v2.25.0 — Ready for Stockholm

ESSC 2026 opens in Stockholm on 11 - 12 June, and this release gets the site ready for it. Site-wide search, a public roadmap, a licensing page and a press kit make the site easier to navigate and to reuse. The whole interface is pulled onto one brand blue, with redesigned landscape share cards. The phone experience is markedly better and kinder to assistive tech. And the conference itself is everywhere you look: a countdown on the homepage, downloadable programmes for every recent edition, add-to-calendar links on synced events, and the 2025 conference film now playing.

Find your way around

Three new public pages and a search box change how visitors move through the site. A search button in the header, plus the Cmd/Ctrl-K and "/" shortcuts, opens a modal that searches the whole site, and the same search is the primary recovery route on the 404 page. It is built with Pagefind at deploy time, so the index lives on the published site and the modal shows an "available on the published site" notice during local work. A public roadmap at /roadmap.html lays out what has shipped and what is planned. A licensing page sets out how the site may be reused: the code under MIT, the editorial content under CC BY 4.0, with member photos and biographies kept off-limits. A press kit gives journalists the logos, the two-blue palette and the attribution string in one place. Maintainer docs gain an architecture overview and a design-system reference.

The run-up to Stockholm

The conference is now present across the site. A small countdown pill ("11 days until ESSC 2026") sits beside the featured conference on the homepage and on /2026, rendered at build time so it works without JavaScript and recomputed live so it never drifts between rebuilds. Every synced Indico event carries an "Add to calendar" link. The designer-made programme PDFs for 2022 to 2025 are downloadable, and their cover art now mastheads the matching pages. Every archived conference renders its programme in the same grid UI as /2026, replacing the old flat screenshots, so the whole archive reads consistently. The 2025 Thessaloniki conference film plays on /2025 and /past, self-hosted so no third party is contacted on load, and a new "Past events" section on /events records recent members' events.

One brand, one blue

A June 2026 brand-consistency audit pulled the interface onto the logo's blue. The UI accent moves from a slightly indigo blue to the brand #007bc6, and the whole blue family across the stylesheet, including the hero gradient mesh, shifts onto the same hue, while white-on-accent still clears WCAG AA. The social share cards are redesigned on the brand identity: the real EISS lockup and the brand blues, set in Inter, in proper 1200×630 landscape, with the upcoming conference page now naming the event rather than sharing a generic "Past conferences" card. The Inter typeface is self-hosted instead of fetched from Google Fonts, so no visitor IP reaches Google on first paint, and the mobile browser chrome now matches the page in dark mode.

Better on a phone, kinder to everyone

A mobile-UX audit reworked the phone experience. Standalone touch controls now meet the 44px comfort target, the tile grids collapse to a single column instead of overflowing a 320px viewport, and the nav drawer opens flush below the sticky chrome and locks the page behind it while open. Activity and "What we do" cards are now clickable across their whole area, not just on the button. An accessibility pass exposed programme session times to screen readers, gave the press-kit and gallery images distinct alt text, and corrected the social-share locale and a handful of broken profile links. The heavy conference photos were optimised for roughly 15 MB saved, and the accessibility statement records the June 2026 WCAG 2.2 AA review.

