diff --git a/docs/waves/backlog.md b/docs/waves/backlog.md
index 86c53e1..e289835 100644
--- a/docs/waves/backlog.md
+++ b/docs/waves/backlog.md
@@ -536,3 +536,20 @@ deliberately deferred.
- **Why not now:** converting three more pages inside the audit task is the
drive-by CLAUDE.md forbids; the audit's job was to measure and document.
- **Suggested wave or follow-up:** next revision, one task, using the T7.9 kit.
+
+### BL-025 — The second brand blue survives as one rgba focus tint in help.js
+
+- **Found during:** the 2026-08-20 transparency fix (undefined-token sweep)
+- **Where:** `help.js`, the help-centre search input's `:focus` rule:
+ `box-shadow:0 0 0 2px rgba(37,99,214,.15)`
+- **What:** BL-008 removed the second brand blue (#2563d6 = rgb 37,99,214) and
+ `color_check` greps both spellings — but only inside `theme-light.css`, and
+ only with spaces (`37, 99, 214`). This space-free rgba consumer slid past
+ both nets. C4's recorded exception legitimately allows rgba **alphas** as
+ opacity recipes, so this is not a token-rule defect; it is the wrong BASE
+ colour under the alpha. The correct tint is THE blue: `rgba(15,98,254,.15)`.
+- **Why not now:** noticed in passing during an unrelated fix; one-line change
+ plus widening `color_check`'s grep to space-free spellings deserves its own
+ entry rather than a drive-by.
+- **Suggested wave or follow-up:** next housekeeping pass, with the check
+ widened so it cannot recur.
diff --git a/html/auth-guard.js b/html/auth-guard.js
index 87b81a1..6a991ab 100644
--- a/html/auth-guard.js
+++ b/html/auth-guard.js
@@ -68,11 +68,11 @@
ov.id = 'wp-pw-modal';
ov.style.cssText = 'position:fixed;inset:0;background:rgba(20,30,50,.5);display:flex;align-items:center;' +
'justify-content:center;z-index:10002;padding:20px;font:14px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;';
- var inp = 'width:100%;padding:9px 10px;margin-bottom:12px;border:1px solid var(--cds-border-strong-01);border-radius:4px;font-size:14px;';
+ var inp = 'width:100%;padding:9px 10px;margin-bottom:12px;border:1px solid var(--cds-border-strong);border-radius:4px;font-size:14px;';
var lbl = 'display:block;font-size:12px;color:var(--cds-text-secondary);margin-bottom:4px;';
ov.innerHTML =
- '
Times (MIMO windows, history, notifications) are shown in this zone. ' +
'Calendar dates like a due date are never shifted.
' +
- '' +
+ '' +
'
' +
- '
' +
- '' +
+ '
' +
+ '' +
'' +
'
' +
'
';
diff --git a/tests/color_check.py b/tests/color_check.py
index 6a6e691..46cec43 100644
--- a/tests/color_check.py
+++ b/tests/color_check.py
@@ -67,6 +67,34 @@ def main():
others.append(name)
chk("...and no consumer still references either", not others, others)
+ print("\n3. every token consumed is a token defined")
+ # The bug this pins: help.js (and six other files) shipped consuming
+ # --cds-layer-01/-02 and --cds-border-subtle-01/-strong-01 - names the theme
+ # never defined (its names carry no -01 suffix). An undefined var() makes
+ # the whole declaration invalid, so the help centre modal, the password and
+ # language dialogs, and the print popup all rendered TRANSPARENT
+ # backgrounds. Found by the user, 2026-08-20. Definitions are collected
+ # from every file (page aliases are legal); consumption of a name nobody
+ # defines is the defect.
+ defined, consumed = set(), {}
+ for name in sorted(os.listdir(HTML)):
+ if not name.endswith((".js", ".html", ".css")):
+ continue
+ src = io.open(os.path.join(HTML, name), encoding="utf-8").read()
+ for m in re.finditer(r"(--[a-zA-Z0-9-]+)\s*:", src):
+ defined.add(m.group(1))
+ for m in re.finditer(r"setProperty\(\s*['\"](--[a-zA-Z0-9-]+)", src):
+ defined.add(m.group(1))
+ for m in re.finditer(r"var\(\s*(--[a-zA-Z0-9-]+)", src):
+ consumed.setdefault(m.group(1), set()).add(name)
+ # --wp-chart- is the creator's JS-concatenated fallback ('--wp-chart-'+k);
+ # the numbered names it builds are all defined, the fragment is not a name.
+ unresolved = ["%s (%s)" % (t, ", ".join(sorted(fs)))
+ for t, fs in sorted(consumed.items())
+ if t not in defined and t != "--wp-chart-"]
+ chk("no var() anywhere names a token that nothing defines",
+ not unresolved, unresolved[:8])
+
print("\n" + "-" * 54)
print("%d/%d checks passed." % (len(_PASS), len(_PASS) + len(_FAIL)))
for f in _FAIL: