fix: settle the owner's open calls and keep hover popups reachable

AGENTS.md

@@ -37,7 +37,7 @@ sources and run `npm run generate`.
 
 ## The check loop
 
-CI picks the checks a change needs (D-031); `release-gate` is the only required
+CI picks the checks a change needs (D-031, `docs/ci.md`); `release-gate` is the only required
 check and passes when every selected check passed. See the plan before you
 push:
 

CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+- **`focus.ring-contrast`** (D-040): the 1px dashed control ring in
+  `interaction.focus.ring-container`, for controls on a fill and invalid
+  fields beside the danger border. Twelve components use it instead of the
+  written-out ring; rendering is unchanged. Every port classifies it.
+- **Code and terminal backgrounds** (D-039). `surface.code` and
+  `surface.terminal` describe what a code block or terminal pane sits on;
+  `code.bg` and `terminal.bg` the inside of an editor and a terminal grid.
+  Values are unchanged.
+- **Hover popups stay reachable.** The token inspector and the tooltip keep
+  their popup open while the pointer crosses to it, so a long inspector can be
+  scrolled; leaving both closes it after 300 ms, never while keyboard focus
+  is on its trigger or inside it (WCAG 1.4.13). The passive hex preview is
+  unchanged.
+- **Specs.** A loading indicator's label is always visible. The progress spec
+  no longer suggests a track that fails 3:1. CI selection rules moved from
+  D-031 to `docs/ci.md`.
 - **Display and title type sizes** (D-037): `font.size.display` 32/40 and
   `font.size.title` 24/32 with their line heights, for page heroes, metric
   figures and page titles.

docs/ci.md

@@ -0,0 +1,31 @@
+# CI
+
+How CI picks the checks a change runs (D-031). `scripts/ci/select.mjs`
+computes the plan; run it before you push:
+
+```
+node scripts/ci/select.mjs --event pull_request --base origin/main --head HEAD
+```
+
+CI is `select` → checks → `release-gate`.
+
+- `select` reads the changed paths and `scripts/ci/proofs.json`; a path gets
+  cheaper only when a rule claims it. Unclaimed paths and control files
+  (workflows, the selector and registry, `package.json`, the lockfile, the
+  Playwright configs) run every check. On a pull request the base commit's
+  control list also applies, so a change cannot make itself cheaper. A file a
+  browser spec imports runs that spec and counts as a site change.
+- A pull request runs only the selected checks, unit tests and build in
+  parallel; browser subsets write no evidence (D-028).
+- A push to `main` that changes the site runs the whole matrix in shards
+  (desktop in four parts; projects read from the Playwright config), with
+  packed consumers in parallel. Blob reports merge once into the evidence
+  reporter, which refuses a missing shard or configured test; then the
+  verification report and deployment. No site change, no deployment. Changed
+  paths count from the last commit that reached Pages.
+- `release-gate`, the only required check, recomputes the plan from Git with
+  the same code and checks each job ran as planned and passed.
+- `fullyParallel`, two workers per CI job, zero retries. The page axe scan is
+  two tests (colour contrast; every other rule) covering exactly the tagged
+  rules. Only an unnarrowed `playwright test`, or the merge of every shard,
+  writes evidence.