Index of changes

Added

• Profile cards appear on hover for any board or community member named anywhere on the site. When a People-page person's name shows up in page prose — a programme, a conference page, the Summer School trainers, an article — it becomes a subtle link to their profile that reveals a small card (photo, role, affiliation, "View profile") on hover or keyboard focus. It's wired up automatically from the People-page data (board.json → /data/people-index.json), so any new page that names a known person gets the behaviour with no extra work, and adding someone to the People page covers them everywhere at once. Names that don't have a People-page profile, the cards on the People page itself, and existing links are all left untouched. Documented in docs/design-system.md.
• The NetSec Early-Career Scholars Summer School page now lists its lecturers and mentors. The "Who are the lecturers and mentors?" panel on /NetSecSchool, previously a "to be communicated soon" placeholder, now names the six 2026 trainers with their affiliations: Nicolas Blarel and Julia Carver (Leiden University), Silvia D’Amato (James Madison University), Chiara Libiseller (King’s College London), Vanessa Newby (Monash University) and Chiara Ruffa (Sciences Po).
• The mobile browser chrome now matches the page in dark mode. The theme-color meta that tints Android Chrome's address bar and the iOS PWA status bar was a single light brand blue, so on a dark page the chrome read as a mismatched blue band. It is now a media-scoped pair: brand blue (#007bc6) in light mode, the dark page background (#0d1017) in dark mode. The media attribute follows the device colour scheme; a visitor on a light OS who flips the in-page toggle to dark still sees the light tint (strictly better than the previous always-blue, never worse). From the June 2026 brand-consistency audit.
• /events now lists past members' events. A new "Past events" section sits below the auto-synced Upcoming Events on /events (EN + FR + DE), recording recent members' events from Indico's members' space: the joint Sciences Po–EISS conference on the origins of war and diplomacy (June 2024), book talks with Stephen Brooks and William Wohlforth (February 2024) and on forecasting "Finlandization" (June 2023), a seminar on contemporary coercive statecraft (November 2024), and a joint seminar on election interference and disinformation (November 2025). Each row carries its conveners and their affiliations (read from the authenticated Indico records). The list is hand-maintained in src/_data/pastEvents.js and rendered by a new past-events-list.njk partial that reuses the upcoming-events styling. The members' events are members-only on Indico, so the rows don't link there (only the joint conference, which has a public archive page, links out). Automating the refresh from the authenticated Indico API is tracked in #401.
• The joint Sciences Po–EISS Conference is now surfaced on the Activities page. The /programmes page (EN + FR + DE) gains a tile for the June 2024 joint conference with the Center for International Studies (CERI) at Sciences Po, "Origins of War and Diplomacy", linking to its existing archive page at /joint-2024.html. The conference was already in the site data and the visual sitemap but had no entry under Activities.
• /2022 notes the new Best Paper Prize. A short "About the conference" intro on the 2022 Berlin page records that the edition introduced the European Security Studies Best Paper Prize for PhD students and early-career academics, presented for the first time at the closing ceremony (the award already appears in the programme grid). This restores the prize context that the removed "The Programme" card used to carry.
• The designer-made programme PDFs are downloadable, and their covers double as page banners. The print-ready final programmes (the ones with the full-page photo covers) are vendored under src/assets/files/ and surfaced with a "Download the programme (PDF)" button beside the grid on /2022, /2023, /2024 and /2025 (data-driven from a new programmePdf field in conferences.js; the grid is for browsing, the PDF for printing). The top band of each cover (title + photo + logos) is cropped into a wide banner that mastheads /2023, /2024 and /2025. The 2023 PDF was compressed (6.7 MB → 1.8 MB) for the download. A new archive-programme.njk component and src/_data/archiveProgrammes.js (the final printed programmes transcribed into the same days / sessions / papers shape as the live Indico grid) render past conferences with the identical look as /2026: a time-gutter day grid, chairs and discussants, concurrent panels side by side, and expandable paper lists with the presenter marked by a microphone. No more flat programme screenshots. Now wired across every archived conference page (/2019 through /2025, plus the joint Ukraine conference and the 2019 Joint Policy Workshop), replacing the old screenshot images and the hand-rolled 2021 session list. Closes #59 and part of #325.
• "Add to calendar" links on synced Indico events. Each upcoming-events row on /index and /events now carries a small Add to calendar link beside the event, downloading the per-event iCalendar file Indico serves at /export/event/<id>.ics. The link is derived from the event's own id, so it appears automatically once events return to the feed. Localised in all three languages (references #60).
• Public roadmap page at /roadmap.html (EN + FR + DE). A visitor-facing view of what's shipped, in progress, and planned, mirroring the sister NetSec site. Quarterly sections (Q2 / Q3 / Q4 2026) carry version cards with a status pill (Shipped / In progress / Planned / Under watch), the release date and SemVer tag, a short description, and a Release notes link on shipped releases. In-flight cards carry data-milestone="vX.Y.Z"; assets/js/roadmap-progress.js reads /data/roadmap-progress.json (closed / total issues on the matching GitHub milestone) to draw a live progress bar and promote the next release to In progress. An Under watch section lists items waiting on an external trigger, and a CTA row links the issue tracker, the milestones, and the releases. Content lives in src/_data/roadmap.js (hand-translated per locale); linked from the footer and the visual sitemap. Mirrors the version-tied milestones adopted in v2.24.0's follow-up.
• Site search powered by Pagefind. A search button in the header (icon-only, with an accessible label) and the keyboard shortcuts Cmd/Ctrl-K and "/" open a search modal with a labelled input and an ARIA listbox of results, each result a title and a highlighted excerpt linking to its page. The same search is the primary recovery affordance on the 404 page. The static index is generated at deploy time (pagefind --site _site runs after the Eleventy build in deploy.yml) and lives only on the published site, so the modal degrades to an "available on the published site" notice during local development. Site chrome (the nav, the footer, the sticky ribbons, and the modal itself) carries data-pagefind-ignore so only the <main> content is indexed. UI strings are hand-translated under t.search for all three locales (closes #209).
• Licensing & reuse page at /licensing.html (EN + FR + DE). A plain-language page that states how the site may be reused: the source code under MIT, the editorial content under CC BY 4.0 with the attribution string "European Initiative for Security Studies — eiss-europa.com", a carve-out making clear that member photos and biographies belong to the individuals and may not be reused without their consent, and the list of bundled third-party assets with their licences (Lucide icons under ISC, the Inter typeface under OFL). Adds a root LICENSE (MIT) and LICENSE-CONTENT (CC BY 4.0 plus the carve-out), a footer legal-row link, and an entry in the visual sitemap. Closes #275.
• Press kit page at /press-kit.html (EN + FR + DE). A lean brand surface for journalists and partner institutions. Download links for the existing logo variants (logo-mark.svg, logo-lockup.svg, logo-full.svg, logo-full-1024.png), the two-blue palette with hex swatches (#73CAFF network blue, #007BC6 brand blue), the Inter typeface note, a short do/don't block on clear space and recolouring, and the canonical attribution string with a copy-to-clipboard control. Reachable from the visual sitemap, with no footer link. Chrome lives under t.pressKit in all three locales (hand-translated). Closes #279.
• Conference countdown on the homepage and /YYYY. A small pill ("11 days until ESSC 2026") appears next to the featured conference on the homepage and on the conference page while the event is still upcoming, and disappears once it starts. The number is rendered at build time (so it works without JavaScript) and recomputed live in the browser on load, so it never drifts between daily rebuilds. Hand-translated in all three locales.
• The 2025 conference film now plays on /2025. The recordings section (previously gated off) is replaced by a portrait conference film in a phone-style frame: a self-hosted MP4 (a GitHub Release asset, so no third-party request, consistent with the privacy notice) that muted-autoplay-loops only once it scrolls into view, sitting beside a short description on desktop (it stacks on mobile). A single sound toggle and a subtle "tap for sound" hint that fades on first interaction are the only chrome, with a Watch on YouTube link to the Short. Honours prefers-reduced-motion (native controls, no autoplay). The player is a reusable film-embed.njk partial. Closes #330.
• Maintainer docs: architecture overview, design-system reference, and a docs index. docs/architecture.md maps the build pipeline, the _data sources, the sync jobs, and the CI gates; docs/design-system.md catalogues the reusable components (the _includes partials + their CSS/JS interactions); docs/README.md indexes the whole docs/ folder. Closes #283 and #282.

