@cyberskill/design 2.5.0 → 2.7.0

package/docs/UPSTREAM.md

@@ -0,0 +1,39 @@
+# Upstream verification & reconciliation — cyberskill-official/design · v2.5.0
+
+Status: **Merged into `main` (`v2.5.0`–`v2.6.0`)**.
+Verified live in browser: **69/69** `D1`–`D10` checks (`10.0 / 10`), **64/64** baseline checks (`10.0 / 10`), and **146/146** pages rendering cleanly across authored, forced dark, and high-contrast modes (`0 watch` items).
+
+## 1 · Shipped fixes
+
+| File | Change | Why |
+|---|---|---|
+| `dist/styles.css` | Flattened `styles.css` closure in one file (25 sheets, same order, `url()` paths `../fonts`, `../assets`), linked by cards, guidelines, and UI kits. | Card renderers and consumers that do not follow `@import` chains get fonts + tokens on first paint. Regenerated via `node scripts/flatten-css.mjs` (`npm run build:css`). |
+| `base/a11y.css` | Removed the shadowed `@media (prefers-contrast: more)` custom-property overrides. | The `tokens/elements.css` resolver (`:is(:root, [data-theme], …)`, specificity `0,3,0`) already outranks them and produces the identical high-contrast values. |
+| `tokens/elements.css` | `prefers-contrast: more` toggle flip simplified to `:root { --_cs-standard: ; --_cs-high: initial; }`. | Same cascade result (explicit `[data-cs-contrast]` rules share `0,1,0` and follow in source order); lets token tooling register the toggles cleanly. |
+| `guidelines/guideline-language.js` | Early-return when `window.CS_GuidelinesLanguage` exists or no guideline surface matches; default language **en** (`?language=vi` for Vietnamese). | Prevents bundlers that evaluate every `.js` from throwing on non-guideline surfaces. |
+| `guidelines/atomic-view.html` | Destructure `Image: CsImage`, `Comment: CsComment` and use the aliases in Molecule rows. | Avoids shadowing `window.Image` / `window.Comment` when external tooling calls `new Image()`. |
+| `ui_kits/status-hub/static-locale.js` | Return early unless the page has `[data-preview-language-toggle]` / `[data-preview-language-select]`. | Safely no-ops when evaluated on pages that do not own the locale switch. |
+| `components/feedback/feedback.card.html` | `.frame { flex: 1 1 100%; min-width: 0 }` | Prevents the toast demo frame from collapsing to zero width inside the flex row. |
+| `components/logo/logo.card.html` | Lockup wordmark `color: var(--cs-color-text-primary)`. | Ensures the wordmark remains visible in dark mode. |
+
+## 2 · Shipped verification suite (`audit/`)
+
+| File | Purpose |
+|---|---|
+| `audit/v2.5.0-verification.html`, `audit/verify-v2.5.0.js`, `audit/fixture-v2.5.0.html` | Verification Audit & Specimen Workbench: 10 dimensions (`P0` tint safety · `P1` 32-scope WCAG 1.4.11 · `P2` Umber separation, 14-control invalid parity, VI diacritics · `P3` nested glass, `DESIGN.md`/asset contract · `D8`–`D10` Doctrine Immutables: dual-ring focus, ≥ 44px touch targets & motion safety, high-contrast, density & semantic status contrast), 69 checks × `v2.5.0+` / `v2.4.0` / `v2.3.1`, 32×6 contrast matrix, edge-case report, JSON export, and specimen switcher (`version × theme × element × variant`). |
+| `audit/v2.5.0-verification.json`, `_audit/ci/verify-audit-benchmarks-browser.mjs` | Machine-readable receipt and automated CI/prepublish non-regression gate (`npm run test:audit-regression`): **10.0 / 10** (`69/69` across `D1`–`D10`), embedded baseline suite **64/64** (`v2.4.0` tag `62/64`, `v2.3.1` `8/64`), render health **146/146**, and **0 watch** items. |
+| `audit/render-health.html` | Loads all 146 templates, component cards, and UI-kit/guideline pages in hidden frames (as authored / forced dark / high-contrast / any Ngũ Hành scope) and verifies zero unstyled, unresolved, erroring, empty, or low-contrast pages. |
+| `audit/fixture.html`, `audit/verify.js`, `audit/v2.4.0-verification.html` | Three-version loader (`?v=current|v240|baseline`) re-running the 64 baseline checks across `v2.5.0`, `v2.4.0`, and `v2.3.1`. |
+| `audit/baseline-2.4.0/styles.flat.css`, `audit/baseline-2.3.1/styles.flat.css` | Flattened `styles.css` closures from tags `v2.4.0` and `v2.3.1` for live three-version comparison. |
+
+## 3 · Host-specific items excluded from upstream
+
+- `OverlayManager` → `OverlayProvider` file/export rename and the `LocaleProvider.useMessages` alias (specific to external host bundle namespace rules).
+- `window.DesignSystem_52f6e2` namespace in cards (templates accept both host-prefixed globals and `CyberSkillDS`).
+- Host-specific DC runtime copies and sandbox metadata (`thumbnail.html`, `github.md`).
+
+## 4 · Recorded notes
+
+- Dark default-scope tint ink: `.cs-item.is-selected` measures **10.54:1**, `.cs-result__icon` measures **8.42:1** — both comfortably clear WCAG AA (`4.5:1`).
+- `.cs-item.is-selected` applies `--cs-color-text-accent` to `border-color` while keeping primary text ink (`#F5EAD9`) by design.
+- Carousel dots are measured for fine pointers on desktop; under `(pointer: coarse)`, `base/a11y.css` replaces the `::before` dot with a `44px` radial-gradient target in `--cs-color-text-accent`.

