v1.12.0 — A working directory and life after Stockholm

The post-conference release, gathering everything merged since v1.11.0 now that the Summer School and the European Security Studies Conference are over. The directory grows from a listing into a working tool: every member gets a shareable profile page at /people/<slug>, can offer to host an STSM visitor or to mentor through the join form, and carries a self-updating list of recent publications drawn from ORCID. An Events page gathers everything the Action runs in one place, and the conference pages settle into a fixed archive. Underneath sit consolidated renderers shared across the three locales and the Management Committee figures syncing themselves from the cost.eu roster. Four themes follow, then a single canonical index at the bottom.

A directory you can act on

Every member now has a permanent, shareable profile page at /people/<slug>, server-rendered with their own Open Graph card and Person structured data, so a link unfurls as that person and search engines can index it. Two new signals tie the directory to COST money and to the Action's mentoring goal: members can say whether their institution will host a Short-Term Scientific Mission, with the grants page linking straight to the pre-filtered list of hosts, and the mentorship facet grows from a pair of badges into a matching panel that splits offers from requests and scopes itself to the research theme or region in view. Cards also carry a "Recent publications" list drawn from each member's ORCID record, fetched lazily so it costs nothing at load. The directory opens in compact cards by default, three to a row, with the photo-and-bio view one click away.

A fuller front door

A dedicated Events page now gathers the conference, the training schools, the workshops, and the Management Committee meetings in one place, with a dated archive for past editions, and the Publications page renders from data so the first D6 policy brief in October is a data-entry task. The About page opens with an "In numbers" strip giving the size of the Action at a glance. The FAQ and Glossary now emit FAQPage and DefinedTerm structured data, so search engines can surface their questions and terms as rich results.

Life after Stockholm

With the Summer School and the conference over, the ESSC page becomes a fixed archive rendered from a frozen snapshot rather than the live Indico feed, its "Live programme" heading now reading "Full programme" and a hidden template parked ready for next year. During the conference itself the programme carried a "Now happening" banner that named the sessions in progress in Stockholm time and advanced on its own through the day. The Summer School page was redesigned to match the rest of the site, the home Events block now shows only what is still ahead, and the deliverables timeline reads "Delivered" where it once read "Shipped".

Steadier underneath

The 1,850-line directory script that was copied across the English, French, and German pages is now one shared module, and the member-card popover that the conference programme carried its own copy of became a single shared component. The Management Committee statistics on the About page and press kit rewrite themselves from the cost.eu roster each week (the first run caught Ukraine joining the Action), and Working-Group chips reconcile each member's own answer against the formal record instead of being overwritten wholesale. A blank-directory regression that reached the live site was fixed and the render smoke check now exercises all three locales, dozens of stray research keywords were mapped back under theme filters, and "MC" was spelled out as "Management Committee" across the reader-facing copy.

Index of changes

Added

• An "In numbers" strip on the About page (all three locales), giving a visitor the size of the Action at a glance: Management Committee members across the countries they represent, Working Group members, and the people who have joined the Network so far. The Management Committee and country figures are the same cost.eu-synced literals used lower down the page, and the Working Group and Network figures fill at load from data/wg.json and data/bios.json, so none of the three drift. It sits above the deliverables timeline, which now carries a "Timeline & Deliverables" heading where it previously ran without a title. The Action's text also points to the four Working Groups, linking through to /working-groups.html. Stat labels, the section heading, and the linking sentence are hand-translated for FR and DE.

