Leaf pages load only the engine their provider asks for: no Mapbox requests under MapLibre

A generated map leaf chose its engine at BUILD time and hard-linked it in <head>: mapbox-gl.css,
the geocoder css, mapbox-gl.js and the geocoder js from api.mapbox.com. The provider is chosen at
RUNTIME (profile-config.provider → ?provider= → window.MAP_PROVIDER), so a partner embedding a leaf
with ?provider=maplibre still had every visitor's browser make 4 requests to Mapbox.

- generate-tree: no static engine tags on map leaves; the element's own runtime loaders
  (ensureEngineScript / ensureEngineCSS, the geocoder's on-demand loader) load exactly the engine
  asked for, the path composite leaves already ran on. The forge page drops its api.mapbox.com
  preconnect. A leaf opened with provider=maplibre (same ladder as resolveMapProvider) is token-free,
  so the public copy no longer asks a MapLibre visitor to paste a Mapbox token.
- check:leaf-engine-per-provider (new, browser): every leaf at ?provider=maplibre makes 0 requests
  to *.mapbox.com and still draws; at its default every map leaf draws with the engine it drew with
  before (--baseline <tree> compares against another tree).
- check:dashboard-geocoder-provider is wired into gates:post alongside it; it had been held out
  because this generator's tags made it red.
- verify-map-paint: optional GATE_VIEWPORT for a phone pass.

Measured before this landing (browser runs made before the headless rule): leaf-engine vs main's
tree PASS, 56 leaves, 0 Mapbox requests under MapLibre, same default engine. Pins, region popup,
PPLR search and key-cities PASS on both engines with 0 Mapbox requests under MapLibre. RTL shaping
PASS on both engines wherever RTL labels rendered. Paint under MapLibre: the same 4 leaves fail as
on main (country-posters-mfe, upg-100-mfe, regions-mfe, flower-mesh). Pre-existing, not caused here.
Poster "Render" is missing on country-posters and doxa-research-map under BOTH engines. Pre-existing
on main, read from source: countries-map.vue renders <PosterDialog v-if="showPoster"> without
v-model or getMap, and PosterDialog shows only when modelValue is true.
Headless, on this commit's regenerated tree: 57 leaves, 0 carry api.mapbox.com engine tags (main's
doxa-simple-map leaf carried 5), 56 carry the runtime provider check, check:sri PASS.

