studio-engine 0.74.9 → 0.74.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54ff8e7d4414fba9258118e2e467a259121eaab850d8ec8cfb574b95acdf8b22
-  data.tar.gz: fdac442335eaa412bc6084ca82b9bc3b9bd7a89eb110a3857d528f89109835dd
+  metadata.gz: 91281f58c1fc5ccba013b728eaaa3fb8b8e1fc40b451e45893b832c83fc02151
+  data.tar.gz: 39ffd06a4758929bbd1af758d17b631596f3b9a4e8cf8df8b54c67c49a0bb8ee
 SHA512:
-  metadata.gz: 5c1619cd191b89affc30ca2182e1cd2f09963afd2c822a9ef335fe67baa8064c21420451dcd046f5fb26258cc14caca45d5cab9e4800e2e64ba74682e8afc311
-  data.tar.gz: 24a428027cc14be60d49771a2721bc31b974ab456fd6c553d97c78463d23de1effa6aa2f56eb4231b4df0b6cff73ca0bc2c171d21f702f42e29de1e9375413a3
+  metadata.gz: 7140c3b5cc09362d78f88924764c6fb8954727e65cc584a25cbaaf58496fc8b50703ebd08146b5b20cb353689150dd0704b9920ca06541025142f8b039f6f8d0
+  data.tar.gz: cae0907183d7e649afbcb450bfcaed6223e2b376337ef0eda86518169c695474b6416dfde78a9fdba0bece899014f16954916560a0dcb431c50a93a67727a963

data/CHANGELOG.md

@@ -4,6 +4,8 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.74.10 — 2026-09-13
+
 ### Fixed
 
 - **The auth resend footer's error line failed WCAG AA in both themes; it now
@@ -17,9 +19,102 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   turf-monster's currentColor ring (`--spinner-track: currentColor;
   --spinner-color: transparent`), so a host that drops its fork sees no change.
   Guarded by `test/views/resend_footer_error_contrast_test.rb`.
+- **The sign-in overlay blurs in every consumer, and the eight engine classes
+  that painted nothing are fixed.** The class vocabulary guard
+  (`test/views/engine_class_vocabulary_test.rb`) listed them as open defects;
+  its allow-list now holds only deliberate JS and test hooks.
+  - `sessions/new`'s SSO overlay used turf-monster's `backdrop-overlay`, so
+    mcritchie-industries showed it with no blur and no scrim. It now carries
+    `backdrop-blur-[2px] backdrop-brightness-70 bg-primary-900/20`, which
+    compiles to turf's `blur(2px) brightness(0.7)` over a 20% primary-900.
+    Guarded by `test/integration/sign_in_overlay_blur_test.rb`, which renders
+    the page and compiles the overlay's classes without the motion layer.
+  - `_email_field`'s `email-reject` shake lived only in turf. The engine's
+    motion layer now owns it under the same name, with byte-compatible
+    keyframes and a reduced-motion variant that keeps the border flash.
+  - `text-danger`, `hover:text-danger`, `text-warning`, `bg-warning/10`,
+    `border-warning/30` and `placeholder-muted` compiled to nothing. The
+    text forms are now `text-danger-ink` and `text-warning-ink`, the fills
+    compile, and `placeholder-muted` is `placeholder:text-muted`. The same
+    fix reaches the success and warning badges in `studio/emails/show` and
+    the flash panel in `studio/email_images/index`, whose classes sit in Ruby
+    strings the guard's scanner cannot read; a raw-source check now covers
+    them. The flash panel is now `bg-surface` with a role border, because
+    danger-ink on a danger tint measures 4.10 to 4.18:1, under AA.
+  - **For consumers:** turf-monster can delete its `@utility backdrop-overlay`
+    (no turf view uses it now) and its `@utility email-reject` plus keyframes.
+    Until it does, turf's utilities-layer copy outranks the engine's rule, so
+    turf keeps its own shake and does not get the reduced-motion variant.
+- **The wallet callback page no longer names one vendor, and a host intent can
+  now narrate the wait.** `solana_sessions/phantom_callback` opened on
+  "Processing Phantom response..." and changed that line only on the legacy
+  sign-in path. So a transaction resumed through `walletOps` showed one sentence
+  for the whole cosign, broadcast and confirm leg: 18 seconds measured on a QA
+  iPhone for a contest entry. That sentence was also wrong for Solflare and
+  Backpack, which the redirect transport serves too. The page now opens on
+  "Processing your wallet's response...". Before it resumes, it listens for a
+  `studio:wallet-progress` event and writes `detail.text` into the status line
+  as text. A push with no text is ignored, so the default stays until something
+  real replaces it. The engine still knows nothing of what the user was doing.
+  Guarded by `test/views/phantom_callback_test.rb` and
+  `test/views/phantom_callback_resume_test.rb`.
+  - **For consumers:** no host edit is needed to get the neutral copy. To
+    narrate, dispatch the event from the intent's `complete()`:
+    `document.dispatchEvent(new CustomEvent('studio:wallet-progress', { detail:
+    { text: '…' } }))`. On the inline transport nothing listens, so the same
+    line is a harmless no-op there.
+
+### Added
+
+- **Warning and success inks, and fills for all three status roles.**
+  `Studio::ThemeResolver` now emits `--color-warning-ink` and
+  `--color-success-ink` beside `--color-danger-ink`, and the preset maps them
+  to `text-warning-ink` and `text-success-ink`. It also registers `success`,
+  `warning` and `danger` as background and border colours, so `bg-warning/10`
+  and `border-danger/30` compile. It deliberately registers no bare
+  `text-<role>`: every default role colour fails AA as text on the light
+  surfaces (warning #FF7C47 2.04:1, success #4BAF50 2.22:1, danger #EF4444
+  3.01:1). The warning and success inks are read inside their own
+  `bg-<role>/10` badge, so `ThemeResolver#status_ink` also counts that tint as
+  a surface; tuned to the bare surfaces alone, the warning ink measured 3.91:1
+  there. `--color-danger-ink` is unchanged. Danger text belongs on a theme
+  surface, never a danger tint, and the vocabulary guard now refuses that
+  combination in engine views. `Studio::ColorScale.blend` composites a
+  translucent fill over a surface. Guarded by
+  `test/lib/status_ink_contrast_test.rb`.
+
+### Changed
+
+- **The vocabulary guard's Tailwind build reads only its probe.** Tailwind v4
+  auto-detects sources from the working directory, which is this repo, so an
+  empty probe compiled to 75 KB. `source(none)` now makes the probe the only
+  source. The build recipe moved to `test/support/engine_tailwind_build.rb`,
+  where the overlay test shares it.
 
 ### Docs
 
+- **The README stops describing a sign-in card the engine no longer ships.**
+  Its "credential slot" section still named `style/modals/_auth` — deleted with
+  the other mirrors in PR #319 — as the renderer of solana-studio's
+  `solana_studio/auth/_wallet_credential`, while `lib/studio.rb` already said the
+  engine ships no auth card. It now says so too, names turf-monster's
+  `app/views/modals/_auth.html.erb` as the authority both cite, and states that
+  the wallet slot currently has NO host: nothing renders it. Whether it should
+  have one is left as an open call. The store-name paragraph now reflects that
+  every store-taking partial validates through `Studio::JsIdentifier`, and
+  `Studio::JsLiteral.in_attribute` is described exactly (it runs
+  `escape_javascript`; ERB does the HTML half).
+- **"Silent no-op" is gone from the modal partials, specimens and escapers.** A
+  quote or apostrophe that breaks an Alpine expression mounts a dead card, but the
+  vendored Alpine logs `Alpine Expression Error` for it. About a dozen comments —
+  shipped partials, specimens, the e2e lab, `JsLiteral` and `JsIdentifier` — said
+  otherwise; `_age_gate`'s also blamed `to_json`, which ERB entity-escapes. Four
+  files also claimed mcritchie-studio and turf-monster fork `studio/modals/_host`;
+  neither has since 2026-08-28. Pinned in `test/docs/modal_host_contract_docs_test.rb`,
+  whose census reads `studio/modals`, `style/modals`, the dummy app, the two
+  modules and the README. The phrase still survives outside it, in the two e2e
+  specs, `studio/emails/show` and `test/integration/style_page_test.rb`.
+
 - **Thirty-five minor versions of shipped entries left `## Unreleased` and moved
   under the version that actually shipped them.** The block spanned 2,382 lines and every
   entry in it had already been published — `accepted` sat on the `v0.74.4` release

data/README.md

@@ -282,8 +282,9 @@ a single-quoted JS string — the shape rule 2 steers you to — has a second wa
 out: a `'`. ERB escapes it to `'`, the parser decodes that straight back
 into the value, and the bare `'` ends the string: the same
 `Alpine Expression Error`. Route such a value through
-`Studio::JsLiteral.in_attribute(value)`, which runs both escapers in the order
-that works; `lib/studio/js_literal.rb` carries the full contract, identifier
+`Studio::JsLiteral.in_attribute(value)`. It runs `escape_javascript` and
+returns an UNMARKED String, so ERB's `<%= %>` does the HTML half on output —
+both escapers, in the order that works, provided you never `raw` it; `lib/studio/js_literal.rb` carries the full contract, identifier
 position (`Studio::JsIdentifier`) included.
 
 These are properties of the HOST, not of any one card, and they apply to every
@@ -296,8 +297,8 @@ partial explaining its own root. Someone writing a NEW partial has no specimen
 to read; they read the host's documentation, so that is where the rules have
 to live.
 
-And a specimen could not carry rule 1 even in principle, which is what settles
-it: the style guide wraps EVERY registration's partial in a `<div>` of its own
+And a specimen could not DEMONSTRATE rule 1 even in principle — many specimen
+headers state it, but none can show it failing — which is what settles it: the style guide wraps EVERY registration's partial in a `<div>` of its own
 — `<template x-if="…"><div><%= render … %></div></template>` — and that
 wrapper supplies the single root the rule is about. A specimen that broke the
 rule would still render correctly in the guide, so the specimens cannot
@@ -324,53 +325,59 @@ What the engine **keeps** is the SESSION half of Solana sign-in:
 `Studio.wallet_sign_in_statement` — the single source for the signed statement,
 which the gem's deep link reads so the two cannot drift.
 
-#### The auth modal's credential slot
-
-The **sign-in modal itself stays here** and is never forked: every app in the
-ecosystem signs people in, and most of them are web2. What varies is *which
-credentials it offers*. Google and magic-link are implemented by this engine and
-render directly. The wallet button is implemented by the web3 layer, so it is
-**contributed** — `style/modals/_auth` looks for a partial at one fixed path and
-renders whatever it finds:
-
-    solana_studio/auth/_wallet_credential     (shipped by the solana-studio gem)
+The callback view is also where a redirect-transport transaction waits while
+the server cosigns and confirms, and it does not know what the user was doing.
+The registered intent does, so the intent narrates: from its `complete()` it
+dispatches `studio:wallet-progress` with `{ detail: { text: '…' } }`, and the
+page writes that text into its status line. With nothing pushed the line reads
+"Processing your wallet's response...", which names no wallet brand. On the
+inline transport nothing listens, so the dispatch is a harmless no-op there.
 
-Bundling the gem **is** the registration. There is no registry call and no
-config flag; an app without that layer renders nothing there, so a web2 app
-carries no wallet markup at all rather than markup hidden behind a flag. This is
-the same optional-partial convention as `modals/_host_extras` above, and it uses
-the same three-term `lookup_context.exists?`.
-
-Copying the auth modal into the gem was rejected deliberately: it would fork a
-surface both apps sign in through, and the two copies would drift — which is how
-the wallet picker reached three copies before it was promoted.
+#### The auth modal's credential slot
 
-**Two layers answer two different questions, and they are not merged:**
+**This engine ships no sign-in card.** Each app owns its own and computes its
+credential buttons itself: turf-monster's is `app/views/modals/_auth.html.erb`,
+which is also the authority `lib/studio.rb` cites beside the Solana routes. The
+engine's one auth card was the living style guide's MIRROR of turf's,
+`style/modals/_auth`, and it was retired with the other mirrors on 2026-09-09
+(PR #319). For sign-in the engine now ships fragments, not a card:
+`studio/modals/shared/_email_field` and `studio/modals/auth/_resend_footer`,
+each carded on the style guide.
+
+**The wallet credential slot has no host today.** solana-studio still ships
+`solana_studio/auth/_wallet_credential`, a Solana button written to be
+*contributed* into a sign-in card rather than copied into one. The retired
+mirror was its only renderer. Neither turf-monster nor mcritchie-studio names
+the path; turf's card draws its wallet button directly. So bundling solana-studio
+no longer puts a wallet button anywhere. Whether the engine should host the slot
+again, or the convention should be retired, is an open call, not a fact this
+README can settle.
+
+**A card that does host it owns the gate.** The retired mirror's rules still
+hold; they simply live in that app's view now. Two layers answer two different
+questions, and they are not merged:
 
 | Question | Answered by | Where it is decided |
 |---|---|---|
-| Is it **implemented**? | the picker is registered, **and** the credential partial resolves | Ruby, in `style/modals/_auth` — gates the render |
+| Is it **implemented**? | the picker is registered, **and** the credential partial resolves (`lookup_context.exists?`, the same three-term check as `modals/_host_extras`) | Ruby, in the hosting card — gates the render |
 | Should it **show**? | `methodOn('wallet')`, falling back to `Studio.auth_method?(:wallet) && Studio.feature?(:web3)` | Alpine, inside the contributed partial — gates visibility |
 
 Both terms of the Ruby gate are load-bearing, and they fail differently. Without
 the **registration** term a layer that ships the credential but not the picker
 draws a button that opens an empty panel — not hypothetical, solana-studio 0.5.2
-shipped exactly that pair. Without the **existence** term an app whose picker
+shipped exactly that pair. Without the **existence** term a card whose picker
 resolves but whose credential does not raises `Missing partial` in front of
-someone signing in, instead of quietly rendering no button.
-
-Policy stays **out** of the Ruby gate on purpose. Folding
-`auth_method?(:wallet)` and `feature?(:web3)` into the render would delete the
-button from the DOM on a web3-off app that bundles the gem — and the "or"
-divider reads `methodOn('wallet')` too, so ticking Solana Wallet on the style
-guide's Sign in card would then float a divider above a button that is not
-there.
+someone signing in, instead of quietly rendering no button. Keep policy out of
+the Ruby gate: folding `auth_method?(:wallet)` and `feature?(:web3)` into the
+render deletes the button from the DOM, while an "or" divider that reads
+`methodOn('wallet')` still draws above the gap.
 
-A contributed partial renders inside the modal's own Alpine scope, so it may use
+The partial renders inside the hosting card's Alpine scope, so it may use
 `methodOn(...)`, `attested()` (the legal-age gate — call it, or wallet becomes
 the one credential that skips attestation) and `props.submitting`. It receives
-one local, `modal_store`: the engine's real host is `"modals"`, the living style
-guide's page-scoped host is `"dsModals"`.
+one local, `modal_store`, the store backing that card's host. solana-studio's
+own header for the partial still describes the engine as its renderer; that is
+the same stale claim, one repo over.
 
 **Name a store like a JavaScript identifier.** Partials splice this local in as a
 bare name — `$store.<name>.current()` — rather than as a string, so a value
@@ -379,10 +386,11 @@ SyntaxError in the whole `x-data`, and Alpine mounts a component that renders
 every element and does nothing. Escaping is not the repair (an escaped identifier
 is a different SyntaxError); a name that matches `/\A[A-Za-z_$][A-Za-z0-9_$]*\z/`
 is. `studio/modals/onboarding/_first_name` enforces exactly that and raises
-`ArgumentError` on anything else — the first partial to do so, not yet the fleet.
-Note the shape decides the repair, not the name of the local: `blocks/_birthday`
-and `blocks/_leveling_activity` pass `modal_store` in *string* position and
-correctly `escape_javascript` it instead.
+`ArgumentError` on anything else, and every store-taking partial now does the
+same through `Studio::JsIdentifier.validate!` — the shell, the blocks and the
+templates alike. Note the shape decides the repair, not the
+name of the local: `blocks/_birthday` passes `modal_store` in *string* position
+(`store: '…'`) and correctly `escape_javascript`s it instead.
 
 It also keeps two blocks the gem renders **by name** across the gem boundary:
 `studio/modals/blocks/wallet_brand_sprite` and `studio/modals/blocks/card_header`.
@@ -409,11 +417,13 @@ default to `"modals"`, so existing call sites are unchanged. The engine's
 
 Two things that will bite you:
 
-- **Render `scoped_host`, not `host`.** This is a non-isolated engine, so an app
-  view at the same path shadows the engine's — and `mcritchie-studio` and
-  `turf-monster` both ship their own `app/views/studio/modals/_host.html.erb`.
-  A page rendering `studio/modals/host` in those apps silently gets the app's
-  fork. `scoped_host` is unforked everywhere.
+- **Render `scoped_host`, not `host`.** `scoped_host` mounts the page's modals
+  on the page's OWN store, which is the point of a page-scoped host; `host` is
+  the app's shared one. The path matters too: this is a non-isolated engine, so
+  an app view at `app/views/studio/modals/_host.html.erb` would shadow the
+  engine's. No consumer ships one today — mcritchie-studio and turf-monster
+  deleted their forks on 2026-08-28 — but nothing stops the next app, and
+  `scoped_host` has never been forked.
 - **Guard registrations with `current()?.id`.** The outer template unmounts one
   tick *after* the stack empties, so a bare `.id` throws on every close.
 

data/app/assets/tailwind/studio_engine/engine-motion.css

@@ -26,6 +26,7 @@
   Action:
     .hold-btn             press-and-hold confirm button       (ported, TM)
     .hold-stack/.fizz-bit the carbonation behind it           (ported, TM)
+    .email-reject         email field rejection shake + fade  (extracted, TM)
 
