fix(contrast-audit): fail when the ruleset shrinks, not just when a theme fails

[itsdestin]

The gap

The contrast audit counted themes, never rules. Removing a check therefore made it quieter, not louder.

On 2026-07-22, PR #187 consolidated three hand-written contrast tables and dropped panel/canvas and on-destructive/destructive in the process. The audit went on printing All 11 themes pass while creme still shipped panel/canvas at 1.051 and all 11 themes shipped a danger label at 4.21:1. Two open bug entries cited repro commands that had silently stopped reproducing — the next person to check them would reasonably have closed them as already fixed.

The lesson was recorded in the ROADMAP at the time but never mechanized:

a consolidation that removes checks needs a before/after count of rules evaluated, because a shrinking rule set is invisible in a green run

What this adds

A green run must now also prove it checked.

• EXPECTED_RULES pins the per-tier table size (HARD 32 / SURFACE 6 / SOFT 3). Table size is a property of the ruleset, not the theme — a rule with a missing token still reports status: SKIP — so every theme must agree, and disagreement is itself an error.
• A rule skipped for every theme fails the run. This was the second way the incident hid: destructive/on-destructive were skipped for all themes because most packs never declare those tokens, so the audit was green and blind.
• The coverage line reports what actually ran, not what was expected. Printing the expected count during a coverage failure would be the same class of lie this guard exists to catch.

Verification — both directions

Clean run (exit 0):

coverage: 41 rules × 11 themes = 451 checks (HARD 32 / SURFACE 6 / SOFT 3)
All 11 themes pass HARD and SURFACE checks.

Reproducing the real incident — deleting the panel vs canvas rule (exit 1):

coverage: 40 rules × 11 themes = 440 checks (HARD 32 / SURFACE 5 / SOFT 3)

❌ COVERAGE FAILURE — this run did not check what it claims to check:
  - SURFACE: 5 rules evaluated, expected 6 — the ruleset has FEWER rules than when this floor was set

That same deletion printed All 11 themes pass before this change.

The vendored contrast-rules.js was restored byte-identical after the test (git diff --stat clean). No rule content changed in this PR — only the audit script.

Note for reviewers

EXPECTED_RULES is meant to be bumped deliberately when rules are added. A change that lowers it is the review conversation this guard exists to force.

wecoded-themes/scripts/audit-contrast.mjs is the CI-blocking sibling and has the same blind spot — worth the same treatment in a follow-up.

🤖 Generated with Claude Code