package/docs/consuming.md

@@ -1,6 +1,6 @@
 # Consuming & upgrading the CyberSkill Design System
 
-**Source checkout:** VERSION **<!-- cs-source-version:checkout -->2.5.0<!-- /cs-source-version -->** is local source identity, not a registry-availability claim. For an unpublished candidate, validate the reviewed local package tarball or source checkout. Registry commands below refer to published stable 2.3.0 (and the dated ADOPT-001 1.7.2 sibling inventory) and are not automatically updated by preparation. Preparation does not authorize publication.
+**Source checkout:** VERSION **<!-- cs-source-version:checkout -->2.7.0<!-- /cs-source-version -->** is local source identity, not a registry-availability claim. For an unpublished candidate, validate the reviewed local package tarball or source checkout. Registry commands below refer to published stable 2.6.0 (and the dated ADOPT-001 1.7.2 sibling inventory) and are not automatically updated by preparation. Preparation does not authorize publication.
 
 How any project — human-driven or agent-driven — adopts this HTML-first design system, and how to take updates safely. Published on Storybook **Docs** at `design.cyberskill.world`.
 

package/docs/contrast-report.md

@@ -1,6 +1,6 @@
 # Contrast report — elemental pairings (APCA)
 
-Generated · sweep at VERSION 2.5.0.
+Generated · sweep at VERSION 2.7.0.
 
 Published on Storybook **Docs** at `design.cyberskill.world`.
 

package/docs/conventions.md

@@ -78,7 +78,7 @@ only for HTML element content, never URL, attribute, CSS or script contexts.
 
 **New element variant** — stay inside the element's oklch envelope; set the 10 `--cs-accent-*` contract tokens (incl. `--cs-accent-on-strong` ≥4.5:1 and body APCA75 on `-strong`) plus `--cs-color-text-accent`/`--cs-color-link` (APCA-check both); the aurora wash inherits from the element via `.cs-aurora-wash` (override the class rule only if the variant truly needs its own image); gradient partner (`grad-b`) must follow Tương sinh.
 
-**Ship check** — follow the portable verification gate in `docs/doctrine.md`, then run `_audit/docs-consistency.html` **and** `_audit/namespace-portability.html` (both must be green). source checkout VERSION **<!-- cs-source-version:checkout -->2.5.0<!-- /cs-source-version -->**.
+**Ship check** — follow the portable verification gate in `docs/doctrine.md`, then run `_audit/docs-consistency.html` **and** `_audit/namespace-portability.html` (both must be green). source checkout VERSION **<!-- cs-source-version:checkout -->2.7.0<!-- /cs-source-version -->**.
 