Changed

• The public roadmap is restructured around the conference. On /roadmap.html (EN + FR + DE), the next release is now v2.25.0 "Ready for Stockholm", the pre-conference release shipped on 9 June 2026; v2.26.0 "Post-conference: activation, content and feedback" follows in September 2026, and v2.27.0 "Polish and ESSC 2027 prep" closes the year. The internal docs/roadmap-2026.md planning doc and the version milestones are realigned to match (the superseded v2.24.1 patch milestone is closed).

• The Summer School's "Previous edition" section now links to the Euro-SWAMOS page. The NetSec Summer School page recalls Euro-SWAMOS 2023 (Hertie School, Berlin) as the previous edition; that section now carries a "Learn more about Euro-SWAMOS" link through to the dedicated /euroswamos page.

• The social share cards are redesigned on the brand identity. When a page is shared to LinkedIn, X, Mastodon, Bluesky, Facebook or Slack, the preview card now carries the real EISS lockup (the constellation mark plus the EiSS wordmark, embedded from the brand kit) and the brand blues, set in Inter, on a deep brand-navy gradient. They replace the old cards, which drew an off-spec blocky "E" tile and an indigo gradient a hue off the brand. The cards are now proper landscape (1200×630, the summary_large_image ratio) with long titles wrapping to two lines, and the page markup declares the image type and dimensions so scrapers render the preview without a round-trip. The generator (scripts/make-share-cards.py) reads the canonical brand SVGs at build time, so the cards stay in lockstep with the logo. From the June 2026 brand-consistency audit, closing #514.

• Conference share cards now name the event. The upcoming edition's page (/2026) carries its own card — eyebrow "ESSC 2026", titled European Security Studies Conference, with the dates and venue — while the archive index and past years share a card titled EISS Annual Conference. Previously every conference page shared one card labelled "Past conferences", so the flagship upcoming page undersold itself. The per-edition rollover (retiring a bespoke card to the shared archive card once an edition is over) is documented in docs/new-conference.md. Closes #536.

• The UI accent is now the brand blue, so the logo and the interface read as one system. The accent that colours links, buttons, focus rings and badges was a slightly indigo hsl(216 88% 50%), a different blue from the logo's brand blue #007bc6 (hue 203). The accent token is now exactly #007bc6 in light mode (hsl(203 100% 39%), lifted to hsl(203 100% 66%) in dark mode and darkened for print), and the whole blue family across the stylesheet has moved onto hue 203 — including the hero gradient mesh, whose two off-palette violet blobs (hsl(250 …) / hsl(280 …)) are pulled onto the brand hue. White-on-accent and accent-on-white both clear WCAG AA (4.5:1). From the June 2026 brand-consistency audit, closing #512 and the gradient half of #519.