• A dedicated Events page (/events.html, all three locales), reached from the main navigation, that gathers everything the Action runs in one place rather than only the next few entries on the home page. Events still ahead sit at the top, soonest first, and past editions fall into a dated archive below, grouped by year and most recent first, so the European Security Studies Conference, the training schools, the workshops, and the Management Committee meetings all keep a lasting home. A filter row narrows the list by type, every card carries its own calendar link, and the page renders from data/events.json through the same card builder the home block uses, so a new event stays a data entry task. The home Events block now ends with a link through to the full list. Hero copy and the type labels are hand-translated for FR and DE. (#927)

• Real, shareable member profile pages at /people/<slug> (all three locales). Every member now has a permanent URL of their own to put in an email signature or share on LinkedIn, server-rendered from the directory data with their photo, role, affiliation, Working-Group chips, badges, bio, research interests, contact links, and recent publications. A shared link carries the member's own Open Graph metadata and a Person structured-data record, so it unfurls as that person and search engines can index it. The pages are generated by scripts/build-profile-pages.py, reuse the exact site chrome from the directory so they never drift, regenerate on every weekly bios sync, and a CI gate blocks a stale set from merging. Per-member social-card images, on-site search consolidation, and sitemap listing are tracked follow-ups. (#762)

• An STSM-hosting signal on the directory (all three locales), tying the tool to COST mobility money. Members can say through the join form whether their institution can host Short-Term Scientific Mission visitors, and a quiet badge ("Can host STSM visitors", or "Open to hosting" for a conditional answer) then appears on their card, alongside a "STSM hosting" filter that narrows the directory to hosts. The grants page's STSM card links straight to that pre-filtered view, so an applicant looking for a host starts from the people who offered. Like the mentorship and region facets, the badge and filter stay invisible until at least one member opts in, and the answer is collected on the same form, parsed to a tri-state field, and shape-checked. Badge and filter copy hand-translated for FR and DE. (#760)

• A mentorship matching view on the directory (all three locales). The mentorship facet shipped as data plumbing, with "Available to mentor" and "Seeking mentorship" badges and a filter, but nothing joined the two sides: a mentee had to run the filter and infer the matches. Selecting a mentorship filter now opens a panel above the grid that splits the matching members into "Offering" and "Seeking", carries a short note on how to approach a potential mentor, and, when only one side is showing, offers the other side in one click. The filter is now bookmarkable too, so a "Find a mentor" link can deep-link straight to the pre-filtered view (#mentorship=mentor). The panel copy is hand-translated for FR and DE. (#763)

• A "Recent publications" list on directory cards (all three locales), drawn automatically from each member's ORCID record. A member who has added their ORCID iD now shows their three most recent works on their card, each linking to the paper by its DOI where one exists, with no extra effort on their part: the card becomes a living CV that updates itself as they publish. The works are gathered weekly by a new sync that fails soft per member and never wipes the list on a transient outage, and the directory fetches them lazily, once and only after the page has gone idle, so member cards carry none of the weight at load. The "Recent publications" heading is hand-translated for FR and DE. (#761)

• A "Now happening" banner on the ESSC programme page (all three locales). While the conference is on, a banner above the day list names the session or sessions in progress right now, each linking to its card, with a live pulse. Liveness reads from the conference clock in Stockholm time, so it is correct from any visitor's timezone and stays right across daylight-saving, and it advances on its own as the programme moves through the day. It mirrors the same cue on the conference Indico, shows parallel tracks together, and hides itself whenever nothing is live. Built in the shared programme renderer, so next year's page inherits it. (#832)

• A quiet "Is this you? Add your profile" link on the Working Groups page (/working-groups.html, all three locales) for every member shown without a directory bio. The card a person finds with their own name on it is the directory's highest-intent moment, so the link sits there and goes straight to the join form, with the form address read at runtime from the same directory data the page already loads. Members who already have a bio, and the named leads and co-leads, do not get the link. A companion maintainer script, scripts/report-missing-bios.py, generates the post-conference recruitment mail-merge list by diffing the cost.eu roster and the ESSC speaker list against the directory. The link copy is hand-translated for FR and DE. (#758)

• Icon feature chips on the public roadmap's headline release cards (/roadmap.html, all three locales). Each landmark release and each planned card now carries a short row of stroke-icon chips (the open directory, site-wide search, the live conference programme, the directory filters, and so on), so a visitor scanning the timeline can tell a landmark release from a routine one without reading every paragraph. Patch releases carry no chips, which makes the minor and patch rhythm visible at a glance. The icons come from a hidden inline SVG sprite defined once per page, and the chip labels are hand-translated for FR and DE. (#767)

