/* =========================================================
   Delegee Shield — shared layout chrome.
   Used by: all pages (dashboard, upload, review, auth, landing).
   Depends on: tokens.css (must be imported first).
   ========================================================= */

* { box-sizing: border-box; }
html, body { margin: 0; padding: 0; min-height: 100%; }
body {
  background: var(--bg);
  color: var(--fg);
  font-family: var(--font-sans);
  font-size: var(--fs-body);
  line-height: var(--lh-body);
  -webkit-font-smoothing: antialiased;
}
a { color: inherit; text-decoration: none; }
button { font: inherit; }

/* ===== Scrollbars — one canonical treatment, every surface =====
   Was five ad-hoc declarations across dashboard-v2 / review-v2 /
   reconcile, at three different widths and two mechanisms; a couple set
   `scrollbar-width: thin` with no colour and fell back to UA dark.
   The 3.5px transparent border + background-clip insets the thumb, so
   the visible pill is ~5px with breathing room in a 12px gutter rather
   than a bar jammed against the edge.
   Colour comes from tokens (--scrollbar-thumb), so dark mode follows.

   The two mechanisms are MUTUALLY EXCLUSIVE, not complementary: Chrome
   ≥121 supports the standard properties, and the moment a non-auto
   scrollbar-width/scrollbar-color applies to an element it DISCARDS that
   element's ::-webkit-scrollbar styling. Worse, scrollbar-color inherits
   but scrollbar-width does not — so a root-level pair silently gave
   nested panes the default 15px bar (colour inherited, pseudos killed,
   width not inherited) while the page bar was 11px. Hence @supports:
   WebKit/Blink get the pseudos and full geometry control; Firefox, which
   has no such pseudo-element, gets the standard properties instead. */
::-webkit-scrollbar { width: 12px; height: 12px; }
::-webkit-scrollbar-track { background: transparent; }
::-webkit-scrollbar-thumb {
  background-color: var(--scrollbar-thumb);
  border-radius: 99px;
  border: 3.5px solid transparent;
  background-clip: content-box;
}
::-webkit-scrollbar-thumb:hover { background-color: var(--scrollbar-thumb-hover); }
::-webkit-scrollbar-corner { background: transparent; }

/* Firefox only (no ::-webkit-scrollbar). `*` rather than `html` because
   scrollbar-width does not inherit; harmless here since there are no
   pseudos to discard on this engine. Component opt-outs still win on
   specificity (`.input-tabs { scrollbar-width: none }`). */
@supports not selector(::-webkit-scrollbar) {
  * {
    scrollbar-width: thin;
    scrollbar-color: var(--scrollbar-thumb) transparent;
  }
}

/* ===== App shell ===== */
.app-shell { min-height: 100vh; display: flex; flex-direction: column; }

/* Sticky-footer pattern (2026-05-09): main grows to fill the available
   space inside the flex column, so the site-footer naturally sits at
   the bottom when content is short — but never floats above the
   viewport edge when content is long (no fixed positioning, just
   flex-grow). The footers stay AFTER main in the DOM, in normal flow. */
main { flex: 1 1 auto; }

/* ===== v2 shell (sidebar + main) =====
   Pages opt in by overriding {% block app_body %} in base.html with an
   `.app-body` wrapper. The wrapper is a 2-column CSS grid: sidebar width
   driven by --sidebar-w (set inline by JS, persisted in localStorage),
   main column takes the rest. Pages without this wrapper keep the legacy
   single-column flow (default block). */
.app-body {
  display: grid;
  grid-template-columns: var(--sidebar-w, 320px) 1fr;
  flex: 1 1 auto;
  min-height: 0;
  position: relative;
}
.app-body.left-hidden { grid-template-columns: 0 1fr; }
@media (max-width: 900px) {
  .app-body { grid-template-columns: 1fr; }
}

.app-header {
  display: flex; align-items: center; gap: var(--sp-7);
  padding: 0 var(--sp-6);
  height: var(--header-h);
  background: var(--surface);
  border-bottom: 1px solid var(--border);
  position: sticky; top: 0; z-index: var(--z-header);
  backdrop-filter: saturate(1.2);
}
.app-header .brand {
  display: flex; align-items: center; gap: 10px;
}
.app-header .brand img {
  height: 24px; display: block;
}
/* Brand mark swaps by width: full "idonym" wordmark on desktop, compact
   "id" symbol tile on mobile (≤640px) where header space is tight. The
   `img` qualifier keeps specificity above `.app-header .brand img`. */
.app-header .brand img.brand-symbol { display: none; }
@media (max-width: 640px) {
  /* Tighter header rhythm so hamburger + mark + env-chip + avatar fit one
     row on phones (the 32px desktop gap forced the env-chip to wrap). */
  .app-header { gap: 12px; padding: 0 16px; }
  .app-header .brand img.brand-wordmark { display: none; }
  .app-header .brand img.brand-symbol { display: block; height: 34px; width: 34px; }
}

.app-header nav {
  display: flex; gap: 28px; margin-left: 40px;
  font-size: 13.5px; color: var(--fg-2);
  align-self: stretch;
}
.app-header nav a {
  padding: 0 2px;
  display: inline-flex; align-items: center;
  border-bottom: 2px solid transparent;
  transition: color var(--dur-fast) var(--ease), border-color var(--dur-fast) var(--ease);
}
.app-header nav a:hover { color: var(--fg); }
.app-header nav a.is-active {
  color: var(--navy-800);
  border-bottom-color: var(--gold-500);
  font-weight: 600;
}
[data-theme="dark"] .app-header nav a.is-active { color: var(--white); }

