/* INTER, SELF-HOSTED. See static/fonts/README.md for why and for how to refresh it.
This was a render-blocking to fonts.googleapis.com plus two preconnect
hints, on every page. The audience is CNAs and security teams, a meaningful
share of them behind proxies that block third-party font hosts, so the site's
typography depended on a request some readers could never complete, and every
page made a third-party request on a site whose subject is transparency.
ONE face, not four. Google serves the same VARIABLE font for every weight it
declares, so the 400/500/600/700 downloads were byte-identical; `font-weight:
100 900` lets the browser pick from the single file. The site was also asking
for a 300 weight that nothing renders.
`font-display: swap` is kept from Google's own declaration: text paints
immediately in the fallback and reflows when the face arrives, which is the
right trade for a page whose content is the point.
The unicode-range is Google's for the latin subset, verbatim. Anything outside
it falls through to the stack below, which is what should happen for the
accented characters in a handful of CNA names. */
@font-face {
font-family: "Inter";
font-style: normal;
font-weight: 100 900;
font-display: swap;
src: url("../fonts/inter-latin.woff2") format("woff2");
unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}
/* rbptracker.org additions on top of the inherited cve.icu system.
Nothing here restyles a cve.icu component; these are the pieces that system
does not have, because it never had to express a rule, a clock, or a
confidence tier. */
/* ---- the lead number ---------------------------------------------------- */
/* Redaction. The one visual flourish on the site, used only for the literal
API value, never decoratively. */
/* ---- chips ------------------------------------------------------------- */
.chip {
display: inline-block;
font-size: 0.72rem;
font-weight: 600;
letter-spacing: 0.05em;
text-transform: uppercase;
padding: 0.16em 0.5em;
border-radius: 3px;
white-space: nowrap;
font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
}
/* CHIP TEXT COLOURS ARE FIXED TO THE WORST BACKGROUND THEY LAND ON, not to the
one in the rule beside them.
Every chip on this site failed WCAG AA in light theme, and the reason none of
it was caught is that the chips are SEMI-TRANSPARENT: `rgba(220, 53, 69, 0.12)`
has no fixed rendered value, only one that exists after compositing over
whatever the row happens to be. A regex over CSS cannot composite anything, so
the 17-test a11y suite passed while chip-none rendered at 1.75 and chip-ok, the
marker for a satisfied launch condition, rendered at 2.41 against a bar of 4.5.
The colours below are solved against `--color-bg-secondary` (#e9ecef in light),
the darkest surface a chip sits on, so they pass everywhere else too.
rbp/contrast.py computes the ratios and tests/test_a11y.py asserts them. */
.chip-must { background: rgba(220, 53, 69, 0.12); color: #b42b39; }
.chip-should { background: rgba(108, 117, 125, 0.14); color: #5a6168; }
/* A launch condition that is satisfied. Green, but muted: this marks a promise
kept, not a result, and nine of these turning green is the start of a launch
decision rather than the end of one. */
.chip-ok { background: rgba(25, 135, 84, 0.14); color: #206b49; }
/* The "we cannot tell" bucket. Deliberately an outline rather than a fill, so it
does not read as a third category of finding sitting alongside MUST and
SHOULD. It is the absence of a measurement, and it is the largest column on
the page, so it has to look like a gap and not like a verdict. */
.chip-unmeasured {
background: transparent;
color: var(--color-text-secondary);
border: 1px dashed rgba(108, 117, 125, 0.55);
padding: calc(0.16em - 1px) calc(0.5em - 1px);
}
.chip-late { background: rgba(255, 193, 7, 0.18); color: #875f00; }
.chip-corrob { background: rgba(25, 135, 84, 0.12); color: #146f45; }
/* .chip-block was the "named from an ID block" owner tier. v1 publishes no
attribution, so no template emits it and the rule is dead. Removed rather
than left: dead CSS is what let a hand-typed test list look complete while
omitting a chip that WAS rendering. */
/* chip-none carried --color-text-muted at 1.75, which is the EXACT ratio the
comment further down this file claims to have fixed: that fix created
--rbp-text-muted and repointed the rules it knew about, and the chip kept the
old token. The rule it did repoint has since been deleted; this one had not
been found, which is the whole reason it is called out here. */
.chip-none { background: var(--color-bg-secondary); color: #666b70; }
/* DARK THEME. Solved separately against #151821, the card surface, because a
colour that passes over #e9ecef is not the same colour that passes over a dark
row and three chips failed here too. chip-none needs its BACKGROUND changed as
well: no text colour reaches 4.5 over --color-bg-secondary in dark, because
that token is #1a1d27 and the chip is the same value as the surface. */
