diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 64265cf..296338e 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -263,4 +263,11 @@ control in the theme.
 
 `inc/cloudflare-ips.php` holds a static snapshot of CF ranges. Refresh
 quarterly. Override via `peptide_starter_cloudflare_ip_ranges` filter
-for out-of-band update
\ No newline at end of file
+for out-of-band updates.
+
+## Version
+
+**Current:** v1.6.0 (2026-04-23)
+
+Bump `style.css` header line 7 and `PEPTIDE_STARTER_VERSION` in
+`functions.php` together on release.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ec33bfc..69c9de0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,48 +4,46 @@ All notable changes to the Peptide Starter Theme are documented in this file.
 
 ## [1.6.0] - 2026-04-23 — Mobile Performance Phase 1
 
-Mobile optimization targeting LCP reduction through conditional asset dequeue,
-font weight slimming, and font server preconnect. Measured baseline LCP on
-Moto G Power (Slow 4G): 5.4s; target: sub-4s after Phase 1 deployment.
+Mobile-perf optimization targeting LCP reduction through conditional asset
+dequeue, font weight slimming, and font server preconnect. Measured baseline
+LCP on Moto G Power (Slow 4G): 5.4s; target after Phase 1: ~2.5s.
 
-### Performance improvements
+### Added
 
-- **Conditional asset dequeue**: WooCommerce, Elementor, and USMI assets now
-  dequeue on pages that don't use them. Removes ~100KB from non-shop pages.
-- **Google Fonts slimming**: Roboto and Roboto Slab trimmed from 72 faces to 5
-  (400/500/700 weights, no italics). Font CSS shrinks ~6KB → <1KB; woff2 payload
-  reduced ~80%.
-- **Preconnect hints**: `fonts.googleapis.com` and `fonts.gstatic.com` now
-  preconnect in `<head>`, eliminating separate TLS handshake latency on cold cache.
-- **Cookie-notice defer**: Cookie banner script deferred to unblock initial render.
+- `inc/perf-asset-policy.php` — five-function module:
+  - `peptide_starter_perf_dequeue_plugin_assets()` — dequeues WooCommerce,
+    Elementor, and Ultimate Social Media Icons assets on pages that don't
+    use them. Hook: `wp_enqueue_scripts` priority 100.
+  - `peptide_starter_perf_slim_google_fonts()` — `style_loader_src` filter;
+    rewrites Roboto and Roboto Slab `family=` queries to keep only weights
+    actually used (400/500/700 + 400/700). Drops 72 font faces to 5.
+  - `peptide_starter_perf_resource_hints()` — `wp_resource_hints` filter;
+    adds preconnect hints for `fonts.googleapis.com` and `fonts.gstatic.com`.
+  - `peptide_starter_perf_defer_cookie_notice()` — `script_loader_tag` filter;
+    appends `defer` attribute to the cookie-notice front-end script.
+  - `peptide_starter_page_uses_elementor( int $post_id )` — helper.
+- Kill-switch constant `PEPTIDE_STARTER_PERF_DEQUEUE` (default `true`).
+  Define `false` in `wp-config.php` to disable all dequeues instantly.
+- Filterable handle lists: `peptide_starter_perf_woocommerce_handles`,
+  `peptide_starter_perf_elementor_handles`, `peptide_starter_perf_usmi_handles`,
+  `peptide_starter_perf_font_weights`.
+- `tests/test-perf-asset-policy.php` — 13 unit-test cases covering kill-switch,
+  per-page-context dequeue logic, font slim happy/edge cases, filter overrides,
+  preconnect insertion, defer attribute application.
 
-### Technical
+### Changed
 
-- New module `inc/perf-asset-policy.php` (~245 lines, PHPUnit tested).
-- Kill-switch constant `PEPTIDE_STARTER_PERF_DEQUEUE` (default true) allows
-  disable via `wp-config.php` for rollback.
-- All dequeue lists and font weights exposed as filters for customization.
-- Production handle verification: WC (layout/smallscreen/general), Elementor
-  (frontend/frontend-legacy + per-post CSS), USMI (SFSImainCss + 4 scripts).
+- `style.css` Version header bumped 1.5.2 → 1.6.0.
+- `PEPTIDE_STARTER_VERSION` constant bumped to `1.6.0`.
 
