The @font-face rules pointed at public/vendor/ibm-plex-mono, which
does not exist — log/unhandled has the 404 for all three woff2s — so
every page was already falling through to ui-monospace.

Assisted-by: Claude Opus 5 via Claude Code

diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index 51eed25..06e19f3 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -19,9 +19,12 @@ Pro-tacts makes *within* it. When the two disagree, Gloss wins.
 What that inheritance actually means:
 
 - Three stylesheets, in order: `tokens.css`, `base.css`, `components.css`. No
-  build step. IBM Plex Mono is the one webfont. Pro-tacts vendors its own copy
-  under `public/vendor/gloss` (see `rake gloss:vendor`) rather than depending
-  on Gloss at runtime.
+  build step. Pro-tacts vendors its own copy under `public/vendor/gloss` (see
+  `rake gloss:vendor`) rather than depending on Gloss at runtime.
+- No webfont. `--gl-font-mono` names IBM Plex Mono first and falls back
+  through `ui-monospace` to the platform's own, so the face is a preference
+  the browser honors when a reader has it rather than a download every page
+  waits on.
 - **Every value is a `var(--gl-*)`.** No hex, no duration, no px for type or
   rhythm anywhere in Pro-tacts' own CSS. Type is `--gl-step-*`, space is
   `--gl-space-*`, corners are `--gl-radius-sm|md|lg` (4/6/10px — nothing
diff --git a/lib/pro_tacts/admin/layout.rb b/lib/pro_tacts/admin/layout.rb
index 853c2e3..349e2e0 100644
--- a/lib/pro_tacts/admin/layout.rb
+++ b/lib/pro_tacts/admin/layout.rb
@@ -44,8 +44,14 @@ module ProTacts
             meta(charset: "utf-8")
             meta(name: "viewport", content: "width=device-width, initial-scale=1")
             title { "pro-tacts — #{@title}" }
-            link(rel: "preconnect", href: "https://fonts.googleapis.com")
-            link(rel: "stylesheet", href: "https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&display=swap")
+            # No webfont. --gl-font-mono names IBM Plex Mono first and
+            # falls back through ui-monospace to the platform's own
+            # (tokens.css), so a face this app does not ship is a
+            # preference the browser honors when the reader happens to
+            # have it, not a download. What was here before was a
+            # remote Google Fonts stylesheet, and the self-hosted
+            # woff2s meant to replace it were never added — the
+            # @font-face rules pointed at three files that 404ed.
             link(rel: "stylesheet", href: "/vendor/gloss/tokens.css")
             link(rel: "stylesheet", href: "/vendor/gloss/base.css")
             link(rel: "stylesheet", href: "/vendor/gloss/components.css")
diff --git a/public/admin.css b/public/admin.css
index 94c779c..3f1e39a 100644
--- a/public/admin.css
+++ b/public/admin.css
@@ -1,61 +1,3 @@
-/* IBM Plex Mono, self-hosted (the woff2s and their OFL license in
-   public/vendor/ibm-plex-mono). The font came from Google Fonts'
-   remote CSS with display=swap, which painted every page in the
-   fallback first — a flash of unstyled text, and a metric shift that
-   moved the record page's caption line and card between the details
-   and edit screens. Same-origin faces land with the page's own CSS,
-   so there is no swap window to speak of. The weights and the two
-   subsets are Google's own splits; the ranges are their
-   unicode-ranges verbatim. */
-@font-face {
-  font-family: "IBM Plex Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url("/vendor/ibm-plex-mono/ibm-plex-mono-400-latin.woff2") format("woff2");
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-@font-face {
-  font-family: "IBM Plex Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url("/vendor/ibm-plex-mono/ibm-plex-mono-400-latin-ext.woff2") format("woff2");
-  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-@font-face {
-  font-family: "IBM Plex Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url("/vendor/ibm-plex-mono/ibm-plex-mono-500-latin.woff2") format("woff2");
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-@font-face {
-  font-family: "IBM Plex Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url("/vendor/ibm-plex-mono/ibm-plex-mono-500-latin-ext.woff2") format("woff2");
-  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
-@font-face {
-  font-family: "IBM Plex Mono";
-  font-style: normal;
-  font-weight: 600;
-  font-display: swap;
-  src: url("/vendor/ibm-plex-mono/ibm-plex-mono-600-latin.woff2") format("woff2");
-  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-@font-face {
-  font-family: "IBM Plex Mono";
-  font-style: normal;
-  font-weight: 600;
-  font-display: swap;
-  src: url("/vendor/ibm-plex-mono/ibm-plex-mono-600-latin-ext.woff2") format("woff2");
-  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
-}
- 
 /* Light mode's page sits a hair under the card (#faf9f7 under
    #fdfdfb) — a step too fine to read as the contrast Gloss's surface
    system elevates by. The page takes the fill step instead: one
diff --git a/test/pro_tacts/admin/test_contacts_pages.rb b/test/pro_tacts/admin/test_contacts_pages.rb
index 9f4acee..60ca8c8 100644
--- a/test/pro_tacts/admin/test_contacts_pages.rb
+++ b/test/pro_tacts/admin/test_contacts_pages.rb
@@ -152,6 +152,27 @@ class AdminContactsPagesTest < Minitest::Test
     end
   end
 
+  # Every asset the layout asks for is this app's own. The webfont
+  # that used to be linked here came from Google, and the self-hosted
+  # faces meant to replace it were never added — the @font-face rules
+  # pointed at three files that 404ed. Both are gone, and
+  # --gl-font-mono falls through to the platform's own monospace.
+  # Alpine is vendored beside the Gloss CSS for the same reason (see
+  # tasks/alpine.rake): this app is reachable only over Tailscale.
+  def test_the_layout_asks_for_nothing_off_this_host
+    with_contacts({}) do
+      get "/"
+
+      head = last_response.body.split("</head>").first
+      refute_includes head, "fonts.googleapis.com"
+      refute_includes head, "fonts.gstatic.com"
+      refute_includes head, "ibm-plex-mono"
+      assert_includes head, '<script defer src="/vendor/alpine/alpine.min.js"></script>'
+      assert_empty head.scan(%r{(?:href|src)="(https?:)?//[^"]*"}),
+        "the layout links something off this host"
+    end
+  end
+
   # The search lives in the page header (docs/DESIGN.md), rendered by
   # the layout on every screen now — not just the dashboard's — so
   # the header's height never changes between pages and finding a