@company-semantics/contracts 35.0.0 → 35.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "35.0.0",
+  "version": "35.1.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/notifications/README.md

@@ -9,15 +9,17 @@ into `Definition → Payload → compose(payload, context) → Content → Rende
 This is the package's SOLE notification surface. `@company-semantics/contracts/email`
 and every `Email*` symbol are gone, with no shim and no alias.
 
-The domain holds the **output-parity baseline** — a committed, byte-exact
-capture of what the email layer rendered at 32.0.0, plus the test that proves
-this layer still renders exactly that. The baseline was deliberately landed
-_before_ the abstraction it protects, so that every later step in the migration
-had a mechanical answer to "did any real email change?". Now that the old layer
-is deleted, the golden is also the only surviving record of those bytes.
-
-On top of it sits the **semantic model**: the channel-agnostic vocabulary the
-migration is heading toward.
+The domain holds the **semantic model**: the channel-agnostic vocabulary an
+element names, and the renderers that decide what it looks like per channel.
+
+It used to hold an **output-parity baseline** too — a byte-exact capture of what
+the email layer rendered at 32.0.0, landed deliberately _before_ the abstraction
+it protected, so every step of the migration had a mechanical answer to "did any
+real email change?". That baseline did its job: the answer was "none", and it
+shipped in 35.0.0. ADR-CONTRACTS-087 retired it, because a proof that the
+migration changed nothing cannot also serve as permission to change something,
+and email design is not frozen. `__tests__/render-snapshot.test.ts` is the fence
+now; the retired bytes are readable in git at `v35.0.0`.
 
 - `content.ts` — `NotificationContent { metadata, sections }`, `Section`, and the
   flat `NotificationElement` union (greeting, body, keyValueTable, callToAction,
@@ -91,16 +93,16 @@ deliberately (ADR-CONTRACTS-086):
 
 ## Invariants
 
-- The golden in `__tests__/output-parity.golden.ts` records what the email layer
-  rendered at **32.0.0**, and is now the only record of it — there is no longer a
-  layer to re-capture it from. It is a regression baseline, not a specification:
-  when it and this render layer disagree, the GOLDEN is right and the renderer
-  must be fixed, never the golden regenerated to match.
-- Every kind in `NOTIFICATION_DEFINITIONS` needs at least one parity fixture,
-  enforced by the test. The registry is the source of that list — it is total, so
-  "every kind the entry point accepts" and "every kind with a fixture" are the
-  same claim.
-- Rendering for parity MUST pin the year to `OUTPUT_PARITY_CLOCK`'s — by passing
+- `__tests__/render-snapshot.test.ts` locks what this layer renders. A diff there
+  means a real sent email changed: review it, then regenerate. It is a regression
+  fence, not a specification — but since ADR-CONTRACTS-087 retired the parity
+  golden that used to outrank it, reading the diff is the ONLY control left. A
+  snapshot refreshed on sight proves nothing.
+- Every kind in `NOTIFICATION_DEFINITIONS` needs at least one fixture in
+  `__tests__/fixtures.ts`, enforced by the tests. The registry is the source of
+  that list — it is total, so "every kind the entry point accepts" and "every
+  kind with a fixture" are the same claim.
+- Rendering MUST pin the year to `FIXTURE_CLOCK`'s — by passing
   `copyrightYear` in the `RenderContext`, NOT by freezing the clock. `signature`
   used to read `new Date().getFullYear()` mid-render, which is why the fixtures
   once needed fake timers; the year is a value now, and no test in this domain