internal/check-leaf-engine-per-provider.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+/**
+ * check-leaf-engine-per-provider — a leaf loads the engine its PROVIDER asks for, and no other.
+ *
+ * THE BUG (card BUG-LEAF-PAGES-PRELOAD-MAPBOX-EVEN-UNDER-MAPLIBRE; measured by exp-shepherd at
+ * 577149af). generate-tree chose a leaf's engine peer at BUILD time, from the instance config, and
+ * baked it into <head> as static tags: mapbox-gl.css, the geocoder css, mapbox-gl.js and the geocoder
+ * js, all from api.mapbox.com. The provider is chosen at RUNTIME (resolveMapProvider:
+ * profile-config.provider → ?provider= → window.MAP_PROVIDER → mapbox). So a partner that embeds a
+ * leaf with ?provider=maplibre still made its visitors' browsers fetch 4 files from Mapbox, sending
+ * every visitor's IP to a company the partner chose not to use. No project rule permits that.
+ *
+ * WHAT IS ASSERTED, on THIS checkout's served tree (every leaf in the manifest, instances included):
+ *   MAPLIBRE  every leaf at ?provider=maplibre makes ZERO requests to any *.mapbox.com host; a MAP
+ *             leaf must also still draw (a canvas with a live GL context, window.maplibregl defined),
+ *             so a fix cannot pass by breaking the map.
+ *   DEFAULT   every MAP leaf at its default still DRAWS, with the SAME engine it drew with before.
+ *             The engine is read from the canvas that drew (mapboxgl-canvas / maplibregl-canvas), not
+ *             from which globals exist: some leaves are MapLibre by design (prayer-walk-planner, the
+ *             ".../maplibre" instances), and a peer that merely loaded Mapbox proves nothing.
+ *   --baseline <tree root>  measures that tree too (e.g. main, with the static peer) and requires, per
+ *             leaf: the default pass draws with the baseline's engine, and the maplibre pass draws with
+ *             MapLibre wherever the baseline drew a map at all. Without it, a map leaf must simply draw.
+ * Paint here is a floor, not the verdict on looks: verify-map-paint and check:gospel-map-paints judge
+ * the map itself.
+ *
+ * USAGE  node internal/check-leaf-engine-per-provider.mjs [--dir <tree root>] [--only a/b,c/d]
+ *        Run through internal/browser-slot.sh.
+ *        @browser-slot-max-hold 2700
+ * EXIT   0 pass · 1 a leaf calls Mapbox under maplibre, or a map stopped drawing · 75 not measured.
+ */
+import { chromium } from 'playwright'
+import { spawn } from 'node:child_process'
+import { createServer } from 'node:http'
+import { readFileSync, existsSync } from 'node:fs'
+import { resolve, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { TREE_NAME } from './_tree-name.mjs'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const argv = process.argv.slice(2)
+const arg = (k, d) => { const i = argv.indexOf(k); return i >= 0 && argv[i + 1] ? argv[i + 1] : d }
+const DIR = resolve(arg('--dir', resolve(ROOT, 'public')))
+const ONLY = arg('--only', '') ? new Set(arg('--only', '').split(',')) : null
+const BASELINE = arg('--baseline', '') ? resolve(arg('--baseline', '')) : null
+const CONCURRENCY = 3
+const MAPBOX_HOST = /(^|\.)mapbox\.com$/i
+
+const manifestPath = join(DIR, TREE_NAME, 'manifest.json')
