:root{
  --ground:#F7F6EB; --surface:#FFFEF7; --surface-sunk:#EFEDDD;
  --ink:#16210F; --ink-soft:#414D38; --meta:#586F7C;
  --rule:#D8D5BE; --rule-strong:#B5B171;
  /* --edge is what draws an interactive boundary: input, select, button, checkbox.
     Olive Gold is 2.04:1 on the Soft Neutral ground, so it fails WCAG's 3:1 for a UI
     component and fails it badly as a focus ring. This is the same olive walked 40% of
     the way to Deep Green: 3.98:1, still the brand family. Decorative rules keep the
     gold, because decoration carries no threshold. */
  --edge:#737F47; --spark:#A35C17;
  --accent:#113308;
  --flag:#8A4B22; --flag-fill:#F3E5D6;
  --ok:#3F6B2E; --ok-fill:#E6EEDD;
  --code-ground:#14200E; --code-ink:#E4E4D2; --code-dim:#9AA48C; --code-accent:#CFC98F;
  /* System stacks only. This page is meant to run from a stick on a box that has never
     been online, and it was linking webfonts from Google - so it silently fell back
     offline, and a strict content-security-policy blocks it outright. Same three voices,
     nothing fetched: a sans for headings, a serif for prose, a mono for commands. */
  --f-display:system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;
  --f-body:Georgia,"Iowan Old Style","Times New Roman",Times,serif;
  --f-mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace;
}
/* Light is the default whatever the operating system says. This is a build document:
   it is printed, and it is read on a bright screen next to a box. Following the OS
   handed people dark without asking, which is how this page arrived dark on a machine
   whose owner wanted light. Dark is still here, and still meets AA on every pair, but
   it is now a choice someone makes. */
:root[data-theme="dark"]{
  --ground:#0D140A; --surface:#141C10; --surface-sunk:#1A2415;
  --ink:#E9E7D6; --ink-soft:#B3BCA8; --meta:#8FA6B1;
  --rule:#2C3A24; --rule-strong:#5C6640;
  --edge:#8E9A63; --spark:#E0925A;
  --accent:#C6C489;
  --flag:#D79A6A; --flag-fill:#2B1D12;
  --ok:#9CC183; --ok-fill:#1A2415;
  --code-ground:#080D06; --code-ink:#DEDCCB; --code-dim:#7E8A72; --code-accent:#CFC98F;
}
:root[data-theme="dark"]{
  --ground:#0D140A; --surface:#141C10; --surface-sunk:#1A2415;
  --ink:#E9E7D6; --ink-soft:#B3BCA8; --meta:#8FA6B1;
  --rule:#2C3A24; --rule-strong:#5C6640;
  --accent:#C6C489; --gold:#B5B171;
  --flag:#D79A6A; --flag-fill:#2B1D12;
  --ok:#9CC183; --ok-fill:#1A2415;
  --code-ground:#080D06; --code-ink:#DEDCCB; --code-dim:#7E8A72; --code-accent:#CFC98F;
}
*{box-sizing:border-box}
html,body{margin:0}
body{background:var(--ground);color:var(--ink);font-family:var(--f-body);
  font-size:16.5px;line-height:1.6;padding:0 20px 80px;-webkit-font-smoothing:antialiased}
.wrap{max-width:1180px;margin:0 auto}

header.top{padding:32px 0 22px;border-bottom:2px solid var(--accent);margin-bottom:28px}
.top-bar{display:flex;align-items:flex-start;justify-content:space-between;gap:20px}
.top-bar .eyebrow{margin:0}
.mark{flex:none;width:46px;height:46px;margin-top:-8px}
.notice{margin:22px 0 0;padding:14px 16px;background:var(--surface-sunk);
  border:1px solid var(--rule);border-left:3px solid var(--accent);border-radius:3px;max-width:64ch}
.notice p{margin:0 0 8px;font-size:15px;color:var(--ink-soft)}
.notice p:last-of-type{margin-bottom:0}
.notice-actions{display:flex;flex-wrap:wrap;gap:10px;align-items:center;margin-top:12px}
.btn-download{font-family:var(--f-display);font-size:14px;font-weight:600;text-decoration:none;
  border:1px solid var(--edge);border-radius:3px;padding:7px 12px;background:var(--accent);
  color:var(--ground);display:inline-block}
.btn-download:hover{background:var(--ink)}
.btn-download:focus-visible{outline:3px solid var(--accent);outline-offset:2px}
/* .btn-download sets display, and a class beats the [hidden] attribute, so hiding it
   from script needs saying twice. It stayed visible on the downloaded copy without this. */
.btn-download[hidden]{display:none}
@media print{.notice-actions,#theme{display:none}}
.eyebrow{font-family:var(--f-display);font-weight:600;font-size:12px;letter-spacing:.18em;
  text-transform:uppercase;color:var(--meta);margin:0 0 12px}
h1{font-family:var(--f-display);font-weight:700;font-size:clamp(32px,5.5vw,50px);
  line-height:1.04;letter-spacing:-.015em;margin:0;text-wrap:balance}
.standfirst{font-size:18px;color:var(--ink-soft);margin:14px 0 0;max-width:64ch}