• The FAQ and Glossary pages (all three locales) now carry structured-data JSON-LD: FAQPage with a Question per FAQ entry on /faq.html, and DefinedTermSet with a DefinedTerm per term on /glossary.html. scripts/inject-seo.py builds the graph from each page's existing question and term markup, so the questions and definitions stay the authored copy and search engines can surface them as rich results. No visible change. (#766)

• The Publications page now renders its list from data/publications.json (all three locales), so publishing the first D6 policy brief in October becomes a data entry task. Author names that match a directory member link to their profile on the people page automatically. While the file holds no entries the existing placeholder copy stays up. (#726, #693)

• A conference livestream on the ESSC programme page (/essc-2026.html, all three locales). During the conference window each plenary and roundtable card's "Livestream" pill becomes the link to the webinar, carrying the external-link icon, and the session currently on air gets a red "live" pulse. The link, window, and platform live in a hand-maintained data/essc-livestream.json the daily Indico sync never touches, so the pills are links only between the configured start and end and come down by blanking the url. It is one Zoom webinar link for every session.

• A "Founding contributor" badge on directory cards (/people.html, all three locales) for members who were among the 52 researchers named in the COST Open Call proposal that established the Action. It reads as a quiet outlined pill set apart from the bright Working-Group chips, a soft acknowledgement rather than a role, and a hover note points to the Open Call proposal it draws on. The match is made when the directory syncs: scripts/sync-bios.py cross-references each member against the founding-proposer list and writes the flag, so the badge appears by itself the first time a founding contributor adds their bio. The label and its note are hand-translated for FR and DE.

• A founding-cohort snapshot on the About page (/about.html, all three locales), set just under the live Management Committee numbers. It pairs the founding figures (52 contributors across 21 countries) with a link through to the Founding contributors section, so the page reads both where the Action came from and where it stands today. Hand-translated for FR and DE.

• An institutional-commitment line in the press kit (/press-kit.html, all three locales) giving the founding and current figures side by side (founded by 52 researchers across 21 countries through the 2024 COST Open Call, now 49 Management Committee representatives across 30 countries), the dual-stat sentence COST evaluators and press tend to look for. Hand-translated for FR and DE.

• A reusable member-card popover, available across the site. Any page can now turn a person's name into a hover or focus profile card by marking the link with data-member="<id>". The card fetches the directory data once, then shows the member's photo, affiliation, role badges, and a link through to their full directory entry, with that link following the page's own locale. On the Summer School page it surfaces a directory member named in the prose. The pattern began life inside the ESSC programme renderer and is now a shared component in assets/js/site.js.

• The Summer School faculty roster (/summer-school.html, all three locales) now renders as a card per scholar, with directory headshots resolved by name rather than shown only on hover. On load each card's name is matched against the NetSec directory by a normalised first-and-last key (the same scheme that links speakers on the ESSC programme), and a resolved name gains the person's live headshot, their photo updating by itself as the directory does, plus a link through to their profile. The roster heals itself: a scholar who is not in the directory keeps a monogram avatar and starts showing a photo the first time they appear in the directory, with no edit to the page and no per-person tagging. It is also complete with no JavaScript, since the monograms render from the static markup and the headshots replace them on load.

Changed

• Added a "Strategy and deterrence" research theme to the directory filter (all three locales), carved out of "Security and defence", which had grown into a catch-all clustering nearly half the network. The new chip gathers the members working on strategic studies (grand strategy, deterrence, arms control, nuclear strategy and politics, maritime strategy), so the filter row reads less lopsided and a visitor can find that subfield directly. Hand-translated for FR ("Stratégie et dissuasion") and DE ("Strategie und Abschreckung"). Two keywords a newly-joined member brought, NATO and East central Europe, were slotted into existing themes in the same pass so every keyword still clusters.