• New "Co-Director" leadership role on the People page. The board-sync pipeline and the page now recognise a Co-Director role, placed in the Leadership section just below Founding Director (scripts/board-source.json roles table, tier 2; boardSorted.js derives the section from it). This clears the sync warning where the Form's "Co-Director" value fell back to "Board Member". The role is defined but currently unheld — assigning it to Moritz Weiss is held until the appointment is officially announced (tracked separately); he stays listed as Secretary-General until then.

• Departed board members now show their photos on the People page. The EISS-community cards for Flavia Gasbarri, Mauro Gilli and Stephanie Hofmann display their headshots instead of initials placeholders. Their photo files were already in the repo but unreferenced, so the cards fell back to initials; each is now wired in via photoOverride in board.json (the sync-safe manual hatch). Avinash Paliwal keeps the initials placeholder, as no photo is on file.

• Dates use a plain spaced hyphen across the site. Date ranges now read "11 - 12 June 2026" (a spaced hyphen) instead of an em or en dash, for one consistent style: the conference pages from /2017 to /2026, the homepage featured-card day block and the /past archive lines (from conferences.js), /programmes, /initiative, /NetSecSchool, the visual sitemap, the accessibility statement's year ranges, the roadmap's ESSC card, and the archived-programme dates. EN, FR and DE. Deliberately left alone: non-date numeric ranges (the /practical transit lines, the host-city map coordinates) and title separators such as "2017 — Paris" and the "2023 — 21st Century Coercion" heading. Resolves #473.

• The roadmap collapses older shipped releases and shows each one's change count. On /roadmap.html (EN + FR + DE), shipped releases are now collapsible cards (native <details>, so keyboard-operable and working without JavaScript): every shipped release except the most recent is collapsed by default, with the latest left open. Each shipped card now shows the number of changes it shipped beside its Release notes link (e.g. "Release notes · 32 changes"), counted from the CHANGELOG. The "most recent" release is derived in roadmap.js, so it advances automatically as releases are added.

• Every annual-conference page now shares one "Conferences" link-preview card. /2017 through /2026 (and the 2026 FR/DE variants) point their metaImage at the shared conference share card (past-meta.jpg) instead of per-year art, so the whole conference section presents one consistent preview when shared. This also fixes /2019, which mistakenly used the 2025 card, and gives /2017, /2018, /2020, /2021 and /2026 a proper conference card in place of the generic homepage default. FR/DE conference pages resolve to the localised past-meta.fr.jpg / past-meta.de.jpg. The old per-year YYYY-meta.* cards are now unused.

• Refreshed link-preview (OG) share cards for four major pages. The homepage, /past, /initiative and /board get new brand-consistent share cards in the standard 1.91:1 landscape ratio (replacing the older 1200×1200 square art), each with the page title, a one-line description, the canonical URL, and a live stat ("Next · Stockholm 2026", "Founded 2017 · 12 countries", "9 conferences · since 2017", "23 board & support · 12 countries"). The homepage card is also the site-wide default share image. English only for now; the hand-localised FR/DE cards for these pages are unchanged and still in the previous style.

• Roadmap re-synced to the amended v2.24.1 milestone. The v2.24.1 card on /roadmap.html (EN + FR + DE) and the matching rows in docs/roadmap-2026.md now describe a pre-ESSC polishing patch due 9 June 2026 (quality-of-life and UX polish, a QA and accessibility sweep, refreshed FR / DE translations), replacing the earlier "post-ESSC reactive patch, mid June" framing, to match the GitHub milestone's new due date and description.

• Every venue map link now points to OpenStreetMap instead of Google Maps. Following the embed removal, the remaining "Open in Google Maps" links across the archived conference pages (/2017 through /2025), the Joint Policy Workshop pages, /NetSecSchool, /coercion, /joint-2024, /practical, /register and /form now link to OpenStreetMap, matching the venue card on /2026 and /euroswamos. On /2026 (EN + FR + DE) the redundant inline Google link is dropped, leaving the single OpenStreetMap link from the venue card. The dead mapEmbed.src Google embed URL and its stale comment are removed from conferences.js. Closes #452.

• The Euro-SWAMOS page is reframed as a concluded programme. /euroswamos now states that the workshop ran only in 2022 and 2023 and signposts its successor, the NetSec Early-Career Scholars Summer School, in a highlighted callout. The two Hertie School films are folded into a "The two editions" section beside the recap of who ran them, rather than a standalone video block. The FAQ is removed (its lecturer roster is kept as a plain "Lecturers" list), the gallery now shows the two cohort photographs in place of the old stock images, and the venue card is expanded into an "About the Hertie School" section whose map link points to OpenStreetMap instead of Google Maps.

