@bongos/core 1.19.141 → 1.19.143

package/public-landing/projects.html

@@ -161,7 +161,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 .humanSteps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
 /* a repo the platform already handled is named as a plain inline link (task 1002855) —
    the .ghbtn treatment reads as an action to take, and there is nothing here to do */
-.humanSteps p a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.humanSteps p a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .humanSteps p a:hover{text-decoration:underline;}
 /* live checklist states (task 1002694): a step the platform has verified done, and a
    step that can't be performed yet (its prerequisite — usually the domain — is missing) */
@@ -222,7 +222,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 .prog .slbl{font-size:12px;font-weight:700;color:var(--ink-faint);}
 .prog .stages li.now .slbl,.prog .stages li.done .slbl{color:color-mix(in srgb,var(--sea) 40%,var(--ink));}
 .prog .pnote{text-align:center;font-size:13px;font-weight:600;color:color-mix(in srgb,var(--sea) 45%,var(--ink-soft));min-height:18px;}
-.prog .pnote a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.prog .pnote a{color:var(--link-ink);font-weight:700;text-decoration:none;}
 .prog .pnote a:hover{text-decoration:underline;}
 .prog.isLive{background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));}
 .prog.isLive .stages li.done:not(:first-child)::before{background:var(--ok);}
@@ -255,6 +255,10 @@ h1[tabindex="-1"]:focus{outline:none;}
 .addrConfirm.optedOut{border-color:var(--line);background:var(--bg);}
 .addrConfirm.optedOut .addrBig{color:var(--ink-soft);}
 .addrConfirm.optedOut>p{color:var(--ink-faint);}
+/* the handle is not free (task 1002898 N10) — a refusal must not be painted into the
+   green confirmation box that means "yours" */
+.addrConfirm.unavailable{border-color:color-mix(in srgb,var(--err) 45%,var(--bg-card));background:var(--bg);}
+.addrConfirm.unavailable .addrBig{color:var(--err);}
 .addrBig{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;line-height:1.4;}
 .addrBig code{font-family:var(--font-mono);font-size:15px;background:var(--bg-deep);border-radius:8px;padding:2px 9px;color:var(--accent-deep);word-break:break-all;}
 .addrConfirm>p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.5;margin-top:6px;}
@@ -713,8 +717,14 @@ h1[tabindex="-1"]:focus{outline:none;}
           </section>
 
           <!-- step 4 · address — a CONFIRMATION, not a form (task 1002704: every project
-               gets its slug subdomain assigned up front; opt-out lives in the disclosure).
-               The domainless default was a proven dead-end (QA walk, task 1002702). -->
+               gets its slug subdomain assigned up front). The domainless default was a
+               proven dead-end (QA walk, task 1002702).
+               Three choices, all legible without opening anything (task 1002898 N8):
+               the assigned address is stated, and BOTH alternatives sit under it — the
+               bring-your-own domain behind its disclosure, the no-address opt-out in the
+               open. The opt-out used to live INSIDE the "domain I own" fold, i.e. the
+               choice for NO address was hidden under a fold labelled the opposite
+               choice; the owner read the step as "weird" and never found it. -->
           <section class="panel" id="panel-address" aria-labelledby="addr-h">
             <h1 id="addr-h">Its address in the sky</h1>
             <p class="lede">The handle names your project on the platform — and its address comes with it. Sign-in, sharing, everything just works from the moment it stands up.</p>
@@ -733,11 +743,11 @@ h1[tabindex="-1"]:focus{outline:none;}
                       <input type="text" id="f-domain" placeholder="mercury.example.com" autocomplete="off" maxlength="253" spellcheck="false">
                       <div class="hint" id="h-domain">&nbsp;</div>
                     </label>
-                    <label class="addrOpt"><input type="checkbox" id="f-noaddr">
-                      <span>Start without an address — possible, but sign-in on your project can’t be set up until it has one.</span>
-                    </label>
                   </div>
                 </details>
+                <label class="addrOpt"><input type="checkbox" id="f-noaddr">
