@bongos/core 1.19.89 → 1.19.91

package/scripts/status-mirror-sync.js

@@ -57,17 +57,23 @@ const { branding, clientBranding } = require('../src/branding');
 // with src/bongos/serve-internal.js applyBrandTokens. `brand` is the client-safe pack
 // and `publicOrigin` the resolved origin — both injected, never read ambiently, so the
 // transform stays pure and testable.
-function brandTokens(html, brand = {}, publicOrigin = '') {
+function brandTokens(html, brand = {}, publicOrigin = '', buildersOrigin = '') {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
+  const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
+  const esc = (s) => String(s == null ? '' : s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
   return html
-    .split('{{worldName}}').join(world)
-    .split('{{productName}}').join(product)
-    .split('{{Currency}}').join(Cur)
-    .split('{{currency}}').join(cur)
-    .split('{{publicOrigin}}').join(publicOrigin || '');
+    .split('{{worldName}}').join(esc(world))
+    .split('{{productName}}').join(esc(product))
+    .split('{{Currency}}').join(esc(Cur))
+    .split('{{currency}}').join(esc(cur))
+    .split('{{tagline}}').join(esc(tagline))
+    .split('{{publicOrigin}}').join(esc(publicOrigin || ''))
+    .split('{{buildersOrigin}}').join(esc(buildersOrigin || publicOrigin || ''));
 }
 
 // ---- the three off-box index.html injections -------------------------------

package/src/bongos/serve-internal.js

@@ -153,21 +153,45 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // stays brand-free (the fitness identity gate). Runs BEFORE the __BRANDING__
 // script is inserted; the injected JSON holds resolved values (never tokens), so
 // order is immaterial. Tokens: {{worldName}} {{productName}} {{currency}}
-// (lowercase label) {{Currency}} (Capitalized) {{publicOrigin}} (the apex origin,
-// for the one functional cross-instance link — sourced from the FULL pack's
-// domains, which clientBranding deliberately omits). Pure + exported for the test;
-// `origin` is injectable so the test drives it with zero I/O.
-function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin()) {
+// (lowercase label) {{Currency}} (Capitalized) {{tagline}} (the pack's one-line
+// pitch), plus the two ORIGINS — {{publicOrigin}} (this instance's apex) and
+// {{buildersOrigin}} (its hall). Both origins are sourced from the FULL pack's
+// `domains`, which clientBranding deliberately omits, so they are the only way a
+// served page can carry a correct cross-host href or canonical/og: URL: a client
+// fill cannot reach them, and a baked one would make every instance advertise
+// whichever instance happened to author the file (task 1002748, direction C5/C6).
+// Pure + exported for the test; both origins are injectable so it drives with zero I/O.
+function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl()) {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
+  const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
   return String(html == null ? '' : html)
-    .split('{{worldName}}').join(world)
-    .split('{{productName}}').join(product)
-    .split('{{Currency}}').join(Cur)
-    .split('{{currency}}').join(cur)
-    .split('{{publicOrigin}}').join(origin || '');
+    .split('{{worldName}}').join(esc(world))
+    .split('{{productName}}').join(esc(product))
+    .split('{{Currency}}').join(esc(Cur))
+    .split('{{currency}}').join(esc(cur))
+    .split('{{tagline}}').join(esc(tagline))
+    .split('{{publicOrigin}}').join(esc(origin || ''))
+    // a pack that names no hall of its own resolves to its OWN apex — never to
+    // whichever instance authored the file
+    .split('{{buildersOrigin}}').join(esc(hallOrigin || origin || ''))
+    .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''));
+}
+// Every token lands in HTML — as element text, or inside a double-quoted
+// attribute (href/content). Escaping is defence in depth, not a live fix: the
+// only source is config/branding.json, which is committed, code-reviewed and
+// Archon-only, never request-supplied. But a pack string carrying a quote or a
+// '<' would otherwise break out of its attribute or close <title> early, and
+// the values now reach four times as many places as when this was written.
+// No token is ever emitted into a <script> or a CSS context (checked across
+// public-landing/, hall-ui/, status-ui/) — that would need different escaping.
+// Ampersand first, or the other replacements get double-escaped.
+function esc(s) {
+  return String(s == null ? '' : s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
 }
 // The instance apex origin from the full branding pack (domains is server-only,
 // so it never rides clientBranding). Best-effort so a branding hiccup can't crash
@@ -175,6 +199,25 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
 function safePublicOrigin() {
   try { return branding().domains.publicOrigin || ''; } catch { return ''; }
 }
+// The instance's OWN builders' hall origin, same server-only source. Empty is fine:
+// applyBrandTokens falls back to the apex, so a pack that names no hall still gets
+// a same-instance link rather than a dangling href.
+function safeBuildersOrigin() {
+  try { return branding().domains.buildersOrigin || ''; } catch { return ''; }
+}
+// The instance's own source repo, from the pack's `repo: {owner, name}` binding —
+// another server-only field (the branding contract keeps repo off clientBranding
+// alongside domains). A page that wants to link "read the source" must take it
+// from here: the authorship audit fails any hardcoded owner/name, and rightly so,
+// since a baked one would point every instance at whoever authored the file.
+// '' when the pack names no repo — the page drops the link rather than emit a
+// dangling href.
+function safeSourceRepoUrl() {
+  try {
+    const repo = branding().repo;
+    return repo && repo.owner && repo.name ? `https://github.com/${repo.owner}/${repo.name}` : '';
+  } catch { return ''; }
+}
 // Instance product/world name for the API-discovery index (task 1918). Best-effort:
 // a branding hiccup must not break the JSON response.
 function safeProductName() {