package/src/notifications/__tests__/README.md

@@ -2,53 +2,48 @@
 
 ## Purpose
 
-The output-parity proof for the multi-channel notification render layer
-(ADR-CONTRACTS-086), and the snapshot suite that documents the markup.
-
-- `output-parity.golden.ts` — the fixtures (kind + payload) and
-  `OUTPUT_PARITY_GOLDEN`, the exact `{ subject, text, html }` each one rendered
-  to through the email layer **as it stood before any of this existed**.
-- `output-parity.test.ts` — renders every fixture through `renderToChannel`, the
-  new entry point, and asserts byte equality against that golden.
-- `render-snapshot.test.ts` + `__snapshots__/` — the same fixtures as vitest
-  snapshots, moved here from the old `src/email/render/__tests__/` with the
-  markup they document.
-
-The parity test used to pin the old `renderEmail` against itself, which was the
-point: the bytes were captured _before_ the layer they describe was touched. That
-baseline has now done its job — the same fixtures render through
-`compose → Content → Renderer` and produce the same bytes, so the generalisation
-is proven to have changed no email. `src/email/` was deleted on that proof.
-
-Prefer the golden when the two suites disagree. `vitest -u` can regenerate a
-snapshot in a keystroke, and a snapshot regenerated under refactor pressure is
-worth nothing; the golden is a committed module, so making it pass is a
-deliberate, reviewable act.
+The shared fixture corpus for the multi-channel notification render layer
+(ADR-CONTRACTS-086), and the snapshot suite that documents the markup it renders
+to.
+
+- `fixtures.ts` — every implemented kind × representative payload, plus
+  `FIXTURE_CLOCK` and `fixtureKey`. Shared by every suite here and by
+  `../renderers/email/__tests__/render.test.ts`, so a kind added to the registry
+  is covered everywhere by being added once.
+- `render-snapshot.test.ts` + `__snapshots__/` — those fixtures rendered through
+  the email channel, as vitest snapshots. This is the fence: **a diff here means
+  a real sent email changed.**
+
+## The retired output-parity golden (ADR-CONTRACTS-087)
+
+`fixtures.ts` was `output-parity.golden.ts`, and it used to carry
+`OUTPUT_PARITY_GOLDEN` — the exact `{ subject, text, html }` the email layer
+emitted at 32.0.0, before any of this existed — asserted byte-for-byte by
+`output-parity.test.ts` at the entry point and by the email renderer's own suite
+at the renderer. Those two tests were the "no output change" contract for the
+generalisation: `src/email/` was deleted on that proof.
+
+**The proof passed and shipped in 35.0.0, which discharged it.** It was a claim
+about a migration, not a freeze on email design — and the moment email design is
+deliberately exercised, byte-equality to a deleted layer fails by construction
+and keeps failing.
+
+It was **retired rather than regenerated**, and the distinction is the point:
+rewriting those bytes to match a redesign would have made the file assert
+something false about a layer that no longer exists to contradict it. The bytes
+are readable in git at `v35.0.0`; nothing in the tree claims to be them.
 
 ## Invariants
 
-- The year MUST be pinned to `OUTPUT_PARITY_CLOCK`'s via the `RenderContext`, not
-  by freezing the clock. It is baked into every case by `signature`, so an
-  unpinned render fails on the next New Year's Day for calendar reasons alone.
-  Fake timers are no longer needed anywhere here, and that is the improvement
-  this layer was built to deliver — do not reintroduce them.
-- The captured year is **not** redacted or normalised. It is part of the output
-  surface this proof exists to protect.
-- A failure here means a **real sent email changed**. Review the diff before
-  regenerating; the golden is not a snapshot to refresh on sight. `src/email/` is
-  deleted, so these bytes cannot be re-captured — the golden is the only record
-  of what that layer emitted, and regenerating it destroys the proof rather than
-  updating it.
-- The golden and the fixtures MUST stay in exact correspondence — no missing and
-  no orphaned entries. The test enforces both directions.
-- Every kind in `NOTIFICATION_DEFINITIONS` MUST have a fixture, enforced by both
-  suites.
-- The golden's BYTES are frozen; its TYPES were re-anchored onto this domain when
-  the `Email*` originals were deleted. `OutputParityFixture.options` went with
-  them — it was declared as `RenderEmailOptions` and carried the old layer's
-  `includeRequestMetadata`, which `compose` replaced with "does the payload carry
-  request details?". It had been left in place as frozen evidence, but its type
-  no longer exists and no test ever read it; the one fixture that set it supplies
-  both request fields anyway, so the gate opens regardless. The byte equality is
-  what proves that — which is exactly why dropping the field was safe and
-  re-recording a byte would not be.
+- A snapshot diff means **a real sent email changed**. Review it, then
+  `vitest -u` — never the other way round. Regenerating on sight is the whole
+  hazard; the review is the control, and it is now the only one.
+- The year MUST be pinned via `FIXTURE_CLOCK` on the `RenderContext`, never by
+  freezing the clock. `signature` bakes it into every case, so an unpinned render
+  fails on the next New Year's Day for calendar reasons alone. Fake timers are
+  not needed anywhere here — that is the impurity ADR-CONTRACTS-086 retired, so
+  do not reintroduce them.
+- The pinned year is **not** redacted or normalised. It is part of the output
+  surface these suites exist to protect.
+- Every kind in `NOTIFICATION_DEFINITIONS` MUST have a fixture, enforced by
+  `./definition.test.ts` and `./registry.test.ts`.