+                  <span>Start without an address — possible, but sign-in on your project can’t be set up until it has one.</span>
+                </label>
               </div>
               <div class="nav">
                 <button type="button" class="btn ghost" data-back="3">← Back</button>
@@ -2113,30 +2123,101 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (state.noAddress) return '';
       return assignedDomain() || '';
     }
+    /* What the create POST may CARRY, as opposed to what the panel displays: only a
+       bring-your-own domain. The assigned <slug>.<apex> default is the server's to
+       apply (task 1002704) and re-asserting it here is what task 1002898 N2 closes —
+       apexBase() falls back to guessing from location.hostname, and a guess that
+       disagrees with the server's apex (a subdomain hub like get.<apex>) is refused
+       as an under-apex squat. Omit it and the server assigns the right one. */
+    function byoDomain() {
+      return state.domain && looksLikeDomain(state.domain) ? state.domain : '';
+    }
+
+    /* ── slug availability (task 1002898 N10) ──
+       The panel promised '<slug>.<apex> — yours from the moment it stands up' on FORMAT
+       validation alone, so a collision surfaced only as a 409 at the final Create click.
+       GET /provisioning/slug-available answers the same question the create route will,
+       and the promise is now made only once the server has said the handle is free.
+       This NARROWS the race, it does not close it — the 409 at create is still the only
+       authority — so an unanswered check degrades to naming the address WITHOUT the
+       ownership promise, never to guessing in either direction. */
+    var slugAvail = { slug: '', state: 'unknown' };  /* unknown | checking | free | taken | yours | reserved */
+    var slugCheckT = 0;
+    var slugCheckGen = 0;
+    /* Only trust a verdict that belongs to the handle currently in the field. */
+    function slugAvailState() {
+      return slugAvail.slug === state.slug ? slugAvail.state : 'unknown';
+    }
+    /* Debounced, and generation-guarded because a cleared timer cannot cancel a chain
+       already mid-fetch — each chain carries the generation it was born under, so an
+       orphaned answer goes quiet instead of overwriting a newer one (the manifest-poll
+       idiom below). The caller re-renders; this only sets state. */
+    function checkSlugAvailable() {
+      clearTimeout(slugCheckT);
+      slugCheckGen += 1;
+      var slug = state.slug;
+      if (!validSlug(slug)) { slugAvail = { slug: slug, state: 'unknown' }; return; }
+      slugAvail = { slug: slug, state: 'checking' };
+      var myGen = slugCheckGen;
+      slugCheckT = setTimeout(function () {
+        fetch(API + '/provisioning/slug-available?slug=' + encodeURIComponent(slug), { credentials: 'same-origin' })
+          .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
+          .then(function (d) {
+            if (myGen !== slugCheckGen) return;
+            slugAvail = { slug: slug, state: d.available ? 'free' : (d.reason || 'taken') };
+            renderAddrPanel();
+          })
+          .catch(function () {
+            if (myGen !== slugCheckGen) return;
+            /* no answer is NOT a free answer — back to the format-only wording */
+            slugAvail = { slug: slug, state: 'unknown' };
+            renderAddrPanel();
+          });
+      }, 400);
+    }
     function renderAddrPanel() {
       var box = $('addrConfirm');
       if (!box) return;
       var assigned = assignedDomain();
       var custom = state.domain && looksLikeDomain(state.domain) ? state.domain : '';
-      box.classList.toggle('optedOut', state.noAddress && !custom);
       var big = $('addrAssigned');
       var note = $('addrAssignedNote');
+      /* the verdict only bears on the ASSIGNED address — a chosen domain or the
+         opt-out settles the step without it */
+      var avail = !custom && !state.noAddress && assigned ? slugAvailState() : 'unknown';
+      box.classList.toggle('optedOut', state.noAddress && !custom);
+      box.classList.toggle('unavailable', avail === 'taken' || avail === 'yours' || avail === 'reserved');
       if (custom) {
         big.innerHTML = '<code>' + esc(custom) + '</code> — your own domain, wired up for you.';
         note.textContent = 'DNS pointing happens after the standup; the card on your projects page walks you through it.';
       } else if (state.noAddress) {
