<?php
/**
 * OWCO_Admin — the whole wp-admin surface of the plugin.
 *
 * Top-level menu "OW Consent", navigated through in-page tabs:
 *   1. Dashboard    → status cards, compliance diagnostic, quick help
 *   2. Banner       → display, floating button, renewal, texts
 *   3. Compliance   → legal framework, blocking policy, CCPA/GPC, TCF, geo, policy links
 *   4. Legal        → company identity, hosting, profession, mediation, retention, documents
 *   5. Categories   → availability, labels, descriptions
 *   6. Policies     → document generator
 *   7. Scanner      → manual/automatic crawl + findings triage
 *   8. Audit ledger → hash-chain listing + integrity check + retention
 *   9. DSAR         → request register + portal settings
 *
 * Native WordPress forms only (no React, no build step). Every write path goes
 * through handle_save(): capability check, then nonce check, then a redirect.
 *
 * Admin notices (Guideline 11 — a plugin must not hijack the dashboard):
 *   - notice_invalid_patterns() and notice_ledger_key() are STANDING conditions and
 *     are printed on this plugin's own screens only, gated on is_own_screen().
 *   - notice_write_refusals() is the single exception, and the only notice this
 *     plugin prints anywhere else. It fires only while this site is actively
 *     answering visitors that their consent cannot be recorded, it is dismissible,
 *     the dismissal is remembered per user, and it never repeats itself for a
 *     refusal already acknowledged.
 *   - Everything else the screens report — saved settings, generation results,
 *     the DSAR queue, the write-refusal incident report — is rendered inside the
 *     plugin's own pages and is not an admin_notices hook at all.
 *
 * Escaping/sanitizing notes for reviewers:
 *   - every superglobal read is wp_unslash()-ed then sanitized on the same line;
 *   - settings values are sanitized per key by OWCO_Core::sanitize_setting();
 *   - the plugin-owned tables (OWCO_TABLE_*) are queried directly because no WP data
 *     layer covers them; each such statement carries its own narrow phpcs:ignore.
 */

if ( ! defined( 'ABSPATH' ) ) { exit; }

class OWCO_Admin {

	const MENU_SLUG = 'ow-consent';
	const SAVE_NONCE_ACTION = 'owco_admin_save';

	/**
	 * Nonce action guarding the "hide this notice" link.
	 *
	 * Separate from SAVE_NONCE_ACTION: that one guards writes to the plugin's configuration,
	 * and a token minted for a link that only sets a per-user display preference must
	 * not be spendable on anything else.
	 *
	 * @var string
	 */
	const DISMISS_NONCE_ACTION = 'owco_dismiss_notice';

	/**
	 * User meta holding the newest refusal this administrator has acknowledged.
	 *
	 * A timestamp, not a flag — see notice_write_refusals(). Prefixed like every
	 * other name this plugin stores.
	 *
	 * @var string
	 */
	const DISMISS_REFUSALS_META = 'owco_dismissed_write_refusals';

	/**
	 * How recent a refusal has to be for the site-wide notice to mention it.
	 *
	 * Guideline 11 again: the notice exists for a fault happening NOW. A refusal from
	 * a fortnight ago on a site that has been recording consent ever since is history,
	 * and history belongs on the dashboard panel, not on every screen of wp-admin.
	 *
	 * @var int
	 */
	const REFUSAL_NOTICE_DAYS = 7;

	public static function init() {
		add_action( 'admin_menu', array( __CLASS__, 'register_menu' ) );
		add_action( 'admin_menu', array( __CLASS__, 'cleanup_submenu' ), 999 );
		add_action( 'admin_init', array( __CLASS__, 'handle_save' ) );
		add_action( 'admin_init', array( __CLASS__, 'handle_notice_dismissal' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'enqueue_assets' ) );

		// Guideline 11 — a plugin must not hijack the dashboard with its notices.
		// The rule this plugin applies, and the reason each notice sits where it does:
		//
		//   * A condition the site owner has to act on TODAY, that they will otherwise
		//     never see, may be announced on any admin screen — and must then be
		//     dismissible, and must stop announcing itself once it is over. Exactly one
		//     condition qualifies here: this site is answering visitors that it cannot
		//     record their choice. A consent plugin that is not recording consent is the
		//     one thing an administrator cannot be left to discover by opening our menu.
		//
		//   * Everything else — a catalogue pattern that will not compile, a signing key
		//     that lives in the database — is a standing condition, interesting to us and
		//     not urgent to them. It belongs on our own screens, where they are already
		//     looking at the thing it concerns, and nowhere else.
		add_action( 'admin_notices', array( __CLASS__, 'notice_write_refusals' ) );
		add_action( 'admin_notices', array( __CLASS__, 'notice_invalid_patterns' ) );
		add_action( 'admin_notices', array( __CLASS__, 'notice_ledger_key' ) );

		// Plugin row links.
		add_filter( 'plugin_action_links_' . OWCO_BASENAME, array( __CLASS__, 'plugin_action_links' ) );

		// OWCO_DSAR prints a standalone "Requests to fulfil" notice above the DSAR tab.
		// Since 1.2.0 the queue itself carries those controls on every row, plus the
		// pending-state and closing actions the panel has no room for, so the panel is
		// pure duplication. Turned off through the opt-out filter OWCO_DSAR publishes for
		// exactly this purpose — its result and deadline notices are unaffected.
		add_filter( 'owco_dsar_show_fulfilment_panel', '__return_false' );
	}

	/**
	 * Surface invalid regex patterns from the scripts catalog (collected by OWCO_Core::match_pattern).
	 * Quietly skipped at runtime so they don't break the front end ; admins see them here.
	 *
	 * Guideline 11: confined to the plugin's own screens since 1.4.4. A pattern that
	 * will not compile is a maintenance note about our catalogue, not an emergency —
	 * and it is a STANDING one, so announced site-wide it would sit on every screen of
	 * the site until someone edited a row. It is raised where it can be acted on, next
	 * to the catalogue it is about, and it links straight at the offending rows.
	 */
	public static function notice_invalid_patterns() {
		if ( ! self::is_own_screen() ) { return; }
		if ( ! current_user_can( 'manage_options' ) ) { return; }
		$list = (array) get_transient( 'owco_invalid_patterns' );
		if ( empty( $list ) ) { return; }

		// Self-correcting: re-validate each recorded pattern against PCRE at render time.
		// Drop entries that are blank-looking (data noise) or no longer error — so a stale
		// transient left over from a previous build can never surface a blank/obsolete bullet.
		$still_bad = array();
		foreach ( $list as $h => $p ) {
			$p = (string) $p;
			if ( '' === (string) preg_replace( '/[\s\p{C}\p{Z}]+/u', '', $p ) ) {
				continue; // blank / whitespace / zero-width → silent skip
			}
			// Re-use the single source of truth instead of re-testing here: matching against
			// an EMPTY subject never backtracks, so it silently declares a catastrophic
			// pattern healthy. validate_regex_pattern() probes a ~1080-char string and also
			// treats a compile failure as invalid.
			// A short dot-less pattern is not a regex at all — it is the too-broad host
			// fragment OWCO_Core::match_pattern() refuses and records — so keep it as well.
			$too_short = ( strlen( $p ) < 6 && strpos( $p, '.' ) === false );
			if ( $too_short || ! OWCO_Core::validate_regex_pattern( $p ) ) {
				$still_bad[ $h ] = $p;
			}
		}

		if ( empty( $still_bad ) ) {
			// Nothing genuinely invalid anymore → clear the stale transient and show nothing.
			delete_transient( 'owco_invalid_patterns' );
			return;
		}
		if ( count( $still_bad ) !== count( $list ) ) {
			set_transient( 'owco_invalid_patterns', $still_bad, DAY_IN_SECONDS );
		}

		echo '<div class="notice notice-warning is-dismissible"><p><strong>OW Consent:</strong> '
			. esc_html__( 'Some tracker-catalogue patterns are invalid and were skipped, so whatever they were meant to block is not blocked:', 'ow-consent' )
			. '</p><ul style="margin-left:1.5em;list-style:disc;">';
		foreach ( $still_bad as $p ) {
			echo '<li><code>' . esc_html( $p ) . '</code></li>';
		}
		echo '</ul><p><a class="button button-small" href="'
			. esc_url( self::tab_url( 'catalog', array( 'invalid' => '1' ) ) ) . '">'
			. esc_html__( 'Repair them in the tracker catalogue', 'ow-consent' )
			. '</a></p></div>';
	}

	/**
	 * Tell the administrator when the ledger signing key lives in the database.
	 *
	 * Without OWCO_LEDGER_KEY in wp-config.php the plugin signs the chain with a random
	 * key it keeps in the database. The hash chain is still built, but anyone with
	 * database access could re-sign it, so the tamper-evidence claim does not hold and
	 * the administrator must be told (FIX-CONTRACT §6).
	 *
	 * Guideline 11: confined to the plugin's own screens since 1.4.4. Nothing is
	 * broken and no consent is being lost — the register is written and the chain is
	 * built; what is reduced is the evidential weight of that chain. It is also a
	 * permanent state until someone edits wp-config.php, so site-wide it would be a
	 * warning that never goes away, on every screen, forever. It is shown where the
	 * register itself is read, which is where the claim it qualifies is being relied
	 * on, and it stays dismissible.
	 *
	 * @return void
	 */
	public static function notice_ledger_key() {
		if ( ! self::is_own_screen() ) { return; }
		if ( ! current_user_can( 'manage_options' ) ) { return; }
		if ( ! class_exists( 'OWCO_Consent' ) || ! method_exists( 'OWCO_Consent', 'ledger_key_warning' ) ) { return; }
		if ( ! OWCO_Core::setting( 'ledger_enabled' ) ) { return; }

		$warning = (string) OWCO_Consent::ledger_key_warning();
		if ( '' === $warning ) { return; }

		echo '<div class="notice notice-warning is-dismissible"><p><strong>OW Consent:</strong> '
			. esc_html( $warning )
			. '</p></div>';
	}

	/* =================================================================
	 * GUIDELINE 11 — WHERE A NOTICE IS ALLOWED TO APPEAR
	 * ============================================================== */

	/**
	 * Whether the screen being rendered belongs to this plugin.
	 *
	 * Every notice this class raises except one is gated on this. Read from
	 * WP_Screen rather than from `$_GET['page']`, so that no superglobal is consulted
	 * to decide what is printed and a screen reached by any other route is judged the
	 * same way.
	 *
	 * @return bool
	 */
	protected static function is_own_screen() {
		if ( ! function_exists( 'get_current_screen' ) ) {
			return false;
		}
		$screen = get_current_screen();
		if ( ! is_object( $screen ) || ! isset( $screen->id ) ) {
			return false;
		}
		return ( false !== strpos( (string) $screen->id, self::MENU_SLUG ) );
	}

	/**
	 * The only notice this plugin raises outside its own screens.
	 *
	 * It says one thing: visitors are using the cookie banner and this site is
	 * answering that it cannot record their choice. That is the single condition an
	 * administrator must not be left to discover by opening our menu — nothing is
	 * stored for those visitors, so the site can prove neither a consent nor a
	 * refusal for them, and every hour it continues is an hour of collection it
	 * cannot account for. It is also, unlike every other warning here, TRANSIENT:
	 * it appears because something broke, and it stops on its own once the record is
	 * clear or the last refusal ages out of the window.
	 *
	 * What keeps it inside Guideline 11:
	 *   - it is printed only while at least one genuine refusal is less than
	 *     REFUSAL_NOTICE_DAYS old — never as a standing banner;
	 *   - it is dismissible, and the dismissal is REMEMBERED per user, so it does not
	 *     come back on the next page load the way `is-dismissible` alone would;
	 *   - a dismissal silences the refusals known at that moment, not the condition:
	 *     a refusal recorded afterwards raises it again, because that is new
	 *     information and not a repetition;
	 *   - it never appears on our own screens, which carry the full incident report
	 *     (render_write_refusals_panel()) instead of this three-line summary.
	 *
	 * The amber half of the record — events where the choice WAS saved and something
	 * merely interfered — is deliberately excluded. Those belong on the dashboard
	 * panel; raising them here would make a site that is working look broken.
	 *
	 * @return void
	 */
	public static function notice_write_refusals() {
		if ( ! current_user_can( 'manage_options' ) ) { return; }
		if ( self::is_own_screen() ) { return; }

		$refused = self::recent_write_refusals();
		if ( empty( $refused ) ) { return; }

		$newest = (int) $refused[0]['time'];
		$seen   = (int) get_user_meta( get_current_user_id(), self::DISMISS_REFUSALS_META, true );
		if ( $seen >= $newest ) { return; }

		$total       = count( $refused );
		$dismiss_url = add_query_arg(
			array(
				'owco_dismiss'        => 'write_refusals',
				'_owco_dismiss_nonce' => wp_create_nonce( self::DISMISS_NONCE_ACTION ),
			)
		);
		?>
		<div class="notice notice-error is-dismissible">
			<p><strong><?php esc_html_e( 'OW Consent: this site is telling visitors it cannot record their choice.', 'ow-consent' ); ?></strong></p>
			<p><?php
				printf(
					/* translators: %s: number of refused consent writes currently on record. */
					esc_html( _n(
						'%s consent write was refused, and nothing was stored for the visitor concerned: this site can prove neither a consent nor a refusal for them.',
						'%s consent writes were refused, and nothing was stored for the visitors concerned: this site can prove neither a consent nor a refusal for them.',
						$total,
						'ow-consent'
					) ),
					esc_html( number_format_i18n( $total ) )
				);
			?></p>
			<p>
				<a class="button button-primary" href="<?php echo esc_url( self::tab_url( 'dashboard' ) ); ?>"><?php esc_html_e( 'See what the site answered', 'ow-consent' ); ?></a>
				<a class="button-link" style="margin-left:10px;" href="<?php echo esc_url( $dismiss_url ); ?>"><?php esc_html_e( 'Hide this until it happens again', 'ow-consent' ); ?></a>
			</p>
		</div>
		<?php
	}

	/**
	 * Genuine, recent refusals — the rows the site-wide notice is allowed to count.
	 *
	 * Applies the same split as render_write_refusals_panel(): an entry with an HTTP
	 * status is a refusal, an entry with status 0 is a note about a write that
	 * SUCCEEDED, and `owco_cookie_not_persisted` names a success whatever status a
	 * future release logs it with. Rows with no usable timestamp are left to the
	 * dashboard panel: the notice's whole dismissal model is "newer than what you
	 * already dismissed", and a row dated zero cannot take part in it.
	 *
	 * @return array[] Newest first; empty when nothing qualifies.
	 */
	protected static function recent_write_refusals() {
		$rows = self::write_refusals();
		if ( empty( $rows ) ) {
			return array();
		}

		$cutoff = time() - ( self::REFUSAL_NOTICE_DAYS * DAY_IN_SECONDS );
		$out    = array();
		foreach ( $rows as $row ) {
			$time = isset( $row['time'] ) ? (int) $row['time'] : 0;
			if ( $time <= 0 || $time < $cutoff ) {
				continue;
			}
			if ( (int) $row['status'] <= 0 || 'owco_cookie_not_persisted' === $row['code'] ) {
				continue;
			}
			$out[] = $row;
		}

		// write_refusals() already returns newest first; re-indexed so that [0] is
		// the newest whatever the filtering above removed.
		return array_values( $out );
	}

	/**
	 * Remember that this administrator has seen the refusal notice.
	 *
	 * Stores the timestamp of the newest refusal known at dismissal time rather than
	 * a boolean, which is what lets the notice come back for a LATER refusal without
	 * ever repeating itself for the ones already acknowledged. Per user: one
	 * administrator hiding it must not hide it from their colleagues.
	 *
	 * @return void
	 */
	public static function handle_notice_dismissal() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- this only decides whether the request is one of ours; the nonce is verified below, before anything is read or written.
		if ( ! isset( $_GET['owco_dismiss'], $_GET['_owco_dismiss_nonce'] ) ) {
			return;
		}
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_owco_dismiss_nonce'] ) ), self::DISMISS_NONCE_ACTION ) ) {
			return;
		}
		if ( 'write_refusals' !== sanitize_key( wp_unslash( $_GET['owco_dismiss'] ) ) ) {
			return;
		}

		$rows   = self::recent_write_refusals();
		$newest = empty( $rows ) ? time() : (int) $rows[0]['time'];
		update_user_meta( get_current_user_id(), self::DISMISS_REFUSALS_META, $newest );

		// Back to the screen the administrator was on, minus the two arguments, so a
		// refresh cannot re-run the dismissal and the address bar stays clean.
		wp_safe_redirect( remove_query_arg( array( 'owco_dismiss', '_owco_dismiss_nonce' ) ) );
		exit;
	}

	public static function plugin_action_links( $links ) {
		$url = admin_url( 'admin.php?page=' . self::MENU_SLUG );
		array_unshift( $links, '<a href="' . esc_url( $url ) . '">' . esc_html__( 'Settings', 'ow-consent' ) . '</a>' );
		return $links;
	}

	/* =================================================================
	 * MENU
	 * ============================================================== */

	public static function register_menu() {
		add_menu_page(
			// Product name: printed as-is on purpose, so a locale cannot translate the brand.
			'OW Consent',
			'OW Consent',
			'manage_options',
			self::MENU_SLUG,
			array( __CLASS__, 'render_page' ),
			'dashicons-shield-alt',
			76
		);

		// No submenu : navigation is via in-page tabs.
		// The auto-created duplicate submenu is removed by cleanup_submenu() on admin_menu priority 999.
	}

	/**
	 * Remove the auto-created submenu (WordPress adds a duplicate of the parent menu title).
	 * Hooked late (priority 999) so it runs after all submenu construction.
	 */
	public static function cleanup_submenu() {
		global $submenu;
		if ( isset( $submenu[ self::MENU_SLUG ] ) ) {
			unset( $submenu[ self::MENU_SLUG ] );
		}
	}

	protected static function tabs() {
		return array(
			'dashboard'  => __( 'Dashboard', 'ow-consent' ),
			'banner'     => __( 'Banner', 'ow-consent' ),
			'compliance' => __( 'Compliance', 'ow-consent' ),
			'legal'      => __( 'Legal identity', 'ow-consent' ),
			'categories' => __( 'Categories', 'ow-consent' ),
			'policies'   => __( 'Policies', 'ow-consent' ),
			'scanner'    => __( 'Scanner', 'ow-consent' ),
			'catalog'    => __( 'Tracker catalogue', 'ow-consent' ),
			'ledger'     => __( 'Audit ledger', 'ow-consent' ),
			'dsar'       => __( 'DSAR requests', 'ow-consent' ),
		);
	}

	/**
	 * Admin URL of one of the plugin tabs, with optional extra query arguments.
	 *
	 * @param string $tab  Tab slug.
	 * @param array  $args Extra query arguments.
	 * @return string
	 */
	protected static function tab_url( $tab, array $args = array() ) {
		$args = array_merge( array( 'page' => self::MENU_SLUG, 'tab' => (string) $tab ), $args );
		return add_query_arg( $args, admin_url( 'admin.php' ) );
	}

	/* =================================================================
	 * ASSETS
	 * ============================================================== */

	/**
	 * Style handle of the admin stylesheet, assets/css/admin.css.
	 *
	 * The plugin's own handle, not core's `wp-admin`. Attaching to a core handle
	 * makes this plugin's CSS part of a stylesheet every screen of every other
	 * plugin also loads, it is emitted even on screens this enqueue deliberately
	 * skipped, and it cannot be dequeued without taking core's admin CSS with it.
	 *
	 * @var string
	 */
	const STYLE_HANDLE = 'owco-admin';

	public static function enqueue_assets( $hook ) {
		if ( strpos( (string) $hook, self::MENU_SLUG ) === false ) { return; }

		$ver = defined( 'OWCO_VERSION' ) ? (string) OWCO_VERSION : false;

		wp_enqueue_style( self::STYLE_HANDLE, OWCO_URL . 'assets/css/admin.css', array( 'wp-admin' ), $ver );
	}

	/* =================================================================
	 * SAVE (admin-post style)
	 * ============================================================== */

	public static function handle_save() {
		// === GET-based actions (URL links with nonce) ===
		if ( ! empty( $_GET['owco_action'] ) && ! empty( $_GET['_owco_nonce_url'] ) ) {
			if ( ! current_user_can( 'manage_options' ) ) { return; }
			if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_owco_nonce_url'] ) ), self::SAVE_NONCE_ACTION ) ) {
				wp_die( esc_html__( 'Invalid nonce.', 'ow-consent' ) );
			}
			$action = sanitize_key( wp_unslash( $_GET['owco_action'] ) );
			if ( $action === 'generate_policy_inline' ) {
				$type   = isset( $_GET['policy_type'] ) ? sanitize_key( wp_unslash( $_GET['policy_type'] ) ) : '';
				$result = OWCO_Policies::generate_page( $type, array( 'publish' => true ) );
				set_transient( 'owco_policy_gen_result', self::policy_result_payload( $result ), 60 );
				// No `updated=1` here: nothing was saved, and a WP_Error must not be
				// reported as "Settings saved." The outcome is rendered from the
				// transient by render_policy_gen_result() on the target tab.
				wp_safe_redirect( add_query_arg( array( 'page' => self::MENU_SLUG, 'tab' => 'compliance' ), admin_url( 'admin.php' ) ) );
				exit;
			}
			if ( 0 === strpos( $action, 'export_' ) ) {
				self::handle_export( substr( $action, 7 ) );
				return;
			}
		}

		if ( empty( $_POST['owco_admin_action'] ) ) { return; }
		if ( ! current_user_can( 'manage_options' ) ) { return; }
		if ( ! isset( $_POST['_owco_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_owco_nonce'] ) ), self::SAVE_NONCE_ACTION ) ) {
			wp_die( esc_html__( 'Invalid nonce.', 'ow-consent' ) );
		}

		$action = sanitize_key( wp_unslash( $_POST['owco_admin_action'] ) );

		if ( $action === 'save_settings' ) {
			$before_scanner = array(
				'enabled'   => (bool) OWCO_Core::setting( 'scanner_enabled' ),
				'frequency' => (string) OWCO_Core::setting( 'scanner_frequency' ),
			);
			self::save_settings_from_post();
			self::maybe_reschedule_scanner( $before_scanner );
			$tab = isset( $_POST['_tab'] ) ? sanitize_key( wp_unslash( $_POST['_tab'] ) ) : 'dashboard';
			$tabs = self::tabs();
			if ( ! isset( $tabs[ $tab ] ) ) { $tab = 'dashboard'; }
			wp_safe_redirect( add_query_arg( array( 'updated' => '1', 'tab' => $tab ), admin_url( 'admin.php?page=' . self::MENU_SLUG ) ) );
			exit;
		}

		if ( $action === 'reset_dpa_authority' ) {
			// Stored as '' rather than as the shipped 'CNIL': both make OWCO_Policies derive
			// the authority, but an empty value cannot be printed by mistake by anything
			// that reads the setting directly.
			$clean = OWCO_Core::sanitize_setting( 'legal_dpa_authority', '' );
			OWCO_Core::update_settings( array( 'legal_dpa_authority' => ( null === $clean ? '' : $clean ) ) );
			self::set_screen_result( 'success', __( 'The supervisory authority is derived from the compliance profile again.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dashboard' ) );
			exit;
		}

		if ( $action === 'clear_write_refusals' ) {
			if ( class_exists( 'OWCO_REST' ) && method_exists( 'OWCO_REST', 'clear_refusal_log' ) ) {
				OWCO_REST::clear_refusal_log();
				self::set_screen_result( 'success', __( 'The record of refused choices was emptied. If the cause is still there, it fills again as soon as a visitor uses the banner.', 'ow-consent' ) );
			} else {
				self::set_screen_result( 'error', __( 'This record cannot be emptied on this site: the endpoint that keeps it does not offer a way to.', 'ow-consent' ) );
			}
			wp_safe_redirect( self::tab_url( 'dashboard' ) );
			exit;
		}

		if ( $action === 'verify_ledger' ) {
			$res = OWCO_Consent::ledger_verify();
			set_transient( 'owco_ledger_verify_result', $res, 60 );
			wp_safe_redirect( add_query_arg( array( 'tab' => 'ledger' ), admin_url( 'admin.php?page=' . self::MENU_SLUG ) ) );
			exit;
		}

		if ( $action === 'run_scanner' ) {
			// phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged,WordPress.PHP.NoSilencedErrors.Discouraged -- a crawl of dozens of URLs needs more than the default limit; the call is disabled on some hosts and its failure is not actionable.
			@set_time_limit( 120 );
			$res = OWCO_Scanner::run_static_scan();
			set_transient( 'owco_scanner_run_result', $res, 60 );
			wp_safe_redirect( add_query_arg( array( 'tab' => 'scanner' ), admin_url( 'admin.php?page=' . self::MENU_SLUG ) ) );
			exit;
		}

		if ( $action === 'generate_policy' ) {
			$type    = isset( $_POST['policy_type'] ) ? sanitize_key( wp_unslash( $_POST['policy_type'] ) ) : '';
			$publish = ! empty( $_POST['policy_publish'] );
			$result  = OWCO_Policies::generate_page( $type, array( 'publish' => $publish ) );
			set_transient( 'owco_policy_gen_result', self::policy_result_payload( $result ), 60 );
			wp_safe_redirect( add_query_arg( array( 'tab' => 'policies' ), admin_url( 'admin.php?page=' . self::MENU_SLUG ) ) );
			exit;
		}

		if ( $action === 'dsar_resolve' || $action === 'dsar_respond' ) {
			self::handle_dsar_respond();
			return;
		}

		if ( $action === 'dsar_resend' || $action === 'dsar_cancel' ) {
			self::handle_dsar_lifecycle( $action );
			return;
		}

		if ( $action === 'confirm_finding' ) {
			$id  = isset( $_POST['finding_id'] ) ? absint( wp_unslash( $_POST['finding_id'] ) ) : 0;
			$cat = isset( $_POST['finding_category'] ) ? sanitize_key( wp_unslash( $_POST['finding_category'] ) ) : 'unknown';
			self::classify_findings( array( $id ), $cat );
			wp_safe_redirect( self::scanner_return_url() );
			exit;
		}

		if ( $action === 'bulk_classify' ) {
			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce and capability verified at the top of handle_save(); every id is cast with absint() on this line.
			$raw_ids = isset( $_POST['finding_ids'] ) ? array_map( 'absint', (array) wp_unslash( $_POST['finding_ids'] ) ) : array();
			$ids     = array();
			foreach ( $raw_ids as $raw_id ) {
				$one = absint( $raw_id );
				if ( $one > 0 ) { $ids[] = $one; }
			}
			$cat = isset( $_POST['bulk_category'] ) ? sanitize_key( wp_unslash( $_POST['bulk_category'] ) ) : '';
			self::classify_findings( $ids, $cat );
			wp_safe_redirect( self::scanner_return_url() );
			exit;
		}

		if ( $action === 'catalog_save' || $action === 'catalog_delete' ) {
			self::handle_catalog_write( $action );
			return;
		}
	}

