T3.1 - C3/S5: inventory the token systems, and correct the accent baseline

Produces docs/reference/tokens.md. No stylesheet is touched; T3.1 is inventory.

What the inventory found that the plan did not say:

- It is six stylesheets plus the launcher's inline <style>, not four (D1 again).
  202 custom-property declarations, all listed with file and line.
- The wave 0 accent baseline is wrong: 15 declarations across 5 sheets, not 14
  across 4. console.css:13 packs five declarations onto one line and the
  baseline's `^\s*--` regex only ever matches the first, so console's own
  --accent was never counted. Corrected command is in tokens.md section 10.
  The wave 9 target of one sheet is unchanged; there is one more to remove.
- Three mono stacks, not two. The file map recorded console.css dropping
  ui-monospace and Segoe UI Mono; wp-chrome.css:159,221 is a third stack that
  drops Cascadia Mono and Segoe UI Mono.
- --shadow-lg does not differ by blur, as the file map says. Both are
  0 4px 16px. The difference is the colour: rgba(0,0,0,.16) against
  rgba(20,30,50,.12). That means they can be unified later with no layout
  consequence at all.
- Twelve var() fallbacks can never fire, because the token they fall back from
  is declared at :root on a sheet the page loads. Free deletions for T3.2.
- --shadow: none is a no-op token with 8 consumers. Left for T3.3, which is
  hunting exactly this class of silent nothing.
- 111 var() references live in .js files across 23 token names. A rename there
  fails silently - no build error, no console warning, just an unstyled
  element. Section 9 is the list to grep before deleting any alias.
- There is a second brand blue: #2563d6, filling .sop-inherited at 7% alpha on
  every field a work package inherited from its SOP. Logged as BL-008.

The document states one rule up front, because it is the difference between a
clean wave 3 and a broken one: consolidation is not unification. Where two
sheets declare the same value, T3.2 collapses them. Where they declare
different values for the same role - the two banner greens, the three error
borders, the two shadows - each value gets its own canonical name and the pair
is recorded. Picking a winner between two near-identical greys is a visual
change, which T3.2 forbids.

Section 8 computes the near-duplicates rather than eyeballing them. The one to
watch is the zebra stripe: console's #fafafa sits six points from #f4f4f4, and
collapsing them erases the striping on the nine-column user table.

New backlog entries: BL-004 (help.js ships 52 colours in a different design
language), BL-005 (two modals styled entirely by inline style= attributes),
BL-006 (17 half-pixel font sizes), BL-007 (--radius: 0 contradicted 45 times in
the sheet that declares it), BL-008 (the second blue).

One decision T3.2 needs and this task cannot make: adopting the superset mono
stack changes the rendered face on machines that have Segoe UI Mono or
ui-monospace but not IBM Plex Mono, which is most of the target environment.
That is a real change on admin and users. Either accept it and re-shoot those
two baselines - capturing twice, since they are not byte-stable - or keep
console.css's narrower stack as a second token until T3.5. Written up in
tokens.md section 6d and 8-H; built to neither until it is answered.

Verification: f_items 5 FIXED / F6 REPRODUCES as expected, browser_check
71/71. Screenshots not applicable - this task changes no rendered surface.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/waves/backlog.md

