ci: add permissions: write + secrets:inherit to deploy.yml

The deploy.yml was missing a permissions: block, which means GitHub defaults
to read-only access for public repos. This prevents the nested reusable ci.yml
(permissions: contents: write) from starting, causing startup_failure.

Also adds secrets: inherit to the ci: job so secrets flow through the
reusable workflow chain.

Agent-Session: fix-e2e-ref-20260617

.github/workflows/ci.yml

@@ -1,112 +1,24 @@
-name: CI — Lint & Test
-
-# Runs on every PR and every push to main.
-# Three jobs in parallel:
-#   1. PHP Lint — syntax check across supported PHP versions
-#   2. PHPCS — WordPress coding standards (non-blocking during theme rollout)
-#   3. PHPUnit — runs the theme's test suite against the WordPress test framework
+name: CI
 
+# Thin caller — delegates all jobs to the shared reusable workflow.
+# Must include workflow_call so deploy.yml can gate on this workflow.
 on:
+  pull_request: {}
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_call: {}
 
+# Required by the reusable phpcs job which commits phpcbf auto-fixes back
+# to the PR branch. GitHub enforces that callers declare at least the same
+# permissions as any job-level override in the called workflow.
 permissions:
-  contents: read
+  contents: write
 
 jobs:
-  php-lint:
-    name: PHP Lint (${{ matrix.php }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        php: ['7.4', '8.1', '8.3']
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          coverage: none
-      - name: Syntax check all PHP files
-        run: |
-          set -e
-          find . -name '*.php' \
-            -not -path './vendor/*' \
-            -not -path './node_modules/*' \
-            -not -path './.git/*' \
-            -print0 | xargs -0 -n1 -P4 php -l > /dev/null
-
-  phpcs:
-    name: PHPCS (WordPress standards)
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.1'
-          coverage: none
-          tools: composer:v2
-      - name: Install dependencies
-        run: composer install --no-progress --no-interaction --prefer-dist
-      - name: Run PHPCS
-        run: vendor/bin/phpcs --standard=.phpcs.xml.dist
-
-  phpunit:
-    name: PHPUnit (PHP ${{ matrix.php }}, WP ${{ matrix.wp }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        php: ['8.1']
-        wp: ['latest']
-    services:
-      mysql:
-        image: mysql:8.0
-        env:
-          MYSQL_ROOT_PASSWORD: root
-          MYSQL_DATABASE: wp_tests
-        ports:
-          - 3306:3306
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=5
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install subversion
-        # ubuntu-latest no longer ships svn preinstalled. The WP test suite
-        # bootstrap script checks out develop.svn.wordpress.org via svn.
-        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
-      - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          coverage: none
-          tools: composer:v2
-          extensions: mysqli
-      - name: Install composer dependencies
-        run: composer install --no-progress --no-interaction --prefer-dist
-      - name: Wait for MySQL
-        run: |
-          for i in {1..30}; do
-            if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
-              echo "MySQL is up"; break
-            fi
-            echo "Waiting for MySQL..."; sleep 2
-          done
-      - name: Install WordPress test suite
-        env:
-          WP_TESTS_DIR: /tmp/wordpress-tests-lib
-          # Trailing slash matters: the bootstrap config substitutes this verbatim into ABSPATH,
-          # then concatenates 'wp-settings.php'. Without the slash you get '/tmp/wordpresswp-settings.php'.
-          WP_CORE_DIR: /tmp/wordpress/
-        run: |
-          chmod +x bin/install-wp-tests.sh
-          # 6th arg = skip-database-creation: the MySQL service already created wp_tests via MYSQL_DATABASE env.
-          bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 ${{ matrix.wp }} true
-      - name: Run PHPUnit
-        env:
-          WP_TESTS_DIR: /tmp/wordpress-tests-lib
-        run: vendor/bin/phpunit --colors=always
+  ci:
+    uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
+    with:
+      tests: wp-framework
+      has_js: true
+      line_limit_paths: inc
+    secrets: inherit

.github/workflows/cto-review.yml

@@ -1,20 +1,17 @@
 name: CTO Review
 
-# Automated PR review powered by Claude + DeepSeek + Kimi (via OpenRouter)
-# plus Neurometric PR-Summarizer (a Qwen3-4B task-specialist SLM).
+# Automated PR review powered by Claude Haiku (via OpenRouter).
 #
-# During the A/B window (until further notice), every PR gets reviewed by FOUR models
-# in parallel. The PR comment shows each model's verdict side-by-side so we can compare
-# quality/cost on real PRs before picking a permanent default.
+# A/B panel decision 2026-06-12: panel dropped to Haiku-only.
+# Evidence: convo/cto/threads/2026-06-qa-ab-review/02-analyst-findings.md
+# DeepSeek: high false-positive rate (absint()="code exec", PLUGIN_DIR="dir traversal").
+# Kimi: ~60% model failure rate across 13 PRs sampled.
+# Neurometric: summarizer only, zero unique-real findings, unreliable heuristic verdict.
+# Haiku: 0 failures, lowest noise, equivalent real-signal catch rate vs 4-voice panel.
 #
-# Neurometric is a "prose voice": it does not support OpenAI tool-calling, so its
-# contribution is raw markdown + a heuristic verdict. It is never the primary voice.
+# Does NOT merge. Posts formal APPROVE/REQUEST_CHANGES/COMMENT reviews.
 #
-# Does NOT merge. Does NOT post formal APPROVE/REQUEST_CHANGES reviews — always COMMENT
-# (GITHUB_TOKEN can't formally approve PRs without repo-setting toggle).
-#
-# Requires repo secrets: OPENROUTER_API_KEY, NEUROMETRIC_API_KEY (optional; the
-# Neurometric voice self-skips with an inline error note if the key is missing).
+# Requires repo secret: OPENROUTER_API_KEY
 #
 # Cost cap: tracked in Repository Variables (CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS).
 # Default cap is 1000 cents ($10/month). Auto-resets on the 1st of each month.
@@ -123,17 +120,18 @@ jobs:
           git fetch origin ${{ github.event.pull_request.base.ref }} --depth=50
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-          DIFF=$(git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000)
+          # Write the diff to a file, not a step output / env var. Passing a
+          # ~400KB diff through the process env (execve argv+envp) exceeds the
+          # runner ARG_MAX and fails the next step with "Argument list too long".
+          # File transport also sidesteps the ~1MB step-output cap.
+          git diff --no-color "$BASE_SHA" "$HEAD_SHA" | head -c 400000 > /tmp/cto-review-diff.txt
           FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
-          SIZE=$(echo -n "$DIFF" | wc -c)
+          SIZE=$(wc -c < /tmp/cto-review-diff.txt)
           {
             echo "size=$SIZE"
             echo "files<<EOF_FILES"
             echo "$FILES"
             echo "EOF_FILES"
-            echo "diff<<EOF_DIFF"
-            echo "$DIFF"
-            echo "EOF_DIFF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Load repo conventions
@@ -150,18 +148,17 @@ jobs:
             echo "EOF_CONV"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Call 4 models in parallel (OpenRouter + Neurometric)
+      - name: Call Haiku via OpenRouter
         if: steps.budget.outputs.skip != 'true'
         id: review
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          NEUROMETRIC_API_KEY: ${{ secrets.NEUROMETRIC_API_KEY }}
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO_NAME: ${{ github.event.repository.name }}
-          DIFF: ${{ steps.diff.outputs.diff }}
+          DIFF_PATH: /tmp/cto-review-diff.txt
           DIFF_SIZE: ${{ steps.diff.outputs.size }}
           CHANGED_FILES: ${{ steps.diff.outputs.files }}
           CONVENTIONS: ${{ steps.conventions.outputs.content }}
@@ -183,24 +180,17 @@ jobs:
           fi
 
           python3 - <<'PY'
-          import json, os, sys, urllib.request, concurrent.futures
+          import json, os, sys, urllib.request
 
           api_key = os.environ["OPENROUTER_API_KEY"]
 
-          # A/B harness: four models. Each gets the same prompt.
-          # Primary model's verdict drives the heading. Others are labeled.
-          # Edit this list to change the roster (or drop to 1 after A/B window closes).
-          #
-          # provider_type semantics:
-          #   - "openrouter_tools": OpenAI tool-calling via OpenRouter; structured verdict.
-          #   - "neurometric_prose": Neurometric marketplace SLM; prose output + heuristic verdict.
-          MODELS = [
-              # (slug, display name, input_per_M_USD, output_per_M_USD, is_primary, provider_type)
-              ("anthropic/claude-haiku-4.5",       "Claude Haiku 4.5",                     1.00, 5.00, True,  "openrouter_tools"),
-              ("deepseek/deepseek-chat-v3.1",      "DeepSeek V3.1",                        0.15, 0.75, False, "openrouter_tools"),
-              ("moonshotai/kimi-k2-thinking",      "Kimi K2 Thinking",                     0.60, 2.50, False, "openrouter_tools"),
-              ("neurometric/pr-summarizer",        "Neurometric PR-Summarizer (Qwen3-4B)", 0.00, 0.00, False, "neurometric_prose"),
-          ]
+          # Haiku-only reviewer. A/B panel dropped 2026-06-12 per QA data:
+          # DeepSeek high false-positive rate, Kimi ~60% failure rate,
+          # Neurometric zero unique-real findings. Haiku retained as sole voice.
+          MODEL_SLUG = "anthropic/claude-haiku-4.5"
+          MODEL_DISPLAY = "Claude Haiku 4.5"
+          INPUT_PER_M_USD = 1.00
+          OUTPUT_PER_M_USD = 5.00
 
           system = """You are the CTO and lead reviewer for the peptiderepo project. You are reviewing a pull request opened by an autonomous agent or human contributor.
 
@@ -208,7 +198,8 @@ jobs:
           1. Assess whether the change is safe to merge and deploy to production (peptiderepo.com on Hostinger WordPress).
           2. Flag security issues, cost traps (paid AI API usage), performance regressions, missing input sanitization, missing output escaping, hardcoded secrets, broken migrations, or violations of the repo's CONVENTIONS.md.
           3. Check that the PR follows the project's git workflow: branch naming (claude/<scope>-<date>), Agent-Session trailer in commits, PR description covers what/why/risk/test-plan.
-          4. Be concise and direct. No pleasantries. Call out concrete line-level issues when possible.
+          4. CTO app-map freshness. If this PR modifies any of: (a) the admin settings surface (register_setting, add_submenu_page, add_options_page, settings field labels, option keys, types, defaults); (b) the file/class structure (any file added, renamed, split per the 300-line rule, or materially restructured); or (c) the data flow (new external API client, new hook/filter fired publicly, new scheduled job, or changed class responsibilities) — then the PR description MUST include a line referencing an accompanying update to `Peptide Repo CTO/app-maps/<repo-slug>.md`. The CTO workspace is a separate repo, so CI cannot verify the doc update mechanically — you must inspect the PR description for an explicit mention. If the description is silent despite a triggering change, raise this as a MAJOR concern (not blocking) so the author can add the mention or open a follow-up PR on the CTO workspace.
+          5. Be concise and direct. No pleasantries. Call out concrete line-level issues when possible.
 
           You MUST respond by calling the submit_review function. Do not write prose outside the tool call.
 
@@ -228,7 +219,9 @@ jobs:
           user_blocks.append(f"**Changed files:**\n```\n{os.environ['CHANGED_FILES']}\n```\n")
           if os.environ.get("CONVENTIONS", "").strip():
               user_blocks.append(f"# Repo CONVENTIONS.md\n{os.environ['CONVENTIONS']}\n")
-          user_blocks.append(f"# Diff\n```diff\n{os.environ['DIFF']}\n```\n")
+          with open(os.environ["DIFF_PATH"], encoding="utf-8", errors="replace") as _df:
+              _diff_text = _df.read()
+          user_blocks.append(f"# Diff\n```diff\n{_diff_text}\n```\n")
           user_message = "\n\n".join(user_blocks)
 
           tools = [{
@@ -260,218 +253,100 @@ jobs:
               }
           }]
 
-          PER_MODEL_TIMEOUT = 60  # seconds; one hung model should not block siblings
+          body = {
+              "model": MODEL_SLUG,
+              "max_tokens": 2048,
+              "messages": [
+                  {"role": "system", "content": system},
+                  {"role": "user", "content": user_message}
+              ],
+              "tools": tools,
+              "tool_choice": {"type": "function", "function": {"name": "submit_review"}}
+          }
+          req = urllib.request.Request(
+              "https://openrouter.ai/api/v1/chat/completions",
+              data=json.dumps(body).encode(),
+              headers={
+                  "Authorization": f"Bearer {api_key}",
+                  "content-type": "application/json",
+                  "HTTP-Referer": "https://github.com/peptiderepo",
+                  "X-Title": f"peptiderepo CTO reviewer ({MODEL_DISPLAY})"
+              },
+              method="POST"
+          )
 
-          # Heuristic verdict inference for prose-voice models that can't do tool-calling.
-          # Keyword order matters: block markers beat approve markers.
-          PROSE_BLOCK_MARKERS = [
-              "do not merge", "do not approve", "should not be merged", "reject this",
-              "critical security", "critical issue", "critical vulnerability",
-              "blocker", "blocking issue", "request_changes", "request changes",
-              "**critical**", "sql injection", "must be addressed before",
-          ]
-          PROSE_APPROVE_MARKERS = [
-              "safe to merge", "ready to merge", "no blocking issues", "lgtm",
-              "approve this", "looks good to merge", "no concerns",
-          ]
+          error = None
+          review = None
+          cost_cents = 0.0
+          ptok = 0
+          ctok = 0
 
-          def infer_verdict_from_prose(text):
-              t = (text or "").lower()
-              if any(m in t for m in PROSE_BLOCK_MARKERS):
-                  return "REQUEST_CHANGES"
-              if any(m in t for m in PROSE_APPROVE_MARKERS):
-                  return "APPROVE"
-              return "COMMENT"
-
-          def call_openrouter_tools(slug, display, in_rate, out_rate, is_primary):
-              body = {
-                  "model": slug,
-                  "max_tokens": 2048,
-                  "messages": [
-                      {"role": "system", "content": system},
-                      {"role": "user", "content": user_message}
-                  ],
-                  "tools": tools,
-                  "tool_choice": {"type": "function", "function": {"name": "submit_review"}}
-              }
-              req = urllib.request.Request(
-                  "https://openrouter.ai/api/v1/chat/completions",
-                  data=json.dumps(body).encode(),
-                  headers={
-                      "Authorization": f"Bearer {api_key}",
-                      "content-type": "application/json",
-                      "HTTP-Referer": "https://github.com/peptiderepo",
-                      "X-Title": f"peptiderepo CTO reviewer ({display})"
-                  },
-                  method="POST"
-              )
-              try:
-                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
-                      data = json.loads(resp.read())
-              except Exception as e:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "openrouter_tools",
-                      "error": str(e)[:300],
-                      "cost_cents": 0,
-                  }
+          try:
+              with urllib.request.urlopen(req, timeout=60) as resp:
+                  data = json.loads(resp.read())
+          except Exception as e:
+              error = str(e)[:300]
+              data = {}
 
+          if not error:
               choice = data.get("choices", [{}])[0].get("message", {})
               tool_calls = choice.get("tool_calls", [])
               if not tool_calls:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "openrouter_tools",
-                      "error": f"No tool_call in response. Raw content: {str(choice)[:300]}",
-                      "cost_cents": 0,
-                  }
+                  error = f"No tool_call in response. Raw content: {str(choice)[:300]}"
+              else:
+                  try:
+                      review = json.loads(tool_calls[0]["function"]["arguments"])
+                  except Exception as e:
+                      error = f"Malformed tool args: {e}"
 
-              try:
-                  review = json.loads(tool_calls[0]["function"]["arguments"])
-              except Exception as e:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "openrouter_tools",
-                      "error": f"Malformed tool args: {e}",
-                      "cost_cents": 0,
-                  }
+              if not error:
+                  usage = data.get("usage", {})
+                  ptok = usage.get("prompt_tokens", 0)
+                  ctok = usage.get("completion_tokens", 0)
+                  cost_usd = (ptok * INPUT_PER_M_USD / 1_000_000) + (ctok * OUTPUT_PER_M_USD / 1_000_000)
+                  cost_cents = cost_usd * 100
 
-              usage = data.get("usage", {})
-              ptok = usage.get("prompt_tokens", 0)
-              ctok = usage.get("completion_tokens", 0)
-              cost_usd = (ptok * in_rate / 1_000_000) + (ctok * out_rate / 1_000_000)
-              cost_cents = cost_usd * 100
-              return {
-                  "slug": slug, "display": display, "is_primary": is_primary,
-                  "provider_type": "openrouter_tools",
-                  "review": review, "prompt_tokens": ptok, "completion_tokens": ctok,
-                  "cost_cents": cost_cents,
-              }
-
-          def call_neurometric_prose(slug, display, is_primary):
-              nm_key = os.environ.get("NEUROMETRIC_API_KEY", "")
-              if not nm_key:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "neurometric_prose",
-                      "error": "NEUROMETRIC_API_KEY secret not set on this repo",
-                      "cost_cents": 0,
-                  }
-              body = {
-                  "model": slug,
-                  "max_tokens": 2048,
-                  "messages": [
-                      {"role": "system", "content": system},
-                      {"role": "user", "content": user_message},
-                  ],
-              }
-              req = urllib.request.Request(
-                  "https://api.neurometric.ai/v1/chat/completions",
-                  data=json.dumps(body).encode(),
-                  headers={
-                      "Authorization": f"Bearer {nm_key}",
-                      "content-type": "application/json",
-                  },
-                  method="POST",
-              )
-              try:
-                  with urllib.request.urlopen(req, timeout=PER_MODEL_TIMEOUT) as resp:
-                      data = json.loads(resp.read())
-              except Exception as e:
-                  return {
-                      "slug": slug, "display": display, "is_primary": is_primary,
-                      "provider_type": "neurometric_prose",
-                      "error": str(e)[:300],
-                      "cost_cents": 0,
-                  }
-              prose = data.get("choices", [{}])[0].get("message", {}).get("content") or ""
-              verdict = infer_verdict_from_prose(prose)
-              return {
-                  "slug": slug, "display": display, "is_primary": is_primary,
-                  "provider_type": "neurometric_prose",
-                  "review": {"verdict": verdict, "prose": prose},
-                  "prompt_tokens": 0, "completion_tokens": 0,
-                  "cost_cents": 0,
-              }
-
-          def call_model(slug, display, in_rate, out_rate, is_primary, provider_type="openrouter_tools"):
-              if provider_type == "neurometric_prose":
-                  return call_neurometric_prose(slug, display, is_primary)
-              return call_openrouter_tools(slug, display, in_rate, out_rate, is_primary)
-
-          results = []
-          with concurrent.futures.ThreadPoolExecutor(max_workers=len(MODELS)) as pool:
-              futures = [pool.submit(call_model, *m) for m in MODELS]
-              for f in concurrent.futures.as_completed(futures):
-                  results.append(f.result())
-
-          # Order: primary first, then alphabetical for stable comparison
-          results.sort(key=lambda r: (not r.get("is_primary"), r["display"]))
-
-          # Build combined comment
-          primary = next((r for r in results if r.get("is_primary") and "review" in r), None)
-          heading_verdict = primary["review"]["verdict"] if primary else "MIXED"
-
-          lines = [f"## CTO Review — {heading_verdict}", ""]
-          lines.append(f"_A/B harness active: {len(results)} models reviewing in parallel. Primary verdict drives heading; others are advisory._")
-          lines.append("")
-
-          total_cents = 0.0
-          for r in results:
-              lines.append(f"---")
-              primary_tag = " (primary)" if r.get("is_primary") else ""
-              lines.append(f"### {r['display']}{primary_tag}")
-              if "error" in r:
-                  lines.append("")
-                  lines.append(f"⚠️ Model failed: `{r['error']}`")
-                  lines.append("")
-                  continue
-              rev = r["review"]
+          # Build comment
+          if error:
+              heading_verdict = "ERROR"
+              lines = [f"## CTO Review — {heading_verdict}", ""]
+              lines.append(f"Model failed: `{error}`")
               lines.append("")
-              if r.get("provider_type") == "neurometric_prose":
-                  lines.append(f"**Verdict:** {rev['verdict']} _(heuristic, inferred from prose)_")
-                  lines.append("")
-                  # Cap at 6KB to keep PR comments readable; 4B model output is rarely over this
-                  prose = rev.get("prose", "")
-                  if len(prose) > 6000:
-                      prose = prose[:6000] + "\n\n_…output truncated for comment length…_"
-                  lines.append(prose)
-                  lines.append("")
-                  lines.append("_free tier; per-call token usage not tracked_")
-                  lines.append("")
-                  continue
-              lines.append(f"**Verdict:** {rev.get('verdict', 'COMMENT')}")
+              lines.append(f"_reviewer: {MODEL_DISPLAY}_")
+          else:
+              heading_verdict = review.get("verdict", "COMMENT")
+              lines = [f"## CTO Review — {heading_verdict}", ""]
+              lines.append(f"**Verdict:** {heading_verdict}")
               lines.append("")
-              lines.append(rev.get("summary") or "_(model returned no summary)_")
+              lines.append(review.get("summary") or "_(model returned no summary)_")
               lines.append("")
-              if rev.get("concerns"):
+              if review.get("concerns"):
                   lines.append("**Concerns:**")
-                  for c in rev["concerns"]:
-                      sev = c["severity"].upper()
+                  for c in review["concerns"]:
+                      sev = c.get("severity", "UNKNOWN").upper()
                       f = f"`{c['file']}`" if c.get("file") else ""
                       lines.append(f"- **{sev}** {f} — {c['issue']}")
                   lines.append("")
-              if rev.get("positives"):
-                  lines.append("**Positives:** " + "; ".join(rev["positives"]))
+              if review.get("positives"):
+                  lines.append("**Positives:** " + "; ".join(review["positives"]))
                   lines.append("")
-              lines.append(f"_tokens in/out: {r['prompt_tokens']}/{r['completion_tokens']} · cost: ${r['cost_cents']/100:.4f}_")
-              total_cents += r["cost_cents"]
+              lines.append(f"_tokens in/out: {ptok}/{ctok} · cost: ${cost_cents/100:.4f}_")
               lines.append("")
 