+if (!existsSync(manifestPath)) { console.log(`LEAF-ENGINE: NOT MEASURED — no ${manifestPath}`); process.exit(75) }
+const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+const leaves = []
+for (const b of manifest.bundles || []) for (const p of b.profiles || []) {
+  const base = `${b.bundle}/${p.profile}`
+  const add = (id) => { if ((!ONLY || ONLY.has(id)) && existsSync(join(DIR, TREE_NAME, id, 'index.html'))) leaves.push({ id, isMap: !!p.isMap }) }
+  add(base)
+  for (const inst of p.instances || []) add(`${base}/${inst.id}`)
+}
+if (!leaves.length) { console.log('LEAF-ENGINE: NOT MEASURED — no leaves matched'); process.exit(75) }
+
+async function serve(dir) {
+  const port = await new Promise((ok) => { const s = createServer().listen(0, '127.0.0.1', () => { const n = s.address().port; s.close(() => ok(n)) }) })
+  const srv = spawn(process.execPath, [resolve(ROOT, 'internal/serve-strict.mjs'), '--port', String(port), '--directory', dir], { stdio: 'ignore' })
+  let up = false
+  for (let i = 0; i < 40 && !up; i++) { await new Promise((r) => setTimeout(r, 150)); up = await fetch(`http://127.0.0.1:${port}/${TREE_NAME}/manifest.json`).then((r) => r.ok).catch(() => false) }
+  if (!up) { try { srv.kill() } catch { /* gone */ } return null }
+  return { port, stop: () => { try { srv.kill() } catch { /* already gone */ } } }
+}
+const cur = await serve(DIR)
+const base = BASELINE ? await serve(BASELINE) : null
+const stop = () => { cur && cur.stop(); base && base.stop() }
+if (!cur || (BASELINE && !base)) { stop(); console.log(`LEAF-ENGINE: NOT MEASURED — could not serve ${!cur ? DIR : BASELINE}`); process.exit(75) }
+
+// A drawn map: a canvas, somewhere down the shadow roots, with a live WebGL context.
+const DRAWN = `(() => {
+  const canvases = []
+  const walk = (r) => { for (const e of r.querySelectorAll('*')) { if (e.tagName === 'CANVAS') canvases.push(e); if (e.shadowRoot) walk(e.shadowRoot) } }
+  walk(document)
+  const drawing = canvases.filter((c) => { if (c.width < 50 || c.height < 50) return false
+    const gl = c.getContext('webgl2') || c.getContext('webgl'); return !!gl && !gl.isContextLost() })
+  const engines = [...new Set(drawing.map((c) => c.classList.contains('maplibregl-canvas') ? 'maplibre' : c.classList.contains('mapboxgl-canvas') ? 'mapbox' : 'other'))].sort()
+  return { canvases: canvases.length, live: drawing.length > 0, engine: engines.join('+') || 'none', mapboxgl: !!window.mapboxgl, maplibregl: !!window.maplibregl }
+})()`
+
+const browser = await chromium.launch({ args: ['--use-gl=swiftshader', '--enable-webgl', '--ignore-gpu-blocklist'] })
+async function load(srvPort, id, provider) {
+  const ctx = await browser.newContext({ viewport: { width: 1280, height: 860 } })
+  const page = await ctx.newPage()
+  const mapboxReqs = []
+  page.on('request', (r) => { try { if (MAPBOX_HOST.test(new URL(r.url()).hostname)) mapboxReqs.push(r.url()) } catch { /* data: etc */ } })
+  const url = `http://127.0.0.1:${srvPort}/${TREE_NAME}/${id}/index.html${provider === 'maplibre' ? '?provider=maplibre' : ''}`
+  try {
+    await page.goto(url, { waitUntil: 'load', timeout: 45000 })
+    await page.waitForLoadState('networkidle', { timeout: 20000 }).catch(() => {})
+    let d = null
