nav: one registry drives the sidebar; the battery names its lane (items 16+17) — STAGED, unpushed

Item 16, ported as contract. The sidebar is generated from frontmatter
`category:` + `order:` in CATEGORY_ORDER instead of three hand-typed link
clusters in components/navbar.py. Every page already declared a category;
the navbar ignored them, which is exactly how /audiences/web-crawlers came
to be listed twice — as "Web Crawlers" under This package and as
"A · What the crawler sees" under Showcase. It is listed once now.

The three cluster names survive as category names, per the drop. Gained:
/changelog as a Timeline, a footer, an Other Apps menu built from
network_directory.PRIMARY, lib/aside.py collapsing the aside where no
`.. toc::` fills it, and an Admin section that appears FOR THE OWNER —
previously a blanket /admin/* filter hid both admin pages from everyone
including them. The anonymous tree still carries no /admin/ href.
Lost, deliberately: the sidebar's Pip Components and Other Apps I've built
sections (the network is listed once, in the menu) and everything in
Resources except dmc.

/api is NOT registered, and that is a measurement rather than an omission:
dash_improve_my_llms ships no component metadata — no metadata.json, no
bundled JS, no generated component classes — so there are no props to
tabulate. API_PACKAGES = [].

Also in 16: home renders through markdown2dash rather than dcc.Markdown,
/admin/traffic swaps dcc.Dropdown for dmc.DatePickerInput and gains a
People section above the crawler tables, and the mobile-fit CSS keeps a
code block inside a List item from widening the whole document.

FIXED, found by item 16's own rewritten test: five docs pages hyperlinked
/admin/control-board in their prose, putting an admin path into /llms.txt.
The prose keeps the words and drops the link.

Item 17: the battery's default UA now names the browser lane — a Chrome
token first, the internal token after it (substring match, so the
internal-traffic exclusion still holds), CRAWLER_UA untouched. At dimll
>= 2.8 the bare internal token was crawler-lane, so every default-UA check
was reading the prerendered crawler document. Item 17(b) is
not-applicable here: the only og:image in run.py is a comment describing
the 2.5.0 history, and this fork declares identity through the package's
configure_seo rather than injecting tags.

Cargo-eligibility evidence the item asks for: nine of the eleven files
came out BYTE-IDENTICAL to the template's at 1.6.38. The two that differ
are recorded as DIVERGENCES.md 8, and both seams are the template's, not
this fork's — header.py hardcodes its own 'ddb.png' logo filename, and
test_nav_contract.py names /backend-comparison, a tutorial page this fork
deleted at fork time. DIVERGENCES.md 9 records SAME_AS keeping the PyPI
distribution beside the repo.

Suite: 688 passed / 2 skipped (flask), 685 / 5 (fastapi), 685 / 5 (quart).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EjfiNPKsgLwAxtN3BexPSJ

