fix: correct indentation in footer.php line 60 (PHPCS)

- Add abbrs field to Established verdict taxonomy item
- Add peptide_starter_render_desc() helper — builds safe HTML from
  esc_html/esc_attr components; replaces abbr terms with <abbr> tap-targets
- Update front-page.php description output to use render_desc()
- Add assets/js/abbr-tooltip.js — popover open/close, outside-click
  dismissal, keyboard accessibility (Enter/Space/Escape), ARIA attrs
- Enqueue abbr-tooltip.js on is_front_page() only
- Add .pr-abbr and .pr-abbr-popover CSS with dashed underline affordance,
  fade-in animation, dark-mode-safe surface variables
- Fix PEPTIDE_STARTER_VERSION drift: 2.0.0-alpha.3 → 2.2.1

Routing note: this is a theme change (not PR Core). Term 'RCT' is scoped
to the verdict legend strip only; monograph bodies are unaffected.

.github/workflows/ci.yml

@@ -1,24 +1,112 @@
-name: CI
+name: CI — Lint & Test
+
+# Runs on every PR and every push to main.
+# Three jobs in parallel:
+#   1. PHP Lint — syntax check across supported PHP versions
+#   2. PHPCS — WordPress coding standards (non-blocking during theme rollout)
+#   3. PHPUnit — runs the theme's test suite against the WordPress test framework
 
-# Thin caller — delegates all jobs to the shared reusable workflow.
-# Must include workflow_call so deploy.yml can gate on this workflow.
 on:
-  pull_request: {}
   push:
     branches: [main]
-  workflow_call: {}
+  pull_request:
+    branches: [main]
 
-# Required by the reusable phpcs job which commits phpcbf auto-fixes back
-# to the PR branch. GitHub enforces that callers declare at least the same
-# permissions as any job-level override in the called workflow.
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  ci:
-    uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
-    with:
-      tests: wp-framework
-      has_js: true
-      line_limit_paths: inc
-    secrets: inherit
+  php-lint:
+    name: PHP Lint (${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.1', '8.2', '8.3']
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+      - name: Syntax check all PHP files
+        run: |
+          set -e
+          find . -name '*.php' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -print0 | xargs -0 -n1 -P4 php -l > /dev/null
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer:v2
+      - name: Install dependencies
+        run: composer install --no-progress --no-interaction --prefer-dist
+      - name: Run PHPCS
+        run: vendor/bin/phpcs --standard=.phpcs.xml.dist
+
+  phpunit:
+    name: PHPUnit (PHP ${{ matrix.php }}, WP ${{ matrix.wp }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.1', '8.2', '8.3']
+        wp: ['latest']
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wp_tests
+        ports:
+          - 3306:3306
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install subversion
+        # ubuntu-latest no longer ships svn preinstalled. The WP test suite
+        # bootstrap script checks out develop.svn.wordpress.org via svn.
+        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          tools: composer:v2
+          extensions: mysqli
+      - name: Install composer dependencies
+        run: composer install --no-progress --no-interaction --prefer-dist
+      - name: Wait for MySQL
+        run: |
+          for i in {1..30}; do
+            if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
+              echo "MySQL is up"; break
+            fi
+            echo "Waiting for MySQL..."; sleep 2
+          done
+      - name: Install WordPress test suite
+        env:
+          WP_TESTS_DIR: /tmp/wordpress-tests-lib
+          # Trailing slash matters: the bootstrap config substitutes this verbatim into ABSPATH,
+          # then concatenates 'wp-settings.php'. Without the slash you get '/tmp/wordpresswp-settings.php'.
+          WP_CORE_DIR: /tmp/wordpress/
+        run: |
+          chmod +x bin/install-wp-tests.sh
+          # 6th arg = skip-database-creation: the MySQL service already created wp_tests via MYSQL_DATABASE env.
+          bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 ${{ matrix.wp }} true
+      - name: Run PHPUnit
+        env:
+          WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        run: vendor/bin/phpunit --colors=always

.github/workflows/cto-review.yml

@@ -1,17 +1,20 @@
 name: CTO Review
 
-# Automated PR review powered by Claude Haiku (via OpenRouter).
+# Automated PR review powered by Claude + DeepSeek + Kimi (via OpenRouter)
+# plus Neurometric PR-Summarizer (a Qwen3-4B task-specialist SLM).
 #
-# A/B panel decision 2026-06-12: panel dropped to Haiku-only.
-# Evidence: convo/cto/threads/2026-06-qa-ab-review/02-analyst-findings.md
-# DeepSeek: high false-positive rate (absint()="code exec", PLUGIN_DIR="dir traversal").
-# Kimi: ~60% model failure rate across 13 PRs sampled.
-# Neurometric: summarizer only, zero unique-real findings, unreliable heuristic verdict.
-# Haiku: 0 failures, lowest noise, equivalent real-signal catch rate vs 4-voice panel.
+# During the A/B window (until further notice), every PR gets reviewed by FOUR models
+# in parallel. The PR comment shows each model's verdict side-by-side so we can compare
+# quality/cost on real PRs before picking a permanent default.
 #
-# Does NOT merge. Posts formal APPROVE/REQUEST_CHANGES/COMMENT reviews.
+# Neurometric is a "prose voice": it does not support OpenAI tool-calling, so its
+# contribution is raw markdown + a heuristic verdict. It is never the primary voice.
 #
-# Requires repo secret: OPENROUTER_API_KEY
+# Does NOT merge. Does NOT post formal APPROVE/REQUEST_CHANGES reviews — always COMMENT
+# (GITHUB_TOKEN can't formally approve PRs without repo-setting toggle).
+#
+# Requires repo secrets: OPENROUTER_API_KEY, NEUROMETRIC_API_KEY (optional; the
+# Neurometric voice self-skips with an inline error note if the key is missing).
 #
 # Cost cap: tracked in Repository Variables (CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS).
 # Default cap is 1000 cents ($10/month). Auto-resets on the 1st of each month.
@@ -120,18 +123,17 @@ jobs:
           git fetch origin ${{ github.event.pull_request.base.ref }} --depth=50
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-          # Write the diff to a file, not a step output / env var. Passing a
-          # ~400KB diff through the process env (execve argv+envp) exceeds the
-          # runner ARG_MAX and fails the next step with "Argument list too long".
-          # File transport also sidesteps the ~1MB step-output cap.
-          git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000 > /tmp/cto-review-diff.txt
+          DIFF=$(git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000)
           FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
-          SIZE=$(wc -c < /tmp/cto-review-diff.txt)
+          SIZE=$(echo -n "$DIFF" | wc -c)
           {
             echo "size=$SIZE"
             echo "files<<EOF_FILES"
             echo "$FILES"
             echo "EOF_FILES"
+            echo "diff<<EOF_DIFF"
+            echo "$DIFF"
+            echo "EOF_DIFF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Load repo conventions
@@ -148,17 +150,18 @@ jobs:
             echo "EOF_CONV"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Call Haiku via OpenRouter
+      - name: Call 4 models in parallel (OpenRouter + Neurometric)
         if: steps.budget.outputs.skip != 'true'
         id: review
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          NEUROMETRIC_API_KEY: ${{ secrets.NEUROMETRIC_API_KEY }}
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO_NAME: ${{ github.event.repository.name }}
-          DIFF_PATH: /tmp/cto-review-diff.txt
+          DIFF: ${{ steps.diff.outputs.diff }}
           DIFF_SIZE: ${{ steps.diff.outputs.size }}
           CHANGED_FILES: ${{ steps.diff.outputs.files }}
           CONVENTIONS: ${{ steps.conventions.outputs.content }}
@@ -180,17 +183,24 @@ jobs:
           fi
 
