The requirement list still opens only while the new-password field
is focused. After blur, unmet rules stay visible as field text, and
Save can be pressed to return focus to that field.
Use consistent field labels, validation, and strength guidance in both password-change flows.
Show requirements only while the new-password field is active and surface validation failures clearly.