Monorepo Stabilization (2026-05-14 → 2026-06-04)

Lean log of an 11-cycle stabilization pass. The task began as a deep review and turned into fixing a wave of drift where prior agents optimized local metrics (test counts, CSP scores, lint) without verifying the deployed user experience. All fixes are committed locally and deployed live via web-deploy.

Root pattern

Agents optimized a proxy metric, not the deployed page. None of the regressions below were caught by any test, because the E2E suite runs against astro dev, which does not apply public/_headers (CSP) or serve a production build.

Fixes (all committed + deployed live)

Issue	Root cause	Fix
`/components` dark + dead in prod	CSP missing `'unsafe-eval'` (regressed in `e96e163`) → Alpine dead	Restored `'unsafe-eval'` on template + mbr (sdc/ts have no Alpine directives → kept strict)
Homepage lost content + dead buttons	`56de2d0` replaced redirect-to-/docs homepage with a thin hero; `Button` ignored `href`	Rebuilt homepage (Option B); `Button` renders `<a>` for href + `btn` marker class
Brand Assets card wrong logos	Used deprecated `Logo`/`TSLogo` text placeholders	Canonical `<BrandLogo>` (SD leaf-dot; TS in brand blue `#0053B3`)
mBR Snapshot calculator empty	`x-data` factory in a bundled module ran after `Alpine.start()`	Made it `is:inline` (loads during parse)
Stats grid overflow (“25+ Years…”)	`repeat(N, 1fr)` min-content overflow	`repeat(N, minmax(0, 1fr))`
Small grey “blobs” everywhere	Astro emits stray empty `<code></code>` when `<code>` has literal braces	HTML-entity-encode braces (`{`/`}`)
Dark-mode wordmark contrast	mBR brand green too dark on dark (~1.95:1)	`[data-theme='dark']` override → `#3fc46e`
mBR favicon halo not on template	SSOT updated, template copies stale	Synced from `src/brand/mbr/favicons/`; static mask id
CI flakiness / perf	25 external Unsplash/picsum demo images	Localized to `/demo` SVG placeholders; video `preload="none"`

Guardrail added

Deploy-preview gate — cd sites/template && pnpm test:deploy-gate. Builds + serves dist/ via wrangler pages dev (so _headers/CSP apply) and asserts zero page/console errors, failed same-origin requests, and stray empty styled inline elements (“grey blobs”). Proven to fail when 'unsafe-eval' is removed. Run before every web-deploy.

Decisions

mbr / sdc are intentionally light-only (financial sites; matches ts). Template showcase keeps dark mode. (CLAUDE.md.)
Repo is local-only — never pushed to GitHub (privacy); backed up by the local backup system. So CI + the pre-push hook never run; the operative guardrail is the local deploy-gate. The GitHub Actions deploy-gate job was removed (inert).

Dropped (per Talbot)

D4 — modal:33 + form-fields:325 pre-existing interaction-test failures.
D6 — replacing 153 networkidle waits. Its justification (unblock push) is moot in a local-only repo; only adds noise to manual /test-all.

Key references

Repo CHANGELOG.md (Unreleased) and LESSONS.md carry the durable detail.
Lessons: CSP needs unsafe-eval; astro preview ≠ production; verify deployed UX not the metric; SSOT for brand assets; grid minmax(0,1fr); lazy-embed facade; literal braces in <code> → empty-tag blobs.