.cols{display:grid;grid-template-columns:minmax(0,380px) minmax(0,1fr);gap:40px;align-items:start}
@media (max-width:900px){.cols{grid-template-columns:1fr;gap:32px}}

/* ---- form ---- */
.panel{background:var(--surface);border:1px solid var(--rule);border-radius:4px;padding:22px 22px 8px}
@media (min-width:901px){.form-col{position:sticky;top:20px;max-height:calc(100vh - 40px);overflow-y:auto}}
h2{font-family:var(--f-display);font-weight:600;font-size:22px;margin:0 0 4px;text-wrap:balance}
.panel h3{font-family:var(--f-display);font-weight:600;font-size:12px;letter-spacing:.14em;
  text-transform:uppercase;color:var(--meta);margin:24px 0 12px;padding-bottom:6px;
  border-bottom:1px solid var(--rule)}
.panel h3:first-of-type{margin-top:8px}
.field{margin:0 0 16px}
label{display:block;font-family:var(--f-display);font-weight:600;font-size:14.5px;margin:0 0 3px}
.hint{display:block;font-size:13.5px;color:var(--meta);margin:0 0 6px;line-height:1.45}
input[type=text],select{
  width:100%;font-family:var(--f-mono);font-size:14px;padding:9px 10px;
  background:var(--ground);color:var(--ink);border:1px solid var(--edge);border-radius:3px}
input[type=text]:focus,select:focus{outline:3px solid var(--accent);outline-offset:1px;border-color:var(--accent)}
select{font-family:var(--f-body);font-size:15px}
.choice{display:flex;flex-wrap:wrap;gap:8px;margin:2px 0 0}
.choice label{
  font-family:var(--f-body);font-weight:400;font-size:14.5px;margin:0;cursor:pointer;
  border:1px solid var(--edge);border-radius:3px;padding:7px 12px;background:var(--ground);
  display:flex;align-items:center;gap:7px}
.choice input{margin:0;accent-color:var(--accent)}
.choice label:has(input:checked){border-color:var(--accent);background:var(--ok-fill);font-weight:600}
.choice label:focus-within{outline:3px solid var(--accent);outline-offset:1px}

.certcompare{margin:10px 0 0}
.certcompare table{font-size:13.5px}
.certcompare th,.certcompare td{padding:7px 9px}
.certcompare tbody tr{opacity:.5}
.certcompare[data-cert="none"] tr[data-c="none"],
.certcompare[data-cert="laptop"] tr[data-c="laptop"],
.certcompare[data-cert="token"] tr[data-c="token"]{opacity:1;background:var(--ok-fill)}
.note-quiet{background:var(--surface-sunk);margin-top:8px}
.hint-spaced{margin-top:6px}
.note{font-size:13.5px;border-radius:3px;padding:9px 12px;margin:6px 0 0}
.note.warn{background:var(--flag-fill);border:1px solid var(--flag);color:var(--ink)}
.note.warn b{color:var(--flag)}

.actions{display:flex;gap:10px;flex-wrap:wrap;margin:20px 0 22px}
button{
  font-family:var(--f-display);font-weight:600;font-size:14.5px;letter-spacing:.02em;
  padding:9px 16px;border-radius:3px;border:1px solid var(--accent);cursor:pointer;
  background:var(--accent);color:var(--ground)}
button.ghost{background:transparent;color:var(--accent)}
button:hover{opacity:.88}
button:focus-visible{outline:3px solid var(--accent);outline-offset:2px}

/* ---- output ---- */
.out-head{display:flex;align-items:baseline;justify-content:space-between;gap:16px;flex-wrap:wrap;
  border-bottom:2px solid var(--accent);padding-bottom:10px;margin-bottom:6px}
.block{margin:28px 0 0;padding-top:22px;border-top:1px solid var(--rule)}
.block:first-of-type{border-top:none;padding-top:8px}
.block-head{display:flex;align-items:baseline;gap:12px;margin-bottom:8px}
.step-tag{font-family:var(--f-mono);font-size:12px;color:var(--ground);background:var(--accent);
  padding:2px 8px;border-radius:2px;flex:none}
/* The step headings sit under the "Your commands" h2, so they are h3 in the document
   outline (a screen reader's heading list is a table of contents, and h2 -> h4 reads as
   a missing level). They keep their own size, scoped so the form's own h3s are untouched. */
.block-head h3{font-family:var(--f-display);font-weight:600;font-size:19px;margin:0;text-wrap:balance}
.block p{margin:0 0 12px;max-width:70ch;font-size:15.5px;color:var(--ink-soft)}
.cmd{position:relative;margin:0 0 14px}
.blocked{border:1px dashed var(--flag);background:var(--flag-fill);border-radius:3px;
  padding:13px 16px;font-size:15px;color:var(--ink)}
.blocked b{color:var(--flag)}
.runon{font-family:var(--f-display);font-size:12px;font-weight:600;letter-spacing:.1em;
  text-transform:uppercase;color:var(--meta);padding:0 0 5px}
.runon b{color:var(--ink);letter-spacing:.04em}
pre{background:var(--code-ground);color:var(--code-ink);font-family:var(--f-mono);
  font-size:13px;line-height:1.7;padding:15px 17px;border-radius:3px;overflow-x:auto;
  margin:0;border-left:3px solid var(--rule-strong);white-space:pre}
.copy{position:absolute;top:22px;right:8px;font-size:12px;padding:5px 10px;
  background:var(--rule-strong);border-color:var(--rule-strong);color:var(--code-ground)}
.copy.done{background:var(--ok);border-color:var(--ok);color:var(--ground)}
ol.checks,ul.checks{margin:0 0 14px;padding-left:0;list-style:none}
ol.checks li,ul.checks li{display:flex;gap:10px;padding:7px 0;border-bottom:1px dotted var(--rule);
  font-size:15.5px;align-items:flex-start}
ol.checks li:last-child,ul.checks li:last-child{border-bottom:none}
.tick{flex:none;width:14px;height:14px;border:1.5px solid var(--edge);border-radius:2px;margin-top:5px}
.val{font-family:var(--f-mono);font-size:13.5px;background:var(--surface-sunk);padding:1px 5px;border-radius:2px}
.tablewrap{overflow-x:auto;margin:0 0 14px;border:1px solid var(--rule);border-radius:3px}
table{border-collapse:collapse;width:100%;font-size:15px;background:var(--surface)}
th,td{text-align:left;padding:9px 13px;border-bottom:1px solid var(--rule);vertical-align:top}
th{font-family:var(--f-display);font-size:11px;font-weight:700;letter-spacing:.14em;
  text-transform:uppercase;color:var(--meta);background:var(--surface-sunk);white-space:nowrap}
tr:last-child td{border-bottom:none}
td.k{font-family:var(--f-mono);font-size:13px}
.popout{margin:8px 0 2px;border:1px solid var(--rule);border-radius:3px;background:var(--surface)}
.popout>summary{cursor:pointer;padding:8px 12px;font-family:var(--f-display);font-weight:600;
  font-size:13.5px;color:var(--accent);list-style:none}
.popout>summary::-webkit-details-marker{display:none}
.popout>summary::before{content:"\25B8  ";color:var(--meta)}
.popout[open]>summary::before{content:"\25BE  "}
.popout>summary:focus-visible{outline:3px solid var(--accent);outline-offset:-2px}
.popout .inner{padding:2px 14px 12px;font-size:14.5px;border-top:1px solid var(--rule)}
.popout ol{margin:10px 0 8px;padding-left:20px}
.popout ol li{margin:0 0 6px;display:list-item;border:none;padding:0}
.popout table{font-size:13.5px;margin:8px 0 0}
.popout th,.popout td{padding:6px 9px}
.screen{font-family:var(--f-mono);font-size:12.5px;background:var(--code-ground);color:var(--code-ink);
  padding:11px 13px;border-radius:3px;margin:8px 0;white-space:pre;overflow-x:auto}
.trap{background:var(--flag-fill);border:1px solid var(--flag);border-radius:3px;
  padding:12px 15px;margin:0 0 14px;font-size:15px;color:var(--ink)}
.trap b{color:var(--flag)}
.trap p{margin:0;color:var(--ink)}
.skipped{color:var(--meta);font-style:italic;font-size:15px}
footer{margin-top:56px;padding-top:16px;border-top:2px solid var(--accent);font-size:13.5px;color:var(--meta)}
@media (prefers-reduced-motion:reduce){*{transition:none!important}}
@media print{
  .form-col,.actions,.copy{display:none}
  .cols{grid-template-columns:1fr}
  body{padding:0;font-size:12px}
  pre{white-space:pre-wrap}
}