   Leveling:
     .level-badge(-1..-10) progressive level pill ladder       (ported, TM)
@@ -74,9 +75,9 @@
   - Every tuning knob (duration, size, color, %, delay) is a CSS custom property
     with a sensible themed default, so a caller retunes via `style="--x: ..."`
     or a `:root` override WITHOUT forking the rule.
-  - Namespacing: the two extracted primitives keep their source names
-    (`.studio-border-glow`, `.loading-dots`) so the follow-up de-fork is a pure
-    delete-the-local-copy swap with no view churn; their gem rules are byte-
+  - Namespacing: the extracted primitives keep their source names
+    (`.studio-border-glow`, `.loading-dots`, `.email-reject`) so the follow-up
+    de-fork is a pure delete-the-local-copy swap with no view churn; their gem rules are byte-
     compatible with the app copies, so a transient co-load is a harmless
     duplicate. The reconciled/fresh primitives use fresh generic names
     (`.spinner`, `.sheen`, `.ping`, `.fade-edge`, `.progress-meter`) that no app
@@ -1872,4 +1873,44 @@ body.modal-open { overflow: visible; }
     transition: none !important;
   }
 }
+
+/* =============================================================================
+   13. email-reject — the email field's submit-rejection "no" (extracted, TM)
+   A short horizontal shake plus a danger border that fades back to the resting
+   border .input-field uses (border-strong), so it settles with no flash.
+   studio/modals/shared/_email_field binds it as :class="{ 'email-reject':
+   _rejecting }" when rendered with validator: true; the consumer's
+   emailValidator factory owns the _rejecting STATE, and the engine paints it.
+
+   The name and keyframes are byte-compatible with turf-monster's local
+   @utility, so the two co-load harmlessly until turf deletes its copy. Turf's
+   utilities-layer rule outranks this one until then, so the reduced-motion
+   branch below reaches turf only after that delete.
+
+   Tune:   --email-reject-duration (default 0.55s)
+   ========================================================================== */
+.email-reject {
+  animation: email-reject var(--email-reject-duration, 0.55s) ease-in-out;
+}
+
+@keyframes email-reject {
+  0%   { transform: translateX(0);    border-color: var(--color-danger); }
+  15%  { transform: translateX(-7px); }
+  30%  { transform: translateX(7px);  }
+  45%  { transform: translateX(-5px); }
+  60%  { transform: translateX(4px);  }
+  75%  { transform: translateX(-2px); }
+  100% { transform: translateX(0);    border-color: var(--color-border-strong, inherit); }
+}
+
+/* Reduced motion keeps the signal and drops the shake: the border still flashes
+   danger and fades back, and nothing moves. */
+@keyframes email-reject-fade {
+  0%   { border-color: var(--color-danger); }
+  100% { border-color: var(--color-border-strong, inherit); }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .email-reject { animation-name: email-reject-fade; }
+}
 }

data/app/views/components/_avatar_cropper.html.erb

@@ -34,7 +34,7 @@
       <span x-text="croppedUrl ? 'Change Photo' : 'Upload Photo'"></span>
     </button>
     <template x-if="croppedUrl">
-      <button type="button" @click="removePhoto()" class="text-muted hover:text-danger text-xs transition">Remove</button>
+      <button type="button" @click="removePhoto()" class="text-muted hover:text-danger-ink text-xs transition">Remove</button>
     </template>
   </div>
 

data/app/views/error_logs/index.html.erb

@@ -23,7 +23,7 @@
           }
         ">
     <input type="text" name="q" value="<%= params[:q] %>" placeholder="Search errors... (Esc to clear)" autofocus x-ref="input"
-           class="input-field pr-10 py-2.5 text-sm placeholder-muted"
+           class="input-field pr-10 py-2.5 text-sm placeholder:text-muted"
            :readonly="loading" />
     <div x-show="loading" x-cloak class="absolute right-3 top-1/2 -translate-y-1/2">
       <svg class="animate-spin h-4 w-4 text-primary" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">

data/app/views/schema/index.html.erb

@@ -7,7 +7,7 @@
   <div class="mb-6 relative">
     <input type="text" placeholder="Filter tables..." x-model="search"
            @keydown.escape.prevent="search = ''"
-           class="input-field pr-10 py-2.5 text-sm placeholder-muted" />
+           class="input-field pr-10 py-2.5 text-sm placeholder:text-muted" />
     <button x-show="search.length > 0" x-cloak @click="search = ''"
             class="absolute right-3 top-1/2 -translate-y-1/2 text-muted hover:text-heading transition">
       <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
@@ -47,7 +47,7 @@
                   <td class="px-4 py-1.5">
                     <span class="inline-flex gap-1.5 flex-wrap">
                       <% unless col.null %>
-                        <span class="text-warning font-medium">NOT NULL</span>
+                        <span class="text-warning-ink font-medium">NOT NULL</span>
                       <% end %>
                       <% if col.default.present? %>
                         <span class="text-muted">default: <span class="text-secondary font-mono"><%= col.default %></span></span>

data/app/views/sessions/new.html.erb

@@ -22,7 +22,7 @@
                x-transition:leave="transition ease-in duration-500"
                x-transition:leave-start="opacity-100"
                x-transition:leave-end="opacity-0"
-               class="absolute inset-0 z-10 rounded-2xl cursor-pointer flex items-center justify-center backdrop-overlay">
+               class="absolute inset-0 z-10 rounded-2xl cursor-pointer flex items-center justify-center backdrop-blur-[2px] backdrop-brightness-70 bg-primary-900/20">
             <span class="text-secondary text-xs font-medium uppercase tracking-wider">Click to show other options</span>
           </div>
     <% end %>

data/app/views/solana_sessions/phantom_callback.html.erb

@@ -1,7 +1,14 @@
 <div class="flex flex-col items-center justify-center min-h-[60vh] px-4">
   <div class="text-center">
     <div id="phantom-spinner" class="inline-block w-10 h-10 border-4 border-primary border-t-transparent rounded-full animate-spin mb-4"></div>
-    <p id="phantom-status" class="text-secondary text-sm">Processing Phantom response...</p>
+    <%# THE ONE SENTENCE THE USER READS for the whole return leg, and on a
+        transaction that leg includes the server's cosign, broadcast and confirm.
+        It names the act and not a vendor: the redirect transport returns
+        Phantom, Solflare and Backpack users here alike. The id keeps its old name
+        because the script below addresses it by that name. A registered intent
+        replaces this text through the studio:wallet-progress event (see the
+        resume branch below); with nothing pushed it stays, and stays true. %>
+    <p id="phantom-status" class="text-secondary text-sm">Processing your wallet's response...</p>
     <p id="phantom-error" class="text-red-400 text-sm mt-2 hidden"></p>
   </div>
 
