/* ============================================================================
   theme.css — the single source of truth for color & type tokens.
   S27 Hearth reskin (WP-1). Loaded BEFORE every other stylesheet so the
   custom properties cascade to forms.css / plan_health.css / drawer.css and
   the (tokenized) inline template styles.

   IMPORTANT — the ONLY file permitted to contain raw hex color literals.
   Everything else references these tokens via var(). Enforced by
   engine/hex_regression_guard.py (WP-7).

   IMPORTANT — CSS comments do NOT nest: the first close-delimiter (an
   asterisk immediately followed by a slash) after an open ends the comment.
   Never write that close-delimiter inside this multi-line banner — it
   self-closes the banner early, every line after it is parsed as broken CSS,
   the token rule below is dropped, and the whole palette computes to nothing.
   Guarded by tests/test_hex_regression_guard.py (the token-rule-parses test).

   Two token groups (Style_Refresh_Guide §7):
     • BRAND / NEUTRAL — direction-themed; re-valued as one block at the
       Hearth swap. WP-1 holds the CURRENT (pre-Hearth) values so the app is
       pixel-identical after WP-1 — this step only relocates and names.
     • SEMANTIC — tier + state colors. LOCKED; tokenized but NOT re-valued by
       the brand reskin. The three tier colors encode the plan model
       (S26/S27) and must survive any reskin unchanged.

   ── RE-SKIN DRIFT NOTE (WP-9) ──────────────────────────────────────────────
   Translucent brand washes use rgb(from var(--token) r g b / <a>) so they
   re-theme, but that needs Chrome119+/Safari16.4+/Firefox128+. For older
   browsers (a real share of this app's older-adult users) each wash is
   preceded by a PRECOMPUTED plain-rgba fallback marked `theme-fallback`
   — the token's value at that alpha. Those marked lines are the ONLY brand
   values allowed outside this file (the hex-regression guard permits a brand
   rgba only on a marker line; an unmarked one still fails).

   THE DEBT: a future re-skin that edits the values below does NOT update the
   marked fallbacks — they will still paint the OLD palette on old browsers
   until regenerated. On any re-value, regenerate every `theme-fallback`
   line from the new token values. This is mechanical and SHOULD become a build
   step: parse this file's `--token: #hex;` map and rewrite each fallback as
   the rgba() of the token named in the following `rgb(from var(--token) …)`
   line (exactly what scripts/…/add_fallbacks.py did for WP-9). Until that
   build step exists, treat regeneration as a required manual step of any
   re-skin. A stale marked fallback is caught by review, not by the guard
   (the guard only enforces the marker, not that the value is current).
   ========================================================================== */
:root {
  /* ===== BRAND / NEUTRAL (Hearth — Style_Refresh_Guide §10 LOCKED values) =====
     THE RE-VALUE: this one block is the reskin. Because the app is fully
     tokenized, editing these values re-skins every surface. Revert this block
     alone to undo the look. */
  --color-canvas:         #FBFAF6;   /* Linen — page ground (§10: lighter than Oat) */
  --color-surface:        #FFFFFF;   /* cards */
  --color-surface-alt:    #FBF9F5;   /* insets / light panels */
  --color-ink:            #243330;   /* Pine Ink — primary text */
  --color-ink-muted:      #616966;   /* secondary text (§9: clears AA at ≥4.5:1) */
  --color-primary:        #2C5551;   /* Deep Teal-Pine — structure, headers, primary buttons */
  --color-primary-strong: #20403D;   /* primary hover/active */
  --color-accent:         #E28A5F;   /* Ember — warm human accent (fills/borders/large only, §9) */
  --color-accent-strong:  #C56A3E;   /* Ember-strong — AA-safe accent TEXT at ≥16px/600 (§9) */
  --color-accent-soft:    #F7E4D7;   /* accent washes / chips */
  --color-border:         #E6E1D8;   /* hairlines */
  /* border-warm has no §10 value; §7 asked to consolidate the taupe cluster to
     one token, so it unifies to the Hearth hairline (warm non-locked borders
     lighten from #D4CDC0 to #E6E1D8). The Patricia warm-taupe HEADER register
     is NOT this token — it stays literal (guard allowlist). */
  --color-border-warm:    #E6E1D8;
  --sage:                 #7A9C7A;   /* decorative sage green (retained; not in §10) */

  /* ===== SEMANTIC / STATE (locked — NOT re-valued by the brand reskin) ===== */
  --state-success:        #2E7D32;   /* success text/fill */
  --state-success-tint:   #81C784;   /* bright success tint (checks, "do here" label, gradient stop) */
  --state-warning:        #E65100;   /* strong warning orange */
  --state-warning-fill:   #F0C267;   /* light amber fill (partial indicator bg) */
  --state-warning-border: #D8A83A;   /* mid amber border */
  --state-warning-text:   #6D4C00;   /* dark amber text on light fill */
  --state-error:          #C62828;   /* error text/fill */
  --state-error-tint:     #E57373;   /* light error tint ("professional" label) */

  /* ===== TIER (LOCKED — tokenized, NEVER re-valued; S26/S27 plan model) ===== */
  --tier-first48:         #ffb74d;   /* First 48 Hours — amber */
  --tier-firstmonth:      #66bb6a;   /* First Month — green */
  --tier-executor:        #ef5350;   /* executor tier (The First Year) — red */

  /* ===== TYPE (WP-5 — Hearth: Fraunces display / Public Sans body) =========
     System-font fallback stack on every token so first paint never blocks
     while the webfonts load (display=swap). Type is swappable via these two
     tokens alone. */
  --font-display: 'Fraunces', Georgia, 'Times New Roman', serif;
  --font-body:    'Public Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
  --font-mono:    ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;

  /* ===== TEMPLATE-LOCAL palette (WP-4) ===================================
     Page-specific decorative tints lifted from the 8 inline <style> blocks
     (checklist status-badge legend, auth error tints, admin panels, a couple
     of one-offs). No §10 Hearth target — retained at CURRENT values so those
     pages are visually unchanged. Tokenized only to remove raw hex from the
     templates; NOT re-valued by the brand reskin. */
  --tmpl-info:               #1565C0;   /* info/link blue text (checklist) */
  --tmpl-info-soft:          #E3F2FD;   /* light info background */
  --tmpl-error-soft:         #FEE;      /* auth error-message background */
  --tmpl-error-border:       #F5C2C2;   /* auth error border */
  --tmpl-badge-warn-soft:    #FFF3E0;   /* checklist status badge (warm) */
  --tmpl-badge-warn-soft2:   #FFF9C4;   /* checklist status badge (yellow) */
  --tmpl-badge-error-soft:   #FFCDD2;   /* checklist status badge (red) */
  --tmpl-badge-success-soft: #E8F5E9;   /* checklist status badge (green) */
  --tmpl-amber:              #FFA726;   /* checklist accent amber */
  --tmpl-amber-strong:       #F57F17;   /* checklist accent amber (strong) */
  --tmpl-warm-white:         #FFF6EC;   /* secure_card warm white */
  --tmpl-slate-muted:        #4A6272;   /* landing muted slate text */

  /* ===== LEGACY ALIASES ===================================================
     Retained so drawer.css (0 hex, out of scope) and any un-migrated
     reference keeps resolving — and RE-THEMES with the new tokens. Each
     alias points at its semantic token; --medium-gray (#888) has no exact
     token home so it stays direct (not in the Hearth locked set). */
  --parchment:   var(--color-canvas);
  --deep-slate:  var(--color-primary);
  --terracotta:  var(--color-accent);
  --charcoal:    var(--color-ink);
  --white:       var(--color-surface);
  --light-gray:  var(--color-surface-alt);
  --medium-gray: #888888;
  --dark-gray:   var(--color-ink-muted);
  --ring-outer:  var(--tier-first48);
  --ring-middle: var(--tier-firstmonth);
  --ring-inner:  var(--tier-executor);
}