package/src/notifications/__tests__/__snapshots__/README.md

@@ -13,6 +13,11 @@ stayed `{kind} · {name}`, so every snapshot key still resolves against the same
 file. That is the claim the move is making — the keys matched, so the bytes
 matched.
 
+The `security.alert` cases have since moved: the `warning` banner is drawn in the
+product's destructive colour (ADR-CONTRACTS-087). That is the first deliberate
+change to this markup since the move, and the reason the parity golden that used
+to guard it is gone.
+
 This directory exists because vitest resolves snapshots adjacent to the test
 file, so the `.snap` had to travel with it.
 
@@ -20,13 +25,15 @@ file, so the `.snap` had to travel with it.
 
 - This is **production-parity email markup**. A diff here means a real sent email
   changed. Review it, then `vitest -u` — never the other way round.
-- These snapshots are **not** the migration's proof. That is
-  `../output-parity.golden.ts`, a committed module `vitest -u` cannot touch. When
-  the two disagree, the golden is right. Regenerating this file to make a
-  refactor pass is the exact failure ADR-CONTRACTS-086 exists to prevent, and it
-  is one keystroke away — which is why the golden is not a snapshot.
-- The copyright year is pinned to `OUTPUT_PARITY_CLOCK`'s, never the wall clock.
-  It is baked into every case via `signature`, so an unpinned capture would fail
-  on the next New Year's Day for calendar reasons alone.
+- These snapshots are now the **only** automated record of that markup. Until
+  ADR-CONTRACTS-087 the migration's proof sat beside them in
+  `../output-parity.golden.ts`, a committed module `vitest -u` could not touch,
+  and it was the tie-breaker when the two disagreed. That proof was discharged in
+  35.0.0 and retired, because it asserted byte-equality with a deleted layer and
+  email design is allowed to change. Nothing now catches a snapshot regenerated
+  under refactor pressure except reading the diff — so read it.
+- The copyright year is pinned to `FIXTURE_CLOCK`'s, never the wall clock. It is
+  baked into every case via `signature`, so an unpinned capture would fail on the
+  next New Year's Day for calendar reasons alone.
 - The year is **not** redacted or normalised. It is part of the output surface
   these snapshots exist to protect.