package/src/module-api.js

@@ -605,8 +605,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.87 with no explicit bump. run 31656577595. (task 1002620)
 //   1.19.89 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.88 with no explicit bump. run 31657467485. (task 1002620)
+//   1.19.90 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.89 with no explicit bump. run 31717551308. (task 1002620)
+//   1.19.91 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.90 with no explicit bump. run 31722841411. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.89'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.91'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -65,12 +65,36 @@ function landingPage(file) {
   if (!_landingPages.has(file)) {
     let html = '';
     try {
-      html = injectBrandingGlobal(fs.readFileSync(path.join(LANDING_DIR, file), 'utf8'));
+      html = injectBrandingGlobal(stripApexOnly(fs.readFileSync(path.join(LANDING_DIR, file), 'utf8')));
     } catch { /* absent → '' */ }
     _landingPages.set(file, html);
   }
   return _landingPages.get(file);
 }
+
+// THE APEX CONDITIONAL (task 1002748). public-landing/ ships wholesale to every
+// instance, so one file has to render two shapes: the platform's own front door,
+// and a child project's. Sections that are true only of the platform — the
+// catalog of OTHER instances, the "capture-resistant commons" claim, the door
+// into the catalog — are wrapped in <!--apex-only:start--> … <!--apex-only:end-->
+// and REMOVED here on any instance that is not the hub.
+//
+// Removed, not CSS-hidden: a child instance must not ship the platform's claims
+// to a crawler, and hiding is not the same as not saying it.
+//
+// Comment sentinels rather than an attribute selector because this is a string
+// transform, not a DOM one — matching a balanced close tag with a regex is the
+// fragile shape, and a sentinel pair has no such failure mode.
+//
+// `platform-identity` IS the hub flag, not a proxy for it: its manifest reads
+// "Enabled ONLY on the hub instance; ordinary hosted + self-hosted instances
+// leave it off", and it is the module that owns the very /projects catalog these
+// sections point at. So this asks the instance what it IS, and nothing anywhere
+// has to know the platform's hostname (direction C5).
+const APEX_ONLY = /<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g;
+function stripApexOnly(html, isHub = isModuleEnabled('platform-identity')) {
+  return isHub ? html : String(html).replace(APEX_ONLY, '');
+}
 function landingHtml() { return landingPage('index.html'); }
 // The interactive landing gate (public-landing/gate/, ported from amazonprimea
 // in task 1002407). When an instance ships it, it is the apex front door
@@ -232,4 +256,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { buildPlatformApp, startBackgroundServices };
+module.exports = { buildPlatformApp, startBackgroundServices, stripApexOnly };

