The favourite star already had a burst - a pop, a ring wave and sparks. The rating stars now share it: once the counted rating is swapped in, the stars up to the chosen one burst in a row. The toast a refused vote raises turned white in the dark scheme, and the repeated-vote message ended in a bare number of days.

Core changes:

1. One burst for two owners (plugins/system/slaed.js):
2. setBurst(node, turn) pops one node and staggers it by --sl-d-turn; the favourite star calls it as before

3. A star vote is remembered in htmx:configRequest with its target and value; htmx:afterSwap of that target bursts the stars up to the value, and a refused vote forgets it

4. Burst and toast styles (templates/lite/assets/css/theme.css):
5. .sl-is-burst is no longer bound to .sl-fav; a rating star takes the round the ring needs only while it bursts
6. The sparks stay hidden until their star's turn; keyframes renamed sl-burst-pop, -ring and -spark
7. The toast is an inverse band, as the top bar is: --sl-bg-inverse with --sl-band-text in both schemes
8. The repeated-vote message (core/system.php, lang/*.php, docs/RATINGS.md):

9. _RATINGS_WAIT names the date the next vote opens, in _DATESTRING, in all six locales

   • a date reads without plural forms, which a bare count of days could not

Benefits:

• The rating answers a vote with the same gesture the favourite star does, from one mechanism
• The toast reads on either page, and the message says when rather than a number of what

Technical notes:

• The --sl-fav-* tokens keep their names: the API is frozen, so the rating stars read them as they are
• Retry-After still carries seconds; only the text changed
• tools/ui-audit-baseline.json and tools/ui-contrast.json are stored for the whole series of three commits

In the dark scheme the tone tokens turn into light tints: right for a glyph, glaring as the fill of a whole bar. Every solid surface of the admin theme now reads its own --sl-solid-* tokens, which hold the light scheme's tone in light and that tone under a seventy per cent shade in dark, so the bars read the same in both and in every browser.

Core changes:

1. Solid bar tokens (templates/admin/assets/css/base.css):

2. --sl-solid-bg, -border, -text and -shadow for the primary bar

   • -good-, -warn- and -bad- variants carry the success, warning and danger fills and borders
   • -link-text is the glyph of a link on a solid band in hand
3. --sl-footer-border, and the footer stripe gradient reads the shaded tone in dark
4. --sl-beam-width, -dur, -bg and --sl-pointer-width for the motion layer
5. Solid surfaces (templates/admin/assets/css/theme.css):
6. Panel heads, sidebar block heads in all their tones, the toolbar item in hand, the footer band and the login footer

7. The toned buttons sl-but-blue, -green and -red, and the mini buttons in hand, pressed or leading, with the dial toggle

   • the four mini rules shared one body and are one selector list
   • the muted and disabled mini hover set the whole background, so the gradient never shows through
8. A beam crosses each head once a cycle, staggered by --sl-d-turn, and at once under the hand
9. A soft light follows the pointer over the page, as on the presentation page
10. Behaviour (templates/admin/assets/js/admin-ui.js):
11. setBeamTurns() writes each head's place in the beam order
12. The pointer is written once a frame; touch and reduced motion get no light
13. Contract (tools/ui-contract.php):
14. Components pointer, solid, solid-bad, solid-good, solid-link, solid-warn
15. --sl-d-turn registered; --sl-d-pointer-x/-y also written by admin-ui.js

Benefits:

• One colour principle for every solid surface of the panel, light and dark from one token
• No @property or color-scheme pinning, so Firefox renders the dark bars exactly as Chromium does

Technical notes:

• The light scheme is unchanged: each token's light half reads the semantic tone it replaced
• All motion stands under prefers-reduced-motion: no-preference
• The audit baseline and the contrast registry are stored with the rating commit that closes this series

The label baseline still carried three defects after the last store. Two were one bug on the ban list page, the third was a hint the crawl could not place. All three are gone, and the baseline holds no violation, so any new label defect turns ui:label red.

Core changes:

1. Ban list forms (admin/modules/security.php):

2. The account ban form named its time and reason fields f-time and f-info, the ids of the address ban form on the same page

   • Its fields are f-utime and f-uinfo, so every label points at the field beside it
3. Label crawl rows (tools/label-audit.mjs):

4. .sl-opt-tile is the fourth row shape: a tile holding one group, the avatar gallery, carries the group's description as its text, so the tile is the row its hint belongs to

5. Label baseline (tools/label-audit-baseline.json):
6. The three recorded violations are removed; coverage is unchanged

Benefits:

• A click on a ban form label focuses the field it names
• ui:label starts from zero violations

Technical notes:

• No stored data, route or interface changes

65ce7687 shipped config/fields.php without its account and forum sections. The fields unit of the 6.3 update reads a named file as the 6.3 format and requires each of its three areas to be a definition list, so a 6.2 site without a field configuration of its own stopped with a refusal before its schema ran.

Core changes:

1. Shipped field definitions (config/fields.php):

2. account and forum ship as empty definition lists instead of being absent

   • The demo fields stay removed; order keeps its example with field1 not required

Benefits:

• The 6.2 update finishes on the first run again (UpdateSiteTest)
• A clean installation carries no demo profile or forum fields

Technical notes:

• Configuration only; setUpdateFields() in setup/index.php is unchanged
• The stand keeps its own config/fields.php, only the shipped copy changes

The Node plan left open records outside its acceptance: defects of shop, order, forum, account, the core and the installer that its windows met and were not allowed to fix. This commit closes all of them in ten batches, each with a test that fails without its fix, and widens the gates so the code rules and the tooling hold.

Core changes:

1. Shipped configuration and admin security (config/, admin/modules/.php, modules//admin/index.php):
2. The debug panel ships closed (var_view 0) and getVariables() escapes every value
3. The test bans of the stand leave config/security.php; the demo fields of account and forum leave config/fields.php

4. Every state-changing admin handler checks checkAdminPost() with its module scope; row actions post

   • GET, header and query tokens are refused, AdminGuardTest scans every admin file
5. The admin file rename accepts a plain name only and reports a failed rename
6. Form fields named name are renamed, category parents refuse cycles, setForumLast() ends on a stored cycle
7. Shop, order, forum and contact (modules/shop, order, forum, money, contact):
8. The checkout reads the cart through getCartCookie() and clears it with setCookiesDelete()
9. getTplPager() takes a known count; the product list qualifies p.status; mass actions split categories and modes
10. Point compensations roll the owner back on false, as docs/POINTS.md now describes
11. The CSV import leaves votes and comments alone, opens only files of its own directory, and stops repeating the id
12. Settings texts of shop, order, money and contact use the editor field and the breaks format, so a save is stable
13. Core writes, cache and templates (core/classes/template.php, pdo.php, cache.php, comment.php, core/system.php):
14. Compiled templates and scheduler state files are written through a temporary file and a rename under a lock
15. The panel bumps the page cache on its first write and once more at shutdown; _session writes no longer bump
16. Comment::updateBody() and the deferred recount run under the write guard; silent failures log their reason
17. Cache::setDirPath() creates every cache directory and tolerates a lost mkdir race
18. Node (core/classes/node/*.php, modules/node/):
19. getTreeRows() limits replies per root in one light walk; batch sizes follow NodeQuery::getTargetSize()
20. Comment::getThread() reads a support thread at once; stored types normalise a late rule on read
21. view.mode is a closed list, the report switch follows the mode, categories and sitemap follow the language
22. A non-moderator without pre-moderation gets no external address field; import failures answer their reason
23. Installer and the 6.3 update (setup/index.php, setup/sql/table_update6_3.sql):
24. Duplicate rating rows are removed before the unique key, the 6.2 loader is replaced by the shipped panel
25. checkSetupCode() counts failures under a lock and removes the key after the fifth

26. The update carries an early 6.2 schema, NULL addresses, negative balances and MySQL 8 zero dates

    • New fixture tests/Fixtures/update62early; the fixtures' site.sql is kept by .gitignore
27. Interface and language (templates/, lang/, plugins/system/slaed.js):
28. Favourite buttons post without an href, POST-only ops answer 405, the admin pager shows its total
29. _BACK means back in Polish and Ukrainian; the rating widget reads the checked rule and answers blocked scopes
30. The forum repair of counters is a POST button; auto_links reads banners of the site theme
31. Code rules sweep (whole tree, tests/PhpFileFormatTest.php, .php-cs-fixer.dist.php):
32. Comments leave function bodies, one line above a class, no period, no Cyrillic, 180 characters per line
33. list_syntax and indentation_type join the fixer; shop and whois are indented with spaces
34. Gate tooling (tools/ui-shots.mjs, tests/Support/tree_walk.php, tests/bootstrap.php, tools/upload-route-check.php):
35. ui-shots signs the modes in one after another with one retry; --before --only keeps the rest of the pair
36. Every source gate walks the tree through getTreeFiles(), which never enters storage or a scratch theme
37. In-process tests log into a directory of their run instead of the site log of the stand
38. setFailTrigger() is defined again; PointTest and RatingTest fail on a broken probe instead of skipping

Benefits:

• A clean installation no longer exposes cookies and sessions or carries test bans
• Admin state changes need a POST of their own scope
• The full suite and ui:gates can run side by side without false failures

Technical notes:

• Schema: table_update6_3.sql removes duplicate _rating rows and aligns the early 6.2 column shapes

• API: getTplPager() accepts count, NodeQuery::getTargetSize(), NodeQuery::MODES, Comment::getThread(), Rating::getRule() and the blocked code 503, Point::$active readable, checkCatRight() replaces checkCatRead()

• Breaking: admin handlers refuse tokens outside a POST of their scope; a stored forum or category cycle is refused on save; view.mode support requires the support extension