+    for (let i = 0; i < 30; i++) { d = await page.evaluate(DRAWN).catch(() => null); if (d && d.live) break; await page.waitForTimeout(500) }
+    await page.waitForTimeout(1500)            // late requests (a lazily injected geocoder) still count
+    return { ...d, mapboxReqs: [...mapboxReqs] }
+  } catch (e) { return { error: String(e.message || e).split('\n')[0], mapboxReqs: [...mapboxReqs] } }
+  finally { await ctx.close() }
+}
+
+const rows = []
+const queue = leaves.slice()
+await Promise.all(Array.from({ length: CONCURRENCY }, async () => {
+  while (queue.length) {
+    const L = queue.shift()
+    const ml = await load(cur.port, L.id, 'maplibre')
+    const mb = L.isMap ? await load(cur.port, L.id, 'default') : null
+    const bl = base && L.isMap ? await load(base.port, L.id, 'default') : null
+    const problems = []
+    if (ml.error) problems.push(`maplibre load: ${ml.error}`)
+    if (ml.mapboxReqs.length) problems.push(`${ml.mapboxReqs.length} Mapbox request(s) under maplibre: ${[...new Set(ml.mapboxReqs.map((u) => new URL(u).pathname.split('/').slice(0, 3).join('/') || u))].slice(0, 3).join(', ')}`)
+    if (mb && mb.error) problems.push(`default load: ${mb.error}`)
+    if (bl && bl.error) problems.push(`baseline load: ${bl.error}`)
+    // What SHOULD draw: with a baseline, whatever drew there; without one, a map leaf draws something.
+    const baselineDrew = bl ? bl.live : (L.isMap ? true : false)
+    if (L.isMap && !ml.error && baselineDrew && !(ml.live && ml.engine.includes('maplibre'))) problems.push(`under maplibre the map does not draw with MapLibre (drew: ${ml.engine})`)
+    if (mb && !mb.error) {
+      if (bl && !bl.error) {
+        if (mb.engine !== bl.engine) problems.push(`the DEFAULT path changed engine: before ${bl.engine}, now ${mb.engine}`)
+      } else if (!mb.live) problems.push('the DEFAULT path draws no map')
+    }
+    rows.push({ id: L.id, isMap: L.isMap, mlReqs: ml.mapboxReqs.length, def: mb ? mb.engine : '', was: bl ? bl.engine : '', problems, unmeasured: !!(ml.error || (mb && mb.error) || (bl && bl.error)) })
+  }
+}))
+await browser.close(); stop()
+
+rows.sort((a, b) => a.id.localeCompare(b.id))
+console.log(`LEAF-ENGINE: ${rows.length} leaves (${rows.filter((r) => r.isMap).length} maps) on ${DIR}${BASELINE ? ` — baseline ${BASELINE}` : ''}`)
+for (const r of rows) console.log(`  ${r.problems.length ? (r.unmeasured ? '??  ' : 'FAIL') : 'ok  '}  ${r.id.padEnd(46)} ${r.isMap ? 'map ' : '    '} mapbox reqs under maplibre: ${String(r.mlReqs).padStart(2)}${r.def ? `  default draws: ${r.def}${r.was ? ` (was ${r.was})` : ''}` : ''}${r.problems.length ? '  — ' + r.problems.join('; ') : ''}`)
+const fails = rows.filter((r) => r.problems.length && !r.unmeasured)
+if (fails.length) {
+  console.log(`LEAF-ENGINE: FAIL — ${fails.length} leaf/leaves: under ?provider=maplibre they still call Mapbox, or a map stopped drawing.`)
+  process.exit(1)
+}
+if (rows.some((r) => r.unmeasured)) { console.log('LEAF-ENGINE: NOT MEASURED — a leaf did not load.'); process.exit(75) }
+console.log(`LEAF-ENGINE: PASS — no leaf calls Mapbox under maplibre; every map draws with MapLibre under maplibre and with ${BASELINE ? 'the same engine as the baseline' : 'an engine'} by default.`)

