A hook that is present but never runs is worse than no hook: it reads as covered. On any clone other than the one it was written in, this one was present and silent for three unrelated reasons, and on a machine without composer it would have refused every commit without saying why.

Core changes:

1. The hook is enabled per machine, not per repository (package.json):

2. core.hooksPath lives in .git/config, which neither a clone nor a pull carries

   • git will not let a repository enable its own hooks, which is a security property

and not an oversight, so something has to set it on each machine

• postinstall sets it during npm install, and npm run ui:hooks sets it by hand
• the postinstall falls through with a message outside a git checkout instead of

failing the install

1. The hook file was committed without its executable bit (tools/hooks/pre-commit):

2. core.fileMode is false in this checkout, so chmod +x never reached the index and the file went in as 100644

3. Windows does not care - git runs hooks through sh either way - but git on Linux and macOS skips a non-executable hook without a word

4. git update-index --chmod=+x puts it in as 100755
5. The hook assumed two tools that a fresh machine does not have (tools/hooks/pre-commit):
6. php has to be on the PATH of the shell git runs hooks in
7. vendor/ is gitignored, so phpunit is absent until composer install

8. both are checked before anything else and each stops with its own reason and the remedy, rather than failing on a confusing error or stepping aside quietly

9. verified in all four directions: no php stops with the PATH message, no vendor stops with the composer message, SLAED_SKIP_GATES=1 passes silently, and a normal tree prints [gates] ok

10. Documentation (CONTRIBUTING.md, docs/TESTS.md):
11. both said "enable it once per clone", which reads as something the clone does

12. both now say it is per machine, name core.hooksPath and .git/config as the reason a clone and a pull leave it behind, and record what the hook refuses to run without

Benefits:

• the hook either runs or says why it did not, on any machine
• npm install is enough to arm it after a clone

Technical notes:

• this commit carries no file the gates watch, so the hook exits early on it by design; the fast set was run by hand instead and is green

• a gate that steps aside when its tools are missing is the failure this repository has now closed five times, which is why both new checks refuse rather than skip

A theme cannot restyle what PHP hardcodes, so the closing batch of the etalon plan moves every class attribute, inline style and HTML tag out of PHP and into the theme layer. The scan that measures it falls from 143 occurrences in 21 files to zero and gains a limit, so the next one fails the build instead of printing a number.

Core changes:

1. Extended statistics panel (admin/modules/statistic.php):

2. The inline <style> block it printed painted with --line, --bg, --soft, --muted, --blue2, --green, --purple and --orange

   • None of those eight names exists in either theme, so every border, background,

shadow and accent in the panel resolved to nothing and it had never been styled

• No count could see it: the audit reads CSS files and this was a string in PHP

• The markup is partials/statistic-extended.html and the CSS is 24 rules in theme.css

  • Every value lands on a ladder; the four accents are primary, success, warning

and accent; five component tokens are declared under statx

• These eight images are the only ones of 168 that moved, and they moved on purpose

1. Monitor traffic chart (admin/modules/monitor.php):

2. The 900x285 SVG becomes partials/monitor-chart.html taking four series, six hover slots and two axis lists

3. Four attribute kinds are dropped as dead

   • stroke and filter on lines and areas are SVG presentation attributes, which lose

to any CSS rule, and .sl-chart-line-up { stroke: ... } had been winning already

• .sl-chart-tip .muted set fill: var(--sl-text), which .sl-chart-tip text two rules

above already set, so the rule and the class are both gone

1. Markdown and BBCode renderer (core/classes/parser.php):

2. 55 tags, 7 inline styles and 4 classes move into four new fragments plus the existing list, list-item, code-highlight, blockquote, div and parser-image

3. A fragment can own a regular expression's replacement string once it renders the placeholder

   • parser-inline.html rendered with content_html set to the literal $1 gives the

template a whole element and PHP a replacement string

• A pair that wraps text the parser has not finished reading renders the same whole

element with \x01 as its content and is split there, so a theme never spells half
a tag

