T9.9 - C4 + the backlog sweep: nine entries closed, each re-measured first

The colour half (C4, approved Aug 18 - "change them"):
- BL-004: the help centre's own 52-colour palette collapsed onto theme tokens
- BL-005: the JS-built dialogs (auth-guard, wp-format) and project-data's
  badges read tokens; the creator's categorical badge palette moved to
  theme-light as --wp-chart-1..10, read by computed style at boot; the print
  popup - a document with no stylesheet - inlines live token VALUES
- BL-008: the second brand blue (#2563d6) is deleted; .sop-inherited tints
  with THE blue at the same 7% alpha
- BL-009: the ninth amber (--wp-status-warning-text-alt) is deleted
- theme-light gained the two missing feedback tokens the consoles carried as
  literals (--wp-status-success-text / -error-text)
- NEW tests/color_check.py 4/4: zero hex literals outside theme-light.css,
  comments stripped (the BL-017 lesson), with the exceptions named in full
  (meta theme-color cannot resolve a var; rgba alphas are opacity recipes)

The correctness half, each re-measured before touching, as the task ordered:
- BL-011 STILL REPRODUCED: the sync badge mounted on the first async sync
  event; its holder now mounts at DOMContentLoaded, so the three overlays land
  in script order deterministically
- BL-012 fixed and MEASURED: baseline_shots freezes Date and Math.random per
  document; two consecutive admin captures came back byte-identical
- BL-016 fixed: a step-less wizard URL is step 1; stepper_check's deliberately
  wrong pin flipped with the fix, exactly as the entry planned
- BL-018 fixed both halves: the false-complete write now requires the
  {sop,state} production shape, and browser_check.seed writes that shape -
  which un-detoured four probes' creators from the SOP gate. stepper_check
  re-pointed at projB (no SOP) because its premise is a wizard someone is
  STARTING, and projA now legitimately restores a finished one.
- BL-019 fixed: a stored cost code that left COST_CODES is kept as an option
  (the gov_wosize pattern), so opening a package no longer blanks its record
- hold_check's AST sweep refined in passing detection: it flagged T8.3's
  notification-row .status as a release transition; it now reads wp.status only

Every wave-9-pointing backlog entry is closed with its measurement recorded.

Verification (each probe run alone): color_check 4/4, stepper_check 71/71,
validation_check 77/77, url_state_check 23/23, autosave_check 34/34,
a11y_check 22/22, launcher_check 58/58, aggregates_check 16/16,
kitting_check 26/26, hold_check 50/50, mobile_check 24/24, frame_check 38/38,
sections_check 95/95, form_structure_check 50/51 (BL-022's question).

Items: C4, BL-004, BL-005, BL-008, BL-009, BL-011, BL-012, BL-016, BL-018, BL-019

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/waves/backlog.md

@@ -157,7 +157,7 @@ deliberately deferred.
 - **Suggested wave or follow-up:** `T2.2` should ship the drawer with adequate targets;
   `C1`'s audit at `T9.5` confirms it app-wide.
 
-### BL-004 — `help.js` ships a 52-colour palette in a different design language
+### BL-004 — CLOSED at T9.9 — `help.js` ships a 52-colour palette in a different design language
 
 - **Found during:** T3.1
 - **Where:** `html/help.js:79` (the injected `<style>`)
@@ -172,8 +172,9 @@ deliberately deferred.
   work, not a non-issue.
 - **Suggested wave or follow-up:** wave 9, alongside `C4`. Documented in
   `docs/reference/tokens.md` §1.
+- **CLOSED, T9.9:** the help centre's palette collapsed onto theme-light tokens; color_check.py sweeps every file on every run
 
-### BL-005 — Two modals are styled entirely by inline `style=` attributes
+### BL-005 — CLOSED at T9.9 — Two modals are styled entirely by inline `style=` attributes
 
 - **Found during:** T3.1
 - **Where:** `html/auth-guard.js:67-92` (change-password) and `html/wp-format.js:120-150`
@@ -184,6 +185,7 @@ deliberately deferred.
 - **Why not now:** they are markup built by JS, not a stylesheet, so they are outside `T3.2`'s
   four-sheet surface. Both dialogs are rebuilt as accessible components under `C1`.
 - **Suggested wave or follow-up:** `T9.5`, with the `C1` audit.
+- **CLOSED, T9.9:** both JS-built dialog kits (auth-guard, wp-format) and project-data's badges read tokens; zero literals remain
 
 ### BL-006 — Seventeen half-pixel font sizes
 
@@ -219,7 +221,7 @@ deliberately deferred.
   it in four waves, and it is measured every run now instead of once. Carried to
   `T7.2`.
 
-### BL-008 — There is a second brand blue: `#2563d6`
+### BL-008 — CLOSED at T9.9 — There is a second brand blue: `#2563d6`
 
 - **Found during:** T3.1
 - **Where:** `html/wp-creation-styles.css:565`, `html/help.js`, `html/wp-creation-app.js:1257`
@@ -231,8 +233,9 @@ deliberately deferred.
 - **Why not now:** swapping it changes a rendered fill, which `T3.2` forbids. It is the same
   conversation as the green action buttons.
 - **Suggested wave or follow-up:** wave 9, with `C4`. `T3.5` is scoped to buttons; this is a field fill. See `docs/reference/tokens.md` §8-E.
+- **CLOSED, T9.9:** the second brand blue is deleted - .sop-inherited tints with THE blue at the same alpha, and the print popup inlines live token values
 