	/* =================================================================
	 * SCANNER TRIAGE
	 * ============================================================== */

	/**
	 * Apply a category to one or several scanner findings.
	 *
	 * Routed through OWCO_Scanner::classify_finding() rather than a direct UPDATE, because
	 * that method also mirrors the decision into the blocking catalogue. Writing only to
	 * wp_owco_scanner — which is what 1.1.0 did — left the classification with no effect
	 * whatsoever on what the blocker blocks.
	 *
	 * @param array  $ids      Finding ids.
	 * @param string $category Category slug, or 'unknown' to un-classify.
	 * @return void
	 */
	protected static function classify_findings( array $ids, $category ) {
		$category  = sanitize_key( (string) $category );
		$allowed   = OWCO_Core::categories();
		$allowed[] = 'unknown';

		if ( empty( $ids ) ) {
			self::set_screen_result( 'error', __( 'No tracker was selected.', 'ow-consent' ) );
			return;
		}
		if ( ! in_array( $category, $allowed, true ) ) {
			self::set_screen_result( 'error', __( 'Choose a category before applying it.', 'ow-consent' ) );
			return;
		}
		if ( ! class_exists( 'OWCO_Scanner' ) || ! method_exists( 'OWCO_Scanner', 'classify_finding' ) ) {
			self::set_screen_result( 'error', __( 'The scanner module is unavailable.', 'ow-consent' ) );
			return;
		}

		$done = 0;
		foreach ( $ids as $id ) {
			$res = OWCO_Scanner::classify_finding( (int) $id, $category );
			if ( true === $res ) { $done++; }
		}

		if ( $done > 0 ) {
			do_action( 'owco_catalog_updated' );
			// 'unknown' writes category_guess = 'unknown', confirmed = 0 and deliberately
			// skips catalog_entry_for_finding(), so claiming the catalogue was updated
			// would be false in exactly that case.
			if ( 'unknown' === $category ) {
				/* translators: %s: number of trackers moved back to Uncategorized */
				$message = _n( '%s tracker moved back to Uncategorized. No blocking rule was written for it.', '%s trackers moved back to Uncategorized. No blocking rule was written for them.', $done, 'ow-consent' );
			} else {
				/* translators: %s: number of trackers whose category was changed */
				$message = _n( '%s tracker classified. The blocking catalogue was updated accordingly.', '%s trackers classified. The blocking catalogue was updated accordingly.', $done, 'ow-consent' );
			}
			// Not escaped here: render_screen_result() escapes when it prints.
			self::set_screen_result(
				'success',
				sprintf( $message, number_format_i18n( $done ) )
			);
		} else {
			self::set_screen_result( 'error', __( 'Nothing could be classified — the selected rows no longer exist.', 'ow-consent' ) );
		}
	}

	/**
	 * Back to the Scanner tab, keeping the filters and the page the admin was on.
	 *
	 * @return string
	 */
	protected static function scanner_return_url() {
		$keep = array();
		foreach ( array( 'filter', 'kind', 'state', 'paged' ) as $arg ) {
			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- handle_save() verifies the _owco_nonce field and manage_options before dispatching to the handler that calls this helper, so the write is already authorised; this only re-reads the listing state to rebuild the redirect target, unslashed and sanitized on the same line.
			$val = isset( $_POST[ '_owco_' . $arg ] ) ? sanitize_text_field( wp_unslash( $_POST[ '_owco_' . $arg ] ) ) : '';
			if ( '' !== $val ) { $keep[ $arg ] = $val; }
		}
		return self::tab_url( 'scanner', $keep );
	}

	/* =================================================================
	 * DSAR FULFILMENT
	 * ============================================================== */

	/**
	 * Record what was done about a request and close it.
	 *
	 * 1.1.0 only flipped `status` to resolved: the site then recorded in its own audit
	 * trail that a right had been honoured, with nothing anywhere saying what was
	 * actually sent or deleted. `response_notes` is the accountability trace GDPR art. 5.2
	 * expects, so it is now mandatory when closing a request.
	 *
	 * @return void
	 */
	protected static function handle_dsar_respond() {
		global $wpdb;

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce and capability are verified by handle_save() before this handler is dispatched; the value is unslashed and cast on this line.
		$id = isset( $_POST['dsar_id'] ) ? absint( wp_unslash( $_POST['dsar_id'] ) ) : 0;
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- see above; the value is unslashed and sanitized on this line.
		$notes  = isset( $_POST['dsar_notes'] ) ? sanitize_textarea_field( wp_unslash( $_POST['dsar_notes'] ) ) : '';
		$notes  = ( strlen( $notes ) > 2000 ) ? substr( $notes, 0, 2000 ) : $notes;
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- see above; the value is unslashed, sanitized and then checked against an allow-list.
		$status = isset( $_POST['dsar_status'] ) ? sanitize_key( wp_unslash( $_POST['dsar_status'] ) ) : 'resolved';
		if ( ! in_array( $status, array( 'resolved', 'rejected' ), true ) ) { $status = 'resolved'; }

		if ( $id <= 0 || ! self::table_ready( OWCO_TABLE_DSAR ) ) {
			self::set_screen_result( 'error', __( 'Unknown request.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}
		if ( '' === trim( $notes ) ) {
			self::set_screen_result( 'error', __( 'Say what you did before closing the request: the note is your proof that the right was honoured.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}

		// The row's own state decides what may be recorded — never the posted form alone.
		// Without this a replayed POST re-closes a request that was already resolved,
		// rejected or expired, and "Honoured" can be stamped on an identity nobody ever
		// confirmed.
		$table = OWCO_TABLE_DSAR;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table; the identifier is bound as %i and the id as %d. Never cached: the row is about to be written.
		$current = $wpdb->get_var( $wpdb->prepare( 'SELECT status FROM %i WHERE id = %d', $table, $id ) );
		if ( null === $current ) {
			self::set_screen_result( 'error', __( 'Unknown request.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}
		$current = (string) $current;
		if ( ! in_array( $current, array( 'pending', 'verified' ), true ) ) {
			self::set_screen_result( 'error', __( 'This request is already closed. Its answer cannot be rewritten — the audit trail has to stay as it was recorded.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}
		if ( 'verified' !== $current && 'resolved' === $status ) {
			self::set_screen_result( 'error', __( 'A right cannot be recorded as honoured while the requester has never confirmed their identity. Resend the identity link, mark the request expired, or close it as refused.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}

		$now  = gmdate( 'Y-m-d H:i:s' );
		$data = array(
			'status'             => $status,
			'handled_at'         => $now,
			'handled_by_user_id' => get_current_user_id(),
			'response_notes'     => $notes,
			'closed_at'          => $now,
		);
		$formats = array( '%s', '%s', '%d', '%s', '%s' );

		$suppress = $wpdb->suppress_errors( true );
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, single-row admin write; every value is bound by $wpdb->update() and there is nothing to cache.
		$ok = $wpdb->update( OWCO_TABLE_DSAR, $data, array( 'id' => $id ), $formats, array( '%d' ) );
		if ( false === $ok ) {
			// An install whose 1.2.0 migration has not run yet has no closed_at column.
			unset( $data['closed_at'] );
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, single-row admin write on the pre-1.2.0 column set; values bound by $wpdb->update().
			$ok = $wpdb->update( OWCO_TABLE_DSAR, $data, array( 'id' => $id ), array( '%s', '%s', '%d', '%s' ), array( '%d' ) );
		}
		$wpdb->suppress_errors( $suppress );

		if ( false === $ok ) {
			self::set_screen_result( 'error', __( 'The request could not be updated.', 'ow-consent' ) );
		} else {
			do_action( 'owco_dsar_closed', $id, $status, $notes );
			self::set_screen_result( 'success', __( 'Request closed and your answer recorded.', 'ow-consent' ) );
		}

		wp_safe_redirect( self::tab_url( 'dsar' ) );
		exit;
	}

	/**
	 * Give a `pending` request the two actions it never had: resend the identity link, or
	 * abandon it. Before 1.2.0 an unverified request had no control at all and stayed in
	 * the "Pending" card forever.
	 *
	 * @param string $action 'dsar_resend' or 'dsar_cancel'.
	 * @return void
	 */
	protected static function handle_dsar_lifecycle( $action ) {
		global $wpdb;

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce and capability are verified by handle_save() before this handler is dispatched; the value is unslashed and cast on this line.
		$id = isset( $_POST['dsar_id'] ) ? absint( wp_unslash( $_POST['dsar_id'] ) ) : 0;
		if ( $id <= 0 || ! self::table_ready( OWCO_TABLE_DSAR ) ) {
			self::set_screen_result( 'error', __( 'Unknown request.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}

		$table = OWCO_TABLE_DSAR;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table; the identifier is bound as %i and the id as %d. Never cached: the row is about to be written.
		$row = $wpdb->get_row( $wpdb->prepare( 'SELECT id, request_type, subject_email, status FROM %i WHERE id = %d', $table, $id ), ARRAY_A );
		if ( ! $row ) {
			self::set_screen_result( 'error', __( 'Unknown request.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}

		if ( 'dsar_cancel' === $action ) {
			$now = gmdate( 'Y-m-d H:i:s' );
			$suppress = $wpdb->suppress_errors( true );
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, single-row admin write; values bound by $wpdb->update().
			$ok = $wpdb->update(
				OWCO_TABLE_DSAR,
				array( 'status' => 'expired', 'handled_at' => $now, 'handled_by_user_id' => get_current_user_id(), 'closed_at' => $now, 'token_hash' => null ),
				array( 'id' => $id ),
				array( '%s', '%s', '%d', '%s', '%s' ),
				array( '%d' )
			);
			if ( false === $ok ) {
				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- same write restricted to the pre-1.2.0 column set; values bound by $wpdb->update().
				$ok = $wpdb->update( OWCO_TABLE_DSAR, array( 'status' => 'expired', 'handled_at' => $now ), array( 'id' => $id ), array( '%s', '%s' ), array( '%d' ) );
			}
			$wpdb->suppress_errors( $suppress );
			self::set_screen_result(
				false === $ok ? 'error' : 'success',
				false === $ok
					? __( 'The request could not be updated.', 'ow-consent' )
					: __( 'Request marked as expired: the identity of the requester was never confirmed.', 'ow-consent' )
			);
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}

		// Resend.
		if ( 'pending' !== (string) $row['status'] ) {
			self::set_screen_result( 'error', __( 'Only a request still waiting for identity confirmation can be re-sent.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}
		if ( ! class_exists( 'OWCO_DSAR' ) || ! method_exists( 'OWCO_DSAR', 'store_token' ) || ! method_exists( 'OWCO_DSAR', 'send_verification_email' ) ) {
			self::set_screen_result( 'error', __( 'The DSAR module is unavailable.', 'ow-consent' ) );
			wp_safe_redirect( self::tab_url( 'dsar' ) );
			exit;
		}

		// A fresh token invalidates the previous link, which is what "resend" must mean.
		$token = OWCO_DSAR::store_token( $id );
		$sent  = OWCO_DSAR::send_verification_email( array(
			'id'            => $id,
			'subject_email' => (string) $row['subject_email'],
			'request_type'  => (string) $row['request_type'],
			'token'         => $token,
		) );

		self::set_screen_result(
			$sent ? 'success' : 'error',
			$sent
				? __( 'A new identity-verification link was sent; the previous one no longer works.', 'ow-consent' )
				: __( 'The verification email could not be sent. Check the site mail configuration.', 'ow-consent' )
		);
		wp_safe_redirect( self::tab_url( 'dsar' ) );
		exit;
	}

	/* =================================================================
	 * TRACKER CATALOGUE WRITES
	 * ============================================================== */

	/**
	 * Insert, update or delete one blocking rule in wp_owco_scripts.
	 *
	 * @param string $action 'catalog_save' or 'catalog_delete'.
	 * @return void
	 */
	protected static function handle_catalog_write( $action ) {
		global $wpdb;

		$back = self::catalog_return_url();

		if ( ! self::table_ready( OWCO_TABLE_SCRIPTS ) ) {
			self::set_screen_result( 'error', __( 'The tracker catalogue table does not exist.', 'ow-consent' ) );
			wp_safe_redirect( $back );
			exit;
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce and capability are verified by handle_save() before this handler is dispatched; the value is unslashed and cast on this line.
		$id = isset( $_POST['catalog_id'] ) ? absint( wp_unslash( $_POST['catalog_id'] ) ) : 0;

		if ( 'catalog_delete' === $action ) {
			if ( $id <= 0 ) {
				self::set_screen_result( 'error', __( 'Unknown catalogue rule.', 'ow-consent' ) );
				wp_safe_redirect( $back );
				exit;
			}
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, single-row admin delete; the id is bound by $wpdb->delete().
			$deleted = $wpdb->delete( OWCO_TABLE_SCRIPTS, array( 'id' => $id ), array( '%d' ) );
			if ( $deleted ) {
				do_action( 'owco_catalog_updated' );
				self::set_screen_result( 'success', __( 'Blocking rule deleted. The tracker it covered is no longer blocked before consent.', 'ow-consent' ) );
			} else {
				self::set_screen_result( 'error', __( 'That rule no longer exists.', 'ow-consent' ) );
			}
			wp_safe_redirect( $back );
			exit;
		}

		$fields = self::read_catalog_post();
		$error  = self::validate_catalog_fields( $fields );
		if ( '' !== $error ) {
			self::set_screen_result( 'error', $error );
			wp_safe_redirect( $back );
			exit;
		}

		$data = array(
			'pattern'            => $fields['pattern'],
			'pattern_type'       => $fields['pattern_type'],
			'match_target'       => $fields['match_target'],
			'name'               => $fields['name'],
			'vendor'             => $fields['vendor'],
			'category'           => $fields['category'],
			'privacy_policy_url' => $fields['privacy_policy_url'],
		);
		$formats = array( '%s', '%s', '%s', '%s', '%s', '%s', '%s' );

		$suppress = $wpdb->suppress_errors( true );
		if ( $id > 0 ) {
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, single-row admin write; every value is bound by $wpdb->update().
			$ok      = $wpdb->update( OWCO_TABLE_SCRIPTS, $data, array( 'id' => $id ), $formats, array( '%d' ) );
			$message = __( 'Blocking rule updated.', 'ow-consent' );
		} else {
			$data['created_at'] = gmdate( 'Y-m-d H:i:s' );
			$formats[]          = '%s';
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, single-row admin write; every value is bound by $wpdb->insert().
			$ok      = $wpdb->insert( OWCO_TABLE_SCRIPTS, $data, $formats );
			$message = __( 'Blocking rule added. Matching trackers are now held until the visitor consents.', 'ow-consent' );
		}
		$wpdb->suppress_errors( $suppress );

		if ( false === $ok ) {
			self::set_screen_result( 'error', __( 'The rule could not be saved — most likely another rule already uses this exact pattern.', 'ow-consent' ) );
		} else {
			do_action( 'owco_catalog_updated' );
			// A repaired pattern must stop being reported as broken.
			delete_transient( 'owco_invalid_patterns' );
			self::set_screen_result( 'success', $message );
		}

		wp_safe_redirect( $back );
		exit;
	}

	/**
	 * Read the catalogue form fields out of POST.
	 *
	 * @return array<string,string>
	 */
	protected static function read_catalog_post() {
		$get = array( __CLASS__, 'post_text' );
		return array(
			'pattern'            => call_user_func( $get, 'catalog_pattern', 255 ),
			'pattern_type'       => sanitize_key( call_user_func( $get, 'catalog_pattern_type', 20 ) ),
			'match_target'       => sanitize_key( call_user_func( $get, 'catalog_match_target', 10 ) ),
			'name'               => call_user_func( $get, 'catalog_name', 190 ),
			'vendor'             => call_user_func( $get, 'catalog_vendor', 190 ),
			'category'           => sanitize_key( call_user_func( $get, 'catalog_category', 30 ) ),
			'privacy_policy_url' => esc_url_raw( call_user_func( $get, 'catalog_policy_url', 500 ) ),
		);
	}

	/**
	 * One sanitized POST string.
	 *
	 * The only callers are handlers that already verified the nonce and the capability in
	 * handle_save(); the sniff cannot see across that call boundary.
	 *
	 * @param string $key   POST key.
	 * @param int    $limit Maximum length kept.
	 * @return string
	 */
	protected static function post_text( $key, $limit = 190 ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce and capability are verified by handle_save() before any handler runs; the value is unslashed and sanitized on this line.
		$raw = isset( $_POST[ $key ] ) ? sanitize_text_field( wp_unslash( $_POST[ $key ] ) ) : '';
		$raw = trim( $raw );
		return ( strlen( $raw ) > $limit ) ? substr( $raw, 0, $limit ) : $raw;
	}

	/**
	 * Refuse a catalogue rule the matcher could never apply — or would apply far too widely.
	 *
	 * @param array $f Fields from read_catalog_post().
	 * @return string Translated error, or '' when the rule is acceptable.
	 */
	protected static function validate_catalog_fields( array $f ) {
		if ( '' === $f['pattern'] ) {
			return __( 'A blocking rule needs a pattern.', 'ow-consent' );
		}
		if ( ! in_array( $f['pattern_type'], self::catalog_pattern_types(), true ) ) {
			return __( 'Unknown pattern type.', 'ow-consent' );
		}
		if ( ! in_array( $f['match_target'], array( 'url', 'cookie' ), true ) ) {
			return __( 'A pattern matches either a resource URL or a cookie name.', 'ow-consent' );
		}
		if ( ! in_array( $f['category'], OWCO_Core::categories(), true ) ) {
			return __( 'Choose a consent category for this rule.', 'ow-consent' );
		}
		if ( 'regex' === $f['pattern_type'] ) {
			if ( ! OWCO_Core::validate_regex_pattern( $f['pattern'] ) ) {
				return __( 'That regular expression does not compile, or it backtracks so much that it would slow every page down. Fix it or use a plain host pattern.', 'ow-consent' );
			}
		}
		// FIX-CONTRACT §2.5 and OWCO_Core::match_pattern(): a short dot-less host pattern
		// matches inside unrelated file names ("ads" inside "downloads.js").
		if ( 'url' === $f['match_target'] && 'host' === $f['pattern_type'] ) {
			if ( strlen( $f['pattern'] ) < 6 || strpos( $f['pattern'], '.' ) === false ) {
				return __( 'A host pattern matched against URLs must contain a dot and be at least 6 characters long, otherwise it matches unrelated files. Use the "Cookie name" target for a short name.', 'ow-consent' );
			}
		}
		return '';
	}

	/**
	 * Pattern types the catalogue accepts.
	 *
	 * @return array<int,string>
	 */
	protected static function catalog_pattern_types() {
		return array( 'host', 'regex', 'inline_signature' );
	}

	/**
	 * Back to the catalogue, keeping the filters the admin was using.
	 *
	 * @return string
	 */
	protected static function catalog_return_url() {
		$keep = array();
		foreach ( array( 'cat', 'target', 'ptype', 's', 'invalid', 'paged' ) as $arg ) {
			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- handle_save() verifies the _owco_nonce field and manage_options before dispatching to the handler that calls this helper, so the write is already authorised; this only re-reads the listing state to rebuild the redirect target, unslashed and sanitized on the same line.
			$val = isset( $_POST[ '_owco_' . $arg ] ) ? sanitize_text_field( wp_unslash( $_POST[ '_owco_' . $arg ] ) ) : '';
			if ( '' !== $val ) { $keep[ $arg ] = $val; }
		}
		return self::tab_url( 'catalog', $keep );
	}

	/**
	 * Normalise what OWCO_Policies::generate_page() returned into a displayable array.
	 *
	 * A WP_Error may carry the list of mandatory settings that are still empty as its
	 * error data; that list is what the administrator actually needs to see.
	 *
	 * @param mixed $result Return value of OWCO_Policies::generate_page().
	 * @return array
	 */
	protected static function policy_result_payload( $result ) {
		if ( ! is_wp_error( $result ) ) {
			return is_array( $result ) ? $result : array();
		}

		$payload = array( 'error' => $result->get_error_message() );
		$data    = $result->get_error_data();
		if ( is_array( $data ) ) {
			$missing = isset( $data['missing'] ) ? $data['missing'] : $data;
			if ( is_array( $missing ) ) {
				$list = array();
				foreach ( $missing as $item ) {
					if ( is_scalar( $item ) ) {
						$list[] = (string) $item;
					}
				}
				if ( ! empty( $list ) ) {
					$payload['missing'] = $list;
				}
			}
		}
		return $payload;
	}

	protected static function save_settings_from_post() {
		// CRITICAL : only update keys present in this form submit.
		// Each tab's form has a hidden `value="0"` for every bool it owns → absent keys
		// mean "this field isn't on the form" (different tab), NOT "user unchecked it".
		// Otherwise saving one tab would nuke all settings on other tabs.
		// Nonce already verified by caller handle_save().
		// phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce + capability verified by the only caller, handle_save(); the array is unslashed here and sanitized per field by OWCO_Core::sanitize_setting().
		$incoming = isset( $_POST['owco'] ) ? (array) wp_unslash( $_POST['owco'] ) : array();
		$clean    = array();
		foreach ( $incoming as $k => $v ) {
			$sanitized = OWCO_Core::sanitize_setting( $k, $v );
			if ( $sanitized !== null ) {
				$clean[ $k ] = $sanitized;
			}
		}
		if ( ! empty( $clean ) ) {
			OWCO_Core::update_settings( $clean );
		}
	}

	/**
	 * Re-arm the scanner cron when its schedule settings actually changed.
	 *
	 * `OWCO_Scanner::maybe_schedule()` only ever schedules a *missing* event, so switching
	 * the frequency from Weekly to Daily used to be saved and then ignored until the next
	 * activation. Called right after a settings save, with the values read before it.
	 *
	 * @param array $before array{enabled:bool,frequency:string} state before the save.
	 * @return void
	 */
	protected static function maybe_reschedule_scanner( array $before ) {
		if ( ! class_exists( 'OWCO_Scanner' ) ) { return; }

		$enabled   = (bool) OWCO_Core::setting( 'scanner_enabled' );
		$frequency = (string) OWCO_Core::setting( 'scanner_frequency' );
		if ( $enabled === $before['enabled'] && $frequency === $before['frequency'] ) {
			return; // nothing to do.
		}

		// Prefer the scanner's own entry point when it exposes one.
		if ( method_exists( 'OWCO_Scanner', 'reschedule' ) ) {
			OWCO_Scanner::reschedule();
			return;
		}

		$hook = defined( 'OWCO_Scanner::CRON_HOOK' ) ? OWCO_Scanner::CRON_HOOK : 'owco_scanner_run';
		wp_clear_scheduled_hook( $hook );
		if ( ! $enabled ) { return; }

		$schedules  = (array) wp_get_schedules();
		$recurrence = isset( $schedules[ $frequency ] ) ? $frequency : 'daily';
		wp_schedule_event( time() + ( 10 * MINUTE_IN_SECONDS ), $recurrence, $hook );
	}

	/**
	 * Human label for a cron recurrence, falling back to the slug.
	 *
	 * @param string $slug Recurrence slug.
	 * @return string
	 */
	protected static function schedule_label( $slug ) {
		$schedules = (array) wp_get_schedules();
		if ( isset( $schedules[ $slug ]['display'] ) ) {
			return (string) $schedules[ $slug ]['display'];
		}
		return (string) $slug;
	}

