host's path has never been forked. %>
 <% content_for(:title) { "Emails" } %>
 <%
   max_width  = Studio::EmailCatalog::MAX_WIDTH

data/app/views/studio/emails/orphan.html.erb

@@ -15,7 +15,7 @@
           class: "text-sm text-muted hover:text-heading underline underline-offset-2" %>
     <h1 class="text-3xl font-bold text-heading mt-2">Unregistered email</h1>
     <div class="flex flex-wrap items-center gap-2 mt-3">
-      <span class="badge bg-warning/10 text-warning border-warning/30 whitespace-nowrap">Not registered</span>
+      <span class="badge bg-warning/10 text-warning-ink border-warning/30 whitespace-nowrap">Not registered</span>
       <span class="font-mono text-2xs text-muted"><%= @key %></span>
     </div>
   </header>

data/app/views/studio/emails/show.html.erb

@@ -66,16 +66,16 @@
   badge_class, badge_label, badge_note =
     case source
     when :app
-      ["badge bg-success/10 text-success border-success/30", "Uploaded here",
+      ["badge bg-success/10 text-success-ink border-success/30", "Uploaded here",
        "Stored for #{Studio.app_name} — this upload is what ships."]
     when :app_asset
-      ["badge bg-success/10 text-success border-success/30", "#{Studio.app_name}'s artwork",
+      ["badge bg-success/10 text-success-ink border-success/30", "#{Studio.app_name}'s artwork",
        "Committed in this app's own assets. Upload to replace it."]
     when :engine_default
       ["badge bg-inset text-muted border-subtle", "Studio default",
        "Shared artwork that ships with the engine. Upload to make it #{Studio.app_name}'s."]
     else
-      ["badge bg-warning/10 text-warning border-warning/30", "No image",
+      ["badge bg-warning/10 text-warning-ink border-warning/30", "No image",
        "This email sends without a banner."]
     end
 %>
@@ -476,7 +476,7 @@
       </div>
     <% end %>
     <% if @preview_error.present? %>
-      <p class="text-2xs text-danger mt-2 px-1 font-mono break-all"><%= @preview_error %></p>
+      <p class="text-2xs text-danger-ink mt-2 px-1 font-mono break-all"><%= @preview_error %></p>
     <% end %>
   </section>
 
@@ -507,9 +507,10 @@
 
   <% if @uploads_available %>
     <%# Cropper + the page-scoped modal host, exactly as the index mounts them:
-        scoped_host rather than modals/host, because mcritchie-studio and
-        turf-monster both ship app copies of modals/host that shadow the engine's
-        in this non-isolated engine.
+        scoped_host rather than modals/host, because this page mounts its modals
+        on its OWN store, and because scoped_host's path has never been forked
+        (an app copy of modals/host would shadow the engine's in this
+        non-isolated engine; none ships one today).
 
         Optional chaining on current() is load-bearing: the outer template
         unmounts one tick AFTER the stack empties, so a bare .id throws on every

data/app/views/studio/modals/_crop_photo.html.erb

@@ -28,8 +28,9 @@
 <% crop_store = local_assigns.fetch(:store, "modals") %>
 <%# STRING position, so it is ESCAPED rather than validated: the store name is
     handed to cropPhotoModal as a JS string argument, not spliced in as a bare
-    identifier. An apostrophe would close that literal and mount the modal as a
-    silent no-op that still renders every element below. Studio::JsLiteral carries
+    identifier. An apostrophe would close that literal and mount the modal dead:
+    every element below still renders, and the only signal is an Alpine
+    Expression Error in the browser console. Studio::JsLiteral carries
     why both escapers have to run. %>
 <% crop_store_js = Studio::JsLiteral.in_attribute(crop_store) %>
 <div x-data="cropPhotoModal({ store: '<%= crop_store_js %>' })">

