studio-engine 0.74.1 → 0.74.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d056d9eddc4bd13c863b5ec0f3e239e7591fc16ddd2170ac5192537f5a190326
-  data.tar.gz: 289b7050571718689aa567db5f0434be21c41ee7074b4b49d26969f16b07a815
+  metadata.gz: 6694226dcc9e100149692ef60162478d4927a69280343c5047c0222517f1f68c
+  data.tar.gz: 8e6b5c07f8bb5fa60466049f321c7be0a09168fb750766202a5d122734cb6699
 SHA512:
-  metadata.gz: 15c2e97be72e8fe2e4e67719a569f6d456f82e961fd36b11d0c5062d8ace97836316398eef5058bf9436cdec7ec4ed33aca31ca7decf70bcfe3569dd8665e693
-  data.tar.gz: 6dd53cf3747fdb36271afaea5a76c0dc2ee615e25f394083b3219476a5222991999edf97474e1022e9f2f584350ba05b04cbfaa01d5fe0f28ce2995f3a06d6fa
+  metadata.gz: 6ec39596a087d56cc64f3a211ea349bf6a00b7a21c6eb1d1c70b36136dda3f3ab7f8fe1a1f61b26593661283f12707501727d9f3d5119f01b3fa28995ece7bd7
+  data.tar.gz: 3d65093bf62c9088976d9ea56e756cabd7e01e65aaae06205419e337a0d8b6a1a1b93c60b93631bf724d254f01bcdc5fb0c7360c50525c1f519b35b6b7b49946

data/CHANGELOG.md

@@ -6,6 +6,84 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **The email banner assembled two attributes INCLUDING THEIR OWN QUOTES in Ruby,
+  so ERB escaping never ran on them.** `_layered_banner.html.erb` wrote
+  `background="..."` and `bgcolor="..."` as Ruby strings and marked them
+  `html_safe` — the one shape ERB's attribute escaping can never reach. Both now
+  go through `tag.attributes`. This is the EMAIL half of the family PR #303 closed
+  in the modal/Alpine partials.
+
+  **THE RULE IS THE OPPOSITE OF #303'S, and that is the whole point.** There the
+  locals are Alpine EXPRESSIONS: they stay `html_safe` so a handler reaches the
+  browser byte-identical. A background URL and a colour are CONTENT, so they take
+  the FULL escaping a content attribute is owed — the treatment #303 gave the four
+  input constraints. Mark by what the value IS, not by which file it lives in.
+
+  **MEASURED, and worse than the sibling seams.** A double quote in
+  `background_url` did not merely inject an attribute, it ATE the rest of the tag:
+  the cell came back carrying `background`, `quote"`, a lone backslash, `<` and
+  `script`, having LOST `bgcolor`, `width`, `height`, `valign` and `style`
+  outright — five attributes gone from one quote. The failure is
+  a structurally wrecked email — no fallback colour, no dimensions, no
+  background-image CSS — not merely a tainted one.
+
+  **`bgcolor` WAS CLASSIFIED AND CLEARED BEFORE BEING TOUCHED**, because #303's
+  warning was that two of its six candidate sites were already safe.
+  `scrim_solid_hex` formats three integers the model has already clamped to 0-255,
+  so it returns a hash and six hex digits for every input — proven by rendering a
+  hostile scrim, not by reading the method. It is repaired anyway, and the reason
+  is measured: simulating the plausible refactor (the method learning to pass a
+  named colour through) injects an `onload` into every email with the attribute
+  hand-assembled, and merely renders a wrong colour with `tag.attributes` on it.
+
+  **NOTHING MOVED FOR REAL INPUT.** Seven banner shapes rendered before and after,
+  in both email and preview mode, are byte-identical. The one input whose bytes
+  change is a signed CDN URL, whose `&` now ships as `&amp;` — a correction, since
+  the CSS twin and the VML `src` on the SAME element already escaped it and the
+  hand-assembled `background` was the odd one out shipping a bare `&`. Verified in
+  a real browser: the client decodes the attribute, requests the URL with its
+  signature intact, and paints the banner.
+
+- **The Rails guard sweep's non-vacuity check tested a COPY of the scanner, so
+  the scanner could go blind and the suite stayed green.**
+  `rails_guard_sweep_test.rb` is a source scan, and a scan is only trustworthy
+  with a control proving its predicate can still say NO. That control re-typed
+  the rule as string operations on a sample instead of calling the scan's own
+  path: the predicate existed twice, at line 78 and line 101. Measured — typing
+  one typo into line 78 ALONE (`\bRails\.` → `\bRailz\.`), which blinds the net so
+  it can never flag anything no matter what `lib/` contains, left all three tests
+  passing, 0 failures. The floor was being measured against a duplicate
+  implementation, so it certified the copy and never the instrument.
+
+  **THE REPAIR IS ONE DEFINITION, NOT A BETTER COPY.** The rule now lives in a
+  single `offending_line?`, and both the scan and every control call it. The same
+  mutation now reddens `test_the_predicate_still_flags_the_shape_that_was_fixed`
+  by name — while the scan itself still passes, which is precisely the "passes for
+  free" the control exists to catch.
+
+  **THE CONTROLS ARE SPLIT ONE PER CLAUSE**, because `offending_line?` decides on
+  four (comment exemption, mentions `defined?(Rails)`, not already asking
+  `Rails.respond_to?`, and calls a method on the constant) and one combined
+  assertion would go red without saying which clause went inert — the same
+  blindness as the copy, one level in. Each of the four now reddens its own named
+  test. The scan also asserts its EXIT-BLINDNESS FLOOR inside the test that trusts
+  the result — the three named files were swept, and more than 1,000 lines were
+  read — because a scan whose loop never runs reports zero offenders and passes
+  having proved nothing. Six mutations, applied one at a time, each verified red.
+
+  **TWO CLAIMS IN THE ENTRIES BELOW WERE FALSE, and are corrected in this same
+  change.** *The Rails guard sweep really is finished now* said a bare
+  `require "action_view"` is what defines the namespace-only `module Rails`. It is
+  not — measured, that require leaves `Rails` UNDEFINED and never loads
+  rails-html-sanitizer. What defines it is naming a constant under
+  `ActionView::Helpers`, which autoloads the helpers tree; in `studio/js_literal`
+  that is line 66's `extend ActionView::Helpers::JavaScriptHelper`. The same loose
+  sentence had propagated into three test files and is corrected there too. And
+  *`Studio::S3` no longer mistakes a Rails NAMESPACE* said `lib/studio.rb` used the
+  repaired form "in three places" — the sweep in this same unreleased block made it
+  FOUR, so a false completeness claim was shipping one sentence above the entry
+  announcing a fix for exactly that.
+
 - **A quote in a host local can no longer close an Alpine attribute and turn the
   rest of the element into markup.** Four partials built an attribute — its OWN
   QUOTES included — as a Ruby String and marked it `html_safe`, which is the one
@@ -81,9 +159,16 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   `Studio.routes`. All three now ask `Rails.respond_to?` first.
 