           python3 - <<'PY'
-          import json, os, sys, urllib.request
+          import json, os, sys, urllib.request, concurrent.futures
 
           api_key = os.environ["OPENROUTER_API_KEY"]
 
-          # Haiku-only reviewer. A/B panel dropped 2026-06-12 per QA data:
-          # DeepSeek high false-positive rate, Kimi ~60% failure rate,
-          # Neurometric zero unique-real findings. Haiku retained as sole voice.
-          MODEL_SLUG = "anthropic/claude-haiku-4.5"
-          MODEL_DISPLAY = "Claude Haiku 4.5"
-          INPUT_PER_M_USD = 1.00
-          OUTPUT_PER_M_USD = 5.00
+          # A/B harness: four models. Each gets the same prompt.
+          # Primary model's verdict drives the heading. Others are labeled.
+          # Edit this list to change the roster (or drop to 1 after A/B window closes).
+          #
+          # provider_type semantics:
+          #   - "openrouter_tools": OpenAI tool-calling via OpenRouter; structured verdict.
+          #   - "neurometric_prose": Neurometric marketplace SLM; prose output + heuristic verdict.
+          MODELS = [
+              # (slug, display name, input_per_M_USD, output_per_M_USD, is_primary, provider_type)
+              ("anthropic/claude-haiku-4.5",       "Claude Haiku 4.5",                     1.00, 5.00, True,  "openrouter_tools"),
+              ("deepseek/deepseek-chat-v3.1",      "DeepSeek V3.1",                        0.15, 0.75, False, "openrouter_tools"),
+              ("moonshotai/kimi-k2-thinking",      "Kimi K2 Thinking",                     0.60, 2.50, False, "openrouter_tools"),
+              ("neurometric/pr-summarizer",        "Neurometric PR-Summarizer (Qwen3-4B)", 0.00, 0.00, False, "neurometric_prose"),
+          ]
 
           system = """You are the CTO and lead reviewer for the peptiderepo project. You are reviewing a pull request opened by an autonomous agent or human contributor.
 
@@ -219,9 +229,7 @@ jobs:
           user_blocks.append(f"**Changed files:**\n```\n{os.environ['CHANGED_FILES']}\n```\n")
           if os.environ.get("CONVENTIONS", "").strip():
               user_blocks.append(f"# Repo CONVENTIONS.md\n{os.environ['CONVENTIONS']}\n")
-          with open(os.environ["DIFF_PATH"], encoding="utf-8", errors="replace") as _df:
-              _diff_text = _df.read()
-          user_blocks.append(f"# Diff\n```diff\n{_diff_text}\n```\n")
+          user_blocks.append(f"# Diff\n```diff\n{os.environ['DIFF']}\n```\n")
           user_message = "\n\n".join(user_blocks)
 
           tools = [{
@@ -253,100 +261,218 @@ jobs:
               }
           }]
 
-          body = {
-              "model": MODEL_SLUG,
-              "max_tokens": 2048,
-              "messages": [
-                  {"role": "system", "content": system},
-                  {"role": "user", "content": user_message}
-              ],
-              "tools": tools,
-              "tool_choice": {"type": "function", "function": {"name": "submit_review"}}
-          }
-          req = urllib.request.Request(
-              "https://openrouter.ai/api/v1/chat/completions",
-              data=json.dumps(body).encode(),
-              headers={
-                  "Authorization": f"Bearer {api_key}",
-                  "content-type": "application/json",
-                  "HTTP-Referer": "https://github.com/peptiderepo",
-                  "X-Title": f"peptiderepo CTO reviewer ({MODEL_DISPLAY})"
-              },
-              method="POST"
-          )
+          PER_MODEL_TIMEOUT = 60  # seconds; one hung model should not block siblings
 
-          error = None
-          review = None
-          cost_cents = 0.0
-          ptok = 0
-          ctok = 0
+          # Heuristic verdict inference for prose-voice models that can't do tool-calling.
+          # Keyword order matters: block markers beat approve markers.
+          PROSE_BLOCK_MARKERS = [
+              "do not merge", "do not approve", "should not be merged", "reject this",
+              "critical security", "critical issue", "critical vulnerability",
+              "blocker", "blocking issue", "request_changes", "request changes",
+              "**critical**", "sql injection", "must be addressed before",
+          ]
+          PROSE_APPROVE_MARKERS = [
+              "safe to merge", "ready to merge", "no blocking issues", "lgtm",
+              "approve this", "looks good to merge", "no concerns",
+          ]
 
-          try:
-              with urllib.request.urlopen(req, timeout=60) as resp:
-                  data = json.loads(resp.read())
-          except Exception as e:
-              error = str(e)[:300]
-              data = {}
+          def infer_verdict_from_prose(text):
+              t = (text or "").lower()
+              if any(m in t for m in PROSE_BLOCK_MARKERS):
+                  return "REQUEST_CHANGES"
+              if any(m in t for m in PROSE_APPROVE_MARKERS):
+                  return "APPROVE"
+              return "COMMENT"
+
+          def call_openrouter_tools(slug, display, in_rate, out_rate, is_primary):
+              body = {
+                  "model": slug,
+                  "max_tokens": 2048,
+                  "messages": [
+                      {"role": "system", "content": system},
+                      {"role": "user", "content": user_message}
+                  ],
+                  "tools": tools,
+                  "tool_choice": {"type": "function", "function": {"name": "submit_review"}}
+              }
+              req = urllib.request.Request(
+                  "https://openrouter.ai/api/v1/chat/completions",
+                  data=json.dumps(body).encode(),
+                  headers={
+                      "Authorization": f"Bearer {api_key}",
+                      "content-type": "application/json",
+                      "HTTP-Referer": "https://github.com/peptiderepo",
+                      "X-Title": f"peptiderepo CTO reviewer ({display})"
+                  },
+                  method="POST"
+              )
+              try:
+                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
+                      data = json.loads(resp.read())
+              except Exception as e:
+                  return {
+                      "slug": slug, "display": display, "is_primary": is_primary,
+                      "provider_type": "openrouter_tools",
+                      "error": str(e)[:300],
+                      "cost_cents": 0,
+                  }
 
-          if not error:
               choice = data.get("choices", [{}])[0].get("message", {})
               tool_calls = choice.get("tool_calls", [])
               if not tool_calls:
-                  error = f"No tool_call in response. Raw content: {str(choice)[:300]}"
-              else:
-                  try:
-                      review = json.loads(tool_calls[0]["function"]["arguments"])
-                  except Exception as e:
-                      error = f"Malformed tool args: {e}"
+                  return {
+                      "slug": slug, "display": display, "is_primary": is_primary,
+                      "provider_type": "openrouter_tools",
+                      "error": f"No tool_call in response. Raw content: {str(choice)[:300]}",
+                      "cost_cents": 0,
+                  }
 
-              if not error:
-                  usage = data.get("usage", {})
-                  ptok = usage.get("prompt_tokens", 0)
-                  ctok = usage.get("completion_tokens", 0)
-                  cost_usd = (ptok * INPUT_PER_M_USD / 1_000_000) + (ctok * OUTPUT_PER_M_USD / 1_000_000)
-                  cost_cents = cost_usd * 100
+              try:
+                  review = json.loads(tool_calls[0]["function"]["arguments"])
+              except Exception as e:
+                  return {
+                      "slug": slug, "display": display, "is_primary": is_primary,
+                      "provider_type": "openrouter_tools",
+                      "error": f"Malformed tool args: {e}",
+                      "cost_cents": 0,
+                  }
 
-          # Build comment
-          if error:
-              heading_verdict = "ERROR"
-              lines = [f"## CTO Review — {heading_verdict}", ""]
-              lines.append(f"Model failed: `{error}`")
+              usage = data.get("usage", {})
+              ptok = usage.get("prompt_tokens", 0)
+              ctok = usage.get("completion_tokens", 0)
+              cost_usd = (ptok * in_rate / 1_000_000) + (ctok * out_rate / 1_000_000)
+              cost_cents = cost_usd * 100
+              return {
+                  "slug": slug, "display": display, "is_primary": is_primary,
+                  "provider_type": "openrouter_tools",
+                  "review": review, "prompt_tokens": ptok, "completion_tokens": ctok,
+                  "cost_cents": cost_cents,
+              }
+
+          def call_neurometric_prose(slug, display, is_primary):
+              nm_key = os.environ.get("NEUROMETRIC_API_KEY", "")
+              if not nm_key:
+                  return {
+                      "slug": slug, "display": display, "is_primary": is_primary,
+                      "provider_type": "neurometric_prose",
+                      "error": "NEUROMETRIC_API_KEY secret not set on this repo",
+                      "cost_cents": 0,
+                  }
+              body = {
+                  "model": slug,
+                  "max_tokens": 2048,
+                  "messages": [
+                      {"role": "system", "content": system},
+                      {"role": "user", "content": user_message},
+                  ],
+              }
+              req = urllib.request.Request(
+                  "https://api.neurometric.ai/v1/chat/completions",
+                  data=json.dumps(body).encode(),
+                  headers={
+                      "Authorization": f"Bearer {nm_key}",
+                      "content-type": "application/json",
+                  },
+                  method="POST",
+              )
+              try:
+                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
+                      data = json.loads(resp.read())
+              except Exception as e:
+                  return {
+                      "slug": slug, "display": display, "is_primary": is_primary,
+                      "provider_type": "neurometric_prose",
+                      "error": str(e)[:300],
+                      "cost_cents": 0,
+                  }
+              prose = data.get("choices", [{}])[0].get("message", {}).get("content") or ""
+              verdict = infer_verdict_from_prose(prose)
+              return {
+                  "slug": slug, "display": display, "is_primary": is_primary,
+                  "provider_type": "neurometric_prose",
+                  "review": {"verdict": verdict, "prose": prose},
+                  "prompt_tokens": 0, "completion_tokens": 0,
+                  "cost_cents": 0,
+              }
+
+          def call_model(slug, display, in_rate, out_rate, is_primary, provider_type="openrouter_tools"):
+              if provider_type == "neurometric_prose":
+                  return call_neurometric_prose(slug, display, is_primary)
+              return call_openrouter_tools(slug, display, in_rate, out_rate, is_primary)
+
+          results = []
+          with concurrent.futures.ThreadPoolExecutor(max_workers=len(MODELS)) as pool:
+              futures = [pool.submit(call_model, *m) for m in MODELS]
+              for f in concurrent.futures.as_completed(futures):
+                  results.append(f.result())
+
+          # Order: primary first, then alphabetical for stable comparison
+          results.sort(key=lambda r: (not r.get("is_primary"), r["display"]))
+
+          # Build combined comment
+          primary = next((r for r in results if r.get("is_primary") and "review" in r), None)
+          heading_verdict = primary["review"]["verdict"] if primary else "MIXED"
+
+          lines = [f"## CTO Review — {heading_verdict}", ""]
+          lines.append(f"_A/B harness active: {len(results)} models reviewing in parallel. Primary verdict drives heading; others are advisory._")
+          lines.append("")
+
+          total_cents = 0.0
+          for r in results:
+              lines.append(f"---")
+              primary_tag = " (primary)" if r.get("is_primary") else ""
+              lines.append(f"### {r['display']}{primary_tag}")
+              if "error" in r:
+                  lines.append("")
+                  lines.append(f"⚠️ Model failed: `{r['error']}`")
+                  lines.append("")
+                  continue
+              rev = r["review"]
               lines.append("")
-              lines.append(f"_reviewer: {MODEL_DISPLAY}_")
-          else:
-              heading_verdict = review.get("verdict", "COMMENT")
-              lines = [f"## CTO Review — {heading_verdict}", ""]
-              lines.append(f"**Verdict:** {heading_verdict}")
+              if r.get("provider_type") == "neurometric_prose":
+                  lines.append(f"**Verdict:** {rev['verdict']} _(heuristic, inferred from prose)_")
+                  lines.append("")
+                  # Cap at 6KB to keep PR comments readable; 4B model output is rarely over this
+                  prose = rev.get("prose", "")
+                  if len(prose) > 6000:
+                      prose = prose[:6000] + "\n\n_…output truncated for comment length…_"
+                  lines.append(prose)
+                  lines.append("")
+                  lines.append("_free tier; per-call token usage not tracked_")
+                  lines.append("")
+                  continue
+              lines.append(f"**Verdict:** {rev.get('verdict', 'COMMENT')}")
               lines.append("")
-              lines.append(review.get("summary") or "_(model returned no summary)_")
+              lines.append(rev.get("summary") or "_(model returned no summary)_")
               lines.append("")
-              if review.get("concerns"):
+              if rev.get("concerns"):
                   lines.append("**Concerns:**")
-                  for c in review["concerns"]:
-                      sev = c.get("severity", "UNKNOWN").upper()
+                  for c in rev["concerns"]:
+                      sev = c["severity"].upper()
                       f = f"`{c['file']}`" if c.get("file") else ""
                       lines.append(f"- **{sev}** {f} — {c['issue']}")
                   lines.append("")
-              if review.get("positives"):
-                  lines.append("**Positives:** " + "; ".join(review["positives"]))
+              if rev.get("positives"):
+                  lines.append("**Positives:** " + "; ".join(rev["positives"]))
                   lines.append("")
-              lines.append(f"_tokens in/out: {ptok}/{ctok} · cost: ${cost_cents/100:.4f}_")
+              lines.append(f"_tokens in/out: {r['prompt_tokens']}/{r['completion_tokens']} · cost: ${r['cost_cents']/100:.4f}_")
+              total_cents += r["cost_cents"]
               lines.append("")
 
           lines.append("---")
-          lines.append(f"_Total review cost: **${cost_cents/100:.4f}**. Reviewer: {MODEL_DISPLAY}. Roster configured in `.github/workflows/cto-review.yml`._")
+          lines.append(f"_Total review cost: **${total_cents/100:.4f}**. A/B roster configured in `.github/workflows/cto-review.yml`._")
 
           with open("/tmp/review-body.md", "w") as f:
               f.write("\n".join(lines))
           with open(os.environ["GITHUB_OUTPUT"], "a") as f:
-              f.write(f"added_cents={int(round(cost_cents))}\n")
+              f.write(f"added_cents={int(round(total_cents))}\n")
               f.write(f"skipped=0\n")
               f.write(f"primary_verdict={heading_verdict}\n")
           PY
 
       - name: Post PR review (formal APPROVE / REQUEST_CHANGES / COMMENT)
-        # Uses Haiku's verdict as the formal event. Falls back to COMMENT
-        # if the model failed or returned something unexpected.
+        # Uses primary model's verdict as the formal event. Falls back to COMMENT
+        # if the primary model failed or returned something unexpected.
         if: steps.budget.outputs.skip != 'true' && steps.review.outputs.skipped != '1'
         uses: actions/github-script@v7
         env:

.github/workflows/deploy.yml

@@ -9,17 +9,159 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Gate deploy on the reusable CI (lint-php, phpcs, phpunit, file-size, lint-js).
-  # ci.yml exposes workflow_call so it can be used here without re-running a
-  # separate workflow — the call result satisfies the branch-protection context
-  # "ci / ci (lint-php (8.1))" etc.
-  ci:
-    uses: ./.github/workflows/ci.yml
+  validate:
+    name: Validate PHP & JS
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: PHP Lint Check
+        run: |
+          find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
+          test ${PIPESTATUS[0]} -eq 0
+      - name: Install PHPCS with WordPress standards
+        run: |
+          composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+          composer global require --dev squizlabs/php_codesniffer:"^3.0" wp-coding-standards/wpcs:"^3.0" phpcsstandards/phpcsutils:"^1.0"
+      - name: Run PHPCS (WordPress Core)
+        run: |
+          ~/.composer/vendor/bin/phpcs -s . || true  # non-blocking during theme rollout
+      - name: JS Syntax Check
+        run: |
+          find assets/js -name "*.js" -exec node --check {} \;
 
-  deploy:
-    name: Deploy (shared pipeline)
-    needs: ci
-    uses: peptide-repo/peptide-e2e/.github/workflows/deploy-app.yml@main
-    with:
-      target_path: wp-content/themes/peptide-starter
-    secrets: inherit
+  deploy-staging:
+    name: Deploy to Staging
+    needs: validate
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - name: Deploy via rsync → staging
+        run: |
+          rsync -avz --delete \
+            --exclude='.git' \
+            --exclude='.github' \
+            --exclude='tests/' \
+            --exclude='phpunit.xml' \
+            --exclude='composer.json' \
+            --exclude='composer.lock' \
+            --exclude='vendor/' \
+            --exclude='node_modules/' \
+            --exclude='.phpcs.xml.dist' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/staging/wp-content/themes/peptide-starter/
+      - name: Staging health check
+        run: |
+          sleep 5
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.peptiderepo.com/ || echo "000")
+          echo "Staging responded: HTTP $STATUS"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+
+  smoke:
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    secrets:
+      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
+      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
+
+  deploy-production:
+    name: Deploy to Production
+    needs: [validate, deploy-staging]  # smoke is informational; not gating prod until e2e suite is stable
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - name: Snapshot plugin inventory (pre-deploy)
+        # Guards against the 2026-04-23 incident where rsync to wrong path clobbered WP core.
+        # Checks that the active plugin count is sane before and after deploy.
+        # Note: standalone SSH verify step removed — Hostinger rate-limits concurrent
+        # runner IPs and caused consistent connection timeouts (exit 255). The rsync
+        # itself will fail safely if the path doesn't exist.
+        run: |
+          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
+            -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=30 \
+            -o BatchMode=yes \
+            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} \
+            "wp --path=/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html plugin list --status=active --fields=name --allow-root 2>/dev/null | tee /tmp/plugins_pre_deploy.txt && echo \"Pre-deploy plugin count: \$(wc -l < /tmp/plugins_pre_deploy.txt)\""
+      - name: Deploy via rsync → production
+        run: |
+          rsync -avz --delete \
+            --exclude='.git' \
+            --exclude='.github' \
+            --exclude='tests/' \
+            --exclude='phpunit.xml' \
+            --exclude='composer.json' \
+            --exclude='composer.lock' \
+            --exclude='vendor/' \
+            --exclude='node_modules/' \
+            --exclude='.phpcs.xml.dist' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/
+      - name: Verify plugin inventory unchanged (post-deploy)
+        run: |
+          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
+            -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=30 \
+            -o BatchMode=yes \
+            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            wp --path=/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html plugin list --status=active --fields=name --allow-root 2>/dev/null > /tmp/plugins_post_deploy.txt
+            PRE=$(wc -l < /tmp/plugins_pre_deploy.txt)
+            POST=$(wc -l < /tmp/plugins_post_deploy.txt)
+            echo "Pre-deploy active plugins:  $PRE"
+            echo "Post-deploy active plugins: $POST"
+            if [ "$POST" -lt "$PRE" ]; then
+              echo "ERROR: Plugin count dropped from $PRE to $POST after deploy."
+              diff /tmp/plugins_pre_deploy.txt /tmp/plugins_post_deploy.txt || true
+              exit 1
+            fi
+            echo "Plugin inventory OK."
+          ENDSSH
+      - name: Purge LiteSpeed Cache
+        run: |
+          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
+            -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=30 \
+            -o BatchMode=yes \
+            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
+            if [ -d "$CACHE_DIR" ]; then
+              rm -rf "$CACHE_DIR"/*
+              echo "LiteSpeed cache purged."
+            fi
+            touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
+          ENDSSH
+      - name: Production health check
+        run: |
+          sleep 5
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
+          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
+            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
+            exit 1
+          fi
+          echo "Production healthy (HTTP $STATUS)"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+      - name: Deploy summary
+        run: |
+          echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY
+          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- **Deployed to:** peptiderepo.com/themes/peptide-starter" >> $GITHUB_STEP_SUMMARY

.github/workflows/main-push-audit.yml

@@ -29,22 +29,12 @@ jobs:
         with:
           script: |
             const sha = context.sha;
-            // Squash-merge -> PR association is eventually-consistent; poll briefly
-            // before concluding this was a direct push (avoids false positives on merges).
-            async function findMergedPR() {
-              for (let attempt = 1; attempt <= 5; attempt++) {
-                const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  commit_sha: sha,
-                });
-                const m = prs.find(p => p.merged_at);
-                if (m) return m;
-                if (attempt < 5) await new Promise(r => setTimeout(r, 10000));
-              }
-              return null;
-            }
-            const merged = await findMergedPR();
+            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              commit_sha: sha,
+            });
+            const merged = prs.find(p => p.merged_at);
             if (merged) {
               core.info(`OK: commit ${sha.substring(0,7)} came from PR #${merged.number}`);
               return;

CHANGELOG.md

@@ -1,43 +1,5 @@
 # Peptide Starter Theme - Changelog
 
-## [2.3.0] - 2026-06-16 — Adopt estate CI standard
-
-### Changed
-
-- `.github/workflows/ci.yml`: Replaced per-repo CI jobs with a thin caller
-  delegating to `peptiderepo/peptide-e2e/.github/workflows/ci.yml@main`
-  (`tests: wp-framework`, `has_js: true`, `line_limit_paths: inc`). Added
-  `workflow_call` trigger so `deploy.yml` can gate on this workflow.
-- `.github/workflows/deploy.yml`: Retired standalone `validate` job; deploy
-  now gates on the reusable CI via `uses: ./.github/workflows/ci.yml`.
-- `composer.json`: `test` script now calls `vendor/bin/phpunit` explicitly
-  (was bare `phpunit`).
-- `inc/helpers.php`: Split 311-line file at the nav-walker boundary; reduced
-  to 211 lines.
-
-### Added
-
-- `inc/nav-walker.php`: `Peptide_Starter_Nav_Walker` class and
-  `peptide_starter_primary_menu_fallback()` extracted from `inc/helpers.php`
-  (123 lines). Loaded in `functions.php` before `helpers.php`.
-- `package.json` / `package-lock.json`: Minimal npm manifest so the reusable
-  `lint-js` job can run `npm ci` and then execute `npm run lint` (which runs
-  `node --check` on `assets/js/**/*.js`).
-
-
-## [2.2.2] - 2026-04-29 — Front page layout restructure
-
-### Changed
-
-- `template-parts/module-cards.php`: Removed Science Feed from the module card
-  grid. The grid is for interactive tools only; news is content. Grid is now
-  5 cards: Peptides, Calculator, Protocol Builder, Tracker, Subject Log. No card
-  in this set goes inactive-dimmed due to a plugin registration check.
-- `front-page.php`: Replaced the full `[peptide_news]` inline feed with a
-  3-item teaser row (`[peptide_news count="3"]`) and a "View all research →"
-  CTA linking to `/news`. Reduces page weight and drives traffic to the
-  dedicated news page.
-
 ## [2.2.1] - 2026-04-29 — RCT inline abbreviation tooltip
 
 ### Added

composer.json

@@ -13,7 +13,7 @@
 	"scripts": {
 		"lint": "phpcs",
 		"lint:fix": "phpcbf",
-		"test": "vendor/bin/phpunit"
+		"test": "phpunit"
 	},
 	"config": {
 		"allow-plugins": {

front-page.php

@@ -204,7 +204,7 @@ $featured_monograph_ids = array( 211, 36, 177 );
 	</section>
 	<?php endif; ?>
 
-	<!-- Research Modules Grid (5 cards) -->
+	<!-- Research Modules Grid (6 cards) -->
 	<?php get_template_part( 'template-parts/module', 'cards' ); ?>
 
 	<!-- PRAutoBlogger Posts Widget -->
@@ -214,22 +214,19 @@ $featured_monograph_ids = array( 211, 36, 177 );
 	}
 	?>
 
-	<!-- News Teaser Section — 3 items + "View all" CTA -->
+	<!-- News Feed Section -->
 	<?php
 	if ( shortcode_exists( 'peptide_news' ) ) {
 		?>
-		<section class="news-teaser-section">
+		<section class="news-feed-section">
 			<div class="ps-container">
-				<div class="news-teaser-header">
-					<div>
-						<h2><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
-						<p><?php esc_html_e( 'Recent publications from leading research sources.', 'peptide-starter' ); ?></p>
-					</div>
-					<a href="<?php echo esc_url( home_url( '/news' ) ); ?>" class="ps-btn ps-btn-secondary">
-						<?php esc_html_e( 'View all research →', 'peptide-starter' ); ?>
-					</a>
+				<div class="news-feed-header">
+					<h2 class="news-feed-title"><?php esc_html_e( 'What\'s new', 'peptide-starter' ); ?></h2>
+					<p class="news-feed-description">
+						<?php esc_html_e( 'Recent peptide research, regulatory shifts, and synthesis news. New posts weekly.', 'peptide-starter' ); ?>
+					</p>
 				</div>
-				<?php echo do_shortcode( '[peptide_news count="3"]' ); ?>
+				<?php echo do_shortcode( '[peptide_news]' ); ?>
 			</div>
 		</section>
 		<?php

functions.php

@@ -7,8 +7,6 @@
  * 300 lines and to make responsibilities discoverable.
  *
  * @see inc/config.php           — security configuration
- * @see inc/nav-walker.php       — Peptide_Starter_Nav_Walker + primary menu fallback
- * @see inc/helpers.php          — customizer helpers, gates, honeypot, CSV utility
  * @see inc/rate-limiter.php     — transient-backed rate limiter
  * @see inc/email-verification.php — token-gated email verification
  * @see inc/auth-handlers.php    — AJAX login + registration
@@ -16,6 +14,7 @@
  * @see inc/newsletter-admin.php — admin subscriber viewer + unsubscribe
  * @see inc/page-setup.php       — auto-create pages + v1.5.0 user migration
  * @see inc/mail-diagnostic.php  — admin deliverability test tool
+ * @see inc/helpers.php          — nav walker, menu fallback, gates, utilities
  * @see inc/perf-asset-policy.php — asset dequeue + font slim + preconnect + defer
  *
  * @package peptide-starter
@@ -27,14 +26,13 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 // Theme constants.
-define( 'PEPTIDE_STARTER_VERSION', '2.3.0' );
+define( 'PEPTIDE_STARTER_VERSION', '2.2.1' );
 define( 'PEPTIDE_STARTER_DIR', get_template_directory() );
 define( 'PEPTIDE_STARTER_URI', get_template_directory_uri() );
 
 // Load feature modules. Order matters — config must load before anything
 // that calls peptide_starter_config_*; rate limiter before handlers.
 require_once PEPTIDE_STARTER_DIR . '/inc/config.php';
-require_once PEPTIDE_STARTER_DIR . '/inc/nav-walker.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/helpers.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/cloudflare-ips.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/rate-limiter.php';

inc/helpers.php

@@ -2,21 +2,17 @@
 /**
  * Theme Helper Functions
  *
- * Customizer output helpers, custom logo, pagination, auth gates,
- * honeypot, and CSV utility shared across the theme.
+ * Customizer output helpers, nav walker, custom logo, pagination, menu
+ * fallback, auth gates, and assorted utilities shared across the theme.
  *
- * Navigation walker and primary menu fallback have been extracted to
- * inc/nav-walker.php (v2.3.0) to keep this file under 300 lines.
- *
- * @see functions.php        — includes this file (after nav-walker.php)
- * @see inc/nav-walker.php   — Peptide_Starter_Nav_Walker + menu fallback
- * @see header.php           — uses peptide_starter_the_custom_logo()
+ * @see functions.php — includes this file
+ * @see header.php — uses peptide_starter_the_custom_logo() + menu fallback
  * @see page-subject-log.php, page-tracker.php, page-protocol-builder.php —
  *   use peptide_starter_require_login()
  *
  * What: Utility functions for template output, theme mods, auth gating.
  * Who calls it: Templates and handler files.
- * Dependencies: WordPress Customizer API, email-verification.
+ * Dependencies: WordPress Customizer API, Walker_Nav_Menu, email-verification.
  *
  * @package peptide-starter
  */
@@ -26,6 +22,110 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 
+/**
+ * Navigation Menu Walker — adds active classes.
+ *
+ * What: Renders menu items with an 'active' class for current + ancestor.
+ * Who calls it: wp_nav_menu() in header.php with walker => new instance.
+ * Dependencies: Walker_Nav_Menu.
+ */
+class Peptide_Starter_Nav_Walker extends Walker_Nav_Menu {
+
+	/**
+	 * Render a single menu item.
+	 *
+	 * @param string   $output Item output accumulator.
+	 * @param WP_Post  $item   Menu item data.
+	 * @param int      $depth  Menu depth.
+	 * @param stdClass $args   Menu arguments.
+	 * @param int      $id     Current item ID.
+	 * @return void
+	 */
+	public function start_el( &$output, $item, $depth = 0, $args = null, $id = 0 ) {
+		$indent    = ( $depth ) ? str_repeat( "\t", $depth ) : '';
+		$classes   = empty( $item->classes ) ? array() : (array) $item->classes;
+		$classes[] = 'menu-item-' . $item->ID;
+
+		if ( in_array( 'current-menu-item', $classes, true ) || in_array( 'current-menu-parent', $classes, true ) ) {
+			$classes[] = 'active';
+		}
+
+		$args        = apply_filters( 'nav_menu_item_args', $args, $item, $depth );
+		$class_names = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item, $args, $depth ) );
+		$class_names = $class_names ? ' class="' . esc_attr( $class_names ) . '"' : '';
+
+		$item_id = apply_filters( 'nav_menu_item_id', 'menu-item-' . $item->ID, $item, $args, $depth );
+		$item_id = $item_id ? ' id="' . esc_attr( $item_id ) . '"' : '';
+
+		$output .= $indent . '<li' . $item_id . $class_names . '>';
+
+		$atts = array(
+			'title'  => ! empty( $item->attr_title ) ? $item->attr_title : '',
+			'target' => ! empty( $item->target ) ? $item->target : '',
+			'rel'    => ! empty( $item->xfn ) ? $item->xfn : '',
+			'href'   => ! empty( $item->url ) ? $item->url : '',
+		);
+
+		$atts       = apply_filters( 'nav_menu_link_attributes', $atts, $item, $args, $depth );
+		$attributes = '';
+
+		foreach ( $atts as $attr => $value ) {
+			if ( ! empty( $value ) ) {
+				$value       = ( 'href' === $attr ) ? esc_url( $value ) : esc_attr( $value );
+				$attributes .= ' ' . $attr . '="' . $value . '"';
+			}
+		}
+
+		$title = apply_filters( 'the_title', $item->title, $item->ID );
+
+		$link  = $args->before;
+		$link .= '<a' . $attributes . '>';
+		$link .= $args->link_before . $title . $args->link_after;
+		$link .= '</a>';
+		$link .= $args->after;
+
+		$output .= $link . "</li>\n";
+	}
+}
+
+/**
+ * Fallback menu when no primary nav is assigned in WP admin.
+ *
+ * Previously lived inline inside header.php; moved here in v1.5.1 to
+ * prevent redeclaration if header.php is ever included twice.
+ *
+ * @return void Echoes a complete <ul>.
+ */
+function peptide_starter_primary_menu_fallback() {
+	?>
+	<ul>
+		<li><a href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php esc_html_e( 'Home', 'peptide-starter' ); ?></a></li>
+		<li class="menu-item-has-children">
+			<a href="#"><?php esc_html_e( 'Tools', 'peptide-starter' ); ?></a>
+			<ul class="sub-menu">
+				<li><a href="<?php echo esc_url( home_url( '/calculator' ) ); ?>"><?php esc_html_e( 'Calculator', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/protocol-builder' ) ); ?>"><?php esc_html_e( 'Protocol Builder', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/tracker' ) ); ?>"><?php esc_html_e( 'Tracker', 'peptide-starter' ); ?></a></li>
+			</ul>
+		</li>
+		<li class="menu-item-has-children">
+			<a href="#"><?php esc_html_e( 'My Data', 'peptide-starter' ); ?></a>
+			<ul class="sub-menu">
+				<li><a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>"><?php esc_html_e( 'Peptides', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/subject-log' ) ); ?>"><?php esc_html_e( 'Subject Log', 'peptide-starter' ); ?></a></li>
+			</ul>
+		</li>
+		<li class="menu-item-has-children">
+			<a href="#"><?php esc_html_e( 'Resources', 'peptide-starter' ); ?></a>
+			<ul class="sub-menu">
+				<li><a href="<?php echo esc_url( home_url( '/documentation' ) ); ?>"><?php esc_html_e( 'Documentation', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/news' ) ); ?>"><?php esc_html_e( 'Science Feed', 'peptide-starter' ); ?></a></li>
+			</ul>
+		</li>
+	</ul>
+	<?php
+}
+
 /**
  * Display custom logo with fallback to site name link.
  *
@@ -82,7 +182,7 @@ function peptide_starter_get_search_placeholder() {
  * @return string Copyright text (may contain safe HTML).
  */
 function peptide_starter_get_footer_copyright() {
-	return get_theme_mod( 'footer_copyright', esc_html__( 'Copyright \u00a9 2026 Peptide Repo. All rights reserved.', 'peptide-starter' ) );
+	return get_theme_mod( 'footer_copyright', esc_html__( 'Copyright © 2026 Peptide Repo. All rights reserved.', 'peptide-starter' ) );
 }
 
 /**
@@ -117,8 +217,8 @@ function peptide_starter_pagination() {
 			'format'    => 'page/%#%/',
 			'current'   => $current,
 			'total'     => $total,
-			'prev_text' => esc_html__( '\u2190 Previous', 'peptide-starter' ),
-			'next_text' => esc_html__( 'Next \u2192', 'peptide-starter' ),
+			'prev_text' => esc_html__( '← Previous', 'peptide-starter' ),
+			'next_text' => esc_html__( 'Next →', 'peptide-starter' ),
 			'type'      => 'plain',
 		)
 	);
@@ -148,8 +248,8 @@ function peptide_starter_safe_referer() {
 /**
  * Gate a template behind login + verified email.
  *
- * Unauthenticated \u2192 redirect to /auth?redirect_to=current-uri.
- * Logged in but unverified \u2192 redirect to /profile?verify_required=1.
+ * Unauthenticated → redirect to /auth?redirect_to=current-uri.
+ * Logged in but unverified → redirect to /profile?verify_required=1.
  *
  * Side effects: emits 302 and exits the request.
  *

inc/nav-walker.php

@@ -1,123 +0,0 @@
-<?php
-/**
- * Navigation Menu Walker & Primary Menu Fallback
- *
- * What: Custom nav walker that adds 'active' CSS classes, plus a fallback
- *       menu rendered when no primary nav is assigned in WP admin.
- * Who calls it: header.php — wp_nav_menu() with walker => new Peptide_Starter_Nav_Walker(),
- *               and the callback_function parameter for the fallback.
- * Dependencies: Walker_Nav_Menu (WordPress core).
- *
- * Extracted from inc/helpers.php in v2.3.0 to keep both files under 300 lines.
- *
- * @package peptide-starter
- */
-
-// Exit if accessed directly.
-if ( ! defined( 'ABSPATH' ) ) {
-	exit;
-}
-
-/**
- * Navigation Menu Walker — adds active classes.
- *
- * What: Renders menu items with an 'active' class for current + ancestor items.
- * Who calls it: wp_nav_menu() in header.php with walker => new instance.
- * Dependencies: Walker_Nav_Menu.
- */
-class Peptide_Starter_Nav_Walker extends Walker_Nav_Menu {
-
-	/**
-	 * Render a single menu item.
-	 *
-	 * @param string   $output Item output accumulator (passed by reference).
-	 * @param WP_Post  $item   Menu item data.
-	 * @param int      $depth  Menu depth.
-	 * @param stdClass $args   Menu arguments.
-	 * @param int      $id     Current item ID.
-	 * @return void
-	 */
-	public function start_el( &$output, $item, $depth = 0, $args = null, $id = 0 ) {
-		$indent    = ( $depth ) ? str_repeat( "\t", $depth ) : '';
-		$classes   = empty( $item->classes ) ? array() : (array) $item->classes;
-		$classes[] = 'menu-item-' . $item->ID;
-
-		if ( in_array( 'current-menu-item', $classes, true ) || in_array( 'current-menu-parent', $classes, true ) ) {
-			$classes[] = 'active';
-		}
-
-		$args        = apply_filters( 'nav_menu_item_args', $args, $item, $depth );
-		$class_names = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item, $args, $depth ) );
-		$class_names = $class_names ? ' class="' . esc_attr( $class_names ) . '"' : '';
-
-		$item_id = apply_filters( 'nav_menu_item_id', 'menu-item-' . $item->ID, $item, $args, $depth );
-		$item_id = $item_id ? ' id="' . esc_attr( $item_id ) . '"' : '';
-
-		$output .= $indent . '<li' . $item_id . $class_names . '>';
-
-		$atts = array(
-			'title'  => ! empty( $item->attr_title ) ? $item->attr_title : '',
-			'target' => ! empty( $item->target ) ? $item->target : '',
-			'rel'    => ! empty( $item->xfn ) ? $item->xfn : '',
-			'href'   => ! empty( $item->url ) ? $item->url : '',
-		);
-
-		$atts       = apply_filters( 'nav_menu_link_attributes', $atts, $item, $args, $depth );
-		$attributes = '';
-
-		foreach ( $atts as $attr => $value ) {
-			if ( ! empty( $value ) ) {
-				$value       = ( 'href' === $attr ) ? esc_url( $value ) : esc_attr( $value );
-				$attributes .= ' ' . $attr . '="' . $value . '"';
-			}
-		}
-
-		$title = apply_filters( 'the_title', $item->title, $item->ID );
-
-		$link  = $args->before;
-		$link .= '<a' . $attributes . '>';
-		$link .= $args->link_before . $title . $args->link_after;
-		$link .= '</a>';
-		$link .= $args->after;
-
-		$output .= $link . "</li>\n";
-	}
-}
-
-/**
- * Fallback menu when no primary nav is assigned in WP admin.
- *
- * Previously lived inline inside header.php; moved to inc/helpers.php in
- * v1.5.1 to prevent redeclaration, then extracted here in v2.3.0.
- *
- * @return void Echoes a complete <ul>.
- */
-function peptide_starter_primary_menu_fallback() {
-	?>
-	<ul>
-		<li><a href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php esc_html_e( 'Home', 'peptide-starter' ); ?></a></li>
-		<li class="menu-item-has-children">
-			<a href="#"><?php esc_html_e( 'Tools', 'peptide-starter' ); ?></a>
-			<ul class="sub-menu">
-				<li><a href="<?php echo esc_url( home_url( '/calculator' ) ); ?>"><?php esc_html_e( 'Calculator', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/protocol-builder' ) ); ?>"><?php esc_html_e( 'Protocol Builder', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/tracker' ) ); ?>"><?php esc_html_e( 'Tracker', 'peptide-starter' ); ?></a></li>
-			</ul>
-		</li>
-		<li class="menu-item-has-children">
-			<a href="#"><?php esc_html_e( 'My Data', 'peptide-starter' ); ?></a>
-			<ul class="sub-menu">
-				<li><a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>"><?php esc_html_e( 'Peptides', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/subject-log' ) ); ?>"><?php esc_html_e( 'Subject Log', 'peptide-starter' ); ?></a></li>
-			</ul>
-		</li>
-		<li class="menu-item-has-children">
-			<a href="#"><?php esc_html_e( 'Resources', 'peptide-starter' ); ?></a>
-			<ul class="sub-menu">
-				<li><a href="<?php echo esc_url( home_url( '/documentation' ) ); ?>"><?php esc_html_e( 'Documentation', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/news' ) ); ?>"><?php esc_html_e( 'Science Feed', 'peptide-starter' ); ?></a></li>
-			</ul>
-		</li>
-	</ul>
-	<?php
-}

package-lock.json

@@ -1,13 +0,0 @@
-{
-  "name": "peptide-starter-theme",
-  "version": "2.3.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "peptide-starter-theme",
-      "version": "2.3.0",
-      "license": "GPL-2.0-or-later"
-    }
-  }
-}

package.json

@@ -1,10 +0,0 @@
-{
-  "name": "peptide-starter-theme",
-  "version": "2.3.0",
-  "description": "WordPress theme for peptiderepo.com",
-  "private": true,
-  "scripts": {
-    "lint": "find assets/js -name '*.js' -print0 | xargs -0 -I{} node --check {}"
-  },
-  "license": "GPL-2.0-or-later"
-}

style.css

@@ -4,7 +4,7 @@ Theme URI: https://github.com/peptiderepo/peptide-starter
 Description: Premium, accessible WordPress theme for scientific peptide reference database
 Author: Peptide Repo
 Author URI: https://peptiderepo.com
-Version: 2.3.0
+Version: 2.2.1
 License: GPL v2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 Text Domain: peptide-starter

template-parts/module-cards.php

@@ -2,7 +2,7 @@
 /**
  * Template Part: Research Module Cards
  *
- * Renders a 5-card grid of research modules (tools/sections) for the front page.
+ * Renders a 6-card grid of research modules (tools/sections) for the front page.
  * Each card checks if the target plugin is active; inactive cards are dimmed.
  * Cards with 'coming_soon' => true display a "Coming soon" badge overlaid in
  * the top-right corner — layered on top of the --inactive visual treatment.
@@ -58,6 +58,14 @@ $modules = array(
 		'available'   => shortcode_exists( 'peptide_tracker' ),
 		'coming_soon' => true,
 	),
+	array(
+		'title'       => __( 'Science Feed', 'peptide-starter' ),
+		'description' => __( 'What\'s new in peptide research. Filtered for what matters, weekly.', 'peptide-starter' ),
+		'url'         => '/news',
+		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 22h16a2 2 0 002-2V4a2 2 0 00-2-2H8a2 2 0 00-2 2v16a2 2 0 01-2 2zm0 0a2 2 0 01-2-2v-9c0-1.1.9-2 2-2h2"/><line x1="10" y1="6" x2="18" y2="6"/><line x1="10" y1="10" x2="18" y2="10"/><line x1="10" y1="14" x2="14" y2="14"/></svg>',
+		'available'   => shortcode_exists( 'peptide_news' ),
+		'coming_soon' => false,
+	),
 	array(
 		'title'       => __( 'Subject Log', 'peptide-starter' ),
 		'description' => __( 'Track outcomes over time. Subjective markers, lab results, protocol changes — your own data, kept private.', 'peptide-starter' ),
@@ -101,4 +109,3 @@ $modules = array(
 		</div>
 	</div>
 </section>
-