• Past members' events on /events now link to their Indico event pages. Each of the five rows in the Past events section links to its event on indico.eiss-europa.com (opening in a new tab, with an external-link icon). The events sit in the members-only space, so a non-member following a link meets the Indico sign-in (the intended gate) while members reach the event directly. The November 2025 election-interference-and-disinformation seminar also gains its convener, Arthur Laudrain (Stanford CISAC).

• /initiative founding nuance. A short line notes that EISS began in 2017 within the AEGES association and became a standalone French loi 1901 non-profit in 2021 (registered office at CERI, Sciences Po), while keeping 2017 as the headline founding date (JSON-LD foundingDate unchanged). EN/FR/DE. Part of #329.

• The Inter typeface is now self-hosted instead of loaded from Google Fonts. The font is served from the site's own origin (vendored under src/assets/fonts/, variable weight, Latin + Latin-Extended), so no visitor IP is sent to Google on first paint. This matches the site's no-tracking stance, removes a render-blocking cross-origin request, and drops the corresponding entries from the privacy notice.

• The conference venue map no longer embeds Google Maps. The /YYYY venue block was a Google Maps iframe that loaded on page view, sending every visitor's IP to Google. It is replaced by a plain address card with a link to OpenStreetMap that opens only when clicked. No third party is contacted on page load. The Google Maps entry is removed from the privacy notice accordingly.

• The open-panel examples on /initiative now show the breadth of past ESSCs. The short list of recent open panels is recurated from the conference archive to span 2018 to 2026 and to sit clearly apart from the nine permanent thematic sections: non-state actors and domestic politics (2018), climate change and security actors (2019), European security read through India (2021), organised crime in Latin America (2023), knowledge production on war (2024), and cyber and digital sovereignty (2026). Titles stay in English (their conference form) and are marked lang="en" on the FR and DE pages.

• /2025 now opens with the conference, not the programme. The page leads with a short review of the Thessaloniki edition sitting beside the conference film (the film is no longer a standalone "Conference film" section lower down), then the keynote and round tables, then the photo gallery, then the full programme in the grid UI. The programme used to be the first thing on the page as a flat screenshot.

• Conference photo galleries crop to a consistent shape. The /2025, /2021 and /2019 galleries (and the Joint Policy Workshop photos) now use a shared .photo-gallery grid where every tile holds a uniform 3:2 landscape box with object-fit: cover, instead of letting each photo set its own height. This fixes the ragged, oddly-cropped look from mixed source dimensions.

• The 2025 conference film now also runs on the /past conferences page. The same film-embed.njk player sits in a portrait column beside the year-by-year archive cards on desktop, staying in view as the list scrolls, and stacks below the cards on mobile. It reuses the self-hosted GitHub Release asset and the scroll-into-view muted autoplay already used on /2025, so nothing downloads until it enters the viewport. Part of #330.

• On /past, the conference film now comes before the list of past conferences. It stacks on top on mobile and sits as the left column on desktop, rather than trailing after the list.

• /2025 opens with the conference film folded into a short intro instead of a separate "Conference film" section lower down, and the archive pages now follow a consistent section order. The /2021 page drops an off-template "Read more about the EISS Board" signpost, and /2019 drops a redundant open-and-closed-panels explainer (now covered on /initiative).

• The archived conference pages now share one structure. Across /2019, /2021, /2022 and /2025, the "thank you" wrap-up cards are gone, and every photo gallery sits in the same place: directly above the programme grid. The /2022 page also loses its old "The Programme" card (the one linking to /panels.html), which the grid UI superseded, and its four-photo strip is folded into the standard .photo-gallery so it crops like the others.

• Accessibility statement refreshed for the June 2026 audit. /accessibility (EN + FR + DE) now records the June 2026 site-wide WCAG 2.2 AA review (no critical or serious barriers), adds the accessible search dialog/combobox and the FR/DE lang="en" annotations to the implemented-features list. Review date bumped to 2 June 2026. Per CLAUDE.md §9.

• Heavy conference photos optimised (~15 MB saved). Oversized gallery images are downscaled to web dimensions and recompressed: the /2021 Lisbon gallery drops from ~10.6 MB to ~0.57 MB (two Flickr originals were 7.2 MB and 3.4 MB at 4176px), the /NetSecSchool photos from ~2.4 MB to ~0.63 MB (4096px → 1600px), and the /2022 Berlin gallery photos, saved as ~1 MB PNGs, are now ~0.13 MB JPEGs. Same images, far lighter pages. From the June 2026 QA audit (perf-01/02/03, #415).

