The field standard tied captions to controls but left four kinds of row unnamed: a radio group, an editor and a hint carried no accessible name at all, and the value row was a label labelling nothing. One helper now owns the three ids a row needs, every group, editor and hint is tied to what belongs to it, and a row folds on the box it stands in rather than on the window.

Core changes:

1. Field identity (core/helpers.php):

2. getFieldIds() answers the control, caption and hint ids of one row

   • The id is taken and never derived from the field name: this tree writes ids by hand and the mapping is no rule
   • Only a row whose field has no labelable control mints one, from the seed the caller names and a per-request counter
3. getTplRadioGroup(), getTplTextarea(), getTplModuleSelect() and getTplRefreshTimeSelect() carry a caption id and a hint id down
4. getTplAddFieldRows() gives its dynamic controls an id and the row a for
5. Row markup (templates/*/fragments/div-row.html, label.html, form-field-row.html):

6. hint_html, hint_id and label_id are row keys; the hint leaves the label element and keeps its cell

   • A caption that swallowed the hint read the explanation out as the name of the field
7. label-hint.html is gone and its 98 call sites carry caption and hint apart
8. lite renders a span where a row has no for, instead of a label labelling nothing
9. Radio groups (core/helpers.php, block-content.html, partials/div.html):
10. Every .sl-radio-group carries role="group" and aria-labelledby to its own caption
11. The switch variant and the checkbox lists built through the div partial take the same two attributes
12. Editors (core/classes/editor.php, plugins/editors/*/driver.php):

13. Editor::getNameData() settles the name once, so four drivers cannot answer it four ways

    • A caption is pointed at; a row without one is named by its own text
14. plain writes the name onto its textarea; toastui and ckeditor onto the mount, and their JS moves it to the element holding role="textbox"
15. TinyMCE takes aria-label only: its editable body is a second document and an IDREF does not cross that boundary
16. EditorPlain::getWidget() uses the declared fragment keys instead of a hand-built attribute string
17. Hints (core/admin.php, admin/modules/.php, modules//admin/index.php):
18. aria-describedby ties every hint to the control, or to the group, of its own row
19. catacess() and getMailRow() learned to take an id, so the rows they build can be pointed at
20. Read-only value row (templates/*/fragments/field-value.html, assets/css/theme.css):
21. Own vocabulary: .sl-value-row, .sl-value-label, .sl-value-text, and the caption is a span
22. The panel row gains the fold it never had; .sl-form-* now means the editable row and nothing else
23. Container fold (templates/*/assets/css/theme.css):
24. A grid nested in another row's field cell folds unconditionally: measured 496 to 816px at the four rig widths, it never has room for two columns
25. .sl-oauth-form and .sl-pmf-reply declare a container, so a card in a minmax(280px, 1fr) column and a composer in a split pane fold while the window is wide
26. The crawl and its baseline (tools/label-audit.mjs, tools/label-audit-baseline.json):
27. npm run ui:label walks the panel, the site as a member and the site as a guest, and asks of every rendered document what no count in a file can ask
28. 417 baseline entries fell to 20: what remains is 15 duplicate ids, four codemirror editors and one for that reaches no labelable element, each recorded on purpose

Benefits:

• A screen reader announces the question a radio group answers, the caption an editor carries and the sentence that explains a field, none of which it could before
• One owner for the three ids of a row, so a caption, a group and a hint cannot disagree about the name that joins them
• The panel value row folds on a phone instead of holding a 160px caption column down to it
• A form row in a narrow box reads the box, so the OAuth card stops drawing two columns in 342px

Technical notes:

• fragments/label-hint.html is removed. A theme package outside this repository that renders it must move to the hint_html row key
• getMailRow() in admin/modules/config.php takes the id triple as its fifth argument; catacess() and getTplModuleSelect() gained optional id and description arguments and stay compatible with every existing call
• --sl-form-label-width keeps its name although the rule it serves was renamed: the admin API block is frozen and a distributed theme reads that name
• No count reported by tools/ui-audit.php moved; tools/ui-contrast.json was regenerated from the final tree
• docs/FORM-FIELDS-2026.md is deleted, and what outlives it is in docs/TEMPLATES.md under Form Row Contract and Label crawl

Every form row on both sides now puts its caption in the left column and its control in the right one, an editor takes the whole row, and the colon that separated the two is gone. The caption is tied to its control by an explicit for and id, which no row in this tree carried before.

Core changes:

1. The row (fragments/form-field-row.html, fragments/div-row.html):

2. The site row is a two-track grid, a quarter to the caption and three quarters to the field, folding to one track under 900px

   • The label cell is rendered unconditionally, so a row with no caption leaves

the left track empty instead of sliding the field into it

• hide_label is gone: 91 call sites hid the caption and showed a placeholder

in its place

• An editor row drops to a single track with the caption above it, which is the only exception to the two-column rule

• A tall field is read from its first line, so the caption meets it there rather than floating at half its height

• The panel row wraps its caption in a label when the row names a control
• The colon (assets/css/theme.css of both themes):
• Every ::after rule that drew the separator is removed

• With it go the mechanisms that existed only to cancel it: sl-no-colon with its important override, and the is_action_label flag with its sl-action-label class

• The link from caption to control (143 site rows, 890 panel cells):
• 527 rows carry label_for beside input_id, or selectid on a panel select
• getTplCategorySelect() emits an id of its own

• fragments/label.html, select.html and textarea.html gained the keys the link needs, and the panel hint became a span so the caption above it can be a label without holding block content

• Two forms that were written by hand now follow the standard:
• The OAuth link and create forms, which had no captions at all
• The private message composer, which hid its captions from sight
• Defects the work uncovered:

• sl-hidden lost to the display the row itself set, so a row marked hidden stayed visible: fifteen link rows in the media form, the GitHub fields of the changelog configuration

• The panel media form gave its rows and its inputs overlapping ids
• The suggested nickname of the OAuth form was escaped twice
• Contrast (templates/lite/assets/css/theme.css, tools/ui-contrast.json):

• The two edge tabs drew white on a pastel plate at 1.68:1 and 1.86:1, below AA along the whole plate; they now take the strong text tone at 7.66:1 and 6.92:1

• The pair registry is regenerated and no longer names a deleted class

Benefits:

• One field standard instead of two conventions, so a new form has a shape to follow rather than a choice to make

• A caption that names its control to assistive technology and focuses it on click, which no row did before

• Two hidden-row defects, one duplicate-id defect and one double-escape gone

Technical notes:

• Ids read f-<name>; ten rows resolve theirs conditionally, because the author row shows a plain value to a member and an input to a guest

• No schema, route or op name changed, and every form posts what it posted

• Verified by walking 24 site pages and 252 panel pages: every for resolves to a labelable element, no id repeats on a page, no label nests inside another

• What the standard still owes, and why radio groups, editors and hints have no accessible name yet, is planned in docs/FORM-FIELDS-2026.md

The side and top keys a module carries have decided nothing since the modules moved off their table: the two globals the foot reads by were never assigned, so every page rendered all four block positions. The reading is restored, and the grid stops holding a column it was no longer given.

Core changes:

1. The module block setting reaches the renderer (index.php):

2. $blocks and $blocks_c are assigned from $mconf beside active and view

   • setFoot() reads both by global and skips the sides a module switched off
   • They were declared in the global list of setFoot() and assigned in no file of the tree
   • A null global compares equal to the empty string, so the first branch of all four won always

3. The line lost in the migration read the columns blocks and blocks_c of the modules table

   • The keys are now side and top of $conf['modules'][$name], the values unchanged: 0 both, 1 first, 2 second, 3 neither
   • The four conditions of setFoot() are the ones 6.2 shipped and needed no edit
4. The home branch stays as it is, which is what 6.2 did: a random module never decided the blocks of the front page
5. The content grid follows the columns that exist (theme.css):

6. #container declares one column, and a side track only under :has() of the rail it belongs to

   • Left alone, right alone, both, neither - four rules, each naming its own template
   • The empty right track cost the content 400px of width and 24px of gutter on every page without blocks
   • #leftbar had no track at all: with left blocks the content would have landed in the sidebar column