	/* =================================================================
	 * RENDER
	 * ============================================================== */

	public static function render_page() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only admin screen tab filter.
		$tab = isset( $_GET['tab'] ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : 'dashboard';
		$tabs = self::tabs();
		if ( ! isset( $tabs[ $tab ] ) ) { $tab = 'dashboard'; }
		?>
		<div class="wrap owco-admin">
			<header class="owco-admin-header" style="display:flex;align-items:center;gap:16px;margin:16px 0 8px;flex-wrap:wrap;">
				<img
					src="<?php echo esc_url( OWCO_URL . 'assets/logo-header.png' ); ?>"
					alt="OptionWeb"
					style="height:36px;width:auto;filter:invert(1);"
				>
				<?php // Second half of the "OW | Consent" product name: printed as-is so a locale cannot translate the brand. ?>
				<span style="font-weight:400;color:#1d2327;font-size:23px;line-height:1.3;">Consent</span>
				<?php if ( OWCO_Core::setting( 'banner_enabled' ) ) : ?>
					<span style="display:inline-flex;align-items:center;background:linear-gradient(135deg,#f97316 0%,#ea580c 100%);color:#fff;font-size:11px;font-weight:700;letter-spacing:.05em;padding:3px 10px;border-radius:999px;text-transform:uppercase;"><?php esc_html_e( 'Active', 'ow-consent' ); ?></span>
				<?php else : ?>
					<span style="display:inline-flex;align-items:center;background:#e5e7eb;color:#374151;font-size:11px;font-weight:700;letter-spacing:.05em;padding:3px 10px;border-radius:999px;text-transform:uppercase;"><?php esc_html_e( 'Off', 'ow-consent' ); ?></span>
				<?php endif; ?>
				<span style="margin-left:auto;font-size:13px;color:#6b7280;">
					<?php
					/* translators: %s: plugin version */
					printf( esc_html__( 'Version %s', 'ow-consent' ), esc_html( OWCO_VERSION ) );
					?>
					&middot;
					<a href="https://optionweb.dev/en/addons/ow-consent/" target="_blank" rel="noopener" style="text-decoration:none;color:#ea580c;font-weight:500;">optionweb.dev</a>
				</span>
			</header>
			<p class="description" style="margin:0 0 24px;color:#4b5563;font-size:13px;">
				<?php esc_html_e( 'Consent management — GDPR, CCPA, LGPD, TCF v2.2 — cookie banner, automatic tracker blocking, scanner, policy generator, DSAR portal.', 'ow-consent' ); ?>
			</p>

			<?php
			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only admin screen flag.
			if ( ! empty( $_GET['updated'] ) ) : ?>
				<div class="notice notice-success is-dismissible"><p><?php esc_html_e( 'Settings saved.', 'ow-consent' ); ?></p></div>
			<?php endif; ?>

			<h2 class="nav-tab-wrapper">
				<?php foreach ( $tabs as $slug => $label ) :
					$url = add_query_arg( array( 'page' => self::MENU_SLUG, 'tab' => $slug ), admin_url( 'admin.php' ) );
					$class = 'nav-tab' . ( $tab === $slug ? ' nav-tab-active' : '' ); ?>
					<a href="<?php echo esc_url( $url ); ?>" class="<?php echo esc_attr( $class ); ?>"><?php echo esc_html( $label ); ?></a>
				<?php endforeach; ?>
			</h2>

			<?php
			self::render_screen_result();

			switch ( $tab ) {
				case 'banner':     self::render_tab_banner();     break;
				case 'compliance': self::render_tab_compliance(); break;
				case 'legal':      self::render_tab_legal();      break;
				case 'categories': self::render_tab_categories(); break;
				case 'policies':   self::render_tab_policies();   break;
				case 'scanner':    self::render_tab_scanner();    break;
				case 'catalog':    self::render_tab_catalog();    break;
				case 'ledger':     self::render_tab_ledger();     break;
				case 'dsar':       self::render_tab_dsar();       break;
				default:           self::render_tab_dashboard();  break;
			}
			?>
		</div>
		<?php
	}

	/* ---------------- Dashboard ---------------- */

	protected static function render_tab_dashboard() {
		global $wpdb;
		$ledger_table = OWCO_TABLE_LEDGER;
		$ledger_ok    = self::table_ready( $ledger_table );
		$ledger_count = 0;
		$last_consent = '';

		if ( $ledger_ok ) {
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, bound as %i. Live counter, must not be cached.
			$ledger_count = (int) $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i', $ledger_table ) );
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, bound as %i. Live value, must not be cached.
			$last_consent = (string) $wpdb->get_var( $wpdb->prepare( 'SELECT created_at FROM %i ORDER BY id DESC LIMIT 1', $ledger_table ) );
		}

		// The 1.1.0 card counted `status = 'pending'` — the one status that is NOT
		// actionable — and labelled it "to handle within 30 days".
		$dsar         = self::dsar_stats();
		$dsar_open    = $dsar['pending'] + $dsar['verified'];

		$profile = OWCO_Core::setting( 'compliance_profile' );
		$profile_label = self::profile_label( $profile );

		// Diag.
		$issues = self::compliance_diagnostic();
		?>
		<div class="owco-cards">
			<div class="owco-card">
				<h3><?php esc_html_e( 'Compliance profile', 'ow-consent' ); ?></h3>
				<div class="owco-big"><?php echo esc_html( $profile_label ); ?></div>
				<div class="owco-sub"><?php esc_html_e( 'Active legal framework', 'ow-consent' ); ?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Recorded consents', 'ow-consent' ); ?></h3>
				<div class="owco-big"><?php echo esc_html( number_format_i18n( $ledger_count ) ); ?></div>
				<div class="owco-sub"><?php
					if ( ! $ledger_ok ) {
						esc_html_e( 'The ledger table is missing.', 'ow-consent' );
					} elseif ( '' !== $last_consent ) {
						/* translators: %s: date and time of the most recent recorded consent, in the site timezone */
						echo esc_html( sprintf( __( 'Last: %s', 'ow-consent' ), self::utc_to_local_display( $last_consent ) ) );
					} else {
						esc_html_e( 'None yet.', 'ow-consent' );
					}
				?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Open DSAR', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="color:<?php echo $dsar['overdue'] > 0 ? '#b91c1c' : '#0f172a'; ?>;"><?php echo esc_html( number_format_i18n( $dsar_open ) ); ?></div>
				<div class="owco-sub"><?php
					if ( $dsar['overdue'] > 0 ) {
						printf(
							/* translators: %s: number of requests past their legal deadline */
							esc_html( _n( '%s past its legal deadline.', '%s past their legal deadline.', $dsar['overdue'], 'ow-consent' ) ),
							esc_html( number_format_i18n( $dsar['overdue'] ) )
						);
					} else {
						printf(
							/* translators: %d: number of days the site commits to answer within */
							esc_html( _n( 'To answer within %d day.', 'To answer within %d days.', $dsar['response_days'], 'ow-consent' ) ),
							(int) $dsar['response_days']
						);
					}
				?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Google Consent Mode v2', 'ow-consent' ); ?></h3>
				<div class="owco-big" aria-hidden="true"><?php echo OWCO_Core::setting( 'gcm_enabled' ) ? '✅' : '⛔'; ?></div>
				<div class="owco-sub"><?php echo OWCO_Core::setting( 'gcm_enabled' ) ? esc_html__( 'Active', 'ow-consent' ) : esc_html__( 'Inactive', 'ow-consent' ); ?></div>
			</div>
		</div>

		<?php
		// Prints nothing at all unless the endpoint actually refused a write.
		self::render_write_refusals_panel();
		?>

		<?php if ( OWCO_Core::setting( 'geo_enabled' ) && class_exists( 'OWCO_Geo' ) ) :
			$geo = OWCO_Geo::geo_for_js(); ?>
		<div class="owco-section">
			<h2><?php esc_html_e( 'Geolocation (dynamic profile)', 'ow-consent' ); ?></h2>
			<p><?php
				printf(
					/* translators: 1: visitor country code in <code>, 2: applied profile in <strong>, 3: detection source in <em> */
					wp_kses_post( __( 'Visitor detected: country %1$s — applied profile: %2$s — source: %3$s', 'ow-consent' ) ),
					'<code>' . esc_html( $geo['country'] ?: '—' ) . '</code>',
					'<strong>' . esc_html( $geo['profile'] ) . '</strong>',
					'<em>' . esc_html( $geo['source'] ) . '</em>'
				);
			?></p>
			<p class="owco-help"><?php esc_html_e( 'The compliance profile is selected automatically based on the visitor country. Sources tested in order: Cloudflare → CloudFront → server mod_geoip → local MaxMind → site locale → default setting.', 'ow-consent' ); ?></p>
		</div>
		<?php endif; ?>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Compliance diagnostic', 'ow-consent' ); ?></h2>
			<?php if ( empty( $issues ) ) : ?>
				<p><span class="owco-pill ok">✓</span> <?php esc_html_e( 'No issue detected. The site is correctly configured for the selected profile.', 'ow-consent' ); ?></p>
			<?php else : ?>
				<ul style="list-style:disc;padding-left:20px;">
					<?php foreach ( $issues as $issue ) : ?>
						<li><span class="owco-pill <?php echo esc_attr( $issue['level'] ); ?>"><?php echo esc_html( $issue['level'] === 'warn' ? __( 'Warning', 'ow-consent' ) : __( 'Error', 'ow-consent' ) ); ?></span> <?php echo esc_html( $issue['message'] ); ?>
							<?php if ( ! empty( $issue['action'] ) ) : ?>
								<form method="post" style="display:inline;margin-left:8px;">
									<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
									<input type="hidden" name="owco_admin_action" value="<?php echo esc_attr( (string) $issue['action'] ); ?>">
									<button type="submit" class="button button-small"><?php echo esc_html( isset( $issue['action_label'] ) ? (string) $issue['action_label'] : __( 'Fix this', 'ow-consent' ) ); ?></button>
								</form>
							<?php endif; ?>
						</li>
					<?php endforeach; ?>
				</ul>
			<?php endif; ?>
		</div>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Quick help', 'ow-consent' ); ?></h2>
			<p><?php esc_html_e( 'OW Consent handles the cookie banner, the tamper-proof consent audit ledger, Google Consent Mode v2, and DSAR requests (right of access / erasure) for you. Start with:', 'ow-consent' ); ?></p>
			<ol>
				<li><?php esc_html_e( '"Compliance" tab → select the legal framework (GDPR for Europe).', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( '"Banner" tab → customise the texts / position.', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( '"Categories" tab → enable/disable the cookie types used on your site.', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( '"Legal identity" tab → fill in your company, registration and hosting details. The policy generator refuses to publish a document while a mandatory field is empty.', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( '"Policies" tab → generate the privacy policy, cookie policy, legal notice and terms.', 'ow-consent' ); ?></li>
			</ol>
		</div>
		<?php
	}

	/* ---------------- Refused consent writes ---------------- */

	/**
	 * Panel: what the public write endpoint refused, and what it let through with
	 * a warning.
	 *
	 * Renders NOTHING while the record is empty, which is the normal state — it
	 * must never become another permanent notice. When it is not empty it is the
	 * whole incident report on one screen: what the visitor experienced, how often,
	 * over what window, which code the endpoint answered, what that code means and
	 * what to change. It exists so that the next occurrence of the 1.3.1 incident on
	 * a live site — every write refused, for weeks, with the cause readable only in
	 * a browser console nobody opened — names itself in wp-admin instead.
	 *
	 * OWCO_REST::refusal_log() records two different things and they must not be
	 * shown as one. An entry with an HTTP status is a refusal: nothing was stored
	 * and the visitor saw an error. An entry with status 0 is a warning: the choice
	 * WAS recorded, but something about the site interfered on the way. Calling the
	 * second kind a refusal would raise a red alarm on a site that is working.
	 *
	 * One code overrides that split by name — see the bucketing below.
	 *
	 * @return void
	 */
	protected static function render_write_refusals_panel() {
		$rows = self::write_refusals();
		if ( empty( $rows ) ) {
			return;
		}

		$refused = array();
		$notes   = array();
		foreach ( $rows as $row ) {
			// The status is what separates the two, with one exception settled by the
			// code itself: `owco_cookie_not_persisted` names an event where the write
			// SUCCEEDED — the register holds the choice — so it belongs in the amber
			// half whatever status a future release happens to log it with. Shown as a
			// refusal it would raise a red alarm on a site whose register is complete.
			if ( $row['status'] > 0 && 'owco_cookie_not_persisted' !== $row['code'] ) {
				$refused[] = $row;
			} else {
				$notes[] = $row;
			}
		}

		$accent = empty( $refused ) ? '#b45309' : '#b91c1c';
		?>
		<div class="owco-section" style="border-left:4px solid <?php echo esc_attr( $accent ); ?>;">
			<?php
			if ( ! empty( $refused ) ) {
				self::render_refusals_block( $refused );
			}
			if ( ! empty( $notes ) ) {
				self::render_refusal_notes_block( $notes, ! empty( $refused ) );
			}
			?>
			<?php if ( class_exists( 'OWCO_REST' ) && method_exists( 'OWCO_REST', 'clear_refusal_log' ) ) : ?>
				<form method="post" class="owco-actions">
					<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
					<input type="hidden" name="owco_admin_action" value="clear_write_refusals">
					<button type="submit" class="button"><?php esc_html_e( 'Clear this record', 'ow-consent' ); ?></button>
				</form>
				<p class="owco-help"><?php esc_html_e( 'Clear it once you have changed something, then have someone load the site and use the banner. If this panel does not come back, the site is recording choices again.', 'ow-consent' ); ?></p>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * The refusals themselves: nothing was stored for these visitors.
	 *
	 * @param array[] $refused Normalised rows, newest first, all with a status.
	 * @return void
	 */
	protected static function render_refusals_block( array $refused ) {
		$total = count( $refused );

		$times = array();
		foreach ( $refused as $row ) {
			if ( $row['time'] > 0 ) {
				$times[] = $row['time'];
			}
		}
		$newest = empty( $times ) ? 0 : max( $times );
		$oldest = empty( $times ) ? 0 : min( $times );

		$counts = array();
		foreach ( $refused as $row ) {
			$code            = ( '' === $row['code'] ) ? 'unknown' : $row['code'];
			$counts[ $code ] = isset( $counts[ $code ] ) ? ( $counts[ $code ] + 1 ) : 1;
		}
		arsort( $counts );
		$top_code  = (string) key( $counts );
		$top_count = (int) current( $counts );

		// The most recent refusal carrying the dominant code: its two host names are
		// the pair worth printing next to the configured address.
		$sample = $refused[0];
		foreach ( $refused as $row ) {
			$code = ( '' === $row['code'] ) ? 'unknown' : $row['code'];
			if ( $code === $top_code ) {
				$sample = $row;
				break;
			}
		}

		$explain = self::refusal_explanation( $top_code );
		$listed  = array_slice( $refused, 0, 10 );
		?>
		<h2 style="margin-top:0;color:#b91c1c;"><?php esc_html_e( 'Visitor choices are not being recorded', 'ow-consent' ); ?></h2>

		<p><?php esc_html_e( 'Visitors are using the banner and this site is answering that it cannot record their choice. Nothing was stored for them and no tracker was released, so nothing was deposited against their wishes — but over the period below, this site can prove neither a consent nor a refusal.', 'ow-consent' ); ?></p>

		<p>
			<?php
			if ( $oldest > 0 && $newest > 0 && $oldest !== $newest ) {
				printf(
					/* translators: 1: number of refused writes. 2: date and time of the oldest one. 3: date and time of the most recent one. */
					esc_html( _n( '%1$s choice was refused, between %2$s and %3$s.', '%1$s choices were refused, between %2$s and %3$s.', $total, 'ow-consent' ) ),
					esc_html( number_format_i18n( $total ) ),
					esc_html( self::refusal_time_display( $oldest ) ),
					esc_html( self::refusal_time_display( $newest ) )
				);
			} elseif ( $newest > 0 ) {
				printf(
					/* translators: 1: number of refused writes. 2: date and time of the most recent one. */
					esc_html( _n( '%1$s choice was refused, the last one at %2$s.', '%1$s choices were refused, the last one at %2$s.', $total, 'ow-consent' ) ),
					esc_html( number_format_i18n( $total ) ),
					esc_html( self::refusal_time_display( $newest ) )
				);
			} else {
				printf(
					/* translators: %s: number of refused writes. */
					esc_html( _n( '%s choice was refused.', '%s choices were refused.', $total, 'ow-consent' ) ),
					esc_html( number_format_i18n( $total ) )
				);
			}
			?>
			<?php
			// The depth of the record is the REST unit's to decide, so it is read from
			// there rather than restated here, where it would silently go stale.
			$kept = defined( 'OWCO_REST::REFUSAL_LOG_MAX' ) ? (int) constant( 'OWCO_REST::REFUSAL_LOG_MAX' ) : 20;
			printf(
				/* translators: %s: how many events the record keeps at most. */
				esc_html__( 'Only the %s most recent events are kept, and an identical one is not written again for five minutes, so the true number of affected visitors is higher.', 'ow-consent' ),
				esc_html( number_format_i18n( $kept ) )
			);
			?>
		</p>

		<p style="margin-top:14px;">
			<span class="owco-pill bad"><?php echo esc_html( $top_code ); ?></span>
			<?php
			if ( $top_count === $total ) {
				printf(
					/* translators: %s: number of refusals on record, all of them carrying the code shown just before. */
					esc_html( _n( '%s refusal kept, and this is its code.', '%s refusals kept, and this is the code on every one of them.', $total, 'ow-consent' ) ),
					esc_html( number_format_i18n( $total ) )
				);
			} else {
				printf(
					/* translators: 1: number of refusals carrying the most frequent code. 2: total number of refusals on record. */
					esc_html__( 'Most frequent reason — %1$s of the %2$s refusals kept.', 'ow-consent' ),
					esc_html( number_format_i18n( $top_count ) ),
					esc_html( number_format_i18n( $total ) )
				);
			}
			?>
		</p>
		<p><?php echo esc_html( $explain['cause'] ); ?></p>
		<p><strong><?php esc_html_e( 'What to change:', 'ow-consent' ); ?></strong> <?php echo esc_html( $explain['fix'] ); ?></p>
		<?php if ( '' !== $explain['hint'] ) : ?>
			<p><code><?php echo esc_html( $explain['hint'] ); ?></code></p>
		<?php endif; ?>

		<?php
		if ( 'owco_bad_origin' === $top_code ) {
			self::render_refusal_origin_comparison( $sample );
		}
		?>

		<h3 style="margin:18px 0 6px;"><?php esc_html_e( 'The refusals themselves', 'ow-consent' ); ?></h3>
		<?php self::render_refusal_table( $listed ); ?>
		<?php if ( $total > count( $listed ) ) : ?>
			<p class="owco-help">
				<?php
				printf(
					/* translators: 1: number of refusals listed above. 2: number of refusals kept in total. */
					esc_html__( 'Showing the %1$s most recent of the %2$s kept.', 'ow-consent' ),
					esc_html( number_format_i18n( count( $listed ) ) ),
					esc_html( number_format_i18n( $total ) )
				);
				?>
			</p>
		<?php endif; ?>
		<?php
	}

	/**
	 * The other half of the record: the choice WAS recorded, but something about
	 * the site interfered and the operator has to know.
	 *
	 * @param array[] $notes    Normalised rows whose status is 0.
	 * @param bool    $secondary True when a refusals block was printed above.
	 * @return void
	 */
	protected static function render_refusal_notes_block( array $notes, $secondary ) {
		$counts = array();
		foreach ( $notes as $row ) {
			$code            = ( '' === $row['code'] ) ? 'unknown' : $row['code'];
			$counts[ $code ] = isset( $counts[ $code ] ) ? ( $counts[ $code ] + 1 ) : 1;
		}
		arsort( $counts );
		$top_code = (string) key( $counts );
		// The count belongs to the code being explained, not to the whole half: a record
		// holding one of each would otherwise claim both events carry the code shown.
		$top_count = (int) current( $counts );
		$explain   = self::refusal_note_explanation( $top_code );
		$listed    = array_slice( $notes, 0, 5 );

		// The most recent note carrying the dominant code: its two host names are the
		// pair worth printing next to the configured address.
		$sample = $notes[0];
		foreach ( $notes as $row ) {
			$code = ( '' === $row['code'] ) ? 'unknown' : $row['code'];
			if ( $code === $top_code ) {
				$sample = $row;
				break;
			}
		}

		if ( $secondary ) {
			echo '<h3 style="margin:22px 0 6px;color:#b45309;">' . esc_html__( 'Recorded, but not cleanly', 'ow-consent' ) . '</h3>';
		} else {
			echo '<h2 style="margin-top:0;color:#b45309;">' . esc_html__( 'Choices are being recorded, but something is interfering', 'ow-consent' ) . '</h2>';
		}
		?>
		<p>
			<span class="owco-pill warn"><?php echo esc_html( $top_code ); ?></span>
			<?php
			printf(
				/* translators: %s: number of events carrying the code shown just before. */
				esc_html( _n( '%s event carries this code. The visitor choice was saved — this is not a refusal.', '%s events carry this code. The visitor choices were saved — these are not refusals.', $top_count, 'ow-consent' ) ),
				esc_html( number_format_i18n( $top_count ) )
			);
			?>
		</p>
		<p><?php echo esc_html( $explain['cause'] ); ?></p>
		<p><strong><?php esc_html_e( 'What to change:', 'ow-consent' ); ?></strong> <?php echo esc_html( $explain['fix'] ); ?></p>
		<?php
		// On this code the two addresses differing IS the whole answer, so it is shown
		// rather than described — the same comparison the same-origin refusal prints.
		if ( 'owco_cookie_not_persisted' === $top_code ) {
			self::render_refusal_origin_comparison( $sample, 'cookie' );
		}
		?>
		<?php self::render_refusal_table( $listed ); ?>
		<?php
	}

	/**
	 * The listing shared by both halves of the panel.
	 *
	 * @param array[] $rows Normalised rows.
	 * @return void
	 */
	protected static function render_refusal_table( array $rows ) {
		?>
		<table class="owco-table">
			<thead>
				<tr>
					<th><?php esc_html_e( 'When', 'ow-consent' ); ?></th>
					<th><?php esc_html_e( 'Code', 'ow-consent' ); ?></th>
					<th><?php esc_html_e( 'HTTP', 'ow-consent' ); ?></th>
					<th><?php esc_html_e( 'Address the visitor was on', 'ow-consent' ); ?></th>
					<th><?php esc_html_e( 'Address the request reached', 'ow-consent' ); ?></th>
					<th><?php esc_html_e( 'Security token', 'ow-consent' ); ?></th>
				</tr>
			</thead>
			<tbody>
				<?php foreach ( $rows as $row ) : ?>
					<tr>
						<td><?php echo esc_html( self::refusal_time_display( $row['time'] ) ); ?></td>
						<td class="mono"><?php echo esc_html( '' === $row['code'] ? '—' : $row['code'] ); ?></td>
						<td><?php echo esc_html( $row['status'] > 0 ? (string) $row['status'] : '—' ); ?></td>
						<td class="mono"><?php echo esc_html( '' === $row['origin'] ? '—' : $row['origin'] ); ?></td>
						<td class="mono"><?php echo esc_html( '' === $row['host'] ? '—' : $row['host'] ); ?></td>
						<td><?php echo esc_html( $row['token'] ? __( 'Yes', 'ow-consent' ) : __( 'No', 'ow-consent' ) ); ?></td>
					</tr>
				<?php endforeach; ?>
			</tbody>
		</table>
		<?php
	}

	/**
	 * The three addresses side by side, for the two codes a mismatch between them
	 * explains on its own.
	 *
	 * The comparison IS the answer for both, so it is printed rather than described:
	 * the address the browser declared, the address the request landed on, and the
	 * address WordPress is configured with. Only the closing advice differs, because
	 * the consequence does. On 'refusal' the mismatch stopped the write at the door,
	 * and declaring the other address as an accepted alias is a real fix. On 'cookie'
	 * the write went through and it is the visitor browser that discarded the reply,
	 * which no server-side allowance can undo — there, only the two addresses being
	 * the same makes the cookie stick, and the www. spelling is the whole difference
	 * rather than an irrelevance.
	 *
	 * @param array  $sample One normalised row.
	 * @param string $kind   'refusal' when the write was turned down, 'cookie' when it
	 *                       succeeded and the browser kept nothing.
	 * @return void
	 */
	protected static function render_refusal_origin_comparison( array $sample, $kind = 'refusal' ) {
		$cookie_kind = ( 'cookie' === $kind );
		$home        = self::refusal_host( (string) wp_parse_url( home_url( '/' ), PHP_URL_HOST ) );
		$site        = self::refusal_host( (string) wp_parse_url( site_url( '/' ), PHP_URL_HOST ) );
		$seen        = ( '' !== $sample['origin'] ) ? $sample['origin'] : $sample['host'];
		?>
		<table class="owco-table" style="margin:12px 0;max-width:660px;">
			<tbody>
				<tr>
					<th><?php esc_html_e( 'Address the visitor was browsing', 'ow-consent' ); ?></th>
					<td class="mono"><?php echo esc_html( '' === $sample['origin'] ? '—' : $sample['origin'] ); ?></td>
				</tr>
				<tr>
					<th><?php esc_html_e( 'Address the request reached', 'ow-consent' ); ?></th>
					<td class="mono"><?php echo esc_html( '' === $sample['host'] ? '—' : $sample['host'] ); ?></td>
				</tr>
				<tr>
					<th><?php esc_html_e( 'Address WordPress is configured with (Site Address)', 'ow-consent' ); ?></th>
					<td class="mono"><?php echo esc_html( '' === $home ? '—' : $home ); ?></td>
				</tr>
				<?php if ( '' !== $site && $site !== $home ) : ?>
					<tr>
						<th><?php esc_html_e( 'Address WordPress is configured with (WordPress Address)', 'ow-consent' ); ?></th>
						<td class="mono"><?php echo esc_html( $site ); ?></td>
					</tr>
				<?php endif; ?>
			</tbody>
		</table>
		<p>
			<?php
			if ( '' !== $seen && '' !== $home && $seen !== $home && $seen !== $site ) {
				if ( $cookie_kind ) {
					printf(
						/* translators: 1: host name the visitor browser declared. 2: host name WordPress is configured with. */
						esc_html__( 'These do not match: the browser said %1$s, WordPress says %2$s. That single difference is why the cookie is not kept, and nothing else needs looking at until it is gone.', 'ow-consent' ),
						esc_html( $seen ),
						esc_html( $home )
					);
				} else {
					printf(
						/* translators: 1: host name the visitor browser declared. 2: host name WordPress is configured with. */
						esc_html__( 'These do not match: the browser said %1$s, WordPress says %2$s. That single difference is the refusal, and nothing else needs looking at until it is gone.', 'ow-consent' ),
						esc_html( $seen ),
						esc_html( $home )
					);
				}
			} elseif ( $cookie_kind ) {
				esc_html_e( 'The address in the visitor address bar has to be the address WordPress is configured with, spelled the same way, or the browser will not keep the cookie this site sends back.', 'ow-consent' );
			} else {
				esc_html_e( 'The address in the visitor address bar has to be one of the addresses WordPress is configured with, or be declared as an accepted alias.', 'ow-consent' );
			}
			?>
		</p>
		<p class="owco-help">
			<a href="<?php echo esc_url( admin_url( 'options-general.php' ) ); ?>"><?php esc_html_e( 'Settings — General', 'ow-consent' ); ?></a>
			&mdash;
			<?php
			if ( $cookie_kind ) {
				esc_html_e( 'set the WordPress Address and the Site Address to the address visitors actually use, spelled exactly as it appears in their address bar — with the www. prefix, or without it. Here the two spellings are not interchangeable: a browser only keeps a cookie that came back from the very address it is on. Declaring the other address as an accepted alias with the owco_allowed_request_hosts filter stops writes being refused, but it cannot make a browser keep the cookie — only the two addresses being the same does that.', 'ow-consent' );
			} else {
				esc_html_e( 'set the WordPress Address and the Site Address to the address visitors actually use. Where the other address is legitimate — a staging domain, a reverse proxy, a headless front end — declare it with the owco_allowed_request_hosts filter instead. The www. and non-www. spellings of a configured address are already accepted, so those are never the cause.', 'ow-consent' );
			}
			?>
		</p>
		<?php
	}

	/**
	 * What one refusal code means, and what to change because of it.
	 *
	 * Written for the person who owns the site, not for the person who wrote the
	 * plugin: the cause first in ordinary words, then the one thing to change.
	 * 'hint' is a literal technical token — a path, a constant — deliberately left
	 * untranslated so that it can be copied as it stands.
	 *
	 * @param string $code Refusal code, already sanitized.
	 * @return array{cause:string,fix:string,hint:string}
	 */
	protected static function refusal_explanation( $code ) {
		$out = array( 'cause' => '', 'fix' => '', 'hint' => '' );

		switch ( (string) $code ) {
			case 'owco_bad_origin':
				$out['cause'] = __( 'This site is being browsed on an address WordPress does not know it by. Writes are refused on the spot, because a request arriving from an address the site does not recognise cannot be told apart from one forged by another site.', 'ow-consent' );
				$out['fix']   = __( 'Make the addresses match. The comparison below is the entire answer — one of those lines is different from the others.', 'ow-consent' );
				break;

			case 'owco_missing_origin':
				$out['cause'] = __( 'The choice arrived with no Origin header, no Referer header and no security token, so nothing whatsoever showed that it came from this site, and it was refused rather than trusted. Something sitting in front of WordPress — a CDN, a reverse proxy, a security or optimisation layer — is removing those headers.', 'ow-consent' );
				$out['fix']   = __( 'Ask whoever runs that layer to stop stripping Origin and Referer from POST requests to the address below. If these are instead your own server-to-server calls, allow them deliberately with the owco_allow_headerless_write filter.', 'ow-consent' );
				$out['hint']  = '/wp-json/owco/v1/consent';
				break;

			case 'owco_rate_limited':
				$out['cause'] = __( 'Too many choices were counted against one visitor address within five minutes. This is almost never a real flood: behind a proxy or a CDN the plugin has not been told about, every visitor arrives wearing the same address, so a handful of them exhaust a single budget between them.', 'ow-consent' );
				$out['fix']   = __( 'Declare the proxy in wp-config.php so the real visitor address is read instead of the proxy address: give OWCO_TRUSTED_PROXY your proxy or CDN address ranges, comma separated, in place of the example range below.', 'ow-consent' );
				$out['hint']  = "define( 'OWCO_TRUSTED_PROXY', '203.0.113.0/24' );";
				break;

			case 'owco_bad_nonce':
				$out['cause'] = __( 'The one-time security token sent with the choice was rejected as expired or invalid. On a cached site that normally means the banner is being served from a stored copy older than the token it carries, or that the token was issued for one address and sent back to another.', 'ow-consent' );
				$out['fix']   = __( 'Exclude the addresses below from every page cache, object cache and CDN copy, then empty the caches once. They have to be answered by WordPress itself, every time.', 'ow-consent' );
				$out['hint']  = '/wp-json/owco/v1/';
				break;

			case 'owco_headers_already_sent':
				$out['cause'] = __( 'By the time the consent cookie had to be written, this site had already started sending the page, so the cookie could not be set at all. A stray blank line or a warning printed by a theme or another plugin is the usual culprit.', 'ow-consent' );
				$out['fix']   = __( 'On a staging copy, switch debugging on to find what is printed before the page headers, or deactivate plugins one at a time until it stops. One blank line after a closing PHP tag is enough to cause this.', 'ow-consent' );
				break;

			case 'owco_ledger_write_refused':
				$out['cause'] = __( 'The choice could not be written into the consent register, so it was refused instead of being reported as saved with no proof behind it. Either the register table is missing, or the database turned the insert down.', 'ow-consent' );
				$out['fix']   = __( 'Open the "Audit ledger" tab. If it reports the table as missing, deactivate and reactivate the plugin so the tables are rebuilt. If the table is there, the database user is most likely not allowed to write to it and only the host can grant that.', 'ow-consent' );
				break;

			case 'owco_consent_failed':
				$out['cause'] = __( 'The site accepted the request but could not apply the choice, and refused it rather than claiming a success it could not deliver.', 'ow-consent' );
				$out['fix']   = __( 'The underlying failure is in the server error log at the times listed below. Read it there, or ask your host for that extract.', 'ow-consent' );
				break;

			case 'owco_bad_categories':
			case 'owco_bad_param':
				$out['cause'] = __( 'The choice reached this site in a shape the endpoint does not accept. Something between the browser and WordPress rewrote the request: a security module, a script-optimisation plugin, or a cached copy of the banner script older than the plugin itself.', 'ow-consent' );
				$out['fix']   = __( 'Empty every cache, the CDN included, and load the site once. If the refusals continue, disable request-filtering and script-optimisation modules one at a time until they stop.', 'ow-consent' );
				break;

			case 'owco_forbidden':
			case 'rest_forbidden':
				$out['cause'] = __( 'WordPress refused the request before this plugin ever saw it. On most sites that means a security plugin, or a rule on the server, that blocks anonymous POST requests to the REST API.', 'ow-consent' );
				$out['fix']   = __( 'Allow anonymous POST requests to the addresses below, in your security plugin and — if your host runs one — in the server firewall as well.', 'ow-consent' );
				$out['hint']  = '/wp-json/owco/v1/';
				break;

			case 'rest_no_route':
				$out['cause'] = __( 'The address the banner writes to does not exist as far as WordPress is concerned: the REST API is switched off, or the permalink rules that route it were never written.', 'ow-consent' );
				$out['fix']   = __( 'Open Settings — Permalinks and save once, without changing anything, to rewrite the rules. If a plugin closes the REST API to visitors who are not logged in, it has to make an exception for this address.', 'ow-consent' );
				$out['hint']  = '/wp-json/owco/v1/consent';
				break;

			default:
				$out['cause'] = __( 'This site refused the write with the code shown above, which is not one of the causes described here. It comes from WordPress itself, or from another plugin answering in place of this one.', 'ow-consent' );
				$out['fix']   = __( 'Send this panel, code and all, to whoever maintains the site. The code, the HTTP status and the two addresses in the table below are the whole diagnosis — nothing has to be reproduced in a browser.', 'ow-consent' );
				break;
		}

		return $out;
	}

	/**
	 * The same, for the events that did NOT refuse the write.
	 *
	 * @param string $code Code, already sanitized.
	 * @return array{cause:string,fix:string}
	 */
	protected static function refusal_note_explanation( $code ) {
		switch ( (string) $code ) {
			case 'rest_cookie_invalid_nonce':
				return array(
					'cause' => __( 'WordPress rejected the login token that came with the choice as belonging to somebody else. The plugin overrode that verdict, so the choice was still recorded — but a visitor receiving another visitor login token means a cache in front of this site is storing and re-serving pages that were built for a signed-in person. That affects far more than the cookie banner.', 'ow-consent' ),
					'fix'   => __( 'Configure the page cache and the CDN never to store a response that carries a login cookie, and empty both once. If the site is behind a proxy that adds its own caching, it has to be told the same thing.', 'ow-consent' ),
				);

			case 'owco_headers_already_sent':
				return array(
					'cause' => __( 'The choice was recorded, but this site had already started sending the page by the time the consent cookie had to be written, so the server could not set it and the browser had to do it instead. A stray blank line or a warning printed by a theme or another plugin is the usual culprit.', 'ow-consent' ),
					'fix'   => __( 'On a staging copy, switch debugging on to find what is printed before the page headers, or deactivate plugins one at a time until it stops. Until then, a visitor whose browser refuses that fallback is asked again on every page.', 'ow-consent' ),
				);

			case 'owco_cookie_not_persisted':
				return array(
					'cause' => __( 'What visitors see: they accept or refuse, the banner goes away, and on the very next page it is back and they are asked again — over and over, as if nothing had been recorded. Something was: every one of those choices is in the register, and this site can evidence them. What is missing is on the visitor side. The address people are browsing is not the address WordPress is configured with, so the banner sends the choice to a different address from the one in the address bar. A browser treats that as another site and throws away the cookie that comes back from it, and it is that cookie that remembers the choice from one page to the next.', 'ow-consent' ),
					'fix'   => __( 'Make the two addresses the same, in Settings — General. The comparison below is the entire answer: one of those lines is different from the others, and until it is not, every visitor is asked again on every page.', 'ow-consent' ),
				);

			default:
				return array(
					'cause' => __( 'The choice was recorded, but the endpoint noted something worth reporting about the way the request arrived.', 'ow-consent' ),
					'fix'   => __( 'Send this panel, code and all, to whoever maintains the site.', 'ow-consent' ),
				);
		}
	}

	/**
	 * The rolling record of refused public writes, normalised for display.
	 *
	 * OWCO_REST::refusal_log() already sanitises what it returns; everything is cast
	 * again here because the record is a stored option that may have been written
	 * by a different version of the plugin. Guarded rather than called outright so
	 * that a build whose REST unit predates the record degrades to printing nothing,
	 * instead of fataling on the one screen that has to open when a site is already
	 * misbehaving.
	 *
	 * @return array[] Rows of time/code/status/origin/host/token, newest first.
	 */
	protected static function write_refusals() {
		if ( ! class_exists( 'OWCO_REST' ) || ! method_exists( 'OWCO_REST', 'refusal_log' ) ) {
			return array();
		}

		$raw = OWCO_REST::refusal_log();
		if ( ! is_array( $raw ) ) {
			return array();
		}

		$rows = array();
		foreach ( $raw as $entry ) {
			if ( ! is_array( $entry ) || ! isset( $entry['code'] ) ) {
				continue;
			}
			$code = sanitize_key( (string) $entry['code'] );
			if ( '' === $code ) {
				continue;
			}
			$rows[] = array(
				'time'   => ( isset( $entry['at'] ) && is_numeric( $entry['at'] ) ) ? max( 0, (int) $entry['at'] ) : 0,
				'code'   => $code,
				'status' => ( isset( $entry['status'] ) && is_numeric( $entry['status'] ) ) ? max( 0, (int) $entry['status'] ) : 0,
				'origin' => isset( $entry['origin'] ) ? self::refusal_host( $entry['origin'] ) : '',
				'host'   => isset( $entry['host'] ) ? self::refusal_host( $entry['host'] ) : '',
				'token'  => ! empty( $entry['token'] ),
			);
		}

		// The record is written newest first and read back in that order; sorting here
		// as well means a hand-edited or migrated option cannot mislabel the window.
		usort(
			$rows,
			function ( $a, $b ) {
				if ( $a['time'] === $b['time'] ) {
					return 0;
				}
				return ( $a['time'] < $b['time'] ) ? 1 : -1;
			}
		);

		return $rows;
	}

	/**
	 * Render a refusal timestamp in the site timezone.
	 *
	 * @param int $stamp Unix timestamp.
	 * @return string
	 */
	protected static function refusal_time_display( $stamp ) {
		$stamp = (int) $stamp;
		if ( $stamp <= 0 ) {
			return '—';
		}
		return (string) wp_date( 'Y-m-d H:i', $stamp );
	}

	/**
	 * A host name safe to print: bare host, lower case, bounded, nothing else.
	 *
	 * The value originates in a request header, so it is attacker-controlled text.
	 * It is escaped again at print time; it is reduced to host characters here so
	 * that nothing but an address can ever be displayed as one.
	 *
	 * @param string|int|float|bool|null $value Raw value, host name or full URL.
	 * @return string
	 */
	protected static function refusal_host( $value ) {
		if ( null === $value || is_bool( $value ) || is_array( $value ) ) {
			return '';
		}
		$value = trim( (string) $value );
		if ( '' === $value ) {
			return '';
		}
		if ( false !== strpos( $value, '//' ) ) {
			$parsed = (string) wp_parse_url( $value, PHP_URL_HOST );
			if ( '' !== $parsed ) {
				$value = $parsed;
			}
		}
		$value = (string) preg_replace( '/[^A-Za-z0-9._:\[\]-]/', '', $value );
		return substr( strtolower( $value ), 0, 253 );
	}

	protected static function compliance_diagnostic() {
		$issues = array();
		if ( ! OWCO_Core::setting( 'banner_enabled' ) ) {
			$issues[] = array( 'level' => 'bad', 'message' => __( 'The banner is disabled: no consent is being collected.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'banner_reject_all' ) ) {
			$issues[] = array( 'level' => 'bad', 'message' => __( 'GDPR/CNIL: the "Reject all" button is mandatory and must be as visible as "Accept all".', 'ow-consent' ) );
		}
		if ( OWCO_Core::setting( 'banner_close_x' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'The close cross is considered by the CNIL as an ambiguous implicit refusal. Disable it.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'legal_company_name' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'Company name missing — required to generate policies. See the "Legal identity" tab.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'legal_company_reg_number' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'Company registration number missing (RCS / SIREN / BCE-KBO) — mandatory in the legal notice. See the "Legal identity" tab.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'legal_host_name' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'Hosting provider missing — its identity is mandatory in the legal notice (LCEN art. 6-III). See the "Legal identity" tab.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'dsar_enabled' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'The DSAR portal is disabled: visitors cannot exercise their rights through the site.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'dsar_email' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'No DPO email configured: you will not be notified about DSAR requests.', 'ow-consent' ) );
		}
		if ( ! OWCO_Core::setting( 'ledger_enabled' ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'The consent ledger is disabled: you keep no proof that consent was given (GDPR art. 7.1).', 'ow-consent' ) );
		}
		// The first banner layer must carry a route to the information (EDPB 5/2020 §62).
		// `link_privacy_policy` falls back to the WordPress privacy page; when neither
		// exists, the banner ships with no link to anything at all.
		if ( '' === trim( (string) OWCO_Core::setting( 'link_privacy_policy' ) ) && '' === (string) get_privacy_policy_url() ) {
			$issues[] = array( 'level' => 'bad', 'message' => __( 'No privacy policy is linked: the banner gives the visitor no route to any information about the processing. Choose or generate a page under "Compliance" → "Policy links".', 'ow-consent' ) );
		}
		if ( '' === trim( (string) OWCO_Core::setting( 'link_cookie_policy' ) ) ) {
			$issues[] = array( 'level' => 'warn', 'message' => __( 'No cookie policy is linked: nothing points the visitor at the detailed list of trackers. Choose or generate a page under "Compliance" → "Policy links".', 'ow-consent' ) );
		}
		$dpa_issue = self::dpa_authority_issue();
		if ( ! empty( $dpa_issue ) ) {
			$issues[] = $dpa_issue;
		}
		if ( ! is_ssl() ) {
			$issues[] = array( 'level' => 'bad', 'message' => __( 'The site is not on HTTPS — a consent cookie without HTTPS is not legally valid.', 'ow-consent' ) );
		}
		// Scanner: uncategorized trackers. Guarded, because a failed activation leaves the
		// table missing and the dashboard must still render.
		if ( self::table_ready( OWCO_TABLE_SCANNER ) ) {
			$scanner = OWCO_Scanner::findings_summary();
			$unknown = isset( $scanner['unknown'] ) ? (int) $scanner['unknown'] : 0;
			if ( $unknown > 0 ) {
				$issues[] = array(
					'level'   => 'warn',
					'message' => sprintf(
						/* translators: %d: number of un-categorized trackers */
						_n( 'Scanner: %d uncategorized tracker detected. Classify it on the "Scanner" tab so it is blocked before consent.', 'Scanner: %d uncategorized trackers detected. Classify them on the "Scanner" tab so they are blocked before consent.', $unknown, 'ow-consent' ),
						$unknown
					),
				);
			}
		}

		// DSAR requests that already blew the art. 12.3 deadline.
		$dsar = self::dsar_stats();
		if ( $dsar['overdue'] > 0 ) {
			$issues[] = array(
				'level'   => 'bad',
				'message' => sprintf(
					/* translators: %d: number of data-subject requests past their legal deadline */
					_n( '%d data-subject request has passed its legal deadline. See the "DSAR requests" tab.', '%d data-subject requests have passed their legal deadline. See the "DSAR requests" tab.', $dsar['overdue'], 'ow-consent' ),
					$dsar['overdue']
				),
			);
		}

		// Catalogue rules that can never fire: the blocker silently skips them.
		$broken = self::count_broken_catalog_rules();
		if ( $broken > 0 ) {
			$issues[] = array(
				'level'   => 'warn',
				'message' => sprintf(
					/* translators: %d: number of unusable blocking rules */
					_n( '%d blocking rule cannot fire and is skipped at runtime. Repair it on the "Tracker catalogue" tab.', '%d blocking rules cannot fire and are skipped at runtime. Repair them on the "Tracker catalogue" tab.', $broken, 'ow-consent' ),
					$broken
				),
			);
		}

		return $issues;
	}

	/**
	 * Diagnostic entry for a hand-typed supervisory authority that the active compliance
	 * profile contradicts.
	 *
	 * `legal_dpa_authority` is honoured verbatim by OWCO_Policies as soon as it differs
	 * from the shipped default, and it survives a change of compliance profile: a value
	 * typed while the site was on GDPR keeps naming the CNIL in a POPIA or PIPL document
	 * whose own prose describes a different regulator. Rather than stop honouring the
	 * administrator's choice, the mismatch is surfaced here with a one-click reset.
	 *
	 * @return array Issue entry for compliance_diagnostic(), or an empty array.
	 */
	protected static function dpa_authority_issue() {
		$chosen = trim( (string) OWCO_Core::setting( 'legal_dpa_authority' ) );
		if ( '' === $chosen ) { return array(); }

		$defaults = OWCO_Core::default_settings();
		$shipped  = isset( $defaults['legal_dpa_authority'] ) ? trim( (string) $defaults['legal_dpa_authority'] ) : '';
		// Still the shipped value: OWCO_Policies already derives the authority itself.
		if ( $chosen === $shipped ) { return array(); }

		$derived = self::derived_dpa_authority();
		if ( '' === $derived || 0 === strcasecmp( $chosen, $derived ) ) { return array(); }

		return array(
			'level'   => 'warn',
			'message' => sprintf(
				/* translators: 1: authority name typed by the administrator, 2: name of the active compliance profile, 3: authority the plugin would derive from that profile */
				__( 'The supervisory authority is set by hand to "%1$s", while the active framework (%2$s) designates %3$s. Every generated document prints the value you typed, so it contradicts its own text.', 'ow-consent' ),
				$chosen,
				self::profile_label( (string) OWCO_Core::setting( 'compliance_profile' ) ),
				$derived
			),
			'action'       => 'reset_dpa_authority',
			/* translators: %s: name of the supervisory authority the plugin would derive */
			'action_label' => sprintf( __( 'Use %s instead', 'ow-consent' ), $derived ),
		);
	}

	/**
	 * The authority OWCO_Policies would name if `legal_dpa_authority` had never been
	 * customised — i.e. the one the profile and `legal_country` imply.
	 *
	 * The mapping itself is deliberately NOT copied here: OWCO_Policies::authority_info()
	 * is the single authoritative table (fix contract §7), and it is only reachable with
	 * the setting blanked. Blanking is done through the documented `owco_settings` filter
	 * and undone immediately; the settings memo is keyed on the callback set, so both the
	 * probe and the settings afterwards are correct.
	 *
	 * @return string Authority name, or '' when none can be named.
	 */
	protected static function derived_dpa_authority() {
		if ( ! class_exists( 'OWCO_Policies' ) || ! method_exists( 'OWCO_Policies', 'dpa_authority' ) ) { return ''; }

		$lang  = method_exists( 'OWCO_Policies', 'resolve_language' ) ? (string) OWCO_Policies::resolve_language() : 'fr';
		$probe = array( __CLASS__, 'filter_blank_dpa_authority' );

		add_filter( 'owco_settings', $probe, 9999 );
		$derived = (string) OWCO_Policies::dpa_authority( '', '', $lang );
		remove_filter( 'owco_settings', $probe, 9999 );

		$derived = trim( $derived );
		// When nothing is mapped, authority_info() answers a lowercase generic phrase
		// ("the competent supervisory authority"). That is not a name and must never be
		// offered as a replacement value.
		return ( '' !== $derived && preg_match( '/^\p{Lu}/u', $derived ) ) ? $derived : '';
	}

	/**
	 * `owco_settings` callback used only by derived_dpa_authority(), for the length of one
	 * call. Public because add_filter() needs a callable.
	 *
	 * @param mixed $settings Effective settings array.
	 * @return mixed
	 */
	public static function filter_blank_dpa_authority( $settings ) {
		if ( is_array( $settings ) ) {
			$settings['legal_dpa_authority'] = '';
		}
		return $settings;
	}

	/**
	 * How many catalogue rules the matcher would refuse.
	 *
	 * Capped: only the candidates SQL can narrow down are re-checked in PHP, so a large
	 * catalogue does not turn the dashboard into a regex benchmark.
	 *
	 * @return int
	 */
	protected static function count_broken_catalog_rules() {
		global $wpdb;
		if ( ! self::table_ready( OWCO_TABLE_SCRIPTS ) ) { return 0; }

		$table = OWCO_TABLE_SCRIPTS;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, read on an admin screen; it must reflect the catalogue as it is now, so there is nothing to cache.
		$rows = $wpdb->get_results( $wpdb->prepare(
			"SELECT pattern, pattern_type, match_target, category FROM %i
			 WHERE pattern_type = 'regex'
				OR ( match_target = 'url' AND pattern_type = 'host' AND ( CHAR_LENGTH(pattern) < 6 OR pattern NOT LIKE %s ) )
			 LIMIT 200",
			$table,
			'%.%'
		), ARRAY_A );

		$broken = 0;
		foreach ( (array) $rows as $row ) {
			if ( '' !== self::catalog_row_problem( $row ) ) { $broken++; }
		}
		return $broken;
	}

	/**
	 * Short translated name of a compliance profile.
	 *
	 * Framework acronyms stay as-is; the country/jurisdiction wording around them is
	 * translatable, so a localised admin never sees a raw database slug.
	 *
	 * @param string $p Profile slug.
	 * @return string
	 */
	protected static function profile_label( $p ) {
		$labels = self::profile_labels();
		$p      = (string) $p;
		if ( isset( $labels[ $p ] ) ) {
			return $labels[ $p ];
		}
		return '' !== $p ? $p : __( 'Not set', 'ow-consent' );
	}

	/**
	 * The compliance profiles offered by the plugin, translated, in menu order.
	 *
	 * @return array<string,string>
	 */
	protected static function profile_labels() {
		return array(
			'gdpr'       => __( 'GDPR (EU — opt-in)', 'ow-consent' ),
			'uk_pecr'    => __( 'UK GDPR + PECR (United Kingdom)', 'ow-consent' ),
			'ch_nfadp'   => __( 'nFADP (Switzerland)', 'ow-consent' ),
			'ccpa'       => __( 'CCPA/CPRA (California — opt-out)', 'ow-consent' ),
			'lgpd'       => __( 'LGPD (Brazil)', 'ow-consent' ),
			'popia'      => __( 'POPIA (South Africa)', 'ow-consent' ),
			'pipl'       => __( 'PIPL (China — strict opt-in)', 'ow-consent' ),
			'dpdp'       => __( 'DPDP Act (India)', 'ow-consent' ),
			'quebec'     => __( 'Law 25 (Quebec)', 'ow-consent' ),
			'au'         => __( 'Privacy Act (Australia)', 'ow-consent' ),
			'us_generic' => __( 'United States — generic (opt-out)', 'ow-consent' ),
		);
	}