internal/generate-tree.mjs

@@ -615,7 +615,6 @@ function forgeHtml(o) {
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>${esc(o.title)}</title>
   <link rel="icon" href="data:,">
-  <link rel="preconnect" href="https://api.mapbox.com" crossorigin />
   <style>${FORGE_CSS}</style>
 </head>
 <body>
@@ -798,13 +797,14 @@ function mapPageHtml(opts) {
   <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin />
   <link href="https://cdn.jsdelivr.net/npm/maplibre-gl@5/dist/maplibre-gl.css" rel="stylesheet" />
   <script src="https://cdn.jsdelivr.net/npm/maplibre-gl@5/dist/maplibre-gl.js"></script>`
-    : `<!-- Mapbox peer loaded ONCE here; the map custom element mounts in this page and
+    : `<!-- NO STATIC ENGINE TAGS (2026-09-25). This leaf used to hard-link mapbox-gl.css, the
-       uses window.mapboxgl directly (same realm → no cross-realm container errors). -->
+       geocoder css, mapbox-gl.js and the geocoder js from Mapbox's CDN, chosen at BUILD time —
-  <link rel="preconnect" href="https://api.mapbox.com" crossorigin />
+       so a partner embedding it with ?provider=maplibre still sent every visitor's IP to Mapbox
-  <link href="https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.css" rel="stylesheet" />
+       (4 requests per leaf, measured). The provider is chosen at RUNTIME (profile-config.provider
-  <link href="https://api.mapbox.com/mapbox-gl-js/plugins/mapbox-gl-geocoder/v5.0.0/mapbox-gl-geocoder.css" rel="stylesheet" />
+       → ?provider= → window.MAP_PROVIDER → mapbox), and the element's own runtime loaders load
-  <script src="https://api.mapbox.com/mapbox-gl-js/v3.24.0/mapbox-gl.js"></script>
+       exactly that engine: ensureEngineScript / ensureEngineCSS (useMapInstance) and the
-  <script src="https://api.mapbox.com/mapbox-gl-js/plugins/mapbox-gl-geocoder/v5.0.0/mapbox-gl-geocoder.min.js"></script>`
+       geocoder's on-demand loader — the path composite leaves already run on. Gate:
+       check:leaf-engine-per-provider (0 Mapbox requests under maplibre; Mapbox unchanged). -->`
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -868,7 +868,11 @@ ${apiScript}
       var BASE_CONFIG = ${JSON.stringify(pageConfig)};
       // MapLibre map pages AND shell pages (app-shell / nested-mfe-spa) need NO token:
       // the ladder below is skipped entirely and the element mounts immediately.
-      var TOKEN_FREE = ${JSON.stringify(tokenFree)};
+      // …and a Mapbox leaf opened with provider=maplibre (config, ?provider= or window.MAP_PROVIDER —
+      // the same ladder as resolveMapProvider) needs no Mapbox token either: without this, the public
+      // copy (no baked token) asked a MapLibre visitor to paste a Mapbox token it would never use.
+      var RUNTIME_PROVIDER = String((BASE_CONFIG && BASE_CONFIG.provider) || new URLSearchParams(location.search).get('provider') || window.MAP_PROVIDER || 'mapbox').toLowerCase();
+      var TOKEN_FREE = ${JSON.stringify(tokenFree)} || RUNTIME_PROVIDER === 'maplibre';
       // A token-free COMPOSITE still nests plugins, and a nested Mapbox map reads window.MAP_TOKEN
       // rather than this page's profile-config. With no baked token (the public copy), it must get
       // one from ?tk= or a pasted token, or be asked for one — see the rungs below.