data/app/views/studio/modals/_host.html.erb

@@ -32,7 +32,11 @@
   IMPOSES on the content partials registered in its block: a SINGLE ROOT
   element (a template x-if clones only the first one; later siblings are
   dropped) and NO double quote inside x-data (it closes the attribute and
-  Alpine mounts a silent no-op). Both fail without raising.
+  Alpine mounts a no-op). NEITHER STOPS THE RENDER, BUT ONLY ONE IS SILENT:
+  the single-root miss logs nothing at all, while the truncated x-data prints
+  "Alpine Expression Error" to the console (and rethrows it async). That
+  warning is the clue rule one never gives you, so check the console before
+  you re-read the markup.
 %>
 <style>
   /* Scroll lock applied by $store.modals._sync() when the stack is non-empty.

data/app/views/studio/modals/_scoped_host.html.erb

@@ -5,12 +5,13 @@
 
   Why this exists as a separate partial rather than a local on
   studio/modals/_host: this is a NON-ISOLATED engine, so an app view at the same
-  path SHADOWS the engine's. `mcritchie-studio` and `turf-monster` both ship
-  their own app/views/studio/modals/_host.html.erb — older, simpler copies that
-  know nothing of a store: local. A page rendering "studio/modals/host" in those
-  apps silently gets the fork, and its page-scoped store is never registered.
-  This partial's path is unforked in every app, so it renders the engine's code
-  everywhere. (The living style guide hand-rolled the same thing inline for the
+  path SHADOWS the engine's. mcritchie-studio and turf-monster each carried an
+  app copy of app/views/studio/modals/_host.html.erb — older, simpler copies that
+  knew nothing of a store: local — until both were deleted on 2026-08-28. No consumer
+  forks _host today, but nothing stops the next one, and a page rendering
+  "studio/modals/host" in such an app would silently get the fork with its
+  page-scoped store never registered. This partial's path has never been forked,
+  so it renders the engine's code everywhere. (The living style guide hand-rolled the same thing inline for the
   same reason; it can rebase onto this later.)
 
   Two independent problems it solves at once:
@@ -41,11 +42,12 @@
   chaining (`current()?.id`): the outer template unmounts one tick AFTER the
   stack empties, so a bare `.id` throws on every close.
 
-  THE CONTENT PARTIALS OBEY THE SAME TWO RULES AS THE SHARED HOST'S, and both
-  fail silently: a SINGLE ROOT element (a template x-if clones only the first
-  one) and NO double quote inside x-data (it closes the attribute and Alpine
-  mounts a component that renders everything and does nothing). Stated in full
-  in the gem README's "Modal host" section.
+  THE CONTENT PARTIALS OBEY THE SAME TWO RULES AS THE SHARED HOST'S, and they
+  fail DIFFERENTLY: a SINGLE ROOT element (a template x-if clones only the
+  first one, logging nothing) and NO double quote inside x-data (it closes the
+  attribute and Alpine mounts a component that renders everything and does
+  nothing -- but LOGS "Alpine Expression Error" on the way). Stated in full in
+  the gem README's "Modal host" section.
 
   AND EVERY ID REGISTERED HERE MUST BE REACHABLE, both ways round. A card that
   opens an id no template registers shows an EMPTY panel; a template no card