• Tidied the directory's research keywords. The duplicate "Cyber security" folds onto the one-word "Cybersecurity" (matching the existing "Cybersecurity governance", and ENISA's own usage), via a new alias in data/keyword-aliases.json. Seven keywords that were not clustering now carry a theme, so every member keyword again appears under a Research-themes filter chip: Diplomacy joins Foreign policy and diplomacy; Crisis management, Crises and Nuclear politics join Security and defence; Civil protection joins Transnational and human security; and Transatlantic relations and Alliance politics join European and transatlantic security order.

• Spelled out "Management Committee" in place of the bare "MC" abbreviation across the site's reader-facing copy (all three locales): the home page's plenary and enquiry lines, the directory's filter help and join card, the grants and press-kit pages, the sitemap description, the About page's statistics labels, the guided-tour step, and the site-wide maintainer credit in the footer. The French and German pages spell out their own forms ("Comité de gestion", "Management-Ausschuss"). The acronym stays where it is the subject being taught, in the Glossary's "MC Member" entries and the acronym lists, and on the compact directory filter chip and role badge, which pair with those Glossary entries.

• The people-directory renderer is now a shared module (assets/js/people-directory.js) instead of a 1,850-line inline script duplicated across people.html, people.fr.html, and people.de.html. Locale text was already routed through window.netsecT(); the guided-tour step strings that were the only remaining per-locale difference are now entries in the same I18N catalog in site.js. No visible change. (#875)

• Curated the research keywords that recent joiners brought, so every member keyword clusters under a theme again. Prof. Nikolaos Tzifakis joins the directory in this pass; alongside the keywords Dr Wendy He arrived with, their submissions surfaced five canonical forms with no theme plus one sentence-length entry. A submitted misspelling ("EU foreign polcy") folds onto the existing "EU foreign policy" keyword, the long "Geopolitical competition in the Western Balkans" tightens to the region keyword "Western Balkans", and four keywords (Judgment and decision-making, Security studies, US-China relations, Western Balkans) join their research themes, so none of these members falls out of the theme filter chips on the directory.

• Removed the "Official logos and social channels" item from the public roadmap's Under watch list (all three locales). The Action's marks are in place across the site and the social channels are live, so the item has left the watch list.

• The mentorship matching panel now signposts the research-theme and region filters (all three locales). When a mentorship filter is on but no area is selected, a short tip points you to narrow the Offering and Seeking lists to your own field, so the way the two systems combine is discoverable rather than hidden. The directory's "first time here" mentorship note was refreshed to mention the matching panel and the theme narrowing.

• The mentorship matching panel is tighter. Its Offering and Seeking columns now pack together at a readable width rather than stretching across the page, and a layout fix removed a large block of empty space below them (each column is a <section>, so the global section rule was padding it with 160px of vertical space). The top filter line is also a little slimmer, with a shorter search box and Working-Group pills.

• The home page's Events block now shows only events that are still ahead, soonest first, and drops an event once it has finished, instead of listing every event in the data (which left the just-concluded Summer School and ESSC headlined). The "next event" strip above it now ranks a live or upcoming event ahead of a past one and, when only recently-concluded events remain, shows the most recent first, so in the days after the conference it points at the ESSC programme archive rather than the older Summer School. Past events stay in the calendar feed.

• Refreshed the ESSC 2026 and Summer School pages now that both events are over (all three locales). The conference's speaker callout reads as a short thank-you with the programme kept on the page, in place of the pre-event prompt to correct details, print the programme, or request a visa letter. The Summer School's "How to apply" section is retitled "Application process" so it reads as a record rather than an open call. The What's New banner pointing at the live programme came down, and the conference livestream link was blanked.