	/**
	 * True when the policy generator owns a privacy-policy template dedicated to $profile.
	 *
	 * When it does not, OWCO_Policies falls back to the GDPR template — the admin must be
	 * told rather than handed a European document for an Indian or Australian site.
	 *
	 * @param string $profile Profile slug.
	 * @return bool
	 */
	protected static function profile_has_template( $profile ) {
		if ( ! class_exists( 'OWCO_Policies' ) ) { return true; }
		if ( method_exists( 'OWCO_Policies', 'has_template_for' ) ) {
			return (bool) OWCO_Policies::has_template_for( 'privacy_policy', (string) $profile );
		}
		return method_exists( 'OWCO_Policies', 'tpl_privacy_policy_' . (string) $profile );
	}

	/**
	 * True when a document of this type can actually be generated for the active profile.
	 *
	 * Legal notice and Terms only ship a French body, so every non-francophone profile
	 * hits the language gate in OWCO_Policies::generate_page() and gets a WP_Error. The
	 * Generate button used to render anyway, so the operator clicked it and failed every
	 * single time with no prior warning.
	 *
	 * @param string $policy_type Document type slug.
	 * @return bool
	 */
	protected static function policy_type_available( $policy_type ) {
		$policy_type = (string) $policy_type;
		if ( '' === $policy_type ) { return false; }
		if ( ! class_exists( 'OWCO_Policies' ) ) { return false; }
		if ( ! method_exists( 'OWCO_Policies', 'has_template_for' ) ) { return true; }
		return (bool) OWCO_Policies::has_template_for( $policy_type );
	}

	/**
	 * The explanation shown in place of a Generate button the generator would refuse.
	 *
	 * @return string Translated, unescaped.
	 */
	protected static function policy_language_gap_text() {
		return __( 'No template of this document exists in the language of the selected legal framework, so it cannot be generated automatically. Write the page yourself and select it above, or supply a body through the owco_policy_template filter.', 'ow-consent' );
	}

	/**
	 * Warning block shown when the selected profile has no dedicated template.
	 *
	 * @param string $profile Profile slug.
	 * @return void
	 */
	protected static function render_template_fallback_notice( $profile ) {
		if ( self::profile_has_template( $profile ) ) { return; }
		?>
		<p>
			<span class="owco-pill warn"><?php esc_html_e( 'Template fallback', 'ow-consent' ); ?></span>
			<?php
			printf(
				/* translators: %s: name of the selected compliance profile */
				esc_html__( 'No dedicated privacy-policy template exists yet for %s. The GDPR template is used as a base: the generated document must be reviewed by a qualified professional before publication.', 'ow-consent' ),
				esc_html( self::profile_label( $profile ) )
			);
			?>
		</p>
		<?php
	}

	/* ---------------- Banner ---------------- */

	protected static function render_tab_banner() {
		?>
		<form method="post">
			<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
			<input type="hidden" name="owco_admin_action" value="save_settings">
			<input type="hidden" name="_tab" value="banner">

			<div class="owco-section">
				<h2><?php esc_html_e( 'Banner display', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_bool( 'banner_enabled', __( 'Enable banner', 'ow-consent' ) ); ?>
					<?php self::field_select( 'banner_position', __( 'Position', 'ow-consent' ), array(
						'bottom-bar'    => __( 'Bottom bar (full width)', 'ow-consent' ),
						'bottom-card'   => __( 'Bottom-left card', 'ow-consent' ),
						'center-modal'  => __( 'Centered modal', 'ow-consent' ),
						'top-bar'       => __( 'Top bar', 'ow-consent' ),
					) ); ?>
					<?php self::field_select( 'banner_style', __( 'Style', 'ow-consent' ), array(
						'auto'  => __( 'Automatic (follows the visitor system theme)', 'ow-consent' ),
						'light' => __( 'Light', 'ow-consent' ),
						'dark'  => __( 'Dark', 'ow-consent' ),
					), __( '"Automatic" follows the visitor operating-system preference; Light and Dark force the palette whatever that preference is.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'banner_accept_all', __( '"Accept all" button', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'banner_reject_all', __( '"Reject all" button (GDPR: mandatory)', 'ow-consent' ), __( 'Refusing must be exactly as easy as accepting. Removing this button is the single most sanctioned banner defect in Europe.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'banner_preferences', __( '"Customize" button', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'banner_close_x', __( 'Close cross (CNIL: discouraged)', 'ow-consent' ), __( 'When enabled, the cross is treated as a refusal of everything optional. The CNIL considers an ambiguous cross an invalid way to collect consent — leaving this off is the safe choice.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'banner_show_logo', __( 'Show site logo', 'ow-consent' ), __( 'Displays the logo set in Appearance → Customize → Site Identity at the top of the banner. Ignored when the theme has no custom logo.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Persistent floating button', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'In accordance with GDPR art. 7.3 ("it shall be as easy to withdraw consent as to give it"), a persistent button lets visitors reopen the preferences panel from any page.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_bool( 'floating_button_enabled', __( 'Show floating button', 'ow-consent' ) ); ?>
					<?php self::field_select( 'floating_button_position', __( 'Position', 'ow-consent' ), array(
						'bottom-left'  => __( 'Bottom-left (recommended)', 'ow-consent' ),
						'bottom-right' => __( 'Bottom-right', 'ow-consent' ),
						'top-left'     => __( 'Top-left', 'ow-consent' ),
						'top-right'    => __( 'Top-right', 'ow-consent' ),
					) ); ?>
					<?php self::field_select( 'floating_button_style', __( 'Style', 'ow-consent' ), array(
						'pill' => __( 'Pill (icon + text)', 'ow-consent' ),
						'icon' => __( 'Icon only', 'ow-consent' ),
					) ); ?>
					<?php self::field_text( 'floating_button_label', __( 'Displayed text', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Consent renewal', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Consent is not eternal. CNIL: recommended duration 6 to 13 months. EDPB Guidelines 5/2020 §117: "consent must be renewed at appropriate intervals".', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_int( 'consent_renewal_months', __( 'Re-ask consent after (months)', 'ow-consent' ), __( 'Also the lifetime of the consent cookie. Capped at 13 months (CNIL deliberation 2020-091); 0 is treated as that 13-month maximum, not as "never expires".', 'ow-consent' ), 0, 13 ); ?>
					<?php self::field_bool( 'consent_policy_hash_check', __( 'Re-ask if the policy was modified (recommended)', 'ow-consent' ) ); ?>
				</table>
				<p class="owco-help"><?php esc_html_e( '0 months is stored as the 13-month maximum, which is also what the generated cookie policy states. The "policy modified" checkbox forces a new consent whenever you regenerate the policies (version bump).', 'ow-consent' ); ?></p>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Displayed texts', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Each field shows its translated default in grey. Leave it empty to keep that default, which follows the visitor language; type something to override it for every language at once.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_text( 'text_title',       __( 'Title', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'text_message', __( 'Message', 'ow-consent' ) ); ?>
					<?php self::field_text( 'text_accept_all',  __( '"Accept all" text', 'ow-consent' ) ); ?>
					<?php self::field_text( 'text_reject_all',  __( '"Reject all" text', 'ow-consent' ) ); ?>
					<?php self::field_text( 'text_preferences', __( '"Customize" text', 'ow-consent' ) ); ?>
					<?php self::field_text( 'text_save',        __( '"Save my choices" text', 'ow-consent' ) ); ?>
				</table>
			</div>

			<p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button></p>
		</form>
		<?php
	}

	/* ---------------- Compliance ---------------- */

	protected static function render_tab_compliance() {
		$profile = (string) OWCO_Core::setting( 'compliance_profile' );
		self::render_policy_gen_result();
		?>
		<form method="post">
			<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
			<input type="hidden" name="owco_admin_action" value="save_settings">
			<input type="hidden" name="_tab" value="compliance">

			<div class="owco-section">
				<h2><?php esc_html_e( 'Applicable legal framework', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_select( 'compliance_profile', __( 'Compliance profile', 'ow-consent' ), self::profile_labels() ); ?>
					<?php self::field_bool( 'compliance_strict', __( 'Strict mode: auto-block scripts before consent', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'gcm_enabled', __( 'Google Consent Mode v2 (recommended for Google Ads/Analytics)', 'ow-consent' ) ); ?>
				</table>
				<p class="owco-help"><?php esc_html_e( 'The profile drives the banner behaviour: opt-in (Europe) or opt-out (US), displayed legal texts, and specific obligations (close cross, right to withdraw, etc.).', 'ow-consent' ); ?></p>
				<?php self::render_template_fallback_notice( $profile ); ?>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Google Consent Mode v2 — behaviour before consent', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'What Google tags are allowed to do while the visitor has not accepted anything. Both are sent in the Consent Mode "default" call and have no effect when Consent Mode is off.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_bool( 'gcm_ads_data_redaction', __( 'Redact ad identifiers before consent', 'ow-consent' ), __( 'Recommended. While advertising storage is denied, Google strips the ad click identifiers from the requests its tags send. Turning this off sends them in full to a visitor who has not consented.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'gcm_url_passthrough', __( 'Pass ad click identifiers through URLs before consent', 'ow-consent' ), __( 'When on, Google appends gclid / dclid to the internal links of a visitor who refused cookies, so conversions stay attributable without a cookie. It is a measurement gain, not a legal requirement: turn it off if you do not want a refusing visitor carrying an advertising identifier in their address bar.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Automatic blocking policy', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'What the blocker does with a third-party tag that is not in the tracker catalogue. Blocking an unknown script is the safest choice legally, but it can break a site that loads legitimate third-party code.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_select( 'blocker_unknown_script_policy', __( 'Unknown third-party script', 'ow-consent' ), array(
						'allow' => __( 'Allow (fewer breakages)', 'ow-consent' ),
						'block' => __( 'Block until consent (strictest)', 'ow-consent' ),
					), __( 'Applies to a script tag whose source points at a host the catalogue does not know.', 'ow-consent' ) ); ?>
					<?php self::field_select( 'blocker_unknown_iframe_policy', __( 'Unknown third-party iframe', 'ow-consent' ), array(
						'allow' => __( 'Allow', 'ow-consent' ),
						'block' => __( 'Block until consent (recommended)', 'ow-consent' ),
					), __( 'Third-party iframes (video players, maps, social embeds) almost always drop cookies, so blocking is the default.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'blocker_block_resource_hints', __( 'Strip resource hints to tracker hosts', 'ow-consent' ), __( 'Removes preconnect / dns-prefetch / preload pointing at a known tracker: those already open a connection before any consent is given. The same switch also holds back a third-party stylesheet served from an analytics or marketing host until consent; typography hosts such as Google Fonts are never touched, because blanking them only costs every first-time visitor a fallback font.', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'blocker_allowlist', __( 'Never block these hosts', 'ow-consent' ), __( 'One host per line, e.g. cdn.example.com. Use it for your own CDN or for a third party you have a contract with. Also filterable through owco_blocker_allowlist.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'CCPA / CPRA — Do Not Sell or Share + Global Privacy Control', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'For Californian visitors (CCPA §1798.135) and other US states that adopted a universal opt-out mechanism. The GPC (Global Privacy Control, W3C) signal is honored automatically when enabled.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_bool( 'ccpa_inject_footer', __( 'Auto-inject the "Do Not Sell" link in the footer (CCPA profile)', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'gpc_honor', __( 'Honor the GPC signal (Sec-GPC: 1) — RECOMMENDED', 'ow-consent' ) ); ?>
				</table>
				<p class="owco-help">
					<strong><?php esc_html_e( 'Sephora vs. Cal. AG (August 2022)', 'ow-consent' ); ?>:</strong>
					<?php esc_html_e( 'Sephora was fined $1.2M for ignoring the GPC signal. Since 2024, Colorado, Connecticut, and Virginia also require it to be honored.', 'ow-consent' ); ?>
				</p>
				<p class="owco-help"><?php esc_html_e( 'Manual insertion of the link on any page: use the [owco_dnsmpi] shortcode.', 'ow-consent' ); ?></p>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'IAB Transparency and Consent Framework v2.2', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Enable if your site uses Google AdSense, AdManager, AdX, Meta Audience Network, or any other programmatic ad network. Since January 16, 2024, these networks require a valid TCF v2.2 signal for EU+UK+CH traffic.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_bool( 'tcf_enabled', __( 'Enable IAB TCF v2.2', 'ow-consent' ) ); ?>
					<?php // 4095, not 65535: CmpId is a 12-bit field in the TC string, so a larger value cannot be encoded and OWCO_TCF refuses to load rather than silently truncating it. ?>
					<?php self::field_int( 'tcf_cmp_id', __( 'CMP ID (assigned by IAB Europe)', 'ow-consent' ), __( 'Leave 0 until IAB Europe has assigned you an ID. The TC string stores it in 12 bits, so 4095 is the highest value that can be encoded.', 'ow-consent' ), 0, 4095 ); ?>
					<?php self::field_text( 'tcf_publisher_country', __( 'Publisher country (ISO 2-letter)', 'ow-consent' ), __( 'Country code written into the TC string as the publisher country, e.g. FR, BE, DE.', 'ow-consent' ) ); ?>
					<?php self::field_int_list( 'tcf_publisher_purposes_li', __( 'Purposes claimed under legitimate interest', 'ow-consent' ), __( 'TCF purpose numbers, comma-separated (e.g. 2, 7, 9, 10). Purpose 1 (storing information) can never be claimed under legitimate interest. Leave empty if in doubt.', 'ow-consent' ) ); ?>
					<?php self::field_int_list( 'tcf_special_features', __( 'Special features opted in', 'ow-consent' ), __( 'TCF special-feature numbers, comma-separated: 1 = precise geolocation, 2 = device scanning. Both require explicit visitor consent.', 'ow-consent' ) ); ?>
				</table>
				<p class="owco-help"><strong><?php esc_html_e( 'Important:', 'ow-consent' ); ?></strong> <?php esc_html_e( 'For production, you must be registered as a CMP with IAB Europe (~ EUR 5,000 / year for non-members). In the meantime, the module operates in CMP-compatible mode (unofficial) — accepted by most SSPs in development but rejected by Google AdSense in real EEA production.', 'ow-consent' ); ?></p>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Dynamic profile by geolocation', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_bool( 'geo_enabled', __( 'Enable profile detection based on visitor country', 'ow-consent' ) ); ?>
					<?php
					// OWCO_Geo::fallback_profile() downgrades an opt-out profile to GDPR when the
					// country could not be determined — an unknown visitor must never be treated
					// as having consented by default. Offering those values here made the field
					// look like a choice the plugin then ignored, so they are withdrawn; a value
					// already stored is kept in the list, but labelled with what actually happens.
					$geo_profiles = self::profile_labels();
					$geo_opt_out  = ( class_exists( 'OWCO_Geo' ) && method_exists( 'OWCO_Geo', 'opt_out_profiles' ) )
						? (array) OWCO_Geo::opt_out_profiles()
						: array( 'ccpa', 'us_generic', 'au' );
					$geo_current  = (string) OWCO_Core::setting( 'geo_default_profile' );
					foreach ( $geo_opt_out as $geo_slug ) {
						$geo_slug = (string) $geo_slug;
						if ( ! isset( $geo_profiles[ $geo_slug ] ) ) { continue; }
						if ( $geo_slug === $geo_current ) {
							$geo_profiles[ $geo_slug ] = sprintf(
								/* translators: %s: name of a compliance profile that cannot be used as the geolocation fallback */
								__( '%s — ignored, GDPR is applied instead', 'ow-consent' ),
								$geo_profiles[ $geo_slug ]
							);
							continue;
						}
						unset( $geo_profiles[ $geo_slug ] );
					}
					self::field_select( 'geo_default_profile', __( 'Default profile (uncovered countries)', 'ow-consent' ), $geo_profiles, __( 'Applied to a visitor whose country could not be determined. Opt-out frameworks are not offered here: a visitor nobody could place must not be treated as having consented by default, so the plugin falls back to GDPR for them.', 'ow-consent' ) );
					?>
					<?php self::field_bool( 'geo_mmdb_enabled', __( 'Use a local MaxMind database file', 'ow-consent' ), __( 'Reads a GeoLite2-Country.mmdb placed in uploads/ow-geoip/ (path filterable through owco_geo_mmdb_path). Nothing is sent to MaxMind: the lookup is entirely local. Leave off if you have no such file.', 'ow-consent' ) ); ?>
				</table>
				<p class="owco-help"><?php esc_html_e( 'Enable if you have international traffic. OW Consent will use Cloudflare CF-IPCountry / CloudFront-Viewer-Country / MaxMind GeoLite2 (if present in uploads/ow-geoip/) to adapt the banner to the visitor. No IP is stored — only the 2-letter country code is cached for 24h in a session cookie.', 'ow-consent' ); ?></p>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Site integration and lifecycle', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_bool( 'auto_footer_menu_inject', __( 'Append the policy links to the footer menu', 'ow-consent' ), __( 'Off by default: the plugin does not modify your public site unless you ask it to. When on, the pages selected below are appended to the menu assigned to the footer location.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'forms_integration_enabled', __( 'OW Forms integration', 'ow-consent' ), __( 'Records the consent given on an OW Forms submission in the audit ledger and applies the configured retention to stored entries. Has no effect if OW Forms is not installed.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'delete_data_on_uninstall', __( 'Delete all plugin data when the plugin is deleted', 'ow-consent' ), __( 'Off by default. When on, deleting the plugin from the Plugins screen also drops the consent ledger, the scanner findings and every setting — irreversible, and your proof of consent goes with it. Data subject requests are handled separately: the DSAR table holds directly identifying personal data with no purpose left once the plugin is gone, so it is always removed on delete, whatever this switch says.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Policy links', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Select an existing page or click "Generate" to create it automatically from the template matching the legal framework.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php
					self::field_page_picker( 'link_privacy_policy', __( 'Privacy policy', 'ow-consent' ), 'privacy_policy' );
					self::field_page_picker( 'link_cookie_policy',  __( 'Cookie policy', 'ow-consent' ),         'cookie_policy' );
					self::field_page_picker( 'link_terms',          __( 'Terms of service', 'ow-consent' ),'terms' );
					self::field_page_picker( 'link_legal_notice',   __( 'Legal notice', 'ow-consent' ),          'legal_notice' );
					?>
				</table>
			</div>

			<p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button></p>
		</form>
		<?php
	}

	/* ---------------- Legal identity ---------------- */

	/**
	 * Everything the document generator needs to publish a compliant legal notice,
	 * privacy policy and terms. Grouped in the order an administrator fills them in.
	 *
	 * @return void
	 */
	protected static function render_tab_legal() {
		?>
		<form method="post">
			<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
			<input type="hidden" name="owco_admin_action" value="save_settings">
			<input type="hidden" name="_tab" value="legal">

			<div class="owco-section">
				<h2><?php esc_html_e( 'Company identity (data controller)', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Identification of the publisher of the site. Mandatory in France (LCEN art. 6-III) and Belgium (CDE art. XII.6), and used as the data controller in every generated document.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_text( 'legal_company_name', __( 'Legal name', 'ow-consent' ), __( 'The registered name, not the brand name. For a sole trader, your first and last name.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_company_legal_form', __( 'Legal form', 'ow-consent' ), __( 'SARL, SAS, SRL/SPRL, ASBL, GmbH, Ltd, sole trader…', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_company_capital', __( 'Share capital', 'ow-consent' ), __( 'As printed on your company documents, currency included (e.g. 18,600 EUR). Leave empty if your legal form has no share capital.', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'legal_company_address', __( 'Registered address', 'ow-consent' ), __( 'Street, number, postcode, city, country — one element per line.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_company_email', __( 'Contact email', 'ow-consent' ), __( 'Published in the legal notice and used as the fallback contact for data subjects.', 'ow-consent' ), 'email' ); ?>
					<?php self::field_text( 'legal_company_phone', __( 'Phone', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_country', __( 'Country (ISO 2-letter)', 'ow-consent' ), __( 'FR, BE, LU, DE… It selects the competent supervisory authority and the language of the generated documents.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Registration and VAT', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_text( 'legal_company_reg_number', __( 'Registration number', 'ow-consent' ), __( 'RCS or SIREN/SIRET in France, BCE/KBO in Belgium, RCS in Luxembourg, Companies House number in the UK.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_company_reg_place', __( 'Place of registration', 'ow-consent' ), __( 'City of the registry or commercial court, e.g. "RCS Paris", "Tribunal de l\'entreprise de Bruxelles".', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_company_vat', __( 'Intra-community VAT number', 'ow-consent' ), __( 'Mandatory in the legal notice as soon as you are VAT-registered, e.g. FR12345678901 / BE0123456789.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Publication director', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_text( 'legal_publication_director', __( 'Publication director', 'ow-consent' ), __( 'The natural person responsible for the content of the site — by default the legal representative of the company.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Hosting provider', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Identifying your host is mandatory in the legal notice (LCEN art. 6-III-1). Copy the details from your hosting contract.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_text( 'legal_host_name', __( 'Host name', 'ow-consent' ), __( 'Company name of the hosting provider, e.g. OVH SAS, Hetzner Online GmbH.', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'legal_host_address', __( 'Host address', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_host_phone', __( 'Host phone', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_host_url', __( 'Host website', 'ow-consent' ), __( 'Full address, starting with https://', 'ow-consent' ), 'url' ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Regulated profession', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Only for regulated professions (lawyer, doctor, architect, accountant, estate agent…). Leave the whole block empty otherwise.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_text( 'legal_profession_body', __( 'Professional body', 'ow-consent' ), __( 'Bar, order, chamber or authority you are registered with.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_profession_title', __( 'Professional title', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_profession_state', __( 'State that granted the title', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_profession_rules', __( 'Professional rules (URL)', 'ow-consent' ), __( 'Link to the code of conduct applicable to your profession.', 'ow-consent' ), 'url' ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Consumer mediation', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Mandatory for anyone selling to consumers in the EU: you must name the mediator a customer can refer a dispute to.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_text( 'legal_mediator_name', __( 'Mediator', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'legal_mediator_address', __( 'Mediator address', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_mediator_url', __( 'Mediator website', 'ow-consent' ), '', 'url' ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'EU representative (GDPR art. 27)', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_textarea( 'legal_eu_representative', __( 'Representative in the European Union', 'ow-consent' ), __( 'Required only when you are established outside the EU and offer goods or services to people in the EU. Name, address and contact of your designated representative.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Data protection officer and supervisory authority', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_text( 'legal_dpo_name', __( 'DPO name', 'ow-consent' ), __( 'Leave empty if you have not appointed a data protection officer — it is not mandatory for every organisation.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_dpo_email', __( 'DPO email', 'ow-consent' ), '', 'email' ); ?>
					<?php self::field_text( 'legal_dpa_authority', __( 'Supervisory authority', 'ow-consent' ), __( 'The authority a data subject can complain to: CNIL (FR), APD-GBA (BE), CNPD (LU), BfDI (DE), ICO (UK)…', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Processing transparency', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_text( 'legal_transfer_countries', __( 'Countries data is transferred to', 'ow-consent' ), __( 'Comma-separated list of non-EU countries where your processors store or access the data, e.g. United States, India. Leave empty if everything stays in the EU.', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'legal_third_parties_note', __( 'Recipients of the data', 'ow-consent' ), __( 'Categories of recipients outside the trackers already detected by the scanner: accountant, carrier, payment provider, CRM…', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'legal_automated_decisions', __( 'Automated decision-making or profiling', 'ow-consent' ), __( 'GDPR art. 22: enable only if a decision producing legal effects is taken about a person without human intervention (automatic scoring, automated refusal).', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'legal_automated_decisions_desc', __( 'Logic and consequences of that processing', 'ow-consent' ), __( 'Describe the logic involved, its significance and its expected consequences for the person. Only used when the option above is enabled.', 'ow-consent' ) ); ?>
					<?php self::field_int( 'legal_minor_age', __( 'Digital age of consent', 'ow-consent' ), __( 'Age below which a parent must consent for the child. GDPR art. 8 allows 13 to 16 — 15 in France, 13 in Belgium.', 'ow-consent' ), 13, 18 ); ?>
					<?php self::field_textarea( 'legal_data_provision_note', __( 'Consequence of not providing the data', 'ow-consent' ), __( 'GDPR art. 13.2(e): say whether providing the data is a contractual requirement and what happens if the person refuses (e.g. the order cannot be processed).', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Retention periods', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Published in the privacy policy as your retention commitment. The audit ledger has its own retention setting on the "Audit ledger" tab.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_int( 'retention_form_data_days', __( 'Contact form entries (days)', 'ow-consent' ), __( '1095 days = 3 years, the usual commercial-prospecting window recommended by the CNIL.', 'ow-consent' ), 1, 3650 ); ?>
					<?php self::field_int( 'retention_dsar_days', __( 'Rights requests (days)', 'ow-consent' ), __( 'How long a handled DSAR request is kept as proof that you answered it.', 'ow-consent' ), 1, 3650 ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Currency and taxes', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_text( 'legal_currency', __( 'Currency', 'ow-consent' ), __( 'ISO code used in the terms of sale, e.g. EUR, CHF, GBP.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'legal_tax_label', __( 'Price mention', 'ow-consent' ), __( 'How prices are stated in your terms: TTC / HT, incl. VAT / excl. VAT…', 'ow-consent' ) ); ?>
				</table>
			</div>