   **THE MAIL TRANSPORT ONE WAS ARMED, not theoretical.** `lib/studio.rb` requires
-  `studio/js_literal` (line 11) — whose first line is `require "action_view"`,
-  which is what defines the namespace-only `module Rails` — BEFORE it requires
-  `studio/mail_transport` (line 25). Measured at this branch's head, a bare
+  `studio/js_literal` (line 11) BEFORE it requires `studio/mail_transport`
+  (line 25), and loading `js_literal` is what puts the namespace-only `module
+  Rails` in memory. **Not its `require "action_view"`** — measured, that require
+  alone leaves `Rails` UNDEFINED and never loads the sanitizer at all. It is line
+  66, `extend ActionView::Helpers::JavaScriptHelper`: naming anything under
+  `ActionView::Helpers` autoloads the helpers tree, which requires
+  rails-html-sanitizer, and that gem is what ships `module Rails` — with
+  `Rails.methods(false) == []`, no singleton methods at all. The distinction is
+  not pedantry: a file that requires `action_view` and never reaches into
+  `Helpers` does not arm this trap. Measured at this branch's head, a bare
   `Studio::MailTransport.configure!(env: {}, action_mailer: mailer)` died with
   `NoMethodError: undefined method 'env' for module Rails`. No shipped app can
   reach it (every host configures mail from an initializer, where `Rails.env`
@@ -467,10 +552,12 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   long before any application does — ships a namespace-only `module Rails` with no
   singleton methods, so that guard reads true and the next call raises
   `NoMethodError: undefined method 'env' for module Rails`. It now asks
-  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` already uses in three
-  places. **This entry originally called it "the straggler"; that was wrong** —
-  three more sites carried the bare form, swept in *The Rails guard sweep really is
-  finished now* above. No shipped app can reach it — every host boots a
+  `Rails.respond_to?(:env)`, which is the form `lib/studio.rb` now uses in FOUR
+  places: the three it already carried (lines 701, 707 and 742) plus the route
+  guard at line 859. **This entry originally called it "the straggler"; that was
+  wrong** — three more sites carried the bare form, line 859 among them, and all
+  three are swept in *The Rails guard sweep really is finished now* above, in this
+  same unreleased block. No shipped app can reach it — every host boots a
   real application — but the engine's own pure-Ruby unit lane can, and it did:
   adding one `require` for a file that needs `action_view` turned an untouched
   `email_catalog_test` red with two errors about email uploads.

data/app/views/studio/mailers/_layered_banner.html.erb

@@ -66,7 +66,25 @@
 <table role="presentation" width="<%= banner.width %>" cellpadding="0" cellspacing="0" border="0"
        style="width:<%= banner.width %>px;border-collapse:collapse;">
   <tr>
-    <td <%= %(background="#{banner.background_url}").html_safe if banner.background_url.present? %>
+    <%# THE BACKGROUND ATTRIBUTE, EMITTED BY tag.attributes. It was assembled as a
+        Ruby string carrying its OWN quotes and then marked html_safe, which is the
+        one shape ERB's attribute escaping can never reach.
+
+        MEASURED on the unrepaired template, not reasoned about: a double quote in
+        background_url closed the attribute, and the browser read the remainder of
+        the tag as markup. The td came back carrying attributes named `quote"`,
+        `\`, `<` and `script`, and LOST bgcolor, width, height, valign and style
+        outright. That is worse than an injected attribute — the cell loses the
+        fallback colour and both dimensions the whole banner is laid out from, so
+        the failure is a wrecked email, not just a tainted one.
+
+        The URL is CONTENT, not code, so it is passed UNMARKED and takes the full
+        escaping a content attribute is owed. That also closes the latent half: a
+        bare ampersand in a signed-URL query string used to reach the client as the
+        start of an entity. Contrast the Alpine handlers elsewhere in this engine,
+        which stay html_safe precisely because they are expressions the host wrote
+        on purpose. The rule follows what the value IS, not which file it is in. %>
+    <td <%= tag.attributes(background: banner.background_url) if banner.background_url.present? %>
         bgcolor="<%= Studio.theme_primary %>"
         width="<%= banner.width %>" height="<%= banner.height %>" valign="middle"
         style="width:<%= banner.width %>px;height:<%= banner.height %>px;<%= "background-image:url(#{banner.background_url});background-size:cover;background-position:center;background-repeat:no-repeat;" if banner.background_url.present? %>">
@@ -97,7 +115,24 @@
                     contrast case the scrim exists for, in the one client that
                     cannot be spot-checked. Every other client honours the rgba
                     declaration and overrides the flat attribute. %>
-                <%= %(bgcolor="#{banner.scrim_solid_hex}").html_safe if banner.scrim_opacity.positive? %>
+                <%# SAME SHAPE AS THE background ABOVE, AND — stated honestly — NOT
+                    THE SAME LIVE DEFECT. This one was assembled with its own quotes
+                    and marked html_safe too, but the value cannot currently carry a
+                    quote to exploit it: scrim_solid_hex formats three integers the
+                    model has already clamped to 0-255, so it returns a hash sign
+                    and six hex digits for EVERY input. Checked by rendering rather
+                    than by reading, which is the only way that claim is worth
+                    anything: a scrim of `0.5" onload="alert(1)` still came back as
+                    the hex #4C4860, with all five of this cell's attributes intact.
+
+                    It is converted anyway because the SHAPE is the hazard. Safety
+                    here rests on an implementation detail one refactor away from
+                    changing — a scrim that ever learned to accept a named colour
+                    would reopen it silently — and leaving a hand-assembled
+                    attribute beside a repaired one is how the wrong pattern gets
+                    copied next. Same encoder, same reasoning, zero byte movement
+                    for a hex triplet. %>
+                <%= tag.attributes(bgcolor: banner.scrim_solid_hex) if banner.scrim_opacity.positive? %>
                 style="height:<%= banner.height %>px;padding:0 <%= side_padding %>px;<%= "background-color:rgba(24,16,64,#{banner.scrim_opacity});" if banner.scrim_opacity.positive? %>">
               <% if preview || banner.header.present? %>
                 <p<%= hook.call("header") %> style="margin:0 0 <%= gap_after_header %>px;font-family:Montserrat,'Segoe UI',Helvetica,Arial,sans-serif;font-size:<%= header_size %>px;line-height:<%= header_line %>px;font-weight:700;color:#ffffff;">

data/app/views/style/_modals.html.erb

@@ -468,14 +468,6 @@
                     resolve_expr: "$store.dsModals.close()" %></div>
         </template>
 
-        <%# wallet-setup — registered here with the other cards this page opens.
-            Its CARD lives in the Web3 section (it is about getting a wallet); the
-            3-of-3 pill it renders is the HOST's onboarding chain position, which
-            is not this page's business. The Onboarding section that used to own
-            it was folded into Profile on 2026-08-24. %>
-        <template x-if="$store.dsModals.current().id === 'wallet-setup'">
-          <div><%= render "style/modals/wallet_setup" %></div>
-        </template>
 
         <%# --- Batch 3: the modals that had no card on EITHER page --- %>
         <template x-if="$store.dsModals.current().id === 'it-begins'">
@@ -504,21 +496,12 @@
         <template x-if="$store.dsModals.current().id === 'ds-onramp-hub'">
           <div><%= render "style/modals/ds_onramp_hub" %></div>
         </template>
-        <template x-if="$store.dsModals.current().id === 'ds-buy-entry-token'">
-          <div><%= render "style/modals/ds_buy_entry_token" %></div>
-        </template>
-        <template x-if="$store.dsModals.current().id === 'ds-cdp-ramp'">
-          <div><%= render "style/modals/ds_cdp_ramp" %></div>
-        </template>
         <template x-if="$store.dsModals.current().id === 'ds-newsletter-success'">
           <div><%= render "style/modals/ds_newsletter_success" %></div>
         </template>
         <template x-if="$store.dsModals.current().id === 'rate-limit-general'">
           <div><%= render "style/modals/rate_limit_general" %></div>
         </template>
-        <template x-if="$store.dsModals.current().id === 'wallet-changed'">
-          <div><%= render "style/modals/wallet_changed" %></div>
-        </template>
 
         <%# --- Newsletter exit + the off-page quest celebration --- %>
         <template x-if="$store.dsModals.current().id === 'quest-success'">
@@ -534,9 +517,6 @@
         </template>
 