data/app/views/studio/modals/auth/_resend_footer.html.erb

@@ -10,6 +10,29 @@
 
   Locals:
     modal_store — Alpine store name backing close(). Default "modals".
+
+  ERROR INK, not a static red. The error paragraph is text-danger-ink, the
+  per-theme red Studio::ThemeResolver derives to a 4.5:1 target. It replaced
+  text-red-400. Measured through the resolver on turf-monster's real palette
+  (primary 4BAF50), on the modal card, which is bg-surface: danger-ink is 4.50
+  on the dark card 3C3853 and 5.76 on the light card ffffff, clearing AA on
+  both; text-red-400 was 3.86 and 2.89, failing both. Those are Tailwind v4's
+  red-400, about FF6467, which is what these apps compile; the v3 hex F87171
+  gives 4.03 and 2.77 and fails the same way. No STATIC red clears AA
+  on BOTH themes — theme_resolver.rb carries the measured table and derives
+  --color-danger-ink precisely to be the text red. --color-danger is the brand
+  FILL and is free to be vivid; it is not this. Guarded, executably, by
+  test/views/resend_footer_error_contrast_test.rb.
+
+  SPINNER, tuned rather than re-named. This is the engine's canonical .spinner
+  primitive (engine-motion.css), tuned through its OWN documented custom
+  properties to the currentColor ring turf-monster paints with its host-only
+  .cta-spinner — so the block looks unchanged once turf renders it, and the
+  engine names no class it cannot define. Read the mapping carefully, because
+  it looks backwards: --spinner-track colours the WHOLE ring and
+  --spinner-color colours only the leading segment. A currentColor ring with a
+  transparent gap is therefore track currentColor plus color transparent, NOT
+  the reverse, which would draw a lone quarter-arc instead.
 %>
 <%
   # IDENTIFIER position ($store.<name>) — VALIDATED, never escaped: Studio::JsIdentifier.
@@ -19,9 +42,10 @@
 <button @click="resendMagicLink()" :disabled="props.submitting === 'magic-link' || (props.resendCooldown || 0) > 0"
         class="block mx-auto text-sm text-primary hover:text-primary-300 underline underline-offset-2 disabled:opacity-50 disabled:no-underline">
   <span class="inline-flex items-center justify-center gap-1.5">
-    <span x-show="props.submitting === 'magic-link'" class="spinner" aria-hidden="true"></span>
+    <span x-show="props.submitting === 'magic-link'" class="spinner" aria-hidden="true"
+          style="--spinner-track: currentColor; --spinner-color: transparent; opacity: 0.85"></span>
     <span x-text="props.submitting === 'magic-link' ? 'Resending…' : ((props.resendCooldown || 0) > 0 ? ('Resend available in ' + props.resendCooldown + 's') : 'Resend link')"></span>
   </span>
 </button>
-<p role="alert" x-show="props.resendError" x-cloak class="text-xs text-red-400 mt-3 text-center" x-text="props.resendError"></p>
+<p role="alert" x-show="props.resendError" x-cloak class="text-xs text-danger-ink mt-3 text-center" x-text="props.resendError"></p>
 <button @click="$store.<%= modal_store %>.close()" class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">Close</button>

data/app/views/studio/modals/blocks/_age_gate.html.erb

@@ -73,10 +73,14 @@
        get minAge() { return <%= min_age.present? ? min_age.to_i : 0 %> || this.props.minAge || null; },
        get stateCode() { return '<%= j state %>' || this.props.state || ''; },
        get headline() {
-         // Single-quoted + j-escaped, NOT to_json: to_json emits DOUBLE quotes,
-         // which close this double-quoted x-data attribute and mount the
-         // component as a silent no-op. The markup still renders, so every
-         // assertion passes while the card is dead in a browser.
+         // Single-quoted + j-escaped. A plain ERB to_json would in fact survive
+         // here: to_json returns an UNMARKED String, so ERB entity-escapes its
+         // quotes and this double-quoted x-data attribute stays whole. The
+         // hazard is a raw or html_safe one, whose bare quote closes the
+         // attribute and mounts the card dead: the markup still renders, every
+         // assertion passes, and the only signal is an Alpine Expression Error
+         // in the browser console. Studio::JsLiteral.in_attribute is the
+         // engine's contract for a value in this position.
          var t = '<%= j title.to_s %>';
          return t ? t : 'Easy, Young’un';
        },

data/app/views/studio/modals/blocks/_birthday.html.erb

@@ -131,7 +131,7 @@
             :disabled="!complete || submitting">
       <span x-show="!submitting">Confirm &amp; Continue</span>
       <span x-show="submitting" class="inline-flex items-center justify-center gap-2" style="display: none;">
-        <span class="cta-spinner" aria-hidden="true"></span>
+        <span class="spinner" aria-hidden="true" style="--spinner-track: currentColor; --spinner-color: transparent; opacity: 0.85"></span>
         Verifying…
       </span>
     </button>

