Summary

• migrate internal Web UI var(--legacy-alias) theme reads to canonical tokens across app, Flow Chat, tool cards, editor/widget, git, settings, and shared components
• keep legacy alias definitions/export paths for compatibility while lowering compatibility alias read budgets to zero
• add canonical --color-accent-500-rgb and keep --color-primary-rgb as a compatibility alias for generated widget payload and external CSS
• update theme optimization docs and visual governance contract to reflect the latest gcwing/main baseline and the new alias-read boundary

Verification

• pnpm run theme:color-audit:test
• pnpm run theme:color-audit
• pnpm run theme:visual-contract
• pnpm run lint:web
• pnpm run type-check:web
• pnpm --dir src/web-ui run test:run
• git diff --check
• compatibility legacy-key contract scan: unexpectedCount=0

Risk Review

• Visual output should remain equivalent because direct reads now resolve to the same canonical values as the preserved aliases.
• Legacy alias definitions remain in tokens.scss, runtime theme injection, generated widget payload, and widget shell fallback paths for old custom CSS/widget content.
• Generated widget host payload allowlist intentionally grows from 323 to 324 entries to expose --color-accent-500-rgb; the stability hash test was updated accordingly.