• The ESSC 2026 page is now a past-conference archive (all three locales). Its programme renders from a frozen snapshot, data/essc-2026-programme.json, copied at conference close rather than the live Indico feed, so the page stays fixed as future conferences land in the data and the "refreshed overnight" cue no longer shows. The heading changed from "Live programme" to "Full programme" with its live pulse removed, and the "Plan your visit" section (accommodation and getting around) came down now that the event is over. Behind both, the shared programme renderer became year-aware so a single script serves every edition, reading the conference year and data source from the page, and a hidden essc-2027.* template (noindex, unlinked, absent from the sitemap) is parked ready for next year's conference.

• Tightened the directory's filter card so it takes a little less vertical space: trimmed the card padding, the gaps between its rows, and the padding inside the Research-themes / Research-regions collapsibles. The controls keep their breathing room.

• Slimmed the directory search box to sit level with the filter chips beside it, trimming its vertical padding so the top filter line reads as one row rather than a tall search field over short pills.

• Mapped fifteen more research keywords that were not clustering to a theme, so every member keyword again appears under a Research-themes filter on the directory. Strategy, Capability planning, and Black sea security join Security and defence; AI, Cybersecurity, and Cybercrime join Cyber and emerging technology; Influence, Cognitive warfare, and Hybrid threats join Intelligence, information and influence; Geopolitics, Eastern Europe, and Regional cooperation join Foreign policy and diplomacy; European strategic autonomy joins European and transatlantic security order; Defence industrial policy joins Economic security and geoeconomics; and Organisation studies joins Theory and methods.

• Mapped four research keywords that were not clustering to a theme, so every member keyword now appears under a Research-themes filter: History to Theory and methods, Irregular warfare and Maritime strategy to Security and defence, and Maritime security to Transnational and human security.

• The mentorship matching panel now reads at a glance when it is filtered to an area (all three locales). With more than one research theme selected, each person carries small chips showing which of those themes they work on, so a mentee sees the overlap rather than inferring it. When a scoped column is empty it now says so in those terms ("No one in your selected areas yet.") above the widen control, rather than a flat "No one here yet." This continues #869 after the Phase 1 scoping. (#869)

• The directory now opens in compact cards by default (all three locales), three to a row, so the whole network is scannable at a glance. The detailed view with photos and full bios is one click away on the density toggle, and a visitor's choice is still remembered. The mentorship and STSM-hosting filters now also share a single row in the filter card rather than stacking, keeping the controls compact.

• Pulled v1.13.0 forward on the public roadmap from late December to late August (all three locales): the milestone, the card's quarter placement and date, and the repo roadmap timeline were moved. The Year 1 retrospective stays anchored to the October anniversary, where it is published.

• Refreshed the public roadmap's v1.12.0 and v1.13.0 planned cards (all three locales) to match what has actually landed and what the milestones now hold: v1.12.0 reads as the directory-growth and post-conference release, and v1.13.0 as the working-directory release (STSM matching, ORCID publications, profile pages, mentorship, the Glossary field guide) with the Year 1 retrospective. Their feature chips and the repo roadmap timeline were updated to match.

• The deliverables Gantt legend on the About page reads "Delivered" / "Delivered early" instead of "Shipped" / "Shipped early", matching the French ("Livré") and German ("Geliefert") wording already in use.

• Working Group chips on member cards now reconcile the member's own form answer with cost.eu's formal record per WG instead of letting cost.eu overwrite everything weekly. A WG a member declares before cost.eu catches up stays on their card (flagged in the sync PR as pending), a WG newly formalised on cost.eu is added automatically, and a deliberate removal is held for the maintainer to confirm. The home page, directory, and Working Groups page all render the same reconciled sets. (#236)

• The Management Committee statistics on the About page and press kit now rewrite themselves from cost.eu's roster on every weekly sync, instead of living as hand-edited numbers. The first run caught real drift: Ukraine has joined the Action, so the site now reads 51 representatives across 31 countries and the About-page country grid carries the two Ukrainian reps. A drift check flags any future mismatch between the hand-authored grid and the roster in the sync PR. (#236)