data/app/views/studio/modals/blocks/_entry_confirmed.html.erb

@@ -76,7 +76,8 @@
   # STRING position — clusterParam is a JS string on the root scope that
   # _success_card's tx-link concatenates into a URL. An apostrophe closes the
   # literal and the whole x-data becomes a SyntaxError, which mounts this card and
-  # every nested block as a silent no-op. props_expr one line up is the OPPOSITE
+  # every nested block dead: all of it renders, and only the browser console says
+  # why (an Alpine Expression Error). props_expr one line up is the OPPOSITE
   # shape (an Alpine expression by contract) and is deliberately left alone.
   cluster_param_js = Studio::JsLiteral.in_attribute(cluster_param)
   lobby_url_key    = local_assigns.fetch(:lobby_url_key, "props.lobbyUrl")

data/app/views/studio/modals/blocks/_leveling_activity.html.erb

@@ -168,7 +168,7 @@
           <button type="submit" class="btn btn-primary btn-lg w-full" :disabled="saving || !changed">
             <span x-show="!saving" x-text="changed ? '<%= j cta_label %>' : '<%= j saved_label %>'"><%= cta_label %></span>
             <span x-show="saving" class="inline-flex items-center justify-center gap-2" style="display: none;">
-              <span class="cta-spinner" aria-hidden="true"></span>
+              <span class="spinner" aria-hidden="true" style="--spinner-track: currentColor; --spinner-color: transparent; opacity: 0.85"></span>
               <span x-text="progressLabel || '<%= j saving_label %>'"><%= saving_label %></span>
             </span>
           </button>

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -83,8 +83,9 @@
   CRITICAL (Alpine): this partial is cloned from a <template x-if> by the modal
   host, so it must have ONE root element, and the x-data below is a
   DOUBLE-QUOTED attribute — a single " anywhere inside it (a code comment
-  included) closes it early and the whole component mounts as a silent no-op that
-  still renders markup. Keep every inner string SINGLE-quoted.
+  included) closes it early and the whole component mounts dead: it still renders
+  markup, and the only signal is an Alpine Expression Error in the browser
+  console. Keep every inner string SINGLE-quoted.
 
   THE TWO SHAPES — read this before adding a local to the x-data. Five locals are
   interpolated into that attribute and they do NOT take the same repair. Getting
@@ -93,7 +94,7 @@
 
     STRING position — empty_error, submit_path, skip_path, done_event — each sits
       inside a JS SINGLE-quoted literal. A bare apostrophe closes the literal, the
-      expression becomes a SyntaxError, and the card is that silent no-op. Repair:
+      expression becomes a SyntaxError, and the card is that dead component. Repair:
       Studio::JsLiteral.in_attribute, which is where the mechanism now lives and is
       tested. Two escapers have to run — one for the JS literal, one for the
       attribute — and the second only runs on a value ERB still believes is unsafe.
@@ -146,8 +147,8 @@
   # first HOST-SUPPLIED PROSE to go inside that attribute, and prose has
   # apostrophes. Interpolated raw, an error reading "We'll need a name" would
   # close the JS single-quoted string, make the whole expression a SyntaxError,
-  # and mount the component as a SILENT NO-OP that still renders every element
-  # below. Studio::JsLiteral.in_attribute covers the apostrophe, the double quote,
+  # and mount the component DEAD: it still renders every element below, and
+  # only the browser console says why (an Alpine Expression Error). Studio::JsLiteral.in_attribute covers the apostrophe, the double quote,
   # the backslash and the newline, AND hands ERB a value it still believes is
   # unsafe so the attribute's own escaping runs too — a safe string would skip that
   # half and could smuggle a raw double quote in, the exact failure the CRITICAL
@@ -184,8 +185,8 @@
   # THE SAME HAZARD empty_error_js CARRIES, on the three remaining locals that land
   # inside a JS SINGLE-quoted literal in the x-data below. A bare apostrophe in any
   # of them closes its literal, the whole expression becomes a SyntaxError, and
-  # Alpine mounts the component as a SILENT NO-OP that still renders every element
-  # — perfect-looking markup, dead card.
+  # Alpine mounts the component DEAD — perfect-looking markup, a card that does
+  # nothing, and an Alpine Expression Error in the console as the only signal.
   #
   # WHY A METHOD RATHER THAN escape_javascript AT EACH SITE: the second escaper is
   # conditional. ERB skips a value that answers true to html_safe, and
@@ -377,7 +378,7 @@
     </template>
     <button type="submit" :disabled="submitting"
             class="btn btn-primary btn-lg w-full gap-2 disabled:cursor-wait">
-      <span x-show="submitting" class="cta-spinner" aria-hidden="true"></span>
+      <span x-show="submitting" class="spinner" aria-hidden="true" style="--spinner-track: currentColor; --spinner-color: transparent; opacity: 0.85"></span>
       <span x-text="submitting ? 'Saving…' : 'Save and continue'"></span>
     </button>
   </form>