Author: pip-install-python

CHANGELOG.md

@@ -5,6 +5,68 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [llms-2plot-dev 1.4.0] - 2026-08-30
+
+**Sync items 16 and 17 — the navigation contract and the battery's lane.**
+
+### Added
+
+- **`/changelog`** — this file as a Timeline, linked under Home in the
+  sidebar and from the footer, and served as its own `llms.txt`.
+- **A footer** — © Pip Install Python LLC, the owner's GitHub profile,
+  Discord and YouTube, every icon labelled.
+- **An Admin section in the sidebar, visible to the OWNER.** Both admin
+  pages (`/admin/control-board`, `/admin/traffic`) were previously
+  hidden from everyone including the owner by a blanket `/admin/*` path
+  filter; they are now listed for `is_admin_user()` and for nobody else —
+  the anonymous tree carries no `/admin/` href at all.
+- **An `Other Apps` menu in the top bar**, built from
+  `network_directory.PRIMARY` rather than a hand-typed list.
+- **`lib/aside.py`** — the aside column collapses on pages with no
+  `.. toc::`, so `/changelog` and `/` render full width.
+
+### Changed
+
+- **The sidebar is generated from frontmatter**, not from three
+  hand-typed link clusters in `components/navbar.py`. Every page already
+  declared `category:`; the navbar simply ignored it. Each page now also
+  declares `order:`. **`/audiences/web-crawlers` is listed once** — it
+  appeared twice, as "Web Crawlers" under This package and as
+  "A · What the crawler sees" under Showcase.
+- **The sidebar's `Pip Components` and `Other Apps I've built` sections
+  are gone** — the network is listed once, in the top bar's menu.
+  `Resources` is third-party only: `dmc`. No `community.plotly.com`, no
+  `2plot.dev`.
+- **`pages/home.py` renders through markdown2dash**, not `dcc.Markdown`,
+  so home's headings, tables and code fences match every docs page.
+- **`/admin/traffic` uses `dmc.DatePickerInput`** instead of
+  `dcc.Dropdown`, and gains a **People** section — the day's human hits,
+  visitors, sessions and median session — above the crawler tables, with
+  the line that humans never enter the read ledger.
+- **Mobile fit**: code blocks inside a List item, Blockquote or Timeline
+  scroll in their own box instead of widening the document; the rules are
+  in `main.css` against public Mantine class names, never per page.
+- **`/api` is NOT registered here, and that is a measurement.**
+  `dash_improve_my_llms` ships no component metadata — no
+  `metadata.json`, no bundled JS, no generated component classes
+  (checked on 2.8.0). It is a library of routes, middleware and config
+  objects, so there are no props to tabulate. `API_PACKAGES` is `[]`.
+- **The live battery's default User-Agent names the browser lane**
+  (item 17). At dimll ≥2.8 a UA with no browser engine token is
+  crawler-lane, so `scripts/network_smoke.py`'s bare internal token made
+  every default-UA check read the prerendered crawler document. A Chrome
+  token now leads, the internal token follows it (substring match, so
+  internal-traffic exclusion still holds), and `CRAWLER_UA` is untouched.
+
+### Fixed
+
+- **Admin URLs no longer leak into the machine corpus.** Five pages
+  hyperlinked `/admin/control-board` in their prose, which put an admin
+  path in `/llms.txt`. Found by item 16's rewritten
+  `tests/test_excluded_links_hidden.py`. The prose keeps the words and
+  drops the link — the URL is useless to anyone who cannot authenticate,
+  and publishing it invited crawlers to an admin path.
+
 ## [llms-2plot-dev 1.3.0] - 2026-08-30
 
 **Round 3.4, the posture flip — consumed as sync item 15, with

DIVERGENCES.md

@@ -103,6 +103,36 @@ this host is a worked example. Expect the FIRST promoted run after
 adoption to go red on the wait until the dashboard is switched, and read
 that red as the owner step outstanding, not as a defect in cd.yml.
 
+**8. Two item-16 files are not byte-identical to the template's, and
+both seams are the TEMPLATE's, not this fork's.** 1.6.38 asks each fork
+to report which of the eight navigation files came out byte-identical,
+as the evidence for reclassing them as cargo next round. Nine of the
+eleven files this fork took are identical (`components/navbar.py`,
+`footer.py`, `appshell.py`, `pages/changelog.py`, `pages/api.py`,
+`lib/api_reference.py`, `lib/aside.py`, `lib/network_directory.py`,
+`tests/test_excluded_links_hidden.py`). The two that differ:
+
+  - `components/header.py` — ONE line: `get_asset_url('ddb.png')`. The
+    template hardcodes its own logo filename in the component, so the
+    file still carries fork identity and cannot be cargo until that
+    moves to a constant beside `WORDMARK`. This fork serves
+    `llms.png`.
+  - `tests/test_nav_contract.py` — the aside pin names
+    `/backend-comparison`, a template tutorial page this fork DELETED at
+    fork time (divergence 1). Two of this site's own `.. toc::` pages
+    stand in. Cargo-eligible once the pin picks its paths from the
+    registry rather than naming them.
+
+Recorded so the reclass has the evidence rather than a claim, and so a
+later sync does not read either line as drift.
+
+**9. `SAME_AS` carries the PyPI distribution as well as the repo.** The
+template's 1.6.38 constant is `SAME_AS = [GITHUB_URL]`. This site
+documents a published package, so its JSON-LD identity claims both the
+repo and `https://pypi.org/project/dash-improve-my-llms/` — the
+docs-home ↔ package loop this site exists to close. `GITHUB_URL` itself
+points at the PACKAGE's repo, not this site's, for the same reason.
+
 ## Byte-owned paths
 