[data-theme="dark"] .chip-must { color: #f87171; }
[data-theme="dark"] .chip-should { color: #9ca3b4; }
[data-theme="dark"] .chip-ok { color: #4ade80; }
[data-theme="dark"] .chip-late { color: #f0c25a; }
[data-theme="dark"] .chip-corrob { color: #4ade80; }
[data-theme="dark"] .chip-none { background: #262a36; color: #b6bcc7; }
/* ---- tables ------------------------------------------------------------ */
/* A BOUNDED scrollport, so `position: sticky` on the header actually has
something to stick to. This was `overflow-x: auto` with no max-height, which
made the wrapper a scroll container on both axes bound to a scrollport that
never scrolls: at 4000px of page scroll the th sat at -3,630px, so a table
44,000px tall at live scale was read with no column labels visible at any
point. The first columns a reader loses are Inferred owner, Confidence and
Rule, which carry all the hedging. (Review item 17.) */
.tablewrap {
max-height: calc(100vh - 8rem);
overflow: auto;
}
td.num, th.num {
text-align: right;
font-variant-numeric: tabular-nums;
font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
white-space: nowrap;
}
td.id { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; white-space: nowrap; }
/* ---- fan-out feed sub-rows (/status) ----------------------------------- */
/*
`csaf` is one row in the feed table and seventeen providers underneath it.
The sub-rows are subordinate, not separate: same alignment, same column for
IDs read.
They do NOT sum to the parent and the CSS used to tell readers to compare
them as though they did. Providers overlap: the same advisory can be carried
by an aggregator and by its publisher, and the parent dedupes while the rows
do not. On the run that prompted this the sub-rows totalled 6,793 against a
parent of 2,992. That claim is now made in the page's own copy instead of in
a comment nobody reads.
Indent AND a muted label, because indent alone is invisible once the table
scrolls sideways on a narrow viewport, which is exactly where these rows are
hardest to place. Both cues are decoration over a label that already reads
`csaf:www.cisa.gov`, so nothing here is the only thing carrying the meaning.
*/
tr.subrow > td { border-bottom-color: var(--color-border-light); }
tr.subrow > td.mono { color: var(--rbp-text-muted); }
td.indent { padding-left: 1.6rem; }
/*
A PROVIDER LABEL MUST BE ABLE TO BREAK, AT EVERY WIDTH.
`csaf:csaf.data.security.nozominetworks.com` is 42 monospace characters with
no break opportunity a browser will take on its own, and it sits in an
indented cell. Under 768px the reflow block at the foot of this file already
allows `.mono` to break anywhere; above it, nothing did, so the table pushed
the PAGE sideways: measured at 192px of overflow at 769px and 61px at 900px,
immediately above the breakpoint where the mobile rule stops applying.
WCAG 1.4.10 is written about 320px, which is why the existing rule is where it
is, and this failure sat in the gap that rule leaves. Scoped to this table
rather than made global: `.mono` on the list page carries CVE IDs, which are
short, break badly, and are meant to be selected whole.
*/
table.table-sm td.mono { overflow-wrap: anywhere; }
/* ---- caveat block ------------------------------------------------------ */
.caveat {
border-left: 3px solid var(--color-primary);
background: var(--color-bg-secondary);
padding: var(--spacing-md) var(--spacing-lg);
border-radius: 0 var(--border-radius) var(--border-radius) 0;
margin: var(--spacing-lg) 0;
}
.caveat p:last-child { margin-bottom: 0; }
.caveat.warn { border-left-color: var(--color-warning); }
.mono { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
.small { font-size: 0.85rem; }
pre.api {
background: var(--color-bg-secondary);
border: 1px solid var(--color-border);
border-radius: var(--border-radius);
padding: var(--spacing-md);
overflow-x: auto;
font-size: 0.82rem;
line-height: 1.6;
}
.stale-banner {
background: rgba(255, 193, 7, 0.15);
border: 1px solid var(--color-warning);
border-radius: var(--border-radius);
padding: var(--spacing-sm) var(--spacing-md);
margin-bottom: var(--spacing-md);
font-size: 0.9rem;
}
/* Quoted policy text. Marked with a rule rather than italics: these are the
passages that cut AGAINST the site, so they have to read as the source's own
words and not as this site's aside. */
blockquote {
margin: 0 0 var(--spacing-md) 0;
padding: var(--spacing-sm) var(--spacing-md);
border-left: 3px solid var(--color-border);
color: var(--color-text-secondary);
font-size: 0.94rem;
}
blockquote p:last-child { margin-bottom: 0; }
/* `.degraded-banner` stood here. The banner it styled was removed from base.html
on 2026-08-26 and the run's state is reported on /status instead, so the rule
styled nothing. Deleted rather than left: dead CSS is what let a hand-typed
test list look complete while omitting a chip that WAS rendering, and it is
what let a translucent stripe fail AA in dark theme for as long as it did.
