/* Crewwize — the design system foundation (REQ-013).
 *
 * ONE stylesheet is loaded by every page this service serves: the landing page,
 * the account pages, and the fleet screens behind the login. Everything that
 * makes Crewwize recognisable is in here — the palette, the type, the controls,
 * the chrome. The two sheets loaded after it (landing.css, fleet.css) add layout
 * for one surface each and are not allowed to redefine a token.
 *
 * Until 2026-08-19 this was two unrelated designs. site.css painted the fleet and
 * the account pages white with a green button; landing.css painted the public
 * pages navy with an amber one. Somebody who read the marketing page and pressed
 * "Free registration" landed on a page that looked like a different company's,
 * which is D-91's whole reason for existing.
 *
 * D-63 constrains every line: no CDN, no font host, no analytics, no client
 * framework. That rules out a webfont (D-95), so the type is the system stack —
 * and the design leans into it rather than apologising, using the monospace stack
 * for labels and figures the way an instrument display does. It is more honest
 * than a downloaded font on a site whose whole argument is not depending on other
 * people's servers.
 */

/* --- tokens --------------------------------------------------------------- */

:root {
  color-scheme: light dark;

  /* Brand. The navy is the app icon's background, exactly — the same icon is on
   * the crew's home screen, so a brand colour that disagreed with it would undo
   * the point of sharing the mark. */
  --navy: #0b2545;
  --navy-deep: #071a33;
  --navy-soft: #14355c;

  /* Signal amber: instrument backlight, a lifejacket, the marking on a chart
   * that means pay attention. ONE accent, spent in few places.
   *
   * D-93: amber is the brand accent and never means danger. Red is reserved for
   * something being wrong. A page that spends red on a button has nothing left
   * to say when a chain fails to verify. */
  /* Signal amber, warmed for the linen ground (REQ-016, direction C).
   *
   * #f0a137 on ivory is two neighbouring creams: the accent stopped reading as
   * an accent, and — the part that actually decides it — the focus ring fell to
   * 2.7:1 against the page, under NFR-90's 3:1 floor for a UI boundary. This
   * value clears 3.2:1 on the linen and 3.9:1 on the navy chrome, so one accent
   * still serves both grounds and the keyboard is never lost on either.
   *
   * The mark keeps its own navy: the app icon is unchanged and D-91 fixes the
   * chrome across all three surfaces. */
  --accent: #c07510;
  /* Near-black on the amber, in both themes: white on amber is the contrast
   * failure this token exists to prevent, and at 5.0:1 this clears the 4.5:1
   * floor a control label needs. */
  --accent-ink: #241300;

  /* Semantic, and separate from the accent on purpose (D-93). These three carry
   * meaning; they are never used for emphasis. */
  --ok: #1d6340;
  --warn: #7d4b08;
  --danger: #a02622;

  /* Neutrals with a deliberate blue bias, so grey next to the navy reads as
   * chosen rather than left over. */
  /* Linen and ink. The neutrals carry a warm bias so that grey next to the navy
   * reads as chosen rather than left over — the same argument the blue-biased
   * set made, pointed the other way. A page of ours should look like paper in a
   * navy binding, which is what a ship's book is. */
  --paper: #f4f1e9;
  --paper-2: #ebe6da;
  --ink: #1b1a16;
  --ink-2: #56514a;
  --line: #ddd5c4;

  /* The page's own ink and card, kept under names the navy chrome never
   * rebinds. Everything below reads --fg and --card, which are aliases of
   * these; a component that has to put the page's surface back — a menu
   * hanging off the navy bar — reads the --page-* names and gets the right
   * answer in both themes. Without them it can only hardcode the light
   * values, which is the dark-mode half of the same bug. */
  --page-fg: var(--ink);
  --page-fg-2: var(--ink-2);
  --page-rule: var(--line);
  --page-card: #fffdf8;
  --page-card-line: var(--line);

  --bg: var(--paper);
  --bg-alt: var(--paper-2);
  --fg: var(--page-fg);
  --fg-2: var(--page-fg-2);
  --rule: var(--page-rule);
  --card: var(--page-card);
  --card-line: var(--page-card-line);
  --field: #fffdf8;

  --sans: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto,
    "Helvetica Neue", Arial, sans-serif;
  --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas,
    "Liberation Mono", monospace;

  --wrap: 68rem;

  --radius-sm: 7px;
  --radius: 10px;
  --radius-lg: 14px;