package/tests/cloud_bongos_pack.mjs

@@ -32,14 +32,18 @@ test('R74: a vanilla boot resolves to the Cloud Bongos identity', () => {
 
 test('R74: the vanilla pack carries the Cloud Bongos LOOK (sunrise palette, Baloo 2/Quicksand, bongo favicon)', () => {
   const c = clientBranding(vanilla());
-  assert.equal(c.theme.colors.accent, '#f97316', 'sunrise orange accent');
-  assert.equal(c.theme.colors.bg, '#fff7ed', 'warm sunrise base');
+  // fired down from the original #f97316 so white-on-accent clears WCAG AA
+  // (2.80:1 -> 4.61:1, task 1002749) — same ember hue, readable
+  assert.equal(c.theme.colors.accent, '#ce4806', 'ember orange accent');
+  // ember marigold (task 1002748): the base is PIGMENTED, not near-white. The
+  // old #fff7ed sat within a few points of the cards and the page read as fog.
+  assert.equal(c.theme.colors.bg, '#f9d9a8', 'marigold base');
   assert.match(c.theme.fonts.display, /Baloo 2/);
   assert.match(c.theme.fonts.body, /Quicksand/);
   assert.ok(c.theme.fonts.links.some((l) => /Baloo\+2/.test(l) && /Quicksand/.test(l) && /Fira\+Code/.test(l)), 'loads Baloo 2 + Quicksand + Fira Code');
   assert.match(c.theme.favicon, /circle/, 'bongo-pair favicon (circles), not the Greek Α');
   assert.doesNotMatch(c.theme.favicon, /font-family='serif'>Α/);
-  assert.match(c.theme.backdrop, /linear-gradient\(180deg/, 'sunrise backdrop gradient');
+  assert.equal(c.theme.backdrop, '#f9d9a8', 'the marigold ground holds all the way down');
   assert.equal(c.copy.tagline, 'Building software is laying down a beat.');
   assert.equal(c.rankLabels.archon, 'Owner', 'plain rank labels, not "Archon"');
 });
@@ -48,21 +52,23 @@ test('R74: serving the hall on a vanilla boot injects the Cloud Bongos sunrise t
   const c = clientBranding(vanilla());
   const html = '<head><link rel="stylesheet" href="/builders/style.css"><title>x</title></head><body></body>';
   const out = injectBrandingGlobal(html, c);
-  // palette override + sunrise body backdrop + bongo favicon + the type links
-  assert.match(out, /:root\{[^}]*--accent:#f97316;/);
-  assert.match(out, /body\{background:linear-gradient\(180deg/);
+  // palette override + the marigold body backdrop + bongo favicon + the type links
+  assert.match(out, /:root\{[^}]*--accent:#ce4806;/);
+  assert.match(out, /body\{background:#f9d9a8;\}/);
   assert.match(out, /<link rel="icon" href="data:image\/svg\+xml[^"]*circle/);
   assert.match(out, /fonts\.googleapis\.com\/css2\?family=Baloo\+2/);
   // and it lands AFTER the stylesheet so the Cloud Bongos look wins
-  assert.ok(out.indexOf('/builders/style.css') < out.indexOf('--accent:#f97316'));
+  assert.ok(out.indexOf('/builders/style.css') < out.indexOf('--accent:#ce4806'));
 });
 