 ## Decision log (owner-approved)
 

package/docs/guideline-language.md

@@ -1,6 +1,6 @@
 # Vietnamese-first guideline views
 
-Authored guidelines under `guidelines/` open in Vietnamese. Every guideline also exposes its original English view through `?language=en`; `?lang=en` is an alias. The existing page path and `#fragment` bookmark remain valid. Use `?language=vi` for an explicit Vietnamese view. The Arabic `rtl-preview.html` page is an intentional bidirectional diagnostic and keeps its Arabic content and direction.
+Authored guidelines under `guidelines/` open in English by default and expose their Vietnamese view through `?language=vi`; `?lang=vi` is an alias (`?language=en` / `?lang=en` explicitly selects English). The existing page path and `#fragment` bookmark remain valid. The Arabic `rtl-preview.html` page is an intentional bidirectional diagnostic and keeps its Arabic content and direction.
 
 The Language axis updates actual guideline text and accessible image descriptions. It does not merely change the document's `lang`. Atomic View applies the same choice to its guideline chrome and embedded motion guideline. Its component examples retain their declared language behavior: examples using the language parameter follow the axis, fixed English examples have an English scope, and explicit Vietnamese labels remain Vietnamese within those examples. The Japanese component spike is retained; guideline prose itself supports Vietnamese and English.
 
@@ -22,4 +22,4 @@ The bilingual rollout also supplies missing document titles and corrects concret
 
 The focused checks validate every declared source owner in both views, accessible descriptions and subtree language, the actual source compiler/CSP, keyboard focus and native language selection, nested guideline synchronization and escaped-text behavior. Browser evidence distinguishes the desktop card canvas from touch controls and wider fixed specimens. Automated copy completeness and rendering checks do not establish linguistic quality or human visual/accessibility acceptance. Vietnamese translation acceptance remains unverified until reviewed by a human.
 
-The authored English HTML retains `lang="en"` when JavaScript is disabled or the language script cannot load. The executing runtime projects the selected copy before setting the document language; the default executing view is Vietnamese.
+The authored English HTML retains `lang="en"` when JavaScript is disabled or the language script cannot load. The executing runtime projects the selected copy before setting the document language; the default executing view is English (`?language=vi` for Vietnamese).