  /* NFR-89, D-94: nothing a finger has to hit is smaller than this. It is a token
   * rather than a number repeated in six places so that raising it once raises
   * it everywhere — the failure mode is a control that shrank because somebody
   * tuned its padding. */
  --tap: 44px;
  /* Every control on every page is this tall — fields, selects and buttons
   * alike. One token, so a form cannot end up with two heights on one row.
   *
   * Written out rather than aliased to --tap, because every other alias in this
   * block is a colour and the contrast test resolves them as colours. It must
   * equal --tap all the same: that is D-94's floor, and TestEveryFieldIsOneHeight
   * fails if the two ever part company. */
  --control-h: 44px;

  /* The application shell (D-121). A token rather than a number in two sheets,
   * because the sidebar's width and the sheet's left edge are the same
   * measurement seen from two sides — and when they drift the page has a gutter
   * nobody meant to draw. */
  --side-w: 15rem;
}

/* Dark is a theme, not an afterthought: only the surface tokens move, and every
 * component below reads them, so nothing needs a second rule. A colour whose only
 * definition lives inside this block is the classic unreadable-page bug. */
@media (prefers-color-scheme: dark) {
  :root {
    /* Warm dark, and not the light theme inverted. C's whole argument is paper,
     * and paper at night is a warm dark room rather than a cold screen. The
     * navy chrome stays navy in both: it is the mark's own ground (D-91). */
    --bg: #14120e;
    --bg-alt: #1b1813;
    --page-fg: #f2ece1;
    --page-fg-2: #b7ac9b;
    --page-rule: #383029;
    --page-card: #201c16;
    --page-card-line: #38302a;
    --field: #1a1712;
    /* 9:1 on the dark ground; the light value would be a smudge here. */
    --accent: #eda93f;
    --accent-ink: #241300;
    --ok: #7fd3a4;
    --warn: #edc481;
    --danger: #ff8a80;
  }
}

/* --- base ----------------------------------------------------------------- */

*, *::before, *::after { box-sizing: border-box; }

html { -webkit-text-size-adjust: 100%; }

body {
  margin: 0;
  /* Explicit, always. A transparent body borrows whatever ground is behind it,
   * which on a phone in dark mode is how a page ends up with dark text on dark. */
  background: var(--bg);
  color: var(--fg);
  font-family: var(--sans);
  font-size: 17px;
  line-height: 1.6;
  text-rendering: optimizeLegibility;
  min-height: 100vh;
  /* dvh second, so a browser that has it uses it: on a phone 100vh is the
   * viewport with the address bar hidden, which leaves the footer pushed
   * below the fold on first paint. */
  min-height: 100dvh;
  display: flex;
  flex-direction: column;
}

h1, h2, h3, h4 {
  text-wrap: balance;
  line-height: 1.15;
  margin: 0;
  letter-spacing: -.015em;
  font-weight: 650;
}

h1 { font-size: clamp(1.75rem, 4.4vw, 2.6rem); }
h2 { font-size: clamp(1.35rem, 2.8vw, 1.8rem); }
h3 { font-size: 1.12rem; }
h4 { font-size: 1rem; }

p { margin: 0 0 1rem; }
p:last-child { margin-bottom: 0; }

a { color: inherit; text-underline-offset: 2px; text-decoration-thickness: 1px; }
a:hover { text-decoration-thickness: 2px; }

small { font-size: .86rem; line-height: 1.45; }

code, kbd, samp { font-family: var(--mono); }

/* One focus ring, everywhere, in the accent — so a keyboard is never lost on any
 * of the three surfaces. Amber clears 3:1 on both the navy chrome and the paper,
 * which is NFR-90's floor for a UI boundary. */
:focus-visible {
  outline: 3px solid var(--accent);
  outline-offset: 2px;
  border-radius: 2px;
}

.wrap {
  width: 100%;
  max-width: var(--wrap);
  margin-inline: auto;
  padding-inline: clamp(1rem, 4vw, 2rem);
}

.skip { position: absolute; left: -9999px; }
.skip:focus {
  left: 1rem;
  top: 1rem;
  z-index: 20;
  background: var(--accent);
  color: var(--accent-ink);
  padding: .5rem .75rem;
  border-radius: var(--radius-sm);
}

.lede { font-size: 1.06rem; color: var(--fg-2); max-width: 66ch; }
.fine { font-size: .88rem; color: var(--fg-2); max-width: 74ch; }

/* A certificate, read back exactly as the vessel froze it (D-184).
   `pre` rather than a paragraph on purpose: the wording is a statement somebody
   signed and the line breaks are theirs, so nothing here reflows it into
   prose it did not have. It wraps, because a phone is narrower than a sentence. */
.frozen {
  white-space: pre-wrap;
  font-family: inherit;
  font-size: .95rem;
  line-height: 1.5;
  max-width: 74ch;
  margin: 0 0 .75rem;
  padding: 1rem 1.1rem;
  border: 1px solid var(--card-line);
  border-radius: var(--radius);
  background: var(--card);
}
.note { margin: 0; font-size: .85rem; color: var(--fg-2); }

.eyebrow {
  font-family: var(--mono);
  font-size: .78rem;
  letter-spacing: .09em;
  text-transform: uppercase;
  color: var(--accent);
  margin: 0 0 .9rem;
}

.prose p { max-width: 68ch; color: var(--fg-2); margin-bottom: 1.05rem; }

/* --- the bar -------------------------------------------------------------- */
/*
 * The same navy bar carries the mark on all three surfaces. What sits to the
 * right of it changes — section links and two account actions on the public
 * pages, a name and a sign-out on the fleet — but the thing a person recognises
 * does not.
 */

.nav {
  position: sticky;
  top: 0;
  z-index: 5;
  flex: none;
  background: var(--navy);
  color: #fff;
  border-bottom: 1px solid rgba(255, 255, 255, .1);
}

/* Full width rather than centred on --wrap, because the bar now sits above a
 * sidebar: a centred bar over a flush sidebar puts the mark somewhere in the
 * middle of the page with the menu it belongs to underneath the gutter. */
.nav-in {
  display: flex;
  align-items: center;
  gap: .75rem;
  min-height: 68px;
  padding-inline: clamp(.75rem, 2vw, 1.25rem);
  padding-block: .45rem;
}

.mark {
  display: inline-flex;
  align-items: center;
  gap: .6rem;
  font-weight: 700;
  letter-spacing: .01em;
  text-decoration: none;
  color: #fff;
  margin-right: auto;
}
/* Half again the size it was, in an outlined tile (2026-08-24).
 *
 * At 34 px beside 17 px type the mark read as a favicon that had wandered into
 * the page — present, legible, and forgettable. The outline is what lets it grow:
 * the icon's own ground is the brand navy, so on the navy bar it was a dark
 * square on a dark bar and growing it only made the dissolve larger. A hairline
 * of the bar's own white at low alpha gives it an edge without introducing a
 * colour, so it stays inside the token vocabulary (D-91). */
.mark img {
  border-radius: 9px;
  display: block;
  outline: 1.5px solid rgba(255, 255, 255, .35);
  outline-offset: 1px;
}
.mark span { font-size: 1.18rem; }

/* An icon on its own is still something a finger has to hit, so it is a --tap
 * target with the glyph centred in it (D-94, NFR-89). The button is transparent
 * until it is pointed at: the bar has one amber action at most and a row of
 * boxes would compete with it (D-93). */
.iconbtn {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  min-width: var(--tap);
  min-height: var(--tap);
  padding: 0;
  background: transparent;
  border: 1px solid transparent;
  border-radius: var(--radius-sm);
  color: inherit;
  cursor: pointer;
}
.iconbtn:hover { background: rgba(255, 255, 255, .1); }
.nav .iconbtn { color: #fff; }

/* Every icon inherits the ink of the ground it stands on, which is how the same
 * markup works on the navy bar and on the paper sidebar without either carrying
 * a colour (see templates/icons.html). */
.ic { display: block; flex: none; }

/* The monogram, matching the boat's roster exactly — same letters, same colour,
 * from shared/monogram. White text on every palette entry clears 4.5:1. */
.avatar {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 34px;
  height: 34px;
  border-radius: 50%;
  color: #fff;
  font-family: var(--mono);
  font-size: .82rem;
  font-weight: 700;
  letter-spacing: .02em;
  flex: none;
}

.nav-links { display: flex; gap: 1.15rem; font-size: .92rem; flex-wrap: wrap; }
.nav-links a {
  color: rgba(255, 255, 255, .82);
  text-decoration: none;
  padding: .25rem 0;
  border-bottom: 2px solid transparent;
}
.nav-links a:hover { color: #fff; border-bottom-color: var(--accent); }

.nav-cta { display: flex; gap: .5rem; align-items: center; }

/* Who is signed in, on the fleet. */
.who { color: rgba(255, 255, 255, .75); font-size: .92rem; }
.nav .linkish { color: #fff; }

/* On a phone the section links are the first thing to go: the two account
 * actions are what somebody arriving on 390 px actually wants. */
@media (max-width: 46rem) {
  .nav-links { display: none; }
  .mark span { font-size: 1.05rem; }
  /* The name goes before the avatar does: the tile is the thing a person
   * recognises at a glance, and it costs 34 px where the name costs a third of
   * the bar. */
  .nav-cta .who { display: none; }
  .mark img { width: 42px; height: 42px; }
}

/* --- the navy ground ------------------------------------------------------ */
/*
 * The bar, the hero, the call-to-action band and the footer are the brand navy,
 * and text on them is white. Rather than every component carrying a second rule
 * for "but on navy", these four rebind the surface tokens for their subtree — so
 * a control dropped onto the hero inherits legible colours from the ground it is
 * standing on, exactly as it does on paper.
 *
 * This is not tidiness. Until 2026-08-19 the hero's secondary button read
 * `color: var(--fg)`, which is the paper ink: on the navy hero it was dark on
 * dark and the button was invisible. It was invisible only in light mode, which
 * is why it survived — in dark mode --fg is near-white and it looked correct.
 * Anything placed here later would have inherited the same bug.
 */
.nav, .hero, .cta-band, .band-navy, .foot {
  --fg: #ffffff;
  --fg-2: rgba(255, 255, 255, .72);
  --rule: rgba(255, 255, 255, .22);
  --card: transparent;
  --card-line: rgba(255, 255, 255, .22);
}

/* ...and back to paper, for the one thing that hangs off the navy bar without
 * standing on it.
 *
 * The account menu is a card that happens to be positioned inside .nav, so it
 * inherited white ink on a TRANSPARENT ground and rendered as ghost text over
 * whatever was behind it — the owner's screenshot of 2026-08-28. It is the hero
 * button of 2026-08-19 exactly, one surface along, and setting `color` on the
 * panel would not have fixed it: --card was transparent too.
 *
 * So a popover that carries the page's surface says so, and puts all five back
 * from the --page-* names, which no chrome rebinds. Anything else dropped on the
 * navy bar and meant to read as paper gets this class rather than a colour. */
.on-paper {
  --fg: var(--page-fg);
  --fg-2: var(--page-fg-2);
  --rule: var(--page-rule);
  --card: var(--page-card);
  --card-line: var(--page-card-line);
  color: var(--fg);
}

/* --- controls ------------------------------------------------------------- */

.btn, button, .button {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  gap: .5rem;
  /* min-height, not height: a control that has to wrap on a narrow phone must
   * grow rather than clip its own label. There is no width:100% rule here for
   * the same reason — a form that wants full-width buttons asks for it. */
  min-height: var(--tap);
  padding: .55rem 1.05rem;
  border-radius: var(--radius);
  border: 1px solid var(--rule);
  background: var(--card);
  color: var(--fg);
  font: inherit;
  font-weight: 600;
  font-size: .95rem;
  text-decoration: none;
  cursor: pointer;
}

.btn-primary, button.primary, .primary.button {
  background: var(--accent);
  border-color: var(--accent);
  /* Near-black on amber, in both themes. Amber is light, so white-on-amber is
   * the contrast failure this token exists to prevent. */
  color: var(--accent-ink);
}
.btn-primary:hover, button.primary:hover, .primary.button:hover { filter: brightness(1.07); }

/* Quiet sits on the navy chrome and only there. */
.btn-quiet {
  background: transparent;
  border-color: rgba(255, 255, 255, .35);
  color: #fff;
  min-height: 38px;
}
.btn-quiet:hover { border-color: #fff; }

.btn-ghost {
  background: transparent;
  border-color: var(--rule);
  color: var(--fg);
}
.btn-ghost:hover { border-color: var(--fg-2); }

.btn-lg { min-height: 50px; padding: .7rem 1.4rem; font-size: 1.02rem; }

/* A button that is really a link. Kept a real <button> because it submits a form
 * — a link that logs you out is a link a third-party page can pull. */
button.linkish {
  background: none;
  border: none;
  padding: 0;
  min-height: 0;
  color: var(--fg);
  font-weight: 500;
  text-decoration: underline;
  border-radius: 3px;
}
button.linkish.danger { color: var(--danger); }

form.inline { display: inline; }

/* --- fields --------------------------------------------------------------- */

.stack { display: flex; flex-direction: column; gap: 1.1rem; }
.stack label { display: flex; flex-direction: column; gap: .35rem; }
.stack label > span { font-weight: 600; font-size: .95rem; }
.stack small { color: var(--fg-2); }
.pair { display: flex; gap: 1rem; flex-wrap: wrap; }
.pair label { flex: 1 1 12rem; }

input[type=text], input[type=email], input[type=password], input[type=date],
input[type=search], input[type=tel], input[type=number], select, textarea {
  font: inherit;
  /* 16px minimum on the fields specifically: below it, iOS Safari zooms the page
   * on focus and does not zoom back out, which strands somebody mid-form on a
   * phone (D-94). This is the one place a font-size is a functional
   * requirement rather than a preference. */
  font-size: max(16px, 1rem);
  color: var(--fg);
  background: var(--field);
  border: 1px solid var(--rule);
  border-radius: var(--radius-sm);
  /* One EXPLICIT height for every control, not a height that falls out of
   * padding. It used to be `padding: .65rem .75rem; min-height: var(--tap)`,
   * and that produced two different heights on one form: an input grew to about
   * 48px because its padding and line-height together exceeded the floor, while
   * a select stayed at exactly 44px because every browser ignores vertical
   * padding on a native menulist. A row of fields where the drop-down is four
   * pixels shorter than the box beside it reads as a rendering fault, and it was
   * on every form in the service.
   *
   * --tap is the floor D-94 sets and this sits exactly on it: 44px, which is
   * also smaller than what was there, so the fields stop looking heavy. Never
   * below it — that is an accessibility decision, not a visual one. */
  height: var(--control-h);
  min-height: var(--control-h);
  padding: 0 .75rem;
  width: 100%;
}

/* A textarea is the one control that is deliberately not one row high. It keeps
 * the same horizontal padding so its text starts on the same line as every
 * field above it, and gets vertical padding back because its content wraps. */
textarea {
  height: auto;
  min-height: calc(var(--control-h) * 2);
  padding: .6rem .75rem;
  line-height: 1.5;
}
input:hover, select:hover, textarea:hover { border-color: var(--fg-2); }

/* A field that is filled in and cannot be changed has to look that way before
 * it is tapped. A readonly input styled like an editable one is a field people
 * try to correct and quietly fail to — the small print underneath explains why
 * it is fixed, and this is what makes them read it. */
input[readonly], textarea[readonly] {
  background: var(--card);
  color: var(--fg-2);
  cursor: default;
}
input[readonly]:hover, textarea[readonly]:hover { border-color: var(--rule); }

/* A boarding pass (D-153). Monospace and wrapped, because it is a hundred-odd
 * characters somebody selects whole and copies -- never reads, and never types.
 * Wide-tracked would make it longer to select and buys nothing: unlike a claim
 * code, no human ever transcribes one of these. */
textarea.pass {
  font-family: var(--mono, ui-monospace, SFMono-Regular, Menlo, monospace);
  font-size: 13px;
  line-height: 1.5;
  word-break: break-all;
}

/* --- notices -------------------------------------------------------------- */
/*
 * Every one of these says which specific thing is degraded, per REQ-001 §18's
 * habit — a banner that just says "warning" trains people to dismiss it. The
 * colour is on a left rule rather than a fill, so the text stays on the same
 * ground as the rest of the page and keeps its contrast in both themes.
 */

.notice {
  border: 1px solid var(--card-line);
  border-left: 3px solid var(--fg-2);
  background: var(--card);
  padding: .8rem 1rem;
  border-radius: var(--radius);
  margin: 0 0 1.4rem;
  font-size: .95rem;
}
.notice p { margin: 0 0 .4rem; }
.notice p:last-child { margin: 0; }
.notice.ok { border-left-color: var(--ok); }
.notice.warn { border-left-color: var(--accent); }
.notice.error { border-left-color: var(--danger); }

.callout {
  border-left: 3px solid var(--accent);
  background: var(--bg-alt);
  padding: .8rem 1rem;
  border-radius: 0 var(--radius) var(--radius) 0;
  max-width: 62ch;
  font-size: .96rem;
}

/* --- badges and tags ------------------------------------------------------ */

.badge, .tag {
  display: inline-block;
  font-family: var(--mono);
  font-size: .72rem;
  letter-spacing: .04em;
  text-transform: uppercase;
  padding: .22rem .5rem;
  border-radius: 999px;
  border: 1px solid var(--card-line);
  color: var(--fg-2);
  background: var(--card);
  white-space: nowrap;
}
.tag.warn { color: var(--warn); border-color: var(--warn); }

/* --- footer --------------------------------------------------------------- */

.foot {
  margin-top: auto;
  flex: none;
  background: var(--navy-deep);
  color: rgba(255, 255, 255, .72);
  padding: 2rem 0 2.5rem;
  font-size: .9rem;
}
.foot p { margin: 0 0 .5rem; max-width: 74ch; }
.foot b { color: #fff; }
.foot a { color: rgba(255, 255, 255, .8); }
.foot .fine { font-size: .82rem; color: rgba(255, 255, 255, .55); }

/* There is no motion in this design. If any is ever added, it stops here. */
@media (prefers-reduced-motion: reduce) {
  *, *::before, *::after {
    animation-duration: .01ms !important;
    animation-iteration-count: 1 !important;
    transition-duration: .01ms !important;
    scroll-behavior: auto !important;
  }
}

/* The vessel form's two halves — the sail number, and the engines (REQ-016 §5).
 *
 * A sailing vessel is asked for a sail number and a motor vessel for her
 * engines; neither is asked of the other, and neither is asked of a commercial
 * or research vessel at all. Doing that as the person changes the <select>
 * needs no script, which matters here more than anywhere: this service serves
 * exactly ONE script and a form field is not a reason to widen that (D-96,
 * D-63, R-94).
 *
 * It is guarded by @supports rather than written plainly, and that guard is the
 * whole safety of it. Without :has(), the two blocks would simply never match
 * their show rule and would stay hidden — so a browser too old for :has() would
 * silently drop two fields off the form and the owner would never know they
 * existed. Inside the guard, "too old" means "both halves are shown", which is
 * exactly what the page did before this rule and is a state the form already
 * handles: the store drops whichever half does not belong to the type on save.
 */
@supports selector(form:has(select)) {
  .only-sailing, .only-motor { display: none; }
  form:has(select[name="vessel_type"] option[value="sailing"]:checked) .only-sailing,
  form:has(select[name="vessel_type"] option[value="motor"]:checked) .only-motor {
    display: flex;
  }
}

/* The two ways in, on one sign-in card (REQ-009 §5.7, D-96 amended).
 *
 * A rule and a heading rather than two boxes side by side: they are not equal
 * choices. The passkey is above and is the better credential; the password is
 * below and is the one that works anywhere. Putting them level would say they
 * are the same, and they are not.
 */
.auth-rule {
  border: 0;
  border-top: 1px solid var(--rule);
  margin: 1.75rem 0 1.25rem;
}
.auth-h2 {
  font-size: 1rem;
  font-weight: 600;
  color: var(--fg-2);
  margin: 0 0 .75rem;
}

/* The offer to install the app (D-157, auth-layout.html "getapp").
 *
 * A panel on paper, so it takes its ink from the page and not from whatever
 * surface encloses it — `.on-paper` exists for exactly the ghost-text failure
 * that produced it, and this card is inside a centred auth card that could
 * change ground without this file being touched.
 *
 * The rule that matters is the last one: a page being viewed AS the installed
 * app must not offer to install itself. That is a media query and not a script,
 * so this service still serves exactly one (D-96, R-94). It is also the only
 * honest half of the question a browser can answer — whether THIS page is the
 * app. Whether the app exists on the device is not askable at all, which is why
 * the words say "get" rather than "you have not installed it".
 */
.getapp {
  margin: 1.75rem 0 0;
  padding: 1rem 1.1rem;
  border: 1px solid var(--card-line);
  border-radius: var(--radius, 10px);
  background: var(--card);
}
.getapp p { margin: 0 0 .6rem; }
.getapp p:last-child { margin-bottom: 0; }

@media (display-mode: standalone), (display-mode: minimal-ui) {
  .getapp { display: none; }
}

/* The boarding pass's square (D-174). White ground on purpose: a QR code needs
   contrast and a quiet zone, not a theme, and the officer reading it is holding
   a camera rather than looking at a page. */
.pass-square { background:#fff; padding:14px; border-radius:12px; width:max-content;
               max-width:100%; margin:14px 0 10px; }
.pass-square svg { display:block; width:240px; height:240px; max-width:60vw; max-height:60vw; }