-### BL-009 — A ninth amber, four points from the eighth
+### BL-009 — CLOSED at T9.9 — A ninth amber, four points from the eighth
 
 - **Found during:** T3.2
 - **Where:** `html/field.html:35` (`.pill.warn`)
@@ -243,6 +246,7 @@ deliberately deferred.
 - **Why not now:** merging it moves a rendered colour, which `T3.2` forbids. `T3.2` named it
   `--wp-status-warning-text-alt` so it is visible rather than hidden in a hex.
 - **Suggested wave or follow-up:** wave 9, with `C4`. `T3.5` is scoped to buttons; this is a status pill. See `docs/reference/tokens.md` §8-K.
+- **CLOSED, T9.9:** --wp-status-warning-text-alt is deleted; its one consumer (field.html warn pill) uses the real amber
 
 ### BL-010 — 829 raw spacing, type and radius values remain inside rules
 
@@ -260,7 +264,7 @@ deliberately deferred.
 - **Suggested wave or follow-up:** `T5.x` and `T7.1`, where these pages are re-laid-out and the
   values are being chosen again anyway. See `docs/reference/tokens.md` §6b and §11.
 
-### BL-011 — Three JS-injected overlays race to append on the SOP page
+### BL-011 — CLOSED at T9.9 — Three JS-injected overlays race to append on the SOP page
 
 - **Found during:** T3.2
 - **Where:** `html/work-package-suite.html` — `#wp-sync-badge`, `.wp-navscrim`, `#wp-sidenav`
@@ -273,8 +277,9 @@ deliberately deferred.
 - **Why not now:** invisible to users, and the fix is ordering in three separate scripts, which
   is a change with no observable benefit while `T7.1` is still going to move this code.
 - **Suggested wave or follow-up:** wave 9, if it is still true after `T7.1`.
+- **CLOSED, T9.9:** the sync badge's holder mounts at DOMContentLoaded, so the three overlays land in script order deterministically
 
-### BL-012 — `admin.html` and the creator at 1440px are not stable enough to screenshot-diff
+### BL-012 — CLOSED at T9.9 — `admin.html` and the creator at 1440px are not stable enough to screenshot-diff
 
 - **Found during:** T3.2
 - **Where:** `tests/baseline_shots.py` output for `admin-390`, `admin-1440`, `creator-1440`
@@ -287,6 +292,7 @@ deliberately deferred.
   covers what the diff was being asked to prove, and covers it better.
 - **Suggested wave or follow-up:** wave 9, alongside `C2`. Either freeze the clock in the
   fixture or exclude the live regions from capture — otherwise every later wave re-learns this.
+- **CLOSED, T9.9:** baseline_shots.py freezes Date and Math.random per document; two consecutive admin captures measured byte-identical
 
 ### BL-013 — The creator's inputs have no visible focus ring at all
 
@@ -330,7 +336,7 @@ deliberately deferred.
 - **Why not now:** out of `A5`'s stated scope, and `A4`/`S9` rebuild the stepper.
 - **Suggested wave or follow-up:** `T7.x`, with the stepper rebuild.
 
-### BL-016 — Back to a URL with no `step` leaves the wizard on the step it was on
+### BL-016 — CLOSED at T9.9 — Back to a URL with no `step` leaves the wizard on the step it was on
 
 - **Found during:** T5.1
 - **Where:** `html/work-package-suite-app.js`, the `WPUrl.onChange` handler
@@ -347,6 +353,7 @@ deliberately deferred.
   unreviewable.
 - **Suggested wave or follow-up:** wave 9, with `C2`. `tests/stepper_check.py` pins the
   current behaviour with a named check so the fix has a test waiting for it.
+- **CLOSED, T9.9:** a step-less wizard URL is step 1 (parseInt || 1); stepper_check's pin flipped with the fix, as the entry planned
 
 ### BL-017 — The native-dialog baseline metric counts prose
 
@@ -364,7 +371,7 @@ deliberately deferred.
   a comment-stripped figure alongside the raw one and state both. Wave 9 sets the
   target against the stripped figure.
 
-### BL-018 — The Work Package tab's gate is the last localStorage-derived status
+### BL-018 — CLOSED at T9.9 — The Work Package tab's gate is the last localStorage-derived status
 
 - **Found during:** T5.3
 - **Where:** `html/work-package-suite-app.js` — `restoreSavedSOP()` sets `sopComplete`,
@@ -396,8 +403,9 @@ deliberately deferred.
   **imports `set_sop` from `sections_check.py`** rather than writing a fifth
   copy, so the workaround is in one place and disappears when the fixture is
   fixed. Four probes is enough evidence: `T9.9` owns it.
+- **CLOSED, T9.9:** the false-complete write requires the {sop,state} shape, and browser_check.seed now writes the production shape (the four probes' gate detours are gone)
 
-### BL-019 — A cost code that has left the list is silently blanked on edit
+### BL-019 — CLOSED at T9.9 — A cost code that has left the list is silently blanked on edit
 
 - **Found during:** T5.6
 - **Where:** `html/wp-creation-app.js` — `buildCostCodes()` at `:185`, consumed by
@@ -418,6 +426,7 @@ deliberately deferred.
   a fix here changes what is written back to existing records — which wants its own diff.
 - **Suggested wave or follow-up:** wave 9. The fix is the four lines already written for
   `gov_wosize`.
+- **CLOSED, T9.9:** a stored cost code with no matching option is kept as an option (the gov_wosize pattern), so the round-trip preserves it
 
 ### BL-014 — Four controls fall back to the browser's default focus ring