			<div class="owco-section">
				<h2><?php esc_html_e( 'Business type and generated documents', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_select( 'legal_business_type', __( 'Type of activity', 'ow-consent' ), array(
						'auto'       => __( 'Detect automatically', 'ow-consent' ),
						'vitrine'    => __( 'Showcase site (no online sale)', 'ow-consent' ),
						'ecommerce'  => __( 'Online shop (goods)', 'ow-consent' ),
						'services'   => __( 'Services / bookings', 'ow-consent' ),
						'rental'     => __( 'Rental or hire', 'ow-consent' ),
						'saas'       => __( 'Software or subscription (SaaS)', 'ow-consent' ),
						'content'    => __( 'Content, media or membership', 'ow-consent' ),
					), __( 'Selects the terms-of-service template. "Detect automatically" analyses your pages and installed plugins — choose the type explicitly if the guess is wrong.', 'ow-consent' ) ); ?>
					<?php self::field_bool( 'policy_disclaimer', __( 'Add the "template, have it reviewed" notice', 'ow-consent' ), __( 'Strongly recommended: every generated document ends with a dated notice stating it is an automatically generated template that must be reviewed by a qualified professional before publication.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button></p>
		</form>
		<?php
	}

	/* ---------------- Categories ---------------- */

	protected static function render_tab_categories() {
		?>
		<form method="post">
			<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
			<input type="hidden" name="owco_admin_action" value="save_settings">
			<input type="hidden" name="_tab" value="categories">

			<div class="owco-section">
				<h2><?php esc_html_e( 'Category: Necessary (forced)', 'ow-consent' ); ?></h2>
				<p class="owco-help"><?php esc_html_e( 'Always active. Covers session, cart, login, language preference cookies. Art. 5.3 ePrivacy.', 'ow-consent' ); ?></p>
				<table class="form-table">
					<?php self::field_text( 'cat_necessary_label', __( 'Displayed label', 'ow-consent' ), __( 'Leave empty to use the translated default for the visitor language.', 'ow-consent' ) ); ?>
					<?php self::field_textarea( 'cat_necessary_desc', __( 'Description', 'ow-consent' ), __( 'Shown under the toggle in the preferences panel and reused in the generated cookie policy.', 'ow-consent' ) ); ?>
				</table>
			</div>

			<?php
			$cats = array_values( array_diff( OWCO_Core::categories(), array( 'necessary' ) ) );
			foreach ( $cats as $cat ) :
				/* translators: %s: translated cookie category name (e.g. Statistics) */
				$label_name = sprintf( __( 'Category: %s', 'ow-consent' ), OWCO_Core::category_label( $cat ) );
			?>
			<div class="owco-section">
				<h2><?php echo esc_html( $label_name ); ?></h2>
				<table class="form-table">
					<?php self::field_bool( "cat_{$cat}_available", __( 'Make this category available in the consent UI', 'ow-consent' ), __( 'When off, the category is never offered to the visitor and everything the catalogue classifies under it stays blocked.', 'ow-consent' ) ); ?>
					<?php self::field_text( "cat_{$cat}_label", __( 'Displayed label', 'ow-consent' ), __( 'Leave empty to use the translated default for the visitor language.', 'ow-consent' ) ); ?>
					<?php self::field_textarea( "cat_{$cat}_desc", __( 'Description', 'ow-consent' ), __( 'Shown under the toggle in the preferences panel and reused in the generated cookie policy.', 'ow-consent' ) ); ?>
				</table>
			</div>
			<?php endforeach; ?>

			<p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button></p>
		</form>
		<?php
	}

	/* ---------------- Ledger ---------------- */

	protected static function render_tab_ledger() {
		$algo = (string) OWCO_Core::setting( 'ledger_hash_algo' );
		if ( '' === $algo ) { $algo = 'sha256'; }

		if ( ! self::table_ready( OWCO_TABLE_LEDGER ) ) {
			self::render_missing_table( __( 'Consent audit ledger', 'ow-consent' ) );
			self::render_ledger_settings_form( $algo );
			return;
		}

		$filters   = self::ledger_filters();
		$where     = self::ledger_where( $filters );
		$paged     = self::current_paged();
		$total     = self::count_rows( OWCO_TABLE_LEDGER, $where );
		$total_all = self::count_rows( OWCO_TABLE_LEDGER, '' );
		$rows      = self::fetch_page(
			OWCO_TABLE_LEDGER,
			'id, created_at, visitor_token, event, categories, profile, source, ip_pseudonymous, page_url, prev_hash, row_hash',
			$where,
			'id DESC',
			$paged
		);
		$verify = get_transient( 'owco_ledger_verify_result' );
		$carry  = array_filter( $filters, 'strlen' );
		?>
		<div class="owco-section">
			<h2><?php esc_html_e( 'Consent audit ledger (hash chain)', 'ow-consent' ); ?></h2>
			<p><?php
				printf(
					/* translators: %s: keyed-hash scheme actually in use, in <code> */
					wp_kses_post( __( 'Every consent is sealed with a %s taken over the row itself plus the hash of the row before it. Editing, deleting or reordering a row breaks that link, which is what makes the ledger usable as proof under GDPR art. 7(1).', 'ow-consent' ) ),
					'<code>HMAC-' . esc_html( strtoupper( $algo ) ) . '</code>'
				);
			?></p>

			<?php self::render_ledger_key_source(); ?>
			<?php self::render_ledger_verify_result( $verify ); ?>

			<form method="post" style="display:inline-block; margin-top:10px;">
				<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
				<input type="hidden" name="owco_admin_action" value="verify_ledger">
				<button type="submit" class="button"><?php esc_html_e( 'Verify the chain now', 'ow-consent' ); ?></button>
			</form>
			<span style="margin-left:14px; color:#64748b; font-size:13px;"><?php
				printf(
					/* translators: %s: total number of ledger rows */
					esc_html__( 'Total: %s rows', 'ow-consent' ),
					esc_html( number_format_i18n( $total_all ) )
				);
			?></span>
		</div>

		<?php self::render_ledger_settings_form( $algo ); ?>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Consent records', 'ow-consent' ); ?></h2>
			<p class="owco-help"><?php esc_html_e( 'Search by visitor token to answer "prove that this person consented on that date". Dates are entered in the site timezone and matched against the UTC timestamps actually stored.', 'ow-consent' ); ?></p>

			<form method="get" style="margin-bottom:14px;display:flex;gap:8px;flex-wrap:wrap;align-items:flex-end;">
				<input type="hidden" name="page" value="<?php echo esc_attr( self::MENU_SLUG ); ?>">
				<input type="hidden" name="tab" value="ledger">
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Visitor token', 'ow-consent' ); ?></span>
					<input type="search" name="token" value="<?php echo esc_attr( $filters['token'] ); ?>" placeholder="<?php esc_attr_e( 'Visitor token', 'ow-consent' ); ?>" maxlength="32" pattern="[a-fA-F0-9]*">
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by event', 'ow-consent' ); ?></span>
					<select name="event">
						<option value=""><?php esc_html_e( 'Every event', 'ow-consent' ); ?></option>
						<?php foreach ( self::ledger_events() as $ev ) : ?>
							<option value="<?php echo esc_attr( $ev ); ?>"<?php selected( $filters['event'], $ev ); ?>><?php echo esc_html( self::ledger_event_label( $ev ) ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by compliance profile', 'ow-consent' ); ?></span>
					<select name="profile">
						<option value=""><?php esc_html_e( 'Every profile', 'ow-consent' ); ?></option>
						<?php foreach ( self::profile_labels() as $slug => $label ) : ?>
							<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $filters['profile'], $slug ); ?>><?php echo esc_html( $label ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<?php esc_html_e( 'From', 'ow-consent' ); ?>
					<input type="date" name="from" value="<?php echo esc_attr( $filters['from'] ); ?>">
				</label>
				<label>
					<?php esc_html_e( 'To', 'ow-consent' ); ?>
					<input type="date" name="to" value="<?php echo esc_attr( $filters['to'] ); ?>">
				</label>
				<button type="submit" class="button"><?php esc_html_e( 'Filter', 'ow-consent' ); ?></button>
				<a class="button" href="<?php echo esc_url( self::tab_url( 'ledger' ) ); ?>"><?php esc_html_e( 'Reset', 'ow-consent' ); ?></a>
				<a class="button" href="<?php echo esc_url( self::export_url( 'ledger', 'csv', $carry ) ); ?>"><?php esc_html_e( 'Export CSV', 'ow-consent' ); ?></a>
				<a class="button" href="<?php echo esc_url( self::export_url( 'ledger', 'json', $carry ) ); ?>"><?php esc_html_e( 'Export JSON (with chain links)', 'ow-consent' ); ?></a>
			</form>

			<?php if ( empty( $rows ) ) : ?>
				<p><em><?php
					echo empty( $carry )
						? esc_html__( 'No consent recorded yet.', 'ow-consent' )
						: esc_html__( 'No consent matches these filters.', 'ow-consent' );
				?></em></p>
			<?php else : ?>
				<table class="owco-table">
					<thead>
						<tr>
							<th>#</th>
							<th><?php esc_html_e( 'Date', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Visitor', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Event', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Categories', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Profile', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'IP', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Chain (previous → this row)', 'ow-consent' ); ?></th>
						</tr>
					</thead>
					<tbody>
						<?php foreach ( $rows as $r ) : ?>
							<tr>
								<td><?php echo (int) $r['id']; ?></td>
								<td>
									<?php echo esc_html( self::utc_to_local_display( isset( $r['created_at'] ) ? $r['created_at'] : '' ) ); ?>
									<br><small style="color:#64748b;"><?php
										/* translators: %s: raw UTC timestamp stored in the ledger */
										printf( esc_html__( '%s UTC', 'ow-consent' ), esc_html( (string) $r['created_at'] ) );
									?></small>
								</td>
								<td class="mono"><?php echo esc_html( (string) $r['visitor_token'] ); ?></td>
								<td><?php echo esc_html( self::ledger_event_label( isset( $r['event'] ) ? $r['event'] : '' ) ); ?></td>
								<td><?php
									$cats = trim( (string) $r['categories'] );
									echo '' !== $cats ? esc_html( $cats ) : esc_html__( 'none', 'ow-consent' );
								?></td>
								<td><?php echo esc_html( self::profile_label( isset( $r['profile'] ) ? $r['profile'] : '' ) ); ?></td>
								<td><?php echo esc_html( (string) $r['ip_pseudonymous'] ); ?></td>
								<td class="mono">
									<?php
									$prev = (string) $r['prev_hash'];
									$self_hash = (string) $r['row_hash'];
									?>
									<span title="<?php echo esc_attr( $prev ); ?>"><?php echo esc_html( '' !== $prev ? substr( $prev, 0, 12 ) . '…' : '—' ); ?></span>
									→
									<span title="<?php echo esc_attr( $self_hash ); ?>"><?php echo esc_html( '' !== $self_hash ? substr( $self_hash, 0, 12 ) . '…' : '—' ); ?></span>
								</td>
							</tr>
						<?php endforeach; ?>
					</tbody>
				</table>
				<?php self::render_pagination( $total, $paged, 'ledger', $carry ); ?>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * The ledger settings form, rendered whether or not the table exists.
	 *
	 * @param string $algo Hash algorithm slug actually in use.
	 * @return void
	 */
	protected static function render_ledger_settings_form( $algo ) {
		?>
		<form method="post">
			<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
			<input type="hidden" name="owco_admin_action" value="save_settings">
			<input type="hidden" name="_tab" value="ledger">
			<div class="owco-section">
				<h2><?php esc_html_e( 'Ledger settings', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_bool( 'ledger_enabled', __( 'Record consents in the audit ledger', 'ow-consent' ), __( 'GDPR art. 7.1 puts the burden of proof on you: without the ledger you keep no evidence that a visitor consented. Turn it off only if another system records the proof.', 'ow-consent' ) ); ?>
					<?php self::field_int( 'ledger_retention_days', __( 'Keep the entries for (days)', 'ow-consent' ), __( '0 = keep forever. Old entries are pruned daily, oldest first, and the hash of the last removed row is anchored so the remaining chain stays verifiable. The CNIL expects proof of consent to be kept at least 3 years (1095 days).', 'ow-consent' ), 0, 3650 ); ?>
				</table>
				<p class="owco-help"><?php
					printf(
						/* translators: %s: keyed-hash scheme identifier */
						esc_html__( 'Signing scheme in use: %s. It is not editable here — changing it would make every existing row fail verification.', 'ow-consent' ),
						esc_html( 'HMAC-' . strtoupper( (string) $algo ) )
					);
				?></p>
				<p><button type="submit" class="button"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button></p>
			</div>
		</form>
		<?php
	}

	/**
	 * State where the signing key lives, as recorded in `owco_ledger_key_source`.
	 *
	 * When the key is the one the plugin keeps in the database (no OWCO_LEDGER_KEY in
	 * wp-config.php), anyone with database access can re-sign the whole chain — the ledger is still a useful log
	 * but it is no longer tamper-evident, and the screen must not imply otherwise
	 * (FIX-CONTRACT §6).
	 *
	 * @return void
	 */
	protected static function render_ledger_key_source() {
		$stored = get_option( 'owco_ledger_key_source' );
		$source = '';
		$safe   = null;

		if ( is_array( $stored ) ) {
			$source = isset( $stored['source'] ) ? (string) $stored['source'] : '';
			$safe   = ! empty( $stored['tamper_evident'] );
		}
		if ( '' === $source && class_exists( 'OWCO_Consent' ) && method_exists( 'OWCO_Consent', 'ledger_key_source' ) ) {
			$source = (string) OWCO_Consent::ledger_key_source();
			$safe   = method_exists( 'OWCO_Consent', 'ledger_is_tamper_evident' ) ? (bool) OWCO_Consent::ledger_is_tamper_evident() : null;
		}
		if ( '' === $source ) { return; }

		$labels = array(
			'constant'  => __( 'a dedicated OWCO_LEDGER_KEY constant in wp-config.php', 'ow-consent' ),
			'database'  => __( 'a random key the plugin keeps in the database, because wp-config.php defines no OWCO_LEDGER_KEY', 'ow-consent' ),
		);
		$label = isset( $labels[ $source ] ) ? $labels[ $source ] : $source;
		?>
		<p class="owco-help" style="margin-top:10px;">
			<span class="owco-pill <?php echo esc_attr( false === $safe ? 'warn' : 'ok' ); ?>"><?php esc_html_e( 'Signing key', 'ow-consent' ); ?></span>
			<?php
			printf(
				/* translators: %s: description of where the ledger signing key is stored */
				esc_html__( 'The chain is signed with %s.', 'ow-consent' ),
				esc_html( $label )
			);
			?>
			<?php if ( false === $safe ) : ?>
				<strong><?php esc_html_e( 'The chain therefore proves nothing against someone who has database access: define OWCO_LEDGER_KEY in wp-config.php to restore tamper-evidence.', 'ow-consent' ); ?></strong>
			<?php endif; ?>
			<?php if ( is_array( $stored ) && ! empty( $stored['checked_at'] ) ) : ?>
				<br><small><?php
					printf(
						/* translators: %s: UTC timestamp of the last key check */
						esc_html__( 'Last checked %s UTC.', 'ow-consent' ),
						esc_html( (string) $stored['checked_at'] )
					);
				?></small>
			<?php endif; ?>
		</p>
		<?php
	}

	/**
	 * Render the outcome of the last chain verification.
	 *
	 * Reports every break found (not only the first one) with its reason, because a single
	 * edited row, a fork created by a concurrent write and a wholesale rewrite have very
	 * different legal readings.
	 *
	 * @param mixed $verify Result of OWCO_Consent::ledger_verify(), or anything else.
	 * @return void
	 */
	protected static function render_ledger_verify_result( $verify ) {
		if ( ! is_array( $verify ) ) { return; }

		$checked  = isset( $verify['checked'] ) ? (int) $verify['checked'] : (int) ( isset( $verify['total'] ) ? $verify['total'] : 0 );
		$breaks   = isset( $verify['breaks'] ) && is_array( $verify['breaks'] ) ? $verify['breaks'] : array();
		$count    = isset( $verify['break_count'] ) ? (int) $verify['break_count'] : count( $breaks );
		$reasons  = self::ledger_break_reasons();

		if ( ! empty( $verify['ok'] ) ) : ?>
			<div class="owco-banner-status ok">✓ <?php
				printf(
					/* translators: %s: number of ledger rows verified */
					esc_html__( 'Chain intact — %s rows verified.', 'ow-consent' ),
					esc_html( number_format_i18n( $checked ) )
				);
			?></div>
		<?php else : ?>
			<div class="owco-banner-status bad">✗ <?php
				printf(
					/* translators: 1: number of broken rows, 2: number of rows verified */
					esc_html( _n( 'Chain broken: %1$s row failed out of %2$s verified.', 'Chain broken: %1$s rows failed out of %2$s verified.', $count, 'ow-consent' ) ),
					esc_html( number_format_i18n( $count ) ),
					esc_html( number_format_i18n( $checked ) )
				);
			?></div>
			<?php if ( ! empty( $breaks ) ) : ?>
				<ul style="list-style:disc;padding-left:20px;margin-top:10px;">
					<?php foreach ( $breaks as $break ) :
						$bid    = isset( $break['id'] ) ? (int) $break['id'] : 0;
						$reason = isset( $break['reason'] ) ? (string) $break['reason'] : '';
						$label  = isset( $reasons[ $reason ] ) ? $reasons[ $reason ] : __( 'Unrecognised failure', 'ow-consent' );
					?>
						<li><?php
							printf(
								/* translators: 1: ledger row id, 2: reason the row failed verification */
								esc_html__( 'Row #%1$d — %2$s', 'ow-consent' ),
								(int) $bid,
								esc_html( $label )
							);
						?></li>
					<?php endforeach; ?>
					<?php if ( $count > count( $breaks ) ) : ?>
						<li><em><?php
							printf(
								/* translators: %s: number of additional failures not listed */
								esc_html__( '…and %s more not listed.', 'ow-consent' ),
								esc_html( number_format_i18n( $count - count( $breaks ) ) )
							);
						?></em></li>
					<?php endif; ?>
				</ul>
			<?php endif; ?>
			<?php if ( ! empty( $verify['key_rotated'] ) ) : ?>
				<p class="owco-help"><?php esc_html_e( 'The signing key changed since these rows were written (site migration, or OWCO_LEDGER_KEY changed). That explains the failures without anyone having altered the ledger.', 'ow-consent' ); ?></p>
			<?php endif; ?>
		<?php endif; ?>

		<?php if ( ! empty( $verify['partial'] ) ) : ?>
			<p class="owco-help"><?php esc_html_e( 'Partial verification: only part of the chain was walked. Run it again to check the rest.', 'ow-consent' ); ?></p>
		<?php endif; ?>
		<?php if ( ! empty( $verify['legacy_rows'] ) ) : ?>
			<p class="owco-help"><?php
				printf(
					/* translators: %s: number of rows written by an older plugin version */
					esc_html__( '%s rows were written by an earlier version and are verified against the legacy scheme.', 'ow-consent' ),
					esc_html( number_format_i18n( (int) $verify['legacy_rows'] ) )
				);
			?></p>
		<?php endif; ?>
		<?php if ( ! empty( $verify['attested_rows'] ) ) : ?>
			<p class="owco-help"><?php
				$owco_attest_at = ( isset( $verify['attestation']['started_at'] ) ) ? (string) $verify['attestation']['started_at'] : '';
				printf(
					/* translators: 1: number of rows, 2: UTC date and time of the plugin update */
					esc_html( _n( '%1$s row was signed with the previous key, before version 2.0.5. It is verified against the attestation made of it under the current key when the plugin was updated (%2$s UTC): any change made since then is detected.', '%1$s rows were signed with the previous key, before version 2.0.5. They are verified against the attestation made of them under the current key when the plugin was updated (%2$s UTC): any change made since then is detected.', (int) $verify['attested_rows'], 'ow-consent' ) ),
					esc_html( number_format_i18n( (int) $verify['attested_rows'] ) ),
					esc_html( $owco_attest_at )
				);
			?></p>
		<?php endif; ?>
		<?php if ( ! empty( $verify['unverifiable_rows'] ) ) : ?>
			<p class="owco-help"><?php
				printf(
					/* translators: %s: number of ledger rows sealed without a secret key */
					esc_html( _n( '%s row was sealed before a signing key was available. Its digest can be recomputed by anyone who can write to the database, so it proves nothing on its own and the chain is not declared intact while it remains.', '%s rows were sealed before a signing key was available. Their digests can be recomputed by anyone who can write to the database, so they prove nothing on their own and the chain is not declared intact while they remain.', (int) $verify['unverifiable_rows'], 'ow-consent' ) ),
					esc_html( number_format_i18n( (int) $verify['unverifiable_rows'] ) )
				);
			?></p>
		<?php endif; ?>
		<?php if ( ! empty( $verify['anchor_seeded'] ) ) : ?>
			<p class="owco-help"><?php esc_html_e( 'This ledger had no recorded head. The chain verified in full, so its end has now been anchored: from now on, removing the most recent rows is detected instead of going unnoticed.', 'ow-consent' ); ?></p>
		<?php endif; ?>
		<?php if ( ! empty( $verify['pruned'] ) ) : ?>
			<p class="owco-help"><?php
				printf(
					/* translators: %s: number of rows removed by the retention policy */
					esc_html__( '%s older rows were removed by the retention policy; the chain is anchored from the last removed row.', 'ow-consent' ),
					esc_html( number_format_i18n( (int) $verify['pruned'] ) )
				);
			?></p>
		<?php endif; ?>
		<?php if ( isset( $verify['tamper_evident'] ) && ! $verify['tamper_evident'] ) : ?>
			<p class="owco-help"><?php esc_html_e( 'The signing key is stored in the database, so the chain proves nothing against someone who has database access. Add this line to wp-config.php, above the line that says to stop editing — a freshly generated key, shown only here:', 'ow-consent' ); ?></p>
			<p><code><?php echo esc_html( "define( 'OWCO_LEDGER_KEY', '" . OWCO_Core::new_secret() . "' );" ); ?></code></p>
			<p class="owco-help"><?php esc_html_e( 'Rows already signed keep verifying after you add it.', 'ow-consent' ); ?></p>
		<?php endif;
	}

	/**
	 * Translated explanation for each failure reason returned by ledger_verify().
	 *
	 * @return array<string,string>
	 */
	protected static function ledger_break_reasons() {
		return array(
			'hash_mismatch' => __( 'the row content no longer matches its own signature (the row was edited)', 'ow-consent' ),
			'awaiting_attestation' => __( 'the row was signed with the previous key and has not been attested yet — the update is still working through the ledger; check again later', 'ow-consent' ),
			'chain_break'   => __( 'the link to the previous row is wrong (a row was inserted, removed or reordered)', 'ow-consent' ),
			'bad_genesis'   => __( 'the first row does not start the chain (the beginning of the ledger was removed)', 'ow-consent' ),
			'table_emptied' => __( 'the ledger is empty although entries were recorded before', 'ow-consent' ),
			'tail_truncated'=> __( 'the most recent rows are missing', 'ow-consent' ),
			'head_mismatch' => __( 'the last row differs from the recorded head of the chain', 'ow-consent' ),
			'count_mismatch'=> __( 'the number of rows differs from the recorded count', 'ow-consent' ),
			'unkeyed_rows'  => __( 'rows are sealed with an unkeyed hash that anyone with database access can recompute — they are not evidence', 'ow-consent' ),
		);
	}

	/* ---------------- DSAR ---------------- */

	protected static function render_tab_dsar() {
		if ( ! self::table_ready( OWCO_TABLE_DSAR ) ) {
			self::render_missing_table( __( 'Data-subject requests', 'ow-consent' ) );
			self::render_dsar_settings_form();
			return;
		}

