The panel settings window landed in 7e864723 with three rows built three ways, one of them posting without a token; the locale switch answered to any GET that carried newlang. This commit closes both, collapses the rows onto one builder, and follows the RSS feed the same way: declared where a reader looks for it, stable where it was random.

Core changes:

1. Settings window (core/admin.php, templates/admin/fragments/settings-row.html):

2. getAdminSettingsRow() takes the axis and returns the row

   • getAdminLanguagePick() and getAdminEditorPick() collapse into it
   • the panel stops drawing a mode row of its own, so templates/admin/fragments/

mode-switch.html and its fork entry in tools/ui-contract.php are gone

• the sl-mode class moves onto settings-row.html behind an is_mode flag, which

keeps --sl-mode-width and --sl-mode-height read and the frozen API intact

• hidden fields settle on fragments/hidden.html for all three rows

• the sidebar editor block leaves getAdminInfo(); the window is the only place the editor is offered, and the function loses three globals and gains a return type

• CSRF on the editor and the locale (admin/index.php, core/security.php, index.php):
• updateAdminEditor() refuses a request without checkAdminPost('changeeditor')

• setLang() only reads the cookie now; setLangChoice() does the writing

  • a token check cannot live in setLang(): it runs before the session, the database

and the parser exist, and every admin POST came back as the login page

• both op=newlang handlers call it and redirect, so the POST turns back into a GET

• scope newlang joins the token allowlist of checkDynamicMark(), because the site block sits on cacheable pages and needs getPageToken()

• Language producers (blocks/languages.php, templates/lite/fragments/lang-switch.html):
• the flags became submit buttons of one form, the select became a POST of the same
• the geo redirect writes the cookie directly instead of handing itself ?newlang=

• getAdminLanguageLinks() is gone: the panel renders with the admin theme, whose layout has no admin_langs, so the strip was computed on every load and discarded

• RSS feed (core/user.php, core/system.php):
• the site declares its own feed with <link rel="alternate"> in the head
• <atom:link rel="self"> and dc:creator replace an antispam@antispam.com placeholder
• ?go=rss without a name answers with the first module instead of a random one
• Route handler names (admin/index.php, core/system.php, modules/account/index.php):

• every handler carries a verb prefix now: updateAdminEditor, setAdminThemeMode, setAdminLanguage, deleteAdminSession, getAdminLoginForm, checkAdminLogin, addAdminAccount, and login_report becomes addLoginReport

• the op strings and token scopes they answer to are untouched
• Login journal (core/system.php):

• addLoginReport() reads the flag before the kind becomes a string

  • a non-empty string is true either way, so log_u was unreachable and log_a alone

decided both journals, which wrote user passwords the operator had switched off

1. Removals and site header (docs/, demo/, templates/lite/partials/site-header.html):
2. docs/SETTINGS-FIXES-2026.md and demo/ are deleted, no code referenced either

3. the RSS button leaves the header, browsers have not rendered a feed since 2018; the remaining tones shift back onto a contiguous position % 6 cycle

4. --sl-wordmark-img-width 145px -> 150px and a quoting fix in ThemeCreationTest.php ride along, both unrelated to the rest and included on request

Benefits:

• One builder and one fragment for a row instead of three constructions
• Two handlers that changed state without a token now refuse one that lacks it
• A locale change no longer happens because a prefetcher followed a link
• Readers find the feed without being handed its address

Technical notes:

• Breaking: log_u now means what it says. With log_a on and log_u off, user logins stop being written to log_user.log, and the attempted passwords with them

• Breaking: RSS <author> becomes <dc:creator>; a parser reading <author> loses the name
• Breaking: ?newlang= as a GET no longer switches the locale anywhere
• The site language switch returns to the referring page rather than to the home page
• No storage, schema or route changed: every op string and token scope is as it was

The site header stops cycling through the modes one press at a time and stands all three open on a rail; the panel stops spending its toolbar row on six flags and a toggle, and gathers the colour mode, the content editor and the language into one window opened from a single item. Both spend handlers that already existed: no new storage, no new op, and the editor keeps writing the administrator row it always wrote.