• The blockquote and attachment fallbacks are gone: the parser renders through the theme or not at all

• One decision, one address, across eighteen smaller files:

• class strings inside form_attr become semantic flags in form-add.html and form-wrap.html

• style="display:none" becomes the hidden attribute, which the reset gives !important so nothing a component sets can put back what the page took off screen; the tab script writes .hidden instead of style.display

• Eight sites that joined text with a tag now call getTplLines() over fragments/lines.html

• add_voting() built class="sl-field sl-form-control" into select_attr, where select.html had already written class="sl-select..."; an HTML parser keeps the first attribute of a name, so the string had never reached a pixel and is deleted with its parameter

• The captcha directory guard copies storage/index.html instead of building a document
• Gates (tools/ui-contract.php, tests/Unit/ParserFixturesTest.php):

• markup.limit is 0, so php tools/ui-audit.php --markup exits non-zero on the next hardcoded class, style or tag

• ParserFixturesTest asserts the exact HTML of 86 cases and ran with no engine, so every expected string was what PHP concatenated; it builds a Template now, because the bytes it asserts are a theme's answer

• tools/ui-contrast.json is regenerated beside the manifest that feeds it: 438 pairs, 118 admin and 320 lite, contrast at zero in both

Benefits:

• A theme can restyle every element the CMS emits, which is the goal of the plan expressed as a measurement: markup 0, and every count either theme controls at zero

• The statistics panel is readable for the first time, in both light and dark
• Three gates that were reporting stale answers now report current ones

Technical notes:

• Six fragments are byte-identical in both themes: lines, editor-mount, parser-block, parser-inline, parser-link, parser-table; two partials are the panel's alone

• The parser now hard-depends on the theme layer; there is no plain-HTML fallback left

• The parser disk cache already carries getTheme() and the class mtime in its key, so theme-owned markup cannot be served across themes or across this change

• Masking an element for the screenshot gate removes it from the contrast gate, because the collector skips visibility:hidden and display:none; the registry shrank from 460 pairs to 438 for that reason and not from a regression, which the retired span.sl-but.sl-hidden still sitting in the committed file independently proves

• No breaking change: 86 byte-exact parser fixtures pass unchanged, and 160 of 168 baseline images are identical to the pristine tree

Batch 8 of docs/THEME-ETALON-2026.md. Canon reconciliation is what makes the two shipped themes etalons rather than two codebases with matching names, and the checks that were meant to drive it were adding unlike populations together: one figure of 424 duplicates and one of 135 divergences is answered by grinding rather than by thinking. Split into what they actually measure, they left 50 duplicate groups and 46 divergences - sets small enough to decide one by one.

Core changes:

1. Cross-theme divergence becomes a gate (tools/ui-audit.php, tools/ui-contract.php):

2. checkCrossTheme() reads a shared selector two ways

   • same property set, different values: legal, one canon carrying many skins
   • different property sets: needs a written reason under divergent
3. 135 divergences are now 117 = 71 in value alone and 46 in structure, all explained

4. the element reset was settled structurally instead of registered: h1..h5, hr, ol, fieldset, a:hover and the two check inputs hold one property set per theme

5. The duplicate check stops counting need as debt (tools/ui-audit.php):
6. a body of one declaration is need, the way display: flex under 122 containers is
7. a body met in two files cannot be merged: CSS has no cross-file selector list
8. of the 50 groups left, 7 merged, 1 redundant rule deleted, 34 given a reason
9. dup 178 and 246 -> 0 and 0
10. A theme is created and checked by a test (tests/Unit/ThemeCreationTest.php):
11. copies an etalon, repaints only the API block, asks the whole contract of the copy
12. contrast is measured on the real pair registry put through the same repaint
13. checkThemeAssets() answered by tests/Support/theme_probe.php on the live core
14. the skeleton is checked against both gates that demand it, never against itself
15. The contrast walk composites instead of passing through (tools/ui-shots.mjs):
16. every sheer layer is composited back down onto the ground that really paints
17. background-image is walked layer by layer, back to front, not stop by stop

18. it found the admin footer copyright at 4.26:1 under its own decorative hatch; the hatch alpha is now what the ratio allows and the pair reads 4.60:1

19. registry 442 -> 460 pairs, both halves at zero below AA
20. Dark is guarded by pixels (tools/ui-shots.json, tools/ui-baseline):
21. modes gains dark: 168 committed images, every noise floor under the threshold

22. --out= sends a capture outside the repository, so a batch can compare its own two captures instead of a committed baseline the stand's own data has moved under

23. the site counters the profile and the statistic page print are masked
24. The two names nothing wrote are gone (plugins/system/slaed.js, both themes):
25. placeFloat() writes --sl-d-float-top and --sl-d-float-left; the theme owns the rule
26. six inline layout properties and a hardcoded z-index leave the script
27. unmet 2 -> 0 in both themes
28. Three zoos in admin take the shape lite had already settled (templates/admin):
29. the alert reads one --sl-alert-tint and its glyph the base tone; the last raw hex goes
30. the loading dots read the API block and the tone directly
31. the switch spells its four aliased tokens and draws the theme's one focus ring
32. scoped 84 -> 54, --sl-danger-subtle deleted, --sl-knob-dur folded onto the ladder
33. error.html on the settled names, and four spellings of one intent closed:
34. 60 tokens declared and 60 read, closed on itself
35. ::before/::after at 57 sites, "bootstrap-icons" at seven, --sl-radius-circle at 28

Benefits:

• every count either theme controls reads zero, and cross reads zero beside them
• a new theme is now provably one copy and one repaint, asserted rather than claimed
• the dark half of both themes is guarded by images and not only by ratios
• a contrast failure nobody could see is fixed, and the walk that finds its kind is honest

Technical notes:

• ui-audit gains isClassUsed(), whose boundary is the name alphabet: a class emitted after a template tag was invisible to it, which read as five dead classes in lite

• nine classes really were dead and are deleted, with --sl-move-height beside them

• admin ul keeps its longhands on purpose: a shorthand resets every longhand it omits, which flattened 82 nested list marks when it was written as one

• ten lite templates carried CRLF in the working tree, which .gitattributes normalises on the way into the index: four template divergences the tool reported were local drift and never in the repository, which is why this commit shows none of them

• fixtures cover every classifier change: classuse.html, dup-need.css
• no theme file below the marker names a mode; frozen stays false while canon is open

Batch 7 of docs/THEME-ETALON-2026.md. Lite's last 386 untokenised decisions reach a token, its whole palette gains a second half through light-dark(), and the frontend gains the colour-mode switch on the plumbing the panel already had. Both themes now report zero on every count they control, in both modes.

Core changes:

1. Every decision left in lite reaches one address (templates/lite/assets/css/*.css):

2. Size, animation, shadow, background, border and outline take a component token

   • A figure sizing a control, an icon or a page region has one name, as admin has
   • An animation carries its own dur and ease; a shadow is one whole value at one name

3. Four laws replaced four zoos rather than renaming them

   • The tinted pill: six tone classes and eight state marks read one --sl-chip-bg
   • The focus ring: outline and box-shadow draw one --sl-ring-width in one --sl-ring-bg,

and a status ring mixes its own colour at --sl-ring-mix

• The tile: --sl-ico-bg and --sl-ico-border read currentColor, and only the ratio is

hoisted where the tone is itself scoped

• The arrow: every CSS triangle in the theme reads one --sl-arrow-width

• The colour tail folded onto the roles it had been spelling by hand

  • --sl-color-brand and -banner onto --sl-primary-subtle, -strong onto --sl-primary-strong
  • --sl-color-text-ink onto --sl-text, -link and --sl-login-link-hover-color onto -strong
  • The eight --sl-changelog-* and the two service tones of the social icons onto roles
• Lite carries both modes (templates/lite/assets/css/base.css):

• color-scheme on :root, light-dark() through the palette, two data-theme selectors under the marker; no rule outside the API block names the mode

• A tint step is a ground and nothing else: every mark that read one takes the base tone of its family, which turns over by itself

• What a token cannot repaint stays fixed: the footer band carries the wordmark and the flag as images with white baked in, the page head carries a photograph, and the text standing on them reads --sl-band-text

• Contrast fell 53 to 0 in light and dark together, each value derived from the luminance the ratio allows against the worst ground it really meets

• The colour mode switch reaches the site (core/system.php, index.php, templates/lite):

• getAdminModeSwitch() becomes getThemeModeSwitch($action) for the panel and the site alike, and one setThemeMode() writes the cookie for both handlers

• index.php answers op=mode on the token scope the panel uses; lite's four document templates carry data-theme and the site header carries the toggle

• A visitor who picked a mode is not cacheable: the page-cache key is the route alone, so a stored copy would hand the next visitor someone else's mode

• Two measuring tools were wrong and are fixed (tools/ui-audit.php, tools/ui-shots.mjs):

• getValueKind() could not read a shadow whose colour or length arrives through a token, so one name held two kinds across the themes for no visible reason; isShadowValue() reads it now, with tests/Fixtures/ui/shadow.css under it

• The contrast walk read a mostly transparent fill as a solid surface and reported a failure against a colour nobody can see; it passes through to the ancestor that paints, at the threshold its own gradient rule already used

Benefits:

• A new theme is one copied directory and one repainted API block, in two modes
• Every visual decision in both shipped themes has exactly one address
• The whole site meets AA in light and dark, measured on pairs that really meet on screen
• dup falls 266 to 246 and scoped 103 to 92 as the folds land

Technical notes:

• tools/ui-audit-baseline.json re-stored at the new lows; the ratchet holds them
• tools/ui-contrast.json regenerated with credentials: 442 pairs, admin's 124 unchanged
• 84 baseline images re-captured in one pass and verified stable on a second run

• The mode cookie is written only through setCookies(); the toggle posts with a CSRF token that rides the dynamic-region contract on cacheable pages

• Backward compatible: no schema, route or template contract changes

Batch 5 of the theme etalon gives lite the motion, layer and gradient axes admin already carried. Not one transition, one layer or one gradient in the theme had an address of its own, so a theme author could not restyle any of them without forking rules. All three now read the same names admin does, the untokenised metric falls from 1396 to 1209 and the grammar violations from 99 to 44.

Core changes:

1. Motion (templates/lite/assets/css/base.css, theme.css):

2. 81 duration parts over 13 spellings snap onto --sl-time-fast, --sl-time-base and --sl-time-slow; 32 were already on a step, 31 move by 20ms or less and 18 move further

   • the two longest, the poll bar filling at 0.8s and the profile ring drawing

itself at 0.9s, take --sl-time-slow with the rest: an exception granted by
argument is how a zoo grows back, so the ladder has none in this theme

• admin still spells its own ring --sl-knob-dur: 1s, and that divergence is

batch 8's to settle in the direction lite has taken

• of the five curve spellings ease stays, linear is allowlisted, cubic-bezier(0.2, 0.8, 0.2, 1) folds onto --sl-ease-in-out and cubic-bezier(0.2, 0.7, 0.3, 1) onto --sl-ease-out

• the overshoot cubic-bezier(0.3, 1.6, 0.5, 1) becomes --sl-vote-ease, because a curve leaving the 0-1 range is a different kind of motion and no ladder holds it

• the speed dial's five hand-written delays become calc(var(--sl-dial-dur) * n) on a 0.05s step, which is the spelling admin already used

• Layers (templates/lite/assets/css/base.css, theme.css):

• twelve values over 26 sites become seven roles: --sl-z-base, -raised, -overlay, -dropdown, -popover, -modal and -toast

  • 0, 1, 30, 3000 and the image popup at 1000 were already a role's own value
  • 2 and 5 both mean "painted over the box it sits in" and merge into -overlay;

the only place the two sets meet is the user card, where the tool chip sits
at top: -38px and the online badge at top: 20px

• 4, the session panel, goes up to -dropdown to stay above that badge; it

clears the tool chip by 12px, which is measured and not argued

• four orders change and each is recorded in the plan: the header login form and the top-menu submenu fall to -dropdown and keep their old order by tie and document position, the tooltip's anchored panel and the image popup rise past the submenu, and the two fixed edge tabs fall to -popover where the footer's document position still resolves the tie their way

• --sl-z-sticky stays undeclared, because nothing in lite reads it and a step nothing reads is a dead token

• Gradients (templates/lite/assets/css/base.css, theme.css):

• --sl-line-gradient becomes --sl-grad-line and --sl-bg-hover-gloss becomes --sl-grad-gloss, which drops the last name stacking a state on an axis

• the five --sl-progress-fill-* triples fold into the categorical --sl-progress-1..5 and the five --sl-grad-progress-*, and the track into --sl-progress-bg, -border, -radius and -height; the fill height is now calc(var(--sl-progress-height) - 1px - 1px) and the flat fallback under each gradient, which no browser in the baseline ever painted, is gone

• the three gradients one component owns take that component's address: --sl-changelog-date-bg, --sl-feedback-bg and --sl-idea-bg

• the button bevel is composed: --sl-btn-bg holds the face, --sl-btn-text the label and one --sl-btn-shadow both edges and the lift under them, which retires the two scoped internals .sl-but had been setting on itself

• --sl-grad-info-start/-end were a colour under a gradient prefix and one of them also painted the search button flat, so they take colour names --sl-info-subtle and --sl-info-muted; --sl-grad-success-start proved to be --sl-success-subtle spelled twice and collapses onto it, its partner becoming --sl-success-muted

• The contract and the baseline (tools/ui-contract.php, tools/ui-audit-baseline.json):

• the components changelog-date, feedback and idea are declared

• the baseline is re-stored: count 1209, bare 107, names 44, scoped 107, tokens 213, with admin unchanged at zero

• The plan (docs/THEME-ETALON-2026.md):

• the batch 5 section is deleted rather than marked done, and the status moves to batch 6

• every figure it touched is re-derived from the tool: the metric tables, the baseline table, the transition and layer ladder rows, the cross-theme selector count and the grammar violation split

• the merge reasoning for the layers and the three colour names minted here are written down, because the batches after this one inherit them and no counter would recover them

Benefits:

• a theme author can now restyle every transition, every stacking layer and every gradient in lite by editing the API block, which is what the etalon promises

• the layer roles replace fourteen numbers picked to win one argument each, so a new overlay has a role to take instead of a number to outbid

• one duration ladder across both themes means a motion change is one edit, not a search for eight spellings of the same fifth of a second

Technical notes:

• durations move on purpose: 0.5s and 0.6s fall to 0.35s at seven fade and zoom sites, and the poll bar and profile ring fall to it from 0.8s and 0.9s

• no screenshot sees a duration, so motion is verified by reading computed transition-duration, -delay and -timing-function off the rendered page: 843 transitioning elements over five lite pages, all on the ladder

• layers are verified the same way, by resolving every computed z-index on those pages against the named roles

• all 42 tokens this batch added or renamed resolve on the live page to the values they held before it

• lite screenshots are identical to the stored baseline; the admin diffs the rig reports are the stand's own data, and admin renders from files this batch does not touch

• the button label highlight is now spelled with color-mix() at --sl-btn-mix: 85%, which is the same paint as the rgba() it replaces