@@ -169,6 +176,37 @@
   if (hasResumer && studio.walletJournal.peek()) {
     dbg('Transport', 'wallet_dl journal present — resuming through walletOps');
 
+    // THE PROGRESS SEAM — the intent speaks, this page listens.
+    //
+    // THE DEFECT IT CLOSES. The status line used to change only on the legacy
+    // path below, past this branch's return, so a transaction resumed here read
+    // one unchanging sentence while the server cosigned, broadcast and
+    // confirmed: 18 seconds measured on a QA iPhone for a contest entry. That
+    // reads as a hang. The registered intent knows what the server is doing and
+    // has no surface on this document; this page has the surface and, by
+    // design, no idea. So the intent dispatches, from its complete():
+    //
+    //   document.dispatchEvent(new CustomEvent('studio:wallet-progress',
+    //     { detail: { text: 'Cosigning and submitting to Solana...' } }));
+    //
+    // An EVENT, not a function the intent must find, because complete() runs on
+    // both transports: on the inline one there is no listener and the dispatch
+    // is a harmless no-op, so the intent needs no check for which document it
+    // is on. And an event, not an option handed through resume, because
+    // solana-studio's resume calls complete() with ctx, result and state and
+    // nothing else, so there is no bag to carry one in.
+    //
+    // INSTALLED BEFORE resume, never after: resume calls complete() in the same
+    // tick, so a push made before its first await would land on no listener.
+    // textContent, never markup. A push with no text is ignored, because a blank
+    // status line reads as the hang this seam exists to end.
+    document.addEventListener('studio:wallet-progress', function(e) {
+      var text = e && e.detail && e.detail.text;
+      if (typeof text !== 'string' || !text.trim()) { return; }
+      dbg('Progress', text);
+      statusEl.textContent = text;
+    });
+
     studio.walletOps.resume(params, {
       navigate: function(url) { window.location.href = url; }
     }).then(function(result) {

data/app/views/studio/email_images/index.html.erb

@@ -26,7 +26,7 @@
   <% end %>
 
   <% flash.each do |type, message| %>
-    <div class="mb-4 rounded-lg px-4 py-3 text-sm <%= type.to_s == "alert" ? "bg-danger/10 text-danger" : "bg-success/10 text-success" %>">
+    <div class="mb-4 rounded-lg px-4 py-3 text-sm bg-surface border <%= type.to_s == "alert" ? "border-danger/30 text-danger-ink" : "border-success/30 text-success-ink" %>">
       <%= message %>
     </div>
   <% end %>

data/app/views/studio/emails/index.html.erb

@@ -15,9 +15,10 @@
      rather than the app's shared `modals` store, so this page works identically
      in an app that renders a shared modal host (mcritchie-studio, turf-monster)
      and one that renders none at all (mcritchie-industries, moms-app). It uses
-     studio/modals/scoped_host, NOT studio/modals/host — the latter is forked by
-     mcritchie-studio and turf-monster, and an app fork shadows the engine's
-     partial in this non-isolated engine. %>
+     studio/modals/scoped_host, NOT studio/modals/host — host is the app's
+     shared store, and in this non-isolated engine an app copy of it would shadow
+     the engine's partial. mcritchie-studio and turf-monster deleted theirs on
+     2026-08-28; scoped_host's path has never been forked. %>
 <% content_for(:title) { "Emails" } %>
 <%
   max_width  = Studio::EmailCatalog::MAX_WIDTH

data/app/views/studio/emails/orphan.html.erb

@@ -15,7 +15,7 @@
           class: "text-sm text-muted hover:text-heading underline underline-offset-2" %>
     <h1 class="text-3xl font-bold text-heading mt-2">Unregistered email</h1>
     <div class="flex flex-wrap items-center gap-2 mt-3">
-      <span class="badge bg-warning/10 text-warning border-warning/30 whitespace-nowrap">Not registered</span>
+      <span class="badge bg-warning/10 text-warning-ink border-warning/30 whitespace-nowrap">Not registered</span>
       <span class="font-mono text-2xs text-muted"><%= @key %></span>
     </div>
   </header>

data/app/views/studio/emails/show.html.erb

@@ -66,16 +66,16 @@
   badge_class, badge_label, badge_note =
     case source
     when :app
-      ["badge bg-success/10 text-success border-success/30", "Uploaded here",
+      ["badge bg-success/10 text-success-ink border-success/30", "Uploaded here",
        "Stored for #{Studio.app_name} — this upload is what ships."]
     when :app_asset
-      ["badge bg-success/10 text-success border-success/30", "#{Studio.app_name}'s artwork",
+      ["badge bg-success/10 text-success-ink border-success/30", "#{Studio.app_name}'s artwork",
        "Committed in this app's own assets. Upload to replace it."]
     when :engine_default
       ["badge bg-inset text-muted border-subtle", "Studio default",
        "Shared artwork that ships with the engine. Upload to make it #{Studio.app_name}'s."]
     else
-      ["badge bg-warning/10 text-warning border-warning/30", "No image",
+      ["badge bg-warning/10 text-warning-ink border-warning/30", "No image",
        "This email sends without a banner."]
     end
 %>
@@ -476,7 +476,7 @@
       </div>
     <% end %>
     <% if @preview_error.present? %>
-      <p class="text-2xs text-danger mt-2 px-1 font-mono break-all"><%= @preview_error %></p>
+      <p class="text-2xs text-danger-ink mt-2 px-1 font-mono break-all"><%= @preview_error %></p>
     <% end %>
   </section>
 
@@ -507,9 +507,10 @@
 
   <% if @uploads_available %>
     <%# Cropper + the page-scoped modal host, exactly as the index mounts them:
-        scoped_host rather than modals/host, because mcritchie-studio and
-        turf-monster both ship app copies of modals/host that shadow the engine's
-        in this non-isolated engine.
+        scoped_host rather than modals/host, because this page mounts its modals
+        on its OWN store, and because scoped_host's path has never been forked
+        (an app copy of modals/host would shadow the engine's in this
+        non-isolated engine; none ships one today).
 