The staleness banner is a different thing and keeps its rule below. Stale means
"this is old", degraded meant "this is incomplete", and a run can be fresh and
incomplete at the same time. */
/* ---- dark-mode gaps inherited from the cve.icu sheet -------------------- */
/* .metric-card fills with linear-gradient(--viz-color-1, --viz-color-2), and
the viz palette is defined only on :root. cve.icu overrides .stat-card for
dark but not .metric-card, so the card kept a pale blue fill on a near-black
page. Fixed here rather than in the ported sheet, so style.css stays a clean
copy that can be re-pulled from upstream. */
[data-theme="dark"] .metric-card {
background: linear-gradient(135deg, var(--color-bg-content), var(--color-bg-hover));
border-color: var(--color-border);
}
[data-theme="dark"] .metric-card:hover {
border-color: rgba(96, 165, 250, 0.4);
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.35);
}
[data-theme="dark"] .metric-value { color: var(--color-accent); }
/* ==========================================================================
Accessibility (review item 17)
==========================================================================
Two reviewers measured ten AA failures and one called them disqualifying for a
federal reader: a documented WCAG failure on the primary data table is a bar to
citing a third-party resource from official guidance, whatever the data quality.
PROJECT-OWNED TEXT TOKENS, measured against every background they actually
render on. The inherited cve.icu tokens were never re-audited against the
striped-row background this project introduced, and auditing against white is
the mistake to avoid: half the rows are not white.
Measured worst-case ratios (the lowest across --color-bg-content,
--color-bg-secondary and --color-bg-hover), pinned in tests/test_a11y.py:
token was (worst) now (worst)
text-secondary 3.95 FAIL 6.07
text-muted 1.75 FAIL 5.44
link 3.80 FAIL 5.43
The 1.75 was the abstention marker, the site's own statement that it does not
know, on the majority of rows. The least certain cell on the page was the
least legible one, so the site's conservatism was the part a reader could not
see. That is a semantic failure as much as a standards one. The cell it was
measured on is gone; the tokens it produced carry the whole site. */
:root {
/* THE INHERITED TOKENS, CORRECTED AT THE ROOT.
style.css loads first and sets --color-text-secondary: #6c757d (3.95 over
the striped row) and --color-text-muted: #adb5bd (1.75). This project
forked AA-safe values into --rbp-* and then repointed rules at them ONE AT
A TIME, which is why the fix kept missing things: sixteen rendered
selectors were still on the inherited values, including .chip-unmeasured,
td.desc, blockquote, .nav-menu a and every .footer link.
Repointing rule by rule is the method that failed twice. Overriding the
token fixes the whole class at once and cannot be missed by omission.
Values solved against #e9ecef, the darkest surface either lands on. */
--color-text-secondary: #5a6168;
--color-text-muted: #666b70;
/* Hover states are text a reader reads while pointing at it, so they carry
the same 4.5 bar. #0d6efd measured 3.80 on the striped row. */
--color-primary: #0b5bd2;
/* .logo:hover, .nav-menu a:hover and .footer a:hover all read this. */
--color-accent: #0b5bd2;
/* .metric-value, the big figure on every stat card, read this at 2.63. */
--chart-primary: #10538f;
--rbp-text-secondary: #52585e;
--rbp-text-muted: #595f66;
--rbp-link: #0a58ca;
/* The days-public signal. NOT --color-warning: that is #ffc107 and
renders at 1.37:1 on white, which the contrast harness caught the
moment the list page used it. Semantic colour still has to be
readable; a signal nobody can read is decoration. */
--rbp-age: #8A5013;
}
[data-theme="dark"] {
/* Same corrections for dark. --color-text-muted is #6b7280 there, which is
3.67 on the card surface. */
--color-text-muted: #9aa3b2;
/* --color-text-secondary HAS TO BE RE-ASSERTED HERE, and it was missing.