         <%# --- Web3 --- %>
-        <template x-if="$store.dsModals.current().id === 'cosign-rejected'">
-          <div><%= render "style/modals/cosign_rejected" %></div>
-        </template>
         <%# Both web3 sign-in cards render from SOLANA-STUDIO, and both are the
             REAL shipped partials rather than style-guide forks — the same files
             turf-monster renders in production, so what is reviewed here IS the
@@ -1187,9 +1167,9 @@
           listed for reference but <strong>cannot be opened here</strong>. Nothing
           registers them, so a trigger would open an empty panel.
         <% end %>
-        The cards run in the order a player meets them &mdash; <strong>get a wallet,
-        prove it, spend from it</strong>: Connect wallet &rarr; Setup Wallet &rarr;
-        the two Sign Wallet states &rarr; Processing &rarr; success or error &rarr;
+        The cards run in the order a player meets them &mdash; <strong>connect a
+        wallet, prove it, spend from it</strong>: Connect wallet &rarr; the two
+        Sign Wallet states &rarr; Processing &rarr; success or error &rarr;
         top-up &rarr; Entry confirmed. Inside that, <strong>Connect Wallet &rarr;
         Processing on-chain transaction &rarr; On-chain success</strong> is a
         <strong>walked flow</strong> and the live card <strong>glows</strong>,
@@ -1212,14 +1192,7 @@
         <strong>standard web3 auth button</strong>: a wallet row (brand mark, the
         wallet&rsquo;s own name, Installed badge, chevron) rather than a filled
         CTA, glowing via <code class="font-mono text-2xs">pulse-cta</code> because
-        it is the one thing to press. Do not confuse them with <strong>Setup
-        Wallet</strong>, immediately before them: that one asks an account to
-        <strong>get</strong> a wallet, these ask an account to
-        <strong>prove</strong> the one it already has &mdash; opposite populations
-        (<code class="font-mono text-2xs">WalletSetupPolicy</code> exits at its own
-        step 1 for an account that holds a wallet), so no user ever meets both.
-        They sit next to each other anyway, because the pair is easiest to keep
-        straight when you can read them side by side.
+        it is the one thing to press.
       </p>
     </div>
     <%# ONE ordered run, read left to right as a player meets it: get a wallet,
@@ -1261,30 +1234,6 @@
           section's business.
           ONE card with a "Wallet detected" toggle rather than two cards sharing a
           modal id: the two Sign Wallet cards below are what that shape costs. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Setup Wallet",
-            reference: %(the "Set up your wallet" card (style/modals/_wallet_setup) — how an account with NO wallet gets one, and the host's third onboarding step (it renders a 3-of-3 pill, which is the host's chain position, not this section's). An APP-SPECIFIC flow: the engine owns only the chrome (shell, progress_pill, wallet_brand_sprite) and the house wallet-row idiom, while extension detection, the 90-second walkthrough video, the Detailed Guide route and the managed-wallet fallback stay in the host (turf-monster's own is ~576 lines). Toggle "Wallet detected" to swap the row between INSTALL and Installed. NOTE it is the OPPOSITE population to the two Sign Wallet cards immediately below — WalletSetupPolicy exits at its own step 1 for an account that already holds a wallet, so no user ever meets both. Open with $store.dsModals.open('wallet-setup', { detected: false })),
-            card_data: "opts: { detected: false }",
-            toggles:   [{ model: "opts.detected", label: "Wallet detected" }],
-            open_expr: "$store.dsModals.open('wallet-setup', { detected: opts.detected })",
-            glow_when: ds_glow.call("wallet-setup"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2">
-          <span class="block h-2 w-20 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <%# the 3-of-3 pill, filled — the whole reason this card sits here %>
-          <span class="flex gap-1">
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-            <span class="flex-1 h-1.5 rounded" style="background: var(--color-cta)"></span>
-          </span>
-          <span class="flex items-center gap-1.5 h-7 w-full rounded-lg border px-1.5" style="border-color: var(--color-border-strong)">
-            <span class="w-4 h-4 rounded shrink-0" style="background: var(--color-primary)"></span>
-            <span class="block h-1.5 w-8 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <%# the walkthrough placeholder, the card's second half %>
-          <span class="block w-full rounded" style="height: 1.6rem; background: var(--color-text); opacity: .10"></span>
-        </div>
-      <% end %>
 
       <%# SIGN WALLET — the web2-session-on-a-wallet-account card. NOT part of the
           walk above: that walk is one on-chain transaction, this is an AUTH state
@@ -1411,20 +1360,6 @@
           no — refusing to co-sign because the transaction it was handed did not
           match the entry it prepared. They sit together because a reviewer
           reading either alone would not know the other existed. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Co-sign refused",
-            reference: %(the "Transaction not signed" card (style/modals/_cosign_rejected) — turf-monster's modals/_cosign_rejected, opened when POST confirm_onchain_entry answers 422 with code tx_rejected: the server refused to co-sign because the submitted transaction did not match the entry it had prepared. APP-SPECIFIC — the engine owns no entry preparation, no co-signing and no verdict; it lends card_header and nothing else. THE COPY IS DELIBERATELY VAGUE and should stay that way: good actors never see this card (it fires on a tampered or mismatched transaction), so naming WHICH server-side check failed would help an attacker probe the validation. What the copy does commit to is the part the one honest user needs — nothing was submitted, the funds are safe. Open with $store.dsModals.open('cosign-rejected')),
-            open_expr: "$store.dsModals.open('cosign-rejected')",
-            glow_when: ds_glow.call("cosign-rejected"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2">
-          <div class="text-2xl leading-none">&#128737;&#65039;</div>
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="block h-1.5 w-full rounded" style="background: var(--color-text); opacity: .3"></span>
-          <span class="block h-1.5 w-28 mx-auto rounded" style="background: var(--color-text); opacity: .3"></span>
-          <span class="block h-5 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
 
       <%# Wallet deposit — standalone top-up card (not part of the walk). %>
       <%= render layout: "style/modal_specimen", locals: {
@@ -1486,41 +1421,7 @@
         </div>
       <% end %>
 
-      <%# ds-buy-entry-token — reached with a lineup picked and no way to pay. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Buy entry token",
-            reference: %(the entry-token purchase (style/modals/_ds_buy_entry_token) — turf-monster's modals/_buy_entry_token, built from blocks/_close_x and two blocks/_rail_row. Reached when a player has picked a lineup and has no way to pay for it, which is why the copy says the lineup is SAVED: losing their picks is the one thing they are afraid of at that moment. The ranking is a PRODUCT decision rather than a visual one — Coinflow leads and carries the "New" badge because it mints a spendable entry token directly, the shortest path from here to being in the contest, while Stripe swaps into the auth wizard's tokens picker, the older and longer path, and defers. Open with $store.dsModals.open('ds-buy-entry-token')),
-            open_expr: "$store.dsModals.open('ds-buy-entry-token')",
-            glow_when: ds_glow.call("ds-buy-entry-token"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 space-y-2">
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="flex items-center gap-1.5 rounded-md p-1.5" style="border: 2px solid var(--color-primary)">
-            <span class="block h-4 w-4 rounded" style="background: var(--color-cta)"></span>
-            <span class="block h-1.5 flex-1 rounded" style="background: var(--color-text); opacity: .3"></span>
-          </span>
-          <span class="flex items-center gap-1.5 rounded-md p-1.5 border border-subtle">
-            <span class="block h-4 w-4 rounded" style="background: var(--color-text); opacity: .25"></span>
-            <span class="block h-1.5 flex-1 rounded" style="background: var(--color-text); opacity: .18"></span>
-          </span>
-        </div>
-      <% end %>
 