• The press kit's poster previews now load as WebP derivatives with PNG fallback, and the logo preview uses the small navigation derivative, cutting the page's image payload from roughly 1.4 MB to under 170 KB. Download links still deliver the full-resolution originals. The Lighthouse CI run now asserts performance and accessibility budgets so this class of regression gets flagged on the PR that introduces it. (#270)

• The public roadmap's in-flight progress bars now read "N of M tasks done so far" rather than "N of M tasks done" (all three locales). For a release that has not been cut the milestone total is provisional, since more issues can be tagged into it before release and not everything is always milestoned, so a card sitting at 15 of 15 was reading as a finished release. Shipped releases, whose milestone counts are final, keep the plain "N tasks done".

• Redesigned the Summer School page (/summer-school.html, all three locales) to match the rest of the site rather than reading as a plain stack of paragraphs. The hero gains an at-a-glance strip (dates, location, format, funded places, and the run-on to the conference) alongside two clear calls to action. The body is now glass cards: a two-up About block, a three-card "Taking part" set with accent icons, and the practical and heritage notes as cards. The faculty roster lists each scholar in its own tile. A new "Organised by" block shows the NetSec and EISS lockups side by side as equal partners, with the EISS network-mark and wordmark added as an inline asset that adapts to light and dark themes.

• Deduplicated the member-card popover so there is now one copy of its machinery. The ESSC programme renderer (essc-2026.html and its FR / DE twins) carried its own ~250-line inline copy of the popover (positioning, hover and scroll dismissal, the Safari navigation workaround, and the card body) alongside the shared component in assets/js/site.js. The renderer now resolves a speaker name to a directory record with its own fuzzy matcher (unchanged) and hands that record to the shared card via a small window.netsecMemberCard API, passing its locale strings, raw role labels, and working-group prefix as options. Visible behaviour is identical on both surfaces.

• The About-page and Working-Group leadership cards now also resolve against the directory by name, not only by a hand-written data-slug, reusing the first-and-last matcher the ESSC programme and Summer School roster use. The slug stays the primary key and still wins where present, so nothing changes for the current cards, and the addition means a leader can be reconciled and a card heal itself as the directory fills in, with no one tagging a slug by hand.

Fixed

• Member titles written out in full are now uniformised to house style, so a submission of "Professor Mark Rhinard" reads as "Prof. Mark Rhinard" like every other professor in the directory. The sync only recognised the abbreviations (Prof, Dr), so a spelled-out title slipped through unchanged and, worse, leaked into the member's slug (professor-mark-rhinard) and profile-page URL. scripts/sync-bios.py now folds "Professor" to "Prof." and "Doctor" to "Dr" in both the display name and the slug, the existing entry was corrected (name, id, headshot filename, and profile pages all moved to mark-rhinard), and a regression test covers the full-word forms. To stop it recurring at the source, the join form now collects the honorific in its own "Title" dropdown (Prof. / Dr / Ms / Mr / Mx / None please) rather than asking members to type it into the name field, and the sync combines the two, falling back to the old single-field header for earlier responses.

• The French and German About pages no longer carry a "find out more" card block (FAQ, Glossary, Press kit, Members' Wiki) that the authoritative English page never had. The block was added to the FR and DE pages alone in the early information-architecture pass and had been drifting since; it duplicated links already in the page's jump-to list and the footer. Removed so all three locales read the same.