The :root block above overrides it to #5a6168, an AA-safe value solved
against the LIGHT surfaces. style.css sets the dark value to #9ca3b4 in its
own [data-theme="dark"] block. Those two selectors have EQUAL specificity
(0,1,0), so source order decides, and rbp.css loads second: the light
correction won in dark theme and --color-text-secondary resolved to #5a6168
against a near-black ground.
Measured in the browser at 2.54:1 against a bar of 4.5, on `.text-muted`,
which style.css sets from this token with `!important` in dark. That is the
footer of every page, the card sub-copy on /method, /policy and /status, and
the "how far the feeds reach" prose.
The comment on the :root block argues that overriding the TOKEN "fixes the
whole class at once and cannot be missed by omission", against repointing
rules one at a time. That argument is right and this is its one failure
mode: overriding a token at :root silently un-overrides the other theme
unless you re-assert it, and nothing about the light theme looks wrong.
#9ca3b4 is style.css's own dark value, which the harness had believed was
winning all along. 6.32 worst-case across the four dark surfaces. */
--color-text-secondary: #9ca3b4;
/* .theme-toggle:hover reads --color-primary over --color-bg-hover. */
--color-primary: #6ba5f8;
--color-accent: #6ba5f8;
--chart-primary: #6ba5f8;
--rbp-text-secondary: #b6bece;
--rbp-text-muted: #9aa3b2;
--rbp-link: #7cb0ff;
--rbp-age: #D9A05B;
}
/* THIS RULE CARRIED THREE DEAD SELECTORS AND TWO LIVE ONES, across two lines
with only the second holding the brace, so "delete the dead line" took the
live half with it twice. The dead three are gone and the body stays.
WHAT IT IS ACTUALLY WORTH, measured rather than inherited, because the note
that used to sit here said losing it dropped `.text-muted` to 2.54:1 in dark
and that is not true. In DARK this rule never applies at all: style.css sets
`[data-theme="dark"] .text-muted` from --color-text-secondary with
`!important`, which wins outright. The 2.54 was that token going un-asserted
for dark, which is a different fix, still in place two blocks up, and guarded
by test_a_root_override_does_not_silently_undo_the_dark_theme.
What this rule buys is LIGHT theme, where it wins on source order and swaps
#5a6168 for the darker #52585e: 6.07 worst case against 5.30 without it.
Both clear AA, so deleting it is a real loss of headroom and not a failure,
and no test goes red if it goes. Keep it, and keep the reason honest: the
next person to read this needs to know which half of the pair is load-bearing
and that the scary number belongs to the other one. */
.page-header p.text-muted, .text-muted { color: var(--rbp-text-secondary); }
/* FOCUS. One outline rule existed in the entire project, so no focus treatment
was ever designed, on a site whose primary surface is a sortable table. */
a:focus-visible,
button:focus-visible,
[tabindex]:focus-visible,
input:focus-visible,
select:focus-visible {
outline: 3px solid var(--rbp-link);
outline-offset: 2px;
border-radius: 2px;
}
/* Empty is not a warning, so it does not get .caveat warn's amber. */
.empty-state {
border: 1px dashed var(--color-border);
border-radius: var(--border-radius);
padding: var(--spacing-lg);
color: var(--rbp-text-secondary);
text-align: center;
margin: var(--spacing-lg) 0;
}
.empty-state strong { color: var(--color-text-primary); }
/* 768, NOT 767, and the single pixel was a real failure. It applies to the
reflow block further down, which is now the only 768 block in this file.
style.css opens `@media (max-width: 768px)` with `table { min-width: 600px }`
and `th, td { white-space: nowrap }`. A block opening at 767px leaves EXACTLY
768px, the iPad portrait width, with both of those on and nothing undoing
them. Whatever else changes here, do not move the number by one. */
@media (max-width: 768px) {
.tablewrap { max-height: none; overflow: visible; }
}
/* PRINT stripped every hedge. The inherited print block forces
`color: #212529 !important` on td, th, span and a, which collapses the entire
certainty vocabulary to one ink: a candidate MUST becomes indistinguishable
from a SHOULD, and the abstention marker loses its distinction. It also never
reset .tablewrap's overflow or the table's min-width, so an overflow box with
no scrollbar clipped the page. */
@media print {
.tablewrap { max-height: none !important; overflow: visible !important; }
/* AND THE TABLE'S OWN BOX, which is a separate container from the wrapper.