• Activity and "What we do" cards are now clickable across their whole area. On /programmes (EN + FR + DE) and the "What we do" tiles on /initiative (EN + FR + DE), the whole card is the link rather than only its button or arrow. A stretched-link overlay extends each card's single primary link to cover the full tile, the visible button or arrow stays as the cue, and the card lifts on keyboard focus to match its hover state. Cards that carry no link (the /events event formats) or a payment commitment (the membership tiles) are deliberately left button-only, so a stray click cannot trigger them. The /past conference cards and the /events synced-event rows were already whole-card links.

Removed

• Stale practical information dropped from the archived conference pages. Logistics that only mattered to attendees at the time, the Barcelona 2023 hotel-recommendations list and transport note, and the Lisbon 2020/2021 practical-information framing, are gone from the archive. The pages keep their host-and-venue context. Past conferences read as a record, not a live event guide.

Fixed

• The mobile nav drawer now opens flush below the sticky chrome. At phone widths (≤880px) the drawer is position: fixed, but its containing block is .site-header, not the viewport: the frosted nav's backdrop-filter establishes a containing block for fixed descendants. So the old inset-block-start: var(--nav-height, 64px) resolved against the header (and --nav-height was never defined, so it fell back to a literal 64px), and the drawer overlapped the bottom of the chrome, worst on FR/DE pages, which stack the beta-translation ribbon above the nav. The drawer now uses inset-block-start: 100%, the bottom edge of that containing block, so it tracks the real chrome height for free with no measured value, whether the What's New banner is up, the ribbon is present, or the scroll-shrink is mid-flight. CSS-only. Closes #555. Verified live across EN/FR/DE, light and dark, at rest and scrolled, banner active and dismissed, at 375px and 320px.

• The "whole card is a link" tiles now actually navigate when you click anywhere on them. The Activities tiles (and every other card that uses the stretched-link pattern site-wide) showed a link cursor and a hover-lift but did nothing unless you clicked exactly on the pill: the button's press-scale (:active { transform }) turned the button into the containing block for its own full-card overlay, collapsing it down to just the pill at the instant of the click, so the release was lost. The press-transform is now held off stretched links, so the overlay stays anchored to the whole card through the click. The "learn more …" pills also now sit consistently at the bottom-right of their cards, lined up across each row, instead of floating mid-card.

• Two small touch / wording fixes from the mobile-UX audit. The ESSC-speaker microphone on the People page now carries a native title, so a touch user can long-press the icon to read what it means (previously its explanation only appeared on hover, which touch devices don't have; screen-reader users were already covered by its aria-label). And the Initiative page's reference to the inaugural-conference details, written "(see right)" / "(voir à droite)" / "(siehe rechts)", now reads "(see the panel)" / "(voir le récapitulatif)" / "(siehe Übersicht)" — the old wording pointed the wrong way once the two-column layout stacks on a phone.

• The mobile nav drawer now locks the page behind it. Opening the hamburger menu on a phone no longer lets a swipe scroll the page underneath the open drawer — the body is frozen while the menu is open (mirroring the search modal) and released on close. From the June 2026 mobile-UX audit.

• Mobile touch and layout polish from the June 2026 mobile-UX audit. Standalone touch controls now meet the 44px comfort target on phones: the EN/FR/DE language switcher (previously a ~16px-tall, 10px-text chip), the header search / theme / menu icon buttons (were 36px), the membership join CTAs and the board social-icon links. The closed mobile menu is now visibility:hidden rather than just transparent, so its links leave the keyboard/VoiceOver focus order when the menu is shut (they were silently tabbable while invisible). The homepage hero heading steps down from ~45px to ~37px at 375px (matching the calmer /2026 hero) so it no longer fills the first screen. And the programmes/events/initiative tile grids collapse to a single column on phones instead of holding a 20rem column that overflowed a 320px viewport. All scoped to ≤480px, so desktop is unchanged. Verified live at 375px and 320px.

• Two People-page profile links no longer resolve as broken relative URLs. Moritz Weiss's ORCID was stored as a bare iD (0000-0001-9311-6480) and John Helferich's website as a scheme-less domain (johnhelferich.com). The card template emits these straight into href, so a browser read each as a path on eiss-europa.com and both icon-links 404'd. The two values in board.json now carry full URLs (https://orcid.org/… and https://johnhelferich.com), matching every other member's entry. Caught by the link checker during the June 2026 brand audit.