 test('R74: themeMarkup paints the backdrop only when the pack supplies one', () => {
   // OTB-shaped pack (no backdrop) → no body{background} rule.
   const otb = themeMarkup({ colors: { bg: '#ece0c2' }, fonts: { links: [] }, favicon: '', backdrop: '' });
   assert.doesNotMatch(otb, /body\{background/);
-  // Cloud Bongos pack → backdrop present.
-  assert.match(themeMarkup(clientBranding(vanilla()).theme), /body\{background:linear-gradient/);
+  // Cloud Bongos pack → backdrop present. Asserted by PRESENCE, not by shape:
+  // this test's subject is whether a backdrop paints at all, so it must not
+  // re-break every time the palette legitimately changes.
+  assert.match(themeMarkup(clientBranding(vanilla()).theme), /body\{background:.+\}/);
 });
 
 test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (task 1374)', () => {

package/tests/cosmos_token_contrast.mjs

@@ -0,0 +1,268 @@
+// Guards the WCAG AA contrast of the cosmos.css token layer (task 1002749).
+//
+// The tokens are the ONLY input here: this test PARSES public-landing/assets/cosmos.css
+// and resolves var()/color-mix() itself, so it measures what the surfaces actually paint.
+// Duplicating the hex values would prove nothing.
+//
+// AA thresholds: 4.5:1 normal text, 3.0:1 large text (>=24px, or >=18.66px bold) and
+// meaningful non-text boundaries. Every pair below is a real selector in cosmos.css.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CSS = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..', 'public-landing', 'assets', 'cosmos.css'
+);
+const src = fs.readFileSync(CSS, 'utf8');
+
+// ── parse ────────────────────────────────────────────────────────────────────
+const declarations = (body) => {
+  const out = {};
+  // strip comments, then take --name:value up to the ; that ends the declaration
+  for (const m of body.replace(/\/\*[\s\S]*?\*\//g, '').matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)) {
+    // collapse the whitespace of multi-line values so the lockstep check compares
+    // meaning, not indentation
+    out[m[1]] = m[2].replace(/\s+/g, ' ').trim();
+  }
+  return out;
+};
+
+const bodyAt = (open) => {
+  let depth = 0;
+  for (let i = open; i < src.length; i++) {
+    if (src[i] === '{') depth++;
+    else if (src[i] === '}' && --depth === 0) return src.slice(open + 1, i);
+  }
+  throw new Error(`unbalanced braces at offset ${open}`);
+};
+
+const blockAfter = (marker) => {
+  const at = src.indexOf(marker);
+  assert.notEqual(at, -1, `cosmos.css no longer contains ${marker} — update this test`);
+  return bodyAt(src.indexOf('{', at));
+};
+
+// A bare :root appears twice: the contract/chrome tier first, the derived tier last.
+// Both feed both modes, so the two merge into one raw map per mode.
+const bareRoots = [...src.matchAll(/\n:root\{/g)].map((m) => bodyAt(src.indexOf('{', m.index)));
+assert.equal(bareRoots.length, 2, 'expected exactly two bare :root blocks in cosmos.css');
+const [contractTier, derivedTier] = bareRoots.map(declarations);
+const firstRoot = contractTier;
+const derived = derivedTier;
+
+const darkExplicit = declarations(blockAfter(':root[data-mode="dark"]{'));
+const darkMedia = declarations(blockAfter(':root:not([data-mode="light"]){'));
+
+// THE CASCADE THAT ACTUALLY SHIPS. injectBrandingGlobal splices the branding pack's
+// theme <style> at the END of <head> — after the cosmos.css <link> — as a plain
+// :root. Equal specificity, later in document order, so for the 13 tokens the pack