The reflow block above gives `table.table-sm` `display: block; overflow-x:
auto` so a wide figure table scrolls inside itself instead of scrolling the
page. That block carries no media type, so it matches PAPER too, where a
scroll container is a clip with no scrollbar and the reader loses the
columns silently. It also stops being a table, so the columns stop lining
up. The equivalent reset for the deleted `table.rbp` was here and left with
it; this is the same guarantee for the tables that are actually printed. */
table.table-sm { display: table !important; overflow-x: visible !important; }
/* Keep the vocabulary legible in one ink by giving each chip a border and a
visible label, rather than relying on colour that print flattens. */
.chip { border: 1px solid #212529 !important; background: transparent !important; }
.chip-must::after { content: " (MUST)"; }
.chip-unmeasured::after { content: " (not measurable)"; }
.caveat, .empty-state, blockquote { border: 1px solid #212529 !important; }
/* A printed page cannot be scrolled to the caveats, so keep them with the table. */
.caveat { page-break-inside: avoid; }
.nav, .theme-toggle, .nav-toggle, .skip-link { display: none !important; }
}
@media (prefers-reduced-motion: reduce) {
* { animation: none !important; transition: none !important; scroll-behavior: auto !important; }
}
/* The front page's h1. The lead count is the visual heading, so the h1 names the
thing and sits above it small: the page that will be ranked and linked most had
no h1 at all and an outline starting at H2. Not visually-hidden, because a
heading a sighted reader cannot see is its own problem. */
/* ---- narrow viewports: nothing may scroll the PAGE sideways ------------- */
/*
WCAG 1.4.10 (reflow) is failed by horizontal page scroll at 320 CSS px. This
site had 926px of it on /cves and 1,656px on /method at 375px wide.
The .rbp tables get the card layout above. These are the OTHER tables, the
coverage figures, the feed inventory and the launch checklist, which are
`table.table-sm` and were inheriting `min-width: 600px` and `nowrap` from
style.css with nothing to undo them. They stay tabular, because a
three-column figure table reads worse as stacked cards, and instead scroll
inside their own bounded container so the PAGE does not.
*/
@media (max-width: 768px) {
table.table-sm {
min-width: 0;
display: block;
overflow-x: auto;
-webkit-overflow-scrolling: touch;
}
table.table-sm th,
table.table-sm td {
white-space: normal;
overflow-wrap: anywhere;
}
/* Long unbroken strings are the other source of sideways scroll: CVE IDs,
URLs and mono spans in prose. */
.mono, code, pre {
overflow-wrap: anywhere;
word-break: break-word;
}
pre.api {
overflow-x: auto;
white-space: pre-wrap;
}
}
/* White text on a light-blue fill is 2.51 in dark theme. These are the only
rules that put `white` on --color-primary, and in dark that token is a pale
blue chosen for TEXT on a dark ground, not for a fill behind white. */
[data-theme="dark"] .skip-link,
[data-theme="dark"] .page-header button:active {
color: #0b1220;
}
/* ---- the nav band between the mobile collapse and comfortable ----------- */
/*
Measured at 72 to 79px of horizontal PAGE overflow across 769 to 847px on
seven of nine pages, with the theme toggle pushed entirely off screen. The
mobile menu collapses at 768px and the full nav does not fit until the high
840s, so there is an 80px band where neither layout works.
`flex-wrap: wrap` is the mechanism fix and is width-independent: the exact
pixel at which the nav stops fitting depends on font metrics, so a breakpoint
number alone would be right on the machine it was measured on and wrong on
the next one. The wider collapse is belt and braces.