         big.textContent = 'Starting without an address.';
         note.textContent = 'Sign-in on your project can’t be set up until it has one — add it any time from your projects page.';
-      } else if (assigned) {
+      } else if (assigned && avail === 'free') {
         big.innerHTML = '<code>' + esc(assigned) + '</code> — yours from the moment it stands up.';
         note.textContent = 'Sign-in, sharing, everything just works. You can point a domain you own at it any time.';
+      } else if (assigned && avail === 'taken') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — already taken.';
+        note.textContent = 'Another project on the platform holds that handle. Pick a different one.';
+      } else if (assigned && avail === 'yours') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — you already have that one.';
+        note.textContent = 'That handle belongs to one of your own projects. Pick a different one to start something new.';
+      } else if (assigned && avail === 'reserved') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — reserved by the platform.';
+        note.textContent = 'That address is the platform’s own. Pick a different handle, or bring a domain you own.';
+      } else if (assigned && avail === 'checking') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — checking that it’s free…';
+        note.textContent = 'One moment.';
+      } else if (assigned) {
+        /* the check didn’t answer — name the address, promise nothing about it */
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — the address it would take.';
+        note.textContent = 'We couldn’t check whether that handle is free just now — you’ll know for certain when you create it.';
       } else if (!validSlug(state.slug)) {
         big.textContent = 'Pick a handle above and the address comes with it.';
         note.textContent = '';
       } else {
         /* dotless host (local dev): nothing sane to auto-assign — the domain
-           field IS the step here, so unfold it (a folded disclosure made the
-           opt-out checkbox unreachable-by-default; owner walk, 2026-08-12) */
+           field IS the step here, so unfold it */
         big.textContent = 'No address is assigned on this host.';
         note.textContent = 'Add a domain you own below, or start without one.';
         $('addrCustom').open = true;
@@ -2202,7 +2283,10 @@ h1[tabindex="-1"]:focus{outline:none;}
          (a pre-auth probe 401s for strangers and, worse, could seed the
          draft's owner with myLogin()'s placeholder) */
       if (step === 3) { syncHome(); if (authKnown) ensureRepoAccess(); }
-      if (step === 4) renderAddrPanel();
+      /* re-check on every entry, not just on typing: a resumed draft arrives here with
+         a handle nobody has asked the server about, and a handle free ten minutes ago
+         may not be now (task 1002898 N10) */
+      if (step === 4) { checkSlugAvailable(); renderAddrPanel(); }
       if (step === 5) renderReview();
     }
 
@@ -2427,6 +2511,7 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (!state.slug) { h.innerHTML = '&nbsp;'; h.className = 'hint'; this.classList.remove('bad'); }
       else if (validSlug(state.slug)) { h.textContent = 'Nice — that works.'; h.className = 'hint ok'; this.classList.remove('bad'); }
       else { h.textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.'; h.className = 'hint err'; this.classList.add('bad'); }
+      checkSlugAvailable();
       renderAddrPanel();
       saveDraft();
     });
@@ -2481,6 +2566,23 @@ h1[tabindex="-1"]:focus{outline:none;}
           return false;
         }
         if (state.domain && !looksLikeDomain(state.domain)) return false;
+        /* A handle the server has already said is not free would only 409 at Create —
+           stop here instead (task 1002898 N10). ONLY a definite negative blocks:
+           'unknown' and 'checking' must never gate the step, because the check is
+           advisory and the 409 remains the authority. A chosen domain or the opt-out
+           settles the address another way, so the block does not apply there. */
+        if (!state.domain && !state.noAddress) {
+          var av = slugAvailState();
+          if (av === 'taken' || av === 'yours' || av === 'reserved') {
+            $('h-slug').textContent = av === 'taken'
+              ? 'That handle is already taken — pick a different one.'