-      <%# ds-cdp-ramp — ONE of thirteen states, and the card says so. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Coinbase ramp (preflight)",
-            reference: %(the Coinbase ramp's BUY PREFLIGHT (style/modals/_ds_cdp_ramp) — turf-monster's modals/_cdp_ramp. DELIBERATELY PARTIAL: that modal is a TWO-FLOW step machine (buy and cash-out) across THIRTEEN states — preflight, opening, waiting, awaiting-cdp, send, settling and the rest — and this cards exactly one of them, the buy preflight, which is the state both funding cards hand off to and therefore the only one a player reaches without already being mid-flow. The other twelve are uncarded BY DECISION (operator, 2026-08-26), which is a different thing from an oversight — a cabinet that shows one state of a thirteen-state machine without admitting it teaches a reader that the machine is simpler than it is. /tasks/port-cdp-ramp-specimen holds the full state map if that decision reverses. Open with $store.dsModals.open('ds-cdp-ramp')),
-            open_expr: "$store.dsModals.open('ds-cdp-ramp')",
-            glow_when: ds_glow.call("ds-cdp-ramp"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2 relative">
-          <span class="absolute top-1 right-2 text-secondary leading-none">&times;</span>
-          <span class="block h-2 w-28 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <span class="block h-1.5 w-full rounded" style="background: var(--color-text); opacity: .12"></span>
-          <span class="block h-1.5 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .12"></span>
-          <span class="block h-4 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
 
       <%# Entry confirmed — the GENERIC web3 celebration (tx link + heading + drain
           CTA). seedsEarned: 0 so no seeds bar even where leveling is on: this card
@@ -1567,30 +1468,6 @@
         </div>
       <% end %>
 
-      <%# wallet-changed — the extension switched accounts underneath the session.
-          Both addresses are shown because recognising your own is the only way to
-          tell a deliberate switch from an accident. %>
-      <%= render layout: "style/modal_specimen", locals: {
-            label:     "Wallet changed",
-            reference: %(the Web3 "Wallet changed" reconciliation (style/modals/_wallet_changed) — turf-monster's modals/_wallet_changed, fired when the person switches accounts inside their wallet extension while signed in. Composes the engine's blocks/_card_header; the switch itself belongs to turf's wallet store (continueSwitch) and the engine owns no wallet. Nothing is broken — but the session and the extension now disagree about who this is, and every on-chain action from here would use an identity the page is not showing. So it prints BOTH addresses, truncated the Solana way, because recognising your own is the one check the app cannot make for you. Continuing re-derives a session against the new wallet, which is a round trip, so the button carries a busy state rather than looking dead. Open with $store.dsModals.open('wallet-changed', { currentAddress: '…', newAddress: '…' })),
-            open_expr: "$store.dsModals.open('wallet-changed', { currentAddress: '7xKpDemoSignedInWallet9JZ2Q', newAddress: '9mQtDemoSwitchedWalletLd4V' })",
-            glow_when: ds_glow.call("wallet-changed"),
-            disabled: !web3_on, openable: true } do %>
-        <div class="pointer-events-none w-40 rounded-lg bg-surface border border-subtle shadow p-4 text-center space-y-2">
-          <div class="text-2xl leading-none">🔀</div>
-          <span class="block h-2 w-24 mx-auto rounded" style="background: var(--color-text); opacity: .18"></span>
-          <%# the two truncated addresses — the comparison IS the card %>
-          <span class="flex items-center justify-between gap-2">
-            <span class="block h-1.5 w-10 rounded" style="background: var(--color-text); opacity: .18"></span>
-            <span class="block h-1.5 w-12 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <span class="flex items-center justify-between gap-2">
-            <span class="block h-1.5 w-10 rounded" style="background: var(--color-text); opacity: .18"></span>
-            <span class="block h-1.5 w-12 rounded" style="background: var(--color-text); opacity: .35"></span>
-          </span>
-          <span class="block h-5 w-full rounded" style="background: var(--color-cta)"></span>
-        </div>
-      <% end %>
     </div>
   </section>
 

data/lib/studio/js_literal.rb

@@ -56,6 +56,26 @@ module Studio
   # the worked examples; test/lib/studio/attribute_encoding_contract_test.rb pins the
   # ActionView behaviour the whole thing rests on.
   #
+  # THE MARKING IS A JUDGEMENT ABOUT THE VALUE, NOT ABOUT THE FILE, and it is the
+  # half of that repair most easily got backwards. `tag.attributes` takes both kinds
+  # and does the right thing with each:
+  #
+  #   EXPRESSION (an Alpine handler, a JS number, a store path) — pass it MARKED.
+  #     Only the double quotes move, so the code the caller deliberately handed the
+  #     engine still parses. Escaping it would be corruption of the same kind the
+  #     script-body note above describes.
+  #   CONTENT (a URL, a colour, a length, a regex, a tooltip sentence) — pass it
+  #     UNMARKED and let it take the full escaping a content attribute is owed. The
+  #     parser hands the value back decoded, and a bare `&` stops reaching the client
+  #     as the start of an entity.
+  #
+  # Both repairs live in this engine and neither is the default: the four input
+  # constraints in modals/blocks/_leveling_activity are the content case beside the
+  # handlers in the same file, and studio/mailers/_layered_banner is the content case
+  # in an EMAIL, where the consumer is a mail client rather than a browser and the
+  # margin for a malformed attribute is smaller. Choosing by which file a value sits
+  # in, rather than by what the value is, gets one of those two wrong every time.
+  #
   # AND IT IS THE WRONG REPAIR FOR IDENTIFIER POSITION. A local spliced in as a bare
   # NAME — `$store.<%= modal_store %>.close()` — must be VALIDATED, never escaped:
   # escape_javascript also escapes `$`, so a legitimate store name like `dsModals$2`

