T9.9 - C4 + the backlog sweep: nine entries closed, each re-measured first

The colour half (C4, approved Aug 18 - "change them"):
- BL-004: the help centre's own 52-colour palette collapsed onto theme tokens
- BL-005: the JS-built dialogs (auth-guard, wp-format) and project-data's
  badges read tokens; the creator's categorical badge palette moved to
  theme-light as --wp-chart-1..10, read by computed style at boot; the print
  popup - a document with no stylesheet - inlines live token VALUES
- BL-008: the second brand blue (#2563d6) is deleted; .sop-inherited tints
  with THE blue at the same 7% alpha
- BL-009: the ninth amber (--wp-status-warning-text-alt) is deleted
- theme-light gained the two missing feedback tokens the consoles carried as
  literals (--wp-status-success-text / -error-text)
- NEW tests/color_check.py 4/4: zero hex literals outside theme-light.css,
  comments stripped (the BL-017 lesson), with the exceptions named in full
  (meta theme-color cannot resolve a var; rgba alphas are opacity recipes)

The correctness half, each re-measured before touching, as the task ordered:
- BL-011 STILL REPRODUCED: the sync badge mounted on the first async sync
  event; its holder now mounts at DOMContentLoaded, so the three overlays land
  in script order deterministically
- BL-012 fixed and MEASURED: baseline_shots freezes Date and Math.random per
  document; two consecutive admin captures came back byte-identical
- BL-016 fixed: a step-less wizard URL is step 1; stepper_check's deliberately
  wrong pin flipped with the fix, exactly as the entry planned
- BL-018 fixed both halves: the false-complete write now requires the
  {sop,state} production shape, and browser_check.seed writes that shape -
  which un-detoured four probes' creators from the SOP gate. stepper_check
  re-pointed at projB (no SOP) because its premise is a wizard someone is
  STARTING, and projA now legitimately restores a finished one.
- BL-019 fixed: a stored cost code that left COST_CODES is kept as an option
  (the gov_wosize pattern), so opening a package no longer blanks its record
- hold_check's AST sweep refined in passing detection: it flagged T8.3's
  notification-row .status as a release transition; it now reads wp.status only

Every wave-9-pointing backlog entry is closed with its measurement recorded.

Verification (each probe run alone): color_check 4/4, stepper_check 71/71,
validation_check 77/77, url_state_check 23/23, autosave_check 34/34,
a11y_check 22/22, launcher_check 58/58, aggregates_check 16/16,
kitting_check 26/26, hold_check 50/50, mobile_check 24/24, frame_check 38/38,
sections_check 95/95, form_structure_check 50/51 (BL-022's question).

Items: C4, BL-004, BL-005, BL-008, BL-009, BL-011, BL-012, BL-016, BL-018, BL-019

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/color_check.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Is theme-light.css the only place a colour exists? — C4, T9.9.
+
+The token rule, finally enforceable everywhere: after this sweep no colour
+literal survives outside theme-light.css - not in page stylesheets, not in the
+help centre's injected styles (BL-004), not in the JS-built dialogs (BL-005),
+not in the print popup. One accent blue (BL-008 - the second brand blue is
+gone, .sop-inherited tints with THE blue) and one warning amber (BL-009 - the
+alt token is deleted). Comments are stripped first: quoting a hex while
+explaining it is not declaring one (the BL-017 lesson).
+
+The exceptions, in full: <meta name="theme-color"> (a meta attribute cannot
+resolve a CSS var), and rgba() shadow/overlay alphas, which are opacity
+recipes, not palette entries.
+
+Static sweep - no browser needed. Exit 0 all passed, 1 a failure.
+"""
+import io
+import os
+import re
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from browser_check import chk, _PASS, _FAIL                          # noqa: E402
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+HTML = os.path.join(ROOT, "html")
+
+
+def strip_comments(src, is_css):
+    src = re.sub(r"/\*.*?\*/", "", src, flags=re.S)
+    if not is_css:
+        src = "\n".join(re.sub(r"(?<![:'\"])//.*$", "", ln) for ln in src.split("\n"))
+        src = re.sub(r"<!--.*?-->", "", src, flags=re.S)
+    return src
+
+
+def main():
+    print("\n1. hex literals outside theme-light.css")
+    offenders = []
+    for name in sorted(os.listdir(HTML)):
+        if not name.endswith((".js", ".html", ".css")) or name == "theme-light.css":
+            continue
+        src = strip_comments(io.open(os.path.join(HTML, name), encoding="utf-8").read(),
+                             name.endswith(".css"))
+        # the one exception: the browser-chrome hint, which cannot use var()
+        src = re.sub(r'<meta name="theme-color" content="#[0-9a-fA-F]{6}"\s*/?>', "", src)
+        for m in re.finditer(r"#[0-9a-fA-F]{3}\b|#[0-9a-fA-F]{6}\b", src):
+            offenders.append("%s: %s" % (name, m.group(0)))
+    chk("no hex colour literal outside theme-light.css; grep confirms",
+        not offenders, offenders[:8])
+
+    print("\n2. one blue, one amber")
+    theme = io.open(os.path.join(HTML, "theme-light.css"), encoding="utf-8").read()
+    code = strip_comments(theme, True)
+    chk("the second brand blue (#2563d6) is gone from the theme itself",
+        "2563d6" not in code and "37, 99, 214" not in code)
+    chk("the ninth amber (--wp-status-warning-text-alt) is deleted",
+        "--wp-status-warning-text-alt" not in code)
+    others = []
+    for name in sorted(os.listdir(HTML)):
+        if name == "theme-light.css" or not name.endswith((".js", ".css", ".html")):
+            continue
+        src = strip_comments(io.open(os.path.join(HTML, name), encoding="utf-8").read(),
+                             name.endswith(".css"))
+        if "warning-text-alt" in src or "2563d6" in src:
+            others.append(name)
+    chk("...and no consumer still references either", not others, others)
+
+    print("\n" + "-" * 54)
+    print("%d/%d checks passed." % (len(_PASS), len(_PASS) + len(_FAIL)))
+    for f in _FAIL:
+        print("  - " + f)
+    return 1 if _FAIL else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())