• The member directory no longer renders blank (all three locales). The renderer extraction into assets/js/people-directory.js introduced two faults that reached the live site: the guided-tour step strings were rewritten with typographic quotation marks standing in as JavaScript string delimiters, a parse error that aborted the whole script, and the French and German card templates were missing the .member-founding element the renderer dereferences, so those two locales threw on every card even once the parse error was fixed. The tour strings now use straight-quote delimiters, the FR and DE templates carry the founding-badge element to match English, and the render smoke check now exercises all three locale directories rather than English alone, so a per-locale template drift like this is caught before merge. (#875)

• The weekly bios sync no longer re-encodes a name-collapse member's headshot every run. When someone submits the join form under a fuller name than their seed entry (the canonical case is "Dr John N.T. Helferich" against the seed "Dr John Helferich"), the sync collapses the two onto one card. The pre-download resolver that points the photo at the canonical slug was only being handed one of the three match indexes it needs, so it missed the name-and-country bridge, wrote the photo under the form slug, re-encoded it through a non-deterministic libjpeg path, and then the merge step deleted and regenerated the canonical WebP derivative. The result was an auto-PR with a lone churning binary diff and no data change. The resolver now receives all three indexes, and the merge rebase is a no-op when the photo already sits at the canonical slug, leaving the WebP untouched. Two regression tests cover both halves.

• The directory's guided tour (the ? button) now covers the STSM-hosting filter, which it skipped entirely, and gives the research-region filter its own step so its highlight lands on the regions rather than on the themes while the text talks about regions. Each filter step now anchors to a unique element, and the "Step X of N" count reflects only the steps a visitor actually sees: filter rows that stay hidden until a member opts in are dropped before counting, so the number no longer jumps. All three locales.

• Removed a duplicate, incomplete directory card. A member had submitted the join form twice, once leaving the name blank, so the second entry rendered as a card titled only "Mr" beside their complete one. The two could not auto-merge because a name that is only a title strips to nothing for the deduplication matcher. The sync now drops a form row whose name is only a title with nothing after it, so this class of incomplete submission can no longer reach the directory.

• The STSM-hosting badge ("Can host STSM visitors" / "Open to hosting STSM visitors") now centres on detailed directory cards and profile pages, matching the mentorship badge above it, instead of left-aligning out of step with the rest of the centred header. It still left-aligns in the compact card view, as the mentorship badge does.

• A member who changes their STSM-hosting answer on the form now sees it reflected on their directory card after the weekly sync. The sync merges a returning member's fresh form answers onto their stored entry by copying a fixed set of fields, and stsm_hosting (added in #760) was never added to that set, so a changed answer was silently dropped for anyone who already had a directory entry. First-time submitters were unaffected. (#760)

• A member's directory bio no longer carries the website navigation pasted in front of it. Alexandra Brankova's bio arrived with her university staff page's Swedish header ("Till startsidan" and "Search") sitting above the prose, copied along with the text. The weekly bios sync now strips a leading run of known navigation labels before it stores a bio, so the page header drops away while the prose stays untouched, and the fix holds on every future sync without anyone editing the form response.

• Nine research keywords from the latest member sign-ups now cluster under the directory's theme filter instead of falling outside it. Arms control, deterrence and nuclear strategy now sit under Security and defence. Russian foreign policy sits under Foreign policy and diplomacy. Digital media and narratives sit under Intelligence, information and influence. International relations, identity and ontological security sit under Theory and methods. Each keyword had been carrying its member out of every theme chip, the gap the sync's Review flags exist to catch.

• The directory's "STSM hosting" filter now actually narrows the grid to the members who can host. The chip reused the mentorship chip's CSS class, which the mentorship click handler also listens on, so clicking it silently added an empty value to the mentorship filter and excluded everyone. The mentorship handler is now scoped to its own chips. (#760)

• The weekly bios sync now shows its two quiet warnings in the auto-PR body rather than only in the scheduled job's stderr, under a "Review flags" section. A research keyword that maps to no theme (so the member carrying it falls out of the directory's theme filter) and any link field the sync rewrote to an absolute URL (a bare domain gaining its https://, a Bluesky handle becoming its profile URL) now appear where the maintainer actually reviews each week. A clean sync adds nothing, so the section stays silent unless there is something to look at. This is the gap that left Anna Pagnacco's cyber keywords sitting outside every theme chip for months with no one noticing. (#796)

• The French and German home pages now carry the same Working-Group membership data as the English one. The weekly cost.eu sync rewrote the home page's embedded WG_MAP (which drives the Working-Group chips) only in index.html, so the two locale home pages had drifted 21 members behind. scripts/sync-cost.py now rewrites the map in all three locales together, and the back-log was reconciled in this change, so the chips match across languages.

• The search overlay's close button is now a full 44px touch target (it was a 32px square), the size mobile guidance asks for, with the icon unchanged. A render pass across the June audit's responsive candidates confirmed the rest read correctly on a phone: the Working Groups member grid, the home page add-to-calendar menu, and the ESSC at-a-glance strip. (#457)

• Directory cards now build working links from the website and Bluesky fields. A member who typed a bare domain (itsallcyber.baby) or a Bluesky handle (@name.com) previously got a broken relative link, and for Bluesky a link the brand icon could not resolve. scripts/sync-bios.py now normalises every link field to an absolute URL as it writes the directory data, so a website gains its https:// and a Bluesky handle becomes its bsky.app/profile/ address, with two existing entries corrected by the same pass. A new data-shape check blocks any non-absolute link field from reaching the site again. The Bluesky icon was redrawn from the Simple Icons butterfly, replacing a hand-simplified path that rendered as a squashed blob.

• Research keywords that read as cyber work now cluster under a research theme on the directory filter. The harmonised-theme map had no entry for cyber security, cyber defence, or infrastructure, so a member whose keywords were only those sat outside every theme chip and never surfaced when a visitor filtered by area. The map now covers them. Differently-worded spellings of one employer also fold together through a new affiliation alias map, so "ETH Center for Security Studies" and "ETH Zurich, Center for Security Studies" read as one institution rather than two. (#506)

• The deliverables Gantt on the About page now bands the years cleanly: Year 2 and Year 4 carry a subtle blue tint (visible in both themes), the year-divider lines and the quarter grid lines show properly in dark mode, and the D1 row's tint and dividers line up with every other row (an extra connector element had shifted its :nth-child count by one quarter).

• The About-page deliverables Gantt now binds every row to one shared column system (CSS subgrid), so a milestone marker can no longer drift into the neighbouring quarter column on a wide or zoomed viewport. Each row was previously its own grid resolving its columns independently. ([#236] context; visual robustness)

• Expanding a directory card in compact view no longer overwrites a shared #themes= filter in the URL: card expansion stays out of the address bar, so a filtered link survives tapping through profiles. Incoming member deep-links still auto-expand their card. (#647)

• The Formspree privacy-policy link on the privacy notice (all three locales) now points at the canonical URL instead of a redirecting one, closing the last of the five stale-URL findings from the May launch audit.

• Corrected the order of the public roadmap (/roadmap.html, all three locales): the v1.11.0 release card (8 June) had been sitting after the 9 to 11 June Summer School and conference card, so the shipped release read as if it came after the event. The shipped release now precedes the planned event, matching the chronology and the internal roadmap timeline.

• Fixed a family of photo-layout bugs caused by a display:contents <picture> wrapper inside a grid. The WebP upgrade wraps a headshot in <picture><source><img>, and display:contents promoted the wrapper's children, the image and its <source>, into separate grid cells of the surrounding layout. Two places were affected, both only for members whose headshot is a JPEG or PNG (members already stored as WebP get a plain <img> and were always fine): the member-card popover, where the stray <source> took the photo column and collapsed the text to one word per line, and the About-page and Working-Group leadership avatars, where it broke the image's height so non-square photos rendered at the wrong size inside their circle. The popover wrapper is now a normal grid cell, and the avatar image is pinned to its fixed-size box, so both fill correctly. The same popover fix also covers the ESSC programme speaker cards, which share the CSS.

• The Summer School links on the home page now point at the dedicated NetSec Summer School page (/summer-school.html, in the matching locale) rather than the external EISS page. Both the news card and the Events-section card kept their old outbound link when the page shipped, so visitors were sent off-site for content that now lives on netsec-cost.eu.