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.74.1"
+  VERSION = "0.74.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.74.1
+  version: 0.74.2
 platform: ruby
 authors:
 - Alex McRitchie
@@ -521,9 +521,6 @@ files:
 - app/views/style/modals/_age_gate.html.erb
 - app/views/style/modals/_auth.html.erb
 - app/views/style/modals/_birthday.html.erb
-- app/views/style/modals/_cosign_rejected.html.erb
-- app/views/style/modals/_ds_buy_entry_token.html.erb
-- app/views/style/modals/_ds_cdp_ramp.html.erb
 - app/views/style/modals/_ds_close_x.html.erb
 - app/views/style/modals/_ds_newsletter_success.html.erb
 - app/views/style/modals/_ds_onramp_hub.html.erb
@@ -539,11 +536,9 @@ files:
 - app/views/style/modals/_rate_limit_general.html.erb
 - app/views/style/modals/_unsubscribe_confirm.html.erb
 - app/views/style/modals/_unsubscribe_goodbye.html.erb
-- app/views/style/modals/_wallet_changed.html.erb
 - app/views/style/modals/_wallet_connect.html.erb
 - app/views/style/modals/_wallet_connect_slot.html.erb
 - app/views/style/modals/_wallet_deposit.html.erb
-- app/views/style/modals/_wallet_setup.html.erb
 - app/views/theme_settings/edit.html.erb
 - app/views/user_mailer/magic_link.html.erb
 - app/views/user_mailer/magic_link.text.erb

data/app/views/style/modals/_cosign_rejected.html.erb

@@ -1,36 +0,0 @@
-<%#
-  Living style guide specimen — the "we did not co-sign that" refusal.
-
-  APP-SPECIFIC FLOW, engine chrome only. What this card names is turf-monster's:
-  POST confirm_onchain_entry answered 422 with code `tx_rejected`, meaning the
-  server refused to co-sign because the submitted transaction did not match the
-  entry it had prepared. The engine owns no entry preparation, no co-signing and
-  no verdict — it lends `blocks/_card_header` and nothing else, exactly as
-  style/modals/_entry_tokens borrows chrome for a flow the engine does not own.
-
-  WHY THE COPY IS VAGUE, and why a reviewer should not "improve" it: good actors
-  never see this card. It fires on a tampered or mismatched transaction, so the
-  copy is deliberately reassuring and deliberately silent about WHICH
-  server-side check failed — naming the check would help an attacker probe the
-  validation. The reassurance ("nothing was submitted and your funds are safe")
-  is the part that matters to the one honest user who ever hits it.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div x-data="{}">
-  <%= render "studio/modals/blocks/card_header",
-        icon_emoji: "🛡️",
-        title: "Transaction not signed" do %>
-    <p class="text-sm text-body">
-      For your security we didn&rsquo;t co-sign this transaction &mdash; it
-      didn&rsquo;t match the entry we prepared, so nothing was submitted and your
-      funds are safe. Please close this and try entering again. If it keeps
-      happening, <span class="text-primary">contact support</span>.
-    </p>
-  <% end %>
-
-  <%# One button, because there is exactly one thing to do. The host also closes
-      on escape and click-outside; this card is dismissible by design. %>
-  <button type="button" @click="$store.dsModals.close()"
-          class="btn btn-primary btn-lg w-full">Got it</button>
-</div>

data/app/views/style/modals/_ds_buy_entry_token.html.erb

@@ -1,40 +0,0 @@
-<%#
-  Living style guide specimen — Buy an Entry Token.
-
-  APP-SPECIFIC flow, engine chrome throughout (blocks/_close_x + two
-  blocks/_rail_row). Reached when a player has picked a lineup and has no way to
-  pay for it, which is why the copy says the lineup is SAVED: the one thing they
-  are afraid of at that moment is losing their picks.
-
-  TWO RAILS, RANKED, and the ranking is a product decision rather than a visual
-  one. Coinflow leads and carries the "New" badge because it mints a spendable
-  entry token directly — it is the shortest path from here to being in the
-  contest. Stripe still swaps into the auth wizard's tokens picker, which is the
-  older, longer path, so it defers.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div class="relative">
-  <%= render "studio/modals/blocks/close_x", modal_store: "dsModals" %>
-
-  <div class="text-center pt-1 mb-2">
-    <h3 class="text-heading font-bold text-lg leading-tight">Buy an Entry Token</h3>
-  </div>
-  <p class="text-xs text-body mb-4 text-center">
-    1 token = 1 contest entry. Your lineup is saved &mdash; pick how to pay.
-  </p>
-
-  <div class="space-y-3">
-    <%= render "studio/modals/blocks/rail_row",
-          emphasis: :primary, on_click: "$store.dsModals.close()",
-          icon_label: "CF", icon_bg: "#14B8A6",
-          title: "Coinflow · $19", subtitle: "Buy 1 entry with a card · fastest",
-          badge: "New", data: { ds_rail: "coinflow" } %>
-
-    <%= render "studio/modals/blocks/rail_row",
-          on_click: "$store.dsModals.close()",
-          icon_label: "S", icon_bg: "#635BFF",
-          title: "Card · $19", subtitle: "Buy an entry token with a card",
-          data: { ds_rail: "stripe" } %>
-  </div>
-</div>