data/app/views/style/modals/_newsletter_email.html.erb

@@ -15,7 +15,8 @@
   path instead of two. Here the callback resolves locally.
 
   Single root, and everything inside the double-quoted x-data is single-quoted —
-  an inner double quote closes the attribute and mounts a silent no-op.
+  an inner double quote closes the attribute and mounts a dead component whose
+  only signal is an Alpine Expression Error in the browser console.
 %>
 <div x-data="{
        email: '',

data/app/views/style/modals/_unsubscribe_confirm.html.erb

@@ -23,7 +23,8 @@
 
   Single root: the outer <div> is the host's required root, and everything inside
   the double-quoted x-data is single-quoted — an inner double quote closes the
-  attribute and mounts the component as a silent no-op.
+  attribute and mounts the component dead, with an Alpine Expression Error in
+  the browser console as the only signal.
 %>
 <div x-data="{
        saving: false,

data/lib/studio/color_scale.rb

@@ -85,6 +85,12 @@ module Studio
       (hi + 0.05) / (lo + 0.05)
     end
 
+    # `top` painted at `alpha` over an opaque `bottom`: the colour a browser
+    # composites for a translucent fill like bg-danger/10 on the surface under it.
+    def self.blend(top, bottom, alpha)
+      rgb_to_hex(*hex_to_rgb(top).zip(hex_to_rgb(bottom)).map { |t, b| (t * alpha + b * (1 - alpha)).round })
+    end
+
     def self.with_opacity(hex, opacity)
       r, g, b = hex_to_rgb(hex)
       "rgba(#{r},#{g},#{b},#{opacity})"

data/lib/studio/js_identifier.rb

@@ -5,9 +5,10 @@ module Studio
   #     <button @click="$store.<%= modal_store %>.close()">
   #
   # THE SIBLING OF Studio::JsLiteral, AND ITS OPPOSITE. Both exist for the same
-  # silent failure: a host value that makes an Alpine expression a SyntaxError, so
+  # quiet failure: a host value that makes an Alpine expression a SyntaxError, so
   # the component mounts as a NO-OP that still renders every element. Perfect
-  # markup, dead card, nothing raised and nothing logged. The two differ on the
+  # markup, dead card, nothing raised server-side, and only an Alpine Expression
+  # Error in the browser console to say why. The two differ on the
   # only question that matters — WHAT THE VALUE IS:
   #
   #   STRING position  — the value is DATA inside a JS literal. Any character is

data/lib/studio/js_literal.rb

@@ -4,7 +4,9 @@ module Studio
   # ONE home for the repair that keeps a host-supplied value from bricking an
   # Alpine component when it is spliced into a JS-evaluating HTML attribute.
   #
-  # THE FAILURE THIS EXISTS FOR is silent, which is the whole reason it is worth a
+  # THE FAILURE THIS EXISTS FOR is quiet — no server error, no failing render
+  # test, only an Alpine Expression Error in the browser console — which is the
+  # whole reason it is worth a
   # module instead of a convention. A local sits inside a JS single-quoted literal
   # in a double-quoted attribute:
   #