Core changes:

1. Colour mode control (core/system.php, templates/lite/fragments/mode-switch.html):

2. getThemeModeSwitch() returns the three modes with the one in force marked, instead of the next one to step to

   • the order is light, auto, dark, so the answer that follows the system sits between the two it chooses from
   • the knob rides over the cells and the active cell hands its icon to it, so nothing is drawn twice
3. the rail places its knob with :has() on the active cell, so no state attribute is written from PHP
4. Settings window of the panel (core/admin.php, templates/admin/fragments/window-settings.html):

5. getAdminSettingsWindow() builds one window from three rows, each posting to the handler that already owns it

   • the mode writes its cookie, the editor writes _admins.editor through changeeditor(), the language writes the session
   • Editor::getSelect() is reused as it stands, so the sidebar block and the window stay in step
6. getLanguageList() is the one list the flag strip of the plain panel and the language row both read
7. the toolbar keeps one item for the window and rules the row where the kind of destination changes
8. Theme components (templates//assets/css/.css, tools/ui-contract.php):
9. .sl-mode-rail, .sl-mode-cell and .sl-mode-knob replace the single .sl-mode-but of the site
10. .sl-set-row and .sl-set-item carry the window rows and the toolbar item; the component set is declared in the contract
11. a toolbar item may now hold a button as well as a link, which is what lets the window open from the menu row
12. the social row takes its hover ground from the category palette instead of eight hand-picked colours

Benefits:

• any mode is one press away on the site, where three presses were needed to come back to the system answer
• the panel toolbar returns to one line: 40px against the 70px the flags and the toggle wrapped it to
• one place for the three answers an administrator changes from any screen, with room for a fourth
• eight colour rules fall to one rotation the tree already spends on categories

Technical notes:

• no schema change and no new op: every row posts to an existing handler
• fragments/mode-switch.html diverges by theme on purpose, with the reason recorded in tools/ui-contract.php
• --sl-mode-width and --sl-mode-height stay declared in both themes, as a frozen API may not lose a name
• demo/ carries the stand the variants were chosen on; it links the shipped CSS and JS and ships no theme of its own

The etalon plan is finished, so its prose moves into the reference documentation and the plan file goes. What replaces the checklist nobody would remember is a pre-commit hook for the cheap gates and a two-word pair for the visual one. Four gates that read zero while checking nothing are closed, and the committed screenshot baseline is dropped because it cannot be stable on a stand whose own content moves.

Core changes:

1. Gates that no longer answer when their input vanishes:

2. tools/ui-contrast.json could be deleted and the contrast count still read zero

   • getContract() folds the registry in only if (is_file(...)), so a missing file

left nothing to check and ThemeContractTest stayed green

• ThemeContractTest now asserts the file exists and carries pairs for every theme

• node tools/ui-shots.mjs --check wrote a missing baseline image instead of failing

  • a check whose baseline is absent re-baselined itself against the tree it was

asked to judge and exited zero; it reports MISSING and exits non-zero now

• php tools/ui-audit.php --markup had no limit beside the count

  • markup.limit is 0, so the scan fails on the next hardcoded class, style or tag

• the screenshot rig captured a degraded set without credentials

  • --before and --after refuse to start without SLAED_UI_USER and SLAED_UI_PASS,

because a run without them skips every state that needs a session

1. Automation (tools/hooks/pre-commit, package.json):

2. the pre-commit hook runs the audit, the markup scan and the theme, template and parser tests on every commit carrying a file able to move a count

   • about twenty seconds, and nothing at all on a documentation commit
   • enable once per clone with npm run ui:hooks; SLAED_SKIP_GATES=1 skips one
   • when a commit touches theme CSS or a canon template it prints the two visual

commands, because no count can see a moved pixel

• npm run ui:before and npm run ui:after are the visual gate

  • ui:after empties the page and template caches, compares against the capture

`ui:before` took, regenerates the contrast registry when a base.css moved, reads
the counts and prints one verdict

• verified in both directions: no change gives PASS, a padding shift on a class the

page really carries gives eight DIFFs and FAIL

1. The screenshot baseline is no longer committed (tools/ui-baseline, .gitignore):

2. measured: a check against the committed set went red hours after capture on a tree whose frontend was byte-identical - 100% size changed at sm, md and lg on the front page and the forum list, 1.6% to 3.9% even at xl

3. the page height follows the content of the stand, and a mask cannot save a box whose height is what moves, so the reference is captured per change into a temp directory

4. 168 images and about 80 MB leave the working tree; the path is gitignored so a stray capture cannot put them back

5. A scratch theme stopped leaking its compiled templates (tests/Support/theme_scratch.php):

6. deleteScratchTheme() removed templates/scratch-* and left storage/cache/templates/scratch-* behind, so every phpunit run and every --newtheme leaked about half a megabyte under a name nothing can read again

7. Documentation (docs/, root):

8. docs/THEME-ETALON-2026.md is deleted; its contract, its gate table and its measured findings move into docs/TEMPLATES.md as three reference sections, without the batch narrative and without any superseded figure

9. docs/PARSER.md records that the parser owns no markup and needs a global $tpl

10. docs/ARCHITECTURE.md records that $tpl is created before $prs because the parser depends on it, not by coincidence

11. docs/EDITORS.md records that every driver mounts through fragments/editor-mount.html

12. CONTRIBUTING.md, UPGRADING.md and docs/TEMPLATES.md stop describing HTML leaving PHP as work in progress; it is done and a gate holds it

13. five files that pointed at the deleted plan now point at docs/TEMPLATES.md

Benefits:

• the cheap gates need nothing remembered: they run on commit or refuse it
• a gate whose input is missing now fails instead of reporting a clean zero
• the working tree drops from about 145 MB to 65 MB

Technical notes:

• .git is unchanged in size: the baseline blobs stay in history and any image can be recovered with git show b115eaa0:tools/ui-baseline/<name>.png

• the hook needs core.hooksPath pointed at tools/hooks, which npm run ui:hooks does

• the full 168-image walk has not been run under the new --before/--after flags; the cycle was verified with --only=voting, and the contrast branch of ui:after has not executed because no palette moved in that test

• no breaking change: 915 tests pass, phpstan is clean, every ratcheted count holds

Batch 8 of docs/THEME-ETALON-2026.md closes the remainder of canon and freezes the theme API. Every shared name the two etalons spell differently is now either one file or an entry with a written reason, and the freeze is held by a gate rather than by a sentence: the baseline carries a roster of the 297 and 404 names each API block declares, the audit compares it every run and --store refuses to write while a name has gone missing.

Core changes:

1. The 28 same-named templates of canon (tools/ui-contract.php, tools/ui-audit.php):

2. --cross reads a shared template the way it already read a shared selector

   • templates carries a written reason per divergence, canon names the two

directories the demand applies to, and unanswered ones join the global `cross`

• layouts and pages are reported and demand nothing: the page shells differ by nature

• two of the 28 were one contract with two spellings and are now one file

  • radio.html: admin's is lite's plus four optional keys no lite caller passes
  • changelog-body.html: the admin h3 skipped a level under the h1 of module-head,

so both are h2 and the admin rule moved with it at the same --sl-font-h4

• the other 26 are two contracts under one name, which the key sets show rather than the line counts: link maps twelve names in the panel against thirty-three on the site with not one in both, inline-badge fourteen against twenty, span one against 22

• One name per intent for hiding and dimming (both themes, core/user.php, modules/forum/index.php):

• .sl-hidden meant display: none in admin and an opacity step in lite

  • read by producer rather than by class: six lite call sites mean gone, four mean

closed but still readable - a comment awaiting approval, an unpublished forum
post, an opened message, an action the reader may not take

• those four take .sl-dimmed, which both themes already carried

• .sl-none and .sl-hidden were two spellings of display: none, so the name that says the role keeps the intent and .sl-none is retired from both themes

  • the admin is_hidden branch of span.html had no producer at all, and the

!important that served it goes with it

1. The focus ring of a link (both base.css):

2. a { outline: none } was in both themes, not one: in admin it sits in the group input, textarea, select, a, which is why the tool reported only lite

3. neither theme drew a:focus-visible in its place, so both take the ring the rest of each theme already draws, spelled identically

4. The !important flags, read once (both theme.css):

5. three in lite were fighting nothing: a hover rule that already outscored its target, an id selector nothing in the file can reach, and a dead rule whose class no template or script writes

6. every one that remains carries the reason beside it - the glyph face beating an element font, the editor engine writing its height inline, a print rule reaching past the inline display the tab script writes

7. The HTTP half of the theme-creation gate (tools/ui-shots.mjs, tests/Support/theme_scratch.php, tests/Support/theme_probe.php):

8. node tools/ui-shots.mjs --newtheme builds a scratch copy of an etalon, points the account the rig signs in as at it, renders every frontend page of the manifest and restores the column and removes the tree in finally

9. both halves build that copy through one lifecycle, theme_scratch.php, so a lifecycle spelled twice cannot drift into two

10. the three site logs are read before and after the walk: a theme that renders a page and writes a notice behind it has still failed

11. The freeze (tools/ui-contract.php, tools/ui-audit.php, tests/Unit/ThemeContractTest.php):

12. frozen is true, and the roster under api in the baseline is what holds it

13. an addition wrongs no copy; a rename in place is refused by the run, by --store and by phpunit alike

14. The rig learns two pages it could not hold still (tools/ui-shots.json):

15. admin-monitor grew 6954 to 7092 to 7557 pixels in the seven seconds after load: two panels arrive on load and are then replaced out of band by a four-second poller, and what moved was their height, so masking could never have held them

16. the bar of the statistic page was masked and the count and per cent printed beside it were not, so the page flapped around the threshold on a walk long enough for the rig's own visits to move the figures

Benefits:

• every shared name across the two etalons is now answered for, by one file or by one written reason, which is what hundreds of copies will inherit

• one name for gone and one for dimmed, in both themes, with no name left holding two intents at the moment the API is frozen

• a link that is focused says so on both sides of the CMS
• creating a theme is checked as a file and as a served page, through one lifecycle
• important falls 23 to 22 in admin and 17 to 13 in lite, and what is left says why

Technical notes:

• --sl-font-hero reads 38px: the top step of the font-size ladder holds a different value, with the step count and the role names unchanged

• probe_boot.php answers 404 and exits unless PHP_SAPI is cli. The probes are served by a stand, register_argc_argv turns a query string into $argv, and theme_probe.php stopped being read-only in this commit

• tools/ui-baseline is re-captured whole and checked against itself: 168 of 168 states match and every noise floor sits below 0.2%

• no breaking change to any runtime contract: the template keys that moved are is_hidden to is_dimmed at four call sites, all inside this repository

Both are about what the gates can see rather than about either theme, and neither blocks the freeze. They are recorded in the risk that names them, in the description of the walk that would change, and as a step of batch 8 that has to answer them.

Core changes:

1. The dark-mode risk carries what batch 7 measured (docs/THEME-ETALON-2026.md):

2. Two dark breaks shipped green through every gate and were found by looking

   • The headline over the photo band flipped from white to near-black, because the band

is a photograph with no dark variant while --sl-on-solid turns over

• The footer wordmark vanished when the band under it inverted, because the wordmark

is an image with white baked into it

• Both pass AA in both modes, so no contrast pair could report either

• Until modes gains dark, a batch that touches colour opens the pages in dark, looks at them, and says in its report that it did

• The walk's sheer-fill reading is named as a half answer (docs/THEME-ETALON-2026.md):
• Passing through a fill under 0.5 alpha removed exactly two false readings in batch 7

• It also leaves the honest ones unmeasured: white text on a twenty per cent veil over a photograph now reports nothing rather than something wrong

• Compositing is the whole answer, about twenty lines in getContrastPairs(), and needs both halves of the registry re-generated in one run

• Batch 8 gains the step that decides them (docs/THEME-ETALON-2026.md):

• The cost of each is stated: 168 images and about 72 MB against the only gate that would have caught either break; twenty lines against a registry that may surface new pairs

Benefits:

• A question asked once is not asked again from scratch, and its cost is already priced
• The next colour batch knows it owes a look in dark until the manifest covers it

Technical notes:

• Documentation only; no code, no theme and no gate changes