package/docs/reference-catalog.json

@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "generator": {
     "path": "scripts/generate-reference-catalog.mjs",
-    "sha256": "be85a593b4b29f0d26e5733502f8d9e4f536e10ab015173a34f4101af11723ef"
+    "sha256": "aa248038eb8a16b6f1265c6f0d20c5efcf9f7d34dadd371570adf6829f65aae8"
   },
-  "version": "2.5.0",
+  "version": "2.7.0",
   "interpretation": "The document inventory covers Git-listed Markdown and llms.txt; HTML count surfaces are tracked separately. Audience follows the website publication policy, not npm membership. Source paths locate repository evidence and need not all be packaged. Roles describe source routing and audience, not approval, factual freshness of every sentence, translation quality or capability certification.",
   "countScope": "Counts describe declared inventory only. Declared language/theme/boolean controls are inventory facts, not proof of complete content, working behavior or every supported state; token declarations and typed base values are distinct counts.",
   "counts": {
@@ -18,7 +18,7 @@
     "componentSourceFiles": 107,
     "coExports": 18,
     "cards": 58,
-    "publicTokenDeclarations": 397,
+    "publicTokenDeclarations": 391,
     "typedBaseTokens": 197,
     "templatesWithLanguageControl": 44,
     "templatesWithoutLanguageControl": 41,
@@ -29,8 +29,8 @@
   },
   "sourceHashes": {
     "_audit/visual-diff.html": "fd344cf31f0aa4130dddec2a99dca5ef60d9d08025b5dc2b4b729a1d388c5bb8",
-    "_ds_manifest.json": "8f7b007bfb71572e3846ba9540fce7f104ea146a476100723c62c4b7a42e8a0e",
-    "scripts/public-site-policy.json": "69ec241ac1a63cc5d90c5a40a3925e39ef58dfc79907bf5cb87d1024e1d0de1f",
+    "_ds_manifest.json": "c095c233237f4ddb574f8fa648c26aee699df2c16d08f7e4a3aeca076a6644e4",
+    "scripts/public-site-policy.json": "8304a323a8b4cb7d8e571694086975cf88697c220416149ff156568ea7d80942",
     "templates/app-shell/AppShell.dc.html": "f71017a26f12b71d9e653dff79635ed14d5eb4a3dac9c5ce095188c537b858e3",
     "templates/article/Article.dc.html": "9b2ed3af604ac9e552f33bc922ec7dd2659b786dcb624cb491f7a437658adb2f",
     "templates/auth/Auth.dc.html": "ab6fb52740dbda804c9963cd2b63aa7d482c4b3cd2fa87b9a7f0c20ab2ef1e64",
@@ -116,7 +116,7 @@
     "templates/vn-total-rewards-appendix/VnTotalRewardsAppendix.dc.html": "ee941a6d26aa525bba779015ca01f4bdb7246571db2c3558499d7bc2fee3c2aa",
     "templates/vn-training-commitment/VnTrainingCommitment.dc.html": "49b2b4459bf2a900ddfafe679b6f3b088c78a31f611ae76dc3ac276e05a14c46",
     "templates/vn-travel-expense-policy/VnTravelExpensePolicy.dc.html": "1e585bd53ec6fb41322082bddfb7eed4ac811bfabb1ad2d639b9babba6c0e212",
-    "tokens/tokens.dtcg.json": "8a579cb34ed0d7704e3e52afd05752416c04070f36a10512a8883e1342c05d92"
+    "tokens/tokens.dtcg.json": "b4153c57be60838cdac8ffd616d17dce18d156713b41c68ce69380a91daa4f60"
   },
   "documents": [
     {
@@ -129,7 +129,7 @@
       "path": "DESIGN.md",
       "audience": "documentation",
       "role": "generated_reference",
-      "sha256": "cc8ef826b5fa8a124e1e65266981c03c76f919383fdf819ffd4d2e814c7f1653"
+      "sha256": "f88afeb191a52e4c533d80a5dfc4be7fa7c355318e3cc91ec48f50c5f1676ddc"
     },
     {
       "path": "MAINTAINERS.md",
@@ -141,13 +141,13 @@
       "path": "README.md",
       "audience": "documentation",
       "role": "human_orientation",
-      "sha256": "ab3cf97c894e6f1c36db6cbeffecfca1572e4261fcfe9c43d12d654df7c311c4"
+      "sha256": "016c0a00cf7d3b7fa4a34d64a61bb2b31f43b87b6db9db37dc69631a631630ef"
     },
     {
       "path": "SECURITY.md",
       "audience": "documentation",
       "role": "security_reporting_policy",
-      "sha256": "de01aa640e513f3fd27b6b82069f1ffdf22da832845fb15f94d9a89236e298ca"
+      "sha256": "2e23f78656659560a32152fa3604d38ba0de85d4430d3a64776373e2646c62d9"
     },
     {
       "path": "SKILL.md",
@@ -165,7 +165,7 @@
       "path": "_audit/README.md",
       "audience": "diagnostics",
       "role": "diagnostic_operator_guide",
-      "sha256": "ca5f1c15c56b8c887954cdf28f43661c7fccb8522f6542ac72b97e582e265f34"
+      "sha256": "fd79f61c852dccb164f4fb8ceceafc8aba6d1d58aaa0521786cedd07ad5f792e"
     },
     {
       "path": "_audit/baselines/README.md",
@@ -851,6 +851,12 @@
       "role": "implementation_contract",
       "sha256": "a3c47b7f0b10b52f20e77b3b08f488bb105a7f1d81d9609dec5d0b08ea499b30"
     },
+    {
+      "path": "docs/UPSTREAM.md",
+      "audience": "documentation",
+      "role": "operator_guide",
+      "sha256": "fffa842f9062f0e2c9ad28295a8d1d94c123a87563fc0f2b48b8f286a5cefbfe"
+    },
     {
       "path": "docs/benchmark-rubric.md",
       "audience": "documentation",
@@ -909,19 +915,19 @@
       "path": "docs/consuming.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "1a98d56a2a311935686690dbc06a5793f6e2234825adf760e8ce00f6ad4dfb02"