package/src/notifications/__tests__/__snapshots__/registry.test.ts.snap

@@ -0,0 +1,31 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`NOTIFICATION_DEFINITIONS > titles every kind 1`] = `
+{
+  "auth.otp · Default": "Your login code for Company Semantics",
+  "auth.otp · Short expiry": "Your login code for Company Semantics",
+  "auth.otp · With request metadata": "Your login code for Company Semantics",
+  "chat.shared · Default": "A chat has been shared with you",
+  "chat.shared · Long preview": "A chat has been shared with you",
+  "chat.shared · Long title": "A chat has been shared with you",
+  "chat.shared · No preview": "A chat has been shared with you",
+  "chat.shared · Short": "A chat has been shared with you",
+  "companyMd.access_request_approved · Editor": "Your access request was approved",
+  "companyMd.access_request_approved · Viewer": "Your access request was approved",
+  "companyMd.access_request_denied · No reason": "Your access request was reviewed",
+  "companyMd.access_request_denied · With reason": "Your access request was reviewed",
+  "companyMd.access_requested · No message": "Someone requested access to a document",
+  "companyMd.access_requested · With message": "Someone requested access to a document",
+  "org.invite · Admin": "You've been invited to join Acme Corp on Company Semantics",
+  "org.invite · Member": "You've been invited to join Acme Corp on Company Semantics",
+  "org.ownership_transfer · No note (admin)": "You've been invited to become a workspace owner",
+  "org.ownership_transfer · With note + from": "You've been invited to become a workspace owner",
+  "org.ownership_transfer_completed · Default": "Workspace ownership has been transferred",
+  "org.unit_owner_granted · Delegate with expiry": "You've been added as delegate owner to Platform Engineering in Acme Corp",
+  "org.unit_owner_granted · Unit owner + message": "You've been added as owner to Platform Engineering in Acme Corp",
+  "security.alert · Excessive OTP requests": "Security alert for your account",
+  "security.alert · Unusual login location": "Security alert for your account",
+  "share.granted · Document · editor · message": "Something has been shared with you",
+  "share.granted · Meeting · viewer · no title": "Something has been shared with you",
+}
+`;

package/src/notifications/__tests__/__snapshots__/render-snapshot.test.ts.snap

@@ -1547,7 +1547,7 @@ exports[`email render > security.alert · Excessive OTP requests 1`] = `
 <head><meta charset="UTF-8"></head>
 <body style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; color: #1a1a1a; margin: 0; padding: 0;">
 <div style="max-width: 520px; margin: 0 auto;">
-<p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;">🆆🅰🆁🅽🅸🅽🅶</p>
+<p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;"><span style="color: #e7000b;">🆆🅰🆁🅽🅸🅽🅶</span></p>
 <p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;">Unusual login-code activity detected.</p>
 <p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;">Details: 12 login codes requested in 5 minutes</p>
 <p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 4px 0;">If this was you, no action is needed.</p>
@@ -1587,7 +1587,7 @@ exports[`email render > security.alert · Unusual login location 1`] = `
 <head><meta charset="UTF-8"></head>
 <body style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; color: #1a1a1a; margin: 0; padding: 0;">
 <div style="max-width: 520px; margin: 0 auto;">
-<p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;">🆆🅰🆁🅽🅸🅽🅶</p>
+<p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;"><span style="color: #e7000b;">🆆🅰🆁🅽🅸🅽🅶</span></p>
 <p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;">A login from an unusual location was detected.</p>
 <p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 20px 0;">Details: Login from Berlin, DE</p>
 <p style="font-family: 'SF Mono', SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace; font-size: 13px; margin: 0 0 4px 0;">If this was you, no action is needed.</p>

package/src/notifications/__tests__/context.test.ts

@@ -12,13 +12,13 @@
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 
 import { COMPANY_NAME, createRenderContext } from "../context";
-import { OUTPUT_PARITY_CLOCK } from "./output-parity.golden";
+import { FIXTURE_CLOCK } from "./fixtures";
 
-const FROZEN_YEAR = new Date(OUTPUT_PARITY_CLOCK).getUTCFullYear();
+const FROZEN_YEAR = new Date(FIXTURE_CLOCK).getUTCFullYear();
 
 beforeAll(() => {
   vi.useFakeTimers();
-  vi.setSystemTime(new Date(OUTPUT_PARITY_CLOCK));
+  vi.setSystemTime(new Date(FIXTURE_CLOCK));
 });
 
 afterAll(() => {
@@ -38,7 +38,7 @@ describe("createRenderContext", () => {
   it("defaults the year from the clock", () => {
     vi.setSystemTime(new Date("2030-03-04T05:06:07.000Z"));
     expect(createRenderContext().brand.copyrightYear).toBe(2030);
-    vi.setSystemTime(new Date(OUTPUT_PARITY_CLOCK));
+    vi.setSystemTime(new Date(FIXTURE_CLOCK));
   });
 
   it("overrides each brand field independently", () => {
@@ -55,7 +55,7 @@ describe("createRenderContext", () => {
     const before = createRenderContext(pinned);
     vi.setSystemTime(new Date("2031-01-01T00:00:00.000Z"));
     expect(createRenderContext(pinned)).toEqual(before);
-    vi.setSystemTime(new Date(OUTPUT_PARITY_CLOCK));
+    vi.setSystemTime(new Date(FIXTURE_CLOCK));
   });
 
   it("returns a fresh context per call — callers cannot alias each other", () => {

package/src/notifications/__tests__/definition.test.ts

@@ -31,7 +31,7 @@ import type { NotificationContent, NotificationElement } from "../content";
 import { createRenderContext } from "../context";
 import type { NotificationKind } from "../kinds";
 import { NOTIFICATION_DEFINITIONS } from "../registry";
-import { OUTPUT_PARITY_FIXTURES } from "./output-parity.golden";
+import { NOTIFICATION_FIXTURES } from "./fixtures";
 
 const CONTEXT = createRenderContext({ brand: { copyrightYear: 2026 } });
 
@@ -40,7 +40,7 @@ function compose(
   kind: NotificationKind,
   context = CONTEXT,
 ): NotificationContent {
-  const fixture = OUTPUT_PARITY_FIXTURES.find((f) => f.kind === kind);
+  const fixture = NOTIFICATION_FIXTURES.find((f) => f.kind === kind);
   if (!fixture) throw new Error(`No parity fixture for kind: ${kind}`);
   const fn = NOTIFICATION_DEFINITIONS[kind].compose as (
     p: unknown,

package/src/notifications/__tests__/fixtures.ts

@@ -0,0 +1,226 @@
+/**
+ * The notification fixture corpus: every implemented kind × representative
+ * payload. Shared by `./render-snapshot.test.ts`, `./definition.test.ts`,
+ * `./registry.test.ts` and `../renderers/email/__tests__/render.test.ts`, so a
+ * kind added to the registry is covered everywhere by being added once here.
+ *
+ * WAS `output-parity.golden.ts` (ADR-CONTRACTS-087). These same inputs used to
+ * carry a frozen `OUTPUT_PARITY_GOLDEN` of the `{ subject, text, html }` the
+ * email layer emitted at 32.0.0, asserted byte-for-byte to prove the
+ * multi-channel generalisation (ADR-CONTRACTS-086) changed no output. That proof
+ * passed and shipped in 35.0.0, which discharged it: it was a claim about a
+ * migration, not a freeze on email design. The bytes were retired rather than
+ * rewritten — editing them to match a deliberate redesign would have made the
+ * file assert something false about a layer that no longer exists. They remain
+ * readable in git at `v35.0.0`.
+ *
+ * `./render-snapshot.test.ts` is now the fence: it locks the same fixtures'
+ * rendered output, and unlike the golden it is regenerable on purpose, because
+ * changing how email looks is now an ordinary reviewed diff.
+ *
+ * Capture-time options are not recorded. The old `renderEmail` took a
+ * `RenderEmailOptions`, and one fixture set `includeRequestMetadata: true`; the
+ * entry point has no equivalent because `auth.otp`'s `compose` gates request
+ * details on whether the payload carries them — and that fixture's payload
+ * carries both, so the gate opens anyway.
+ */
+
+import type { NotificationKind } from "../kinds";
+import type { NotificationPayloads } from "../payloads";
+
+/**
+ * The instant every fixture renders under.
+ *
+ * A pinned year, not a frozen clock. The copyright year is a value on
+ * `RenderContext`, so a test states this instant instead of stubbing time —
+ * which is the impurity ADR-CONTRACTS-086 retired. Pinned rather than left to
+ * the wall clock so no snapshot is due to fail on New Year's Day.
+ */
+export const FIXTURE_CLOCK = "2026-07-15T00:00:00.000Z";
+
+/** One case: a kind rendered with a representative payload. */
+export interface NotificationFixture {
+  readonly kind: NotificationKind;
+  /** Variant label, unique within a kind. */
+  readonly name: string;
+  readonly payload: NotificationPayloads[NotificationKind];
+}
+
+/** Stable label for a fixture — also its snapshot key. */
+export function fixtureKey(kind: NotificationKind, name: string): string {
+  return `${kind} · ${name}`;
+}
+
+const fixtures: NotificationFixture[] = [];
+function add<K extends NotificationKind>(
+  kind: K,
+  name: string,
+  payload: NotificationPayloads[K],
+): void {
+  fixtures.push({ kind, name, payload });
+}
+
+const APP = "https://app.companysemantics.ai";
+
+add("auth.otp", "Default", { otp: "123456", expiresInMinutes: 10 });
+add("auth.otp", "Short expiry", { otp: "902413", expiresInMinutes: 1 });
+add("auth.otp", "With request metadata", {
+  otp: "246810",
+  expiresInMinutes: 5,
+  requestIp: "203.0.113.4",
+  userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
+});
+
+add("org.invite", "Admin", {
+  inviterName: "Alex Rivera",
+  orgName: "Acme Corp",
+  role: "admin",
+  acceptUrl: `${APP}/invite/abc123`,
+  expiresAt: "2026-06-13T00:00:00.000Z",
+});
+add("org.invite", "Member", {
+  inviterName: "Alex Rivera",
+  orgName: "Acme Corp",
+  role: "member",
+  acceptUrl: `${APP}/invite/def456`,
+  expiresAt: "2026-06-13T00:00:00.000Z",
+});
+
+add("org.unit_owner_granted", "Unit owner + message", {
+  granterName: "Jordan Lee",
+  recipientName: "Sam Chen",
+  orgName: "Acme Corp",
+  unitName: "Platform Engineering",
+  roleLabel: "Unit owner",
+  ctaUrl: `${APP}/org/unit/42`,
+  message: "Welcome aboard — glad to have you owning this team.",
+});
+add("org.unit_owner_granted", "Delegate with expiry", {
+  granterName: "Jordan Lee",
+  orgName: "Acme Corp",
+  unitName: "Platform Engineering",
+  roleLabel: "Delegate",
+  ctaUrl: `${APP}/org/unit/42`,
+  expiresAt: "2026-06-13T00:00:00.000Z",
+});
+
+add("org.ownership_transfer", "With note + from", {
+  orgName: "Acme Corp",
+  acceptUrl: `${APP}/owner-transfer/accept/tok123`,
+  expiresAt: "2026-06-13T00:00:00.000Z",
+  note: "Handing this over as I move to an advisory role.",
+  fromName: "Jordan Lee",
+});
+add("org.ownership_transfer", "No note (admin)", {
+  orgName: "Acme Corp",
+  acceptUrl: `${APP}/owner-transfer/accept/tok456`,
+  expiresAt: "2026-06-13T00:00:00.000Z",
+});
+
+add("org.ownership_transfer_completed", "Default", {
+  orgName: "Acme Corp",
+  newOwnerEmail: "new.owner@acme.com",
+});
+
+add("security.alert", "Excessive OTP requests", {
+  alertType: "excessive_otp_requests",
+  details: "12 login codes requested in 5 minutes",
+  timestamp: "2026-07-12T14:30:00Z",
+});
+add("security.alert", "Unusual login location", {
+  alertType: "unusual_login_location",
+  details: "Login from Berlin, DE",
+  timestamp: "2026-07-12T14:30:00Z",
+});
+
+const CHAT_BASE = {
+  sharedByName: "Alex Rivera",
+  visibility: "private",
+} as const;
+add("chat.shared", "Default", {
+  ...CHAT_BASE,
+  chatTitle: "API design discussion",
+  shareUrl: `${APP}/share/abc123`,
+  previewText:
+    "Here are my thoughts on the REST API design for the new authentication endpoints.",
+});
+add("chat.shared", "No preview", {
+  ...CHAT_BASE,
+  chatTitle: "Quick sync notes",
+  shareUrl: `${APP}/share/xyz789`,
+});
+add("chat.shared", "Long title", {
+  ...CHAT_BASE,
+  visibility: "public",
+  chatTitle:
+    "This is a very long chat title that should be truncated to fit the layout properly",
+  shareUrl: `${APP}/share/long456`,
+  previewText: "The assistant response preview text.",
+});
+add("chat.shared", "Long preview", {
+  ...CHAT_BASE,
+  chatTitle: "Code review feedback",
+  shareUrl: `${APP}/share/preview789`,
+  previewText:
+    "I reviewed the pull request and found several areas that need improvement. The authentication logic needs better error handling, and the database queries could be optimized.",
+});
+add("chat.shared", "Short", {
+  ...CHAT_BASE,
+  chatTitle: "Hi",
+  shareUrl: `${APP}/share/short123`,
+  previewText: "Hello!",
+});
+
+add("share.granted", "Document · editor · message", {
+  granterName: "Jordan Lee",
+  recipientName: "Sam Chen",
+  entityLabel: "document",
+  entityTitle: "Q3 Roadmap",
+  accessLevel: "editor",
+  ctaUrl: `${APP}/doc/roadmap`,
+  message: "Take a look before Thursday's planning.",
+});
+add("share.granted", "Meeting · viewer · no title", {
+  granterName: "Jordan Lee",
+  entityLabel: "meeting",
+  accessLevel: "viewer",
+  ctaUrl: `${APP}/meeting/8842`,
+});
+
+add("companyMd.access_requested", "With message", {
+  requesterName: "Sam Chen",
+  docTitle: "Engineering Handbook",
+  message: "I'd like to contribute the onboarding section.",
+  reviewUrl: `${APP}/doc/handbook?request=req_123`,
+});
+add("companyMd.access_requested", "No message", {
+  requesterName: "Sam Chen",
+  docTitle: "Engineering Handbook",
+  reviewUrl: `${APP}/doc/handbook?request=req_456`,
+});
+
+add("companyMd.access_request_approved", "Editor", {
+  approverName: "Jordan Lee",
+  docTitle: "Engineering Handbook",
+  accessLevel: "editor",
+  docUrl: `${APP}/doc/handbook`,
+});
+add("companyMd.access_request_approved", "Viewer", {
+  approverName: "Jordan Lee",
+  docTitle: "Engineering Handbook",
+  accessLevel: "viewer",
+  docUrl: `${APP}/doc/handbook`,
+});
+
+add("companyMd.access_request_denied", "With reason", {
+  approverName: "Jordan Lee",
+  docTitle: "Engineering Handbook",
+  reason: "This doc is limited to the platform team for now.",
+});
+add("companyMd.access_request_denied", "No reason", {
+  approverName: "Jordan Lee",
+  docTitle: "Engineering Handbook",
+});
+
+/** The corpus — every implemented kind × representative variants. */
+export const NOTIFICATION_FIXTURES: readonly NotificationFixture[] = fixtures;