internal/verify-map-paint.mjs

@@ -166,10 +166,12 @@ const splitErrors = (lines) => {
   return { env, real }
 }
 
+// Opt-in viewport for a phone pass (GATE_VIEWPORT=390x844); the default is unchanged.
+const GATE_VIEWPORT = (() => { const m = /^(\d+)x(\d+)$/.exec(process.env.GATE_VIEWPORT || ''); return m ? { width: +m[1], height: +m[2] } : null })()
 let bad = 0
 for (const url of urls) {
   const name = url.split(`/${TREE_NAME}/`)[1] || url
-  const page = await browser.newPage({ viewport: { width: 1280, height: 800 } })
+  const page = await browser.newPage({ viewport: GATE_VIEWPORT || { width: 1280, height: 800 } })
   const errors = []
   // ⚠ THE STYLESHEET COMPLAINT IS A WARNING, NOT AN ERROR, so filtering to type()==='error' above
   // meant this gate could never see it. Mapbox emits "This page appears to be missing CSS

package.json

@@ -39,6 +39,7 @@
     "check:coverage-consistent:poison": "node internal/check-gospel-coverage-consistent.mjs --poison",
     "check:csv-shape": "node internal/check-csv-export-shape.mjs",
     "check:csv-shape:self-test": "node internal/check-csv-export-shape.mjs --self-test",
+    "check:dashboard-geocoder-provider": "node plugin-designs/research-dashboard/scripts/check-dashboard-geocoder-provider.mjs",
     "check:deck-click": "node internal/check-deck-click.mjs",
     "check:dep-names": "node internal/check-dependency-names.mjs",
     "check:descriptions": "node internal/check-profile-descriptions.mjs",
@@ -87,6 +88,7 @@
     "check:i18n-parity": "node internal/check-i18n-parity.mjs",
     "check:kpi-unit": "node internal/check-kpi-unit-once.mjs",
     "check:label-joins": "node internal/check-label-joins.mjs",
+    "check:leaf-engine-per-provider": "node internal/check-leaf-engine-per-provider.mjs",
     "check:leaf-english-leaks": "node internal/check-leaf-english-leaks.mjs",
     "check:leaf-english-leaks:self-test": "node internal/check-leaf-english-leaks.mjs --self-test",
     "check:leaves-mount": "node internal/check-gospel-leaves-mount.mjs",
@@ -180,7 +182,7 @@
     "dev": "bun x vite",
     "fix:sri": "node internal/fix-sri.mjs",
     "gallery": "node internal/generate-gallery.mjs",
-    "gates:post": "node internal/run-parallel.mjs --label=post -- check:drop check:parse verify check:sri check:public-hygiene check:label-joins check:facet-cascade check:facet-one-field check:heartbeat check:kpi-unit check:composite-reg check:descriptions check:no-abs-paths check:no-codename check:dep-names check:composite-srcs check:embed-targets check:nested-token check:i18n-parity check:tabs-localized check:packets-all check:packet-strings-parity check:zone-census check:share-policy check:library-index check:csv-shape check:capability-citations check:catalog-identity check:no-orphan-gates check:quoted-scripts check:done-evidence check:script-flags check:backlog-status check:capability-exemplars check:packet-fixture check:packet-browser check:provider-switch check:locale-reachable check:url-resolver check:manifest-covers check:one-palette check:pin-dim-slider check:legend-source check:backlog-refs check:clustering-modes check:composite-embed-knobs check:composite-locale-leaks check:linked-vocabulary check:wp-embed",
+    "gates:post": "node internal/run-parallel.mjs --label=post -- check:drop check:parse verify check:sri check:public-hygiene check:label-joins check:facet-cascade check:facet-one-field check:heartbeat check:kpi-unit check:composite-reg check:descriptions check:no-abs-paths check:no-codename check:dep-names check:composite-srcs check:embed-targets check:nested-token check:i18n-parity check:tabs-localized check:packets-all check:packet-strings-parity check:zone-census check:share-policy check:library-index check:csv-shape check:capability-citations check:catalog-identity check:no-orphan-gates check:quoted-scripts check:done-evidence check:script-flags check:backlog-status check:capability-exemplars check:packet-fixture check:packet-browser check:provider-switch check:locale-reachable check:url-resolver check:manifest-covers check:one-palette check:pin-dim-slider check:legend-source check:backlog-refs check:clustering-modes check:composite-embed-knobs check:composite-locale-leaks check:linked-vocabulary check:wp-embed check:dashboard-geocoder-provider check:leaf-engine-per-provider",
     "gates:pre": "node internal/run-parallel.mjs --label=pre -- check:template-literal check:mjs-parse check:sfc-parse check:tab-radius check:synced-css check:doc-scripts",
     "library-index": "node internal/generate-library-index.mjs",
     "packet-fixture": "node internal/generate-packet-fixture.mjs",
@@ -243,6 +245,7 @@
     "check:composite-locale-leaks": "a composite rendered in a non-English locale must not show a string the catalogue already translates. The criterion is a LOOKUP, not a category: English catalogue holds the string as a value, this locale holds a different value for that key, the page still renders English. The previous sweep split strings into chrome/data/third-party and scored single words like 'Region' and 'Prayer' as data, so 28 leaks on Big Picture and 41 on Simple Research counted as zero. Surfaces that a lookup cannot judge - vendor map chrome, table DATA cells, facet-rail values - are suppressed by NAME with a stated reason, never by word.",
     "check:coverage-consistent": "the gospel-resources surfaces must agree: no resource on an ISO RESERVED code (und/mul/mis/zxx), every resourced code NAMED, table reach recounted off the pins, no invented URL, tiers reconcile. Static, sub-second. Self-test: `bun run check:coverage-consistent:poison`, all 12 clauses (A-L) must fail. Clause L is the one that is not about consistency: it fails when the link-verification record goes stale, because 'link checked' is a claim about the present tense. Written after the same drift defect was found by hand three times.",
