Официальный сайт SLAED CMS
Журнал изменений
The first two plans of the queue are finished and each deleted itself with its last batch, but the third still named both by path. A reader following the reading order would open the plan, go looking for its two prerequisites and find neither.
Core changes:
- Queue section (docs/UPLOAD-FIELD-2026.md):
- the two finished plans are named without a path, and said to be deleted
what outlived each of them is named instead
- plan 1: the Form Row Contract of docs/TEMPLATES.md and getFieldIds()
- plan 2: the Settings Page Contract of the same file
- the two live defects plan 2 left open, and where each is now recorded
- the handover section below is flagged as the only surviving copy of what plan 2 hands over
Benefits:
- The reading order resolves; every docs path this plan names now exists
- A reader is not left guessing whether a missing prerequisite means missing work
Technical notes:
- Documentation only; no batch, no code and no behaviour is changed
The dead docs/FILE-MANAGER-CONCEPT-2026.md citation is left alone: the plan already knows it is dead and batch 3 is told to replace it
The crawl fails on this stand before any edit, and the record of that was deleted with the plan that measured it. A future reader would meet a red gate and look for the cause in their own work.
Core changes:
- Label crawl (docs/TEMPLATES.md):
the failure is coverage, not violations: 366 stored against 365 rendered
- three route variants no longer answer, two of them record-bound
- proved by stashing a whole batch and running the same audit on the committed tree
- and a warning not to --store over it, which would adopt a regression as the floor
Benefits:
- A red gate that is not yours is recognisable in a minute instead of an hour
Technical notes:
- Documentation only; the loss itself is untouched and still wants an investigation
The account settings plan was deleted with its last batch, and it carried two live defects and one rig property that nothing else in the tree records. Each is written where its subject lives rather than in a register nobody reads.
Core changes:
- Editor defect (docs/EDITORS.md):
a value carrying <br> comes back from a driver without them, measured to the byte
- block fell 1475 to 1387, exactly 22 tags; sig fell 213 to 201, exactly 3
- the settings form rewrites both columns on every save, so any save costs a member their line breaks
- both wrong guesses already spent are recorded, so the next reader does not spend them again
- Settings page defect (docs/TEMPLATES.md):
a validation stop rebuilds every field from the stored row and discards the typed input
- measured with a broken token: a typed occ came back as the stored value
- Contrast registry blind spot (docs/TEMPLATES.md):
a masked or initially hidden element is never sighted, so it has no measured contrast at all
- time is masked for the shots and holds no pair on any page of the tree
Benefits:
- A user-facing data loss stays findable after the document that found it is gone
- The next reader of the contrast registry knows what a zero does not cover
Technical notes:
- Documentation only; no code, no schema and no behaviour change
- Neither defect is fixed here; both want a batch of their own
A sixteen part plan for the content subsystem that is meant to serve several material types at once and retire the same-shaped modules one by one, without growing a second CMS inside SLAED. Status is design; no implementation has started, and nothing in the tree reads any of it yet.
Core changes:
- Plan set (docs/node/):
- README names the reading order and the status
goals, naming, database, code structure and the public core API
- types, fields and settings; routing; rendering
- integrations with SLAED, type extensions, security and performance
- data migration from the modules being replaced, testing, roadmap
- a decision journal, so a settled question is not reopened by the next reader
Benefits:
- The design is arguable before it is expensive, while it is still only prose
- A decision journal keeps the reasoning with the plan instead of in a session
Technical notes:
- Documentation only; no code, no schema, no route and no configuration change
- Written in Russian, as the working language of these plans
The account settings stop being four tabs hiding four endpoints and become one page of sections and tiles: PHP hands over nested data, the template owns every tag and class, and the state of the account is readable before a single field is touched. The password keeps a form of its own so a mistyped old password cannot be answered with "saved" about half the page.
Core changes:
- Page assembly (modules/account/index.php):
edithome() builds sections, tiles, lines and fields instead of markup
- a section that renders nothing is never appended, so the rail counts what exists
- a validation stop carries its section name and the message lands beside its cause
- the shared form opens before the first section marked inform and closes after the last
getProfileFillRate(), getAccountLamps() and getAccountLog() name the three things the page computes
- the fill rate counts six plain controls, and the two it leaves out are left out for a reason each
- the log is assembled from columns that already carry a time and adds no table and no column
- a provider sign-in not later than its linking is the linking, and is not printed twice
- Page template (templates/lite/partials/account-settings.html):
one partial renders sections, tiles, lamps, rail, log and save bar
- PHP names a width number and a tone number; the template maps both to classes
- the tile is the fold container, so rows fold on the tile and never on the window
- Page behaviours (plugins/system/slaed.js):
- data-sl-spy marks the current section, data-sl-meter recomputes completeness as you type
data-sl-dirty raises the save bar on the first change and reverts on discard
- the hidden state is armed by the script, so a page without JavaScript keeps a usable bar
- Theme (templates/lite/assets/css/theme.css, base.css):
- the sl-opt-* vocabulary, three component tokens, and sl-is-ok and sl-is-info beside sl-is-warn
- the yes/no switch label takes the body colour, clearing a 4.17 contrast pair the crawler found
- Dead code removed (templates/lite/fragments/table-row.html, table.html):
the is_avatar_link branch and the is_avatar_grid flag lost their last caller with the preset gallery
- the gallery is now one radio group of 127 options inside the shared form, carrying one token
Benefits:
- One save button for one page, instead of four forms pretending to be one
- The page carries 3 CSRF tokens where it carried 128
- Every caption id comes from getFieldIds(), and no label is emitted without a control
Technical notes:
- The saveavatar route is gone; the avatar arbitration lives inside savehome()
- An avatar failure does not roll back the profile: the profile is one UPDATE, the avatar a second
- Fifteen language constants added across all six locales
- The settings page contract now lives in docs/TEMPLATES.md and the work plan is deleted
A member who had once saved a site theme was served an admin panel built from partials no site theme carries, so the login form did not render at all and the log filled with a template-not-found warning. The name reached the cookie from a default the code wrote in as if it were a decision.
Core changes:
- Theme resolution (core/system.php):
getTheme() ignores the member's theme once ADMIN_FILE is defined
- the panel forces its own theme at bootstrap and the account cookie may not take it back
- the constant is read only where it is set before the bootstrap, which is the panel entry point
- index.php declares the same constant for its admin endpoints, but long after this answer is cached
- Cookie writes (modules/account/index.php):
savehome() and savepass() write the theme the member chose and never the site default
- an empty slot means no preference, which every reader already resolves for itself
- a name written in now means a decision, which is what the database column already held
Benefits:
- The panel is reachable again for every member who ever picked a theme
- The cookie and the users.theme column stop disagreeing about what empty means
Technical notes:
- No schema change; the column already stored an honest empty string
- Backward compatible: a cookie carrying the old default resolves to the same theme
The account settings page stopped being four tabs hiding four independent POST endpoints and became one form saved by one button, with the password form and the OAuth unlink buttons standing beside it as siblings. On the way the password handler lost a CSRF gate that checked nothing, stopped mailing the new password in clear text and stopped logging the member out of an account whose password had just changed.
Core changes:
- Password handling (modules/account/index.php):
savepass() gates on the token check it already performed
- checkSiteToken() wrote into $stop and the function never read it, so a forged
token changed the passwordThe UPDATE became the only gate: nothing happens before it succeeds
- the mail was queued and the result of the write was never read, so a failed
write still announced a successful changeThe session survives the change
- the account cookie carries the password hash, so the new hash is written into
it with the same six-element shape savehome() uses, and the member returns to
the settings page instead of the login formThe mail no longer carries the password
- _PASSESEND lost its fourth argument and every locale renumbered its
positional placeholders- The three password fields became type="password" with autocomplete
- One form and one handler (modules/account/index.php):
edithome() builds one form-add carrying the profile, the avatar and the presets
- getNaviTabs() left the function: the password form and the unlink buttons live
inside tab panels, and wrapping the tabs in a form would nest one form in
another, which the parser drops silentlyThe preset gallery stopped being 127 forms and became one radio field
- the page carries one token instead of 128, and every thumbnail is lazy
savehome() took over the avatar with three explicit branches
- a preset, a file that was offered at all, or neither
- neither is UPLOAD_ERR_NO_FILE alone, so an ordinary save with no file attached
no longer tells the member a file was not selected- a rejected upload does not roll back the profile
- saveavatar() and its route are gone
- Each $stop entry carries the section it belongs to
- Radio group helper (core/helpers.php):
getTplRadioGroup() forwards label_html, which fragments/radio.html already supported, so an option can be labelled by an image
- Upload adapter contract (tests/Unit/UploadIntegrationTest.php):
- The account adapter is savehome(), the handler that now publishes
Benefits:
- A forged token can no longer change a password
- A password is no longer sent by mail in clear text
- Changing the password no longer ends the session
- One POST and one token instead of four endpoints and 128 tokens
- 127 lazy thumbnails instead of 127 eager ones inside 127 forms
Technical notes:
- The screenshot manifest gained the settings route, which it never covered
- The avatar is written by its own UPDATE, never folded into the profile write
- _PASSTEXT no longer promises a dropped session; rewritten in all six locales
- No schema change, no route change apart from the removed op=saveavatar
- Breaking change: op=saveavatar is gone; the avatar now travels with op=savehome
The field standard tied captions to controls but left four kinds of row unnamed: a radio group, an editor and a hint carried no accessible name at all, and the value row was a label labelling nothing. One helper now owns the three ids a row needs, every group, editor and hint is tied to what belongs to it, and a row folds on the box it stands in rather than on the window.
Core changes:
- Field identity (core/helpers.php):
getFieldIds() answers the control, caption and hint ids of one row
- The id is taken and never derived from the field name: this tree writes ids by hand and the mapping is no rule
- Only a row whose field has no labelable control mints one, from the seed the caller names and a per-request counter
- getTplRadioGroup(), getTplTextarea(), getTplModuleSelect() and getTplRefreshTimeSelect() carry a caption id and a hint id down
- getTplAddFieldRows() gives its dynamic controls an id and the row a for
- Row markup (templates/*/fragments/div-row.html, label.html, form-field-row.html):
hint_html, hint_id and label_id are row keys; the hint leaves the label element and keeps its cell
- A caption that swallowed the hint read the explanation out as the name of the field
- label-hint.html is gone and its 98 call sites carry caption and hint apart
- lite renders a span where a row has no for, instead of a label labelling nothing
- Radio groups (core/helpers.php, block-content.html, partials/div.html):
- Every .sl-radio-group carries role="group" and aria-labelledby to its own caption
- The switch variant and the checkbox lists built through the div partial take the same two attributes
- Editors (core/classes/editor.php, plugins/editors/*/driver.php):
Editor::getNameData() settles the name once, so four drivers cannot answer it four ways
- A caption is pointed at; a row without one is named by its own text
- plain writes the name onto its textarea; toastui and ckeditor onto the mount, and their JS moves it to the element holding role="textbox"
- TinyMCE takes aria-label only: its editable body is a second document and an IDREF does not cross that boundary
- EditorPlain::getWidget() uses the declared fragment keys instead of a hand-built attribute string
- Hints (core/admin.php, admin/modules/.php, modules//admin/index.php):
- aria-describedby ties every hint to the control, or to the group, of its own row
- catacess() and getMailRow() learned to take an id, so the rows they build can be pointed at
- Read-only value row (templates/*/fragments/field-value.html, assets/css/theme.css):
- Own vocabulary: .sl-value-row, .sl-value-label, .sl-value-text, and the caption is a span
- The panel row gains the fold it never had; .sl-form-* now means the editable row and nothing else
- Container fold (templates/*/assets/css/theme.css):
- A grid nested in another row's field cell folds unconditionally: measured 496 to 816px at the four rig widths, it never has room for two columns
- .sl-oauth-form and .sl-pmf-reply declare a container, so a card in a minmax(280px, 1fr) column and a composer in a split pane fold while the window is wide
- The crawl and its baseline (tools/label-audit.mjs, tools/label-audit-baseline.json):
- npm run ui:label walks the panel, the site as a member and the site as a guest, and asks of every rendered document what no count in a file can ask
- 417 baseline entries fell to 20: what remains is 15 duplicate ids, four codemirror editors and one for that reaches no labelable element, each recorded on purpose
Benefits:
- A screen reader announces the question a radio group answers, the caption an editor carries and the sentence that explains a field, none of which it could before
- One owner for the three ids of a row, so a caption, a group and a hint cannot disagree about the name that joins them
- The panel value row folds on a phone instead of holding a 160px caption column down to it
- A form row in a narrow box reads the box, so the OAuth card stops drawing two columns in 342px
Technical notes:
- fragments/label-hint.html is removed. A theme package outside this repository that renders it must move to the hint_html row key
- getMailRow() in admin/modules/config.php takes the id triple as its fifth argument; catacess() and getTplModuleSelect() gained optional id and description arguments and stay compatible with every existing call
- --sl-form-label-width keeps its name although the rule it serves was renamed: the admin API block is frozen and a distributed theme reads that name
- No count reported by tools/ui-audit.php moved; tools/ui-contrast.json was regenerated from the final tree
- docs/FORM-FIELDS-2026.md is deleted, and what outlives it is in docs/TEMPLATES.md under Form Row Contract and Label crawl
The stand carried one series, the presentation page. It now carries three: the account settings section and the file upload form join it, each drawn as whole pages in the real site shell rather than as descriptions of an idea.
Core changes:
- The gallery (demo/index.html, demo/assets/demo.js):
- The stand presents its variants as series instead of one flat list
DEMO_SERIES holds the three of them, and a file finds its own neighbours and its own gallery section through it
The panel arrows walk inside a series and wrap, so a series is a subject of its own and not a continuation of the one beside it
- The settings series (demo/set-01-deck.html through demo/set-10-bridge.html):
- Ten variants of index.php?name=account&op=edithome
- The upload series (demo/up-01-drop.html through demo/up-06-inline.html):
- Six variants of index.php?name=files&op=add
- The shared rhythm (demo/assets/demo.css, demo/README.md):
- The stand stylesheet gains what the two new series ask of it
The readme describes all three series, the numbering of each and the file names they follow
Benefits:
- Two more decisions can be compared as whole pages under the real theme
- Numbering restarts per series, so a variant is named by what it answers
Technical notes:
- The stand is not part of a release and lives only in the development tree
Every variant keeps whatever it needs beyond the theme in a single style block inside its own file, and adds nothing to the lite theme
The content inside a series is identical to the letter, so a comparison reads the composition and never the text
Every form row on both sides now puts its caption in the left column and its control in the right one, an editor takes the whole row, and the colon that separated the two is gone. The caption is tied to its control by an explicit for and id, which no row in this tree carried before.
Core changes:
- The row (fragments/form-field-row.html, fragments/div-row.html):
The site row is a two-track grid, a quarter to the caption and three quarters to the field, folding to one track under 900px
- The label cell is rendered unconditionally, so a row with no caption leaves
the left track empty instead of sliding the field into it- hide_label is gone: 91 call sites hid the caption and showed a placeholder
in its placeAn editor row drops to a single track with the caption above it, which is the only exception to the two-column rule
A tall field is read from its first line, so the caption meets it there rather than floating at half its height
- The panel row wraps its caption in a label when the row names a control
- The colon (assets/css/theme.css of both themes):
- Every ::after rule that drew the separator is removed
With it go the mechanisms that existed only to cancel it: sl-no-colon with its important override, and the is_action_label flag with its sl-action-label class
- The link from caption to control (143 site rows, 890 panel cells):
- 527 rows carry label_for beside input_id, or selectid on a panel select
- getTplCategorySelect() emits an id of its own
fragments/label.html, select.html and textarea.html gained the keys the link needs, and the panel hint became a span so the caption above it can be a label without holding block content
- Two forms that were written by hand now follow the standard:
- The OAuth link and create forms, which had no captions at all
- The private message composer, which hid its captions from sight
- Defects the work uncovered:
sl-hidden lost to the display the row itself set, so a row marked hidden stayed visible: fifteen link rows in the media form, the GitHub fields of the changelog configuration
- The panel media form gave its rows and its inputs overlapping ids
- The suggested nickname of the OAuth form was escaped twice
- Contrast (templates/lite/assets/css/theme.css, tools/ui-contrast.json):
The two edge tabs drew white on a pastel plate at 1.68:1 and 1.86:1, below AA along the whole plate; they now take the strong text tone at 7.66:1 and 6.92:1
- The pair registry is regenerated and no longer names a deleted class
Benefits:
One field standard instead of two conventions, so a new form has a shape to follow rather than a choice to make
A caption that names its control to assistive technology and focuses it on click, which no row did before
- Two hidden-row defects, one duplicate-id defect and one double-escape gone
Technical notes:
Ids read f-<name>; ten rows resolve theirs conditionally, because the author row shows a plain value to a member and an input to a guest
- No schema, route or op name changed, and every form posts what it posted
Verified by walking 24 site pages and 252 panel pages: every for resolves to a labelable element, no id repeats on a page, no label nests inside another
What the standard still owes, and why radio groups, editors and hints have no accessible name yet, is planned in docs/FORM-FIELDS-2026.md