           lines.append("---")
-          lines.append(f"_Total review cost: **${total_cents/100:.4f}**. A/B roster configured in `.github/workflows/cto-review.yml`._")
+          lines.append(f"_Total review cost: **${cost_cents/100:.4f}**. Reviewer: {MODEL_DISPLAY}. Roster configured in `.github/workflows/cto-review.yml`._")
 
           with open("/tmp/review-body.md", "w") as f:
               f.write("\n".join(lines))
           with open(os.environ["GITHUB_OUTPUT"], "a") as f:
-              f.write(f"added_cents={int(round(total_cents))}\n")
+              f.write(f"added_cents={int(round(cost_cents))}\n")
               f.write(f"skipped=0\n")
               f.write(f"primary_verdict={heading_verdict}\n")
           PY
 
       - name: Post PR review (formal APPROVE / REQUEST_CHANGES / COMMENT)
-        # Uses primary model's verdict as the formal event. Falls back to COMMENT
-        # if the primary model failed or returned something unexpected.
+        # Uses Haiku's verdict as the formal event. Falls back to COMMENT
+        # if the model failed or returned something unexpected.
         if: steps.budget.outputs.skip != 'true' && steps.review.outputs.skipped != '1'
         uses: actions/github-script@v7
         env:

.github/workflows/deploy.yml

@@ -4,97 +4,26 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: write
+
+concurrency:
+  group: deploy-peptide-starter-theme
+  cancel-in-progress: true
+
 jobs:
-  validate:
-    name: Validate PHP & JS
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: PHP Lint Check
-        run: |
-          find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
-          test ${PIPESTATUS[0]} -eq 0
-
-      - name: Install PHPCS with WordPress standards
-        run: |
-          composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
-          composer global require --dev squizlabs/php_codesniffer:"^3.0" wp-coding-standards/wpcs:"^3.0" phpcsstandards/phpcsutils:"^1.0"
-
-      - name: Run PHPCS (WordPress Core)
-        run: |
-          ~/.composer/vendor/bin/phpcs -s .
-
-      - name: JS Syntax Check
-        run: |
-          find assets/js -name "*.js" -exec node --check {} \;
+  # Gate deploy on the reusable CI (lint-php, phpcs, phpunit, file-size, lint-js).
+  # ci.yml exposes workflow_call so it can be used here without re-running a
+  # separate workflow — the call result satisfies the branch-protection context
+  # "ci / ci (lint-php (8.1))" etc.
+  ci:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
 
   deploy:
-    needs: validate
-    name: Deploy to Production
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          # Best-effort: keyscan stderr captured for diagnosis but never fatal.
-          # We use StrictHostKeyChecking=no on the actual ssh/rsync calls anyway.
-          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/tmp/keyscan.err || {
-            echo "::warning::ssh-keyscan failed (non-fatal). stderr:"
-            cat /tmp/keyscan.err || true
-          }
-
-      - name: Deploy via rsync
-        run: |
-          rsync -avz --delete \
-            --exclude='.git' \
-            --exclude='.github' \
-            --exclude='tests/' \
-            --exclude='phpunit.xml' \
-            --exclude='composer.json' \
-            --exclude='composer.lock' \
-            --exclude='vendor/' \
-            --exclude='node_modules/' \
-            --exclude='.phpcs.xml.dist' \
-            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no" \
-            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/
-
-      - name: Purge LiteSpeed Cache
-        run: |
-          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no \
-            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
-            CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
-            if [ -d "$CACHE_DIR" ]; then
-              rm -rf "$CACHE_DIR"/*
-              echo "LiteSpeed cache purged."
-            fi
-            touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
-            echo "Cache purge signal sent."
-          ENDSSH
-
-      - name: Cleanup
-        if: always()
-        run: rm -f ~/.ssh/deploy_key
-
-      - name: Health check
-        run: |
-          sleep 5
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
-          # 200 = normal healthy response.
-          # 403 = peptide-starter-theme v1.5.2 CF-peer validator rejecting this
-          #       GHA-runner direct-to-origin request as non-Cloudflare traffic.
-          #       That rejection is the validator working — itself a positive
-          #       liveness signal. Real user traffic via Cloudflare gets 200.
-          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
-            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
-            exit 1
-          fi
-          echo "Site is responsive (HTTP $STATUS)"
+    name: Deploy (shared pipeline)
+    needs: ci
+    uses: peptide-repo/peptide-e2e/.github/workflows/deploy-app.yml@main
+    with:
+      target_path: wp-content/themes/peptide-starter
+    secrets: inherit

.github/workflows/main-push-audit.yml

@@ -29,12 +29,22 @@ jobs:
         with:
           script: |
             const sha = context.sha;
-            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              commit_sha: sha,
-            });
-            const merged = prs.find(p => p.merged_at);
+            // Squash-merge -> PR association is eventually-consistent; poll briefly
+            // before concluding this was a direct push (avoids false positives on merges).
+            async function findMergedPR() {
+              for (let attempt = 1; attempt <= 5; attempt++) {
+                const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  commit_sha: sha,
+                });
+                const m = prs.find(p => p.merged_at);
+                if (m) return m;
+                if (attempt < 5) await new Promise(r => setTimeout(r, 10000));
+              }
+              return null;
+            }
+            const merged = await findMergedPR();
             if (merged) {
               core.info(`OK: commit ${sha.substring(0,7)} came from PR #${merged.number}`);
               return;

ARCHITECTURE.md

@@ -47,6 +47,8 @@ peptide-starter/
 │   ├── newsletter-admin.php       # Subscriber viewer + CSV-safe export +
 │   │                               # /newsletter-unsubscribe route.
 │   ├── mail-diagnostic.php        # [v1.5.1] Tools → Mail Test — wp_mail probe.
+│   ├── perf-asset-policy.php      # [v1.6.0] Mobile perf: dequeue + font slim
+│   │                               # + preconnect + defer.
 │   └── page-setup.php             # Auto-create pages on activation +
 │                                    # v1.5.0 user migration (enrol into verify).
 │
@@ -265,7 +267,7 @@ for out-of-band updates.
 
 ## Version
 
-**Current:** v1.5.2 (2026-04-14)
+**Current:** v1.6.0 (2026-04-23)
 
 Bump `style.css` header line 7 and `PEPTIDE_STARTER_VERSION` in
 `functions.php` together on release.

CHANGELOG.md

@@ -1,7 +1,168 @@
 # Peptide Starter Theme - Changelog
 
+## [2.3.0] - 2026-06-16 — Adopt estate CI standard
+
+### Changed
+
+- `.github/workflows/ci.yml`: Replaced per-repo CI jobs with a thin caller
+  delegating to `peptiderepo/peptide-e2e/.github/workflows/ci.yml@main`
+  (`tests: wp-framework`, `has_js: true`, `line_limit_paths: inc`). Added
+  `workflow_call` trigger so `deploy.yml` can gate on this workflow.
+- `.github/workflows/deploy.yml`: Retired standalone `validate` job; deploy
+  now gates on the reusable CI via `uses: ./.github/workflows/ci.yml`.
+- `composer.json`: `test` script now calls `vendor/bin/phpunit` explicitly
+  (was bare `phpunit`).
+- `inc/helpers.php`: Split 311-line file at the nav-walker boundary; reduced
+  to 211 lines.
+
+### Added
+
+- `inc/nav-walker.php`: `Peptide_Starter_Nav_Walker` class and
+  `peptide_starter_primary_menu_fallback()` extracted from `inc/helpers.php`
+  (123 lines). Loaded in `functions.php` before `helpers.php`.
+- `package.json` / `package-lock.json`: Minimal npm manifest so the reusable
+  `lint-js` job can run `npm ci` and then execute `npm run lint` (which runs
+  `node --check` on `assets/js/**/*.js`).
+
+
+## [2.2.2] - 2026-04-29 — Front page layout restructure
+
+### Changed
+
+- `template-parts/module-cards.php`: Removed Science Feed from the module card
+  grid. The grid is for interactive tools only; news is content. Grid is now
+  5 cards: Peptides, Calculator, Protocol Builder, Tracker, Subject Log. No card
+  in this set goes inactive-dimmed due to a plugin registration check.
+- `front-page.php`: Replaced the full `[peptide_news]` inline feed with a
+  3-item teaser row (`[peptide_news count="3"]`) and a "View all research →"
+  CTA linking to `/news`. Reduces page weight and drives traffic to the
+  dedicated news page.
+
+## [2.2.1] - 2026-04-29 — RCT inline abbreviation tooltip
+
+### Added
+
+- `.pr-abbr` tap-target on the term "RCT" in the Established verdict card on
+  the verdict legend strip (homepage). Tapping/clicking opens a small inline
+  popover with the full definition: "Randomized Controlled Trial — the gold
+  standard for clinical evidence." Closes on outside click, Escape key, or
+  focus leaving the element.
+- `assets/js/abbr-tooltip.js` — new JS module (~130 lines) for popover open/
+  close, outside-click dismissal, keyboard accessibility (Enter/Space/Escape),
+  and ARIA attributes (`aria-expanded`, `aria-describedby`, `role="tooltip"`).
+  Enqueued on front page only (`is_front_page()`).
+- `peptide_starter_render_desc( string $text, array $abbrs ): string` helper in
+  `inc/verdict-helpers.php`. Builds safe HTML from `esc_html`/`esc_attr`
+  components; verdict taxonomy items carry an optional `abbrs` map.
+- `.pr-abbr` and `.pr-abbr-popover` CSS in `style.css` — dashed underline
+  affordance, fade-in animation, dark-mode-safe surface variables.
+
+### Fixed
+
+- `PEPTIDE_STARTER_VERSION` constant in `functions.php` was stale at
+  `2.0.0-alpha.3`; realigned to `2.2.1` to match `style.css` Version header.
+
+## [2.1.8] - 2026-04-28 — Homepage verdict section spacing fix
+
+### Fixed
+
+- Added missing CSS for `hero-featured-verdicts`, `hero-verdict-card`, and
+  `hero-verdict-explainer` BEM classes used in `front-page.php`. These classes
+  were referenced in the template but had zero CSS rules, causing the Featured
+  Verdicts section to render with bare browser defaults (no grid layout, no card
+  padding, no visual separation between verdict entries).
+- Added responsive 3-column grid for verdict cards at ≥900px breakpoint.
+- Added 5-column grid for verdict explainer items at ≥900px, 3-column at ≥640px.
+- Verdict card left-border now tints to match verdict state via CSS `:has()`.
+
+
 All notable changes to the Peptide Starter Theme are documented in this file.
 
+## [2.1.7] - 2026-04-27 — Newsletter signup infrastructure (Beehiiv)
+
+### Added
+
+- `page-subscribe.php` — single-column conversion template for `/subscribe/` landing page.
+  No sticky ToC; signup-form-centric layout.
+- `single-peptide.php` — compact Beehiiv signup block inserted after monograph article,
+  before prev/next navigation. Copy: "Want updates on monographs like this? One email a
+  week, no spam." Form ID: `6edcd482-cbea-4767-8777-97ac17d6d609`.
+- `footer.php` column 1 — "Get our weekly digest →" link to `/subscribe/` below brand blurb.
+- `functions.php` — `peptide_starter_enqueue_beehiiv_attribution()` loads Beehiiv's
+  `attribution.js` site-wide (footer, async) for UTM source capture across all placements.
+
+### Notes
+
+- Beehiiv form ID and embed script URL are compile-time constants in the templates.
+  If the form ID changes, update `single-peptide.php` and `page-subscribe.php`.
+- `single-repo_daily.php` and `archive-repo_daily.php` signup placements deferred to
+  the Repo Daily sprint (templates don't exist yet).
+- Sender: `repo-weekly@mail.peptiderepo.com`. DNS records (SPF/DKIM/DMARC for
+  `mail.peptiderepo.com`) to be added by Terence in Cloudflare when Beehiiv
+  sending-domain verification runs.
+
+## [2.1.6] - 2026-04-27 — Our Methodology page template + footer link
+
+### Added
+
+- `page-our-methodology.php` — two-column ToC template for the `/our-methodology/`
+  editorial-standards page. Mirrors `page-how-we-review.php` layout; CSS classes
+  use `page-our-methodology` prefix. The `#last-verified` anchor on this page is the
+  deep-link target for Phase 2 verdict-card "Last verified" lines.
+- Footer "Our Method" section now includes **Our Methodology** link (`/our-methodology/`)
+  alongside How We Review Peptides and Editorial Standards.
+
+### Notes
+
+- No changes to existing templates, CSS, or JS.
+- `footer.php` also backports the section-5 "Our Method" block from the v2.1.5 brand
+  sprint which was live on the server but not committed to the repo.
+
+## [1.6.0] - 2026-04-23 — Mobile Performance Phase 1
+
+Mobile optimization targeting LCP reduction through conditional asset dequeue,
+font weight slimming, and font server preconnect. Measured baseline LCP on
+Moto G Power (Slow 4G): 5.4s; target: sub-4s after Phase 1 deployment.
+
+### Performance improvements
+
+- **Conditional asset dequeue**: WooCommerce, Elementor, and USMI assets now
+  dequeue on pages that don't use them. Removes ~100KB from non-shop pages.
+- **Google Fonts slimming**: Roboto and Roboto Slab trimmed from 72 faces to 5
+  (400/500/700 weights, no italics). Font CSS shrinks ~6KB → <1KB; woff2 payload
+  reduced ~80%.
+- **Preconnect hints**: `fonts.googleapis.com` and `fonts.gstatic.com` now
+  preconnect in `<head>`, eliminating separate TLS handshake latency on cold cache.
+- **Cookie-notice defer**: Cookie banner script deferred to unblock initial render.
+
+### Technical
+
+- New module `inc/perf-asset-policy.php` (~245 lines, PHPUnit tested).
+- Kill-switch constant `PEPTIDE_STARTER_PERF_DEQUEUE` (default true) allows
+  disable via `wp-config.php` for rollback.
+- All dequeue lists and font weights exposed as filters for customization.
+- Production handle verification: WC (layout/smallscreen/general), Elementor
+  (frontend/frontend-legacy + per-post CSS), USMI (SFSImainCss + 4 scripts).
+
+### Tests
+
+- `test-perf-asset-policy.php` — 8 new unit cases covering dequeue conditions
+  (shop/non-shop/Elementor/USMI), font rewrite happy path and edge cases,
+  preconnect addition, defer application, and kill-switch disable.
+
+### Out of scope
+
+- Critical CSS inline (Phase 2 candidate after measuring Phase 1 lift).
+- jQuery dequeue (WC/PSA/Elementor compat risk too high).
+- Image optimizations (no images on homepage critical path).
+- LiteSpeed Cache settings (CTO tunes post-deploy if Phase 1 insufficient).
+
+### Breaking changes
+
+None. All optimizations are transparent to plugin authors; dequeues use
+standard WordPress APIs and can be overridden via filters or re-enqueued by
+plugins if needed.
+
 ## [1.5.2] - 2026-04-14 — Security
 
 Same-day follow-up to v1.5.1. Closes four issues the v1.5.1 post-merge

CONVENTIONS.md

@@ -129,6 +129,43 @@ do_action( 'peptide_starter_hero_before' );
 - **languages/:** Translation files
 - **template-parts/:** Reusable template parts
 
+## How to add a performance policy rule
+
+When adding a new asset-perf rule (e.g., a new plugin's CSS to dequeue on
+non-relevant pages, or a new font family to slim):
+
+1. **For dequeues:** edit `inc/perf-asset-policy.php`. Add the plugin's
+   handle list to a new function (or extend the existing arrays via the
+   matching filter — `peptide_starter_perf_<plugin>_handles`). Hook the
+   new dequeue function on `wp_enqueue_scripts` priority 100, gated by
+   `PEPTIDE_STARTER_PERF_DEQUEUE` and a context predicate (e.g.,
+   `is_front_page()`, `! is_woocommerce()`).
+
+2. **For font slimming:** add the family to the default array in
+   `peptide_starter_perf_slim_google_fonts()`, or override at runtime
+   via the `peptide_starter_perf_font_weights` filter. Specify only
+   weights actually used by the design system; defaulting to "all weights"
+   defeats the purpose.
+
+3. **For new resource hints:** extend `peptide_starter_perf_resource_hints()`
+   with the new domain in the `preconnect` array. WP renders the
+   `<link>` tag automatically; don't echo your own.
+
+4. **For deferring third-party scripts:** add the script handle to the
+   list in `peptide_starter_perf_defer_cookie_notice()` (or rename the
+   function if it grows beyond cookie-notice).
+
+5. **Always add a test case** in `tests/test-perf-asset-policy.php`
+   covering the new rule's happy path AND its negation (the page-context
+   where the rule must NOT apply). The dequeue logic is silent if a
+   handle name is wrong — only tests catch this before deploy.
+
+6. **Verify on production handles** before committing. Plugin handle
+   names are not always what you'd guess. SSH to Hostinger and run
+   `wp eval 'global $wp_styles; do_action("wp_enqueue_scripts");
+   foreach($wp_styles->registered as $h=>$o){echo $h.PHP_EOL;}'` to
+   dump the actual handle names.
+
 ## Step-by-Step Guides
 