		$stats   = self::dsar_stats();
		$filters = self::dsar_filters();
		$where   = self::dsar_where( $filters );
		$paged   = self::current_paged();
		$total   = self::count_rows( OWCO_TABLE_DSAR, $where );
		// Explicit column list — verification_token / token_hash are identity credentials
		// and must never be loaded into an admin render. subject_email and details ARE
		// shown on this manage_options-only screen; subject_name is not displayed.
		$rows = self::fetch_page(
			OWCO_TABLE_DSAR,
			'id, created_at, request_type, subject_email, details, status, verified_at, due_at, handled_at, response_notes',
			$where,
			'id DESC',
			$paged
		);
		$carry = array_filter( $filters, 'strlen' );
		?>
		<div class="owco-cards">
			<div class="owco-card">
				<h3><?php esc_html_e( 'Pending', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="color:#92400e;"><?php echo esc_html( number_format_i18n( $stats['pending'] ) ); ?></div>
				<div class="owco-sub"><?php esc_html_e( 'Identity not confirmed yet', 'ow-consent' ); ?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Verified, to handle', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="color:#b91c1c;"><?php echo esc_html( number_format_i18n( $stats['verified'] ) ); ?></div>
				<div class="owco-sub"><?php
					printf(
						/* translators: %d: number of days the site commits to answer within */
						esc_html( _n( '%d-day deadline', '%d-day deadline', $stats['response_days'], 'ow-consent' ) ),
						(int) $stats['response_days']
					);
				?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Overdue', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="color:<?php echo $stats['overdue'] > 0 ? '#b91c1c' : '#15803d'; ?>;"><?php echo esc_html( number_format_i18n( $stats['overdue'] ) ); ?></div>
				<div class="owco-sub"><?php if ( $stats['overdue'] > 0 ) : ?>
					<a href="<?php echo esc_url( self::tab_url( 'dsar', array( 'overdue' => '1' ) ) ); ?>"><?php esc_html_e( 'Past the legal deadline — show them', 'ow-consent' ); ?></a>
				<?php else : ?>
					<?php esc_html_e( 'Every open request is still in time.', 'ow-consent' ); ?>
				<?php endif; ?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Closed', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="color:#15803d;"><?php echo esc_html( number_format_i18n( $stats['closed'] ) ); ?></div>
				<div class="owco-sub"><?php
					printf(
						/* translators: 1: number of answered requests, 2: number abandoned without an answer */
						esc_html__( '%1$s answered, %2$s expired', 'ow-consent' ),
						esc_html( number_format_i18n( $stats['resolved'] ) ),
						esc_html( number_format_i18n( $stats['expired'] ) )
					);
				?></div>
			</div>
		</div>

		<?php self::render_dsar_settings_form(); ?>

		<div class="owco-section">
			<h2><?php esc_html_e( 'DSAR portal — setup', 'ow-consent' ); ?></h2>
			<p><?php esc_html_e( 'Insert the following shortcode in a page of your site (Privacy Policy, Contact, or a dedicated page). Visitors will be able to submit their requests directly.', 'ow-consent' ); ?></p>
			<pre style="background:#0f172a;color:#fde68a;padding:1rem;border-radius:8px;display:inline-block;font-family:ui-monospace,Menlo,monospace;">[owco_dsar_form]</pre>
			<p class="owco-help"><?php esc_html_e( 'Options: types="access,erasure,portability" to limit the types · title="..." to customise the title · submit_label="..." for the button.', 'ow-consent' ); ?></p>
		</div>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Workflow', 'ow-consent' ); ?></h2>
			<ol>
				<li><?php esc_html_e( 'Visitor submits a request → status pending', 'ow-consent' ); ?></li>
				<li><?php
					printf(
						/* translators: %d: number of days the identity-verification link stays valid */
						esc_html( _n( 'Verification email sent with an identity link (valid %d day)', 'Verification email sent with an identity link (valid %d days)', (int) OWCO_Core::setting( 'dsar_token_ttl_days' ), 'ow-consent' ) ),
						(int) OWCO_Core::setting( 'dsar_token_ttl_days' )
					);
				?></li>
				<li><?php esc_html_e( 'Click → status verified, you are notified, and the legal deadline starts', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( 'You fulfil the request below — download the data, run the erasure, or extend the deadline — then record what you did and close it', 'ow-consent' ); ?></li>
			</ol>
			<p class="owco-help"><?php esc_html_e( 'GDPR art. 12.3 gives you one month from the moment the request is complete, that is from the identity confirmation. The "Deadline" column is therefore computed when the requester clicks the verification link, not when the form was submitted; a request never confirmed has no deadline running against you.', 'ow-consent' ); ?></p>
			<p class="owco-help"><?php esc_html_e( 'Closing a request requires a note saying what was actually sent or deleted. That note is the accountability record GDPR art. 5.2 expects, and it is what you show if the answer is ever disputed.', 'ow-consent' ); ?></p>
		</div>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Request register', 'ow-consent' ); ?></h2>

			<form method="get" style="margin-bottom:14px;display:flex;gap:8px;flex-wrap:wrap;align-items:flex-end;">
				<input type="hidden" name="page" value="<?php echo esc_attr( self::MENU_SLUG ); ?>">
				<input type="hidden" name="tab" value="dsar">
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Search by email', 'ow-consent' ); ?></span>
					<input type="search" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>" placeholder="<?php esc_attr_e( 'Email address', 'ow-consent' ); ?>">
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by status', 'ow-consent' ); ?></span>
					<select name="status">
						<option value=""><?php esc_html_e( 'Every status', 'ow-consent' ); ?></option>
						<?php foreach ( array( 'pending', 'verified', 'resolved', 'rejected', 'expired' ) as $st ) : ?>
							<option value="<?php echo esc_attr( $st ); ?>"<?php selected( $filters['status'], $st ); ?>><?php echo esc_html( self::dsar_status_label( $st ) ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by request type', 'ow-consent' ); ?></span>
					<select name="type">
						<option value=""><?php esc_html_e( 'Every type', 'ow-consent' ); ?></option>
						<?php foreach ( self::dsar_type_map() as $slug => $label ) : ?>
							<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $filters['type'], $slug ); ?>><?php echo esc_html( $label ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<?php esc_html_e( 'From', 'ow-consent' ); ?>
					<input type="date" name="from" value="<?php echo esc_attr( $filters['from'] ); ?>">
				</label>
				<label>
					<?php esc_html_e( 'To', 'ow-consent' ); ?>
					<input type="date" name="to" value="<?php echo esc_attr( $filters['to'] ); ?>">
				</label>
				<label style="display:inline-flex;align-items:center;gap:5px;">
					<input type="checkbox" name="overdue" value="1" <?php checked( '1', $filters['overdue'] ); ?>>
					<?php esc_html_e( 'Overdue only', 'ow-consent' ); ?>
				</label>
				<button type="submit" class="button"><?php esc_html_e( 'Filter', 'ow-consent' ); ?></button>
				<a class="button" href="<?php echo esc_url( self::tab_url( 'dsar' ) ); ?>"><?php esc_html_e( 'Reset', 'ow-consent' ); ?></a>
				<a class="button" href="<?php echo esc_url( self::export_url( 'dsar', 'csv', $carry ) ); ?>"><?php esc_html_e( 'Export the register (CSV)', 'ow-consent' ); ?></a>
			</form>

			<?php if ( empty( $rows ) ) : ?>
				<p><em><?php
					echo empty( $carry )
						? esc_html__( 'No request yet.', 'ow-consent' )
						: esc_html__( 'No request matches these filters.', 'ow-consent' );
				?></em></p>
			<?php else : ?>
				<table class="owco-table">
					<thead>
						<tr>
							<th>#</th>
							<th><?php esc_html_e( 'Received', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Type', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Email', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Status', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Verified on', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Deadline', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Fulfilment', 'ow-consent' ); ?></th>
						</tr>
					</thead>
					<tbody>
						<?php
						$status_colors = array(
							'pending'  => '#92400e',
							'verified' => '#b91c1c',
							'resolved' => '#15803d',
							'rejected' => '#7c3aed',
							'expired'  => '#64748b',
						);
						$now_ts = time();
						foreach ( $rows as $r ) :
							$rid          = (int) $r['id'];
							$status       = isset( $r['status'] ) ? (string) $r['status'] : '';
							$status_color = isset( $status_colors[ $status ] ) ? $status_colors[ $status ] : '#0f172a';
							$is_open      = in_array( $status, array( 'pending', 'verified' ), true );
							// due_at is stored in UTC; strtotime() would otherwise read it as
							// server-local and shift the countdown by the UTC offset.
							$due_ts       = ! empty( $r['due_at'] ) ? (int) strtotime( (string) $r['due_at'] . ' UTC' ) : 0;
							$overdue      = ( $is_open && $due_ts > 0 && $due_ts < $now_ts );
							$days_left    = $due_ts > 0 ? (int) ceil( ( $due_ts - $now_ts ) / DAY_IN_SECONDS ) : 0;
							$type         = isset( $r['request_type'] ) ? (string) $r['request_type'] : '';
						?>
							<tr style="<?php echo $overdue ? 'background:#fef2f2;' : ''; ?>">
								<td>#<?php echo (int) $rid; ?></td>
								<td><?php echo esc_html( self::utc_to_local_display( isset( $r['created_at'] ) ? $r['created_at'] : '' ) ); ?></td>
								<td><?php echo esc_html( self::dsar_type_label( $type ) ); ?></td>
								<td><a href="<?php echo esc_url( 'mailto:' . (string) $r['subject_email'] ); ?>"><?php echo esc_html( (string) $r['subject_email'] ); ?></a></td>
								<td>
									<span class="owco-pill" style="background:<?php echo esc_attr( $status_color ); ?>22;color:<?php echo esc_attr( $status_color ); ?>;"><?php echo esc_html( self::dsar_status_label( $status ) ); ?></span>
									<?php if ( $overdue ) : ?>
										<br><span class="owco-pill bad" style="margin-top:4px;"><?php esc_html_e( 'Overdue', 'ow-consent' ); ?></span>
									<?php endif; ?>
								</td>
								<td><?php echo esc_html( self::utc_to_local_display( isset( $r['verified_at'] ) ? $r['verified_at'] : '' ) ); ?></td>
								<td>
									<?php echo esc_html( $due_ts > 0 ? self::utc_to_local_display( (string) $r['due_at'] ) : '—' ); ?>
									<?php if ( $due_ts > 0 && $is_open ) : ?>
										<br><small style="color:<?php echo $overdue ? '#b91c1c' : '#64748b'; ?>;"><?php
											if ( $overdue ) {
												printf(
													/* translators: %d: number of days a request is past its legal deadline */
													esc_html( _n( '%d day late', '%d days late', abs( $days_left ), 'ow-consent' ) ),
													(int) abs( $days_left )
												);
											} else {
												printf(
													/* translators: %d: number of days left before the legal deadline */
													esc_html( _n( '%d day left', '%d days left', max( 0, $days_left ), 'ow-consent' ) ),
													(int) max( 0, $days_left )
												);
											}
										?></small>
									<?php endif; ?>
								</td>
								<td style="min-width:280px;">
									<?php self::render_dsar_row_actions( $rid, $status, $type, $r ); ?>
								</td>
							</tr>
						<?php endforeach; ?>
					</tbody>
				</table>
				<?php self::render_pagination( $total, $paged, 'dsar', $carry ); ?>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * The DSAR portal settings, rendered whether or not the table exists.
	 *
	 * @return void
	 */
	protected static function render_dsar_settings_form() {
		?>
		<form method="post">
			<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
			<input type="hidden" name="owco_admin_action" value="save_settings">
			<input type="hidden" name="_tab" value="dsar">
			<div class="owco-section">
				<h2><?php esc_html_e( 'DSAR portal settings', 'ow-consent' ); ?></h2>
				<table class="form-table">
					<?php self::field_bool( 'dsar_enabled', __( 'Accept rights requests from the site', 'ow-consent' ), __( 'When off, the [owco_dsar_form] shortcode stops accepting submissions and the REST endpoint refuses them. Requests already registered stay in the queue.', 'ow-consent' ) ); ?>
					<?php self::field_text( 'dsar_email', __( 'Email receiving the requests', 'ow-consent' ), __( 'Where the notification is sent when a request is verified. Falls back to the site administrator address when empty.', 'ow-consent' ), 'email' ); ?>
					<?php self::field_text( 'dsar_notify_email', __( 'Additional recipient', 'ow-consent' ), __( 'Optional second address notified at the same time — your DPO or a shared mailbox.', 'ow-consent' ), 'email' ); ?>
					<?php self::field_int( 'dsar_response_days', __( 'Response deadline (days)', 'ow-consent' ), __( 'GDPR art. 12.3 caps it at one month; the value is printed in your privacy policy as a commitment, so it cannot exceed 30.', 'ow-consent' ), 1, 30 ); ?>
					<?php self::field_int( 'dsar_token_ttl_days', __( 'Verification link lifetime (days)', 'ow-consent' ), __( 'How long the identity-confirmation link emailed to the requester stays valid. A request never confirmed within that window expires.', 'ow-consent' ), 1, 90 ); ?>
				</table>
				<p><button type="submit" class="button"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button></p>
			</div>
		</form>
		<?php
	}

	/**
	 * Counters behind the DSAR cards.
	 *
	 * 1.1.0 read a single `pending` count and labelled it "to handle within 30 days",
	 * which is the one status that is NOT actionable — and nothing anywhere counted the
	 * requests that had already blown their legal deadline.
	 *
	 * @return array<string,int>
	 */
	protected static function dsar_stats() {
		global $wpdb;

		// The dashboard asks for these twice (cards + diagnostic) in the same render.
		static $memo = null;
		if ( null !== $memo ) { return $memo; }

		$out = array(
			'pending'       => 0,
			'verified'      => 0,
			'resolved'      => 0,
			'rejected'      => 0,
			'expired'       => 0,
			'closed'        => 0,
			'overdue'       => 0,
			'response_days' => 30,
		);

		$days = (int) OWCO_Core::setting( 'dsar_response_days' );
		$out['response_days'] = ( $days > 0 && $days <= 30 ) ? $days : 30;

		if ( ! self::table_ready( OWCO_TABLE_DSAR ) ) {
			$memo = $out;
			return $memo;
		}

		$table = OWCO_TABLE_DSAR;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table, bound as %i. Legal-deadline counters must never be served from cache.
		$counts   = $wpdb->get_results( $wpdb->prepare( 'SELECT status, COUNT(*) AS c FROM %i GROUP BY status', $table ), ARRAY_A );
		$statuses = array( 'pending', 'verified', 'resolved', 'rejected', 'expired' );
		foreach ( (array) $counts as $row ) {
			$status = isset( $row['status'] ) ? (string) $row['status'] : '';
			if ( in_array( $status, $statuses, true ) ) {
				$out[ $status ] = (int) $row['c'];
			}
		}
		$out['closed'] = $out['resolved'] + $out['rejected'] + $out['expired'];

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin-owned table; a legal-deadline counter must reflect the queue right now and must never be served from cache.
		$out['overdue'] = (int) $wpdb->get_var( $wpdb->prepare(
			"SELECT COUNT(*) FROM %i WHERE status IN ('pending','verified') AND due_at IS NOT NULL AND due_at <> '' AND due_at < %s",
			$table,
			gmdate( 'Y-m-d H:i:s' )
		) );

		$memo = $out;
		return $memo;
	}

	/**
	 * The controls that actually fulfil one request.
	 *
	 * Export and erasure are handled by OWCO_DSAR through admin-post.php with their own
	 * per-request nonces; closing the request and the pending-state controls are handled
	 * here. Before 1.2.0 the only control was a "Resolve" button that flipped the status
	 * while nothing was exported or deleted — the site recorded that a right had been
	 * honoured when it had not.
	 *
	 * @param int    $id     Request id.
	 * @param string $status Current status.
	 * @param string $type   Request type slug.
	 * @param array  $row    Full row.
	 * @return void
	 */
	protected static function render_dsar_row_actions( $id, $status, $type, array $row ) {
		$id        = (int) $id;
		$has_dsar  = class_exists( 'OWCO_DSAR' );
		$post_url  = admin_url( 'admin-post.php' );
		$is_open   = in_array( (string) $status, array( 'pending', 'verified' ), true );
		$exportable = in_array( (string) $type, array( 'access', 'portability' ), true );
		?>
		<div class="owco-actions" style="margin-top:0;gap:6px;">
			<?php if ( 'verified' === $status && $has_dsar && method_exists( 'OWCO_DSAR', 'admin_export_url' ) ) : ?>
				<a class="button button-small" href="<?php echo esc_url( OWCO_DSAR::admin_export_url( $id ) ); ?>">
					<span aria-hidden="true">⬇</span>
					<?php echo $exportable
						? esc_html__( 'Download the data (JSON)', 'ow-consent' )
						: esc_html__( 'Download what we hold (JSON)', 'ow-consent' ); ?>
				</a>
			<?php endif; ?>

			<?php if ( 'verified' === $status && 'erasure' === $type && $has_dsar ) : ?>
				<form method="post" action="<?php echo esc_url( $post_url ); ?>" style="display:inline"
					onsubmit="return confirm('<?php echo esc_js( __( 'Run every WordPress eraser for this address? Data removed this way cannot be recovered.', 'ow-consent' ) ); ?>');">
					<?php wp_nonce_field( 'owco_dsar_erase_' . $id ); ?>
					<input type="hidden" name="action" value="owco_dsar_erase">
					<input type="hidden" name="dsar_id" value="<?php echo esc_attr( (string) $id ); ?>">
					<button type="submit" class="button button-small"><span aria-hidden="true">🗑</span> <?php esc_html_e( 'Erase the data', 'ow-consent' ); ?></button>
				</form>
			<?php endif; ?>

			<?php if ( 'verified' === $status && $has_dsar ) : ?>
				<form method="post" action="<?php echo esc_url( $post_url ); ?>" style="display:inline-flex;gap:4px;align-items:center;">
					<?php wp_nonce_field( 'owco_dsar_extend_' . $id ); ?>
					<input type="hidden" name="action" value="owco_dsar_extend">
					<input type="hidden" name="dsar_id" value="<?php echo esc_attr( (string) $id ); ?>">
					<label class="screen-reader-text" for="owco-dsar-reason-<?php echo esc_attr( (string) $id ); ?>"><?php esc_html_e( 'Reason for the extension', 'ow-consent' ); ?></label>
					<input type="text" id="owco-dsar-reason-<?php echo esc_attr( (string) $id ); ?>" name="owco_reason" style="width:10em" placeholder="<?php esc_attr_e( 'Reason', 'ow-consent' ); ?>">
					<button type="submit" class="button button-small"><?php esc_html_e( '+2 months', 'ow-consent' ); ?></button>
				</form>
			<?php endif; ?>

			<?php if ( 'pending' === $status ) : ?>
				<form method="post" style="display:inline">
					<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
					<input type="hidden" name="owco_admin_action" value="dsar_resend">
					<input type="hidden" name="dsar_id" value="<?php echo esc_attr( (string) $id ); ?>">
					<button type="submit" class="button button-small"><span aria-hidden="true">✉</span> <?php esc_html_e( 'Resend the link', 'ow-consent' ); ?></button>
				</form>
				<form method="post" style="display:inline"
					onsubmit="return confirm('<?php echo esc_js( __( 'Mark this request as expired? Use it when the requester never confirmed their identity.', 'ow-consent' ) ); ?>');">
					<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
					<input type="hidden" name="owco_admin_action" value="dsar_cancel">
					<input type="hidden" name="dsar_id" value="<?php echo esc_attr( (string) $id ); ?>">
					<button type="submit" class="button button-small"><?php esc_html_e( 'Mark expired', 'ow-consent' ); ?></button>
				</form>
			<?php endif; ?>
		</div>

		<?php if ( $is_open ) : ?>
			<details style="margin-top:6px;">
				<summary style="cursor:pointer;font-size:11px;color:#0369a1;"><?php esc_html_e( 'Record the answer and close', 'ow-consent' ); ?></summary>
				<form method="post" style="margin-top:6px;">
					<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
					<input type="hidden" name="owco_admin_action" value="dsar_respond">
					<input type="hidden" name="dsar_id" value="<?php echo esc_attr( (string) $id ); ?>">
					<label class="screen-reader-text" for="owco-dsar-notes-<?php echo esc_attr( (string) $id ); ?>"><?php esc_html_e( 'What you did about this request', 'ow-consent' ); ?></label>
					<textarea id="owco-dsar-notes-<?php echo esc_attr( (string) $id ); ?>" name="dsar_notes" rows="3" style="width:100%;min-width:240px;" required
						placeholder="<?php esc_attr_e( 'e.g. Export sent by email on 12/06, account and comments deleted.', 'ow-consent' ); ?>"></textarea>
					<?php if ( 'verified' === $status ) : ?>
						<label class="screen-reader-text" for="owco-dsar-outcome-<?php echo esc_attr( (string) $id ); ?>"><?php esc_html_e( 'Outcome', 'ow-consent' ); ?></label>
						<select id="owco-dsar-outcome-<?php echo esc_attr( (string) $id ); ?>" name="dsar_status" style="margin-top:4px;">
							<option value="resolved"><?php esc_html_e( 'Honoured', 'ow-consent' ); ?></option>
							<option value="rejected"><?php esc_html_e( 'Refused (give the legal ground in the note)', 'ow-consent' ); ?></option>
						</select>
					<?php else : ?>
						<?php // Identity never confirmed: "Honoured" would put an unverified subject in the audit trail as satisfied. ?>
						<input type="hidden" name="dsar_status" value="rejected">
						<p style="font-size:11px;color:#92400e;margin:4px 0 0;"><?php esc_html_e( 'The requester never confirmed their identity, so this request can only be closed as refused. Use "Resend the link" or "Mark expired" instead if you mean to keep waiting.', 'ow-consent' ); ?></p>
					<?php endif; ?>
					<button type="submit" class="button button-small button-primary" style="margin-top:4px;">✓ <?php esc_html_e( 'Close the request', 'ow-consent' ); ?></button>
				</form>
			</details>
		<?php endif; ?>

		<?php if ( ! empty( $row['response_notes'] ) ) : ?>
			<details style="margin-top:6px;">
				<summary style="cursor:pointer;font-size:11px;color:#64748b;"><?php esc_html_e( 'What was done', 'ow-consent' ); ?></summary>
				<p style="font-size:12px;max-width:320px;white-space:pre-wrap;"><?php echo esc_html( (string) $row['response_notes'] ); ?></p>
			</details>
		<?php endif; ?>

		<?php if ( ! empty( $row['details'] ) ) : ?>
			<details style="margin-top:6px;">
				<summary style="cursor:pointer;font-size:11px;color:#64748b;"><?php esc_html_e( 'What the visitor wrote', 'ow-consent' ); ?></summary>
				<p style="font-size:12px;max-width:320px;white-space:pre-wrap;"><?php echo esc_html( (string) $row['details'] ); ?></p>
			</details>
		<?php endif; ?>
		<?php
	}

	/**
	 * Short translated name of a DSAR request type, for a table column.
	 *
	 * OWCO_DSAR::type_labels() holds the long visitor-facing wording; the queue needs the
	 * right alone. Falls back to the long label, then to the stored slug.
	 *
	 * @param string $type Request type slug.
	 * @return string
	 */
	protected static function dsar_type_label( $type ) {
		$type  = (string) $type;
		$short = self::dsar_type_map();
		if ( isset( $short[ $type ] ) ) {
			return $short[ $type ];
		}
		if ( class_exists( 'OWCO_DSAR' ) && method_exists( 'OWCO_DSAR', 'type_labels' ) ) {
			$long = (array) OWCO_DSAR::type_labels();
			if ( isset( $long[ $type ] ) ) {
				return (string) $long[ $type ];
			}
		}
		return $type;
	}

	/**
	 * Translated name of a DSAR status, instead of the raw database slug.
	 *
	 * @param string $status Status slug.
	 * @return string
	 */
	protected static function dsar_status_label( $status ) {
		$status = (string) $status;
		$labels = array(
			'pending'  => __( 'Pending', 'ow-consent' ),
			'verified' => __( 'Verified', 'ow-consent' ),
			'resolved' => __( 'Resolved', 'ow-consent' ),
			'expired'  => __( 'Expired', 'ow-consent' ),
			'rejected' => __( 'Rejected', 'ow-consent' ),
		);
		return isset( $labels[ $status ] ) ? $labels[ $status ] : $status;
	}

	/* ---------------- Policies ---------------- */

	/**
	 * Show the outcome of the last document generation, then forget it.
	 *
	 * Called by both tabs that can trigger a generation, so an inline "Generate" click on
	 * the Compliance tab reports its own success — or its WP_Error — instead of silently
	 * leaving the result behind for a later visit to the Policies tab.
	 *
	 * @return void
	 */
	protected static function render_policy_gen_result() {
		$result = get_transient( 'owco_policy_gen_result' );
		if ( ! is_array( $result ) ) { return; }
		delete_transient( 'owco_policy_gen_result' );
		?>
		<div class="owco-section">
			<?php if ( ! empty( $result['error'] ) ) : ?>
				<div class="owco-banner-status bad">✗ <?php echo esc_html( $result['error'] ); ?></div>
				<?php if ( ! empty( $result['missing'] ) && is_array( $result['missing'] ) ) : ?>
					<ul style="list-style:disc;padding-left:20px;margin-top:10px;">
						<?php foreach ( $result['missing'] as $missing ) : ?>
							<li><?php echo esc_html( (string) $missing ); ?></li>
						<?php endforeach; ?>
					</ul>
					<p class="owco-help"><?php esc_html_e( 'Fill these in on the "Legal identity" tab, then generate the document again.', 'ow-consent' ); ?></p>
				<?php endif; ?>
			<?php elseif ( ! empty( $result['url'] ) ) : ?>
				<div class="owco-banner-status ok">
					✓ <?php esc_html_e( 'Policy generated successfully', 'ow-consent' ); ?> —
					<a href="<?php echo esc_url( $result['url'] ); ?>" target="_blank"><?php esc_html_e( 'view page', 'ow-consent' ); ?></a>
					<?php if ( ! empty( $result['edit_url'] ) ) : ?>
						·
						<a href="<?php echo esc_url( $result['edit_url'] ); ?>"><?php esc_html_e( 'edit in WP', 'ow-consent' ); ?></a>
					<?php endif; ?>
					·
					<small><?php
						printf(
							/* translators: 1: revision number of the generated legal document (1 for the first publication, incremented each time it is regenerated), 2: first 12 characters of the SHA-256 hash of the document body, shown so two copies can be compared */
							esc_html__( 'version %1$d, hash %2$s', 'ow-consent' ),
							isset( $result['version'] ) ? (int) $result['version'] : 0,
							esc_html( substr( isset( $result['hash'] ) ? (string) $result['hash'] : '', 0, 12 ) )
						);
					?>…</small>
				</div>
			<?php endif; ?>
		</div>
		<?php
	}

	protected static function render_tab_policies() {
		$types = array(
			'cookie_policy'  => array(
				'label' => __( 'Cookie policy', 'ow-consent' ),
				'desc'  => __( 'Detailed up-to-date list of cookies/trackers in use (generated from the scanner). Recommended for all jurisdictions.', 'ow-consent' ),
			),
			'privacy_policy' => array(
				'label' => __( 'Privacy policy', 'ow-consent' ),
				'desc'  => __( 'Full GDPR/CCPA/LGPD document: data controller, purposes, legal bases, rights, non-EU transfers.', 'ow-consent' ),
			),
			'legal_notice'   => array(
				'label' => __( 'Legal notice', 'ow-consent' ),
				'desc'  => __( 'Publisher, publication director, hosting, intellectual property. Mandatory in France (LCEN).', 'ow-consent' ),
			),
			'terms'          => array(
				'label' => __( 'Terms of service', 'ow-consent' ),
				'desc'  => __( 'Terms adapted to the business type (rental, e-commerce, SaaS, services, content) — detected automatically by analysing the site pages.', 'ow-consent' ),
			),
		);