-### Tests
+### Why
 
-- `test-perf-asset-policy.php` — 8 new unit cases covering dequeue conditions
-  (shop/non-shop/Elementor/USMI), font rewrite happy path and edge cases,
-  preconnect addition, defer application, and kill-switch disable.
-
-### Out of scope
-
-- Critical CSS inline (Phase 2 candidate after measuring Phase 1 lift).
-- jQuery dequeue (WC/PSA/Elementor compat risk too high).
-- Image optimizations (no images on homepage critical path).
-- LiteSpeed Cache settings (CTO tunes post-deploy if Phase 1 insufficient).
-
-### Breaking changes
-
-None. All optimizations are transparent to plugin authors; dequeues use
-standard WordPress APIs and can be overridden via filters or re-enqueued by
-plugins if needed.
+PageSpeed Insights mobile score on `https://peptiderepo.com/` was 74 with
+LCP 5.4s, FCP 2.6s. Desktop scored ~95 — the gap was mobile-specific
+(weaker CPU + slower network amplify the cost of 13 render-blocking CSS
+files in `<head>`, of which the homepage actually needed at most 4).
+Phase 1 trims the asset graph for non-shop pages without touching plugin
+code or template files.
 
 ## [1.5.2] - 2026-04-14 — Security
 
@@ -322,4 +320,62 @@ ADR-0001.
   - Focus indicators (2px outline) on all interactive elements
   - 4.5:1+ contrast ratio on all text
   - Semantic HTML with proper landmarks
-  - `a
\ No newline at end of file
+  - `aria-label` and `aria-expanded` attributes on buttons
+  - Keyboard navigation support (Escape closes overlays, Tab through elements)
+
+- **Responsive Breakpoints:**
+  - Mobile: 320px - 479px
+  - Tablet: 480px - 767px
+  - Desktop: 768px - 1023px
+  - Large: 1024px - 1439px
+  - Extra Large: 1440px+
+
+- **Design System:**
+  - Typography: Inter font with 1.125x modular scale, 8px grid base
+  - Colors: Blue primary (#0066CC light, #3B82F6 dark)
+  - Component library: buttons, cards, forms, badges, alerts, pagination
+  - CSS custom properties for all design tokens
+  - No `!important` on global elements (plugin harmony)
+
+- **Navigation & Mobile Menu:**
+  - Primary navigation with active state detection
+  - Mobile hamburger menu with overlay
+  - Custom Nav Walker for WordPress theme integration
+  - Keyboard navigation (Escape closes menu, arrow keys work)
+  - Responsive: hides on desktop, appears on mobile (< 768px)
+
+### Technical Details
+- **Architecture:** Classic WordPress theme (non-block/FSE)
+- **Styling:** Single 44KB `style.css` with no build step
+- **JavaScript:** Vanilla ES6+ in 2 files (navigation.js, theme.js)
+- **Plugin Namespaces:** `.pn-*` (Peptide News), `.psa-*` (Peptide Search AI), `.prab-*` (PRAutoBlogger)
+- **Browser Support:** Chrome, Firefox, Safari (latest 2), iOS Safari 12+
+- **Requires:** WordPress 6.0+, PHP 7.4+
+
+### Initial Release
+- All core features implemented and tested
+- Full dark mode support with ecosystem coordination
+- Production-ready for peptiderepo.com launch
+
+---
+
+## Version Numbering
+
+- Versions follow semantic versioning: MAJOR.MINOR.PATCH
+- Current: v1.3.2
+- Defined in: `style.css` header (line 7) and `functions.php` (line 14 constant)
+- Update both locations when releasing a new version
+
+---
+
+## Deployment
+
+Push to `main` branch triggers automatic deployment to peptiderepo.com via GitHub Actions.
+
+**Process:**
+1. Push to `main`
+2. GitHub Actions workflow `deploy.yml` runs
+3. Files synced via rsync to Hostinger
+4. LiteSpeed cache purged
+
+No manual FTP uploads needed.
diff --git a/CONVENTIONS.md b/CONVENTIONS.md
index 28a13be..54919af 100644
--- a/CONVENTIONS.md
+++ b/CONVENTIONS.md
@@ -129,6 +129,43 @@ do_action( 'peptide_starter_hero_before' );
 - **languages/:** Translation files
 - **template-parts/:** Reusable template parts
 
+## How to add a performance policy rule
+
+When adding a new asset-perf rule (e.g., a new plugin's CSS to dequeue on
+non-relevant pages, or a new font family to slim):
+
+1. **For dequeues:** edit `inc/perf-asset-policy.php`. Add the plugin's
+   handle list to a new function (or extend the existing arrays via the
+   matching filter — `peptide_starter_perf_<plugin>_handles`). Hook the
+   new dequeue function on `wp_enqueue_scripts` priority 100, gated by
+   `PEPTIDE_STARTER_PERF_DEQUEUE` and a context predicate (e.g.,
+   `is_front_page()`, `! is_woocommerce()`).
+
+2. **For font slimming:** add the family to the default array in
+   `peptide_starter_perf_slim_google_fonts()`, or override at runtime
+   via the `peptide_starter_perf_font_weights` filter. Specify only
+   weights actually used by the design system; defaulting to "all weights"
+   defeats the purpose.
+
+3. **For new resource hints:** extend `peptide_starter_perf_resource_hints()`
+   with the new domain in the `preconnect` array. WP renders the
+   `<link>` tag automatically; don't echo your own.
+
+4. **For deferring third-party scripts:** add the script handle to the
+   list in `peptide_starter_perf_defer_cookie_notice()` (or rename the
+   function if it grows beyond cookie-notice).
+
+5. **Always add a test case** in `tests/test-perf-asset-policy.php`
+   covering the new rule's happy path AND its negation (the page-context
+   where the rule must NOT apply). The dequeue logic is silent if a
+   handle name is wrong — only tests catch this before deploy.
+
+6. **Verify on production handles** before committing. Plugin handle
+   names are not always what you'd guess. SSH to Hostinger and run
+   `wp eval 'global $wp_styles; do_action("wp_enqueue_scripts");
+   foreach($wp_styles->registered as $h=>$o){echo $h.PHP_EOL;}'` to
+   dump the actual handle names.
+
 ## Step-by-Step Guides
 
 ### How to Add a New Template
@@ -221,75 +258,6 @@ do_action( 'peptide_starter_hero_before' );
 
 **Important:** Always wrap shortcodes in `shortcode_exists()` checks so theme doesn't break if plugin is missing.
 
-### How to Add a Performance Policy Rule
-
-**Scenario:** Dequeue or transform an asset on certain page conditions
-
-Performance optimizations live in `inc/perf-asset-policy.php` and hook into
-WordPress's enqueue/style-loading pipeline. The module supports conditional
-dequeue (WC, Elementor, USMI), font weight slimming, preconnect hints, and
-script deferral.
-
-1. **For conditional dequeue**, add a block in `peptide_starter_perf_dequeue_plugin_assets()`:
-
-   ```php
-   if ( /* your condition */ ) {
-     $handles = apply_filters( 'peptide_starter_perf_yourplugin_handles',
-       array( 'handle-1', 'handle-2' )
-     );
-     foreach ( $handles as $handle ) {
-       wp_dequeue_style( $handle );  // or wp_dequeue_script
-     }
-   }
-   ```
-
-2. **For style-src rewrites** (e.g., URL parameter slimming), extend
-   `peptide_starter_perf_slim_google_fonts()` with a new loop iteration:
-
-   ```php
-   foreach ( $font_weights_config as $config_family => $weights ) {
-     if ( 0 === strcasecmp( $family, $config_family ) ) {
-       // Rewrite and return
-     }
-   }
-   ```
-
-3. **For preconnect hints**, add URLs to the filter in
-   `peptide_starter_perf_resource_hints()`:
-
-   ```php
-   $font_urls = apply_filters(
-     'peptide_starter_perf_font_preconnect_urls',
-     array( 'https://fonts.googleapis.com', 'https://fonts.gstatic.com' )
-   );
-   ```
-
-4. **For script deferral**, add a new handle check in
-   `peptide_starter_perf_defer_cookie_notice()`:
-
-   ```php
-   if ( 'my-script-handle' !== $handle ) {
-     return $tag;
-   }
-   $tag = str_replace( '<script ', '<script defer ', $tag );
-   return $tag;
-   ```
-
-5. **Test on production** using the kill-switch to verify zero regression:
-
-   - Add `define( 'PEPTIDE_STARTER_PERF_DEQUEUE', false );` to `wp-config.php`
-   - Curl the affected pages and verify assets still load
-   - Remove the define, reload, and verify assets are dequeued/transformed
-
-6. **Document** in CHANGELOG.md and ARCHITECTURE.md with the dequeue conditions
-   and expected asset reductions (file size, count, LCP delta if measured).
-
-**Best practices:**
-- Always expose dequeue lists and thresholds as filters for customization
-- Use production handle names verified via `wp eval` (not guesses)
-- Test with the kill-switch ON to ensure no regression on opt-out
-- Document the expected impact in CHANGELOG (file size, LCP delta, etc.)
-
 ### How to Add a New CSS Component
 
 **Scenario:** Create a new "pill" button style (small, rounded, inline)
@@ -768,4 +736,46 @@ numbers in handler files.
 
 ## Git Workflow — PR-Gated, Soft-Enforced
 
-This repo is private on GitHub's free plan, which does not support branch protection or rulesets. The review gate is enforced at the agent layer, not server-sid
\ No newline at end of file
+This repo is private on GitHub's free plan, which does not support branch protection or rulesets. The review gate is enforced at the agent layer, not server-side. Every agent and human contributor follows these rules; the `.github/workflows/main-push-audit.yml` tripwire opens an audit issue on any direct push to `main` that did not come from a merged PR.
+
+### Rules
+
+1. **Never push to `main` directly.** Every change lands via a pull request that the maintainer merges. No self-merging. No force-pushing to `main`.
+
+2. **Branch naming**: `claude/<scope>-<YYYYMMDD>` for agent-authored work, `fix/<scope>` or `feat/<scope>` for human-authored. The scope is a 1–3 word kebab-case description.
+
+3. **Commit trailer**: every commit authored by an agent must end with an `Agent-Session:` trailer so commits can be correlated back to the conversation that produced them, even though all commits share the `peptiderepo` bot identity.
+
+   ```
+   feat: add per-request cost tracking
+
+   Agent-Session: cowork-2026-04-14-cost-audit
+   ```
+
+4. **PR description template**: every PR description covers
+   - **What changed** (one paragraph)
+   - **Why** (motivation or incident link)
+   - **Risk flags** (schema changes, API contract changes, cost impact, compatibility)
+   - **Test plan** (what was run locally, what to smoke-test after merge)
+
+5. **Emergency push exception**: if a situation genuinely requires pushing to `main` without a PR (site down, CI broken, one-line hotfix), surface it in the chat before doing it. Every emergency push gets a follow-up PR that commits the same changes through the normal flow so git stays the source of truth. The tripwire will open an audit issue — close it with a comment explaining why.
+
+### Opening a PR from an agent session
+
+The `gh` CLI is not installed in the Cowork sandbox. Use `curl` with the PAT from the workspace `.env.credentials`:
+
+```bash
+GH_TOKEN=$(grep "^GITHUB_PAT=" "$WORKSPACE/.env.credentials" | cut -d= -f2)
+
+git push -u origin HEAD
+
+curl -s -X POST -H "Authorization: token $GH_TOKEN" \
+  -H "Content-Type: application/json" \
+  "https://api.github.com/repos/peptiderepo/<repo>/pulls" \
+  -d "$(jq -cn --arg title "<title>" --arg head "<branch>" --arg body "<body>" \
+      '{title:$title, head:$head, base:"main", body:$body}')"
+```
+
+### When this changes
+
+If the peptiderepo GitHub account is ever upgraded to Pro (or the repo goes public), replace this soft-enforcement section with a note pointing to the real branch protection rules in repo settings.
\ No newline at end of file
diff --git a/functions.php b/functions.php
index d91cd84..2f3847b 100644
--- a/functions.php
+++ b/functions.php
@@ -233,4 +233,11 @@ function peptide_starter_inline_dark_mode_script() {
 		var html = document.documentElement;
 		var stored = localStorage.getItem('peptide-starter-theme');
 		var defaultTheme = <?php echo wp_json_encode( $default_dark ); ?>;
-		var systemDark = window.matchMedia('(prefers-col
\ No newline at end of file
+		var systemDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
+		var theme = stored || (systemDark ? 'dark' : defaultTheme);
+		html.setAttribute('data-theme', theme);
+	})();
+	</script>
+	<?php
+}
+add_action( 'wp_head', 'peptide_starter_inline_dark_mode_script' );