Summary

• Collapse production Web UI var(--token, fallback) reads to root/component defaults so fallback governance is 0 / 0.
• Add generated widget payload governance so external legacy alias exposure is visible, budgeted, and checked for undefined keys, missing canonical targets, and canonical keys that are defined but not exported to the iframe payload.
• Refine the theme optimization document to mark stages 1-5 as covered by this PR and replace stale pending questions with reviewed compatibility policy.

Refs #1197

Key changes

• Moves fallback defaults for dynamic layout/theme inputs such as --scene-viewport-border-width, gallery sizing, --surface-stagger-index, --char-index, and Mission Control group colors into root/component variables while preserving inline/runtime overrides.
• Keeps widget payload compatibility stable, but now reports and baselines payload metrics: 326 payload keys, 64 explicit compatibility aliases, 17 legacy size-family keys, 0 undefined payload keys, 0 missing compatibility canonicals, and 0 unexported compatibility canonicals.
• Adds audit coverage for payload legacy family keys and defined-but-unexported canonical keys; this caught and fixed the missing canonical payload exports for --size-radius-2xl and --size-radius-full while keeping the legacy --radius-* keys available for generated/third-party content.
• Converts the same-domain exact duplicate --deep-review-consent-accent-strong-dark to alias --deep-review-consent-accent; cross-identity duplicates such as terminal/git/mission green and git/risk/lane orange remain separate to avoid semantic coupling.

Risk review

• Internal compatibility alias reads remain blocked at 0; generated widget payload aliases are treated as an external compatibility boundary instead of internal usage.
• Static/runtime token alignment remains clean: unresolved vars, fallback-only vars, runtime-only required vars, non-contract cross-file vars, and unregistered dynamic families are all 0.
• Dynamic family risk was reviewed: payload key checks require concrete definitions and now also require compatibility canonicals to be present in the payload allowlist.
• No user-visible color merge is introduced beyond one exact same-domain alias; near and indistinguishable component color pairs remain 0.

Verification

• git diff --check
• pnpm run theme:color-audit:test
• pnpm run theme:color-audit
• pnpm run theme:visual-contract
• pnpm run lint:web
• pnpm run type-check:web
• pnpm --dir src/web-ui run test:run
• pnpm run build:web