 ### How to Add a New Template
@@ -423,11 +460,6 @@ if ( is_active_sidebar( 'footer-1' ) ) {
 
 ### Class Existence Check
 
-**For WooCommerce:**
-```php
-if ( class_exists( 'WooCommerce' ) ) {
-  // Render cart icon
-}
 ```
 
 **For post types:**

assets/brand/logo-horizontal-on-teal.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 96" role="img" aria-label="Peptide Repo">
+  <rect x="8" y="8" width="80" height="80" rx="16" fill="#FFFFFF"/>
+  <text x="48" y="58" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="38" fill="#1B8A92" letter-spacing="1">PR</text>
+  <circle cx="82" cy="82" r="14" fill="#7FD600"/>
+  <path d="M 76 82 l 4 4 l 8 -8" stroke="#0D0D0D" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <text x="108" y="58" font-family="Poppins, sans-serif" font-weight="700" font-size="30" fill="#FFFFFF" letter-spacing="-0.5">Peptide Repo</text>
+</svg>

assets/brand/logo-horizontal-reverse.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 96" role="img" aria-label="Peptide Repo">
+  <rect x="8" y="8" width="80" height="80" rx="16" fill="#1B8A92"/>
+  <text x="48" y="58" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="38" fill="#FFFFFF" letter-spacing="1">PR</text>
+  <circle cx="82" cy="82" r="14" fill="#7FD600"/>
+  <path d="M 76 82 l 4 4 l 8 -8" stroke="#0D0D0D" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <text x="108" y="58" font-family="Poppins, sans-serif" font-weight="700" font-size="30" fill="#FFFFFF" letter-spacing="-0.5">Peptide Repo</text>
+</svg>

assets/brand/logo-horizontal.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 96" role="img" aria-label="Peptide Repo">
+  <rect x="8" y="8" width="80" height="80" rx="16" fill="#1B8A92"/>
+  <text x="48" y="58" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="38" fill="#FFFFFF" letter-spacing="1">PR</text>
+  <circle cx="82" cy="82" r="14" fill="#7FD600"/>
+  <path d="M 76 82 l 4 4 l 8 -8" stroke="#0D0D0D" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <text x="108" y="58" font-family="Poppins, sans-serif" font-weight="700" font-size="30" fill="#0D0D0D" letter-spacing="-0.5">Peptide Repo</text>
+</svg>

assets/brand/logo-mark-small.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" role="img" aria-label="Peptide Repo">
+  <rect x="0" y="0" width="72" height="72" rx="14" fill="#1B8A92"/>
+  <text x="36" y="52" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="38" fill="#FFFFFF" letter-spacing="0.5">PR</text>
+  <circle cx="66" cy="66" r="13" fill="#7FD600"/>
+</svg>

assets/brand/logo-mark.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" role="img" aria-label="Peptide Repo">
+  <rect x="0" y="0" width="72" height="72" rx="14" fill="#1B8A92"/>
+  <text x="36" y="51" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="34" fill="#FFFFFF" letter-spacing="0.5">PR</text>
+  <circle cx="66" cy="66" r="13" fill="#7FD600"/>
+  <path d="M 60.5 66.5 l 3.5 3.5 l 7.5 -7.5" stroke="#0D0D0D" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+</svg>

assets/brand/logo-mono.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 96" role="img" aria-label="Peptide Repo">
+  <rect x="8" y="8" width="80" height="80" rx="16" fill="#0D0D0D"/>
+  <text x="48" y="58" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="38" fill="#FFFFFF" letter-spacing="1">PR</text>
+  <circle cx="82" cy="82" r="14" fill="#0D0D0D" stroke="#0D0D0D" stroke-width="2"/>
+  <circle cx="82" cy="82" r="11" fill="#FFFFFF"/>
+  <path d="M 76 82 l 4 4 l 8 -8" stroke="#0D0D0D" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+  <text x="108" y="58" font-family="Poppins, sans-serif" font-weight="700" font-size="30" fill="#0D0D0D" letter-spacing="-0.5">Peptide Repo</text>
+</svg>

assets/brand/logo-wordmark-reverse.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 280 56" role="img" aria-label="Peptide Repo">
+  <text x="0" y="40" font-family="Poppins, sans-serif" font-weight="700" font-size="36" fill="#FFFFFF" letter-spacing="-0.5">Peptide Repo</text>
+</svg>

assets/brand/logo-wordmark.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 280 56" role="img" aria-label="Peptide Repo">
+  <text x="0" y="40" font-family="Poppins, sans-serif" font-weight="700" font-size="36" fill="#0D0D0D" letter-spacing="-0.5">Peptide Repo</text>
+</svg>

assets/brand/og-default.svg

@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 630" role="img" aria-label="Peptide Repo - What the research really says.">
+  <!-- Background: cream with a subtle teal-corner accent -->
+  <rect x="0" y="0" width="1200" height="630" fill="#FAFAF7"/>
+  <rect x="0" y="610" width="1200" height="20" fill="#1B8A92"/>
+
+  <!-- Logo lockup, top-left, scaled larger -->
+  <g transform="translate(80, 80)">
+    <rect x="0" y="0" width="120" height="120" rx="22" fill="#1B8A92"/>
+    <text x="60" y="86" text-anchor="middle" font-family="Poppins, sans-serif" font-weight="700" font-size="56" fill="#FFFFFF" letter-spacing="1.5">PR</text>
+    <circle cx="111" cy="111" r="20" fill="#7FD600"/>
+    <path d="M 102 111 l 6 6 l 12 -12" stroke="#0D0D0D" stroke-width="4" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+    <text x="148" y="80" font-family="Poppins, sans-serif" font-weight="700" font-size="44" fill="#0D0D0D" letter-spacing="-0.8">Peptide Repo</text>
+  </g>
+
+  <!-- Tagline / hero copy -->
+  <g transform="translate(80, 320)">
+    <text x="0" y="0" font-family="Poppins, sans-serif" font-weight="700" font-size="84" fill="#0D0D0D" letter-spacing="-2">What the research</text>
+    <text x="0" y="100" font-family="Poppins, sans-serif" font-weight="700" font-size="84" fill="#1B8A92" letter-spacing="-2">really says.</text>
+  </g>
+
+  <!-- Verdict-state mini-row, bottom-right, signaling the brand's signature taxonomy -->
+  <g transform="translate(720, 540)" font-family="Inter, sans-serif" font-weight="600" font-size="14">
+    <rect x="0" y="0" width="120" height="32" rx="16" fill="#1B8A92"/>
+    <text x="60" y="22" text-anchor="middle" fill="#FFFFFF" letter-spacing="0.4">Established</text>
+    <rect x="130" y="0" width="120" height="32" rx="16" fill="#7FD600"/>
+    <text x="190" y="22" text-anchor="middle" fill="#0D0D0D" letter-spacing="0.4">Promising</text>
+    <rect x="260" y="0" width="160" height="32" rx="16" fill="#FF8A3D"/>
+    <text x="340" y="22" text-anchor="middle" fill="#0D0D0D" letter-spacing="0.4">Investigational</text>
+  </g>
+</svg>

assets/css/brand.css

@@ -0,0 +1,202 @@
+/**
+ * Peptide Repo Brand Identity v1.0.0
+ * Direction C: "The Trusted Guide"
+ *
+ * Contains CSS custom property tokens and brand component styles.
+ * Enqueued before style.css so tokens cascade into existing theme.
+ *
+ * @package peptide-starter
+ */
+
+:root {
+  /* Base palette */
+  --color-teal: #1B8A92;
+  --color-ink: #0D0D0D;
+  --color-lime: #7FD600;
+  --color-orange: #FF8A3D;
+  --color-neutral: #D0D0D0;
+  --color-light: #F5F5F5;
+  --color-white: #FFFFFF;
+
+  /* Teal scale (primary) */
+  --teal-50:  #EBF5F6;
+  --teal-100: #CEE7EA;
+  --teal-200: #A6D2D7;
+  --teal-300: #74B8C0;
+  --teal-400: #429DA6;
+  --teal-500: #1B8A92;
+  --teal-600: #147178;
+  --teal-700: #0F585E;
+  --teal-800: #0A3F44;
+  --teal-900: #072A2E;
+
+  /* Lime scale (accent — badge/button only, never body text) */
+  --lime-50:  #F5FFE0;
+  --lime-100: #E8FFB8;
+  --lime-200: #D4FF85;
+  --lime-300: #BDFF4D;
+  --lime-400: #A5EE20;
+  --lime-500: #7FD600;
+  --lime-600: #66B000;
+  --lime-700: #4D8A00;
+  --lime-800: #365F00;
+  --lime-900: #1F3700;
+
+  /* Orange scale (caution) */
+  --orange-50:  #FFF3EB;
+  --orange-100: #FFDEC4;
+  --orange-200: #FFC299;
+  --orange-300: #FFA66E;
+  --orange-400: #FF9455;
+  --orange-500: #FF8A3D;
+  --orange-600: #E46B1F;
+  --orange-700: #B8520F;
+  --orange-800: #833708;
+  --orange-900: #4F2003;
+
+  /* Gray scale (neutral) */
+  --gray-50:  #FAFAFA;
+  --gray-100: #F5F5F5;
+  --gray-200: #E8E8E8;
+  --gray-300: #D0D0D0;
+  --gray-400: #A8A8A8;
+  --gray-500: #808080;
+  --gray-600: #5C5C5C;
+  --gray-700: #3D3D3D;
+  --gray-800: #1F1F1F;
+  --gray-900: #0D0D0D;
+
+  /* Semantic tokens */
+  --text-primary: var(--gray-900);
+  --text-secondary: var(--gray-700);
+  --text-muted: var(--gray-500);
+  --text-inverse: var(--color-white);
+
+  --bg-page: var(--color-white);
+  --bg-surface: var(--color-white);
+  --bg-inset: var(--gray-100);
+  --bg-brand: var(--teal-500);
+  --bg-brand-deep: var(--teal-700);
+
+  --border-default: var(--gray-200);
+  --border-strong: var(--gray-300);
+  --border-brand: var(--teal-500);
+
+  /* Verdict system tokens (the signature) */
+  --verdict-established-bg: var(--teal-500);
+  --verdict-established-fg: var(--color-white);
+  --verdict-promising-bg: var(--lime-500);
+  --verdict-promising-fg: var(--gray-900);
+  --verdict-investigational-bg: var(--orange-500);
+  --verdict-investigational-fg: var(--gray-900);
+  --verdict-insufficient-bg: var(--gray-300);
+  --verdict-insufficient-fg: var(--gray-700);
+  --verdict-cautionary-bg: #C0392B;
+  --verdict-cautionary-fg: var(--color-white);
+
+  /* Spacing & sizing primitives */
+  --radius-sm: 4px;
+  --radius-md: 8px;
+  --radius-lg: 12px;
+  --radius-pill: 999px;
+
+  --shadow-card: 0 1px 2px rgba(13,13,13,0.04), 0 2px 8px rgba(13,13,13,0.04);
+  --shadow-card-hover: 0 2px 4px rgba(13,13,13,0.06), 0 8px 16px rgba(13,13,13,0.06);
+}
+
+.pr-verdict {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 14px 6px 10px;
+  border-radius: var(--radius-pill);
+  font-family: "Poppins", sans-serif;
+  font-weight: 600;
+  font-size: 14px;
+  line-height: 1;
+  letter-spacing: 0.01em;
+  min-height: 32px;
+}
+
+.pr-verdict__glyph {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 20px;
+  height: 20px;
+  border-radius: var(--radius-pill);
+  background: rgba(255,255,255,0.25);
+  font-size: 13px;
+  flex-shrink: 0;
+}
+
+.pr-verdict--established { background: var(--verdict-established-bg); color: var(--verdict-established-fg); }
+.pr-verdict--promising { background: var(--verdict-promising-bg); color: var(--verdict-promising-fg); }
+.pr-verdict--investigational { background: var(--verdict-investigational-bg); color: var(--verdict-investigational-fg); }
+.pr-verdict--insufficient { background: var(--verdict-insufficient-bg); color: var(--verdict-insufficient-fg); }
+.pr-verdict--cautionary { background: var(--verdict-cautionary-bg); color: var(--verdict-cautionary-fg); }
+
+.pr-verdict--insufficient .pr-verdict__glyph { background: rgba(13,13,13,0.10); color: var(--gray-700); }
+.pr-verdict--promising .pr-verdict__glyph,
+.pr-verdict--investigational .pr-verdict__glyph { background: rgba(13,13,13,0.12); color: var(--gray-900); }
+
+.pr-verdict-card {
+  background: var(--bg-surface);
+  border: 1px solid var(--border-default);
+  border-radius: var(--radius-lg);
+  padding: 32px;
+  box-shadow: var(--shadow-card);
+}
+
+.pr-verdict-card__header { display: flex; justify-content: space-between; align-items: flex-start; margin-bottom: 24px; }
+.pr-verdict-card__updated { font-size: 13px; color: var(--text-muted); }
+.pr-verdict-card__title { font-family: "Poppins", sans-serif; font-weight: 700; font-size: 36px; line-height: 1.2; margin: 0 0 8px; color: var(--text-primary); }
+.pr-verdict-card__summary { font-family: "Inter", sans-serif; font-size: 18px; line-height: 1.4; color: var(--text-secondary); margin-bottom: 24px; }
+
+.pr-evidence-row {
+  background: var(--bg-inset);
+  border-radius: var(--radius-md);
+  padding: 16px 20px;
+  margin-bottom: 24px;
+}
+
+.pr-evidence-row__item { display: flex; align-items: flex-start; gap: 12px; font-family: "Inter", sans-serif; font-size: 15px; line-height: 1.5; color: var(--text-primary); }
+.pr-evidence-row__item + .pr-evidence-row__item { margin-top: 10px; }
+.pr-evidence-row__glyph { display: inline-flex; align-items: center; justify-content: center; width: 20px; height: 20px; flex-shrink: 0; font-weight: 600; }
+
+.pr-verdict-card__verdict-label { font-family: "Poppins", sans-serif; font-weight: 600; font-size: 14px; color: var(--text-secondary); margin-bottom: 8px; }
+.pr-verdict-card__verdict-text { font-family: "Inter", sans-serif; font-size: 16px; line-height: 1.6; color: var(--text-primary); margin-bottom: 24px; }
+.pr-verdict-card__cta-group { display: flex; gap: 16px; flex-wrap: wrap; }
+.pr-verdict-card__cta-link { color: var(--teal-600); text-decoration: none; font-weight: 600; font-size: 15px; }
+.pr-verdict-card__cta-link:hover { color: var(--teal-700); text-decoration: underline; }
+
+.pr-disclosure {
+  background: var(--bg-inset);
+  border-left: 4px solid var(--teal-500);
+  border-radius: var(--radius-md);
+  padding: 12px 16px;
+  font-family: "Inter", sans-serif;
+  font-size: 14px;
+  color: var(--text-secondary);
+  line-height: 1.5;
+}
+
+.pr-disclosure__label { font-family: "Poppins", sans-serif; font-weight: 600; color: var(--text-secondary); }
+.pr-disclosure--inline { margin: 12px 0; }
+.pr-disclosure--banner { background: var(--teal-50); border: 1px solid var(--teal-200); border-left: 4px solid var(--teal-500); padding: 20px 24px; margin-bottom: 24px; font-size: 14px; }
+.pr-disclosure--footer { font-size: 13px; }
+
+.pr-chip-row { display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 24px; }
+.pr-chip { display: inline-flex; align-items: center; gap: 8px; padding: 8px 16px; border: 1.5px solid var(--border-default); border-radius: var(--radius-pill); background: transparent; color: var(--text-primary); text-decoration: none; font-family: "Inter", sans-serif; font-weight: 600; font-size: 14px; cursor: pointer; transition: all 0.2s ease; }
+.pr-chip:hover { border-color: var(--teal-500); color: var(--teal-600); }
+.pr-chip--active { background: var(--teal-500); border-color: var(--teal-500); color: var(--color-white); }
+
+@media (prefers-reduced-motion: reduce) {
+  .pr-chip { transition: none; }
+}
+
+@media (max-width: 768px) {
+  .pr-verdict-card { padding: 20px; }
+  .pr-verdict-card__title { font-size: 28px; }
+  .pr-verdict-card__summary { font-size: 16px; }
+}

assets/js/abbr-tooltip.js

@@ -0,0 +1,134 @@
+/**
+ * abbr-tooltip.js — Inline abbreviation popover for verdict legend screen.
+ *
+ * What: Opens a small popover anchored to any .pr-abbr element when tapped,
+ *       clicked, or activated via keyboard. Closes on outside click or Escape.
+ * Who triggers: Enqueued by functions.php on is_front_page() requests only.
+ * Depends on: .pr-abbr elements in the DOM with data-def attributes; CSS in
+ *             style.css (.pr-abbr-popover).
+ *
+ * @see inc/verdict-helpers.php  — peptide_starter_render_desc() emits .pr-abbr elements
+ * @see style.css                — .pr-abbr, .pr-abbr-popover visual styles
+ * @package peptide-starter
+ */
+
+( function () {
+	'use strict';
+
+	var POPOVER_CLASS  = 'pr-abbr-popover';
+	var ACTIVE_CLASS   = 'pr-abbr--active';
+	var activePopover  = null;
+	var activeAbbr     = null;
+
+	/**
+	 * Remove the currently open popover, if any.
+	 *
+	 * @return {void}
+	 */
+	function closePopover() {
+		if ( activePopover ) {
+			activePopover.remove();
+			activePopover = null;
+		}
+		if ( activeAbbr ) {
+			activeAbbr.classList.remove( ACTIVE_CLASS );
+			activeAbbr.removeAttribute( 'aria-expanded' );
+			activeAbbr = null;
+		}
+	}
+
+	/**
+	 * Create and position a popover anchored to the given abbr element.
+	 *
+	 * @param {HTMLElement} abbr - The .pr-abbr element that was activated.
+	 * @return {void}
+	 */
+	function openPopover( abbr ) {
+		closePopover();
+
+		var def = abbr.getAttribute( 'data-def' );
+		if ( ! def ) {
+			return;
+		}
+
+		var popover = document.createElement( 'div' );
+		popover.className   = POPOVER_CLASS;
+		popover.textContent = def;
+		popover.setAttribute( 'role', 'tooltip' );
+		popover.setAttribute( 'id', POPOVER_CLASS + '-' + Date.now() );
+
+		document.body.appendChild( popover );
+
+		// Position below the abbr, clamped to viewport width.
+		var rect       = abbr.getBoundingClientRect();
+		var scrollTop  = window.pageYOffset || document.documentElement.scrollTop;
+		var scrollLeft = window.pageXOffset || document.documentElement.scrollLeft;
+		var top        = rect.bottom + scrollTop + 6;
+		var left       = rect.left  + scrollLeft;
+		var maxLeft    = window.innerWidth - popover.offsetWidth - 16;
+
+		popover.style.top  = top + 'px';
+		popover.style.left = Math.max( 8, Math.min( left, maxLeft ) ) + 'px';
+
+		abbr.classList.add( ACTIVE_CLASS );
+		abbr.setAttribute( 'aria-expanded', 'true' );
+		abbr.setAttribute( 'aria-describedby', popover.id );
+
+		activePopover = popover;
+		activeAbbr    = abbr;
+	}
+
+	/**
+	 * Toggle the popover for an abbr element (open if closed, close if open).
+	 *
+	 * @param {HTMLElement} abbr - The .pr-abbr element that was activated.
+	 * @return {void}
+	 */
+	function togglePopover( abbr ) {
+		if ( activeAbbr === abbr ) {
+			closePopover();
+		} else {
+			openPopover( abbr );
+		}
+	}
+
+	// -------------------------------------------------------------------------
+	// Event listeners
+	// -------------------------------------------------------------------------
+
+	document.addEventListener( 'click', function ( e ) {
+		var abbr = e.target.closest( '.pr-abbr' );
+		if ( abbr ) {
+			e.stopPropagation();
+			togglePopover( abbr );
+			return;
+		}
+		// Click outside any abbr — close.
+		closePopover();
+	} );
+
+	document.addEventListener( 'keydown', function ( e ) {
+		if ( e.key === 'Escape' ) {
+			closePopover();
+			return;
+		}
+		if ( e.key === 'Enter' || e.key === ' ' ) {
+			var abbr = e.target.closest( '.pr-abbr' );
+			if ( abbr ) {
+				e.preventDefault();
