T10.8: verification (390px/1440px, full suite, per-task done-when)

Walked T10.1-T10.5's claims against the actual code (env vars, routes,
JIT provisioning, the password-removal sweep, login.html) rather than
re-trusting this file's own prose. No drift found.

Full suite via the Docker runner: 39/41 files clean. token_check.py's
exit 2 is a harness mismatch (needs --out/--compare, not a bare run),
not a failure. generalinfo_check.py is 48/49 - the one failure is a
pre-existing rgba() shadow literal from the D11 Micron-assets merge,
confirmed via git show HEAD to predate this wave; logged as BL-031,
not fixed here. okta_auth_check.py re-run fresh: 22/22.

390px/1440px: baseline_shots.py captured all fourteen shots. Visually
confirmed login.html and users.html show the Okta-only sign-in and the
password-free admin UI at both widths.

Wave 10 complete.

docs/waves/backlog.md

@@ -626,6 +626,28 @@ deliberately deferred.
 - **Suggested wave or follow-up:** next housekeeping pass, alongside any other
   post-cutover schema tidy-up.
 
+### BL-031 — A raw `rgba()` shadow survives in the creator's stylesheet
+
+- **Found during:** T10.8 (the full suite could finally run through Docker; the
+  dev sandbox never had a headless browser to run it in before)
+- **Where:** `html/wp-creation-styles.css:929`, `.asset-results { ... box-shadow:0
+  8px 24px rgba(20,30,50,.18); }`
+- **What:** `generalinfo_check.py` asserts the whole file carries no raw colour
+  literal (comments excluded) as part of its CR-003 priority-colour check, and
+  this one line fails it: 48/49. Confirmed via `git show HEAD` that the literal
+  is already committed, byte-identical, unrelated to wave 10 — it is the Micron
+  asset picker's dropdown shadow, which arrived with the `origin/Micron-Assets`
+  merge (D11, 2026-08-20) and was never swept by `C4`'s token pass (`T9.9`
+  closed before D11 merged). The fix is a straight swap:
+  `theme-light.css:217` already declares `--wp-shadow-menu: 0 8px 24px
+  rgba(20, 30, 50, .18)`, the identical value — this line should read
+  `box-shadow:var(--wp-shadow-menu);`.
+- **Why not now:** unrelated to the Okta wave; fixing a D11-era CSS literal
+  inside T10.8 (auth verification) is exactly the drive-by `CLAUDE.md` forbids.
+- **Suggested wave or follow-up:** next housekeeping pass, with `C4`'s other
+  leftovers. One-line fix, `generalinfo_check.py` already pins it (49/49 once
+  fixed).
+
 ### BL-030 — `DEPLOY-login-portal.md` is fully stale
 
 - **Found during:** T10.9

docs/waves/wave-10.md

@@ -120,6 +120,42 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other
 - **T10.8 — Verification.** 390px and 1440px, full suite, done-when checks per task,
   matching the rigor D13 was held to.
 
+  Done-when checks per task, verified against the actual code rather than
+  re-reading this file's own claims: T10.1 (Authlib pinned, the four env vars,
+  `is_configured()`/`describe()`), T10.2 (the login/callback routes, no
+  app-side group or claim gate layered on Okta's own), T10.3 (identity-claim
+  matching, JIT at the lowest role, local deprovisioning still enforced after
+  Okta approves), T10.4 (zero remaining references to `bcrypt` /
+  `password_hash` / `hash_password` / `verify_password` anywhere in `.py` or
+  `.js`, `manage_users.py promote`, `smoketest.py` / `seed_demo.py` /
+  `browser_check.py` / `launcher_check.py` all minting via `create_token()`),
+  T10.5 (`login.html` is one Okta link, no password field). All matched what
+  this file already claimed — no drift found.
+
+  Full suite, run through the Docker test runner (all 41 files in `tests/`,
+  bare invocation): 39 passed clean. `tests/token_check.py` "failed" at exit 2,
+  but that is a harness mismatch, not a check failure — it is a two-step
+  snapshot/diff tool (`--out` to capture, `--compare A B` to diff) and prints
+  usage + exits 2 when run with no arguments, which is what a bare full-suite
+  pass does to every file. `tests/generalinfo_check.py` scored 48/49 — the one
+  failure is a raw `rgba()` shadow literal in `wp-creation-styles.css`,
+  confirmed via `git show HEAD` to already be committed and unrelated to this
+  wave (it is the Micron asset picker's dropdown shadow from the `D11` merge,
+  2026-08-20, predating this wave by two weeks). Logged as `BL-031` rather than
+  fixed here — an unrelated CSS token-rule violation is not this wave's to fix.
+  `tests/okta_auth_check.py` re-run fresh (no browser needed): 22/22.
+
+  390px and 1440px: `tests/baseline_shots.py` captured all fourteen shots
+  (login, launcher, sop, creator, admin, users, field × two widths) into
+  `docs/reference/baseline/`. `login-390.png`/`login-1440.png` and
+  `users-390.png`/`users-1440.png` visually confirmed: the login page is a
+  single "Sign in with Okta" button with no username/password form at either
+  width, and the User Directory's table and "Add a user" form both carry no
+  password column and no reset-password action anywhere, at either width.
+
+  Wave 10 is complete. The three items in "Still open" below are external
+  (security team / Okta admin), not blocked on any task in this wave.
+
 - **T10.9 — Rollback-aware deploy runbook.** Raised after hazard review found
   `DEPLOY-runbook-2026-08-04.md`'s Rollback section has no case for a migration whose
   `downgrade()` cannot restore the data it drops — see `D17`. `T10.4`'s