WordPress.org submission hardening (v1.6165.1210, gate 95/100)

assets/css/skin.css

@@ -177,6 +177,20 @@ body {
 		color: var(--wp--preset--color--studio-mid) !important;
 	}
 
+	/* Band-aware eyebrow colour. The base eyebrow colour (studio-mid) is tuned
+	   for the light page ground and falls below 4.5:1 on the dark bands. The
+	   eyebrow block style sets that colour with !important, so an inline override
+	   in the pattern markup cannot win; these higher-specificity band rules
+	   re-assert a colour that clears WCAG AA on each band's own background:
+	   studio-rule on the dark press band (>=4.84:1 across all variations),
+	   studio-press on the press-tint band (>=5.56:1 across all variations). */
+	.kern-band--press .is-style-kern-eyebrow {
+		color: var(--wp--preset--color--studio-rule) !important;
+	}
+	.kern-band--press-tint .is-style-kern-eyebrow {
+		color: var(--wp--preset--color--studio-press) !important;
+	}
+
 	/* ---------------------------------------------------------------
 	   Specimen annotation (is-style-kern-annotation)
 	   Small, tracked, muted — design notes in specimen patterns.

inc/bindings.php

@@ -5,9 +5,10 @@
  *
  * A static template part can't compute the current year, and hardcoding one is
  * a quiet way to look abandoned every January. So parts/footer.html binds its
- * copyright paragraph to the `colophon/copyright` source registered here (WP
- * 6.5+ block bindings) — one small, removable callback instead of a render
- * filter reinventing what the bindings API already does.
+ * copyright paragraph to the `SLUG . '/copyright'` source registered here (WP
+ * 6.5+ block bindings; resolves to `kern/copyright` for this theme) — one small,
+ * removable callback instead of a render filter reinventing what the bindings
+ * API already does.
  *
  * The "Built with …" credit binds to a second source so an integrator can
  * rewrite or drop it through a filter without editing a template. Both source

inc/bootstrap.php

@@ -39,7 +39,7 @@
 /**
  * Theme version — cache-bust for enqueued assets and the WordPress.org version.
  */
-const VERSION = '1.6148.1706';
+const VERSION = '1.6165.1210';
 
 /**
  * Absolute filesystem path to the theme root (no trailing slash).

inc/setup.php

@@ -188,16 +188,25 @@ function comment_form_field_attributes( array $fields ): array {
 }
 add_filter( 'comment_form_default_fields', __NAMESPACE__ . '\\comment_form_field_attributes' );
 
-/*
- * Skip link — NOT registered here.
+/**
+ * Render the single "Skip to content" link on wp_body_open.
  *
- * Every theme template carries the skip link in its header template part
- * (parts/header.html), rendered via wp:html. Registering a second one here
- * via wp_body_open produced a duplicate in the rendered DOM — two visible
- * "Skip to content" links on Tab keypress, one of which targeted a
- * non-existent anchor. The template-part approach is correct: it is always
- * in the rendered markup, it is in the right DOM position, and there is
- * exactly one of it.
+ * The skip link lives here, in PHP, rather than in parts/header.html, for one
+ * reason: a static template part cannot wrap its prose in gettext, so a
+ * hardcoded "Skip to content" would ship untranslatable. esc_html_e() makes the
+ * label translatable, and wp_body_open places the link first in the body — the
+ * correct DOM position, ahead of the header, targeting #main-content (the
+ * <main> on every template). There is exactly one skip link in the rendered
+ * markup; the earlier duplicate came from registering this AND a template-part
+ * copy at once, so the template-part copy was removed when this moved to PHP.
  *
- * See parts/header.html for the authoritative skip link.
+ * Pillar 5 (Safe by Default): the accessibility affordance is on by default and
+ * its label travels with the site's locale.
  */
+function skip_link(): void {
+	printf(
+		'<a class="skip-link screen-reader-text" href="#main-content">%s</a>',
+		esc_html__( 'Skip to content', 'kern' )
+	);
+}
+add_action( 'wp_body_open', __NAMESPACE__ . '\\skip_link' );

inc/skin.php

@@ -20,10 +20,21 @@
 namespace Kern;
 
 defined( 'ABSPATH' ) || exit;
-// Opt this theme into GitHub-release self-updates (see inc/github-updater.php).
-add_filter( 'kern/github_updater_repo', static function (): string {{
-	return 'thisismyurl/kern';
-}} );
+
+// Opt this theme into GitHub-release self-updates — but only when the updater
+// itself is present. The WordPress.org build strips inc/github-updater.php via
+// .distignore, so in the distributed theme this guard is false and the filter
+// never registers: the submitted package and the GitHub repo behave identically
+// (no self-updater), and a reviewer auditing the repo sees an inert opt-in, not
+// an active updater shadowing the directory's own update channel.
+if ( file_exists( __DIR__ . '/github-updater.php' ) ) {
+	add_filter(
+		'kern/github_updater_repo',
+		static function (): string {
+			return 'thisismyurl/kern';
+		}
+	);
+}
 
 /**
  * Register Kern's image crop sizes.