+				togglePopover( abbr );
+			}
+		}
+	} );
+
+	// Close when focus leaves the popover+abbr pair entirely.
+	document.addEventListener( 'focusin', function ( e ) {
+		if (
+			activeAbbr &&
+			! activeAbbr.contains( e.target ) &&
+			( ! activePopover || ! activePopover.contains( e.target ) )
+		) {
+			closePopover();
+		}
+	} );
+} )();

composer.json

@@ -13,7 +13,7 @@
 	"scripts": {
 		"lint": "phpcs",
 		"lint:fix": "phpcbf",
-		"test": "phpunit"
+		"test": "vendor/bin/phpunit"
 	},
 	"config": {
 		"allow-plugins": {

footer.php

@@ -23,7 +23,7 @@
 			<!-- Footer Grid -->
 			<div class="footer-grid">
 				<?php
-				for ( $i = 1; $i <= 4; $i++ ) {
+				for ( $i = 1; $i <= 5; $i++ ) {
 					echo '<div class="footer-section">';
 					if ( is_active_sidebar( 'footer-' . $i ) ) {
 						dynamic_sidebar( 'footer-' . $i );
@@ -31,7 +31,8 @@
 						// Default footer content if no widgets.
 						if ( 1 === $i ) {
 							echo '<h3>' . esc_html__( 'About', 'peptide-starter' ) . '</h3>';
-							echo '<p>' . esc_html__( 'Peptide Repo is a comprehensive scientific database for peptide research.', 'peptide-starter' ) . '</p>';
+							echo '<p>' . esc_html__( 'Verdict-driven peptide guides for clinicians and informed readers. Clear about the evidence — including when there isn\'t any.', 'peptide-starter' ) . '</p>';
+							echo '<p style="margin-top: var(--spacing-md); font-size: 0.9rem;"><a href="' . esc_url( home_url( '/subscribe' ) ) . '" style="color: var(--color-accent-green, #5a7c5a); font-weight: 600;">' . esc_html__( 'Get our weekly digest →', 'peptide-starter' ) . '</a></p>';
 						} elseif ( 2 === $i ) {
 							echo '<h3>' . esc_html__( 'Quick Links', 'peptide-starter' ) . '</h3>';
 							echo '<ul>';
@@ -52,6 +53,13 @@
 							echo '<ul>';
 							echo '<li><a href="https://github.com/peptiderepo" target="_blank" rel="noopener">' . esc_html__( 'GitHub', 'peptide-starter' ) . '</a></li>';
 							echo '</ul>';
+						} elseif ( 5 === $i ) {
+							echo '<h3>' . esc_html__( 'Our Method', 'peptide-starter' ) . '</h3>';
+							echo '<ul>';
+							echo '<li><a href="' . esc_url( home_url( '/how-we-review-peptides' ) ) . '">' . esc_html__( 'How We Review Peptides', 'peptide-starter' ) . '</a></li>';
+							echo '<li><a href="' . esc_url( home_url( '/our-methodology' ) ) . '">' . esc_html__( 'Our Methodology', 'peptide-starter' ) . '</a></li>';
+							echo '<li><a href="' . esc_url( home_url( '/about' ) ) . '">' . esc_html__( 'Editorial Standards', 'peptide-starter' ) . '</a></li>';
+							echo '</ul>';
 						}
 					}
 					echo '</div>';
@@ -65,6 +73,15 @@
 					<?php echo wp_kses_post( peptide_starter_get_footer_copyright() ); ?>
 				</p>
 
+				<!-- Disclosure -->
+				<?php
+				get_template_part(
+					'template-parts/affiliate-disclosure',
+					null,
+					array( 'context' => 'footer' )
+				);
+				?>
+
 				<!-- Disclaimer -->
 				<p class="footer-disclaimer">
 					<?php esc_html_e( 'All data is provided for informational and educational purposes only. This platform does not provide medical advice, diagnoses, or treatment recommendations. Always consult qualified professionals.', 'peptide-starter' ); ?>

front-page.php

@@ -2,21 +2,38 @@
 /**
  * The front page template
  *
- * Layout: Hero → Research Modules → PRAutoBlogger posts → Peptide News feed.
- * Newsletter signup is handled by footer.php (via template part) on the front page.
+ * Layout: Hero → Verdict Explainer → Featured Verdict Cards → Research Modules
+ *         → PRAutoBlogger posts → Peptide News feed.
  *
- * @see template-parts/module-cards.php — research modules grid
- * @see template-parts/newsletter-signup.php — included via footer.php on front page
- * @see functions.php — helper functions for hero content
+ * Brand v2.0.0: Direction C "The Trusted Guide". Hero uses the 5-state verdict
+ * taxonomy as the central explainer hook. Three featured verdict cards pull from
+ * real monographs (semaglutide / BPC-157 / Melanotan-II) via post meta.
+ *
+ * @see template-parts/module-cards.php       — research modules grid
+ * @see template-parts/verdict/badge.php      — verdict badge component
+ * @see template-parts/verdict/card.php       — full verdict card (monograph hero)
+ * @see inc/helpers.php                       — hero title / subtitle getters
+ * @see assets/css/brand.css                  — verdict token definitions
  *
  * @package peptide-starter
  */
 
 get_header();
+
+/** @see inc/verdict-helpers.php — peptide_starter_get_verdict_taxonomy() */
+$verdict_taxonomy = peptide_starter_get_verdict_taxonomy();
+
+/**
+ * Featured monograph post IDs. These are the three exemplar monographs
+ * loaded during brand sprint v2.0.0 (2026-04-26).
+ * Semaglutide=211 (established), BPC-157=36 (investigational), Melanotan-II=177 (cautionary).
+ */
+$featured_monograph_ids = array( 211, 36, 177 );
 ?>
 
 <main id="main" class="site-main">
-	<!-- Hero Section -->
+
+	<!-- HERO SECTION -->
 	<section class="hero-section">
 		<div class="hero-content">
 			<h1 class="hero-title">
@@ -60,14 +77,134 @@ get_header();
 				<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
 					<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
 				</a>
-				<a href="<?php echo esc_url( home_url( '/documentation' ) ); ?>" class="ps-btn ps-btn-secondary">
-					<?php esc_html_e( 'Documentation', 'peptide-starter' ); ?>
+				<a href="<?php echo esc_url( home_url( '/how-we-review-peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
+					<?php esc_html_e( 'Our method', 'peptide-starter' ); ?>
 				</a>
 			</div>
 		</div>
 	</section>
 
-	<!-- Research Modules Grid (6 cards) -->
+	<!-- VERDICT TAXONOMY EXPLAINER -->
+	<section class="hero-verdict-explainer" aria-label="<?php esc_attr_e( 'Our verdict system', 'peptide-starter' ); ?>">
+		<div class="ps-container">
+			<p class="hero-verdict-explainer__heading">
+				<?php esc_html_e( 'Every peptide gets a verdict. Here\'s what they mean.', 'peptide-starter' ); ?>
+			</p>
+			<div class="hero-verdict-explainer__grid">
+				<?php foreach ( $verdict_taxonomy as $v ) : ?>
+				<div class="hero-verdict-explainer__item">
+					<span
+						class="pr-verdict pr-verdict--<?php echo esc_attr( $v['state'] ); ?>"
+						role="img"
+						aria-label="<?php echo esc_attr( sprintf( __( 'Verdict: %s', 'peptide-starter' ), $v['label'] ) ); ?>"
+					>
+						<span class="pr-verdict__glyph" aria-hidden="true"><?php echo esc_html( $v['glyph'] ); ?></span>
+						<span class="pr-verdict__label"><?php echo esc_html( $v['label'] ); ?></span>
+					</span>
+					<p class="hero-verdict-explainer__desc"><?php echo peptide_starter_render_desc( $v['description'], $v['abbrs'] ?? array() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- output is built from esc_html/esc_attr components inside render_desc(). ?></p>
+				</div>
+				<?php endforeach; ?>
+			</div>
+			<p class="hero-verdict-explainer__cta-line">
+				<a href="<?php echo esc_url( home_url( '/how-we-review-peptides' ) ); ?>" class="ps-btn ps-btn-tertiary ps-btn-sm">
+					<?php esc_html_e( 'How we assign verdicts →', 'peptide-starter' ); ?>
+				</a>
+			</p>
+		</div>
+	</section>
+
+	<!-- FEATURED VERDICT CARDS: semaglutide=211 (Established), BPC-157=36 (Investigational), Melanotan-II=177 (Cautionary) -->
+	<?php
+	$featured_posts = get_posts(
+		array(
+			'post__in'       => $featured_monograph_ids,
+			'post_type'      => 'peptide',
+			'posts_per_page' => 3,
+			'orderby'        => 'post__in',
+			'post_status'    => 'publish',
+		)
+	);
+	if ( ! empty( $featured_posts ) ) :
+		?>
+	<section class="hero-featured-verdicts" aria-label="<?php esc_attr_e( 'Featured peptide verdicts', 'peptide-starter' ); ?>">
+		<div class="ps-container">
+			<h2 class="hero-featured-verdicts__title"><?php esc_html_e( 'Featured verdicts', 'peptide-starter' ); ?></h2>
+			<p class="hero-featured-verdicts__subtitle">
+				<?php esc_html_e( 'Real assessments from our database — see the system in action.', 'peptide-starter' ); ?>
+			</p>
+			<div class="hero-featured-verdicts__grid">
+				<?php
+				foreach ( $featured_posts as $featured_post ) :
+					$post_id      = $featured_post->ID;
+					$verdict_state = get_post_meta( $post_id, 'verdict_state', true );
+					$verdict_text  = get_post_meta( $post_id, 'verdict_text', true );
+					$post_url      = get_permalink( $post_id );
+
+					// Verdict state config — @see inc/verdict-helpers.php
+					$verdict_config = peptide_starter_get_verdict_config();
+					$vc = isset( $verdict_config[ $verdict_state ] ) ? $verdict_config[ $verdict_state ] : null;
+
+					// Signal rows (up to 3).
+					$signal_rows = array();
+					for ( $i = 1; $i <= 3; $i++ ) {
+						$row_label = get_post_meta( $post_id, 'signal_row_' . $i . '_label', true );
+						$row_glyph = get_post_meta( $post_id, 'signal_row_' . $i . '_glyph', true );
+						if ( $row_label ) {
+							$signal_rows[] = array(
+								'label' => $row_label,
+								'glyph' => $row_glyph ? $row_glyph : '•',
+							);
+						}
+					}
+					?>
+				<article class="hero-verdict-card" aria-label="<?php echo esc_attr( get_the_title( $post_id ) ); ?>">
+					<?php if ( $vc ) : ?>
+					<span
+						class="pr-verdict pr-verdict--<?php echo esc_attr( $verdict_state ); ?> hero-verdict-card__badge"
+						role="img"
+						aria-label="<?php echo esc_attr( sprintf( __( 'Verdict: %s', 'peptide-starter' ), $vc['label'] ) ); ?>"
+					>
+						<span class="pr-verdict__glyph" aria-hidden="true"><?php echo esc_html( $vc['glyph'] ); ?></span>
+						<span class="pr-verdict__label"><?php echo esc_html( $vc['label'] ); ?></span>
+					</span>
+					<?php endif; ?>
+
+					<h3 class="hero-verdict-card__title">
+						<a href="<?php echo esc_url( $post_url ); ?>"><?php echo esc_html( get_the_title( $post_id ) ); ?></a>
+					</h3>
+
+					<?php if ( $verdict_text ) : ?>
+					<p class="hero-verdict-card__summary"><?php echo esc_html( $verdict_text ); ?></p>
+					<?php endif; ?>
+
+					<?php if ( ! empty( $signal_rows ) ) : ?>
+					<ul class="hero-verdict-card__signals" aria-label="<?php esc_attr_e( 'Evidence signals', 'peptide-starter' ); ?>">
+						<?php foreach ( $signal_rows as $row ) : ?>
+						<li class="hero-verdict-card__signal-item">
+							<span class="hero-verdict-card__signal-glyph" aria-hidden="true"><?php echo esc_html( $row['glyph'] ); ?></span>
+							<?php echo esc_html( $row['label'] ); ?>
+						</li>
+						<?php endforeach; ?>
+					</ul>
+					<?php endif; ?>
+
+					<a href="<?php echo esc_url( $post_url ); ?>" class="hero-verdict-card__link">
+						<?php esc_html_e( 'Read the full evidence →', 'peptide-starter' ); ?>
+					</a>
+				</article>
+				<?php endforeach; ?>
+			</div>
+
+			<div class="hero-featured-verdicts__footer">
+				<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
+					<?php esc_html_e( 'Browse all peptides', 'peptide-starter' ); ?>
+				</a>
+			</div>
+		</div>
+	</section>
+	<?php endif; ?>
+
+	<!-- Research Modules Grid (5 cards) -->
 	<?php get_template_part( 'template-parts/module', 'cards' ); ?>
 
 	<!-- PRAutoBlogger Posts Widget -->
@@ -77,24 +214,28 @@ get_header();
 	}
 	?>
 
-	<!-- News Feed Section -->
+	<!-- News Teaser Section — 3 items + "View all" CTA -->
 	<?php
 	if ( shortcode_exists( 'peptide_news' ) ) {
 		?>
-		<section class="news-feed-section">
+		<section class="news-teaser-section">
 			<div class="ps-container">
-				<div class="news-feed-header">
-					<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
-					<p class="news-feed-description">
-						<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
-					</p>
+				<div class="news-teaser-header">
+					<div>
+						<h2><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
+						<p><?php esc_html_e( 'Recent publications from leading research sources.', 'peptide-starter' ); ?></p>
+					</div>
+					<a href="<?php echo esc_url( home_url( '/news' ) ); ?>" class="ps-btn ps-btn-secondary">
+						<?php esc_html_e( 'View all research →', 'peptide-starter' ); ?>
+					</a>
 				</div>
-				<?php echo do_shortcode( '[peptide_news]' ); ?>
+				<?php echo do_shortcode( '[peptide_news count="3"]' ); ?>
 			</div>
 		</section>
 		<?php
 	}
 	?>
+
 </main>
 
 <?php get_footer(); ?>

functions.php

@@ -7,6 +7,8 @@
  * 300 lines and to make responsibilities discoverable.
  *
  * @see inc/config.php           — security configuration
+ * @see inc/nav-walker.php       — Peptide_Starter_Nav_Walker + primary menu fallback
+ * @see inc/helpers.php          — customizer helpers, gates, honeypot, CSV utility
  * @see inc/rate-limiter.php     — transient-backed rate limiter
  * @see inc/email-verification.php — token-gated email verification
  * @see inc/auth-handlers.php    — AJAX login + registration
@@ -14,7 +16,7 @@
  * @see inc/newsletter-admin.php — admin subscriber viewer + unsubscribe
  * @see inc/page-setup.php       — auto-create pages + v1.5.0 user migration
  * @see inc/mail-diagnostic.php  — admin deliverability test tool
- * @see inc/helpers.php          — nav walker, menu fallback, gates, utilities
+ * @see inc/perf-asset-policy.php — asset dequeue + font slim + preconnect + defer
  *
  * @package peptide-starter
  */
@@ -25,13 +27,14 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 // Theme constants.
-define( 'PEPTIDE_STARTER_VERSION', '1.5.2' );
+define( 'PEPTIDE_STARTER_VERSION', '2.3.0' );
 define( 'PEPTIDE_STARTER_DIR', get_template_directory() );
 define( 'PEPTIDE_STARTER_URI', get_template_directory_uri() );
 
 // Load feature modules. Order matters — config must load before anything
 // that calls peptide_starter_config_*; rate limiter before handlers.
 require_once PEPTIDE_STARTER_DIR . '/inc/config.php';
+require_once PEPTIDE_STARTER_DIR . '/inc/nav-walker.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/helpers.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/cloudflare-ips.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/rate-limiter.php';
@@ -42,6 +45,9 @@ require_once PEPTIDE_STARTER_DIR . '/inc/contact-handler.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/page-setup.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/newsletter-admin.php';
 require_once PEPTIDE_STARTER_DIR . '/inc/mail-diagnostic.php';
+require_once PEPTIDE_STARTER_DIR . '/inc/perf-asset-policy.php';
+require_once PEPTIDE_STARTER_DIR . '/inc/verdict-meta.php';
+require_once PEPTIDE_STARTER_DIR . '/inc/verdict-helpers.php';
 
 /**
  * Set up theme defaults and register support for WordPress features.
@@ -69,6 +75,7 @@ function peptide_starter_setup() {
 	load_theme_textdomain( 'peptide-starter', PEPTIDE_STARTER_DIR . '/languages' );
 }
 add_action( 'after_setup_theme', 'peptide_starter_setup' );
+add_action( 'after_setup_theme', 'peptide_starter_perf_asset_policy_init' );
 
 /**
  * Register and enqueue stylesheets and scripts.
@@ -76,12 +83,18 @@ add_action( 'after_setup_theme', 'peptide_starter_setup' );
  * @return void
  */
 function peptide_starter_scripts() {
+	wp_enqueue_style( 'peptide-starter-brand', PEPTIDE_STARTER_URI . '/assets/css/brand.css', array(), PEPTIDE_STARTER_VERSION );
 	wp_enqueue_style( 'peptide-starter-style', PEPTIDE_STARTER_URI . '/style.css', array(), PEPTIDE_STARTER_VERSION );
 
 	wp_enqueue_script( 'peptide-starter-navigation', PEPTIDE_STARTER_URI . '/assets/js/navigation.js', array(), PEPTIDE_STARTER_VERSION, true );
 	wp_enqueue_script( 'peptide-starter-theme', PEPTIDE_STARTER_URI . '/assets/js/theme.js', array(), PEPTIDE_STARTER_VERSION, true );
 	wp_enqueue_script( 'peptide-starter-settings-panel', PEPTIDE_STARTER_URI . '/assets/js/settings-panel.js', array(), PEPTIDE_STARTER_VERSION, true );
 
+	// Abbreviation popovers — only needed on the front page verdict legend strip.
+	if ( is_front_page() ) {
+		wp_enqueue_script( 'peptide-starter-abbr-tooltip', PEPTIDE_STARTER_URI . '/assets/js/abbr-tooltip.js', array(), PEPTIDE_STARTER_VERSION, true );
+	}
+
 	wp_localize_script(
 		'peptide-starter-theme',
 		'peptideStarterData',
@@ -134,7 +147,7 @@ add_action( 'wp_enqueue_scripts', 'peptide_starter_plugin_overrides', 99 );
  * @return void
  */
 function peptide_starter_widgets_init() {
-	for ( $i = 1; $i <= 4; $i++ ) {
+	for ( $i = 1; $i <= 5; $i++ ) {
 		register_sidebar(
 			array(
 				/* translators: %d: footer column number */
@@ -238,3 +251,20 @@ function peptide_starter_inline_dark_mode_script() {
 	<?php
 }
 add_action( 'wp_head', 'peptide_starter_inline_dark_mode_script' );
+
+/**
+ * Enqueue Beehiiv attribution script site-wide.
+ *
+ * Loads Beehiiv's attribution.js in the footer so all signup form placements
+ * (subscribe page iframe, single-peptide inline form) are tracked correctly
+ * under a single script include.
+ *
+ * Who calls it: wp_enqueue_scripts action (all front-end page loads).
+ * Dependencies: none.
+ *
+ * @return void
+ */
+function peptide_starter_enqueue_beehiiv_attribution() {
+	wp_enqueue_script( 'beehiiv-attribution', 'https://subscribe-forms.beehiiv.com/attribution.js', array(), null, true );
+}
+add_action( 'wp_enqueue_scripts', 'peptide_starter_enqueue_beehiiv_attribution' );

header.php

@@ -20,6 +20,19 @@
 	<meta name="viewport" content="width=device-width, initial-scale=1">
 	<link rel="profile" href="https://gmpg.org/xfn/11">
 	<?php wp_head(); ?>
+	<link rel="preconnect" href="https://fonts.googleapis.com">
+	<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+	<link rel="preload" as="style" href="https://fonts.googleapis.com/css2?family=Poppins:wght@600;700&family=Inter:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap">
+	<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Poppins:wght@600;700&family=Inter:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap">
+	<link rel="icon" type="image/x-icon" href="<?php echo get_stylesheet_directory_uri(); ?>/favicon.ico">
+	<link rel="icon" type="image/png" sizes="16x16" href="<?php echo get_stylesheet_directory_uri(); ?>/assets/brand/favicon-16.png">
+	<link rel="icon" type="image/png" sizes="32x32" href="<?php echo get_stylesheet_directory_uri(); ?>/assets/brand/favicon-32.png">
+	<link rel="apple-touch-icon" sizes="180x180" href="<?php echo get_stylesheet_directory_uri(); ?>/apple-touch-icon.png">
+	<link rel="manifest" href="<?php echo get_stylesheet_directory_uri(); ?>/site.webmanifest">
+	<meta name="theme-color" content="#1B8A92">
+	<?php if ( ! function_exists( 'wp_is_block_theme' ) || ! wp_is_block_theme() ) : ?>
+		<meta property="og:image" content="<?php echo esc_url( get_stylesheet_directory_uri() . '/assets/brand/og-default.png' ); ?>">
+	<?php endif; ?>
 </head>
 
 <body <?php body_class(); ?>>
@@ -105,7 +118,8 @@
 			</button>
 
 			<!-- Dark Mode Toggle -->
-			<button class="header-icon-btn dark-mode-toggle" aria-label="<?php esc_attr_e( 'Toggle dark mode', 'peptide-starter' ); ?>">
+			<!-- Dark mode disabled for v1: verdict-color accessibility only validated for light mode. Re-enable in v1.1 after dark palette audit. -->
+			<button class="header-icon-btn dark-mode-toggle" aria-label="<?php esc_attr_e( 'Toggle dark mode', 'peptide-starter' ); ?>" style="display:none;" aria-hidden="true">
 				<svg class="sun-icon" width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg" style="display: none;">
 					<circle cx="10" cy="10" r="4" stroke="currentColor" stroke-width="2"/>
 					<path d="M10 1V3M10 17V19M19 10H17M3 10H1M16.657 16.657L15.243 15.243M4.757 4.757L3.343 3.343M16.657 3.343L15.243 4.757M4.757 15.243L3.343 16.657" stroke="currentColor" stroke-width="2" stroke-linecap="round"/>
@@ -115,15 +129,6 @@
 				</svg>
 			</button>
 
-			<!-- Cart Icon (WooCommerce) -->
-			<?php if ( class_exists( 'WooCommerce' ) ) { ?>
-				<button class="header-icon-btn cart-toggle" aria-label="<?php esc_attr_e( 'View cart', 'peptide-starter' ); ?>">
-					<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
-						<path d="M1 1H3.27924M3.27924 1L5.20081 13.5631C5.35072 14.4571 5.80765 15.2614 6.4543 15.8285C7.10095 16.3956 7.92274 16.6882 8.76721 16.6882H16.7257M16.7257 16.6882C17.3169 16.6882 17.7793 17.1506 17.7793 17.7418C17.7793 18.333 17.3169 18.7955 16.7257 18.7955M16.7257 16.6882C15.6515 16.6882 14.4632 16.6882 8.76721 16.6882M8.76721 16.6882C8.17601 16.6882 7.71365 17.1506 7.71365 17.7418C7.71365 18.333 8.17601 18.7955 8.76721 18.7955M5.20081 13.5631H16.7257" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-					</svg>
-				</button>
-			<?php } ?>
-
 			<!-- Mobile Menu Toggle -->
 			<button class="menu-toggle" aria-label="<?php esc_attr_e( 'Toggle menu', 'peptide-starter' ); ?>">
 				<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">

inc/helpers.php

@@ -2,17 +2,21 @@
 /**
  * Theme Helper Functions
  *
- * Customizer output helpers, nav walker, custom logo, pagination, menu
- * fallback, auth gates, and assorted utilities shared across the theme.
+ * Customizer output helpers, custom logo, pagination, auth gates,
+ * honeypot, and CSV utility shared across the theme.
  *
- * @see functions.php — includes this file
- * @see header.php — uses peptide_starter_the_custom_logo() + menu fallback
+ * Navigation walker and primary menu fallback have been extracted to
+ * inc/nav-walker.php (v2.3.0) to keep this file under 300 lines.
+ *
+ * @see functions.php        — includes this file (after nav-walker.php)
+ * @see inc/nav-walker.php   — Peptide_Starter_Nav_Walker + menu fallback
+ * @see header.php           — uses peptide_starter_the_custom_logo()
  * @see page-subject-log.php, page-tracker.php, page-protocol-builder.php —
  *   use peptide_starter_require_login()
  *
  * What: Utility functions for template output, theme mods, auth gating.
  * Who calls it: Templates and handler files.
- * Dependencies: WordPress Customizer API, Walker_Nav_Menu, email-verification.
+ * Dependencies: WordPress Customizer API, email-verification.
  *
  * @package peptide-starter
  */
@@ -22,110 +26,6 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 
-/**
- * Navigation Menu Walker — adds active classes.
- *
- * What: Renders menu items with an 'active' class for current + ancestor.
- * Who calls it: wp_nav_menu() in header.php with walker => new instance.
- * Dependencies: Walker_Nav_Menu.
- */
-class Peptide_Starter_Nav_Walker extends Walker_Nav_Menu {
-
-	/**
-	 * Render a single menu item.
-	 *
-	 * @param string   $output Item output accumulator.
-	 * @param WP_Post  $item   Menu item data.
-	 * @param int      $depth  Menu depth.
-	 * @param stdClass $args   Menu arguments.
-	 * @param int      $id     Current item ID.
-	 * @return void
-	 */
-	public function start_el( &$output, $item, $depth = 0, $args = null, $id = 0 ) {
-		$indent    = ( $depth ) ? str_repeat( "\t", $depth ) : '';
-		$classes   = empty( $item->classes ) ? array() : (array) $item->classes;
-		$classes[] = 'menu-item-' . $item->ID;
-
-		if ( in_array( 'current-menu-item', $classes, true ) || in_array( 'current-menu-parent', $classes, true ) ) {
-			$classes[] = 'active';
-		}
-
-		$args        = apply_filters( 'nav_menu_item_args', $args, $item, $depth );
-		$class_names = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item, $args, $depth ) );
-		$class_names = $class_names ? ' class="' . esc_attr( $class_names ) . '"' : '';
-
-		$item_id = apply_filters( 'nav_menu_item_id', 'menu-item-' . $item->ID, $item, $args, $depth );
-		$item_id = $item_id ? ' id="' . esc_attr( $item_id ) . '"' : '';
-
-		$output .= $indent . '<li' . $item_id . $class_names . '>';
-
-		$atts = array(
-			'title'  => ! empty( $item->attr_title ) ? $item->attr_title : '',
-			'target' => ! empty( $item->target ) ? $item->target : '',
-			'rel'    => ! empty( $item->xfn ) ? $item->xfn : '',
-			'href'   => ! empty( $item->url ) ? $item->url : '',
-		);
-
-		$atts       = apply_filters( 'nav_menu_link_attributes', $atts, $item, $args, $depth );
-		$attributes = '';
-
-		foreach ( $atts as $attr => $value ) {
-			if ( ! empty( $value ) ) {
-				$value       = ( 'href' === $attr ) ? esc_url( $value ) : esc_attr( $value );
-				$attributes .= ' ' . $attr . '="' . $value . '"';
-			}
-		}
-
-		$title = apply_filters( 'the_title', $item->title, $item->ID );
-
-		$link  = $args->before;
-		$link .= '<a' . $attributes . '>';
-		$link .= $args->link_before . $title . $args->link_after;
-		$link .= '</a>';
-		$link .= $args->after;
-
-		$output .= $link . "</li>\n";
-	}
-}
-
-/**
- * Fallback menu when no primary nav is assigned in WP admin.
- *
- * Previously lived inline inside header.php; moved here in v1.5.1 to
- * prevent redeclaration if header.php is ever included twice.
- *
- * @return void Echoes a complete <ul>.
- */
-function peptide_starter_primary_menu_fallback() {
-	?>
-	<ul>
-		<li><a href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php esc_html_e( 'Home', 'peptide-starter' ); ?></a></li>
-		<li class="menu-item-has-children">
-			<a href="#"><?php esc_html_e( 'Tools', 'peptide-starter' ); ?></a>
-			<ul class="sub-menu">
-				<li><a href="<?php echo esc_url( home_url( '/calculator' ) ); ?>"><?php esc_html_e( 'Calculator', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/protocol-builder' ) ); ?>"><?php esc_html_e( 'Protocol Builder', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/tracker' ) ); ?>"><?php esc_html_e( 'Tracker', 'peptide-starter' ); ?></a></li>
-			</ul>
-		</li>
-		<li class="menu-item-has-children">
-			<a href="#"><?php esc_html_e( 'My Data', 'peptide-starter' ); ?></a>
-			<ul class="sub-menu">
-				<li><a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>"><?php esc_html_e( 'Peptides', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/subject-log' ) ); ?>"><?php esc_html_e( 'Subject Log', 'peptide-starter' ); ?></a></li>
-			</ul>
-		</li>
-		<li class="menu-item-has-children">
-			<a href="#"><?php esc_html_e( 'Resources', 'peptide-starter' ); ?></a>
-			<ul class="sub-menu">
-				<li><a href="<?php echo esc_url( home_url( '/documentation' ) ); ?>"><?php esc_html_e( 'Documentation', 'peptide-starter' ); ?></a></li>
-				<li><a href="<?php echo esc_url( home_url( '/news' ) ); ?>"><?php esc_html_e( 'Science Feed', 'peptide-starter' ); ?></a></li>
-			</ul>
-		</li>
-	</ul>
-	<?php
-}
-
 /**
  * Display custom logo with fallback to site name link.
  *
@@ -136,6 +36,15 @@ function peptide_starter_the_custom_logo() {
 		the_custom_logo();
 		return;
 	}
+	// Use SVG logo if available
+	$logo_path = get_template_directory() . '/assets/brand/logo-horizontal.svg';
+	if ( file_exists( $logo_path ) ) {
+		echo '<a class="site-logo" href="' . esc_url( home_url( '/' ) ) . '" rel="home" aria-label="' . esc_attr( get_bloginfo( 'name' ) ) . '">';
+		include $logo_path;
+		echo '</a>';
+		return;
+	}
+	// Fallback to text
 	$site_name = get_bloginfo( 'name' );
 	echo '<a class="site-logo" href="' . esc_url( home_url( '/' ) ) . '" rel="home">' . esc_html( $site_name ) . '</a>';
 }
@@ -146,7 +55,7 @@ function peptide_starter_the_custom_logo() {
  * @return string Hero title text.
  */
 function peptide_starter_get_hero_title() {
-	return get_theme_mod( 'hero_title', get_bloginfo( 'name' ) );
+	return get_theme_mod( 'hero_title', esc_html__( 'Is this peptide right for you?', 'peptide-starter' ) );
 }
 
 /**
@@ -155,7 +64,7 @@ function peptide_starter_get_hero_title() {
  * @return string Hero subtitle text.
  */
 function peptide_starter_get_hero_subtitle() {
-	return get_theme_mod( 'hero_subtitle', esc_html__( 'A scientific peptide reference database', 'peptide-starter' ) );
+	return get_theme_mod( 'hero_subtitle', esc_html__( 'What the research really says', 'peptide-starter' ) );
 }
 
 /**
@@ -173,7 +82,7 @@ function peptide_starter_get_search_placeholder() {
  * @return string Copyright text (may contain safe HTML).
  */
 function peptide_starter_get_footer_copyright() {
-	return get_theme_mod( 'footer_copyright', esc_html__( 'Copyright © 2026 Peptide Repo. All rights reserved.', 'peptide-starter' ) );
+	return get_theme_mod( 'footer_copyright', esc_html__( 'Copyright \u00a9 2026 Peptide Repo. All rights reserved.', 'peptide-starter' ) );
 }
 
 /**
@@ -208,8 +117,8 @@ function peptide_starter_pagination() {
 			'format'    => 'page/%#%/',
 			'current'   => $current,
 			'total'     => $total,
-			'prev_text' => esc_html__( '← Previous', 'peptide-starter' ),
-			'next_text' => esc_html__( 'Next →', 'peptide-starter' ),
+			'prev_text' => esc_html__( '\u2190 Previous', 'peptide-starter' ),
+			'next_text' => esc_html__( 'Next \u2192', 'peptide-starter' ),
 			'type'      => 'plain',
 		)
 	);
@@ -239,8 +148,8 @@ function peptide_starter_safe_referer() {
 /**
  * Gate a template behind login + verified email.
  *
- * Unauthenticated → redirect to /auth?redirect_to=current-uri.
- * Logged in but unverified → redirect to /profile?verify_required=1.
+ * Unauthenticated \u2192 redirect to /auth?redirect_to=current-uri.
+ * Logged in but unverified \u2192 redirect to /profile?verify_required=1.
  *
  * Side effects: emits 302 and exits the request.
  *

inc/nav-walker.php

@@ -0,0 +1,123 @@
+<?php
+/**
+ * Navigation Menu Walker & Primary Menu Fallback
+ *
+ * What: Custom nav walker that adds 'active' CSS classes, plus a fallback
+ *       menu rendered when no primary nav is assigned in WP admin.
+ * Who calls it: header.php — wp_nav_menu() with walker => new Peptide_Starter_Nav_Walker(),
+ *               and the callback_function parameter for the fallback.
+ * Dependencies: Walker_Nav_Menu (WordPress core).
+ *
+ * Extracted from inc/helpers.php in v2.3.0 to keep both files under 300 lines.
+ *
+ * @package peptide-starter
+ */
+
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+/**
+ * Navigation Menu Walker — adds active classes.
+ *
+ * What: Renders menu items with an 'active' class for current + ancestor items.
+ * Who calls it: wp_nav_menu() in header.php with walker => new instance.
+ * Dependencies: Walker_Nav_Menu.
+ */
+class Peptide_Starter_Nav_Walker extends Walker_Nav_Menu {
+
+	/**
+	 * Render a single menu item.
+	 *
+	 * @param string   $output Item output accumulator (passed by reference).
+	 * @param WP_Post  $item   Menu item data.
+	 * @param int      $depth  Menu depth.
+	 * @param stdClass $args   Menu arguments.
+	 * @param int      $id     Current item ID.
+	 * @return void
+	 */
+	public function start_el( &$output, $item, $depth = 0, $args = null, $id = 0 ) {
+		$indent    = ( $depth ) ? str_repeat( "\t", $depth ) : '';
+		$classes   = empty( $item->classes ) ? array() : (array) $item->classes;
+		$classes[] = 'menu-item-' . $item->ID;
+
+		if ( in_array( 'current-menu-item', $classes, true ) || in_array( 'current-menu-parent', $classes, true ) ) {
+			$classes[] = 'active';
+		}
+
+		$args        = apply_filters( 'nav_menu_item_args', $args, $item, $depth );
+		$class_names = join( ' ', apply_filters( 'nav_menu_css_class', array_filter( $classes ), $item, $args, $depth ) );
+		$class_names = $class_names ? ' class="' . esc_attr( $class_names ) . '"' : '';
+
+		$item_id = apply_filters( 'nav_menu_item_id', 'menu-item-' . $item->ID, $item, $args, $depth );
+		$item_id = $item_id ? ' id="' . esc_attr( $item_id ) . '"' : '';
+
+		$output .= $indent . '<li' . $item_id . $class_names . '>';
+
+		$atts = array(
+			'title'  => ! empty( $item->attr_title ) ? $item->attr_title : '',
+			'target' => ! empty( $item->target ) ? $item->target : '',
+			'rel'    => ! empty( $item->xfn ) ? $item->xfn : '',
+			'href'   => ! empty( $item->url ) ? $item->url : '',
+		);
+
+		$atts       = apply_filters( 'nav_menu_link_attributes', $atts, $item, $args, $depth );
+		$attributes = '';
+
+		foreach ( $atts as $attr => $value ) {
+			if ( ! empty( $value ) ) {
+				$value       = ( 'href' === $attr ) ? esc_url( $value ) : esc_attr( $value );
+				$attributes .= ' ' . $attr . '="' . $value . '"';
+			}
+		}
+
+		$title = apply_filters( 'the_title', $item->title, $item->ID );
+
+		$link  = $args->before;
+		$link .= '<a' . $attributes . '>';
+		$link .= $args->link_before . $title . $args->link_after;
+		$link .= '</a>';
+		$link .= $args->after;
+
+		$output .= $link . "</li>\n";
+	}
+}
+
+/**
+ * Fallback menu when no primary nav is assigned in WP admin.
+ *
+ * Previously lived inline inside header.php; moved to inc/helpers.php in
+ * v1.5.1 to prevent redeclaration, then extracted here in v2.3.0.
+ *
+ * @return void Echoes a complete <ul>.
+ */
+function peptide_starter_primary_menu_fallback() {
+	?>
+	<ul>
+		<li><a href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php esc_html_e( 'Home', 'peptide-starter' ); ?></a></li>
+		<li class="menu-item-has-children">
+			<a href="#"><?php esc_html_e( 'Tools', 'peptide-starter' ); ?></a>
+			<ul class="sub-menu">
+				<li><a href="<?php echo esc_url( home_url( '/calculator' ) ); ?>"><?php esc_html_e( 'Calculator', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/protocol-builder' ) ); ?>"><?php esc_html_e( 'Protocol Builder', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/tracker' ) ); ?>"><?php esc_html_e( 'Tracker', 'peptide-starter' ); ?></a></li>
+			</ul>
+		</li>
+		<li class="menu-item-has-children">
+			<a href="#"><?php esc_html_e( 'My Data', 'peptide-starter' ); ?></a>
+			<ul class="sub-menu">
+				<li><a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>"><?php esc_html_e( 'Peptides', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/subject-log' ) ); ?>"><?php esc_html_e( 'Subject Log', 'peptide-starter' ); ?></a></li>
+			</ul>
+		</li>
+		<li class="menu-item-has-children">
+			<a href="#"><?php esc_html_e( 'Resources', 'peptide-starter' ); ?></a>
+			<ul class="sub-menu">
+				<li><a href="<?php echo esc_url( home_url( '/documentation' ) ); ?>"><?php esc_html_e( 'Documentation', 'peptide-starter' ); ?></a></li>
+				<li><a href="<?php echo esc_url( home_url( '/news' ) ); ?>"><?php esc_html_e( 'Science Feed', 'peptide-starter' ); ?></a></li>
+			</ul>
+		</li>
+	</ul>
+	<?php
+}

inc/perf-asset-policy.php

@@ -0,0 +1,290 @@
+<?php
+/**
+ * Performance Asset Policy Module
+ *
+ * Optimizes the front-end asset graph by dequeuing unnecessary plugin styles/scripts
+ * and slimming font requests. Targets mobile LCP improvement through:
+ * - Conditional dequeue of Elementor and USMI assets
+ * - Google Fonts weight slimming (36 faces → 5)
+ * - Preconnect hints for font.googleapis.com + fonts.gstatic.com
+ * - Defer attribute on cookie-notice script
+ *
+ * What: Performance optimizations; no template changes.
+ * Who calls it: functions.php via add_action( 'after_setup_theme', '..._init' ).
+ * Dependencies: WordPress hooks system; works independently.
+ *
+ * @see functions.php — requires and hooks this module
+ * @see CHANGELOG.md — [1.6.0] release notes
+ *
+ * @package peptide-starter
+ */
+
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+/**
+ * Initialize the performance asset policy module.
+ *
+ * Wires all dequeue, font slim, preconnect, and defer hooks at the correct priorities.
+ * Called once per request from the 'after_setup_theme' action.
+ *
+ * @return void
+ */
+function peptide_starter_perf_asset_policy_init() {
+	// Dequeue unnecessary plugin assets at priority 100 (one beat after plugin_overrides).
+	add_action( 'wp_enqueue_scripts', 'peptide_starter_perf_dequeue_plugin_assets', 100 );
+
+	// Slim Google Fonts to essential weights only.
+	add_filter( 'style_loader_src', 'peptide_starter_perf_slim_google_fonts', 10, 2 );
+
+	// Add preconnect hints for font servers.
+	add_filter( 'wp_resource_hints', 'peptide_starter_perf_resource_hints', 10, 2 );
+
+	// Defer cookie-notice script to prevent render blocking.
+	add_filter( 'script_loader_tag', 'peptide_starter_perf_defer_cookie_notice', 10, 3 );
+}
+
+/**
+ * Dequeue assets on non-applicable page types.
+ *
+ * Removes Elementor and Ultimate Social Media Icons assets from pages
+ * that don't use them. Controlled by the kill-switch constant PEPTIDE_STARTER_PERF_DEQUEUE.
+ *
+ * Dequeue conditions:
+ * - Elementor: removed if page doesn't use Elementor builder
+ * - USMI: removed on homepage, archives, and blog index
+ *
+ * @return void
+ */
+function peptide_starter_perf_dequeue_plugin_assets() {
+	// Kill-switch: if disabled in wp-config.php, do nothing.
+	if ( defined( 'PEPTIDE_STARTER_PERF_DEQUEUE' ) && ! PEPTIDE_STARTER_PERF_DEQUEUE ) {
+		return;
+	}
+
+	// Elementor assets: dequeue if page doesn't use Elementor.
+	if ( ! peptide_starter_page_uses_elementor( get_queried_object_id() ) ) {
+		$elementor_handles = apply_filters(
+			'peptide_starter_perf_elementor_handles',
+			array( 'elementor-frontend', 'elementor-frontend-legacy' )
+		);
+
+		foreach ( $elementor_handles as $handle ) {
+			wp_dequeue_style( $handle );
+		}
+
+		// Dequeue Elementor per-post CSS files (pattern: posts-*.css or post-*.css).
+		// These are added dynamically; we identify them by src pattern and remove before render.
+		// Note: post-22 and post-34 are specific Elementor archive template files.
+		global $wp_styles;
+		if ( isset( $wp_styles->queue ) ) {
+			$elementor_post_styles = array();
+			foreach ( $wp_styles->queue as $handle ) {
+				if ( isset( $wp_styles->registered[ $handle ] ) ) {
+					$src = $wp_styles->registered[ $handle ]->src;
+					// Detect Elementor per-post CSS by path pattern.
+					if ( $src && preg_match( '/uploads\/elementor\/css\/post-\d+\.css/', $src ) ) {
+						$elementor_post_styles[] = $handle;
+					}
+				}
+			}
+
+			foreach ( $elementor_post_styles as $handle ) {
+				wp_dequeue_style( $handle );
+			}
+		}
+	}
+
+	// Ultimate Social Media Icons: dequeue on homepage, archives, and blog index.
+	if ( is_front_page() || is_home() || is_archive() ) {
+		$usmi_handles = apply_filters(
+			'peptide_starter_perf_usmi_handles',
+			array(
+				'SFSImainCss',
+				'SFSIjqueryModernizr',
+				'SFSIjqueryShuffle',
+				'SFSIjqueryrandom-shuffle',
+				'SFSICustomJs',
+			)
+		);
+
+		foreach ( $usmi_handles as $handle ) {
+			wp_dequeue_style( $handle );
+			wp_dequeue_script( $handle );
+		}
+	}
+}
+
+/**
+ * Slim Google Fonts to essential weights only.
+ *
+ * Rewrites fonts.googleapis.com URLs to keep only:
+ * - Roboto: 400, 500, 700 (no italics)
+ * - Roboto Slab: 400, 700 (no italics)
+ *
+ * This reduces the font CSS from ~6KB to <1KB and the font payload by ~80%.
+ * Filterable per family via 'peptide_starter_perf_font_weights'.
+ *
+ * @param string $src    Stylesheet URL.
+ * @param string $handle Stylesheet handle.
+ * @return string Rewritten URL or original.
+ */
+function peptide_starter_perf_slim_google_fonts( $src, $handle ) {
+	if ( ! $src || false === strpos( $src, 'fonts.googleapis.com' ) ) {
+		return $src;
+	}
+
+	// Parse the URL to get the query string.
+	$parsed = wp_parse_url( $src );
+	if ( empty( $parsed['query'] ) ) {
+		return $src;
+	}
+
+	// Extract family parameter.
+	parse_str( $parsed['query'], $query_vars );
+	if ( empty( $query_vars['family'] ) ) {
+		return $src;
+	}
+
+	$families_str = $query_vars['family'];
+
+	// Decode the family string (it may be URL-encoded).
+	$families_str = rawurldecode( $families_str );
+
+	// Split families by + (multiple families in one request).
+	$families = explode( '+', $families_str );
+
+	// Get configured font weights from filter.
+	$font_weights_config = apply_filters(
+		'peptide_starter_perf_font_weights',
+		array(
+			'Roboto'       => array( 400, 500, 700 ),
+			'Roboto Slab'  => array( 400, 700 ),
+		)
+	);
+
+	$rewritten_families = array();
+	foreach ( $families as $family ) {
+		// Clean up the family name (URL decode + trim).
+		$family = trim( rawurldecode( $family ) );
+
+		// Check if this family has a configured weight list.
+		$matched = false;
+		foreach ( $font_weights_config as $config_family => $weights ) {
+			if ( 0 === strcasecmp( $family, $config_family ) ) {
+				// Rewrite with only the specified weights.
+				$weights_str = implode( ',', $weights );
+				$rewritten_families[] = $config_family . ':' . $weights_str;
+				$matched = true;
+				break;
+			}
+		}
+
+		// If no config match, pass through unchanged.
+		if ( ! $matched ) {
+			$rewritten_families[] = $family;
+		}
+	}
+
+	// If nothing changed, return original.
+	if ( count( $rewritten_families ) === count( $families ) ) {
+		// Check if any actually changed (compare raw values).
+		$original_str = implode( '+', $families );
+		$rewritten_str = implode( '+', $rewritten_families );
+
+		if ( $original_str === $rewritten_str ) {
+			return $src;
+		}
+	}
+
+	// Rebuild the URL with the new family parameter.
+	$new_query_vars = $query_vars;
+	$new_query_vars['family'] = implode( '+', $rewritten_families );
+	$new_query_str = http_build_query( $new_query_vars );
+
+	// Reconstruct the full URL.
+	$new_src = $parsed['scheme'] . '://' . $parsed['host'] . $parsed['path'] . '?' . $new_query_str;
+
+	return $new_src;
+}
+
+/**
+ * Add preconnect hints for font servers.
+ *
+ * Reduces TLS + DNS latency for Google Fonts requests on cold cache.
+ * Adds preconnect for fonts.googleapis.com and fonts.gstatic.com.
+ *
+ * @param array  $urls  List of URLs to add hints for.
+ * @param string $rel   The relationship type (preconnect, dns-prefetch, etc.).
+ * @return array Modified URL list.
+ */
+function peptide_starter_perf_resource_hints( $urls, $rel ) {
+	// Only add hints for preconnect relationships.
+	if ( 'preconnect' !== $rel ) {
+		return $urls;
+	}
+
+	// Add font servers if not already present.
+	$font_urls = apply_filters(
+		'peptide_starter_perf_font_preconnect_urls',
+		array(
+			'https://fonts.googleapis.com',
+			'https://fonts.gstatic.com',
+		)
+	);
+
+	foreach ( $font_urls as $url ) {
+		if ( ! in_array( $url, $urls, true ) ) {
+			$urls[] = $url;
+		}
+	}
+
+	return $urls;
+}
+
+/**
+ * Defer the cookie-notice script to avoid render-blocking.
+ *
+ * Adds 'defer' attribute to cookie-notice JS while preserving DOM-ready order.
+ * This ensures the cookie banner loads without blocking initial rendering.
+ *
+ * @param string $tag    The script tag HTML.
+ * @param string $handle The script handle.
+ * @param string $src    The script URL (unused).
+ * @return string Modified script tag.
+ */
+function peptide_starter_perf_defer_cookie_notice( $tag, $handle, $src ) {
+	// Only modify the cookie-notice script.
+	if ( 'cookie-notice-front' !== $handle ) {
+		return $tag;
+	}
+
+	// Add defer attribute if not already present.
+	if ( false === strpos( $tag, 'defer' ) ) {
+		// Insert defer before the closing >.
+		$tag = str_replace( '<script ', '<script defer ', $tag );
+	}
+
+	return $tag;
+}
+
+/**
+ * Check if a page uses the Elementor builder.
+ *
+ * Inspects the _elementor_edit_mode post meta. If the page is in builder mode,
+ * we assume Elementor styles are needed (even if no actual content yet).
+ *
+ * @param int $post_id The post ID to check.
+ * @return bool True if page uses Elementor, false otherwise.
+ */
+function peptide_starter_page_uses_elementor( $post_id ) {
+	if ( ! $post_id || ! is_singular() ) {
+		return false;
+	}
+
+	$edit_mode = get_post_meta( $post_id, '_elementor_edit_mode', true );
+
+	return ! empty( $edit_mode ) && 'builder' === $edit_mode;
+}

inc/verdict-helpers.php

@@ -0,0 +1,137 @@
+<?php
+/**
+ * Verdict helper functions for homepage and template parts.
+ *
+ * What: Provides data arrays for the 5-state verdict taxonomy used in the
+ *       homepage explainer strip and featured verdict cards.
+ * Who triggers: Required by functions.php on every page load.
+ * Depends on: Nothing — pure data functions, no WP dependencies.
+ *
+ * @see inc/verdict-meta.php      — verdict CPT meta registration
+ * @see template-parts/verdict/   — badge, card, evidence-row components
+ * @see front-page.php            — homepage verdict sections
+ *
+ * @package peptide-starter
+ */
+
+/**
+ * Returns the verdict taxonomy data array for the homepage explainer strip.
+ *
+ * Canonical order matches CMO brief §5.1 and the 5-state enum in verdict-meta.php.
+ *
+ * @return array[] Each element: state (string), glyph (string), label (string), description (string), abbrs (array, optional).
+ */
+function peptide_starter_get_verdict_taxonomy() {
+	return array(
+		array(
+			'state'       => 'established',
+			'glyph'       => '✓',
+			'label'       => 'Established',
+			'description' => 'Strong RCT evidence; widely prescribed or validated.',
+			// abbrs: terms in description that should render as inline tap-targets.
+			'abbrs'       => array(
+				'RCT' => 'Randomized Controlled Trial — the gold standard for clinical evidence. Participants are randomly assigned to treatment or control groups to measure real effect.',
+			),
+		),
+		array(
+			'state'       => 'promising',
+			'glyph'       => '◐',
+			'label'       => 'Promising',
+			'description' => 'Meaningful human data accumulating; not yet RCT-strong.',
+		),
+		array(
+			'state'       => 'investigational',
+			'glyph'       => '?',
+			'label'       => 'Investigational',
+			'description' => 'Mechanism plausible; human trials sparse.',
+		),
+		array(
+			'state'       => 'insufficient',
+			'glyph'       => '⊘',
+			'label'       => 'Insufficient Evidence',
+			'description' => 'Not enough data to say anything responsible.',
+		),
+		array(
+			'state'       => 'cautionary',
+			'glyph'       => '⚠',
+			'label'       => 'Cautionary',
+			'description' => 'Active safety signals or misuse patterns.',
+		),
+	);
+}
+
+/**
+ * Returns the verdict state config map (glyph + label per state slug).
+ *
+ * Used by featured verdict cards on the homepage and any template that needs
+ * to render a verdict badge from a state string without loading the full card.
+ *
+ * @return array Keyed by state slug. Each value: array{ glyph: string, label: string }.
+ */
+function peptide_starter_get_verdict_config() {
+	return array(
+		'established'     => array(
+			'glyph' => '✓',
+			'label' => 'Established',
+		),
+		'promising'       => array(
+			'glyph' => '◐',
+			'label' => 'Promising',
+		),
+		'investigational' => array(
+			'glyph' => '?',
+			'label' => 'Investigational',
+		),
+		'insufficient'    => array(
+			'glyph' => '⊘',
+			'label' => 'Insufficient Evidence',
+		),
+		'cautionary'      => array(
+			'glyph' => '⚠',
+			'label' => 'Cautionary',
+		),
+	);
+}
+
+/**
+ * Renders a description string with optional inline abbreviation tap-targets.
+ *
+ * What: Builds safe HTML for a verdict card description, replacing known
+ *       abbreviation terms with <abbr> elements that trigger a tooltip.
+ * Who calls it: front-page.php verdict explainer loop.
+ * Depends on: Nothing — pure string transformation.
+ *
+ * The output is intentionally built from escaped components (not from raw $text)
+ * so we never expose unescaped user or data-layer content. Each substitution is:
+ *   esc_html( $text ) → str_replace( literal_term, safe_abbr_html )
+ * This is safe because the abbr tag, class, and data-def are all hardcoded or
+ * escaped here, and the term key is a literal constant from our own data array.
+ *
+ * @param string $text  Plain-text description string. Will be HTML-escaped.
+ * @param array  $abbrs Associative array of term => definition. Keys are literal
+ *                      strings (e.g. 'RCT'). Values are plain-text definitions.
+ * @return string Safe HTML string suitable for echo without further escaping.
+ *
+ * @see inc/verdict-helpers.php — $abbrs data lives in peptide_starter_get_verdict_taxonomy()
+ * @see assets/js/abbr-tooltip.js — JS that handles tap/click to show the popover
+ * @see style.css — .pr-abbr and .pr-abbr-popover styles
+ */
+function peptide_starter_render_desc( string $text, array $abbrs ): string {
+	$html = esc_html( $text );
+
+	foreach ( $abbrs as $term => $definition ) {
+		$safe_term = esc_html( $term );
+		$safe_def  = esc_attr( $definition );
+		$abbr_html = sprintf(
+			'<abbr class="pr-abbr" data-def="%s" tabindex="0" role="button" aria-label="%s: %s">%s</abbr>',
+			$safe_def,
+			$safe_term,
+			$safe_def,
+			$safe_term
+		);
+		// Replace only the first occurrence — abbreviations should not stack.
+		$html = preg_replace( '/' . preg_quote( $safe_term, '/' ) . '/', $abbr_html, $html, 1 );
+	}
+
+	return $html;
+}

inc/verdict-meta.php

@@ -0,0 +1,300 @@
+<?php
+/**
+ * Verdict System Post Meta Registration & Meta Box
+ *
+ * Registers post meta for peptide CPT:
+ * - verdict_state (required): one of 5 states
+ * - verdict_text (required for launch): 3–5 sentence opinionated verdict
+ * - signal_row_1/2/3 (optional): evidence signal label text
+ * - signal_row_1/2/3_glyph (optional): per-row glyph; enum ✓|!|?|⊘|⚠
+ * - has_partner_link (bool, default false): controls inline disclosure render
+ *
+ * Who calls it: loaded by functions.php via require_once.
+ * Depends on: nothing — pure WP register_post_meta.
+ *
+ * @package peptide-starter
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+/**
+ * Register verdict post meta for peptide CPT.
+ *
+ * @return void
+ */
+function peptide_starter_register_verdict_meta() {
+	$allowed_states  = array( 'established', 'promising', 'investigational', 'insufficient', 'cautionary' );
+	$allowed_glyphs  = array( '✓', '!', '?', '⊘', '⚠' );
+
+	// Register verdict_state meta.
+	register_post_meta(
+		'peptide',
+		'verdict_state',
+		array(
+			'type'              => 'string',
+			'single'            => true,
+			'show_in_rest'      => true,
+			'auth_callback'     => '__return_true',
+			'sanitize_callback' => function ( $value ) use ( $allowed_states ) {
+				return in_array( $value, $allowed_states, true ) ? $value : '';
+			},
+		)
+	);
+
+	// Register verdict_text meta — 3–5 sentence opinionated verdict paragraph.
+	register_post_meta(
+		'peptide',
+		'verdict_text',
+		array(
+			'type'              => 'string',
+			'single'            => true,
+			'show_in_rest'      => true,
+			'auth_callback'     => '__return_true',
+			'sanitize_callback' => 'sanitize_textarea_field',
+		)
+	);
+
+	// Register signal row text meta (up to 3 rows).
+	for ( $i = 1; $i <= 3; $i++ ) {
+		register_post_meta(
+			'peptide',
+			'signal_row_' . $i,
+			array(
+				'type'              => 'string',
+				'single'            => true,
+				'show_in_rest'      => true,
+				'auth_callback'     => '__return_true',
+				'sanitize_callback' => 'sanitize_text_field',
+			)
+		);
+
+		// Register per-row glyph meta.
+		// Validated as one of the 5-state glyph set to keep visual vocabulary consistent.
+		register_post_meta(
+			'peptide',
+			'signal_row_' . $i . '_glyph',
+			array(
+				'type'              => 'string',
+				'single'            => true,
+				'show_in_rest'      => true,
+				'auth_callback'     => '__return_true',
+				'sanitize_callback' => function ( $value ) use ( $allowed_glyphs ) {
+									return ( '' === $value || in_array( $value, $allowed_glyphs, true ) ) ? $value : '';
+				},
+			)
+		);
+	}
+
+	// Register has_partner_link — gates inline affiliate disclosure rendering.
+	// Default false: disclosure is suppressed unless a partner link is explicitly present.
+	register_post_meta(
+		'peptide',
+		'has_partner_link',
+		array(
+			'type'          => 'boolean',
+			'single'        => true,
+			'show_in_rest'  => true,
+			'auth_callback' => '__return_true',
+			'default'       => false,
+		)
+	);
+}
+add_action( 'init', 'peptide_starter_register_verdict_meta' );
+
+/**
+ * Add verdict meta box to peptide CPT edit screen.
+ *
+ * @return void
+ */
+function peptide_starter_add_verdict_meta_box() {
+	add_meta_box(
+		'peptide_starter_verdict',
+		esc_html__( 'Verdict System', 'peptide-starter' ),
+		'peptide_starter_render_verdict_meta_box',
+		'peptide',
+		'normal',
+		'high'
+	);
+}
+add_action( 'add_meta_boxes', 'peptide_starter_add_verdict_meta_box' );
+
+/**
+ * Render verdict meta box HTML.
+ *
+ * @param WP_Post $post The post object.
+ * @return void
+ */
+function peptide_starter_render_verdict_meta_box( $post ) {
+	wp_nonce_field( 'peptide_starter_verdict_nonce', 'peptide_starter_verdict_nonce' );
+
+	$verdict_state  = get_post_meta( $post->ID, 'verdict_state', true );
+	$verdict_text   = get_post_meta( $post->ID, 'verdict_text', true );
+	$allowed_states = array(
+		'established'     => esc_html__( 'Established', 'peptide-starter' ),
+		'promising'       => esc_html__( 'Promising', 'peptide-starter' ),
+		'investigational' => esc_html__( 'Investigational', 'peptide-starter' ),
+		'insufficient'    => esc_html__( 'Insufficient Evidence', 'peptide-starter' ),
+		'cautionary'      => esc_html__( 'Cautionary', 'peptide-starter' ),
+	);
+	$allowed_glyphs = array( '✓', '!', '?', '⊘', '⚠' );
+	$has_partner    = (bool) get_post_meta( $post->ID, 'has_partner_link', true );
+	?>
+	<div style="padding:12px 0;">
+
+		<label for="verdict_state" style="display:block;margin-bottom:6px;">
+			<strong><?php esc_html_e( 'Verdict State', 'peptide-starter' ); ?></strong>
+		</label>
+		<select id="verdict_state" name="verdict_state" style="width:100%;padding:8px;font-size:14px;margin-bottom:16px;">
+			<option value=""><?php esc_html_e( '— Select —', 'peptide-starter' ); ?></option>
+			<?php foreach ( $allowed_states as $key => $label ) : ?>
+				<option value="<?php echo esc_attr( $key ); ?>" <?php selected( $verdict_state, $key ); ?>>
+					<?php echo esc_html( $label ); ?>
+				</option>
+			<?php endforeach; ?>
+		</select>
+
+		<label for="verdict_text" style="display:block;margin-bottom:6px;">
+			<strong><?php esc_html_e( 'Our Verdict (3–5 sentences)', 'peptide-starter' ); ?></strong>
+			<span style="font-weight:normal;font-size:12px;color:#666;display:block;margin-top:2px;">
+				<?php esc_html_e( 'The opinionated verdict paragraph shown on the card hero. Be specific — this is the brand\'s editorial spine.', 'peptide-starter' ); ?>
+			</span>
+		</label>
+		<textarea id="verdict_text" name="verdict_text" rows="5"
+			style="width:100%;padding:8px;font-size:14px;margin-bottom:16px;"
+			placeholder="<?php esc_attr_e( 'e.g., Semaglutide works. The data is among the strongest of any peptide therapy...', 'peptide-starter' ); ?>"><?php echo esc_textarea( $verdict_text ); ?></textarea>
+
+		<hr style="border:none;border-top:1px solid #ddd;margin:8px 0 16px;">
+		<p style="font-weight:bold;margin-bottom:8px;"><?php esc_html_e( 'Evidence Signal Rows', 'peptide-starter' ); ?></p>
+
+			<?php
+			for ( $i = 1; $i <= 3; $i++ ) :
+				$row_text  = get_post_meta( $post->ID, 'signal_row_' . $i, true );
+				$row_glyph = get_post_meta( $post->ID, 'signal_row_' . $i . '_glyph', true );
+				?>
+			<div style="display:flex;gap:8px;align-items:flex-start;margin-bottom:12px;">
+				<div style="flex:0 0 80px;">
+					<label for="signal_row_<?php echo esc_attr( $i ); ?>_glyph"
+						style="display:block;margin-bottom:4px;font-size:12px;color:#444;">
+						<?php esc_html_e( 'Glyph', 'peptide-starter' ); ?>
+					</label>
+					<select id="signal_row_<?php echo esc_attr( $i ); ?>_glyph"
+						name="signal_row_<?php echo esc_attr( $i ); ?>_glyph"
+						style="width:100%;padding:6px;font-size:16px;">
+						<option value="" <?php selected( $row_glyph, '' ); ?>>—</option>
+						<?php foreach ( $allowed_glyphs as $g ) : ?>
+							<option value="<?php echo esc_attr( $g ); ?>" <?php selected( $row_glyph, $g ); ?>>
+								<?php echo esc_html( $g ); ?>
+							</option>
+						<?php endforeach; ?>
+					</select>
+				</div>
+				<div style="flex:1;">
+					<label for="signal_row_<?php echo esc_attr( $i ); ?>"
+						style="display:block;margin-bottom:4px;font-size:12px;color:#444;">
+						<?php
+						/* translators: %d is the row number */
+						echo esc_html( sprintf( __( 'Row %d label', 'peptide-starter' ), $i ) );
+						?>
+					</label>
+					<input type="text" id="signal_row_<?php echo esc_attr( $i ); ?>"
+						name="signal_row_<?php echo esc_attr( $i ); ?>"
+						value="<?php echo esc_attr( $row_text ); ?>"
+						style="width:100%;padding:8px;font-size:14px;"
+						placeholder="<?php esc_attr_e( 'Evidence signal label', 'peptide-starter' ); ?>">
+				</div>
+			</div>
+		<?php endfor; ?>
+
+		<hr style="border:none;border-top:1px solid #ddd;margin:8px 0 16px;">
+		<label style="display:flex;align-items:center;gap:8px;cursor:pointer;">
+			<input type="checkbox" name="has_partner_link" value="1"
+				<?php checked( $has_partner, true ); ?> style="width:16px;height:16px;">
+			<span>
+				<strong><?php esc_html_e( 'Has active partner link', 'peptide-starter' ); ?></strong>
+				<span style="display:block;font-size:12px;color:#666;margin-top:2px;">
+					<?php esc_html_e( 'Check this when the monograph contains an affiliate partner link. Controls the inline disclosure strip.', 'peptide-starter' ); ?>
+				</span>
+			</span>
+		</label>
+
+	</div>
+	<?php
+}
+
+/**
+ * Save verdict meta on post save.
+ *
+ * @param int     $post_id The post ID.
+ * @param WP_Post $post    The post object.
+ * @return void
+ */
+function peptide_starter_save_verdict_meta( $post_id, $post ) {
+	// Verify nonce.
+	if ( ! isset( $_POST['peptide_starter_verdict_nonce'] )
+		|| ! wp_verify_nonce( sanitize_key( $_POST['peptide_starter_verdict_nonce'] ), 'peptide_starter_verdict_nonce' )
+	) {
+		return;
+	}
+
+	// Only run for peptide CPT.
+	if ( 'peptide' !== $post->post_type ) {
+		return;
+	}
+
+	if ( ! current_user_can( 'edit_post', $post_id ) ) {
+		return;
+	}
+
+	$allowed_states = array( 'established', 'promising', 'investigational', 'insufficient', 'cautionary' );
+	$allowed_glyphs = array( '✓', '!', '?', '⊘', '⚠' );
+
+	// Save verdict_state.
+	if ( isset( $_POST['verdict_state'] ) ) {
+		$state = sanitize_text_field( wp_unslash( $_POST['verdict_state'] ) );
+		if ( in_array( $state, $allowed_states, true ) ) {
+			update_post_meta( $post_id, 'verdict_state', $state );
+		} else {
+			delete_post_meta( $post_id, 'verdict_state' );
+		}
+	}
+
+	// Save verdict_text.
+	if ( isset( $_POST['verdict_text'] ) ) {
+		$text = sanitize_textarea_field( wp_unslash( $_POST['verdict_text'] ) );
+		if ( ! empty( $text ) ) {
+			update_post_meta( $post_id, 'verdict_text', $text );
+		} else {
+			delete_post_meta( $post_id, 'verdict_text' );
+		}
+	}
+
+	// Save signal rows and their per-row glyphs.
+	for ( $i = 1; $i <= 3; $i++ ) {
+		$field_name = 'signal_row_' . $i;
+		if ( isset( $_POST[ $field_name ] ) ) {
+			$value = sanitize_text_field( wp_unslash( $_POST[ $field_name ] ) );
+			if ( ! empty( $value ) ) {
+				update_post_meta( $post_id, $field_name, $value );
+			} else {
+				delete_post_meta( $post_id, $field_name );
+			}
+		}
+
+		$glyph_field = 'signal_row_' . $i . '_glyph';
+		if ( isset( $_POST[ $glyph_field ] ) ) {
+			$glyph = wp_unslash( $_POST[ $glyph_field ] );
+			if ( in_array( $glyph, $allowed_glyphs, true ) ) {
+				update_post_meta( $post_id, $glyph_field, $glyph );
+			} else {
+				delete_post_meta( $post_id, $glyph_field );
+			}
+		}
+	}
+
+	// Save has_partner_link (checkbox — present = true, absent = false).
+	$has_partner = isset( $_POST['has_partner_link'] ) && '1' === $_POST['has_partner_link'];
+	update_post_meta( $post_id, 'has_partner_link', $has_partner ? '1' : '0' );
+}
+add_action( 'save_post', 'peptide_starter_save_verdict_meta', 10, 2 );

package-lock.json

@@ -0,0 +1,13 @@
+{
+  "name": "peptide-starter-theme",
+  "version": "2.3.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "peptide-starter-theme",
+      "version": "2.3.0",
+      "license": "GPL-2.0-or-later"
+    }
+  }
+}

package.json

@@ -0,0 +1,10 @@
+{
+  "name": "peptide-starter-theme",
+  "version": "2.3.0",
+  "description": "WordPress theme for peptiderepo.com",
+  "private": true,
+  "scripts": {
+    "lint": "find assets/js -name '*.js' -print0 | xargs -0 -I{} node --check {}"
+  },
+  "license": "GPL-2.0-or-later"
+}

page-about.php

@@ -0,0 +1,46 @@
+<?php
+/**
+ * Template Name: About & Editorial Standards
+ *
+ * Editorial standards, disclosure, and about page template.
+ *
+ * @package peptide-starter
+ */
+
+get_header();
+?>
+
+<main id="main" class="site-main">
+	<div class="page-about">
+		<?php
+		while ( have_posts() ) {
+			the_post();
+			?>
+			<article id="post-<?php the_ID(); ?>" <?php post_class( 'entry-about' ); ?>>
+				<header class="entry-header">
+					<h1 class="entry-title"><?php the_title(); ?></h1>
+				</header>
+				<div class="entry-content">
+					<?php the_content(); ?>
+				</div>
+			</article>
+			<?php
+		}
+		?>
+
+		<!-- Affiliate Disclosure Block -->
+		<section class="page-about__disclosures">
+			<h2><?php esc_html_e( 'How We Make Money', 'peptide-starter' ); ?></h2>
+			<?php
+			get_template_part(
+				'template-parts/affiliate-disclosure',
+				null,
+				array( 'context' => 'banner' )
+			);
+			?>
+		</section>
+	</div>
+</main>
+
+<?php
+get_footer();

page-calculator.php

@@ -33,8 +33,8 @@ get_header();
 	<section class="ps-tool-page">
 		<div class="ps-container">
 			<?php
-			if ( shortcode_exists( 'peptide_tools_calculator' ) ) {
-				echo do_shortcode( '[peptide_tools_calculator]' );
+			if ( shortcode_exists( 'prc_calculator' ) ) {
+				echo do_shortcode( '[prc_calculator]' );
 			} else {
 				?>
 				<div class="ps-tool-fallback">

page-how-we-review.php

@@ -0,0 +1,45 @@
+<?php
+/**
+ * Template Name: How We Review Peptides
+ *
+ * Two-column layout with sticky sidebar ToC for the verdict system explainer.
+ *
+ * @package peptide-starter
+ */
+
+get_header();
+?>
+
+<main id="main" class="site-main">
+	<div class="page-how-we-review">
+		<div class="page-how-we-review__content">
+			<?php
+			while ( have_posts() ) {
+				the_post();
+				?>
+				<article id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
+					<header class="entry-header">
+						<h1 class="entry-title"><?php the_title(); ?></h1>
+					</header>
+					<div class="entry-content">
+						<?php the_content(); ?>
+					</div>
+				</article>
+				<?php
+			}
+			?>
+		</div>
+
+		<?php if ( ! empty( get_the_content() ) ) : ?>
+			<aside class="page-how-we-review__sidebar">
+				<nav class="page-toc" aria-label="<?php esc_attr_e( 'Page contents', 'peptide-starter' ); ?>">
+					<h3><?php esc_html_e( 'Contents', 'peptide-starter' ); ?></h3>
+					<!-- JavaScript-generated ToC will be inserted here -->
+				</nav>
+			</aside>
+		<?php endif; ?>
+	</div>
+</main>
+
+<?php
+get_footer();

page-our-methodology.php

@@ -0,0 +1,46 @@
+<?php
+/**
+ * Template Name: Our Methodology
+ *
+ * Two-column layout with sticky sidebar ToC for the editorial methodology page.
+ * Mirrors page-how-we-review.php layout; CSS classes use page-our-methodology prefix.
+ *
+ * @package peptide-starter
+ */
+
+get_header();
+?>
+
+<main id="main" class="site-main">
+	<div class="page-our-methodology">
+		<div class="page-our-methodology__content">
+			<?php
+			while ( have_posts() ) {
+				the_post();
+				?>
+				<article id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
+					<header class="entry-header">
+						<h1 class="entry-title"><?php the_title(); ?></h1>
+					</header>
+					<div class="entry-content">
+						<?php the_content(); ?>
+					</div>
+				</article>
+				<?php
+			}
+			?>
+		</div>
+
+		<?php if ( ! empty( get_the_content() ) ) : ?>
+			<aside class="page-our-methodology__sidebar">
+				<nav class="page-toc" aria-label="<?php esc_attr_e( 'Page contents', 'peptide-starter' ); ?>">
+					<h3><?php esc_html_e( 'Contents', 'peptide-starter' ); ?></h3>
+					<!-- JavaScript-generated ToC will be inserted here -->
+				</nav>
+			</aside>
+		<?php endif; ?>
+	</div>
+</main>
+
+<?php
+get_footer();

page-subscribe.php

@@ -0,0 +1,44 @@
+<?php
+/**
+ * Template Name: Subscribe
+ *
+ * Single-column, signup-form-centric layout for the /subscribe/ landing page.
+ * Lighter than the methodology / how-we-review templates — no sticky two-column ToC.
+ * This is a conversion page, not a reference page.
+ *
+ * Who calls it: WordPress page loader when page_template meta = page-subscribe.php
+ * Dependencies: Beehiiv embed script (loaded inline below); attribution.js loaded
+ *               site-wide via peptide_starter_enqueue_beehiiv_attribution() in functions.php
+ *
+ * @see footer.php — newsletter CTA in footer column 1
+ * @see single-peptide.php — compact inline form on monograph pages
+ * @package peptide-starter
+ */
+
+get_header();
+?>
+
+<main id="main" class="site-main">
+	<div class="page-subscribe">
+		<div class="page-subscribe__content">
+			<?php
+			while ( have_posts() ) {
+				the_post();
+				?>
+				<article id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
+					<header class="entry-header">
+						<h1 class="entry-title"><?php the_title(); ?></h1>
+					</header>
+					<div class="entry-content">
+						<?php the_content(); ?>
+					</div>
+				</article>
+				<?php
+			}
+			?>
+		</div>
+	</div>
+</main>
+
+<?php
+get_footer();

single-peptide.php

@@ -139,6 +139,25 @@ get_header();
 					?>
 				</article>
 
+				<!-- Newsletter Signup — compact inline form below monograph content -->
+				<div class="peptide-newsletter-cta" style="margin-top: var(--spacing-3xl); padding: var(--spacing-2xl); background: var(--color-surface-subtle, #f8f8f6); border-radius: 8px; border: 1px solid var(--color-border-default);">
+					<p style="margin: 0 0 var(--spacing-md); font-size: 0.95rem; color: var(--color-text-secondary);">
+						<?php esc_html_e( 'Want updates on monographs like this? One email a week, no spam.', 'peptide-starter' ); ?>
+					</p>
+					<div class="beehiiv-embed-wrap" style="max-width: 100%; overflow: hidden;">
+						<script async src="https://subscribe-forms.beehiiv.com/embed.js"></script>
+						<iframe
+							src="https://subscribe-forms.beehiiv.com/6edcd482-cbea-4767-8777-97ac17d6d609"
+							class="beehiiv-embed"
+							data-test-id="beehiiv-embed"
+							frameborder="0"
+							scrolling="no"
+							style="width: 100%; max-width: 100%; height: 180px; margin: 0; border-radius: 4px; background-color: transparent; box-shadow: 0 0 #0000;"
+							title="<?php esc_attr_e( 'Subscribe to Repo Weekly', 'peptide-starter' ); ?>"
+						> </iframe>
+					</div>
+				</div>
+
 				<!-- Navigation -->
 				<nav class="post-navigation" style="margin-top: var(--spacing-3xl); padding-top: var(--spacing-2xl); border-top: 1px solid var(--color-border-default);">
 					<div style="display: flex; justify-content: space-between; gap: var(--spacing-lg);">

site.webmanifest

@@ -0,0 +1,14 @@
+{
+  "name": "Peptide Repo",
+  "short_name": "Peptide Repo",
+  "description": "What the research really says — verdict-driven peptide science.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#FAFAF7",
+  "theme_color": "#1B8A92",
+  "icons": [
+    {"src": "/wp-content/themes/peptide-starter/assets/brand/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any maskable"},
+    {"src": "/wp-content/themes/peptide-starter/assets/brand/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any maskable"}
+  ]
+}

template-parts/affiliate-disclosure.php

@@ -0,0 +1,52 @@
+<?php
+/**
+ * Affiliate Disclosure Component
+ *
+ * Displays FTC-compliant disclosure about affiliate commissions.
+ * Three contexts: inline (default), banner, footer.
+ * Accepts $args['context'].
+ *
+ * @package peptide-starter
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+$context = isset( $args['context'] ) ? sanitize_text_field( $args['context'] ) : 'inline';
+
+// Copy variants (verbatim per CMO spec).
+$inline_copy = 'If you buy through this link, the seller pays Peptide Repo a commission. We don\'t pay to feature any peptide, and our verdicts don\'t change based on who pays.';
+
+$banner_copy = 'Peptide Repo earns a commission when readers buy through links to our fulfillment partners. We are funded by those commissions, not by the peptide brands themselves. No peptide on this site appears here because someone paid us. Our verdicts are decided before we negotiate any partnership, and we drop partners whose product or process degrades.';
+
+$footer_copy = 'Peptide Repo earns a commission on some links. <a href="' . esc_url( home_url( '/about/' ) ) . '#disclosures">' . esc_html__( 'How we work', 'peptide-starter' ) . ' →</a>';
+
+switch ( $context ) {
+	case 'banner':
+		?>
+		<aside class="pr-disclosure pr-disclosure--banner" aria-label="<?php esc_attr_e( 'Affiliate disclosure', 'peptide-starter' ); ?>">
+			<span class="pr-disclosure__label"><?php esc_html_e( 'A note on commerce.', 'peptide-starter' ); ?></span>
+			<?php echo wp_kses_post( $banner_copy ); ?>
+		</aside>
+		<?php
+		break;
+
+	case 'footer':
+		?>
+		<p class="pr-disclosure pr-disclosure--footer">
+			<?php echo wp_kses_post( $footer_copy ); ?>
+		</p>
+		<?php
+		break;
+
+	case 'inline':
+	default:
+		?>
+		<aside class="pr-disclosure pr-disclosure--inline" aria-label="<?php esc_attr_e( 'Affiliate disclosure', 'peptide-starter' ); ?>">
+			<span class="pr-disclosure__label"><?php esc_html_e( 'How we make money:', 'peptide-starter' ); ?></span>
+			<?php echo wp_kses_post( $inline_copy ); ?>
+		</aside>
+		<?php
+		break;
+}

template-parts/module-cards.php

@@ -2,8 +2,10 @@
 /**
  * Template Part: Research Module Cards
  *
- * Renders a 6-card grid of research modules (tools/sections) for the front page.
+ * Renders a 5-card grid of research modules (tools/sections) for the front page.
  * Each card checks if the target plugin is active; inactive cards are dimmed.
+ * Cards with 'coming_soon' => true display a "Coming soon" badge overlaid in
+ * the top-right corner — layered on top of the --inactive visual treatment.
  *
  * @see front-page.php — includes this template part
  * @see style.css — .ps-module-* classes
@@ -21,48 +23,48 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 // Module card definitions with shortcode checks for graceful degradation.
+// 'coming_soon' => true adds a "Coming soon" badge without removing existing
+// --inactive styling — the badge layers on top of the dim/no-hover treatment.
 $modules = array(
 	array(
 		'title'       => __( 'Peptides', 'peptide-starter' ),
-		'description' => __( 'Browse the complete reagent directory with protocols and research parameters.', 'peptide-starter' ),
+		'description' => __( 'Read the verdicts. 20 monographs across 5 evidence states, growing weekly.', 'peptide-starter' ),
 		'url'         => '/peptides',
 		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L12 22"/><path d="M5 12C5 8.13 8.13 5 12 5s7 3.13 7 7-3.13 7-7 7-7-3.13-7-7z"/><circle cx="12" cy="8" r="1.5" fill="currentColor" stroke="none"/><circle cx="12" cy="16" r="1.5" fill="currentColor" stroke="none"/></svg>',
 		'available'   => shortcode_exists( 'peptide_directory' ) || post_type_exists( 'peptide' ),
+		'coming_soon' => false,
 	),
 	array(
 		'title'       => __( 'Calculator', 'peptide-starter' ),
-		'description' => __( 'Precision reconstitution calculator for accurate laboratory preparations.', 'peptide-starter' ),
+		'description' => __( 'Reconstitute a peptide accurately. Enter the vial, the bacteriostatic water, the target dose; get the units.', 'peptide-starter' ),
 		'url'         => '/calculator',
 		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="2" width="16" height="20" rx="2"/><line x1="8" y1="6" x2="16" y2="6"/><line x1="8" y1="10" x2="10" y2="10"/><line x1="14" y1="10" x2="16" y2="10"/><line x1="8" y1="14" x2="10" y2="14"/><line x1="14" y1="14" x2="16" y2="14"/><line x1="8" y1="18" x2="16" y2="18"/></svg>',
-		'available'   => shortcode_exists( 'peptide_tools_calculator' ),
+		'available'   => shortcode_exists( 'prc_calculator' ),
+		'coming_soon' => false,
 	),
 	array(
 		'title'       => __( 'Protocol Builder', 'peptide-starter' ),
-		'description' => __( 'Interactive multi-step wizard for designing research protocols.', 'peptide-starter' ),
+		'description' => __( 'Build a protocol you can hand to anyone. Doses, schedule, notes, reviewable history.', 'peptide-starter' ),
 		'url'         => '/protocol-builder',
 		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2"/><rect x="9" y="3" width="6" height="4" rx="1"/><path d="M9 14l2 2 4-4"/></svg>',
 		'available'   => shortcode_exists( 'peptide_tools_protocol_builder' ),
+		'coming_soon' => true,
 	),
 	array(
 		'title'       => __( 'Tracker', 'peptide-starter' ),
-		'description' => __( 'Log doses, manage active compounds, and forecast vial depletion timelines.', 'peptide-starter' ),
+		'description' => __( 'Log doses and timing. For people running their own protocols, and people supervising someone else\'s.', 'peptide-starter' ),
 		'url'         => '/tracker',
 		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/><line x1="3" y1="20" x2="21" y2="20"/></svg>',
 		'available'   => shortcode_exists( 'peptide_tracker' ),
-	),
-	array(
-		'title'       => __( 'Science Feed', 'peptide-starter' ),
-		'description' => __( 'Latest research publications, clinical studies, and laboratory insights.', 'peptide-starter' ),
-		'url'         => '/news',
-		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 22h16a2 2 0 002-2V4a2 2 0 00-2-2H8a2 2 0 00-2 2v16a2 2 0 01-2 2zm0 0a2 2 0 01-2-2v-9c0-1.1.9-2 2-2h2"/><line x1="10" y1="6" x2="18" y2="6"/><line x1="10" y1="10" x2="18" y2="10"/><line x1="10" y1="14" x2="14" y2="14"/></svg>',
-		'available'   => shortcode_exists( 'peptide_news' ),
+		'coming_soon' => true,
 	),
 	array(
 		'title'       => __( 'Subject Log', 'peptide-starter' ),
-		'description' => __( 'Longitudinal tracking for biomarker data and protocol history.', 'peptide-starter' ),
+		'description' => __( 'Track outcomes over time. Subjective markers, lab results, protocol changes — your own data, kept private.', 'peptide-starter' ),
 		'url'         => '/subject-log',
 		'icon'        => '<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 00-4-4H8a4 4 0 00-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>',
 		'available'   => shortcode_exists( 'peptide_tracker_subject_log' ),
+		'coming_soon' => true,
 	),
 );
 ?>
@@ -70,9 +72,9 @@ $modules = array(
 <section class="ps-modules-section">
 	<div class="ps-container-wide">
 		<div class="ps-modules-header">
-			<h2 class="ps-modules-title"><?php esc_html_e( 'Research Modules', 'peptide-starter' ); ?></h2>
+			<h2 class="ps-modules-title"><?php esc_html_e( 'Tools', 'peptide-starter' ); ?></h2>
 			<p class="ps-modules-subtitle">
-				<?php esc_html_e( 'Tools and resources for laboratory research and data management.', 'peptide-starter' ); ?>
+				<?php esc_html_e( 'Free to use. Built for people running their own protocols, and people deciding whether they should.', 'peptide-starter' ); ?>
 			</p>
 		</div>
 
@@ -80,6 +82,9 @@ $modules = array(
 			<?php foreach ( $modules as $module ) : ?>
 				<a href="<?php echo esc_url( home_url( $module['url'] ) ); ?>"
 				   class="ps-module-card <?php echo $module['available'] ? '' : 'ps-module-card--inactive'; ?>">
+					<?php if ( ! empty( $module['coming_soon'] ) ) : ?>
+						<span class="ps-module-card__badge"><?php esc_html_e( 'Coming soon', 'peptide-starter' ); ?></span>
+					<?php endif; ?>
 					<div class="ps-module-card__icon">
 						<?php
 						// SVG icons are defined in this template — safe to output directly.
@@ -96,3 +101,4 @@ $modules = array(
 		</div>
 	</div>
 </section>
+

template-parts/verdict/badge.php

@@ -0,0 +1,54 @@
+<?php
+/**
+ * Verdict Badge Component
+ *
+ * Displays a verdict state badge with glyph, label, and colors.
+ * Accepts $args['verdict_state'] and $args['show_label'].
+ *
+ * @package peptide-starter
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+$verdict_state = isset( $args['verdict_state'] ) ? sanitize_text_field( $args['verdict_state'] ) : '';
+$show_label    = isset( $args['show_label'] ) ? (bool) $args['show_label'] : true;
+
+// State configuration.
+$states = array(
+	'established'      => array(
+		'glyph' => '✓',
+		'label' => 'Established',
+	),
+	'promising'        => array(
+		'glyph' => '◐',
+		'label' => 'Promising',
+	),
+	'investigational'  => array(
+		'glyph' => '?',
+		'label' => 'Investigational',
+	),
+	'insufficient'     => array(
+		'glyph' => '⊘',
+		'label' => 'Insufficient Evidence',
+	),
+	'cautionary'       => array(
+		'glyph' => '⚠',
+		'label' => 'Cautionary',
+	),
+);
+
+// Early exit if invalid state.
+if ( ! isset( $states[ $verdict_state ] ) ) {
+	return;
+}
+
+$state_info = $states[ $verdict_state ];
+?>
+<span class="pr-verdict pr-verdict--<?php echo esc_attr( $verdict_state ); ?>" role="img" aria-label="<?php echo esc_attr( 'Verdict: ' . $state_info['label'] ); ?>">
+	<span class="pr-verdict__glyph" aria-hidden="true"><?php echo $state_info['glyph']; ?></span>
+	<?php if ( $show_label ) : ?>
+		<span class="pr-verdict__label"><?php echo esc_html( $state_info['label'] ); ?></span>
+	<?php endif; ?>
+</span>

template-parts/verdict/card.php

@@ -0,0 +1,105 @@
+<?php
+/**
+ * Verdict Card Component (Monograph Hero)
+ *
+ * Displays the full verdict card hero for a peptide post.
+ * Reads verdict_state, verdict_text, signal_row_1/2/3, and
+ * signal_row_1/2/3_glyph from post meta.
+ *
+ * Who calls it: single-peptide.php for posts with a verdict_state.
+ * Depends on: inc/verdict-meta.php (meta registration),
+ *             template-parts/verdict/badge.php,
+ *             template-parts/verdict/evidence-row.php.
+ *
+ * @see inc/verdict-meta.php
+ * @see single-peptide.php
+ * @package peptide-starter
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+$post_id = isset( $args['post_id'] ) ? absint( $args['post_id'] ) : get_the_ID();
+
+// Get verdict state; bail early if unset.
+$verdict_state = get_post_meta( $post_id, 'verdict_state', true );
+if ( empty( $verdict_state ) ) {
+	return;
+}
+
+// Get opinionated verdict text; fall back to placeholder if not yet authored.
+$verdict_text = get_post_meta( $post_id, 'verdict_text', true );
+if ( empty( $verdict_text ) ) {
+	$verdict_text = __( 'This peptide merits careful scientific review. Please consult with a healthcare provider before use.', 'peptide-starter' );
+}
+
+// Collect signal rows with their per-row glyphs.
+// Glyph comes from the signal_row_N_glyph meta field; if unset, no glyph is
+// rendered. This is intentional — a missing glyph is better than a wrong one.
+$signals = array();
+for ( $i = 1; $i <= 3; $i++ ) {
+	$signal_text  = get_post_meta( $post_id, 'signal_row_' . $i, true );
+	$signal_glyph = get_post_meta( $post_id, 'signal_row_' . $i . '_glyph', true );
+	if ( ! empty( $signal_text ) ) {
+		$signals[] = array(
+			'glyph' => $signal_glyph, // May be empty string; evidence-row handles that.
+			'label' => $signal_text,
+		);
+	}
+}
+?>
+<div class="pr-verdict-card">
+	<div class="pr-verdict-card__header">
+		<div>
+			<?php
+			get_template_part(
+				'template-parts/verdict/badge',
+				null,
+				array(
+					'verdict_state' => $verdict_state,
+					'show_label'    => true,
+				)
+			);
+			?>
+		</div>
+		<!-- last_reviewed_date timestamp deferred to v1.1 — WP post date != editorial review date -->
+	</div>
+
+	<h1 class="pr-verdict-card__title"><?php echo esc_html( get_the_title( $post_id ) ); ?></h1>
+
+	<p class="pr-verdict-card__summary">
+		<?php
+		$summary = get_the_excerpt( $post_id );
+		if ( empty( $summary ) ) {
+			$content = get_the_content( null, false, $post_id );
+			$summary = wp_trim_words( $content, 20 );
+		}
+		echo wp_kses_post( $summary );
+		?>
+	</p>
+
+	<?php if ( ! empty( $signals ) ) : ?>
+		<?php
+		get_template_part(
+			'template-parts/verdict/evidence-row',
+			null,
+			array( 'signals' => $signals )
+		);
+		?>
+	<?php endif; ?>
+
+	<div class="pr-verdict-card__verdict-label"><?php esc_html_e( 'Our verdict:', 'peptide-starter' ); ?></div>
+	<div class="pr-verdict-card__verdict-text">
+		<?php echo wp_kses_post( nl2br( $verdict_text ) ); ?>
+	</div>
+
+	<div class="pr-verdict-card__cta-group">
+		<a href="#evidence" class="pr-verdict-card__cta-link">
+			<?php esc_html_e( 'Read the full evidence', 'peptide-starter' ); ?> →
+		</a>
+		<a href="#dosing" class="pr-verdict-card__cta-link">
+			<?php esc_html_e( 'Jump to dosing', 'peptide-starter' ); ?> →
+		</a>
+	</div>
+</div>

template-parts/verdict/evidence-row.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Verdict Evidence Signal Row Component
+ *
+ * Displays an inset row of evidence signals with glyphs.
+ * Accepts $args['signals'] as array of ['glyph' => '...', 'label' => '...']
+ *
+ * @package peptide-starter
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+$signals = isset( $args['signals'] ) && is_array( $args['signals'] ) ? $args['signals'] : array();
+
+if ( empty( $signals ) ) {
+	return;
+}
+?>
+<div class="pr-evidence-row">
+	<?php foreach ( $signals as $signal ) : ?>
+		<?php
+		$glyph = isset( $signal['glyph'] ) ? sanitize_text_field( $signal['glyph'] ) : '';
+		$label = isset( $signal['label'] ) ? sanitize_text_field( $signal['label'] ) : '';
+		?>
+		<?php if ( ! empty( $glyph ) && ! empty( $label ) ) : ?>
+			<div class="pr-evidence-row__item">
+				<span class="pr-evidence-row__glyph"><?php echo esc_html( $glyph ); ?></span>
+				<span><?php echo esc_html( $label ); ?></span>
+			</div>
+		<?php endif; ?>
+	<?php endforeach; ?>
+</div>

tests/test-perf-asset-policy.php

@@ -0,0 +1,203 @@
+<?php
+/**
+ * Tests for inc/perf-asset-policy.php.
+ *
+ * Covers: conditional dequeue logic (Elementor, USMI), font weight slimming,
+ * preconnect hints, script defer, kill-switch, and filter overrides.
+ *
+ * @package peptide-starter
+ */
+
+/**
+ * Test perf-asset-policy module initialization and hooks.
+ */
+class Test_Perf_Asset_Policy extends WP_UnitTestCase {
+
+	/**
+	 * Test: Kill-switch constant disables all dequeue logic.
+	 *
+	 * When PEPTIDE_STARTER_PERF_DEQUEUE is defined false, the dequeue function
+	 * should early-return without removing anything.
+	 */
+	public function test_kill_switch_disables_dequeue() {
+		// Define kill-switch to false.
+		define( 'PEPTIDE_STARTER_PERF_DEQUEUE', false );
+
+		// Enqueue dummy styles.
+		wp_enqueue_style( 'elementor-frontend', 'http://example.com/elementor.css' );
+
+		// Simulate wp_enqueue_scripts action.
+		do_action( 'wp_enqueue_scripts' );
+
+		// Since kill-switch is off, the style should still be queued.
+		$this->assertTrue( wp_style_is( 'elementor-frontend', 'enqueued' ) );
+	}
+
+
+
+	/**
+	 * Test: Elementor assets dequeued on pages without Elementor.
+	 *
+	 * A non-Elementor page should have Elementor CSS dequeued.
+	 */
+	public function test_elementor_dequeue_on_non_elementor_page() {
+		// Create a post without Elementor.
+		$post_id = $this->factory->post->create();
+
+		$this->go_to( get_permalink( $post_id ) );
+
+		// Enqueue Elementor styles.
+		wp_enqueue_style( 'elementor-frontend', 'http://example.com/elementor.css' );
+
+		// Verify the page doesn't use Elementor.
+		$uses_elementor = peptide_starter_page_uses_elementor( $post_id );
+		$this->assertFalse( $uses_elementor );
+
+		// Run dequeue.
+		peptide_starter_perf_dequeue_plugin_assets();
+
+		// Elementor should be dequeued.
+		$this->assertFalse( wp_style_is( 'elementor-frontend', 'enqueued' ) );
+	}
+
+	/**
+	 * Test: USMI assets dequeued on homepage.
+	 */
+	public function test_usmi_dequeue_on_homepage() {
+		$this->go_to( home_url( '/' ) );
+
+		// Enqueue USMI assets.
+		wp_enqueue_style( 'SFSImainCss', 'http://example.com/sfsi.css' );
+		wp_enqueue_script( 'SFSICustomJs', 'http://example.com/sfsi.js' );
+
+		// Run dequeue.
+		peptide_starter_perf_dequeue_plugin_assets();
+
+		// USMI assets should be dequeued on homepage.
+		$this->assertFalse( wp_style_is( 'SFSImainCss', 'enqueued' ) );
+		$this->assertFalse( wp_script_is( 'SFSICustomJs', 'enqueued' ) );
+	}
+
+	/**
+	 * Test: Font slim rewrites Roboto weights.
+	 *
+	 * A URL with Roboto:100,200,...900 should be rewritten to 400,500,700.
+	 */
+	public function test_font_slim_roboto() {
+		$original_url = 'https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,600,700,800,900&display=swap';
+		$slimmed_url = peptide_starter_perf_slim_google_fonts( $original_url, 'google-fonts-roboto' );
+
+		// Should contain 400,500,700.
+		$this->assertStringContainsString( 'Roboto', $slimmed_url );
+		$this->assertStringContainsString( '400', $slimmed_url );
+		$this->assertStringContainsString( '500', $slimmed_url );
+		$this->assertStringContainsString( '700', $slimmed_url );
+
+		// Should NOT contain 100, 200, 800, 900.
+		$this->assertStringNotContainsString( '100', $slimmed_url );
+		$this->assertStringNotContainsString( '200', $slimmed_url );
+		$this->assertStringNotContainsString( '800', $slimmed_url );
+		$this->assertStringNotContainsString( '900', $slimmed_url );
+	}
+
+	/**
+	 * Test: Font slim ignores non-configured fonts.
+	 *
+	 * A font that isn't in the config should pass through unchanged.
+	 */
+	public function test_font_slim_ignores_non_configured_fonts() {
+		$original_url = 'https://fonts.googleapis.com/css?family=Open+Sans:400,700&display=swap';
+		$result_url = peptide_starter_perf_slim_google_fonts( $original_url, 'google-fonts-open-sans' );
+
+		// Should pass through unchanged.
+		$this->assertEqual( $original_url, $result_url );
+	}
+
+	/**
+	 * Test: Font slim respects filter override.
+	 *
+	 * Custom weights via 'peptide_starter_perf_font_weights' filter should apply.
+	 */
+	public function test_font_slim_filter_override() {
+		$original_url = 'https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,600,700,800,900&display=swap';
+
+		// Add filter to override Roboto weights to just 400.
+		add_filter(
+			'peptide_starter_perf_font_weights',
+			function ( $config ) {
+				$config['Roboto'] = array( 400 );
+				return $config;
+			}
+		);
+
+		$slimmed_url = peptide_starter_perf_slim_google_fonts( $original_url, 'google-fonts-roboto' );
+
+		// Should contain only 400, not 500 or 700.
+		$this->assertStringContainsString( '400', $slimmed_url );
+		$this->assertStringNotContainsString( '500', $slimmed_url );
+		$this->assertStringNotContainsString( '700', $slimmed_url );
+	}
+
+	/**
+	 * Test: Preconnect hints are added.
+	 *
+	 * The preconnect filter should add fonts.googleapis.com and fonts.gstatic.com.
+	 */
+	public function test_preconnect_hints_added() {
+		$urls = array();
+		$result = peptide_starter_perf_resource_hints( $urls, 'preconnect' );
+
+		$this->assertContains( 'https://fonts.googleapis.com', $result );
+		$this->assertContains( 'https://fonts.gstatic.com', $result );
+	}
+
+	/**
+	 * Test: Preconnect ignores other hint types.
+	 *
+	 * Only 'preconnect' relationship should get font URLs; dns-prefetch etc. should not.
+	 */
+	public function test_preconnect_ignores_other_relationships() {
+		$urls = array();
+		$result = peptide_starter_perf_resource_hints( $urls, 'dns-prefetch' );
+
+		// Should not add font URLs for dns-prefetch.
+		$this->assertNotContains( 'https://fonts.googleapis.com', $result );
+		$this->assertNotContains( 'https://fonts.gstatic.com', $result );
+	}
+
+	/**
+	 * Test: Defer applied to cookie-notice script.
+	 *
+	 * The script_loader_tag filter should add 'defer' to cookie-notice-front.
+	 */
+	public function test_defer_cookie_notice() {
+		$tag = '<script src="http://example.com/cookie-notice.js"></script>';
+		$result = peptide_starter_perf_defer_cookie_notice( $tag, 'cookie-notice-front', 'http://example.com/cookie-notice.js' );
+
+		$this->assertStringContainsString( 'defer', $result );
+	}
+
+	/**
+	 * Test: Defer not applied to other scripts.
+	 *
+	 * The defer filter should only affect cookie-notice-front, not other handles.
+	 */
+	public function test_defer_not_applied_to_other_scripts() {
+		$tag = '<script src="http://example.com/other.js"></script>';
+		$result = peptide_starter_perf_defer_cookie_notice( $tag, 'other-script', 'http://example.com/other.js' );
+
+		// Should not have defer added.
+		$this->assertStringNotContainsString( 'defer', $result );
+	}
+
+	/**
+	 * Test: page_uses_elementor helper returns false for non-singular.
+	 */
+	public function test_page_uses_elementor_non_singular() {
+		// Go to homepage (not singular).
+		$this->go_to( home_url( '/' ) );
+
+		$result = peptide_starter_page_uses_elementor( 0 );
+		$this->assertFalse( $result );
+	}
+}