data/app/views/style/modals/_ds_cdp_ramp.html.erb

@@ -1,41 +0,0 @@
-<%#
-  Living style guide specimen — the Coinbase ramp, BUY PREFLIGHT only.
-
-  DELIBERATELY PARTIAL, and saying so is the point. turf's modals/_cdp_ramp is a
-  TWO-FLOW step machine — buy and cash-out — across thirteen states: preflight,
-  opening, waiting, awaiting-cdp, send, settling and the rest. This cards ONE of
-  them: the buy preflight, which is the state both funding cards hand off to and
-  therefore the only one a player reaches without already being mid-flow.
-
-  The other twelve are uncarded BY DECISION (operator, 2026-08-26: minimal
-  migration is fine here). That is a different thing from an oversight, and the
-  reference blurb on this card says so, because a cabinet that shows one state of
-  a thirteen-state machine without admitting it teaches a reader that the machine
-  is simpler than it is. /tasks/port-cdp-ramp-specimen holds the full state map
-  if the decision reverses.
-
-  APP-SPECIFIC, engine chrome: blocks/_close_x plus the centred title this whole
-  funding family uses.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div class="relative">
-  <%= render "studio/modals/blocks/close_x", modal_store: "dsModals" %>
-
-  <div class="text-center pt-1 mb-3">
-    <h3 class="text-heading font-bold text-lg leading-tight">Buy USDC with Coinbase</h3>
-  </div>
-
-  <p class="text-xs text-body mb-4 text-center">
-    You&rsquo;ll finish the purchase in a Coinbase tab. We&rsquo;ll update here
-    automatically once the USDC lands in your wallet.
-  </p>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="btn btn-primary btn-lg w-full">Continue to Coinbase</button>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">
-    Not now
-  </button>
-</div>

data/app/views/style/modals/_wallet_changed.html.erb

@@ -1,70 +0,0 @@
-<%#
-  Living style guide specimen — the wallet switched underneath the session.
-
-  APP-SPECIFIC, engine chrome only (`blocks/_card_header`). The switch itself is
-  the host's: turf's wallet store owns continueSwitch, and the engine owns no
-  wallet.
-
-  THE SITUATION IT NAMES: the person changed accounts inside their wallet
-  extension while signed in here. Nothing is broken and nobody did anything
-  wrong — but the session and the extension now disagree about who this is, and
-  every on-chain action from here would use an identity the page is not showing.
-
-  SO IT SHOWS BOTH ADDRESSES, truncated the way every Solana UI truncates them
-  (4 leading, 4 trailing). Recognising your own address is the only way to tell a
-  deliberate switch from an accident, and it is the one check the app cannot make
-  for them.
-
-  The busy state matters: continuing re-derives a session against the new wallet,
-  which is a round trip. Without it the button looks dead and gets double-clicked.
-
-  Single root; x-data single-quoted throughout.
-%>
-<div x-data="{
-       busy: false,
-       get props() { var c = $store.dsModals.current(); return (c && c.props) || {} },
-       short(addr) {
-         addr = addr || '';
-         return addr.length > 12 ? (addr.slice(0, 6) + '...' + addr.slice(-4)) : addr;
-       },
-       go() {
-         if (this.busy) return;
-         this.busy = true;
-         var s = this;
-         // Demo: the real card awaits the host's wallet store. Hold briefly so
-         // the pending state is visible rather than skipped.
-         setTimeout(function () { s.busy = false; $store.dsModals.close(); }, 600);
-       }
-     }">
-  <%= render "studio/modals/blocks/card_header",
-        icon_emoji: "🔀",
-        title: "Wallet changed" do %>
-    <p class="text-sm text-body">
-      Your wallet is now on a different account than the one you signed in with.
-      Continue with the new one, or switch back in your wallet.
-    </p>
-  <% end %>
-
-  <div class="rounded-lg border border-subtle bg-surface-alt p-3 mb-4 text-sm">
-    <div class="flex items-center justify-between gap-3">
-      <span class="text-secondary">Signed in as</span>
-      <span class="font-mono text-heading" x-text="short(props.currentAddress) || '7xKp...JZ2Q'"></span>
-    </div>
-    <div class="flex items-center justify-between gap-3 mt-2">
-      <span class="text-secondary">Wallet now</span>
-      <span class="font-mono text-heading" x-text="short(props.newAddress) || '9mQt...Ld4V'"></span>
-    </div>
-  </div>
-
-  <button type="button" @click="go()" :disabled="busy"
-          class="btn btn-primary btn-lg w-full disabled:opacity-60">
-    <span x-show="!busy">Continue with this wallet</span>
-    <span x-show="busy" class="inline-flex items-center justify-center gap-2" style="display: none;">
-      <span class="spinner" aria-hidden="true"></span>
-      Switching&hellip;
-    </span>
-  </button>
-
-  <button type="button" @click="$store.dsModals.close()"
-          class="block mx-auto mt-3 text-sm text-secondary hover:text-heading transition">Not now</button>
-</div>