@@ -116,3 +116,67 @@ deliberately deferred.
   the task must leave byte-identical, and would be thrown away in wave 2.
 - **Suggested wave or follow-up:** `T2.2` should ship the drawer with adequate targets;
   `C1`'s audit at `T9.5` confirms it app-wide.
+
+### BL-004 — `help.js` ships a 52-colour palette in a different design language
+
+- **Found during:** T3.1
+- **Where:** `html/help.js:79` (the injected `<style>`)
+- **What:** the help centre injects its own stylesheet with **52 colour literals and zero
+  `var()`**. It is not a fourth copy of the suite palette — it is a different one: slate
+  (`#27313f`, `#334155`, `#e2e8f0`), violet (`#7c3aed`, `#f3e8ff`), its own blue
+  (`rgba(37,99,214,.15)`, see BL-008) and its own greys (`#fafbfc`, `#eef1f6`, `#f4f6f9`,
+  `#f7f8fa`). It loads on the launcher, SOP wizard, creator and field view.
+- **Why not now:** `T3.2`'s contract is "no rendered change", and converting this palette is a
+  restyle, not a consolidation — it would change the help centre on four pages and break the
+  empty-screenshot-diff done-when. The token rule in `CLAUDE.md` does reach it, so it is real
+  work, not a non-issue.
+- **Suggested wave or follow-up:** wave 9, alongside `C4`. Documented in
+  `docs/reference/tokens.md` §1.
+
+### BL-005 — Two modals are styled entirely by inline `style=` attributes
+
+- **Found during:** T3.1
+- **Where:** `html/auth-guard.js:67-92` (change-password) and `html/wp-format.js:120-150`
+  (preferences)
+- **What:** 35 raw colour literals between them — `#0f62fe`, `#8d8d8d`, `#e0e0e0`, `#defbe6`,
+  `#fff1f1`, `#0e6027`, `rgba(20,30,50,.5)` and so on — written into `style=` strings, so no
+  stylesheet can reach them and no token can either.
+- **Why not now:** they are markup built by JS, not a stylesheet, so they are outside `T3.2`'s
+  four-sheet surface. Both dialogs are rebuilt as accessible components under `C1`.
+- **Suggested wave or follow-up:** `T9.5`, with the `C1` audit.
+
+### BL-006 — Seventeen half-pixel font sizes
+
+- **Found during:** T3.1
+- **Where:** `html/wp-creation-styles.css` (14) and `html/wp-chrome.css` (3)
+- **What:** `9.5px`, `10.5px`, `11.5px`, `12.5px`, `13.5px` sit inside an otherwise integer
+  type scale of 27 distinct sizes. They round inconsistently between engines and there is no
+  reason for any of them.
+- **Why not now:** retiring them moves text on every creator screen; `T3.2` forbids rendered
+  change and `T7.1` re-lays-out this page anyway.
+- **Suggested wave or follow-up:** `T7.1`. See `docs/reference/tokens.md` §6a.
+
+### BL-007 — `--radius: 0` is contradicted 45 times in the sheet that declares it
+
+- **Found during:** T3.1
+- **Where:** `html/wp-creation-styles.css:26` and 45 raw `border-radius` values in the same file
+- **What:** the creator declares `--radius: 0` and honours it 23 times, then writes `2px 3px
+  4px 5px 6px 8px 9px 10px 12px 14px 20px 50%` directly in 45 other places, plus two
+  asymmetric CTA radii at `:707` and `:716`. Square corners are the Carbon idiom and the
+  intent everywhere else in the suite; this one sheet drifted.
+- **Why not now:** changing 45 radii is the most visible diff available, and `T3.2` must
+  produce none.
+- **Suggested wave or follow-up:** `T7.1`. See `docs/reference/tokens.md` §6c.
+
+### BL-008 — There is a second brand blue: `#2563d6`
+
+- **Found during:** T3.1
+- **Where:** `html/wp-creation-styles.css:565`, `html/help.js`, `html/wp-creation-app.js:1257`
+- **What:** `.sop-inherited` — the highlight on every field a work package inherited from its
+  SOP — fills with `rgba(37,99,214,0.07)`, which is **`#2563d6`**, not the suite's `#0f62fe`.
+  `help.js` carries the same blue at `.15` alpha and the print window uses it solid for
+  headings. At 7% nobody has noticed, but "one accent colour" is not currently true even after
+  the four token systems collapse to one.
+- **Why not now:** swapping it changes a rendered fill, which `T3.2` forbids. It is the same
+  conversation as the green action buttons.
+- **Suggested wave or follow-up:** `T3.5`, with `A5`. See `docs/reference/tokens.md` §8-E.