.app-header .spacer { flex: 1; }

/* Mobile nav hamburger (C1, 2026-07-05). Base-hidden on EVERY page; revealed
   only on shell pages (body.has-shell, set by shield_dashboard_v2.js) at ≤900px.
   The `hidden` ATTRIBUTE is intentionally NOT used so the global
   `[hidden]{display:none !important}` can't defeat the reveal. */
.nav-drawer-toggle {
  display: none;
  align-items: center;
  justify-content: center;
  width: var(--sp-8);
  height: var(--sp-8);
  padding: 0;
  background: transparent;
  border: 1px solid transparent;
  border-radius: var(--r-md);
  color: var(--fg-2);
  cursor: pointer;
}
.nav-drawer-toggle:hover { background: var(--surface-muted); color: var(--fg); }
.nav-drawer-toggle:focus-visible { outline: none; box-shadow: var(--sh-focus); }
@media (max-width: 900px) {
  body.has-shell .nav-drawer-toggle { display: inline-flex; }
}

.env-chip-wrap { /* unscoped: also a /styleguide specimen */  position: relative; display: inline-flex; flex-shrink: 0; }
.env-chip {
  font-family: var(--font-mono);
  font-size: 10.5px; letter-spacing: 0.14em; text-transform: uppercase;
  color: var(--fg-3);
  padding: 5px 10px;
  border-radius: var(--r-pill);
  border: 1px solid var(--border);
  white-space: nowrap; flex-shrink: 0;
  appearance: none; background: transparent; cursor: pointer;
  transition: border-color var(--dur-fast) var(--ease), color var(--dur-fast) var(--ease);
}
.env-chip:hover { border-color: var(--border-strong); color: var(--fg-2); }
.env-chip:focus-visible { outline: none; box-shadow: var(--sh-focus); }
.env-chip[aria-expanded="true"] { border-color: var(--border-strong); color: var(--fg-2); }
.env-chip .dot {
  display: inline-block; width: 6px; height: 6px; border-radius: 50%;
  background: var(--gold-500); margin-right: 6px; vertical-align: middle;
}
.env-chip .caret {
  display: inline-block; margin-left: 6px; font-size: 8px;
  color: var(--border-strong);
  transition: transform var(--dur-fast) var(--ease);
}
.env-chip[aria-expanded="true"] .caret { transform: rotate(180deg); }

/* Data-residency popover — a skin on the canonical .menu (D50), same idiom
   as .user-menu below. Informational card, not a menuitem list: head +
   fact rows + footer link. Anchored under the chip, right-aligned.
   Geometry selectors ride .env-chip-wrap for specificity: layout.css loads
   BEFORE menu.css, so a bare .residency-menu loses position/min-width to
   the later .menu/.menu--wide base at equal specificity. */
.env-chip-wrap .residency-menu {
  right: 0; top: calc(100% + 8px);
  width: 320px; min-width: 0;
  padding: 0;
  box-shadow: var(--sh-3);
}
/* The v3 rail's copy is body-placed (`.menu--fixed`, window.UIMenu.place sets
   top/left inline). The in-flow anchoring above must not also pin its right
   edge, or the card is over-constrained against the JS placement. */
.env-chip-wrap .residency-menu.menu--fixed { top: auto; right: auto; }
.residency-menu__head { padding: var(--sp-3) var(--sp-4) var(--sp-2); border-bottom: 1px solid var(--border); }
.residency-menu__eyebrow {
  font-family: var(--font-mono);
  font-size: var(--fs-micro); letter-spacing: var(--tracking-caps); text-transform: uppercase;
  color: var(--accent-soft-fg);
  margin-bottom: 2px;
}
.residency-menu__title {
  font-size: var(--fs-sm); font-weight: var(--fw-semibold);
  line-height: var(--lh-snug); color: var(--fg);
}
.residency-menu__rows { padding: var(--sp-1) var(--sp-4); }
.residency-menu__row {
  display: flex; justify-content: space-between; gap: var(--sp-4);
  padding: var(--sp-2) 0;
  border-bottom: 1px solid var(--bg-sunken);
  font-size: var(--fs-sm); color: var(--fg-2);
}
.residency-menu__row:last-child { border-bottom: 0; }
.residency-menu__k small { display: block; font-size: var(--fs-micro); color: var(--fg-3); margin-top: 1px; }
.residency-menu__v {
  font-family: var(--font-mono); font-size: var(--fs-xs); color: var(--fg);
  text-align: right; white-space: nowrap; padding-top: 2px;
}
.residency-menu__v--zero { color: var(--status-ok-fg); font-weight: var(--fw-bold); }
.residency-menu .menu__sep { margin: 0; }
.residency-menu__link {
  display: block; padding: var(--sp-2) var(--sp-4) var(--sp-3);
  font-size: var(--fs-xs); color: var(--fg-2);
  text-decoration: none;
  transition: color var(--dur-fast) var(--ease);
}
.residency-menu__link:hover { color: var(--fg); }
/* Phones: the chip sits mid-header, so a right-anchored 320px panel would
   run off the left edge — clamp to the viewport under the header instead
   (same position:fixed idiom as .menu--fixed). */
@media (max-width: 640px) {
  .env-chip-wrap .residency-menu {
    position: fixed;
    left: var(--sp-3); right: var(--sp-3); top: calc(var(--header-h) + var(--sp-2));
    width: auto;
  }
}