*/
.nav { flex-wrap: wrap; }
.nav-menu { flex-wrap: wrap; }
@media (max-width: 900px) {
/* Collapse the menu across the whole band rather than at 768 only. */
.nav-menu { gap: var(--spacing-sm); }
.nav-menu a { padding-left: 0.4rem; padding-right: 0.4rem; }
}
/* ---- "Showing up in": the evidence column ------------------------------- */
/*
This is the column the site exists for. A reserved ID referenced in three
independent public advisories IS the finding, and it used to render as the
string "osv,ghsa,debian" in a mono span next to a separate integer count.
Now every source is the link to the page it is showing up on, and the count
is the number of chips a reader can see without counting anything.
*/
.where { line-height: 2; }
/* THE MEASURE. Body prose ran at 140-146 characters per line against a 45-75
readable band, on every page, because only the lead had a max-width. One
rule, applied where prose actually is. */
.page-header p, .card-body > p, .caveat p { max-width: 68ch; }
/* ==========================================================================
THE LIST PAGE. The lead, the source inventory, a sticky control bar, and the
rows under their group headings.
Built on the EXISTING tokens rather than a new palette, so the themes and the
computed contrast tests in tests/test_a11y.py keep applying unchanged. That is
a real constraint on the look and it is deliberate: tests/test_a11y.py
DISCOVERS the selectors it measures out of this file, so a hand-picked colour
introduced here is measured on the next run whether or not anyone remembered
to add it to a list. Anything that wants a new colour has to be solved against
every surface it lands on first.
========================================================================== */
.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;
clip:rect(0 0 0 0);white-space:nowrap;border:0}
body.locked{overflow:hidden}
/* ---- the lead: the count at full scale, the distribution beside it ---- */
/* The count was 1.7rem inside the sticky bar, between a search box and two
selects. It is the whole product of the site and it was set smaller than the
nav. Two columns rather than one so the shape of the data sits at the same
altitude as the number it describes: they are one claim and its evidence, and
stacking them puts a screen between them. */
.lead{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1.05fr);
gap:14px 56px;align-items:start;padding:26px 0 4px}
.lead-eyebrow{font-size:.7rem;letter-spacing:.19em;text-transform:uppercase;
color:var(--rbp-text-muted);margin:0 0 10px}
/* h1.cmd-count, not div: the count IS the front page's heading. It keeps the
class name because tests/test_copy.py reads `
` to check
that the headline and og:description carry the same count expression. */
.cmd-count{display:block;margin:0;font-weight:400;font-size:1rem}
.cmd-count b{display:block;font-size:clamp(3.4rem,9vw,6.4rem);font-weight:650;
letter-spacing:-.045em;line-height:.88;font-variant-numeric:tabular-nums;
color:var(--color-text-primary)}
.cmd-count b.dim{opacity:.45}
/* ONE LINE. The unit is the subject of the heading, and "reserved, public,
unpublished" broken after the second comma reads as a list that ran out of
room rather than as the phrase it is. It was wrapping because of a 22ch
measure inherited from when this sat inside the command bar and had a search
box beside it competing for the width; nothing is beside it now. */
.cmd-count span{display:block;margin-top:12px;font-size:1.12rem;line-height:1.35;
white-space:nowrap;color:var(--color-text-primary)}
.lead-floor{margin:16px 0 0;font-size:.85rem;line-height:1.55;max-width:44ch;
color:var(--rbp-text-secondary)}
.lead-floor b{color:var(--color-text-primary)}
/* The scope of the count, directly under it. Same secondary colour as the floor
note so it reads as qualification rather than as a second claim, and sized
between the count and the floor text: a reader who takes in only the number
and the line under it has still been told the window. */
.lead-window{margin:10px 0 0;font-size:.92rem;line-height:1.4;font-weight:500;
color:var(--rbp-text-secondary)}
/* ---- the distribution: the legend for the list ---- */
.dist{margin:0;border-top:2px solid var(--color-text-primary);padding-top:14px}
.dist-cap{display:flex;flex-wrap:wrap;justify-content:space-between;
align-items:center;gap:8px 16px;margin-bottom:14px}
.dist-lab{display:flex;align-items:center;gap:8px;font-size:.82rem;
color:var(--rbp-text-secondary)}
.dist-lab select{font:inherit;font-size:.86rem;font-weight:600;
color:var(--color-text-primary);background:var(--color-bg-content);
border:1px solid var(--color-border);border-radius:6px;padding:5px 9px;cursor:pointer;
/* A