Remove duplicate comment, captcha, filing, and website-security configuration paths.
Move front submission verification to the captcha scene matrix and retire obsolete admin routes and components.
- P1: remove the duplicate "审核联动" (ai_moderate_background/submit)
block from the attachment permissions page; those settings live in
the "评论审核" / API content audit surfaces.
- P2: rename the "内容审核" submenu to "评论审核" (permissions domain).
- P4: remove the "下载/付费内容中心" page and its schema/route chain;
hardcode runtime policy so download always supports credit purchase
and paid content is limited to posts. Drop the now-dead
cms_features.download_credit flag and parse_slug_list helper.
Fix modal scroll ownership and certification modal styling, store evidence as Media Library attachments, reconcile missed provider callbacks, validate currencies, and complete digital fulfillment only after durable entitlement delivery.
Replace user_badge_dictionary textarea with structured user_medal_*
catalog (categories/items/get_type). Expand verify SPA/PHP to Zibll
apply fields. Reader derives badge.dictionary from medal catalog for
existing AKSRT_User_Badges wear/grant runtime. No dual-read of old
pipe dictionary. audit-admin-contracts: 0 errors.
Connect header_components_show_on through aksrt_header_slide_is_show with
zibll page-type matching, drop the homepage-only gate, align admin options,
apply nav color, enqueue by is_show, remove dead float-btn schema, and
consume footer_tabbar_single extend mode on post singles.
SPA shop/forum/payment/users sections now keep configuration pages only.
Operational workbenches were removed from the sidebar and loaders; legacy
hash routes open NativeOpsRedirect into the matching WP native admin page.
Admin SPA production build refreshed accordingly.
Route can_download/Download_State/permission card through Content_Visibility need_purchase; drop download_credit as a second toll; clarify admin labels for points purchase mode.
Rewrite charge-card into typed single-use card_pass inventory with public redeem REST, user-center UI for balance/VIP, admin type-aware create/batch, and CAS mark-used fulfillment via Credits/activate_vip.
Align enabled-meta semantics with frontend, allow truly empty titles on
update, use router navigation for manager deep-links, and document fixed
skeleton ownership in module schema copy.
Wire existing HeroManager/BannerManager into page-display routes and
component loaders, fix banner REST round-trip (show_meta + optional title),
and retarget operator deep-links to the real slide managers.
Add bind_phone captcha scene across schema/runtime/UI, require captcha on
phone bind, return real captcha status objects instead of legacy option
aliases, and harden form discovery for page-sign auth forms.
Gate preprocess_comment so native wp-comments-post cannot bypass captcha,
require verify+reset on phone register, and align UsersSignin status with
active provider.
Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.
update_option returns false when values are identical, which made
POST /ai/settings respond 400 with "保存失败" on no-op saves and
masked-key re-saves. Normalize config, accept no-op as success, and
only send a new API key from the admin form when entered.
Rewrite footer markup to zib_footer_con contract: single adaptive logo
(white-src/dark-src), fcode-links HTML primary, float third column,
hidden-xs, toggle-radius contacts, miniimg structure, customize-first
footer-conter. Restyle zibll-shell CSS and drop conflicting site-footer
BEM padding so filled footer data matches Zibll layout.
kate522