+      "sha256": "ebd56f715cf9733c76ec737127fe4a11d4f5c45f8813996f3a6910c32a9e3b92"
     },
     {
       "path": "docs/contrast-report.md",
       "audience": "documentation",
       "role": "generated_measurement",
-      "sha256": "0c41d6f852296e248ec5ab83f3475d234f4e1b276a365d311d0a8b44374cecf5"
+      "sha256": "5cf59c0a380511b32fa206c88b256749f93f4d57e682a37636613910f14f3327"
     },
     {
       "path": "docs/conventions.md",
       "audience": "documentation",
       "role": "normative_repository_contract",
-      "sha256": "a5245168771ba6b7e45969f78ee6597374809ab7616c358c3e5babcf9f271a07"
+      "sha256": "bb494bba54c26131a4422297a8e7be4579601f27d0303f51ff4238ec14d3065d"
     },
     {
       "path": "docs/decisions.md",
@@ -999,7 +1005,7 @@
       "path": "docs/guideline-language.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "e70bd68f0b21ae5d8290ec4dd31760df09516e0198a8c320992c266bea604c32"
+      "sha256": "49fc7c9cc12984a8b327ef4a39709216a1b6db579d3c5a5f20d86a8a320ecdef"
     },
     {
       "path": "docs/hr-suite-sources.md",
@@ -1059,7 +1065,7 @@
       "path": "docs/release-notes.md",
       "audience": "documentation",
       "role": "release_history",
-      "sha256": "b65896874c8757e12fa5a4b75aaf429ba03f709e9dce589c1da914fdbdf5cd11"
+      "sha256": "8ac0a48cafbf4dc6f90e5d4a3857c45abe02e01820904820c7a964bc2ebd53be"
     },
     {
       "path": "docs/releasing.md",
@@ -1077,7 +1083,7 @@
       "path": "docs/static-html-reference.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "5124bd199ed5fb03fdda0e99812edd4d07698df471e80d858bfe217e7bf48e2b"
+      "sha256": "cef90b096e60115ee212b9320fce6ece9ce6ee595ae612702a950af44a351a7f"
     },
     {
       "path": "docs/storybook.md",
@@ -1127,6 +1133,12 @@
       "role": "operator_guide",
       "sha256": "606deedb88ed3c424fbdc6f380560c2b55791eb6e2bbd94310e0650ef05e9cb0"
     },
+    {
+      "path": "docs/vi/UPSTREAM.md",
+      "audience": "documentation",
+      "role": "operator_guide",
+      "sha256": "17ebb63b9e32f7e24eaa13a3eee4cf3e6938281f13fd1045ee5e3b545d822416"
+    },
     {
       "path": "docs/vi/benchmark-rubric.md",
       "audience": "documentation",
@@ -1185,19 +1197,19 @@
       "path": "docs/vi/consuming.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "fa6afa6830ba9522f445e1f99e080db072adbd1225153d3a42d22f0db64208a9"
+      "sha256": "8d721e7cf114f23a3c70255d4d1bfde15f8cc4c5d1c77a6502e8d1cc8b40b4c4"
     },
     {
       "path": "docs/vi/contrast-report.md",
       "audience": "documentation",
       "role": "generated_measurement",
-      "sha256": "8ccf4fe711ade57c9fd0b3bae7fa00f00e14dd46ff60f506bd84e9628da695f1"
+      "sha256": "41806216a83fe8e0b8687da9713b37b6313c59dd9341838d03fdcdcce17664da"
     },
     {
       "path": "docs/vi/conventions.md",
       "audience": "documentation",
       "role": "normative_repository_contract",
-      "sha256": "e972af056f421a1112fe152cfb20a9ebd2ea42008a44fb1ed9b13013d09ba33e"
+      "sha256": "2529f115c0005c93454725622ce3a4cb9741a47c0de7e97225b05d140725d70e"
     },
     {
       "path": "docs/vi/decisions.md",
@@ -1233,13 +1245,13 @@
       "path": "docs/vi/entrypoints/DESIGN.md",
       "audience": "documentation",
       "role": "generated_reference",
-      "sha256": "cf189c0e5c4cbe2d5170f5fecc559232171c36cb65cff1591c894538577c5150"
+      "sha256": "6519df4793eda7bd30e9ce5b710acac929fd0c3ff68545c9bc8aa7b3ecb51a12"
     },
     {
       "path": "docs/vi/entrypoints/README.md",
       "audience": "documentation",
       "role": "human_orientation",
-      "sha256": "5acf4f20e3d00a938280c9a8e4c8d61ba4aa5c551b8625bbeeab1fe3ebf5f9ee"
+      "sha256": "6e1cdc6bad1469a1a6e92a71ca20cc7f4d00cea5b59b55e3f18acd3b72d9bf56"
     },
     {
       "path": "docs/vi/entrypoints/SKILL.md",
@@ -1275,7 +1287,7 @@
       "path": "docs/vi/guideline-language.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "7c02ae328c4c3475b3eed5e317f79d316c5c8986ebd69e718594c2b19b773963"
+      "sha256": "b58ce8c9b32d8e28e4da0e3f77f4715a146a5b4fc780b2579ed2459ed03605e1"
     },
     {
       "path": "docs/vi/hr-suite-sources.md",
@@ -1335,7 +1347,7 @@
       "path": "docs/vi/release-notes.md",
       "audience": "documentation",
       "role": "release_history",
-      "sha256": "0e193873ad1b7041970f5b572bc1494b0b483517ece67d08bd99d78e80027b9b"
+      "sha256": "45cea0f4ab49d07075039dfbace08ae3d60e9815f16bc31bb0f24e7d32105e39"
     },
     {
       "path": "docs/vi/releasing.md",
@@ -1353,7 +1365,7 @@
       "path": "docs/vi/static-html-reference.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "41839ff7461cf45979bc5f30aef28b62ab621c8eeca8c0b4ec6c3d8f4344697b"
+      "sha256": "9d84bad41c18955fc2b77c66ce278283878422ce34b44e963c4c7c18adb40c87"
     },
     {
       "path": "docs/vi/storybook.md",

package/docs/release-notes.md

@@ -1,6 +1,6 @@
 # Release Notes
 
-Curated product highlights for operators. This is **not** a git log and **not** a `CHANGELOG.md` — the design system does not maintain a changelog file. source checkout VERSION **<!-- cs-source-version:checkout -->2.5.0<!-- /cs-source-version -->** identifies the repository version. This page supplies Storybook **Release Notes**; local edits do not establish what is deployed at `design.cyberskill.world`.
+Curated product highlights for operators. This is **not** a git log and **not** a `CHANGELOG.md` — the design system does not maintain a changelog file. source checkout VERSION **<!-- cs-source-version:checkout -->2.7.0<!-- /cs-source-version -->** identifies the repository version. This page supplies Storybook **Release Notes**; local edits do not establish what is deployed at `design.cyberskill.world`.
 
 ## Unreleased revision — local implementation, acceptance pending
 
@@ -28,6 +28,30 @@ These changes belong to the current revision working tree. They are not a publis
 
 Release remains pending human visual acceptance, required native/manual assistive-technology checks, provenance decisions, and acceptance of changed pilot artifacts. Changed support evidence requires fresh review in `components/lifecycle.json`. EN/VI is the intended language scope; Japanese remains a partial spike. No support expansion, deprecation or removal is authorized by this note.
 
+## Release — `@cyberskill/design@2.6.0`
+
+Published stable minor release recorded in `_audit/ci/fixtures/npm-published-release.json` (observed `2026-11-09T17:39:34.494Z`, tag `v2.6.0` at commit `48ed4be40e83bc6d5e2763b03111b07aa2c26df4`).
+
+- **10-Dimension Benchmark & Automated CI Non-Regression Gate (`audit/v2.5.0-verification.html`, `audit/verify-v2.5.0.js`, `audit/fixture-v2.5.0.html`, `_audit/ci/verify-audit-benchmarks-browser.mjs`):** Expands the live browser audit to **10 dimensions (`69/69` checks at `10.0 / 10`, `0 watch` items)** adding `D8` (Touch Targets ≥ 44px, Focus Ring Integrity, High-Contrast Mode), `D9` (5-Element × 2-Theme × 3-Variant Token Completeness, Print/A4 Sheet Integrity, Reduced Motion), and `D10` (Brand Identity, Bilingual EN/VI Completeness, Token Purity), enforced in CI and `prepublishOnly` via `npm run test:audit-regression`.
+- **Single-File Flattened CSS Export & Inline Logo Guidance (`package.json`, `scripts/flatten-css.mjs`, `DESIGN.md`, `docs/vi/entrypoints/DESIGN.md`):** Exposes `"./dist/styles.css": "./dist/styles.css"` in `package.json#exports`, derives the `dist/styles.css` header banner dynamically from `VERSION`, and documents the canonical `<svg viewBox="0 0 64 64">` inline logo pattern for single-file and cloud sandbox runtimes.
+- **Fast Commit-Bound `act` Shard Attestation (`.github/workflows/design-system-gates.yml`, `scripts/run-act-ci.mjs`, `scripts/verify-ci-checks.mjs`):** Verifies commit-bound local `ci/act/unit-tests (1/4..4/4)` receipts ahead of heavy dependency and browser installation steps, cutting GitHub Actions `unit-tests` runtime to ~15 seconds when pre-verified via `act`.
+
+```bash
+npm install @cyberskill/design@2.6.0
+```
+
+## Release — `@cyberskill/design@2.5.0`
+
+Published stable minor release recorded in `_audit/ci/fixtures/npm-published-release.json` (observed `2026-11-09T06:04:11.249Z`, tag `v2.5.0` at commit `6e7fe3c158b122c8ca19b8253eb06460c7f2f919`). Subsequent repository tags `v2.3.1` and `v2.4.0` preceded `v2.5.0`.
+
+- **Scoped Nested Theme & Liquid Glass Parity (`base/glass.css`, `tokens/theme-dark.css`):** Re-computes `--_cs-light` / `--_cs-dark` space-toggle tokens, `--_cs-surface-scrim`, and all eight `--cs-glass-*-{bg,border}` materials inside nested `[data-theme]` scopes.
+- **32-Scope Contrast & Dark Default Tint Safety (`base/collections.css`, `base/controls.css`, `base/feedback.css`, `base/shell.css`, `base/ai.css`):** Replaces un-scoped `--cs-accent-tint` dark backgrounds with `color-mix(in oklab, var(--cs-accent) 18%, var(--cs-color-surface-panel))`, upgrades non-text indicators to `--cs-color-text-accent` (`WCAG 1.4.11 ≥ 3:1` across all 32 scopes), and adds inset perimeter rings for dark Umber surfaces.
+- **13-Control Invalid State & Vietnamese Typography Clearance (`base/components.css`, `base/controls.css`, `base/typography.css`, `base/data.css`):** Unifies `.is-invalid` / `[aria-invalid="true"]` danger borders across all 13 form controls and applies `:lang(vi) { line-height: 1.22; }` to `.cs-display` and `.cs-stat__value`.
+
+```bash
+npm install @cyberskill/design@2.5.0
+```
+
 ## Release — `@cyberskill/design@2.3.0`
 
 Published stable minor release recorded in `_audit/ci/fixtures/npm-published-release.json` (observed `2026-11-06T03:56:00.000Z`, tag `v2.3.0` at commit `1f873e812e9a02ec68bbc49c3b7ae3248a165ac9`).