7. The three rules sit inside @media (width > 900px) rather than at the top level

   • :has(#sidebar) carries the specificity of an id, which would outrank the narrow-screen reset
   • The two queries are complementary, so the stacked layout below 900px is untouched
8. The narrow-screen rule drops its grid-template-columns: it repeated the base, and 1fr is minmax(auto, 1fr)

Benefits:

• A setting the panel has been saving for years does what its label says
• A module without blocks reads across the full measure instead of against a 424px margin of nothing
• The layout answers the markup, so a left rail needs no second rule the day a left block is written

Technical notes:

• Behaviour: every module whose side or top is not 0 changes appearance, not only the one that was edited
• API: no token added or moved; both rules read --sl-layout-sidebar and --sl-layout-gutter as before
• Compatibility: :has() is already load-bearing in this theme; without it the page degrades to one column
• Gates: ui-audit clean per theme and global, counters identical to HEAD, ui:gates 193 green, phpunit 915 green
• Not run: the screenshot pair, for want of SLAED_UI_USER and SLAED_UI_PASS on the stand

The two photo bands of the front page gain a slow beam and a veil the dark mode alone puts on, the lower menu is laid out by icons at every width and closes the page on the same 50px edge the top bar opens it with, and every season and slider photograph now ships as WebP at a third of the weight.

Core changes:

1. Light beam on both photo bands (base.css, theme.css):

2. Four tokens carry the whole effect, all declared through light-dark() in the API block

   • --sl-band-bg is the veil: transparent in light, half-strength ink in dark
   • --sl-beam-width, --sl-beam-dur and --sl-beam-bg are the shaft, its pass and its light

3. The darkening lives in the alpha of the colour, not in an opacity layer

   • The opacity ladder carries no even half, and an alpha inside a colour is part of the colour

4. The beam travels upright at an even rate: eight seconds, three and a half of travel, four and a half at rest

   • It starts its own width left of the band and ends a window past it, which holds at any width
   • No literal outside the API block: calc() off the width token, 100vw, and the named layer tokens
5. Season photographs cover their band again (theme.css):

6. The ten season rules set the background with longhands instead of the background shorthand

   • The shorthand reset background-size, and with it the cover the base rules declare
   • On a narrow screen the band grew taller than the photo, which then hung as a strip
7. #head-content restates its own position, because its base rule centres on 50% 0
8. Season and slider art in WebP (images/, theme.css, index.php, main-slider.html):
9. Seventeen season files and four slider files replaced, 668 KB down to 248 KB
10. Every reference follows: seventeen url() in the theme, the LCP preload builder, the slider partial
11. ViewBridgeSmokeTest asserts the slider paths by name and moves with them
12. Footer menu as an icon grid (site-footer.html, base.css, theme.css, ui-contract.php):

13. Each destination carries its icon in the markup, never in an nth-child rule

    • A rule keyed on position drifts from the labels the first time a section is added
14. Three shapes of one idea: one row above 1200, four columns to 768, two columns below
15. --sl-fmenu-min-height is one thumb target and one row height, because it is one decision

16. --sl-fmenu-height reads --sl-topbar-height, so the page closes on the edge it opens with

    • Both are floors rather than fixed heights: below the wide step both blocks grow with content
17. The bar separator survives only in the single row, where a line break cannot strand it
18. Component names beam, fmenu declared in the contract
19. Prototype stands (demo/):
20. demo/ gains the hybrid of beam and season particles, and its beam variant matches what shipped

21. demo/footer/ is a new stand: fourteen treatments of the lower menu, each one <style> block

    • A variant renders inside an iframe of a chosen width, because the theme answers the viewport

Benefits:

• The dark mode stops asking white text to stand on a photograph shot for daylight
• A phone no longer meets a hanging separator, a 23px tap target or a stranded advertising line
• Four fewer JPEG kilobytes on every page view, and a third off the theme image payload
• Both bands and the footer are described by tokens, so the next theme repaints them from one block

Technical notes:

• Storage: seventeen season JPEG and four slider JPEG deleted; their WebP counterparts keep the pixel sizes
• API: --sl-sep-height stays declared and read, because a frozen API may gain a name and never lose one
• Compatibility: WebP needs no fallback at the theme baseline (Chrome 123, Safari 17.5, Firefox 120)
• Gates: ui-audit clean per theme and global, phpunit 915 tests green, ratchet re-stored

The panel settings window landed in 7e864723 with three rows built three ways, one of them posting without a token; the locale switch answered to any GET that carried newlang. This commit closes both, collapses the rows onto one builder, and follows the RSS feed the same way: declared where a reader looks for it, stable where it was random.

Core changes:

1. Settings window (core/admin.php, templates/admin/fragments/settings-row.html):

2. getAdminSettingsRow() takes the axis and returns the row

   • getAdminLanguagePick() and getAdminEditorPick() collapse into it
   • the panel stops drawing a mode row of its own, so templates/admin/fragments/

mode-switch.html and its fork entry in tools/ui-contract.php are gone

• the sl-mode class moves onto settings-row.html behind an is_mode flag, which

keeps --sl-mode-width and --sl-mode-height read and the frozen API intact

• hidden fields settle on fragments/hidden.html for all three rows

• the sidebar editor block leaves getAdminInfo(); the window is the only place the editor is offered, and the function loses three globals and gains a return type

• CSRF on the editor and the locale (admin/index.php, core/security.php, index.php):
• updateAdminEditor() refuses a request without checkAdminPost('changeeditor')

• setLang() only reads the cookie now; setLangChoice() does the writing

  • a token check cannot live in setLang(): it runs before the session, the database

and the parser exist, and every admin POST came back as the login page

• both op=newlang handlers call it and redirect, so the POST turns back into a GET

• scope newlang joins the token allowlist of checkDynamicMark(), because the site block sits on cacheable pages and needs getPageToken()

• Language producers (blocks/languages.php, templates/lite/fragments/lang-switch.html):
• the flags became submit buttons of one form, the select became a POST of the same
• the geo redirect writes the cookie directly instead of handing itself ?newlang=

• getAdminLanguageLinks() is gone: the panel renders with the admin theme, whose layout has no admin_langs, so the strip was computed on every load and discarded

• RSS feed (core/user.php, core/system.php):
• the site declares its own feed with <link rel="alternate"> in the head
• <atom:link rel="self"> and dc:creator replace an antispam@antispam.com placeholder
• ?go=rss without a name answers with the first module instead of a random one
• Route handler names (admin/index.php, core/system.php, modules/account/index.php):

• every handler carries a verb prefix now: updateAdminEditor, setAdminThemeMode, setAdminLanguage, deleteAdminSession, getAdminLoginForm, checkAdminLogin, addAdminAccount, and login_report becomes addLoginReport

• the op strings and token scopes they answer to are untouched
• Login journal (core/system.php):

• addLoginReport() reads the flag before the kind becomes a string

  • a non-empty string is true either way, so log_u was unreachable and log_a alone

decided both journals, which wrote user passwords the operator had switched off

1. Removals and site header (docs/, demo/, templates/lite/partials/site-header.html):
2. docs/SETTINGS-FIXES-2026.md and demo/ are deleted, no code referenced either

3. the RSS button leaves the header, browsers have not rendered a feed since 2018; the remaining tones shift back onto a contiguous position % 6 cycle

4. --sl-wordmark-img-width 145px -> 150px and a quoting fix in ThemeCreationTest.php ride along, both unrelated to the rest and included on request

Benefits:

• One builder and one fragment for a row instead of three constructions
• Two handlers that changed state without a token now refuse one that lacks it
• A locale change no longer happens because a prefetcher followed a link
• Readers find the feed without being handed its address

Technical notes:

• Breaking: log_u now means what it says. With log_a on and log_u off, user logins stop being written to log_user.log, and the attempted passwords with them

• Breaking: RSS <author> becomes <dc:creator>; a parser reading <author> loses the name
• Breaking: ?newlang= as a GET no longer switches the locale anywhere
• The site language switch returns to the referring page rather than to the home page
• No storage, schema or route changed: every op string and token scope is as it was