+// emits the PACK wins and cosmos.css's own :root value never renders. Measuring
+// cosmos.css alone would measure a page nobody sees.
+// The dark blocks are :root[data-mode="dark"] and :root:not([data-mode="light"]) —
+// both (0,2,0) — so they outrank the pack's (0,1,0) and win back.
+const packColors = JSON.parse(
+  fs.readFileSync(path.join(path.dirname(CSS), '..', '..', 'config', 'branding.neutral.json'), 'utf8')
+).theme.ui.colors;
+
+// mirrors COLOR_VARS in src/bongos/serve-internal.js
+const camelToVar = (k) => '--' + k.replace(/[A-Z]/g, (c) => '-' + c.toLowerCase());
+const PACK = Object.fromEntries(
+  Object.entries(packColors).map(([k, v]) => [camelToVar(k), v])
+);
+
+const RAW = {
+  light: { ...firstRoot, ...derived, ...PACK },
+  dark: { ...firstRoot, ...derived, ...PACK, ...darkExplicit },
+};
+
+// ── color resolution ─────────────────────────────────────────────────────────
+const clamp = (v) => Math.min(255, Math.max(0, v));
+
+function resolve(expr, mode, seen = new Set()) {
+  const e = String(expr).trim();
+
+  if (e === 'transparent') return [0, 0, 0, 0];
+
+  let m = e.match(/^#([0-9a-f]{6})$/i);
+  if (m) { const n = parseInt(m[1], 16); return [(n >> 16) & 255, (n >> 8) & 255, n & 255, 1]; }
+
+  m = e.match(/^#([0-9a-f]{3})$/i);
+  if (m) return [...m[1]].map((c) => parseInt(c + c, 16)).concat(1);
+
+  m = e.match(/^rgba?\(\s*([\d.]+)\s*,\s*([\d.]+)\s*,\s*([\d.]+)\s*(?:,\s*([\d.]+)\s*)?\)$/);
+  if (m) return [+m[1], +m[2], +m[3], m[4] === undefined ? 1 : +m[4]];
+
+  m = e.match(/^var\(\s*(--[\w-]+)\s*(?:,([\s\S]+))?\)$/);
+  if (m) {
+    const name = m[1];
+    assert.ok(!seen.has(name), `cyclic var reference at ${name}`);
+    const next = RAW[mode][name] ?? m[2];
+    assert.ok(next !== undefined, `${name} is not defined for ${mode} mode`);
+    return resolve(next, mode, new Set([...seen, name]));
+  }
+
+  m = e.match(/^color-mix\(\s*in\s+srgb\s*,\s*([\s\S]+?)\s+([\d.]+)%\s*,\s*([\s\S]+?)\s*\)$/);
+  if (m) {
+    const p = +m[2] / 100;
+    const a = resolve(m[1], mode, seen);
+    const b = resolve(m[3], mode, seen);
+    // color-mix premultiplies by alpha; every pair we assert on resolves opaque,
+    // and `transparent` correctly drags the result toward the other operand.
+    const alpha = a[3] * p + b[3] * (1 - p);
+    if (alpha === 0) return [0, 0, 0, 0];
+    return [0, 1, 2]
+      .map((i) => (a[i] * a[3] * p + b[i] * b[3] * (1 - p)) / alpha)
+      .concat(alpha);
+  }
+
+  throw new Error(`cannot resolve color expression: ${e}`);
+}
+
+// flatten a possibly-translucent color onto an opaque backdrop
+const over = (fg, bg) =>
+  fg[3] === 1 ? fg : [0, 1, 2].map((i) => clamp(fg[i] * fg[3] + bg[i] * (1 - fg[3]))).concat(1);
+
+const lin = (c) => { c /= 255; return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4; };
+const lum = ([r, g, b]) => 0.2126 * lin(r) + 0.7152 * lin(g) + 0.0722 * lin(b);
+const contrast = (fg, bg) => {
+  const [hi, lo] = [lum(fg), lum(bg)].sort((a, b) => b - a);
+  return (hi + 0.05) / (lo + 0.05);
+};
+
+const hex = (c) => '#' + c.slice(0, 3).map((v) => Math.round(v).toString(16).padStart(2, '0')).join('');
+
+// ── the pairs cosmos.css actually paints ─────────────────────────────────────
+// need: 4.5 normal text · 3.0 large text and meaningful non-text
+const CARD = 'var(--bg-card)';
+const PAIRS = [
+  // primary + secondary action
+  ['.btn label on its fill',            '#ffffff',              'var(--accent)',        4.5],
+  ['.btn.ghost:hover label',            'var(--accent-deep)',   CARD,                   4.5],