+              : av === 'yours'
+                ? 'You already have a project with that handle — pick a different one.'
+                : 'That handle is reserved by the platform — pick a different one.';
+            $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
+            return false;
+          }
+        }
         /* no auto-assigned address (dotless host): going domainless must be an
            EXPLICIT choice — a domain, or the opt-out box. Never silent. */
         if (!resolvedDomain() && !state.noAddress) {
@@ -2593,10 +2695,15 @@ h1[tabindex="-1"]:focus{outline:none;}
             slug: state.slug,
             type: state.projType || undefined,
             hosting_shape: 'standalone',
-            domain: resolvedDomain() || undefined,
-            /* The server now defaults an omitted domain to the assigned address
-               (task 1002704), so the opt-out must travel explicitly — an absent
-               domain no longer means "none". */
+            /* ONLY a bring-your-own domain travels (task 1002898 N2). The server owns
+               the assigned <slug>.<apex> default (task 1002704) and applies it to an
+               omitted domain, so re-sending our own derived copy could only disagree
+               with it — apexBase() may be guessing from location.hostname, and a guess
+               that lands under the apex but isn't the server's assignment is refused
+               as a squat. Omitting it is how the default is now requested. */
+            domain: byoDomain() || undefined,
+            /* An absent domain means "assign me the default", so the opt-out must
+               travel explicitly — it is the only thing that means "none". */
             no_address: state.noAddress ? true : undefined,
             target_ref: state.owner + '/' + state.repo,
             /* LOAD-BEARING for the control-plane runner, not just for the checklist we
@@ -2618,9 +2725,14 @@ h1[tabindex="-1"]:focus{outline:none;}
         });
       }).then(function (data) {
         try {
+          /* The address the instance ACTUALLY holds, read off the create response —
+             not our preview of it (task 1002898 N2). The server owns the assigned
+             default, so its answer is the only one the done panel may promise; a
+             client-derived copy could name an address that was never assigned. */
+          var madeDomain = (data.instance && data.instance.domain) || '';
           sessionStorage.setItem(CREATED_KEY, JSON.stringify({
-            id: data.instance && data.instance.id, slug: state.slug, domain: resolvedDomain(),
-            noaddr: !!state.noAddress,
+            id: data.instance && data.instance.id, slug: state.slug, domain: madeDomain,
+            noaddr: !madeDomain,
             mode: state.mode, name: state.name, at: Date.now()
           }));
           sessionStorage.removeItem(DRAFT_KEY);

package/src/module-api.js

@@ -709,8 +709,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.139 with no explicit bump. run 31891805999. (task 1002620)
 //   1.19.141 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.140 with no explicit bump. run 31892484952. (task 1002620)
+//   1.19.142 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.141 with no explicit bump. run 31893298770. (task 1002620)
+//   1.19.143 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.142 with no explicit bump. run 31893905320. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.141'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.143'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -135,6 +135,25 @@ const contrast = (fg, bg) => {
 
 const hex = (c) => '#' + c.slice(0, 3).map((v) => Math.round(v).toString(16).padStart(2, '0')).join('');
 
+// CIE Lab (D65) + ΔE76 — for ink-vs-ink questions contrast() cannot answer.
+// Two colors can each clear 8:1 over the same ground and still BE the same
+// color; a ratio between them only sees lightness, and the collision this file
+// now guards is a chroma one.