     "check:csv-shape": "the export must OPEN as a table: header on line 0, every row matching. Run the `check:csv-shape:self-test` script for the NEGATIVE test (forces the provenance comment back to line 0 IN MEMORY and requires this gate to REJECT it) — the header used to claim 'NEGATIVE-TESTED' with no way to re-run it.",
+    "check:dashboard-geocoder-provider": "the research dashboard leaf at ?provider=maplibre makes ZERO requests to api.mapbox.com, and its search bars still suggest (built tree; browser gate). It was kept out of gates:post while the generated leaf hard-linked the Mapbox engine; the leaf now loads only the engine it is asked for.",
     "check:dep-names": "every declared dep is a REAL package name (a rename once rewrote @capacitor/* and broke bun install in a clone)",
     "check:descriptions": "every shipped profile must say what it is (reads the BUILT manifest)",
     "check:done-evidence": "a card may not reach status:done with NO bluf AND NO fields — the Doxa team inherits this board and an evidence-less 'done' cannot be reconciled against the code. 10 pre-existing are baselined by id; the list should only ever SHRINK.",
@@ -273,6 +276,7 @@
     "check:heartbeat:self-test": "THREE regression cases, each required to fire ITS OWN assertion: [literal] resolver replaced by the old hard-coded array -> B; [shipped-default] dashboard.config.js heartbeatThreshold changed -> A2; [shipped-mode] heartbeatMode flipped to quantile -> A2. Poisons IN MEMORY, never the file. Testing that the FEATURE works is not testing that the REGRESSION is caught — this gate shipped with only the first and missed the second.",
     "check:host-locale-contract": "a HOST's profile-config.locale reaches every leaf: each leaf page is loaded with ONLY \"locale\":\"ar\" added to its profile-config (no ?lang=, the page keeps lang=\"en\") and must draw at least half the Arabic text the same page draws at ?lang=ar. regions-dashboard/regions-list is the positive control (NOT MEASURED if it does not enter Arabic). Guards ProfileLoader's inject('appI18n'): a bundle that never provides appI18n silently ignores the host. --dir <tree> for a before/after, --only a/b,c/d to narrow. Through browser-slot.sh.",
     "check:i18n-never-translated": "a key PRESENT in all 11 catalogs but IDENTICAL in all of them is copied, not translated. check:i18n-parity asserts presence; presence and translatedness are different properties. Carries an allowlist for keys correctly identical everywhere (pure format strings, brand names, ISO designations) — each with a reason, so the list records decisions rather than silencing findings.",
+    "check:leaf-engine-per-provider": "every leaf in the manifest at ?provider=maplibre makes ZERO requests to any *.mapbox.com host and a map leaf still draws; at its default every map leaf draws with the engine it drew with before (read from the canvas that drew). --baseline <tree> compares against another tree (e.g. main). Browser gate, @browser-slot-max-hold 2700.",
     "check:leaves-mount": "DID THE ELEMENT ACTUALLY MOUNT, on all five gospel leaves. Exists because a ReferenceError thrown during setup dies INSIDE the custom-element boundary: the page loads, every asset returns 200, pageerror fires zero times, and the element sits there with an empty shadow root. A healthy-looking dead page. This asks the cheap unambiguous question the rich gates are too slow to ask on every leaf — is anything there — in five steps that each name their own failure: tag defined, host present, shadowRoot attached, shadow root non-empty, visible text rendered. It does NOT trust the absence of console errors; zero errors is not the same as working. --poison for the negative test.",
     "check:legend-export-reachable": "the Export affordance must be reachable at BOTH widths. Selects a leaf row first (the control is gated on selectedNode) and opens the mobile sheet first (it starts closed). Asserts a REAL BOX, not CSS visibility — on mobile the elements report visibility:visible at 0x0. PASSES at both widths since the mobile sheet was given :export-enabled and :tabs. SKIPs when nothing is served.",
     "check:legend-source": "the numbers the maps SHOW must match the numbers the live SOURCE has. Every other gate checks INTERNAL consistency — a page can agree with itself perfectly while its legend has stopped describing reality. Offline SKIPs (exit 0); only a reachable endpoint that disagrees fails.",

plugin-designs/research-dashboard/scripts/check-dashboard-geocoder-provider.mjs

@@ -17,8 +17,9 @@
  *
  * i.e. the leaf ships Mapbox GL and the Mapbox geocoder to every visitor regardless of the engine
  * it was asked for. That is the leaf GENERATOR's doing, not this plugin's, and it is why this gate
- * is deliberately NOT wired into gates:post yet: it would be a red gate about somebody else's file.
+ * was kept out of gates:post until the generator stopped hard-linking the engine (2026-09-25: the leaf
- * Run it by name; it names the exact URLs.
+ * now loads only the engine its provider asks for). It is wired into gates:post in that same landing,
+ * and still names the exact URLs when it fails.
  *
  * ★ ZERO IS THE ASSERTION, not "it rendered". A build that quietly kept the Mapbox geocoder would
  * look identical: the bars appear, suggestions work, nothing errors. Only the request log tells the