 Paths this fork owns byte-for-byte. The F3b fan-out never overwrites

assets/main.css

@@ -228,12 +228,69 @@ input:invalid {
    Element+class selector so it outranks Mantine's own width rule
    regardless of stylesheet load order. markdown2dash stamps m2d-table on
    every table it renders, including kwargs prop tables. */
-table.m2d-table {
+table.m2d-table,
+table.m2d-block-kwargs {
     display: block;
     width: max-content;
     max-width: 100%;
     overflow-x: auto;
 }
+/* (1.6.39) `.. kwargs::` prop tables carry m2d-block-kwargs, not m2d-table
+   — the one table class the rule above never matched; measured on
+   /examples/directives at 391px: a 457px table, a 488px document. */
+
+/* Code blocks scroll inside their own box, wherever they sit (1.6.39;
+   owner-observed on /backend-comparison at phone width). CodeHighlight's
+   <pre> already scrolls, but a flex parent with the default min-width:auto
+   — Mantine's List item wrapper, a Blockquote, a Stack — refuses to shrink
+   below the code's intrinsic width and drags the whole document wide
+   (measured: a 959px document in a 200px viewport, widest element the
+   List itemWrapper around the "Replace @server.before_request" block).
+   Public Mantine class names only — never the hashed .m_* internals. */
+.mantine-List-itemWrapper,
+.mantine-List-itemLabel,
+.mantine-List-item,
+.mantine-Blockquote-root,
+.mantine-Timeline-itemBody,
+.mantine-CodeHighlight-root,
+.mantine-CodeHighlightTabs-root {
+    min-width: 0;
+    max-width: 100%;
+}
+/* The wrapper is inline-flex and the label a block child: without
+   min-width:0 on the LABEL too, it grows to the code's width (measured
+   887px inside a 287px wrapper on /backend-comparison at 391px). */
+.mantine-List-itemWrapper {
+    width: 100%;
+}
+.mantine-List-itemLabel {
+    flex: 1 1 auto;
+}
+/* Timeline bullets (/changelog): a Text in a no-wrap Group grows to its
+   longest unbreakable token — a 60-character test name in a code span —
+   and leaves its card (a 549px document at 391px). Same rule as the
+   component sets inline; here so the stylesheet alone holds the line. */
+.mantine-Timeline-root .mantine-Text-root,
+.mantine-Timeline-root .mantine-Code-root {
+    min-width: 0;
+    overflow-wrap: anywhere;
+}
+/* Inline code in prose: a long unbreakable token (`app.server.before_request`
+   chains, dotted module paths) is the last thing that can push a page past
+   the viewport once blocks and tables scroll in their own boxes — measured:
+   a 353px codespan, a 425px document at 391px on /backend-comparison.
+   Block code (CodeHighlight) keeps pre formatting; this is inline only. */
+code.m2d-codespan,
+.mantine-Code-root:not(.mantine-CodeHighlight-code) {
+    overflow-wrap: anywhere;
+    white-space: normal;
+}
+.mantine-CodeHighlight-root pre,
+.mantine-CodeHighlightTabs-root pre,
+.mantine-AppShell-main pre {
+    overflow-x: auto;
+    max-width: 100%;
+}
 
 /* NEVER style Mantine's hashed .m_* classes — they are private internals,
    version-coupled by construction. A rule that stops matching after a bump

components/appshell.py

@@ -1,6 +1,8 @@
 import dash_mantine_components as dmc
-from dash import Output, Input, clientside_callback, dcc, page_container, State
+from dash import Output, Input, callback, clientside_callback, dcc, page_container, State
 
+from components.footer import FOOTER_HEIGHT, create_footer
+from lib.aside import aside_config
 from components.header import create_header
 from components.navbar import create_navbar, create_navbar_drawer
 from lib.constants import PRIMARY_COLOR, HEADER_HEIGHT
@@ -181,22 +183,22 @@ def create_appshell(data):
                     create_navbar_drawer(data),
                     dmc.AppShellMain(
                         children=page_container,
-                        style={"minHeight": f"calc(100dvh - {HEADER_HEIGHT}px)"}  # Full height minus header
+                        style={"minHeight": f"calc(100dvh - {HEADER_HEIGHT + FOOTER_HEIGHT}px)"}
                     ),
+                    create_footer(),
                 ],
                 id="m2d-appshell",
                 header={"height": HEADER_HEIGHT},
+                footer={"height": FOOTER_HEIGHT},
                 padding="xl",
                 navbar={
                     "width": 280,
                     "breakpoint": "md",  # Collapse on medium screens and below
                     "collapsed": {"mobile": True},
                 },
-                aside={
-                    "width": 280,
-                    "breakpoint": "xl",
-                    "collapsed": {"desktop": False, "mobile": True},
-                },
+                # Collapsed wherever the page renders no TOC — the callback
+                # below re-evaluates it per navigation (lib/aside.py).
+                aside=aside_config("/"),
                 withBorder=True,
             ),
         ],
@@ -307,3 +309,13 @@ def create_appshell(data):
     Input("url", "pathname"),
     State("desktop-navbar-collapsed", "data"),
 )
+
+
+@callback(
+    Output("m2d-appshell", "aside"),
+    Input("url", "pathname"),
+)
+def _collapse_aside_without_toc(pathname):
+    """Full width for pages that render no aside (1.6.39): /changelog, /api,
+    home, the admin pages. The docs pages keep their TOC column."""
+    return aside_config(pathname)

components/footer.py

@@ -0,0 +1,58 @@
+"""The footer — identical on every host (1.6.38).
+
+© {this year} Pip Install Python LLC · GitHub PROFILE · Discord · YouTube.
+The repository link is the top bar's icon, the single Changelog link is
+the sidebar's (owner, 2026-08-30). Every icon carries an accessible name;
+the year is computed; no Terms/Privacy links until those pages exist.
+"""
+from datetime import datetime
+
+import dash_mantine_components as dmc
+from dash_iconify import DashIconify
+
+from lib.constants import DISCORD_URL, GITHUB_PROFILE_URL, PUBLISHER, YOUTUBE_SUBSCRIBE_URL
+
+FOOTER_HEIGHT = 56
+
+
+def _icon_link(icon, href, label):
+    return dmc.Anchor(
+        dmc.ActionIcon(
+            DashIconify(icon=icon, width=20),
+            size="lg",
+            variant="subtle",
+            color="gray",
+            **{"aria-label": label},
+        ),
+        href=href,
+        target="_blank",
+        **{"aria-label": label},
+    )
+
+
+def create_footer():
+    return dmc.AppShellFooter(
+        dmc.Container(
+            dmc.Group(
+                [
+                    dmc.Text(f"© {datetime.now().year} {PUBLISHER}", size="sm", c="dimmed"),
+                    dmc.Group(
+                        [
+                            _icon_link("radix-icons:github-logo", GITHUB_PROFILE_URL, "Pip Install Python on GitHub"),
+                            _icon_link("ic:baseline-discord", DISCORD_URL, "Join the 2plot Discord"),
+                            _icon_link("mdi:youtube", YOUTUBE_SUBSCRIBE_URL, "Subscribe on YouTube"),
+                        ],
+                        gap="sm",
+                    ),
+                ],
+                justify="space-between",
+                wrap="nowrap",
+            ),
+            fluid=True,
+            px="md",
+            h="100%",
+            style={"display": "flex", "alignItems": "center"},
+        ),
+        h=FOOTER_HEIGHT,
+        withBorder=True,
+    )