+const labF = (t) => (t > 216 / 24389 ? Math.cbrt(t) : (841 / 108) * t + 4 / 29);
+const lab = ([r, g, b]) => {
+  const [R, G, B] = [lin(r), lin(g), lin(b)];
+  const [fx, fy, fz] = [
+    labF((0.4124 * R + 0.3576 * G + 0.1805 * B) / 0.95047),
+    labF(0.2126 * R + 0.7152 * G + 0.0722 * B),
+    labF((0.0193 * R + 0.1192 * G + 0.9505 * B) / 1.08883),
+  ];
+  return [116 * fy - 16, 500 * (fx - fy), 200 * (fy - fz)];
+};
+const deltaE76 = (a, b) => {
+  const [A, B] = [lab(a), lab(b)];
+  return Math.hypot(A[0] - B[0], A[1] - B[1], A[2] - B[2]);
+};
+
 // ── the pairs cosmos.css actually paints ─────────────────────────────────────
 // need: 4.5 normal text · 3.0 large text and meaningful non-text
 const CARD = 'var(--bg-card)';
@@ -143,14 +162,22 @@ const PAIRS = [
   ['.btn label on its fill',            '#ffffff',              'var(--accent)',        4.5],
   ['.btn.ghost:hover label',            'var(--accent-deep)',   CARD,                   4.5],
   ['.btn.danger label',                 'var(--err)',           CARD,                   4.5],
-  // Inline links, code chips, pills, the now-step number: every accent-colored
-  // text consumer paints --accent-deep in BOTH modes (task 1002750 deleted the
-  // dark --sun-lit recolors — they pinned the locked space palette over the
-  // branding pack, so a re-themed instance got Cloud Bongos orange links).
-  // The dark blocks derive --accent-deep from the pack-settable --accent.
-  ['inline link on a card',             'var(--accent-deep)',   CARD,                   4.5],
-  ['inline link on the page ground',    'var(--accent-deep)',   'var(--bg)',            4.5],
+  // Code chips, pills, the now-step number, the hover inks: --accent-deep is
+  // CHROME ink in both modes since task 1002822 moved the text links off it
+  // (task 1002750 had already deleted the dark --sun-lit recolors — they pinned
+  // the locked space palette over the branding pack, so a re-themed instance got
+  // Cloud Bongos orange links). The dark blocks derive it from --accent.
+  ['--accent-deep ink on a card',       'var(--accent-deep)',   CARD,                   4.5],
+  ['--accent-deep ink on the ground',   'var(--accent-deep)',   'var(--bg)',            4.5],
   ['code chip on --bg-deep',            'var(--accent-deep)',   'var(--bg-deep)',       4.5],
+  // --link-ink: the text links' own pack-derived token (task 1002822). Nothing
+  // measured --accent-deep as a link ink against the copy AROUND it, and in dark
+  // the two had collapsed into one color — see the separation test below.
+  // --bg-deep is not a link ground today; it is the review panel's robustness
+  // floor, so a link dropped into a --bg-deep panel can never ship under AA.
+  ['--link-ink on a card',              'var(--link-ink)',      CARD,                   4.5],
+  ['--link-ink on the page ground',     'var(--link-ink)',      'var(--bg)',            4.5],
+  ['--link-ink on --bg-deep',           'var(--link-ink)',      'var(--bg-deep)',       4.5],
   // body copy
   ['--ink body copy',                   'var(--ink)',           CARD,                   4.5],
   ['--ink-soft secondary copy',         'var(--ink-soft)',      CARD,                   4.5],
@@ -180,6 +207,15 @@ const PAIRS = [
   // must still measure (19px/700 headline = large text, 3.0)
   ['optedOut .addrBig (large) on --bg', 'var(--ink-soft)',      'var(--bg)',            3.0],
   ['addrOpt warning on --bg',           'var(--warn)',          'var(--bg)',            4.5],
+  // ?view=mine (task 1002823) — both surfaces traded a subtree opacity for muted
+  // tokens, so the tokens themselves now carry the de-emphasis and must measure.
+  // The two pill rows are the pair that proves the split: one mute cannot serve
+  // both grounds, because on the pressed --accent fill no ink token clears 4.5
+  // (--ink is the best at 3.70 light / 4.05 dark) and only the button's #fff does.