data/lib/studio/theme_resolver.rb

@@ -31,6 +31,8 @@ module Studio
       dark_base   = colors[:dark] || "#1A1535"
       primary     = colors[:primary] || "#8E82FE"
       border_rgb  = ColorScale.lighten(dark_base, 0.30)
+      success     = colors[:success] || "#4BAF50"
+      warning     = colors[:warning] || "#FF7C47"
       danger      = colors[:danger] || "#EF4444"
       surfaces    = dark_surfaces(dark_base)
 
@@ -69,8 +71,8 @@ module Studio
         "--color-shadow"         => "transparent",
         "--color-cta"            => primary,
         "--color-cta-hover"      => ColorScale.darken(primary, 0.30),
-        "--color-success"        => colors[:success] || "#4BAF50",
-        "--color-warning"        => colors[:warning] || "#FF7C47",
+        "--color-success"        => success,
+        "--color-warning"        => warning,
         "--color-danger"         => danger,
         # THE DANGER *INK*, which is not the danger *colour*. --color-danger is a
         # brand fill (button backgrounds, borders) and is free to be vivid;
@@ -85,8 +87,17 @@ module Studio
         # start: 0.0 is deliberate — the search tries the operator's actual danger
         # colour FIRST and blends only as far as AA demands, so a theme whose red
         # already passes keeps its exact brand hex.
+        #
+        # The warning and success inks are the same contract for the other two
+        # status roles: their default colours fail AA as text on the light
+        # surfaces too. They are found by #status_ink, which also counts the
+        # role's own tint as a surface, because they are read inside tinted
+        # badges. Danger text is not: it belongs on a theme surface, never on a
+        # danger tint (see #status_ink for why that is a rule, not an accident).
         "--color-danger-ink"     => contrast_ink(danger, direction: :lighten, start: 0.0, target: 4.5,
-                                                 against: dark_surfaces(dark_base)),
+                                                 against: surfaces),
+        "--color-warning-ink"    => status_ink(warning, surfaces, direction: :lighten),
+        "--color-success-ink"    => status_ink(success, surfaces, direction: :lighten),
         "--color-accent"         => colors[:accent] || "#F72585"
       }
     end
@@ -132,6 +143,29 @@ module Studio
       louder ? secondary : muted
     end
 
+    # How strong a status role's tint is where its ink is read on it: the
+    # `bg-<role>/10 text-<role>-ink` badge and flash-panel pattern.
+    STATUS_TINT = 0.10
+
+    # The warning and success inks land on the page surfaces AND on their own
+    # role's tint over each of them (the `bg-warning/10 text-warning-ink`
+    # badge). The tint is darker than a light surface and lighter than a dark
+    # one, so an ink tuned to the bare surfaces alone came out below AA inside
+    # its own badge (default theme: warning 3.91:1 dark, success 4.00:1 dark).
+    # Counting the tints as surfaces closes that.
+    #
+    # --color-danger-ink does NOT go through here, and danger text must not sit
+    # on a danger tint: tuned to bare surfaces it measures 4.10:1 (light) and
+    # 4.18:1 (dark) on its own 10% tint. Consumers already build on that rule (turf-monster's error
+    # contrast guard keeps a control that fails the day danger-ink clears a red
+    # tint), so retuning danger-ink is a sequenced change, not a drive-by one.
+    # test/views/engine_class_vocabulary_test.rb refuses danger-ink on a danger
+    # tint in any engine view.
+    def status_ink(role, surfaces, direction:)
+      tints = surfaces.map { |bg| ColorScale.blend(role, bg, STATUS_TINT) }
+      contrast_ink(role, direction: direction, start: 0.0, target: 4.5, against: surfaces + tints)
+    end
+
     # Bounded, clamped search: raise the blend amount from `start` until the
     # ink clears `target` contrast against every background in `against`.
     # Clamps at 1.0 (pure white/black), so a pathological base degrades to the
@@ -169,6 +203,8 @@ module Studio
     def light_mode_vars
       light_base = colors[:light] || "#f8fafc"
       primary    = colors[:primary] || "#8E82FE"
+      success    = colors[:success] || "#4BAF50"
+      warning    = colors[:warning] || "#FF7C47"
       danger     = colors[:danger] || "#EF4444"
       surfaces   = light_surfaces(light_base)
 