+  ['.btn.danger label',                 'var(--err)',           CARD,                   4.5],
+  // Inline links: cosmos.css recolors its own to --sun-lit in dark (:179-262), but
+  // create.html has ELEVEN --accent-deep consumers and zero dark CSS rules (its only
+  // data-mode hits are the JS toggle), so there the token itself must carry dark.
+  ['inline link on a card',             'var(--accent-deep)',   CARD,                   4.5],
+  ['inline link on the page ground',    'var(--accent-deep)',   'var(--bg)',            4.5],
+  ['code chip on --bg-deep',            'var(--accent-deep)',   'var(--bg-deep)',       4.5],
+  ['cosmos.css dark link (--sun-lit)',  'var(--sun-lit)',       CARD,                   4.5, 'dark'],
+  // body copy
+  ['--ink body copy',                   'var(--ink)',           CARD,                   4.5],
+  ['--ink-soft secondary copy',         'var(--ink-soft)',      CARD,                   4.5],
+  ['--ink-faint .projMeta 13px',        'var(--ink-faint)',     CARD,                   4.5],
+  ['--ink-faint .finePrint on ground',  'var(--ink-faint)',     'var(--bg)',            4.5],
+  // chips: 12px/700 label on its own tint
+  ['.chip base label',                  'var(--ink-soft)',      'var(--neutral-soft)',  4.5],
+  ['.chip.calm label',                  'var(--ink-faint)',     'var(--neutral-soft)',  4.5],
+  ['.chip.live label',                  'var(--ok)',            'var(--ok-soft)',       4.5],
+  ['.chip.maybe label',                 'var(--warn)',          'var(--warn-soft)',     4.5],
+  ['.chip.down/.bad label',             'var(--err)',           'var(--err-soft)',      4.5],
+  // .chip.busy recolors in dark (cosmos.css:194-195) — assert what each mode paints
+  ['.chip.busy label',                  'var(--accent-deep)',   'var(--accent-soft)',   4.5, 'light'],
+  ['.chip.busy label',                  'var(--sun-lit)',       'var(--accent-soft)',   4.5, 'dark'],
+  // lifecycle strip: 12px/700
+  ['.strip .slbl idle',                 'var(--ink-faint)',     CARD,                   4.5],
+  ['.strip .slbl now/done',             'color-mix(in srgb,var(--sea) 40%,var(--ink))',       CARD, 4.5],
+  ['.strip.isLive .slbl',               'var(--ok)',            CARD,                   4.5],
+  // status messages
+  ['.projMsg.ok',                       'var(--ok)',            CARD,                   4.5],
+  ['.projMsg.err / .confirmRow',        'var(--err)',           CARD,                   4.5],
+  // chrome: wordmark + footer sit on the page ground, not on a card
+  // create.html page-local grounds — it carries its own <style> and its own
+  // darkest tints, so cosmos.css's pairs alone do not cover /create
+  ['create.html .ghrow .priv 11px',     'var(--ink-soft)',      'color-mix(in srgb,var(--ink) 8%,var(--bg-deep))', 4.5],
+  ['create.html ::placeholder',         'var(--ink-faint)',     CARD,                   4.5],
+  ['create.html .ghlist .hint on deep', 'var(--ink-faint)',     'var(--bg-deep)',       4.5],
+  ['--chrome-accent wordmark',          'var(--chrome-accent)', 'var(--page-bg)',       4.5],
+  ['--chrome-ink',                      'var(--chrome-ink)',    'var(--page-bg)',       4.5],
+  ['--foot-ink footer copy',            'var(--foot-ink)',      'var(--page-bg)',       4.5],
+  ['--foot-code footer code',           'var(--foot-code)',     'var(--page-bg)',       4.5],
+  ['--hero-b hero emphasis',            'var(--hero-b)',        'var(--bg)',            4.5],
+  ['--hero-lede hero lede',             'var(--hero-lede)',     'var(--bg)',            4.5],
+];
+
+for (const mode of ['light', 'dark']) {
+  test(`cosmos.css tokens clear WCAG AA in ${mode} mode`, () => {
+    const ground = resolve('var(--page-bg)', mode);
+    const failures = [];
+    for (const [what, fgExpr, bgExpr, need, onlyMode] of PAIRS) {
+      if (onlyMode && onlyMode !== mode) continue;
+      const bg = over(resolve(bgExpr, mode), ground);
+      const fg = over(resolve(fgExpr, mode), bg);
+      const got = contrast(fg, bg);
+      if (got < need) {
+        failures.push(`${what}: ${got.toFixed(2)}:1 (needs ${need}) — ${hex(fg)} on ${hex(bg)}`);
+      }
+    }
+    assert.deepEqual(failures, [], `\n  ${failures.join('\n  ')}\n`);
+  });
+}
+
+test('the two dark blocks stay in lockstep', () => {
+  // cosmos.css carries dark twice — an explicit data-mode hook and a
+  // prefers-color-scheme twin. A change to one and not the other is the
+  // classic regression here, and it only shows up for half of users.
+  assert.deepEqual(
+    darkMedia,
+    darkExplicit,
+    'the @media (prefers-color-scheme: dark) twin drifted from :root[data-mode="dark"]'
+  );
+});
+
+test('cosmos.css defaults do not drift from the branding pack', () => {
+  // For the 13 pack-owned tokens, cosmos.css's :root is a dead default — the pack
+  // always overrides it. That makes silent drift easy and dangerous: it was already
+  // real (cosmos.css said --ink-faint:#9c8d80, the pack shipped #857567), and it
+  // means anyone auditing cosmos.css alone measures colors no user ever sees.
+  const drift = [];
+  for (const [name, packValue] of Object.entries(PACK)) {
+    const cssValue = firstRoot[name];
+    if (cssValue === undefined) continue;
+    if (cssValue.toLowerCase() !== packValue.toLowerCase()) {
+      drift.push(`${name}: cosmos.css ${cssValue} vs pack ${packValue}`);
+    }
+  }
+  assert.deepEqual(drift, [], `\n  ${drift.join('\n  ')}\n`);
+});
+
+test('the dark blocks never pin a token the branding pack owns', () => {
+  // The pack injects a plain :root — specificity (0,1,0). Both dark selectors are
+  // (0,2,0), so ANY literal declared there outranks the pack forever and that
+  // instance gets Cloud Bongos' color in dark mode. A dark override of a
+  // pack-settable token is only safe if it DERIVES from one (var(--…)).
+  const PACK_OWNED = ['--accent', '--accent-deep', '--sea', '--terracotta'];
+  for (const block of [darkExplicit, darkMedia]) {
+    for (const name of PACK_OWNED) {
+      const v = block[name];
+      if (v === undefined) continue; // absent = the pack reaches dark. Ideal.
+      assert.match(
+        v,
+        /var\(--/,
+        `${name} is pinned to a literal in a dark block — a re-themed instance can never override it`
+      );
+    }
+  }
+});
+
+test('every accent-derived chrome token follows its contract token', () => {
+  // A branding pack re-themes the contract tier. Any chrome token that hardcodes
+  // the platform orange instead of referencing --accent leaks Cloud Bongos orange
+  // into a re-themed instance (ADR 0062 §7).
+  for (const [name, expected] of [
+    ['--chrome-accent', /var\(--accent(-deep)?\)/],
+    ['--glass-border', /var\(--accent(-deep)?\)/],
+    ['--hero-b', /var\(--accent(-deep)?\)/],
+    ['--foot-code', /var\(--accent(-deep)?\)/],
+    ['--foot-ink', /var\(--ink[\w-]*\)/],
+  ]) {
+    assert.match(
+      firstRoot[name] ?? '',
+      expected,
+      `${name} hardcodes a color instead of following the contract tier`
+    );
+  }
+});