/* Avatar-anchored account dropdown (replaces the inline name+firm strip).
   Layout: a relative-positioned wrapper holds the avatar trigger and an
   absolutely-positioned menu. Toggle behavior in shield_auth.js
   (#user-menu-trigger). */
.app-header .user {
  position: relative;
  display: flex; align-items: center;
  padding-left: 20px; border-left: 1px solid var(--border);
  height: 40px;
}
.avatar { /* unscoped: also a /styleguide specimen */
  width: 36px; height: 36px; border-radius: 999px;
  background: var(--avatar-bg); color: var(--avatar-fg);
  display: grid; place-items: center;
  font-size: 12.5px; font-weight: 600; letter-spacing: 0.04em;
  font-family: var(--font-sans);
  border: 0; padding: 0; cursor: pointer;
  /* "Notarial ring": two inset shadows — a body-colored spacer, then a
     1.5px gold ring sitting 2px in from the rim. Shadow, not border, so
     the 36px box and the grid centering are unaffected. */
  box-shadow: inset 0 0 0 2px var(--avatar-bg),
              inset 0 0 0 3.5px var(--avatar-ring);
  transition: box-shadow 120ms var(--ease, ease);
}
.avatar:hover {
  box-shadow: inset 0 0 0 2px var(--avatar-bg),
              inset 0 0 0 3.5px var(--avatar-ring-hover);
}
.avatar:focus-visible {
  outline: 2px solid var(--gold-500); outline-offset: 2px;
}
/* user-menu geometry/items now come from menu.css (D50); kept here:
   anchoring under the avatar + the account-head skin. The old --white
   background had no dark override (white panel + light text in dark mode);
   the canonical --bg-raised fixes that latent bug.

   The avatar has TWO hosts since the D-refresh nav shell: the app header
   (legacy pages) and the v3 rail's `.sb-foot`. Only the ANCHORING rule stays
   header-only — the rail's copy is `.menu--fixed` and positioned by
   window.UIMenu.place. The skin rules below serve both via `:is()`, which
   keeps the (0,2,0) specificity the bare `.app-header` prefix had. */
.app-header .user-menu {
  top: calc(100% + 8px); right: 0; left: auto;
}
:is(.app-header, .sb-foot) .user-menu-head {
  padding: var(--sp-2) var(--sp-4);
}
:is(.app-header, .sb-foot) .user-menu-head .email {
  color: var(--fg-2);
  font-size: var(--fs-sm);
  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
  max-width: 240px;
}
:is(.app-header, .sb-foot) .user-menu-lang {
  display: flex; align-items: center; gap: 10px;
  padding: 8px 16px;
  font-size: 14px;
  color: var(--fg);
}
:is(.app-header, .sb-foot) .user-menu-lang__label {
  display: flex; align-items: center; gap: 10px;
  flex: 1;
}
.locale-switch--menu { margin-right: 0; }

/* "Learn more" flyout (v3 shell only — see partials/auth_bar.html).
   The host is the hover target for BOTH the trigger row and the flyout, so a
   pointer crossing the gap between them never counts as leaving. The trailing
   chevron/glyph slots mirror `.menu__item`'s own trailing-slot idiom
   (menu.css __count/__kbd) rather than minting a new item variant. */
:is(.app-header, .sb-foot) .user-menu-sub-host { position: relative; }
/* The chevron points the way the panel actually opens: sideways when it flies
   out, down when it drops inline. */
@media (max-width: 900px) {
  :is(.app-header, .sb-foot) [data-user-menu-sub-trigger][aria-expanded="true"] .user-menu-chev {
    transform: rotate(90deg);
  }
}
:is(.app-header, .sb-foot) .user-menu-chev,
:is(.app-header, .sb-foot) .user-menu-ext {
  margin-left: auto;
  flex: none;
  opacity: 0.55;
}
:is(.app-header, .sb-foot) .menu__item:hover .user-menu-chev,
:is(.app-header, .sb-foot) .menu__item:hover .user-menu-ext { opacity: 0.8; }

/* ===== Page rail ===== */
.page {
  max-width: var(--rail-wide);
  margin: 0 auto;
  padding: 48px 32px 96px;
  width: 100%; flex: 1;
}

.page.upload {
  max-width: var(--rail-wide);
  padding-top: 32px;
}

.page.review {
  max-width: var(--rail-wide);
  padding-top: 32px;
}

.page-head {
  display: flex; align-items: flex-end; justify-content: space-between;
  gap: 24px;
  margin-bottom: 40px;
}
.page-head .eyebrow-row {
  display: flex; align-items: center; gap: 12px;
  margin-bottom: 12px;
}
.page-head .path {
  font-family: var(--font-mono);
  font-size: var(--fs-micro);
  letter-spacing: 0.14em; text-transform: uppercase;
  color: var(--fg-3);
}
.page-head h1 {
  font-size: 44px;
  font-weight: 600;
  letter-spacing: -0.025em;
  line-height: 1.05;
  color: var(--fg);
  margin: 0;
}
.page-head .lede {
  margin-top: 12px;
  font-family: var(--font-serif);
  font-size: 16px;
  color: var(--fg-2);
  max-width: 560px;
  line-height: 1.5;
}

/* Eyebrow (shared small-caps mono label) */
.eyebrow {
  font-family: var(--font-mono);
  font-size: 10.5px;
  font-weight: 600;
  letter-spacing: 0.14em;
  text-transform: uppercase;
  color: var(--fg-3);
}

/* Pills */
.pill {
  display: inline-flex; align-items: center; gap: 6px;
  font-family: var(--font-mono);
  font-size: 10px; font-weight: 600;
  letter-spacing: 0.12em;
  padding: 3px 9px;
  /* Outlined tag, not a filled sticker (refresh Δ4): squared to the r-md
     step + a 1px status border — reads "document stamp". */
  border-radius: var(--r-md);
  border: 1px solid var(--border-strong);
  text-transform: uppercase;
  white-space: nowrap;
  vertical-align: middle;
}
.pill .dot { width: 5px; height: 5px; border-radius: 50%; }
.pill.done    { background: var(--status-done-bg);    color: var(--status-done-fg); border-color: var(--status-info-border); }
.pill.done    .dot { background: var(--navy-500); }
.pill.pending { background: var(--status-pending-bg); color: var(--status-pending-fg); border-color: var(--status-pending-border); }
.pill.pending .dot {
  background: var(--gold-600);
  animation: pulse 1.4s var(--ease) infinite;
}
.pill.error   { background: var(--status-error-bg); color: var(--status-error-fg); border-color: var(--status-error-border); }
.pill.error   .dot { background: var(--ent-people-mark); }
.pill.draft   { background: var(--surface-muted); color: var(--fg-3); }
.pill.draft   .dot { background: var(--fg-3); }
/* Active/in-flight state (UP-2 batch queue) — a spinning ring instead of a
   filled dot, so Uploading/Processing read as "in motion". */
.pill.running { background: var(--status-info-bg); color: var(--status-info-fg); border-color: var(--status-info-border); }
.pill.running .dot {
  width: 8px; height: 8px;
  background: transparent;
  border: 1.5px solid currentColor;
  border-top-color: transparent;
  animation: pill-spin 0.7s linear infinite;
}
@keyframes pill-spin { to { transform: rotate(360deg); } }
@media (prefers-reduced-motion: reduce) { .pill.running .dot { animation: none; } }