• The --fs-md type-scale step is no longer undefined. Five rules referenced var(--fs-md) (the press-kit logo-card, swatch, and don't-list headings, the Indico event-title emphasis, and a control), but the token was never declared in :root, so each font-size declaration was dropped and those elements fell back to an inherited size. The step is now defined as 1.125rem, sitting in its natural place between --fs-base (1.0625rem) and --fs-lg (1.25rem), so the five spots render at the intended size. Surfaced by the June 2026 brand-consistency audit.

• The press-kit attribution string now matches the licensing page. The press kit published the attribution as "European Initiative for Security Studies (EISS), eiss-europa.com" while telling readers it was "the same wording carried on our licensing terms", where the licensing page actually reads "European Initiative for Security Studies — eiss-europa.com". The press-kit string (EN, FR, DE) is aligned to the canonical licensing form, so the two surfaces now agree. Surfaced by the June 2026 brand-consistency audit.

• The ESSC-speaker mic icon on the People page no longer floats detached. On board cards with a wide role line (a role plus a functional-responsibility pill, e.g. "Board Member · Events Coordinator"), the mic indicator's margin-inline-start: auto pushed it onto its own right-aligned line, left hanging in space above the person's name. The auto-margin is removed, so the mic now sits inline immediately after the role/pill and wraps with that cluster.

• Homepage hreflang now matches its canonical URL. The homepage's <link rel="canonical"> is the clean root (/), but its hreflang="en" / x-default alternates pointed at /index.html, a self-inconsistent signal to search engines. The alternates.en entry on the three homepages now resolves to /, so canonical, hreflang="en" and x-default agree. Resolves seo-02 from the June 2026 QA audit (#416).

• The ESSC 2026 programme PDF buttons and links work again. The 2026 entry in conferences.js declared programmePdf twice, as the rich object the /2026 page expects ({ url, sizeKb, pages, status }) and again as a bare filename string. JavaScript keeps the last duplicate key, so programmePdf collapsed to the string: the "Open" and "Download" buttons on the programme-PDF card, and the "official programme PDF" link in the "Speaking or chairing?" note, all rendered with an empty href="" (a click just reloaded the page), and the card mislabelled itself as a draft with no page count or size. The stray string key is removed, so all three links resolve to /assets/files/EISS-2026-programme.pdf and the card reads as the final nine-page programme. EN/FR/DE.

• Content and CSS polish from the QA audit. The Hew Strachan affiliation now reads "University of St Andrews" consistently across the archive programme data (was a mix of "St. Andrews" / "St Andrews"). The new /2017 page loses a prose em dash (replaced with a comma per §7), and /euroswamos reads "scholars who engage" rather than "scholars that engage". The .venue-map__body wrapper used by the OpenStreetMap venue card now has a CSS rule (flex: 1 1 auto; min-width: 0), closing a §14 undefined-class gap and pre-empting long-address overflow in the flex row.

• Accessibility pass over the new visual content and components. From the June 2026 multi-agent QA audit: programme session times on /2026 and the archived /YYYY grids were wrapped in aria-hidden="true" and so were unavailable to screen readers; they are now exposed (the visible en dash is spoken as "to", layout unchanged). The lazy YouTube facade now moves focus onto the player it mounts, instead of dropping focus to the document body. The conference film is exposed to assistive tech as a toggle button (role="button" + aria-pressed, only on the interactive path, so the reduced-motion native-controls fallback is untouched). The four press-kit logo download links gain distinct accessible names (EN/FR/DE), and the ten /2021 Lisbon gallery photos get distinct, descriptive alt text in place of the repeated "2021 EISS Conference scene."

• Upcoming event cards without a public link are no longer dead links. A synced Indico event that arrived without a public url was rendered on /index and /events as <a href="">: it showed the hover lift and pointer cursor of a link, but clicking it only reloaded the page (reactive, but not actually clickable). The upcoming-events partial now guards on url the way the past-events list already did, so a URL-less event renders as a non-interactive static card instead, while its "Add to calendar" download still works. EN/FR/DE. Also removes a stray past-events-list 2.njk duplicate from _includes.

• Social-share metadata corrected on every page. The English pages advertised an invalid og:locale of en_EN; it is now en_GB (FR/DE already produced valid fr_FR / de_DE), via a language-to-locale map in the layout. The Twitter/X card also gained the twitter:image:alt it was missing, mirroring the existing og:image:alt. Surfaced by the June 2026 QA audit (part of #416).

• Paper titles in the archived programme grids no longer wrap one word per line. Expanding a panel's paper list on an archive page (/2019 through /2025) rendered each title down a single narrow column. The archive grid reuses the live programme markup but omits the per-paper time gutter (past papers have no individual start time), so each paper's body collapsed into the empty 3.25rem time column. A programme--archive modifier now drops that first column on archive grids, so titles use the full width.

• /2025 conference film alignment. The film is now flush with the right edge of the container (it was 20px short, so it didn't line up with the programme and gallery cards below it), and its top aligns with the intro heading instead of poking ~200px above it (which made the video's top slide under the sticky header before the rest of the section as you scrolled). The .film-feature layout uses align-items: start and right-aligns the film in its column.

• /initiative conference history corrected. The conference-tour list now numbers 2019 as the 3rd edition (was 2nd) and shows 2020 as deferred to 2021 rather than a separate "3rd, online" edition; the 2017 and 2018 cards link to their new pages. The host-city map caption is corrected the same way, and the "N annual conferences" stat reads from conferences.editionCount (9), so the deferred 2020 no longer double-counts. EN/FR/DE. Part of #329.

• The site-search modal and the press kit now actually render. Both features had shipped with complete markup, JavaScript, and translated strings, but none of the classes they referenced were defined in site.css, so the search overlay opened as an unstyled block and the press-kit logos and swatches spilled full-width. The search dialog is now a centred, scrollable panel (a full-screen sheet on phones) with styled results and highlighted excerpts, and the press kit lays out as proper logo, swatch, and do/don't grids with contained images.

• The press kit is now reachable from the footer (legal-links row, EN + FR + DE), not just from the visual sitemap.

• The 2025 conference film now plays on iOS. The real blocker was hosting: GitHub Release assets are served as application/octet-stream with Content-Disposition: attachment and nosniff, which iOS Safari refuses to play inline (desktop browsers sniff the type and play it anyway, which is why it worked there). The film is now served same-origin from /assets/video/, so the host sends Content-Type: video/mp4 and it plays. The player keeps the iOS autoplay hardening too: the muted property is set and the source load()-ed before play(), a centre play button appears if autoplay is still blocked (Low Power Mode), and webkit-playsinline is set for older iOS. The file is a faststart H.264 High / AAC-LC MP4 (720×1280).

• The 2025 film's Watch on YouTube link now works. It pointed at a Shorts URL that did not resolve; it now links the standard watch URL with the conference playlist.

• /2019 was mislabelled the "2nd" Annual Conference. It was the 3rd (2017 inaugural, 2018 second, 2019 third), confirmed by the final programme and the 2019 call for papers, and consistent with the canonical ordinals in conferences.js. Corrected the page eyebrow and meta description.

• Removed personal chair email addresses from the 2022 panels data. src/_data/panels2022.js carried [at]-obfuscated personal emails in the chair fields. They were already stripped from the rendered page, but sat in the committed source; they are now gone from the repository entirely (chair lines read "Chair: Name, Institution").

• In-page anchors no longer land under the sticky chrome. The chrome's height is variable (the What's New banner adds height, and FR/DE pages add the beta ribbon), so the old static scroll offset left clicked anchors hidden behind the chrome in those states. theme.js now measures the chrome's real rendered height and publishes it as scroll-padding-top on <html>, recomputed on load, on resize, and whenever the banner mounts or is dismissed. A static fallback covers the pre-hydration and no-JS case (closes #278).

• CSS and JS no longer load stale from cache after a deploy. The stylesheet and the scripts were linked with bare URLs, so a returning visitor could fetch new HTML while the browser served the old site.css from cache (GitHub Pages caches assets for ten minutes), briefly rendering new markup against old styles. A build-time bust filter now appends the first eight hex of each asset's SHA-256 (site.css?v=…), recomputed every build, so the URL changes only when the file does. No stamping script or CI gate is needed, the hash is derived at build time rather than written into the source.

• /past conference film alignment + sticky offset. The film's top now lines up with the first conference card (the .conference-list margin-top is zeroed inside the two-column layout), and the sticky offset is raised to 8rem so the film no longer tucks behind the sticky header during the scroll-shrink. Mirrors the /2025 fix.

• Search result thumbnails only show for people. Bio-stub results carry a kind: person marker; other results (the board page, /YYYY pages) no longer show whatever image Pagefind auto-extracts first (a board member's face on /board, a speaker headshot, a logo), which read as wrong.

• Pinned Pagefind to 1.5.2 at deploy. The unpinned npx pagefind could fetch a different version per deploy, and the index format / content-hashed shard names differ between versions, so back-to-back deploys could leave the CDN serving a mix of shards from two versions — surfacing as some queries (e.g. "board", "netsec") returning no results. Pinning keeps every build's index identical.

• /refund.html no longer duplicates /terms.html. The two pages shipped byte-identical and both indexable. /refund.html now redirects to /terms.html (rel=canonical + meta-refresh), and the footer's Terms link points straight at /terms — which, unlike /refund, has FR/DE variants, so the link is now localised. Resolves the duplicate-content finding from the June 2026 QA audit (seo-01, part of #416).