         Optional chaining on current() is load-bearing: the outer template
         unmounts one tick AFTER the stack empties, so a bare .id throws on every

data/app/views/studio/modals/_crop_photo.html.erb

@@ -28,8 +28,9 @@
 <% crop_store = local_assigns.fetch(:store, "modals") %>
 <%# STRING position, so it is ESCAPED rather than validated: the store name is
     handed to cropPhotoModal as a JS string argument, not spliced in as a bare
-    identifier. An apostrophe would close that literal and mount the modal as a
-    silent no-op that still renders every element below. Studio::JsLiteral carries
+    identifier. An apostrophe would close that literal and mount the modal dead:
+    every element below still renders, and the only signal is an Alpine
+    Expression Error in the browser console. Studio::JsLiteral carries
     why both escapers have to run. %>
 <% crop_store_js = Studio::JsLiteral.in_attribute(crop_store) %>
 <div x-data="cropPhotoModal({ store: '<%= crop_store_js %>' })">

data/app/views/studio/modals/_scoped_host.html.erb

@@ -5,12 +5,13 @@
 
   Why this exists as a separate partial rather than a local on
   studio/modals/_host: this is a NON-ISOLATED engine, so an app view at the same
-  path SHADOWS the engine's. `mcritchie-studio` and `turf-monster` both ship
-  their own app/views/studio/modals/_host.html.erb — older, simpler copies that
-  know nothing of a store: local. A page rendering "studio/modals/host" in those
-  apps silently gets the fork, and its page-scoped store is never registered.
-  This partial's path is unforked in every app, so it renders the engine's code
-  everywhere. (The living style guide hand-rolled the same thing inline for the
+  path SHADOWS the engine's. mcritchie-studio and turf-monster each carried an
+  app copy of app/views/studio/modals/_host.html.erb — older, simpler copies that
+  knew nothing of a store: local — until both were deleted on 2026-08-28. No consumer
+  forks _host today, but nothing stops the next one, and a page rendering
+  "studio/modals/host" in such an app would silently get the fork with its
+  page-scoped store never registered. This partial's path has never been forked,
+  so it renders the engine's code everywhere. (The living style guide hand-rolled the same thing inline for the
   same reason; it can rebase onto this later.)
 
   Two independent problems it solves at once:

data/app/views/studio/modals/blocks/_age_gate.html.erb

@@ -73,10 +73,14 @@
        get minAge() { return <%= min_age.present? ? min_age.to_i : 0 %> || this.props.minAge || null; },
        get stateCode() { return '<%= j state %>' || this.props.state || ''; },
        get headline() {
-         // Single-quoted + j-escaped, NOT to_json: to_json emits DOUBLE quotes,
-         // which close this double-quoted x-data attribute and mount the
-         // component as a silent no-op. The markup still renders, so every
-         // assertion passes while the card is dead in a browser.
+         // Single-quoted + j-escaped. A plain ERB to_json would in fact survive
+         // here: to_json returns an UNMARKED String, so ERB entity-escapes its
+         // quotes and this double-quoted x-data attribute stays whole. The
+         // hazard is a raw or html_safe one, whose bare quote closes the
+         // attribute and mounts the card dead: the markup still renders, every
+         // assertion passes, and the only signal is an Alpine Expression Error
+         // in the browser console. Studio::JsLiteral.in_attribute is the
+         // engine's contract for a value in this position.
          var t = '<%= j title.to_s %>';
          return t ? t : 'Easy, Young’un';
        },

data/app/views/studio/modals/blocks/_entry_confirmed.html.erb

@@ -76,7 +76,8 @@
   # STRING position — clusterParam is a JS string on the root scope that
   # _success_card's tx-link concatenates into a URL. An apostrophe closes the
   # literal and the whole x-data becomes a SyntaxError, which mounts this card and
-  # every nested block as a silent no-op. props_expr one line up is the OPPOSITE
+  # every nested block dead: all of it renders, and only the browser console says
+  # why (an Alpine Expression Error). props_expr one line up is the OPPOSITE
   # shape (an Alpine expression by contract) and is deliberately left alone.
   cluster_param_js = Studio::JsLiteral.in_attribute(cluster_param)
   lobby_url_key    = local_assigns.fetch(:lobby_url_key, "props.lobbyUrl")

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -83,8 +83,9 @@
   CRITICAL (Alpine): this partial is cloned from a <template x-if> by the modal
   host, so it must have ONE root element, and the x-data below is a
   DOUBLE-QUOTED attribute — a single " anywhere inside it (a code comment
-  included) closes it early and the whole component mounts as a silent no-op that
-  still renders markup. Keep every inner string SINGLE-quoted.
+  included) closes it early and the whole component mounts dead: it still renders
+  markup, and the only signal is an Alpine Expression Error in the browser
+  console. Keep every inner string SINGLE-quoted.
 
   THE TWO SHAPES — read this before adding a local to the x-data. Five locals are
   interpolated into that attribute and they do NOT take the same repair. Getting
@@ -93,7 +94,7 @@
 
     STRING position — empty_error, submit_path, skip_path, done_event — each sits
       inside a JS SINGLE-quoted literal. A bare apostrophe closes the literal, the
-      expression becomes a SyntaxError, and the card is that silent no-op. Repair:
+      expression becomes a SyntaxError, and the card is that dead component. Repair:
       Studio::JsLiteral.in_attribute, which is where the mechanism now lives and is
       tested. Two escapers have to run — one for the JS literal, one for the
       attribute — and the second only runs on a value ERB still believes is unsafe.
@@ -146,8 +147,8 @@
   # first HOST-SUPPLIED PROSE to go inside that attribute, and prose has
   # apostrophes. Interpolated raw, an error reading "We'll need a name" would
   # close the JS single-quoted string, make the whole expression a SyntaxError,
-  # and mount the component as a SILENT NO-OP that still renders every element
-  # below. Studio::JsLiteral.in_attribute covers the apostrophe, the double quote,
+  # and mount the component DEAD: it still renders every element below, and
+  # only the browser console says why (an Alpine Expression Error). Studio::JsLiteral.in_attribute covers the apostrophe, the double quote,
   # the backslash and the newline, AND hands ERB a value it still believes is
   # unsafe so the attribute's own escaping runs too — a safe string would skip that
   # half and could smuggle a raw double quote in, the exact failure the CRITICAL
@@ -184,8 +185,8 @@
   # THE SAME HAZARD empty_error_js CARRIES, on the three remaining locals that land
   # inside a JS SINGLE-quoted literal in the x-data below. A bare apostrophe in any
   # of them closes its literal, the whole expression becomes a SyntaxError, and
-  # Alpine mounts the component as a SILENT NO-OP that still renders every element
-  # — perfect-looking markup, dead card.
+  # Alpine mounts the component DEAD — perfect-looking markup, a card that does
+  # nothing, and an Alpine Expression Error in the console as the only signal.
   #
   # WHY A METHOD RATHER THAN escape_javascript AT EACH SITE: the second escaper is
   # conditional. ERB skips a value that answers true to html_safe, and

data/app/views/style/modals/_newsletter_email.html.erb

@@ -15,7 +15,8 @@
   path instead of two. Here the callback resolves locally.
 
   Single root, and everything inside the double-quoted x-data is single-quoted —
-  an inner double quote closes the attribute and mounts a silent no-op.
+  an inner double quote closes the attribute and mounts a dead component whose
+  only signal is an Alpine Expression Error in the browser console.
 %>
 <div x-data="{
        email: '',

data/app/views/style/modals/_unsubscribe_confirm.html.erb

@@ -23,7 +23,8 @@
 
   Single root: the outer <div> is the host's required root, and everything inside
   the double-quoted x-data is single-quoted — an inner double quote closes the
-  attribute and mounts the component as a silent no-op.
+  attribute and mounts the component dead, with an Alpine Expression Error in
+  the browser console as the only signal.
 %>
 <div x-data="{
        saving: false,

data/lib/studio/color_scale.rb

@@ -85,6 +85,12 @@ module Studio
       (hi + 0.05) / (lo + 0.05)
     end
 
+    # `top` painted at `alpha` over an opaque `bottom`: the colour a browser
+    # composites for a translucent fill like bg-danger/10 on the surface under it.
+    def self.blend(top, bottom, alpha)
+      rgb_to_hex(*hex_to_rgb(top).zip(hex_to_rgb(bottom)).map { |t, b| (t * alpha + b * (1 - alpha)).round })
+    end
+
     def self.with_opacity(hex, opacity)
       r, g, b = hex_to_rgb(hex)
       "rgba(#{r},#{g},#{b},#{opacity})"

data/lib/studio/js_identifier.rb

@@ -5,9 +5,10 @@ module Studio
   #     <button @click="$store.<%= modal_store %>.close()">
   #
   # THE SIBLING OF Studio::JsLiteral, AND ITS OPPOSITE. Both exist for the same
-  # silent failure: a host value that makes an Alpine expression a SyntaxError, so
+  # quiet failure: a host value that makes an Alpine expression a SyntaxError, so
   # the component mounts as a NO-OP that still renders every element. Perfect
-  # markup, dead card, nothing raised and nothing logged. The two differ on the
+  # markup, dead card, nothing raised server-side, and only an Alpine Expression
+  # Error in the browser console to say why. The two differ on the
   # only question that matters — WHAT THE VALUE IS:
   #
   #   STRING position  — the value is DATA inside a JS literal. Any character is

data/lib/studio/js_literal.rb

@@ -4,7 +4,9 @@ module Studio
   # ONE home for the repair that keeps a host-supplied value from bricking an
   # Alpine component when it is spliced into a JS-evaluating HTML attribute.
   #
-  # THE FAILURE THIS EXISTS FOR is silent, which is the whole reason it is worth a
+  # THE FAILURE THIS EXISTS FOR is quiet — no server error, no failing render
+  # test, only an Alpine Expression Error in the browser console — which is the
+  # whole reason it is worth a
   # module instead of a convention. A local sits inside a JS single-quoted literal
   # in a double-quoted attribute:
   #

data/lib/studio/theme_resolver.rb

@@ -31,6 +31,8 @@ module Studio
       dark_base   = colors[:dark] || "#1A1535"
       primary     = colors[:primary] || "#8E82FE"
       border_rgb  = ColorScale.lighten(dark_base, 0.30)
+      success     = colors[:success] || "#4BAF50"
+      warning     = colors[:warning] || "#FF7C47"
       danger      = colors[:danger] || "#EF4444"
       surfaces    = dark_surfaces(dark_base)
 
@@ -69,8 +71,8 @@ module Studio
         "--color-shadow"         => "transparent",
         "--color-cta"            => primary,
         "--color-cta-hover"      => ColorScale.darken(primary, 0.30),
-        "--color-success"        => colors[:success] || "#4BAF50",
-        "--color-warning"        => colors[:warning] || "#FF7C47",
+        "--color-success"        => success,
+        "--color-warning"        => warning,
         "--color-danger"         => danger,
         # THE DANGER *INK*, which is not the danger *colour*. --color-danger is a
         # brand fill (button backgrounds, borders) and is free to be vivid;
@@ -85,8 +87,17 @@ module Studio
         # start: 0.0 is deliberate — the search tries the operator's actual danger
         # colour FIRST and blends only as far as AA demands, so a theme whose red
         # already passes keeps its exact brand hex.
+        #
+        # The warning and success inks are the same contract for the other two
+        # status roles: their default colours fail AA as text on the light
+        # surfaces too. They are found by #status_ink, which also counts the
+        # role's own tint as a surface, because they are read inside tinted
+        # badges. Danger text is not: it belongs on a theme surface, never on a
+        # danger tint (see #status_ink for why that is a rule, not an accident).
         "--color-danger-ink"     => contrast_ink(danger, direction: :lighten, start: 0.0, target: 4.5,
-                                                 against: dark_surfaces(dark_base)),
+                                                 against: surfaces),
+        "--color-warning-ink"    => status_ink(warning, surfaces, direction: :lighten),
+        "--color-success-ink"    => status_ink(success, surfaces, direction: :lighten),
         "--color-accent"         => colors[:accent] || "#F72585"
       }
     end
@@ -132,6 +143,29 @@ module Studio
       louder ? secondary : muted
     end
 
+    # How strong a status role's tint is where its ink is read on it: the
+    # `bg-<role>/10 text-<role>-ink` badge and flash-panel pattern.
+    STATUS_TINT = 0.10
+
+    # The warning and success inks land on the page surfaces AND on their own
+    # role's tint over each of them (the `bg-warning/10 text-warning-ink`
+    # badge). The tint is darker than a light surface and lighter than a dark
+    # one, so an ink tuned to the bare surfaces alone came out below AA inside
+    # its own badge (default theme: warning 3.91:1 dark, success 4.00:1 dark).
+    # Counting the tints as surfaces closes that.
+    #
+    # --color-danger-ink does NOT go through here, and danger text must not sit
+    # on a danger tint: tuned to bare surfaces it measures 4.10:1 (light) and
+    # 4.18:1 (dark) on its own 10% tint. Consumers already build on that rule (turf-monster's error
+    # contrast guard keeps a control that fails the day danger-ink clears a red
+    # tint), so retuning danger-ink is a sequenced change, not a drive-by one.
+    # test/views/engine_class_vocabulary_test.rb refuses danger-ink on a danger
+    # tint in any engine view.
+    def status_ink(role, surfaces, direction:)
+      tints = surfaces.map { |bg| ColorScale.blend(role, bg, STATUS_TINT) }
+      contrast_ink(role, direction: direction, start: 0.0, target: 4.5, against: surfaces + tints)
+    end
+
     # Bounded, clamped search: raise the blend amount from `start` until the
     # ink clears `target` contrast against every background in `against`.
     # Clamps at 1.0 (pure white/black), so a pathological base degrades to the
@@ -169,6 +203,8 @@ module Studio
     def light_mode_vars
       light_base = colors[:light] || "#f8fafc"
       primary    = colors[:primary] || "#8E82FE"
+      success    = colors[:success] || "#4BAF50"
+      warning    = colors[:warning] || "#FF7C47"
       danger     = colors[:danger] || "#EF4444"
       surfaces   = light_surfaces(light_base)
 
@@ -196,8 +232,8 @@ module Studio
         "--color-shadow"         => "rgba(0,0,0,0.05)",
         "--color-cta"            => primary,
         "--color-cta-hover"      => ColorScale.darken(primary, 0.30),
-        "--color-success"        => colors[:success] || "#4BAF50",
-        "--color-warning"        => colors[:warning] || "#FF7C47",
+        "--color-success"        => success,
+        "--color-warning"        => warning,
         "--color-danger"         => danger,
         # THE DANGER *INK*, which is not the danger *colour*. --color-danger is a
         # brand fill (button backgrounds, borders) and is free to be vivid;
@@ -212,8 +248,13 @@ module Studio
         # start: 0.0 is deliberate — the search tries the operator's actual danger
         # colour FIRST and blends only as far as AA demands, so a theme whose red
         # already passes keeps its exact brand hex.
+        #
+        # The warning and success inks are the same contract for the other two
+        # status roles (see the dark-mode note).
         "--color-danger-ink"     => contrast_ink(danger, direction: :darken, start: 0.0, target: 4.5,
-                                                 against: light_surfaces(light_base)),
+                                                 against: surfaces),
+        "--color-warning-ink"    => status_ink(warning, surfaces, direction: :darken),
+        "--color-success-ink"    => status_ink(success, surfaces, direction: :darken),
         "--color-accent"         => colors[:accent] || "#F72585"
       }
     end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.74.9"
+  VERSION = "0.74.10"
 end

data/tailwind/studio.tailwind.config.js

@@ -92,15 +92,32 @@ module.exports = {
         body:      'var(--color-text-body)',
         secondary: 'var(--color-text-secondary)',
         muted:     'var(--color-text-muted)',
-        // The danger RED as TEXT. Separate from the `danger` brand fill on
-        // purpose: a fill can be vivid, but text must clear WCAG AA 4.5:1 on
-        // every surface, and no static red does that on BOTH themes. The token
-        // is derived per theme by ThemeResolver#contrast_ink.
-        'danger-ink': 'var(--color-danger-ink)',
+        // The status roles as TEXT. Separate from the success / warning /
+        // danger FILLS below on purpose: a fill can be vivid, but text must
+        // clear WCAG AA 4.5:1 on every surface, and none of the default role
+        // colours does that on BOTH themes (#EF4444, #FF7C47 and #4BAF50 all
+        // fail on the light surfaces). Each ink is derived per theme by
+        // ThemeResolver#contrast_ink. There is deliberately NO text-danger,
+        // text-warning or text-success: a bare role colour as text is the
+        // defect, so it stays uncompilable.
+        'danger-ink':  'var(--color-danger-ink)',
+        'warning-ink': 'var(--color-warning-ink)',
+        'success-ink': 'var(--color-success-ink)',
+      },
+      // The status-role FILLS: badge tints, flash panels, borders. Registered
+      // for backgrounds and borders ONLY (not `colors`), so that registering
+      // them cannot also mint the text utilities the comment above rules out.
+      backgroundColor: {
+        success: 'var(--color-success)',
+        warning: 'var(--color-warning)',
+        danger:  'var(--color-danger)',
       },
       borderColor: {
         subtle: 'var(--color-border)',
         strong: 'var(--color-border-strong)',
+        success: 'var(--color-success)',
+        warning: 'var(--color-warning)',
+        danger:  'var(--color-danger)',
       },
     },
   },

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.9
+  version: 0.74.10
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-10 00:00:00.000000000 Z
+date: 2026-09-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails