Pilots A+B: comparison column was rendering in body ink (specificity) - #564

…nc (#565)

Board carries the three live /next/ URLs, the four-persona ballots with
self-objections, the Editorial 4-1 artifact head-to-head, the fable
recommendation with its graft package, and the decision protocol - Paul
picks. Ledger rows updated for #561-#564 and the #560 gate repair; OKF
gains the BASE_URL local-production-check rule.


Claude-Session: https://claude.ai/code/session_011SP5gaqXEgUie8pdFrmbeJ

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Gate fault-injection audit: 3 of 8 defects caught

Injected eight defects modelled on ones this repo has shipped, one at a
time, each followed by the narrowest gate that should catch it. Predictions
were written before any run; two were wrong and both are recorded as wrong.

Caught: above-fold contrast (A), smoothed testimonial (C), lost noindex (E).
Missed: below-fold visual (B), frozen tenure (D), banned phrase (F), the
<th> purge trap (G), broken internal link (H).

Two findings the predictions did not anticipate:

- test:links checks almost nothing. The production build renders internal
  links absolute, and lychee --offline excludes all http(s) URIs, so 133,874
  of 149,516 links are excluded; the homepage checks exactly one link, its
  own #main-content anchor. A --remap of the host onto the build dir was
  verified to catch the planted break.
- MarketingCopyTest's rendered ratchet has three hits of slack (baseline 14,
  actual 11), which is what let the injected banned phrase through.

Below-fold coverage quantified for task #12: the viewport-sized capture gates
28.3% of the editorial pilot (1080px of 3822px). The injected #564-class
defect sits at y=1090 - ten pixels outside the frame.

No baselines re-recorded; every injection reverted.


Claude-Session: https://claude.ai/code/session_011SP5gaqXEgUie8pdFrmbeJ

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…sted

The 2026-08-22 audit planted eight defects and the suite caught three. Three of
the five misses get gates here. Every one was injected, watched fail, reverted
and watched pass - green alone proves a test runs, not that it works.

D - a frozen tenure number. The rendered assertion cannot tell `derived` from
`frozen` while both read "18+" in 2026, and saying so in the test body is
honest but guards nothing. The freeze is plainly visible one layer down, so
NextRailTest now asserts both halves: the rendered value, and that every pilot
stub carries `derived: tenure` with no stat frozen at today's derived string.
Not a config test - the hardcoded literal IS the defect class, the way the
2026-08-14 canon audit found the founding year wrong in eight places because
each kept its own copy.

G - the PurgeCSS trap the audit called unguardable. It is unguardable by the
VISUAL gate, which builds production and so purges exactly as production does,
matching its own baseline. It is trivially visible to a set diff: styled in the
register's source CSS, present on an element in the rendered HTML, absent from
the bundle the page links. next_purge_guard_test.rb is keyed on that mechanism
rather than on `th`, so the next element type Hugo stops recording is covered
without an edit, and it reads the bundle from the page's own href - stale
fingerprinted bundles sit in the same directory.

B and the contrast hole - computed styles, not per-band screenshots. The
audit's own recommendation buys four more baselines per pilot, each needing its
noise floor measured on the platform that judges it, and still returns a pixel
delta rather than a ratio - so an intentional recolour and an AA regression stay
indistinguishable. next_pilot_contrast_test.rb asserts the comparison table's
"theirs" column computes the register's own --*-muted token, then walks every
visible text run for 4.5:1 (3:1 large, SC 1.4.3) and every control fill for 3:1
against its surround (SC 1.4.11). ~1.3s for three pages, no baselines, wired
into test:critical. It closes the hole the audit flagged separately: nothing in
this suite measured contrast as a number, and a 3.33:1 black-on-ruby button
shipped this rail on human review alone.

One mistake worth keeping. The muted-column assertion was first written as
"differs from the sibling cell and from body colour" and PASSED the exact #564
injection - in that register the "ours" column IS body colour and the injected
ink is a third value. Wrong for two runs, green both times; only the injection
said so.

Injections and failures, all reverted before the next:

  D  `derived: tenure` -> `value: "18+"`
     the tenure stat must be `derived: tenure` so layouts/next/landing.html
     computes it from site.Params.foundingYear
  D  a second stat frozen at "18+" alongside the derived one
     Expected ["Years of average developer experience"] to be empty
  G  class="rr-th-theirs" on a <th> + a matching rule
     Expected ["rr-th-theirs"] to be empty
     control: the SAME class moved onto the <td> in that row goes green, so it
     flags the purge and not merely a new class
  B  .rr-td-muted -> var(--ed-ink), below the fold
     computes rgb(27, 28, 28), not --ed-muted (rgb(107, 101, 96)).
     It resolves to --ed-ink
  A  .rr-btn-primary label -> var(--ed-ink) on the accent fill
     2.31:1 (needs 4.5:1) text a.rr-btn.rr-btn-primary
  A' .rr-td-muted -> #b5b0ab, below the fold - invisible to every screenshot
     2.15:1 (needs 4.5:1) on five cells
  A" a near-paper button fill with a readable label
     1.12:1 (needs 3.0:1) fill a.rr-btn.rr-btn-primary

Each walk asserts it measured something (>50 text pairs, >0 fills, a non-empty
styled-and-rendered set) - a walk that finds nothing is empty, and empty passes.

Gates: test:unit 289 runs / 6187 assertions / 0 failures in 1.42s (287 / 6143 /
1.33s before - the purge guard reuses the build the suite already makes);
test:critical 38 runs / 0 failures, 55 screenshots compared, no failures, no
baseline rewritten; bin/hugo-build clean; standardrb clean on the new files.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011SP5gaqXEgUie8pdFrmbeJ

Close three fault-injection gaps: 8 of 8, each gate broken before trusted

The 2026-08-22 audit planted eight defects and the suite caught three. Three of
the five misses get gates here. Every one was injected, watched fail, reverted
and watched pass - green alone proves a test runs, not that it works.

D - a frozen tenure number. The rendered assertion cannot tell `derived` from
`frozen` while both read "18+" in 2026, and saying so in the test body is
honest but guards nothing. The freeze is plainly visible one layer down, so
NextRailTest now asserts both halves: the rendered value, and that every pilot
stub carries `derived: tenure` with no stat frozen at today's derived string.
Not a config test - the hardcoded literal IS the defect class, the way the
2026-08-14 canon audit found the founding year wrong in eight places because
each kept its own copy.

G - the PurgeCSS trap the audit called unguardable. It is unguardable by the
VISUAL gate, which builds production and so purges exactly as production does,
matching its own baseline. It is trivially visible to a set diff: styled in the
register's source CSS, present on an element in the rendered HTML, absent from
the bundle the page links. next_purge_guard_test.rb is keyed on that mechanism
rather than on `th`, so the next element type Hugo stops recording is covered
without an edit, and it reads the bundle from the page's own href - stale
fingerprinted bundles sit in the same directory.

B and the contrast hole - computed styles, not per-band screenshots. The
audit's own recommendation buys four more baselines per pilot, each needing its
noise floor measured on the platform that judges it, and still returns a pixel
delta rather than a ratio - so an intentional recolour and an AA regression stay
indistinguishable. next_pilot_contrast_test.rb asserts the comparison table's
"theirs" column computes the register's own --*-muted token, then walks every
visible text run for 4.5:1 (3:1 large, SC 1.4.3) and every control fill for 3:1
against its surround (SC 1.4.11). ~1.3s for three pages, no baselines, wired
into test:critical. It closes the hole the audit flagged separately: nothing in
this suite measured contrast as a number, and a 3.33:1 black-on-ruby button
shipped this rail on human review alone.

One mistake worth keeping. The muted-column assertion was first written as
"differs from the sibling cell and from body colour" and PASSED the exact #564
injection - in that register the "ours" column IS body colour and the injected
ink is a third value. Wrong for two runs, green both times; only the injection
said so.

Injections and failures, all reverted before the next:

  D  `derived: tenure` -> `value: "18+"`
     the tenure stat must be `derived: tenure` so layouts/next/landing.html
     computes it from site.Params.foundingYear
  D  a second stat frozen at "18+" alongside the derived one
     Expected ["Years of average developer experience"] to be empty
  G  class="rr-th-theirs" on a <th> + a matching rule
     Expected ["rr-th-theirs"] to be empty
     control: the SAME class moved onto the <td> in that row goes green, so it
     flags the purge and not merely a new class
  B  .rr-td-muted -> var(--ed-ink), below the fold
     computes rgb(27, 28, 28), not --ed-muted (rgb(107, 101, 96)).
     It resolves to --ed-ink
  A  .rr-btn-primary label -> var(--ed-ink) on the accent fill
     2.31:1 (needs 4.5:1) text a.rr-btn.rr-btn-primary
  A' .rr-td-muted -> #b5b0ab, below the fold - invisible to every screenshot
     2.15:1 (needs 4.5:1) on five cells
  A" a near-paper button fill with a readable label
     1.12:1 (needs 3.0:1) fill a.rr-btn.rr-btn-primary

Each walk asserts it measured something (>50 text pairs, >0 fills, a non-empty
styled-and-rendered set) - a walk that finds nothing is empty, and empty passes.

Gates: test:unit 289 runs / 6187 assertions / 0 failures in 1.42s (287 / 6143 /
1.33s before - the purge guard reuses the build the suite already makes);
test:critical 38 runs / 0 failures, 55 screenshots compared, no failures, no
baseline rewritten; bin/hugo-build clean; standardrb clean on the new files.


Claude-Session: https://claude.ai/code/session_011SP5gaqXEgUie8pdFrmbeJ

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>