@@ -196,8 +232,8 @@ module Studio
         "--color-shadow"         => "rgba(0,0,0,0.05)",
         "--color-cta"            => primary,
         "--color-cta-hover"      => ColorScale.darken(primary, 0.30),
-        "--color-success"        => colors[:success] || "#4BAF50",
-        "--color-warning"        => colors[:warning] || "#FF7C47",
+        "--color-success"        => success,
+        "--color-warning"        => warning,
         "--color-danger"         => danger,
         # THE DANGER *INK*, which is not the danger *colour*. --color-danger is a
         # brand fill (button backgrounds, borders) and is free to be vivid;
@@ -212,8 +248,13 @@ module Studio
         # start: 0.0 is deliberate — the search tries the operator's actual danger
         # colour FIRST and blends only as far as AA demands, so a theme whose red
         # already passes keeps its exact brand hex.
+        #
+        # The warning and success inks are the same contract for the other two
+        # status roles (see the dark-mode note).
         "--color-danger-ink"     => contrast_ink(danger, direction: :darken, start: 0.0, target: 4.5,
-                                                 against: light_surfaces(light_base)),
+                                                 against: surfaces),
+        "--color-warning-ink"    => status_ink(warning, surfaces, direction: :darken),
+        "--color-success-ink"    => status_ink(success, surfaces, direction: :darken),
         "--color-accent"         => colors[:accent] || "#F72585"
       }
     end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.74.8"
+  VERSION = "0.74.10"
 end

data/tailwind/studio.tailwind.config.js

@@ -92,15 +92,32 @@ module.exports = {
         body:      'var(--color-text-body)',
         secondary: 'var(--color-text-secondary)',
         muted:     'var(--color-text-muted)',
-        // The danger RED as TEXT. Separate from the `danger` brand fill on
-        // purpose: a fill can be vivid, but text must clear WCAG AA 4.5:1 on
-        // every surface, and no static red does that on BOTH themes. The token
-        // is derived per theme by ThemeResolver#contrast_ink.
-        'danger-ink': 'var(--color-danger-ink)',
+        // The status roles as TEXT. Separate from the success / warning /
+        // danger FILLS below on purpose: a fill can be vivid, but text must
+        // clear WCAG AA 4.5:1 on every surface, and none of the default role
+        // colours does that on BOTH themes (#EF4444, #FF7C47 and #4BAF50 all
+        // fail on the light surfaces). Each ink is derived per theme by
+        // ThemeResolver#contrast_ink. There is deliberately NO text-danger,
+        // text-warning or text-success: a bare role colour as text is the
+        // defect, so it stays uncompilable.
+        'danger-ink':  'var(--color-danger-ink)',
+        'warning-ink': 'var(--color-warning-ink)',
+        'success-ink': 'var(--color-success-ink)',
+      },
+      // The status-role FILLS: badge tints, flash panels, borders. Registered
+      // for backgrounds and borders ONLY (not `colors`), so that registering
+      // them cannot also mint the text utilities the comment above rules out.
+      backgroundColor: {
+        success: 'var(--color-success)',
+        warning: 'var(--color-warning)',
+        danger:  'var(--color-danger)',
       },
       borderColor: {
         subtle: 'var(--color-border)',
         strong: 'var(--color-border-strong)',
+        success: 'var(--color-success)',
+        warning: 'var(--color-warning)',
+        danger:  'var(--color-danger)',
       },
     },
   },

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.8
+  version: 0.74.10
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-10 00:00:00.000000000 Z
+date: 2026-09-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails