feat: accessibility pass, perf budget ci and submission docs

[salazarsebas]

What

Four issues in one pull request, because they share the same measurement setup and the same docs:

• Performance budget in CI (CI: enforce the performance budget #21). bun run perf now takes --json, exits 1 over budget, and a new perf workflow runs it in a pinned Chrome and uploads the report. The budgets live in client/scripts/budgets.ts, so code and docs/performance.md cannot disagree.
• Accessibility pass (Accessibility pass: reduced motion, focus order, announcements, contrast #19). An audit, the fixes it found, an automated check (bun run a11y, wired into a new a11y workflow), a contrast calculator (bun run contrast) and docs/accessibility.md with the keyboard walkthrough and the contrast table.
• Submission pack (Submission pack: README for a stranger, threat model and final checklist #25). A README a stranger can play from, docs/threat-model.md, and docs/submission-checklist.md.
• Delvers and the NFT standard (Delvers as standard tokens: verify the NFT standard and wallet visibility #23). docs/architecture/nft-standard.md compares the delver interface with SEP-0050 and the OpenZeppelin module, and the contract README lists the deviations. No contract code changes.

Why the accessibility fixes

The automated check found real problems, not only gaps in a list:

• Enter did the wrong thing on a focused control. The global key handler mapped Enter to Confirm and prevented the default, so tabbing to Vault and pressing Enter opened the creator. Controls reached with Tab now keep Enter and Space. A control that was only clicked does not (:focus-visible), so clicking Sound and carrying on still attacks with Enter. The check fails against the old handler with Enter on the focused Vault item opened "Forge your delver".
• Focus was lost on every screen change. Panels now move focus to their heading, the result to its outcome, and the title back to Forge a delver after Escape.
• Nothing was spoken during play. The run log is role="log", the floor label role="status", the health bar has a spoken value that includes the low state, and the canvas has a name.
• Reduced motion was incomplete. Screen shake, the low health heartbeat and a looping descent pulse ignored it. Four copies of the media query check are now one cached helper.
• Contrast and size. Input and chip borders were about 1.4:1 and are now 5.0:1 through a new --line-control token, the pending descent steps were 2.8:1, and the volume sliders and Sound toggle were under 44 px.
• Landmarks. One h1, a labelled Run status region, and the previews now mount inside the real shell so the check sees the same document the game has.

Findings worth a decision

• The testnet relic issuer is not locked. Horizon on 2026-10-10 shows a single signer with weight 1 on GAH27KP7..., while the contract README and the boundary doc said it was locked. The key holder can issue the assets by payment, outside the contract. I corrected those two documents and described it in the threat model. Locking is part of the release deployment in Mainnet readiness: release deployment, locked issuer and player funding #22.
• cargo test is green: 63 tests and the 600 vectors. The contract README said 400 vectors in one place, now corrected.
• The history has a merge titled add-toolkit-claude and .claude/ has 169 tracked files. Both are listed as open items in the checklist.

Verification

Run locally against the production build on 2026-10-10:

• bun run typecheck and bun run build: pass.
• bun run perf (laptop profile): 939 KB transferred, CLS 0, no long tasks, 16.8 ms p99 at 1x and 4x throttle, within budget. With 2.2 MB of noise appended to logo-lockup.webp it exits 1 with Cold load transfer is 3091 KB, budget is 1200 KB. The change was reverted.
• bun run a11y: eleven screens in desktop, 390 by 844 touch and reduced motion passes, plus the keyboard only run. No serious or critical findings, no control under 44 px, no looping animation with reduced motion. The first run found a failing slider size and a looping descent pulse, both fixed here.
• bun run contrast: every pair passes.
• gitleaks 8.30.1 over the full history: no leaks.

CI on this pull request: all four checks are green. The first run of perf failed, and that was useful: on a GitHub runner the 4x throttle gave a 49.9 ms p99 frame and a 126 ms load task for a build that holds 16.8 ms and no long task on the laptop. The runner has no GPU and a much slower CPU, so the throttle stacks on top of an already slow machine. Rather than loosen the laptop budgets, the harness now has two profiles, --profile=laptop (the default) and --profile=ci. The ci profile samples frames at 1x and allows a 200 ms task during load, and docs/performance.md explains why. Bytes and layout shift are identical in both. The green run measured 939 KB, a 68 ms longest task and a 16.8 ms p99 frame, so the longest task has a margin of about 3x and the frame time has none to spare against a 20 ms budget. Watch that number on the next few runs.

Not done

• Submission pack: README for a stranger, threat model and final checklist #25: the live link, the final human read for filler, the licence, the visibility flip and the laptop and phone verification need the owner. They are listed with status in docs/submission-checklist.md.
• Delvers as standard tokens: verify the NFT standard and wallet visibility #23: nothing was tested in Freighter or an explorer, so the wallet screenshot criterion is not met and no support is claimed. Implementing the interface is a contract change and is left for the release redeploy, with the recommendation in the note.
• Accessibility pass: reduced motion, focus order, announcements, contrast #19: the board is a canvas, so a screen reader hears the run log and not the layout, and nobody has driven the game with a real screen reader. Both are written down as limits.

Closes #21
Closes #19
Refs #25
Refs #23

Update, 2026-10-11

• The branch now includes the contract changes from feat: resume runs, soften the first descent and add contract admin #37 (admin and upgrade path, new testnet deployment with a locked issuer), merged in to resolve conflicts. Merge feat: resume runs, soften the first descent and add contract admin #37 first and this diff shrinks to the docs, CI and accessibility work.
• Docs now cite the new contract, asset and issuer ids, and the threat model has a section on the admin and what it means for trust.
• The repository uses a single Apache 2.0 LICENSE, and the contract crate declares Apache-2.0.
• Wallet specific wording was removed from the NFT standard note, the README and the checklist. Players never need an external wallet. The only open item for Delvers as standard tokens: verify the NFT standard and wallet visibility #23 is an explorer link.