@keyframes pulse {
  0%, 100% { opacity: 0.35; transform: scale(1); }
  50%      { opacity: 1;    transform: scale(1.2); }
}

/* Buttons */
.btn {
  font-family: var(--font-sans);
  font-size: 13.5px;
  font-weight: 500;
  padding: 9px 14px;
  border-radius: var(--r-md);
  border: 1px solid transparent;
  cursor: pointer;
  line-height: 1;
  display: inline-flex;
  align-items: center; justify-content: center;
  gap: 8px;
  transition: background var(--dur-fast) var(--ease),
              border-color var(--dur-fast) var(--ease),
              box-shadow var(--dur-fast) var(--ease),
              color var(--dur-fast) var(--ease);
  white-space: nowrap;
}
.btn:focus-visible { outline: none; box-shadow: var(--sh-focus); }
.btn-primary { background: var(--navy-800); color: var(--white); border-color: var(--navy-800); }
.btn-primary:hover { background: var(--navy-700); }
.btn-primary:active { background: var(--navy-900); }
.btn-secondary {
  background: var(--surface); color: var(--navy-800);
  border-color: var(--hair-2);
}
[data-theme="dark"] .btn-secondary {
  color: var(--white); background: transparent; border-color: var(--border-strong);
}
.btn-secondary:hover { border-color: var(--navy-800); }
[data-theme="dark"] .btn-secondary:hover { border-color: var(--gold-500); }
.btn-ghost { background: transparent; color: var(--fg-2); border-color: transparent; }
.btn-ghost:hover { background: var(--surface-muted); color: var(--fg); }
.btn-sm { padding: 6px 10px; font-size: 12px; }
.btn.btn-disabled,
.btn:disabled {
  opacity: 0.4; cursor: not-allowed;
}
.btn.btn-disabled { pointer-events: none; }

/* ===== Back-link breadcrumb ===== */
/* Reusable "← <where>" link for any sub-page. Mirrors the visual language
   already used on the session-detail view's `.review-head .back`. */
.back-link {
  display: inline-flex;
  align-items: center;
  gap: 8px;
  padding: 6px 4px;
  font-family: var(--font-mono);
  font-size: 12px;
  letter-spacing: 0.12em;
  text-transform: uppercase;
  color: var(--fg-2);
  text-decoration: none;
  margin-bottom: var(--sp-3);
  transition: color var(--dur-fast) var(--ease);
}
.back-link:hover,
.back-link:focus-visible { color: var(--fg); }
.back-link svg { display: block; width: 16px; height: 16px; }

/* ===== Reading-page head (`reading_head` macro, macros/ui.html) =====
   The shared opening of every long-form reading page: back · mono-caps
   eyebrow naming the KIND of document · title · gold rule · sub · optional
   mono meta strip · closing rule.

   Lives here rather than in a page stylesheet because it is deliberately
   cross-page chrome, shared by all four reading pages: /whats-new, /privacy,
   /terms and /faq. The last three carried their own copy of this anatomy as
   `.legal-title-row` in policy_doc.css until 2026-07-22; that fork is gone.
   Two spellings of one head is exactly the drift DESIGN.md §3 exists to stop.
   Sizes match `.main-col .page-head` so a reading page and the dashboard open
   at the same pitch. */
.rdg-head {
  padding-bottom: var(--sp-6);
  border-bottom: 1px solid var(--border-strong);
}
/* One rule for both spellings: an <a> when the page has a single obvious
   parent, a <button data-legal-back> when it needs the history-aware walk.
   The button resets are what let the two look identical. */
.rdg-head__back {
  display: inline-flex;
  align-items: center;
  gap: var(--sp-2);
  padding: 0 0 var(--sp-1);
  margin-bottom: var(--sp-4);
  font-family: var(--font-mono);
  font-size: var(--fs-micro);
  letter-spacing: var(--tracking-caps);
  text-transform: uppercase;
  color: var(--fg-3);
  text-decoration: none;
  border-radius: var(--r-md);
  transition: color var(--dur-fast) var(--ease);
  /* button resets */
  background: none;
  border: 0;
  cursor: pointer;
  line-height: inherit;
}
.rdg-head__back:hover { color: var(--fg); }
.rdg-head__back:focus-visible { outline: none; box-shadow: var(--sh-focus); }
.rdg-head__back svg { display: block; }
.rdg-head__eyebrow {
  margin: 0 0 var(--sp-2);
  font-family: var(--font-mono);
  font-size: var(--fs-micro);
  font-weight: var(--fw-semibold);
  letter-spacing: var(--tracking-caps);
  text-transform: uppercase;
  color: var(--accent-soft-fg);
}
.rdg-head__title {
  margin: 0;
  font-size: 26px;
  font-weight: var(--fw-semibold);
  letter-spacing: var(--tracking-tight);
  line-height: 1.1;
  text-wrap: balance;
}
/* The 64px gold hairline the dashboard's page head already carries under its
   title — the one piece of brand punctuation these pages share with it. */
.rdg-head__rule {
  width: 64px;
  height: 2px;
  margin: var(--sp-3) 0;
  background: var(--accent);
  border-radius: 1px;
}
.rdg-head__sub {
  margin: 0;
  max-width: 620px;
  font-size: 13.5px;
  line-height: var(--lh-body);
  color: var(--fg-2);
}
.rdg-head__meta {
  display: flex;
  flex-wrap: wrap;
  gap: var(--sp-2) var(--sp-5);
  margin-top: var(--sp-5);
  font-family: var(--font-mono);
  font-size: var(--fs-micro);
  letter-spacing: var(--tracking-wide);
  color: var(--fg-3);
}
.rdg-head__meta b { color: var(--fg-2); font-weight: var(--fw-semibold); }
.rdg-head__meta a { color: inherit; }

/* ===== Privacy footer ===== */
.privacy-footer {
  margin-top: 56px;
  background: var(--bg-sunken);
  border-left: 3px solid var(--gold-500);
  padding: 20px 24px;
  border-radius: 0 var(--r-md) var(--r-md) 0;
  display: grid;
  grid-template-columns: auto 1fr auto;
  gap: 20px; align-items: flex-start;
}
[data-theme="dark"] .privacy-footer {
  background: rgba(var(--gold-500-rgb), 0.06);
}
.privacy-footer .glyph {
  width: 40px; height: 40px;
  border-radius: 50%;
  background: var(--gold-500);
  color: var(--navy-900);
  display: grid; place-items: center;
  font-family: var(--font-sans);
  font-weight: 700; font-size: 18px;
  flex: none;
}
.privacy-footer .body p {
  font-family: var(--font-serif);
  font-size: 15px;
  line-height: 1.55;
  color: var(--fg);
  margin: 0;
  max-width: 720px;
}
.privacy-footer .body .label {
  font-family: var(--font-mono);
  font-size: 10.5px;
  letter-spacing: 0.14em; text-transform: uppercase;
  color: var(--accent-strong);
  margin-bottom: 6px; display: block;
  font-weight: 600;
}
[data-theme="dark"] .privacy-footer .body .label { color: var(--gold-400); }
.privacy-footer .audit {
  font-family: var(--font-mono);
  font-size: 11px;
  color: var(--fg-3);
  text-align: right;
  letter-spacing: 0.04em;
  line-height: 1.5;
  flex: none;
  white-space: nowrap;
}
.privacy-footer .audit a { color: var(--fg-2); text-decoration: underline; text-underline-offset: 3px; }

/* Rail container: keeps the privacy-footer card aligned with page content
   instead of running edge-to-edge across the app-shell. Matches the default
   --rail-wide used by the dashboard; upload (1100) and review (1280) pages
   will be slightly off — acceptable tradeoff for a global footer. */
.page-footer__inner {
  max-width: var(--rail-wide);
  margin: 0 auto;
  padding: 0 32px;
}

/* ===== Site footer ===== */
.site-footer {
  border-top: 1px solid var(--border);
  background: var(--surface);
  margin-top: 32px;
}
.site-footer__inner {
  max-width: var(--rail-wide);
  margin: 0 auto;
  padding: 18px 32px;
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 20px;
  font-family: var(--font-sans);
  font-size: 12px;
  color: var(--fg-3);
  line-height: 1.5;
}
.site-footer__links {
  display: inline-flex;
  align-items: center;
  gap: 10px;
}
.site-footer__links a {
  color: var(--fg-2);
  text-decoration: none;
  transition: color var(--dur-fast) var(--ease);
}
.site-footer__links a:hover {
  color: var(--fg);
  text-decoration: underline;
  text-underline-offset: 3px;
}
.site-footer__meta {
  display: inline-flex;
  align-items: center;
  gap: 10px;
  color: var(--fg-3);
}
.site-footer__meta a {
  color: var(--fg-2);
  text-decoration: none;
  transition: color var(--dur-fast) var(--ease);
}
.site-footer__meta a:hover {
  color: var(--fg);
  text-decoration: underline;
  text-underline-offset: 3px;
}
.site-footer__links a:focus-visible,
.site-footer__meta a:focus-visible {
  color: var(--fg);
  text-decoration: underline;
  text-underline-offset: 3px;
  outline: none;
  box-shadow: var(--sh-focus);
  border-radius: 2px;
}
.site-footer__sep {
  color: var(--border-strong);
  opacity: 0.6;
}

/* Stack to two centered rows on narrow screens. */
@media (max-width: 640px) {
  .site-footer__inner {
    flex-direction: column;
    align-items: center;
    gap: 8px;
    padding: 16px 24px;
    text-align: center;
  }
}

/* ===== Flash messages =====
 *
 * `#flash-region` is the live region rendered once at the top of <main>
 * (see partials/flash.html). When `flash()` populates it, the element
 * gains the `.flash` class plus `.f-{kind}` styling. Pinning it with
 * position:fixed ensures error messages remain visible regardless of the
 * scroll position the user is in — without this, on a tall review page
 * the flash sat at the document-top and was scrolled out of view, making
 * 4xx/5xx responses feel like silent failures (Task 1.5d, smoke 2026-05-04).
 */
#flash-region {
  position: fixed;
  top: 16px;
  left: 50%;
  transform: translateX(-50%);
  z-index: 200;
  max-width: min(640px, calc(100vw - 32px));
  width: max-content;
  box-shadow: var(--sh-3, 0 4px 12px rgba(var(--black-rgb), 0.15));
  pointer-events: auto;
}
#flash-region:empty {
  display: none;
}

.flash {
  display: flex;
  align-items: flex-start;
  gap: 10px;
  padding: 12px 14px;
  border-radius: 4px;
  font-family: var(--font-sans);
  font-size: 13px;
  line-height: 1.45;
  border: 1px solid transparent;
  flex: 1;
  min-width: 260px;
}
.flash .dot {
  width: 6px;
  height: 6px;
  border-radius: 50%;
  margin-top: 7px;
  flex: none;
}
.f-info { background: var(--status-info-bg); border-color: var(--status-info-border); color: var(--status-info-fg); }
.f-ok   { background: var(--status-ok-bg); border-color: var(--status-ok-border); color: var(--status-ok-fg); }
.f-warn { background: var(--status-pending-bg); border-color: var(--status-pending-border); color: var(--status-pending-fg); }
.f-err  { background: var(--status-error-bg); border-color: var(--status-error-border); color: var(--status-error-fg); }

/* ===== Sliding-session pre-cap warning banner (ADR-0005) =====
 * Reuses the .flash + .f-warn styling (no new colours); only adds bottom-fixed
 * positioning so it doesn't collide with the top-pinned #flash-region. */
.cap-banner {
  position: fixed;
  bottom: 16px;
  left: 50%;
  transform: translateX(-50%);
  z-index: 200;
  max-width: min(640px, calc(100vw - 32px));
  width: max-content;
  box-shadow: var(--sh-3, 0 4px 12px rgba(var(--black-rgb), 0.15));
}

/* ===== Toast ===== */
.toast {
  position: fixed;
  bottom: 24px; left: 50%; transform: translateX(-50%);
  background: var(--navy-900);
  color: var(--white);
  padding: 10px 18px;
  border-radius: var(--r-md);
  font-family: var(--font-sans);
  font-size: 13px;
  box-shadow: var(--sh-3);
  z-index: 120;
  display: flex; align-items: center; gap: 10px;
  animation: toast-in 220ms var(--ease);
}
.toast .eyebrow {
  font-family: var(--font-mono);
  font-size: 10px; letter-spacing: 0.14em; text-transform: uppercase;
  color: var(--gold-400);
  font-weight: 600;
}
/* Optional inline action link on the canonical toast (pattern study F1, D52):
   plain text affordance for reversible mutations ("Undo"). Component
   capability only — wiring real undo endpoints is per-flow work that ships
   with its own specs. Built by showToast(message, {actionLabel, onAction})
   in shield_dashboard_v2.js. */
.toast__action {
  appearance: none;
  border: 0;
  background: transparent;
  padding: var(--sp-1) var(--sp-2);
  margin: calc(-1 * var(--sp-1)) 0;
  border-radius: var(--r-sm);
  font-family: var(--font-mono);
  font-size: var(--fs-xs);
  font-weight: 600;
  letter-spacing: 0.02em;
  color: var(--accent-strong);
  text-decoration: underline;
  text-underline-offset: 2px;
  cursor: pointer;
}
.toast__action:hover { color: var(--gold-400); }
.toast__action:focus-visible {
  outline: 2px solid var(--gold-400);
  outline-offset: 2px;
}
/* Long-form toast. The base toast is a single-line row sized to its content,
   which is fine for a short confirmation but unreadable for a message that
   explains a refusal — those need a wrap boundary and a top-aligned close.
   Paired with showToast(msg, {persist:true}), which also drops the
   auto-dismiss timer. Modifier on the canonical base, not a new component. */
.toast--wrap {
  align-items: flex-start;
  max-width: min(46ch, calc(100vw - 2 * var(--sp-4)));
  padding: var(--sp-3) var(--sp-3) var(--sp-3) var(--sp-4);
  text-align: left;
  line-height: var(--lh-body);
  text-wrap: pretty;
}
/* Dismiss affordance on the canonical toast. Mirrors .toast__action's shape
   (flat, transparent, on the dark toast); required whenever a toast persists,
   present on every toast so dwell time is never the only way out. */
.toast__close {
  appearance: none;
  border: 0;
  background: transparent;
  flex: none;
  width: 22px; height: 22px;
  margin: -2px calc(-1 * var(--sp-1)) 0 0;
  display: grid; place-items: center;
  border-radius: var(--r-sm);
  font-family: var(--font-mono);
  font-size: var(--fs-lg);
  line-height: 1;
  color: var(--navy-200);
  cursor: pointer;
  transition: color var(--dur-fast) var(--ease),
              background var(--dur-fast) var(--ease);
}
.toast__close:hover {
  color: var(--white);
  background: rgba(var(--white-rgb), 0.10);
}
.toast__close:focus-visible {
  outline: 2px solid var(--gold-400);
  outline-offset: 2px;
}
@keyframes toast-in {
  from { opacity: 0; transform: translate(-50%, 8px); }
  to   { opacity: 1; transform: translate(-50%, 0); }
}

/* Reversibility toast (Task 11): composes the base .toast — message + an Undo
   button. The button is a flat text affordance on the dark toast; gold accent
   so it reads as the action without a competing fill. */
.report-toast { z-index: 200; }   /* above the report modal panel */
.report-toast__msg { white-space: nowrap; }
.report-toast__undo {
  appearance: none;
  border: 0;
  background: transparent;
  padding: var(--sp-1) var(--sp-2);
  margin: calc(-1 * var(--sp-1)) 0;
  border-radius: var(--r-sm);
  font-family: var(--font-sans);
  font-size: var(--fs-xs);
  font-weight: 600;
  letter-spacing: 0.02em;
  color: var(--gold-400);
  cursor: pointer;
}
.report-toast__undo:hover { color: var(--gold-300); text-decoration: underline; }
.report-toast__undo:focus-visible {
  outline: 2px solid var(--gold-400);
  outline-offset: 2px;
}
@media (prefers-reduced-motion: reduce) {
  .report-toast { animation: none; }
}

/* ===== Locale switcher =====
   Segmented pill: white capsule with two short codes (EN / HR). The active
   locale gets a gold fill with dark navy text; inactive is a transparent
   pill on the white base, dark text. The separator element is display:none
   — the pill itself groups the codes visually.

   Primary placement: inside .app-header next to the auth bar.
   Fallback: auth pages blank the header and render a floating copy
   (--floating modifier) that pins to the top-right corner. */
.locale-switch {
  display: inline-flex;
  align-items: center;
  gap: 2px;
  margin-right: 14px;
  padding: 3px;
  background: var(--white);
  border: 1px solid rgba(var(--ink-rgb), 0.08);
  border-radius: 999px;
  box-shadow: 0 1px 2px rgba(var(--ink-rgb), 0.04);
  font-size: 11px;
  font-weight: 600;
  letter-spacing: 0.14em;
  line-height: 1;
}
/* Inside the account menu the switch sat heavier than the rows around it: a
   bordered, shadowed 40px pill among flat 34px items. Slimmed to 30px.

   This DOES relax the 2026-07-05 T1 tap target (--sp-7, 32px) to --sp-6 (24px)
   for the in-menu instance only — the header switch, which is the one a
   signed-out visitor taps on a phone, keeps 32px untouched. 24px is the WCAG
   2.5.8 (AA) minimum, so this sits exactly at the floor rather than below it,
   and the control lives inside a menu the user has already opened deliberately.
   Flagged rather than done quietly. */
.locale-switch--menu {
  margin-right: 0;
  padding: 2px;
  box-shadow: none;
}
.locale-switch--menu .locale-switch__btn {
  min-height: var(--sp-6);
  padding: 3px 10px;
}

.locale-switch__sep {
  display: none;
}
.locale-switch__btn {
  appearance: none;
  border: 0;
  background: transparent;
  padding: 5px 11px;
  /* Fix (2026-07-05): ≥32px tap target for the EN/HR chips (T1). */
  min-height: var(--sp-7);
  display: inline-flex;
  align-items: center;
  justify-content: center;
  border-radius: 999px;
  color: var(--ink);
  cursor: pointer;
  font: inherit;
  letter-spacing: inherit;
  text-transform: uppercase;
  opacity: 0.6;
  transition: background-color 160ms ease, color 160ms ease,
              opacity 160ms ease, box-shadow 160ms ease;
}
.locale-switch__btn:hover {
  opacity: 0.9;
  background: rgba(var(--ink-rgb), 0.04);
}
.locale-switch__btn:focus-visible {
  outline: 2px solid var(--accent, var(--gold-500));
  outline-offset: 2px;
}
.locale-switch__btn--active,
.locale-switch__btn--active:hover {
  opacity: 1;
  color: var(--brand-strong, var(--navy-900));
  background: var(--accent, var(--gold-500));
  box-shadow: 0 1px 2px rgba(var(--ink-rgb), 0.18),
              inset 0 1px 0 rgba(var(--white-rgb), 0.35);
}

.locale-switch--floating {
  position: fixed;
  top: 18px;
  right: 22px;
  z-index: var(--z-sticky);
  margin-right: 0;
}

/* -- Account settings: Danger zone -------------------------------------- */
.settings-panel--danger {
  border-left: var(--sp-1) solid var(--danger);
}

.settings-panel__title--danger {
  color: var(--danger-muted);
}

/* System-2 modal (.modal-scrim/.modal-panel) removed — canonical modal.css (D49). */


.account-delete-form {
  display: flex;
  flex-direction: column;
  gap: var(--sp-4);
}

.account-delete-form__field {
  display: flex;
  flex-direction: column;
  gap: var(--sp-1);
}

.account-delete-form__label {
  font-size: var(--fs-sm);
  font-weight: var(--fw-medium);
  font-family: var(--font-sans);
}

.account-delete-form__hint {
  color: var(--danger-muted);
  font-size: var(--fs-xs);
}

.account-delete-form__error {
  color: var(--danger-muted);
  background: var(--danger-soft-bg);
  border-radius: var(--r-lg);
  padding: var(--sp-2) var(--sp-3);
  margin: 0;
}

.account-delete-form__actions {
  display: flex;
  gap: var(--sp-2);
  justify-content: flex-end;
  margin-top: var(--sp-2);
}

.btn--destructive {
  background: var(--danger);
  color: var(--fg-inverse);
  border: none;
}

.btn--destructive:hover:not(:disabled) {
  filter: brightness(1.05);
}

.btn--destructive:disabled {
  opacity: 0.5;
  cursor: not-allowed;
}

/* Outline (quiet) destructive — page-level danger TRIGGERS, e.g. the
   account "Delete account…" entry point. Filled .btn--destructive stays
   the in-modal CONFIRM treatment. (D50 button-spelling cleanup.) */
.btn--destructive-outline {
  background: var(--surface);
  border: 1px solid var(--danger);
  color: var(--danger-muted);
}
.btn--destructive-outline:hover:not(:disabled) { background: var(--danger-soft-bg); }
[data-theme="dark"] .btn--destructive-outline {
  background: transparent;
  color: var(--danger);
}

/* -- Auth flash on /login (deletion success, session expired, etc.) -----
   2026-05-11: was an in-flow block that pushed the split layout down
   and spanned full width. Filip flagged this — promoted to a floating
   centered toast at the top of the viewport, with the same Shield
   look (hairline border, soft shadow, mono message, accent border on
   the left). Stacking: above the auth-split orbs, one step below the
   floating locale switcher — hence the derived value rather than a
   second `--z-sticky` that would leave the pair ordered by DOM
   accident (FU-161 re-seat; same calc idiom as `.menu--above-modal`). */
.auth-flash {
  position: fixed;
  top: 16px;
  left: 50%;
  transform: translateX(-50%);
  z-index: calc(var(--z-sticky) - 1);
  width: max-content;
  max-width: min(640px, calc(100vw - 32px));
  padding: 10px 16px;
  background: var(--bg-raised);
  border: 1px solid var(--border);
  border-left-width: 3px;
  border-radius: var(--r-md);
  font-family: var(--font-sans);
  font-size: 13px;
  line-height: 1.45;
  letter-spacing: -0.003em;
  box-shadow: 0 8px 24px -8px rgba(var(--ink-rgb), 0.20), 0 2px 6px rgba(var(--ink-rgb), 0.08);
  /* Slide in, then auto-dismiss after a common toast dwell (5s) — the app-wide
     #flash-region toast (shield_auth.js) already self-dismisses at 4s; these
     server-rendered auth flashes are position:fixed and previously lingered for
     the whole page life. The exit animates opacity only (visibility snaps at the
     end) so it stays centered and is reduced-motion-safe; `forwards` holds the
     hidden end state so the toast leaves no interactive/AT trace. */
  animation:
    auth-flash-in 220ms var(--ease),
    auth-flash-out 300ms var(--ease) 5000ms forwards;
}
@keyframes auth-flash-in {
  from { opacity: 0; transform: translate(-50%, -8px); }
  to   { opacity: 1; transform: translate(-50%, 0); }
}
@keyframes auth-flash-out {
  from { opacity: 1; }
  to   { opacity: 0; visibility: hidden; }
}
.auth-flash--success {
  border-left-color: var(--success);
  color: var(--success);
}
/* B1 (G1) — session-expired toast on /login?reason=session_expired.
   Uses status-info tokens defined in tokens.css. NO hardcoded values. */
.auth-flash--info {
  border-left-color: var(--status-info-fg);
  color: var(--status-info-fg);
}

/* =========================================================
   Hint-dot (F3 preview modal + reusable) — a small icon button
   that reveals a claims-discipline note on hover/focus. Pure CSS
   (no JS), keyboard-reachable via :focus-within on the button.
   Minted new (NOT the orphaned dashboard-v2 `.info-dot`, whose
   sibling `.info-tooltip` selector + global `initInfoDots` click
   handler would collide). Anatomy: `.hint-dot > .hint-dot__btn +
   .hint-dot__pop`. `--warn` tints the icon danger (calm register —
   an icon+tooltip, never a red panel). Specimen: /styleguide.
   ========================================================= */
.hint-dot { position: relative; display: inline-flex; vertical-align: middle; }
.hint-dot__btn {
  width: 24px; height: 24px; padding: 0; flex: none;
  border: 1px solid var(--border-strong);
  border-radius: var(--r-pill);
  background: var(--surface-muted);
  color: var(--fg-3);
  cursor: help;
  display: inline-flex; align-items: center; justify-content: center;
  transition: color var(--dur-fast) var(--ease),
    border-color var(--dur-fast) var(--ease),
    background var(--dur-fast) var(--ease);
}
.hint-dot__btn svg { width: 14px; height: 14px; display: block; }
.hint-dot__btn:hover { color: var(--fg); border-color: var(--border-focus); }
.hint-dot__btn:focus-visible { outline: none; box-shadow: var(--sh-focus); color: var(--fg); }
.hint-dot--warn .hint-dot__btn {
  color: var(--danger);
  border-color: var(--danger);
  background: var(--danger-soft-bg);
}
.hint-dot__pop {
  position: absolute; bottom: calc(100% + var(--sp-2)); left: 0;
  z-index: var(--z-menu);
  width: 300px; max-width: min(300px, 72vw);
  background: var(--bg-raised); color: var(--fg-2);
  border: 1px solid var(--border);
  border-radius: var(--r-md);
  box-shadow: var(--sh-3);
  padding: var(--sp-3) var(--sp-4);
  font-family: var(--font-sans);
  font-size: var(--fs-xs); line-height: var(--lh-body);
  text-align: left;
  /* The pop sets its own width, so it must set its own wrapping too — hosts
     that suppress wrapping for their own layout (the `white-space: nowrap` on
     an .input-tabs tab) would otherwise push the sentence out of the box as a
     single line while the box stayed 300px wide. */
  white-space: normal;
  opacity: 0; visibility: hidden; transform: translateY(4px);
  transition: opacity var(--dur-fast) var(--ease),
    transform var(--dur-fast) var(--ease),
    visibility 0s linear var(--dur-fast);
}
.hint-dot__pop strong { color: var(--fg); font-weight: var(--fw-semibold); }
/* End-anchored variant: pop hugs the right edge of the trigger. */
.hint-dot--end .hint-dot__pop { left: auto; right: 0; }
.hint-dot:hover .hint-dot__pop,
.hint-dot:focus-within .hint-dot__pop {
  opacity: 1; visibility: visible; transform: none; transition-delay: 0s;
}
/* Bare variant: the glyph alone, no pill. For a hint folded INTO a label or
   another control (the Paste text tab), where the bordered circle would
   outweigh the icons already in that row. Rests at 75% and comes up on its
   own hover — the host may brighten it further from its own stylesheet. */
.hint-dot--bare .hint-dot__btn {
  width: 16px; height: 16px;
  border: 0; background: transparent;
  color: var(--fg-3); opacity: 0.75;
  transition: color var(--dur-fast) var(--ease), opacity var(--dur-fast) var(--ease);
}
.hint-dot--bare .hint-dot__btn svg { width: 15px; height: 15px; }
.hint-dot--bare:hover .hint-dot__btn { color: var(--fg-2); opacity: 1; }
/* Fixed variant: for a hint-dot inside an overflow-clipping ancestor, where an
   absolutely-positioned pop would be cut off. The pop leaves the flow entirely
   and its coordinates are written by window.UIMenu.place (D50) on mouseenter,
   before the :hover reveal above paints — so it must NOT carry a resting
   top/bottom of its own, or a first hover would flash at the wrong spot. */
.hint-dot--fixed .hint-dot__pop { position: fixed; top: 0; left: 0; bottom: auto; }
@media (prefers-reduced-motion: reduce) { .hint-dot__pop { transition: none; } }