diff --git a/tests/widget-system/icon-picker-contract.test.cjs b/tests/widget-system/icon-picker-contract.test.cjs
new file mode 100644
index 00000000..a254529e
--- /dev/null
+++ b/tests/widget-system/icon-picker-contract.test.cjs
@@ -0,0 +1,104 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.resolve(__dirname, '..', '..');
+const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
+
+test('universal icon picker ships catalog data for the bundled FA5 fonts', () => {
+  const data = read('src/Icons/fa5-icons.php');
+  assert.match(data, /Font Awesome 5 Free \(5\.15\.4\)/);
+  assert.match(data, /'fas' =>/, 'solid group');
+  assert.match(data, /'far' =>/, 'regular group');
+  assert.match(data, /'fab' =>/, 'brands group');
+  const names = data.match(/'([a-z0-9-]+)'/g) || [];
+  assert.ok(names.length > 1500, 'generated catalog is the full bundled set');
+  for (const must of ["'clock'", "'folder-open'", "'file-alt'", "'weixin'"]) {
+    assert.match(data, new RegExp(must), `FA5 name ${must} present (FA4 leftovers replaced)`);
+  }
+  assert.doesNotMatch(data, /fa-clock-o|fa-folder-open-o|fa-file-text-o/, 'no FA4-only names');
+});
+
+test('icon catalog REST route is registered with permission + sprite single source', () => {
+  const admin = read('src/Admin/Admin.php');
+  assert.match(admin, /\AKSRT\\Icons\\IconController::class/);
+  const controller = read('src/Icons/IconController.php');
+  assert.match(controller, /\/icons\/catalog/);
+  assert.match(controller, /permission_callback.*check_permission/s);
+  const catalog = read('src/Icons/IconCatalog.php');
+  assert.match(catalog, /svg-icon\.js/);
+  assert.match(catalog, /aksrt_svgs/);
+  assert.match(catalog, /fa5-icons\.php/);
+});
+
+test('widget and nav-menu icon fields render the shared picker', () => {
+  const formRenderer = read('src/WidgetSystem/FormRenderer.php');
+  assert.match(formRenderer, /case 'icon':\s*\n\s*echo aksrt_icon_picker_field\(\$field_name, \$field_id, \(string\) \$value\);/);
+  assert.doesNotMatch(formRenderer, /aksrt-widget-icon/);
+  const adminForm = read('src/WidgetSystem/AdminFormController.php');
+  assert.match(adminForm, /aksrt_icon_picker_assets\(/);
+  const navMenu = read('src/Admin/NavMenuOptions.php');
+  assert.match(navMenu, /aksrt_icon_picker_field\(/);
+  assert.match(navMenu, /aksrt_sanitize_icon_value\(\(string\) \(\$raw\['icon'\] \?\? ''\)\)/);
+  const helper = read('inc/helpers/aksrt-icon-picker.php');
+  for (const token of ['function aksrt_icon_picker_assets', 'function aksrt_icon_picker_field', 'id="aksrt-modal-icon"', 'aksrt-icon-picker__value']) {
+    assert.match(helper, new RegExp(token));
+  }
+  assert.match(helper, /assets\/js\/runtime\/svg-icon\.js/, 'admin previews reuse the frontend sprite');
+});
+
+test('picker JS composes the three value formats and loads the REST catalog', () => {
+  const js = read('assets/js/admin-icon-picker.js');
+  for (const token of ['X-WP-Nonce', 'customsvg-', 'zibsvg-', '`fa ${group.id} fa-${name}`', 'data-aksrt-icon-picker', 'aksrt-icon-picker__value']) {
+    assert.match(js, new RegExp(token.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  }
+  assert.match(js, /DOMParser/, 'custom SVG is sanitized client side');
+  const cssPath = 'assets/css/admin-icon-picker.css';
+  assert.ok(fs.existsSync(path.join(root, cssPath)), 'picker css shipped');
+});
+
+test('icon values sanitize through the SVG-aware helper on every save path', () => {
+  const iconsHelper = read('inc/helpers/aksrt-icons.php');
+  assert.match(iconsHelper, /function aksrt_sanitize_icon_value/);
+  assert.match(iconsHelper, /function aksrt_icon_markup/);
+  assert.match(iconsHelper, /function aksrt_enqueue_fontawesome/);
+  assert.match(iconsHelper, /str_starts_with\(\$value, 'customsvg-'\)/);
+  const schemaProvider = read('src/Admin/SchemaProvider.php');
+  assert.match(schemaProvider, /'icon'\s+=>\s+'icon'/);
+  assert.match(schemaProvider, /case 'icon':\s*\n\s*return function_exists\('aksrt_sanitize_icon_value'\)/);
+  const fieldSchema = read('src/WidgetSystem/FieldSchema.php');
+  assert.match(fieldSchema, /case 'icon':\s*\n\s*return function_exists\('aksrt_sanitize_icon_value'\)/);
+});
+
+test('FA5 loads under a single canonical handle everywhere', () => {
+  const picker = read('inc/helpers/aksrt-icon-picker.php');
+  const admin = read('src/Admin/Admin.php');
+  const coreHooks = read('inc/core-hooks.php');
+  const part1b = read('src/Core/ScriptsPart1b.php');
+  assert.match(picker, /aksrt_enqueue_fontawesome\(\)/);
+  assert.match(admin, /aksrt_enqueue_fontawesome\(\)/);
+  assert.match(coreHooks, /aksrt_enqueue_fontawesome\(\)/);
+  assert.match(part1b, /aksrt_enqueue_fontawesome\(\['bootstrap'\]\)/);
+  assert.match(part1b, /\['aksrt-font-awesome'\]/, 'public main css depends on the canonical handle');
+  for (const file of [picker, admin, coreHooks, part1b]) {
+    assert.doesNotMatch(file, /wp_enqueue_style\(\s*'aksrt-font-awesome'/, 'no duplicate FA registrations');
+  }
+  for (const file of ['inc/helpers/aksrt-widgets-markup.php', 'src/WidgetSystem/Renderers/ContentRenderer.php']) {
+    const source = read(file);
+    assert.doesNotMatch(source, /fa-clock-o|fa-folder-open-o|fa-file-text-o/, `${file} uses FA5 names`);
+  }
+});
+
+test('icon assets are consolidated and dead icon assets are gone', () => {
+  for (const file of ['assets/icons/upload-add.svg', 'assets/icons/default-favicon.svg', 'assets/icons/default-logo.svg', 'assets/icons/playing.svg', 'assets/icons/user-certification.svg']) {
+    assert.ok(fs.existsSync(path.join(root, file)), `${file} exists`);
+  }
+  for (const file of ['assets/img/upload-add.svg', 'assets/img/vip-1.svg', 'assets/img/vip-2.svg', 'assets/img/404.svg', 'assets/img/msg-system.svg', 'assets/fonts/img-code.ttf', 'assets/js/runtime/gutenberg-extend.js', 'assets/fontawesome5/webfonts/fa-solid-900.ttf']) {
+    assert.ok(!fs.existsSync(path.join(root, file)), `${file} removed`);
+  }
+  const mainCss = read('assets/css/main.css');
+  assert.match(mainCss, /url\(\.\.\/icons\/playing\.svg\)/);
+  const phpRefs = read('inc/helpers/comments/form-parts.php');
+  assert.match(phpRefs, /\/assets\/icons\/upload-add\.svg/);
+});