data/app/views/style/modals/_wallet_setup.html.erb

@@ -1,112 +0,0 @@
-<%#
-  Living style guide specimen — the onboarding chain's LAST step, "Set up your
-  wallet" (chain step 3 of 3).
-
-  This documents an APP-SPECIFIC flow. The engine deliberately does NOT own it:
-  turf-monster's app/views/modals/_wallet_setup.html.erb is ~576 lines of
-  extension-presence polling, a hosted 90-second walkthrough video, a Detailed
-  Guide route that resolves at render time, and a managed-wallet fallback for
-  grandfathered web2 accounts. None of that is shareable — it is one app's
-  answer to "how do we get this person a wallet".
-
-  What IS shared, and all this specimen composes, is the CHROME:
-    studio/modals/blocks/shell               — title row + close
-    studio/modals/blocks/progress_pill       — the 3-of-3 chain position
-    studio/modals/blocks/wallet_brand_sprite — inline brand marks, no per-app PNG
-  plus the house wallet-row idiom (brand tile, the wallet's own name, status on
-  the right, chevron) and pulse-cta, so a wallet reads identically here, in the
-  connect picker, and on the web3 step-up card.
-
-  ONE card, ONE id, a `detected` TOGGLE for the two ends of the real progression
-  (install -> waiting -> Installed -> connect). Deliberately not two specimens
-  sharing a modal id: that shape is what left the two web3-step-up cards unable
-  to tell each other apart in the glow, fixed in the same pass that added this.
-
-  WHO SEES IT — the half worth remembering. This card and the web3 step-up card
-  are OPPOSITE populations and no user can ever meet both. WalletSetupPolicy
-  exits at its own step 1 for an account that already holds a wallet; the step-up
-  card is only ever shown to accounts that DO hold one. "Get a wallet" vs "prove
-  the wallet you have".
-
-  Self-contained: no install detection, no video embed, no real routes. The
-  walkthrough is represented as a still placeholder rather than an <iframe>,
-  because the video is the app's asset and an embed here would reach off-host.
-
-  Single root: the outer <div> is the host's required root.
-%>
-<div x-data="{
-       get props() { var c = Alpine.store('dsModals').current(); return (c && c.props) || {}; },
-       get detected() { return !!this.props.detected; }
-     }"
-     class="relative">
-  <%= render "studio/modals/blocks/wallet_brand_sprite" %>
-
-  <%= render layout: "studio/modals/blocks/shell",
-        locals: { title: "Set up your wallet", modal_store: "dsModals" } do %>
-
-    <%# Chain position — the HOST's, not this page's. It is the only one of the
-        three onboarding steps that fills the pill, which is why the pill is here
-        even though the card sits in the Web3 section beside the wallet cards. %>
-    <div class="mb-3">
-      <%= render "studio/modals/blocks/progress_pill", current: 3, total: 3 %>
-    </div>
-
-    <p class="text-sm text-body text-center mb-4">
-      This app runs on the Solana public blockchain; you will need a wallet to
-      enter contests and collect winnings.
-    </p>
-
-    <%# THE wallet row — the house idiom, glowing because it is the one thing to
-        press. Same shape the connect picker and the step-up card use. The right
-        side is the only part that moves: INSTALL before the extension exists,
-        an Installed badge once it answers. %>
-    <button type="button" @click="$store.dsModals.close()"
-            style="--pulse-cta-color: var(--color-primary); --pulse-cta-strength: 0.4; --pulse-cta-scale: 1.02"
-            class="pulse-cta w-full flex items-center gap-3 p-3 rounded-xl bg-surface-alt border border-strong hover:bg-surface transition text-left">
-      <span class="w-9 h-9 rounded-lg overflow-hidden flex items-center justify-center shrink-0">
-        <svg class="w-9 h-9" aria-hidden="true"><use href="#se-wallet-phantom"></use></svg>
-      </span>
-      <span class="font-semibold text-heading">Phantom</span>
-      <span class="ml-auto flex items-center gap-2">
-        <span x-show="!detected" class="text-xs text-muted uppercase tracking-wide">Install</span>
-        <span x-show="detected" class="badge border-primary text-primary">Installed</span>
-        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4 text-muted">
-          <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
-        </svg>
-      </span>
-    </button>
-
-    <%# The teaching half. A brand-new player does not know what a wallet IS, so
-        the card carries its own explainer rather than sending them away to find
-        one. Represented, not embedded — see the header. %>
-    <div class="mt-4 pt-4 border-t border-strong">
-      <h4 class="text-heading font-bold text-sm mb-1">New to Solana &#129300;</h4>
-      <p class="text-sm text-body mb-3">Set up your wallet in <strong>90 seconds</strong>.</p>
-
-      <div class="rounded-lg border border-subtle bg-inset aspect-video flex flex-col items-center justify-center gap-1">
-        <span class="text-2xl leading-none" aria-hidden="true">&#9654;&#65039;</span>
-        <span class="text-2xs text-muted">walkthrough &mdash; the app supplies the video</span>
-      </div>
-
-      <button type="button" @click="$store.dsModals.close()"
-              class="btn btn-primary btn-lg w-full mt-3 flex items-center justify-center gap-2">
-        Detailed Guide
-        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4">
-          <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
-        </svg>
-      </button>
-    </div>
-
-    <%# Dismissible by design, and the fine print says what dismissing costs. The
-        chain is skippable; the entry gate is not, and the card is honest that
-        the two are different things. %>
-    <button type="button" @click="$store.dsModals.close()"
-            class="block mx-auto mt-4 text-sm text-secondary hover:text-heading transition">
-      Maybe later
-    </button>
-    <p class="mt-2 text-center text-2xs text-muted">
-      Rather pay by card? Link a wallet first &mdash; an entry token needs
-      somewhere to land.
-    </p>
-  <% end %>
-</div>