Follow-up to v2.9.0, extending the CSS-variable token system to the surfaces the initial migration deliberately deferred. No functional or API change; all tokens are exact value matches, so this is a zero visual change refactor.
Phase 6 — Status callouts
Re-introduce success/warning/danger (+ new info) as var-backed token groups (surface/line/fg/strong), HSL and theme-aware (dark surfaces blended over the card). The green/red/amber/blue info-boxes collapse onto them, normalising the 50-vs-100 / 700-vs-800 drift the inline callouts carried. 300 pairs collapsed.
Phase 7 — Form-field surface
Add --color-input (white in light, gray-700 in dark) so inputs read one step lighter than the card. 40 bg-white dark:bg-gray-700 field pairs collapsed onto bg-input.
Phase 8 — Hover and recessed surfaces
Add --color-hover, border.strong and --color-sunken (all exact values). 51 hover/recessed pairs collapsed onto hover:bg-hover, hover:border-border-strong, hover:text-foreground, bg-sunken. Minority hover shades left literal on purpose to keep the pass strictly zero-shift.
Tooling
All new pairs live in the scripts/theme_codemod.py MAPPINGS, so the existing --check CI gate now guards status, input, hover and recessed pairs against regression.
dark: variants over this release: templates ~843 -> 565, first-party JS ~216 -> 103. Single status accents, always-white-on-colour text, the card hairline, and Alpine ternary branch-edge classes remain literal by design.
Verification
Full E2E gate green on both merged branches: Docker build and health smoke, CSP/auth/settings/pages/backup suites, and real Let's Encrypt issuance plus renewal against certmate.org over Cloudflare DNS-01 (88/88). No upgrade steps required.