Close the three fault-injection gaps: 8 of 8 - #576

…sted

The 2026-08-22 audit planted eight defects and the suite caught three. Three of
the five misses get gates here. Every one was injected, watched fail, reverted
and watched pass - green alone proves a test runs, not that it works.

D - a frozen tenure number. The rendered assertion cannot tell `derived` from
`frozen` while both read "18+" in 2026, and saying so in the test body is
honest but guards nothing. The freeze is plainly visible one layer down, so
NextRailTest now asserts both halves: the rendered value, and that every pilot
stub carries `derived: tenure` with no stat frozen at today's derived string.
Not a config test - the hardcoded literal IS the defect class, the way the
2026-08-14 canon audit found the founding year wrong in eight places because
each kept its own copy.

G - the PurgeCSS trap the audit called unguardable. It is unguardable by the
VISUAL gate, which builds production and so purges exactly as production does,
matching its own baseline. It is trivially visible to a set diff: styled in the
register's source CSS, present on an element in the rendered HTML, absent from
the bundle the page links. next_purge_guard_test.rb is keyed on that mechanism
rather than on `th`, so the next element type Hugo stops recording is covered
without an edit, and it reads the bundle from the page's own href - stale
fingerprinted bundles sit in the same directory.

B and the contrast hole - computed styles, not per-band screenshots. The
audit's own recommendation buys four more baselines per pilot, each needing its
noise floor measured on the platform that judges it, and still returns a pixel
delta rather than a ratio - so an intentional recolour and an AA regression stay
indistinguishable. next_pilot_contrast_test.rb asserts the comparison table's
"theirs" column computes the register's own --*-muted token, then walks every
visible text run for 4.5:1 (3:1 large, SC 1.4.3) and every control fill for 3:1
against its surround (SC 1.4.11). ~1.3s for three pages, no baselines, wired
into test:critical. It closes the hole the audit flagged separately: nothing in
this suite measured contrast as a number, and a 3.33:1 black-on-ruby button
shipped this rail on human review alone.

One mistake worth keeping. The muted-column assertion was first written as
"differs from the sibling cell and from body colour" and PASSED the exact #564
injection - in that register the "ours" column IS body colour and the injected
ink is a third value. Wrong for two runs, green both times; only the injection
said so.

Injections and failures, all reverted before the next:

  D  `derived: tenure` -> `value: "18+"`
     the tenure stat must be `derived: tenure` so layouts/next/landing.html
     computes it from site.Params.foundingYear
  D  a second stat frozen at "18+" alongside the derived one
     Expected ["Years of average developer experience"] to be empty
  G  class="rr-th-theirs" on a <th> + a matching rule
     Expected ["rr-th-theirs"] to be empty
     control: the SAME class moved onto the <td> in that row goes green, so it
     flags the purge and not merely a new class
  B  .rr-td-muted -> var(--ed-ink), below the fold
     computes rgb(27, 28, 28), not --ed-muted (rgb(107, 101, 96)).
     It resolves to --ed-ink
  A  .rr-btn-primary label -> var(--ed-ink) on the accent fill
     2.31:1 (needs 4.5:1) text a.rr-btn.rr-btn-primary
  A' .rr-td-muted -> #b5b0ab, below the fold - invisible to every screenshot
     2.15:1 (needs 4.5:1) on five cells
  A" a near-paper button fill with a readable label
     1.12:1 (needs 3.0:1) fill a.rr-btn.rr-btn-primary

Each walk asserts it measured something (>50 text pairs, >0 fills, a non-empty
styled-and-rendered set) - a walk that finds nothing is empty, and empty passes.

Gates: test:unit 289 runs / 6187 assertions / 0 failures in 1.42s (287 / 6143 /
1.33s before - the purge guard reuses the build the suite already makes);
test:critical 38 runs / 0 failures, 55 screenshots compared, no failures, no
baseline rewritten; bin/hugo-build clean; standardrb clean on the new files.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011SP5gaqXEgUie8pdFrmbeJ