+  ['.filters .n count, resting pill',   'var(--ink-faint)',     CARD,                   4.5],
+  ['.filters .n count, pressed pill',   '#ffffff',              'var(--accent)',        4.5],
+  ['.proj.gone name (muted)',           'var(--ink-soft)',      CARD,                   4.5],
+  ['.proj.gone meta (dim removed)',     'var(--ink-faint)',     CARD,                   4.5],
   // lifecycle strip: 12px/700
   ['.strip .slbl idle',                 'var(--ink-faint)',     CARD,                   4.5],
   ['.strip .slbl now/done',             'color-mix(in srgb,var(--sea) 40%,var(--ink))',       CARD, 4.5],
@@ -227,6 +263,103 @@ for (const mode of ['light', 'dark']) {
   });
 }
 
+// ── ink vs ADJACENT ink ──────────────────────────────────────────────────────
+// Every PAIRS row above is (ink, ground), so the suite was structurally blind to
+// a link that measured 8.74:1 on its card and was STILL the same color as the
+// prose it sat in. That is exactly what dark mode shipped: --accent-deep
+// resolved to #e9ad8f beside --ink-soft #dcb693 — ΔE76 9.7, two lightness points
+// apart — and dark links carry text-decoration:none until hover, so font-weight
+// was the only cue left. The live repro was .projMsg a.
+//
+// ΔE76 and not a luminance ratio, even though contrast() is right there: light
+// mode's ACCEPTED separation is ΔE76 40.9 but only 1.10:1 in luminance. The
+// light pair is told apart by chroma, so a luminance floor would fail the good
+// case and pass the bad one.
+//
+// The floor is 12, not light mode's 40.9: dark's warm ink IS a desaturated
+// ember, and srgb color-mix can only slide the accent along the line toward
+// white, so 51% is the most chroma --link-ink can hold before a dark navy pack
+// accent falls under 4.5:1 on --bg-deep. Shipped: 14.1 dark, 40.9 light.
+const LINK_SEPARATION = 12;
+
+test('the link ink never collapses into the copy around it', () => {
+  const failures = [];
+  for (const mode of ['light', 'dark']) {
+    const card = over(resolve(CARD, mode), resolve('var(--page-bg)', mode));
+    const link = over(resolve('var(--link-ink)', mode), card);
+    for (const ink of ['--ink-soft', '--ink-faint']) {
+      const beside = over(resolve(`var(${ink})`, mode), card);
+      const got = deltaE76(link, beside);
+      if (got < LINK_SEPARATION) {
+        failures.push(
+          `${mode}: --link-ink ${hex(link)} vs ${ink} ${hex(beside)} — ` +
+          `ΔE76 ${got.toFixed(1)} (needs ${LINK_SEPARATION})`
+        );
+      }
+    }
+  }
+  assert.deepEqual(failures, [], `\n  ${failures.join('\n  ')}\n`);
+});
+
+// The accent packs the rest of this file never sees. Everything above measures
+// the ONE pack config/branding.neutral.json ships — but --link-ink is DERIVED
+// from --accent in dark, so its tuning has to survive whatever accent a host
+// sets. These four are the review panel's own sweep (task 1002822); each is dark
+// enough to carry white .btn text, which any pack's --accent must already do.
+// DARK only: in light --link-ink is var(--accent-deep), a value the pack ships
+// directly rather than derives, so light is the pack author's own contract.
+const ACCENT_SWEEP = {
+  navy: '#1a237e', forest: '#14532d', red: '#b91c1c', magenta: '#a21caf',
+};
+
+test('--link-ink survives a re-theme in dark mode', () => {
+  const failures = [];
+  const shipped = RAW.dark['--accent'];
+  try {
+    for (const [name, accent] of Object.entries(ACCENT_SWEEP)) {
+      RAW.dark['--accent'] = accent;
+      const page = resolve('var(--page-bg)', 'dark');
+      for (const groundExpr of [CARD, 'var(--bg)', 'var(--bg-deep)']) {
+        const bg = over(resolve(groundExpr, 'dark'), page);
+        const got = contrast(over(resolve('var(--link-ink)', 'dark'), bg), bg);
+        if (got < 4.5) failures.push(`${name} on ${groundExpr}: ${got.toFixed(2)}:1 (needs 4.5)`);
+      }
+      const card = over(resolve(CARD, 'dark'), page);
+      const link = over(resolve('var(--link-ink)', 'dark'), card);
+      for (const ink of ['--ink-soft', '--ink-faint']) {
+        const got = deltaE76(link, over(resolve(`var(${ink})`, 'dark'), card));
+        if (got < LINK_SEPARATION) {
+          failures.push(`${name} vs ${ink}: ΔE76 ${got.toFixed(1)} (needs ${LINK_SEPARATION})`);
+        }
+      }
+    }
+  } finally {
+    RAW.dark['--accent'] = shipped;
+  }
+  assert.deepEqual(failures, [], `\n  ${failures.join('\n  ')}\n`);
+});
+
+test('no text link is left painting --accent-deep', () => {
+  // The migration's own regression net. A token only helps the rules that take
+  // it, and the rules are spread across two sheets: re-pointing cosmos.css alone
+  // left projects.html's own `.humanSteps p a` — a plain inline link sitting in
+  // `.humanSteps p{color:var(--ink-soft)}` — on the colliding ink. Anchor
+  // selectors only: --accent-deep is still the right ink for the chrome that
+  // never sits inside prose (code chips, .tbl/.cardRel pills, .btn.ghost:hover,
+  // .filters button:hover, the .steps/.humanSteps number chips), and each of
+  // those is measured by its own PAIRS row above.
+  const strays = [];
+  for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
+    for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
+      if (!/\ba\b/.test(m[1])) continue;
+      if (/(?:^|[;{\s])color\s*:\s*var\(\s*--accent-deep\s*\)/.test(m[2])) {
+        strays.push(`${where}: ${m[1].trim().slice(0, 70)}`);
+      }
+    }
+  }
+  assert.deepEqual(strays, [], `\n  ${strays.join('\n  ')}\n`);
+});
+
 // The gate's LOCKED sky palette — deliberately absent from COLOR_VARS, so a
 // branding pack can never re-theme these. Dark GROUNDS are allowed (dark mode IS
 // the gate's space, by design); text painted with one shows Cloud Bongos orange
@@ -292,9 +425,12 @@ const dimsBelowFull = (body) => {
 
 test('text is never dimmed by subtree opacity', () => {
   // Two nets. (1) Anywhere in either sheet: a rule that declares BOTH a color
-  // and a sub-1 opacity is dimmed text by construction. (2) The create flow's
-  // known text containers may not carry opacity at all — this also catches
-  // ancestor dims (.createSplit) that net 1 can't see.
+  // and a sub-1 opacity is dimmed text by construction. (2) The known text
+  // containers may not carry opacity at all — this also catches ancestor dims
+  // (.createSplit, .proj.gone) and blocks that declare NO color of their own,
+  // which is exactly how .filters .n and .proj.gone survived net 1 into task
+  // 1002823. Graphics are deliberately absent from the list: .orb.ghost and
+  // .worldOrb.dim carry no text and their opacity IS the state cue.
   const offenders = [];
   for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
     for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
@@ -303,7 +439,7 @@ test('text is never dimmed by subtree opacity', () => {
       }
     }
   }
-  for (const sel of ['\\.humanSteps', '\\.addrConfirm', '\\.prog\\b', '\\.choice', '\\.review', '\\.createSplit', '\\.chip \\.rec']) {
+  for (const sel of ['\\.humanSteps', '\\.addrConfirm', '\\.prog\\b', '\\.choice', '\\.review', '\\.createSplit', '\\.chip \\.rec', '\\.filters', '\\.proj\\b']) {
     for (const text of [cssSrc, pageSrc]) {
       for (const m of text.matchAll(new RegExp(`${sel}[^{}]*\\{([^}]*)\\}`, 'g'))) {
         if (dimsBelowFull(m[1])) offenders.push(`text container dimmed: ${m[0].slice(0, 90)}`);