package/src/notifications/__tests__/kinds.test.ts

@@ -17,9 +17,8 @@
  *   union member is added without being named here;
  * - the frozen list in the first test, which fails at runtime if one is removed;
  * - `./registry.test.ts`, which pins a definition for every member;
- * - `./output-parity.test.ts`, which pins golden bytes — captured from the old
- *   layer — for every member. That is what now carries "these are exactly the
- *   kinds email could render": every kind here has bytes that layer produced.
+ * - `./render-snapshot.test.ts`, which pins rendered output for every member.
+ *   That is what carries "these are exactly the kinds email can render".
  *
  * The DIVERGENCE is the easiest thing in this change to mistake for an omission,
  * so it keeps a test of its own. `auth.magic_link` was a registered subject with

package/src/notifications/__tests__/registry.test.ts

@@ -28,11 +28,7 @@ import {
   isValidNotificationKind,
   NOTIFICATION_DEFINITIONS,
 } from "../registry";
-import {
-  fixtureKey,
-  OUTPUT_PARITY_FIXTURES,
-  OUTPUT_PARITY_GOLDEN,
-} from "./output-parity.golden";
+import { fixtureKey, NOTIFICATION_FIXTURES } from "./fixtures";
 
 const KINDS = Object.keys(NOTIFICATION_DEFINITIONS) as NotificationKind[];
 
@@ -45,7 +41,7 @@ const CONTEXT = createRenderContext({ brand: { copyrightYear: 2026 } });
  * so a second set of inputs would be a second thing to keep true.
  */
 function payloadFor(kind: NotificationKind): unknown {
-  const fixture = OUTPUT_PARITY_FIXTURES.find((f) => f.kind === kind);
+  const fixture = NOTIFICATION_FIXTURES.find((f) => f.kind === kind);
   if (!fixture) throw new Error(`No parity fixture for kind: ${kind}`);
   return fixture.payload;
 }
@@ -112,28 +108,32 @@ describe("NOTIFICATION_DEFINITIONS", () => {
     }
   });
 
-  it("titles every kind exactly as email subjected it at 32.0.0", () => {
-    // The subject MOVED from EMAIL_KINDS into compose — it was not rewritten.
-    // Asserted against the frozen golden's subjects, across every parity
-    // fixture, so the interpolation the old `resolveSubject`/`subjectData` did
-    // (the `{orgName}` fill, and unit_owner_granted's derived `roleWord`) is
-    // proven to survive as a template literal rather than assumed to.
+  it("titles every kind", () => {
+    // The title is what the email channel turns into a subject, and the
+    // interpolation `compose` does (the `{orgName}` fill, and
+    // unit_owner_granted's derived `roleWord`) is easy to break silently — a
+    // template literal that stops filling yields a plausible-looking title with
+    // a hole in it. Snapshotting every fixture's title makes that a reviewable
+    // diff, and isolates the claim at COMPOSE: `./render-snapshot.test.ts`
+    // covers the same titles once the renderer has had them.
     //
-    // The oracle used to be the old `renderEmail`'s own output. The golden is
-    // what replaced it when that layer was deleted, and it is the stronger of
-    // the two: it is the bytes 32.0.0 actually shipped, not live code that could
-    // have drifted alongside this registry. This isolates the claim at COMPOSE —
-    // `./output-parity.test.ts` proves the same subjects survive the renderer.
-    for (const fixture of OUTPUT_PARITY_FIXTURES) {
-      const compose = NOTIFICATION_DEFINITIONS[fixture.kind].compose as (
-        p: unknown,
-        c: typeof CONTEXT,
-      ) => { metadata: { title: string } };
-
-      expect(compose(fixture.payload, CONTEXT).metadata.title).toBe(
-        OUTPUT_PARITY_GOLDEN[fixtureKey(fixture.kind, fixture.name)].subject,
-      );
-    }
+    // These titles were asserted against the frozen 32.0.0 golden's subjects
+    // until ADR-CONTRACTS-087 retired it — the values below are those subjects,
+    // recaptured here as an ordinary snapshot. The migration proof they served
+    // was discharged in 35.0.0.
+    const titles = Object.fromEntries(
+      NOTIFICATION_FIXTURES.map((fixture) => {
+        const compose = NOTIFICATION_DEFINITIONS[fixture.kind].compose as (
+          p: unknown,
+          c: typeof CONTEXT,
+        ) => { metadata: { title: string } };
+        return [
+          fixtureKey(fixture.kind, fixture.name),
+          compose(fixture.payload, CONTEXT).metadata.title,
+        ];
+      }),
+    );
+    expect(titles).toMatchSnapshot();
   });
 });