		// Find existing generated pages.
		$existing = array();
		foreach ( $types as $type => $info ) {
			$found = get_posts( array(
				'post_type'   => 'page',
				'post_status' => array( 'publish', 'draft', 'private' ),
				// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- postmeta is indexed on meta_key, and a taxonomy would not model "the page generated for this document type".
				'meta_key'    => OWCO_Policies::POLICY_META,
				// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- the pair meta_key + meta_value IS the identity of the generated page; $type is one of the plugin's own document slugs, the meta_key half is indexed, and this runs once per document type on an admin screen only.
				'meta_value'  => $type,
				'numberposts' => 1,
			) );
			$existing[ $type ] = $found ? $found[0] : null;
		}

		self::render_policy_gen_result();
		$jur = (string) OWCO_Core::setting( 'compliance_profile' );
		?>
		<div class="owco-section">
			<h2><?php esc_html_e( 'Legal policy generator', 'ow-consent' ); ?></h2>
			<p><?php esc_html_e( 'Documents auto-generated from your settings ("Legal identity" tab) and the trackers detected by the scanner. You can edit them freely after generation — the content is stored in a standard WordPress page.', 'ow-consent' ); ?></p>
			<p class="owco-help"><?php
				printf(
					/* translators: %s: name of the selected compliance profile */
					esc_html__( 'Active framework: %s.', 'ow-consent' ),
					esc_html( self::profile_label( $jur ) )
				);
			?></p>
			<?php self::render_template_fallback_notice( $jur ); ?>
		</div>

		<?php foreach ( $types as $type => $info ) :
			$page = $existing[ $type ];
		?>
		<div class="owco-section">
			<h2><?php echo esc_html( $info['label'] ); ?></h2>
			<p class="owco-help"><?php echo esc_html( $info['desc'] ); ?></p>

			<?php if ( $page ) :
				$ver  = (int) get_post_meta( $page->ID, OWCO_Policies::VERSION_META, true );
				$gen  = (string) get_post_meta( $page->ID, OWCO_Policies::GENERATED_META, true );
				$hash = (string) get_post_meta( $page->ID, OWCO_Policies::HASH_META, true ); ?>
				<p>
					<span class="owco-pill ok"><?php esc_html_e( 'Existing', 'ow-consent' ); ?></span>
					<a href="<?php echo esc_url( get_permalink( $page->ID ) ); ?>" target="_blank"><?php echo esc_html( get_the_title( $page->ID ) ); ?></a>
					·
					<a href="<?php echo esc_url( get_edit_post_link( $page->ID ) ); ?>"><?php esc_html_e( 'edit', 'ow-consent' ); ?></a>
					<br>
					<small style="color:#64748b;">
						<?php
						/* translators: 1: version number, 2: generation date, 3: short hash, 4: post status */
						printf( esc_html__( 'Version %1$d · generated on %2$s · hash %3$s · status: %4$s', 'ow-consent' ),
							(int) $ver, esc_html( $gen ), esc_html( substr( $hash, 0, 12 ) ) . '…', esc_html( $page->post_status ) );
						?>
					</small>
					<?php
					// OWCO_Policies sets this flag when a regeneration replaced content that no
					// longer matched the hash it had generated — i.e. hand-written amendments,
					// typically the ones counsel asked for. It also saves a revision first, so
					// the previous wording is recoverable; without this pill nothing told the
					// operator that anything had been overwritten.
					$edited = defined( 'OWCO_Policies::EDITED_META' ) ? (string) get_post_meta( $page->ID, OWCO_Policies::EDITED_META, true ) : '';
					if ( '' !== $edited ) :
						// Only link when a revision really exists: revision.php with anything
						// else than a revision id answers an error screen.
						$revisions_url = '';
						$last_revision = wp_get_post_revisions( $page->ID, array( 'numberposts' => 1, 'fields' => 'ids' ) );
						if ( ! empty( $last_revision ) ) {
							$revisions_url = (string) get_edit_post_link( (int) reset( $last_revision ) );
						}
					?>
						<br>
						<span class="owco-pill warn"><?php esc_html_e( 'Manual edits replaced', 'ow-consent' ); ?></span>
						<?php esc_html_e( 'The last regeneration overwrote changes made by hand on this page. A revision was saved just before, so the previous wording can still be recovered.', 'ow-consent' ); ?>
						<?php if ( '' !== $revisions_url ) : ?>
							<a href="<?php echo esc_url( $revisions_url ); ?>"><?php esc_html_e( 'See the revisions', 'ow-consent' ); ?></a>
						<?php endif; ?>
					<?php endif; ?>
				</p>
			<?php else : ?>
				<p><span class="owco-pill warn"><?php esc_html_e( 'Not generated', 'ow-consent' ); ?></span></p>
			<?php endif; ?>

			<?php if ( ! self::policy_type_available( $type ) ) : ?>
				<p class="owco-help"><?php echo esc_html( self::policy_language_gap_text() ); ?></p>
				<small style="color:#64748b;"><?php
					/* translators: %s: name of the selected compliance profile */
					printf( esc_html__( 'Framework: %s', 'ow-consent' ), esc_html( self::profile_label( $jur ) ) );
				?></small>
			<?php else : ?>
			<form method="post">
				<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
				<input type="hidden" name="owco_admin_action" value="generate_policy">
				<input type="hidden" name="policy_type" value="<?php echo esc_attr( $type ); ?>">
				<label style="display:inline-flex;align-items:center;gap:6px;margin-right:14px;">
					<input type="checkbox" name="policy_publish" value="1"<?php echo ( $page && $page->post_status === 'publish' ) ? ' checked' : ''; ?>>
					<?php esc_html_e( 'Publish immediately', 'ow-consent' ); ?>
				</label>
				<button type="submit" class="button button-primary">
					<span aria-hidden="true"><?php echo $page ? '🔄' : '📄'; ?></span>
					<?php echo $page ? esc_html__( 'Regenerate', 'ow-consent' ) : esc_html__( 'Generate now', 'ow-consent' ); ?>
				</button>
				<small style="margin-left:10px;color:#64748b;"><?php
					/* translators: %s: name of the selected compliance profile */
					printf( esc_html__( 'Framework: %s', 'ow-consent' ), esc_html( self::profile_label( $jur ) ) );
				?></small>
			</form>
			<?php endif; ?>
		</div>
		<?php endforeach; ?>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Good to know', 'ow-consent' ); ?></h2>
			<ul style="list-style:disc;padding-left:20px;">
				<li><?php esc_html_e( 'Each regeneration creates a new (numbered) version and replaces the content entirely. When it overwrites edits you made by hand, a revision is saved first and the document is flagged above, so the previous wording can be recovered.', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( 'The list of trackers in the cookie policy is refreshed from the scanner data at each regeneration.', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( 'Before the first generation, fill out the "Legal identity" tab (company name, registration number, hosting provider, DPO…). Generation is refused while a field that is legally mandatory for the document is still empty.', 'ow-consent' ); ?></li>
				<li><?php esc_html_e( 'The link in the OW Consent settings ("Policy links") is automatically updated with the URL of the generated page.', 'ow-consent' ); ?></li>
			</ul>
		</div>
		<?php
	}

	/* ---------------- Scanner ---------------- */

	protected static function render_tab_scanner() {
		$table_ok = self::table_ready( OWCO_TABLE_SCANNER );
		$summary  = $table_ok
			? (array) OWCO_Scanner::findings_summary()
			: array( 'total' => 0, 'unknown' => 0, 'last' => null );
		$last    = get_transient( 'owco_scanner_last_run' );
		$run_res = get_transient( 'owco_scanner_run_result' );

		$filters  = self::scanner_filters();
		$filter   = $filters['filter'];
		$paged    = self::current_paged();
		$where    = $table_ok ? self::scanner_where( $filters ) : '';
		$total    = $table_ok ? self::count_rows( OWCO_TABLE_SCANNER, $where ) : 0;
		$rows     = $table_ok
			? self::fetch_page(
				OWCO_TABLE_SCANNER,
				'id, discovered_at, kind, name, domain, category_guess, page_url, confirmed',
				$where,
				'discovered_at DESC, id DESC',
				$paged
			)
			: array();
		$carry = array_filter( $filters, 'strlen' );
		?>
		<div class="owco-cards">
			<div class="owco-card">
				<h3><?php esc_html_e( 'Trackers detected', 'ow-consent' ); ?></h3>
				<div class="owco-big"><?php echo esc_html( number_format_i18n( (int) $summary['total'] ) ); ?></div>
				<div class="owco-sub"><?php
					if ( $summary['last'] ) {
						/* translators: %s: timestamp of last tracker discovery */
						echo esc_html( sprintf( __( 'Last discovery: %s', 'ow-consent' ), $summary['last'] ) );
					} else {
						esc_html_e( 'No discovery yet.', 'ow-consent' );
					}
				?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Uncategorized', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="color:<?php echo ( (int) $summary['unknown'] > 0 ) ? '#b91c1c' : '#15803d'; ?>"><?php echo esc_html( number_format_i18n( (int) $summary['unknown'] ) ); ?></div>
				<div class="owco-sub"><?php esc_html_e( 'To categorise manually.', 'ow-consent' ); ?></div>
			</div>
			<div class="owco-card">
				<h3><?php esc_html_e( 'Last auto scan', 'ow-consent' ); ?></h3>
				<div class="owco-big" style="font-size:18px;line-height:1.3"><?php echo is_array( $last ) && ! empty( $last['when'] ) ? esc_html( wp_date( 'd/m/Y H:i', (int) $last['when'] ) ) : esc_html__( 'Never', 'ow-consent' ); ?></div>
				<div class="owco-sub"><?php
					if ( ! OWCO_Core::setting( 'scanner_enabled' ) ) {
						esc_html_e( 'Scanner disabled', 'ow-consent' );
					} else {
						$next_run = wp_next_scheduled( defined( 'OWCO_Scanner::CRON_HOOK' ) ? OWCO_Scanner::CRON_HOOK : 'owco_scanner_run' );
						if ( $next_run ) {
							printf(
								/* translators: %s: date and time of the next automatic scan */
								esc_html__( 'Next run: %s', 'ow-consent' ),
								esc_html( wp_date( 'd/m/Y H:i', (int) $next_run ) )
							);
						} else {
							esc_html_e( 'Scheduled automatically', 'ow-consent' );
						}
					}
				?></div>
			</div>
		</div>

		<?php
		// What the sweep actually saw. This reads the PERSISTED status, so it is just as
		// true after a cron run as after a manual one — unlike the result banner below,
		// which only exists for 60 seconds after a click. A cookie policy generated from
		// an interrupted sweep, or from one that never saw a line of JavaScript, asserts
		// something the data does not support, and the operator has to be able to see that
		// before publishing.
		$coverage = ( class_exists( 'OWCO_Scanner' ) && method_exists( 'OWCO_Scanner', 'scan_completeness' ) )
			? (array) OWCO_Scanner::scan_completeness()
			: array();
		if ( ! empty( $coverage ) ) :
			$cov_has     = ! empty( $coverage['has_scan'] );
			$cov_full    = ! empty( $coverage['complete'] );
			$cov_running = ! empty( $coverage['running'] );
			$cov_js      = ! empty( $coverage['javascript_observed'] );
			$cov_fetched = isset( $coverage['urls_fetched'] ) ? (int) $coverage['urls_fetched'] : 0;
			$cov_failed  = isset( $coverage['urls_failed'] ) ? (int) $coverage['urls_failed'] : 0;
			$cov_error   = isset( $coverage['first_error'] ) ? (string) $coverage['first_error'] : '';
			$cov_last    = isset( $coverage['last_run'] ) ? (int) $coverage['last_run'] : 0;
			$cov_probe   = isset( $coverage['probe_last'] ) ? (int) $coverage['probe_last'] : 0;
		?>
		<div class="owco-section">
			<h2><?php esc_html_e( 'What this scan actually covers', 'ow-consent' ); ?></h2>
			<p class="owco-help"><?php esc_html_e( 'Check this before publishing a cookie policy built from these findings: the generated document tells your visitors that the list reflects the trackers really in use on the site.', 'ow-consent' ); ?></p>
			<ul style="list-style:disc;padding-left:20px;">
				<li>
					<?php if ( ! $cov_has ) : ?>
						<span class="owco-pill bad"><?php esc_html_e( 'Never run', 'ow-consent' ); ?></span>
						<?php esc_html_e( 'No sweep has ever completed on this site, so nothing below was read from your own pages.', 'ow-consent' ); ?>
					<?php elseif ( $cov_running ) : ?>
						<span class="owco-pill warn"><?php esc_html_e( 'In progress', 'ow-consent' ); ?></span>
						<?php
						printf(
							/* translators: %s: number of pages read so far */
							esc_html( _n( 'A sweep is still running: %s page read so far. These figures are partial.', 'A sweep is still running: %s pages read so far. These figures are partial.', $cov_fetched, 'ow-consent' ) ),
							esc_html( number_format_i18n( $cov_fetched ) )
						);
						?>
					<?php elseif ( ! $cov_full ) : ?>
						<span class="owco-pill warn"><?php esc_html_e( 'Incomplete', 'ow-consent' ); ?></span>
						<?php
						printf(
							/* translators: %s: number of pages the last sweep managed to read */
							esc_html( _n( 'The last sweep did not finish: %s page was read. Anything loaded only by a page it never reached is missing from this list.', 'The last sweep did not finish: %s pages were read. Anything loaded only by a page it never reached is missing from this list.', $cov_fetched, 'ow-consent' ) ),
							esc_html( number_format_i18n( $cov_fetched ) )
						);
						?>
					<?php else : ?>
						<span class="owco-pill ok"><?php esc_html_e( 'Complete', 'ow-consent' ); ?></span>
						<?php
						printf(
							/* translators: 1: number of pages read, 2: date and time of the last sweep */
							esc_html( _n( 'The last sweep finished and read %1$s page (%2$s).', 'The last sweep finished and read %1$s pages (%2$s).', $cov_fetched, 'ow-consent' ) ),
							esc_html( number_format_i18n( $cov_fetched ) ),
							esc_html( $cov_last > 0 ? wp_date( 'd/m/Y H:i', $cov_last ) : __( 'date unknown', 'ow-consent' ) )
						);
						?>
					<?php endif; ?>
				</li>
				<?php if ( $cov_failed > 0 ) : ?>
					<li>
						<span class="owco-pill warn"><?php esc_html_e( 'Pages missed', 'ow-consent' ); ?></span>
						<?php
						printf(
							/* translators: %s: number of pages the scanner could not fetch */
							esc_html( _n( '%s page could not be fetched, so what it loads was never inspected.', '%s pages could not be fetched, so what they load was never inspected.', $cov_failed, 'ow-consent' ) ),
							esc_html( number_format_i18n( $cov_failed ) )
						);
						?>
						<?php if ( '' !== $cov_error ) : ?>
							<br><code><?php echo esc_html( $cov_error ); ?></code>
						<?php endif; ?>
					</li>
				<?php endif; ?>
				<li>
					<?php if ( $cov_js ) : ?>
						<span class="owco-pill ok"><?php esc_html_e( 'JavaScript observed', 'ow-consent' ); ?></span>
						<?php
						printf(
							/* translators: %s: date and time the in-browser probe last reported */
							esc_html__( 'A real browser has reported what your pages load at runtime (last report: %s), so tags injected by a tag manager are covered.', 'ow-consent' ),
							esc_html( $cov_probe > 0 ? wp_date( 'd/m/Y H:i', $cov_probe ) : __( 'date unknown', 'ow-consent' ) )
						);
						?>
					<?php else : ?>
						<span class="owco-pill warn"><?php esc_html_e( 'JavaScript never observed', 'ow-consent' ); ?></span>
						<?php esc_html_e( 'The sweep reads HTML on the server and executes nothing, and no browser has ever reported back. Anything a tag manager injects at runtime is therefore absent from this list — visit a few pages of your site while logged in as an administrator to let the in-page probe report.', 'ow-consent' ); ?>
					<?php endif; ?>
				</li>
			</ul>
		</div>
		<?php endif; ?>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Run a manual scan', 'ow-consent' ); ?></h2>
			<p><?php
				printf(
					/* translators: %d: maximum number of URLs crawled in one run */
					esc_html( _n( 'The scanner requests up to %d public URL of your own site (home page, policy pages, your most recent pages and posts, custom post types and a few archives) and parses the returned HTML for third-party scripts, iframes, stylesheets and tracking pixels. It does not execute JavaScript, and it never leaves your domain.', 'The scanner requests up to %d public URLs of your own site (home page, policy pages, your most recent pages and posts, custom post types and a few archives) and parses the returned HTML for third-party scripts, iframes, stylesheets and tracking pixels. It does not execute JavaScript, and it never leaves your domain.', (int) OWCO_Core::setting( 'scanner_max_urls' ), 'ow-consent' ) ),
					(int) OWCO_Core::setting( 'scanner_max_urls' )
				);
			?></p>
			<p class="owco-help"><?php esc_html_e( 'Unknown items are flagged for review below. Each request is a normal loopback HTTP call to your own server, so a large limit on a slow host makes the scan long.', 'ow-consent' ); ?></p>

			<?php if ( is_array( $run_res ) ) :
				// run_static_scan() signals lock-out, loopback failures and a truncated
				// (batched) run. Reporting a green "completed" for any of those tells the
				// admin the site is tracker-free when the scan simply never read a page.
				$res_locked   = ! empty( $run_res['locked'] );
				$res_complete = ! empty( $run_res['complete'] );
				$res_failed   = isset( $run_res['urls_failed'] ) ? (int) $run_res['urls_failed'] : 0;
				$res_fetched  = isset( $run_res['urls_fetched'] ) ? (int) $run_res['urls_fetched'] : 0;
				$res_scanned  = isset( $run_res['urls_scanned'] ) ? (int) $run_res['urls_scanned'] : 0;
				$res_queued   = isset( $run_res['urls_queued'] ) ? (int) $run_res['urls_queued'] : 0;
				// "Done" means dequeued, failures included — urls_scanned only counts the
				// pages that answered, so using it here would understate the progress of a
				// run that is being resumed.
				$res_done     = isset( $run_res['urls_attempted'] ) ? (int) $run_res['urls_attempted'] : $res_scanned;
				$res_error    = isset( $run_res['first_error'] ) ? (string) $run_res['first_error'] : '';
				$res_message  = isset( $run_res['message'] ) ? (string) $run_res['message'] : '';
			?>
				<?php if ( $res_locked ) : ?>
					<div class="owco-banner-status bad">
						✗ <?php echo esc_html( '' !== $res_message ? $res_message : __( 'A scan is already running. Try again in a few minutes.', 'ow-consent' ) ); ?>
					</div>
				<?php elseif ( $res_fetched < 1 ) : ?>
					<div class="owco-banner-status bad">
						✗ <?php esc_html_e( 'The scan could not read a single page of your site, so nothing was analysed — this is not a clean result. Check that your server is allowed to call itself over HTTP: loopback requests are commonly blocked by HTTP authentication on a staging site, or by a firewall.', 'ow-consent' ); ?>
						<?php if ( '' !== $res_error ) : ?>
							<br><code><?php echo esc_html( $res_error ); ?></code>
						<?php endif; ?>
					</div>
				<?php else : ?>
					<div class="owco-banner-status <?php echo ( $res_complete && $res_failed < 1 ) ? 'ok' : 'warn'; ?>">
						<?php if ( $res_complete ) : ?>
							✓ <?php
							/* translators: 1: URLs scanned, 2: total elements detected, 3: new elements, 4: un-categorized count */
							printf( esc_html__( 'Scan completed: %1$d URLs analysed, %2$d elements detected, %3$d new, %4$d uncategorized.', 'ow-consent' ),
								(int) $res_scanned,
								isset( $run_res['total'] ) ? (int) $run_res['total'] : 0,
								isset( $run_res['new'] ) ? (int) $run_res['new'] : 0,
								isset( $run_res['unknown'] ) ? (int) $run_res['unknown'] : 0 );
							?>
						<?php else : ?>
							⏳ <?php
							/* translators: 1: URLs done so far, 2: total URLs queued, 3: elements detected so far, 4: un-categorized count so far */
							printf( esc_html__( 'Scan still running: %1$d of %2$d URLs done, %3$d elements detected so far, %4$d uncategorized. It ran out of time budget and will continue automatically in the background — these figures are partial.', 'ow-consent' ),
								(int) $res_done,
								(int) $res_queued,
								isset( $run_res['total'] ) ? (int) $run_res['total'] : 0,
								isset( $run_res['unknown'] ) ? (int) $run_res['unknown'] : 0 );
							?>
						<?php endif; ?>
						<?php if ( $res_failed > 0 ) : ?>
							<br><?php
							/* translators: %d: number of URLs the scanner could not fetch */
							printf( esc_html( _n( '%d URL could not be fetched, so what it loads was not inspected.', '%d URLs could not be fetched, so what they load was not inspected.', $res_failed, 'ow-consent' ) ), (int) $res_failed );
							?>
							<?php if ( '' !== $res_error ) : ?>
								<code><?php echo esc_html( $res_error ); ?></code>
							<?php endif; ?>
						<?php endif; ?>
					</div>
				<?php endif; ?>
			<?php endif; ?>

			<form method="post" style="margin-top:14px;">
				<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
				<input type="hidden" name="owco_admin_action" value="run_scanner">
				<button type="submit" class="button button-primary"><span aria-hidden="true">🔎</span> <?php esc_html_e( 'Run a scan now', 'ow-consent' ); ?></button>
			</form>

			<form method="post" style="margin-top:18px;">
				<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
				<input type="hidden" name="owco_admin_action" value="save_settings">
				<input type="hidden" name="_tab" value="scanner">
				<table class="form-table">
					<?php self::field_bool( 'scanner_enabled', __( 'Enable the automatic scanner', 'ow-consent' ) ); ?>
					<?php
					$frequencies = array(
						'hourly'     => __( 'Hourly', 'ow-consent' ),
						'twicedaily' => __( 'Twice daily', 'ow-consent' ),
						'daily'      => __( 'Daily', 'ow-consent' ),
						'weekly'     => __( 'Weekly (recommended)', 'ow-consent' ),
					);
					// Only offer recurrences WordPress actually knows about on this install.
					$available_schedules = (array) wp_get_schedules();
					foreach ( array_keys( $frequencies ) as $slug ) {
						if ( ! isset( $available_schedules[ $slug ] ) ) {
							unset( $frequencies[ $slug ] );
						}
					}
					if ( empty( $frequencies ) ) {
						$frequencies = array( 'daily' => __( 'Daily', 'ow-consent' ) );
					}
					self::field_select( 'scanner_frequency', __( 'Frequency', 'ow-consent' ), $frequencies, __( 'Saving reschedules the cron event immediately — the new frequency applies from the next run.', 'ow-consent' ) );
					?>
					<?php self::field_int( 'scanner_max_urls', __( 'URLs crawled per run', 'ow-consent' ), __( 'Hard cap on the number of pages requested in one scan. Lower it on a slow or metered host.', 'ow-consent' ), 1, 500 ); ?>
					<?php
					self::field_select(
						'scanner_probe_mode',
						__( 'In-page probe', 'ow-consent' ),
						array(
							'admins' => __( 'Run for logged-in administrators', 'ow-consent' ),
							'off'    => __( 'Off', 'ow-consent' ),
						),
						__( 'The server-side scan cannot see cookies written by JavaScript. The probe fills that gap by observing what actually runs in a real browser — but only in an administrator\'s own session, never a visitor\'s. Switch it off if you would rather ship no extra script at all; the tracker list then reflects HTML inspection only.', 'ow-consent' )
					);
					?>
					<?php self::field_int( 'scanner_timeout', __( 'Timeout per URL (seconds)', 'ow-consent' ), __( 'A page that does not answer within this many seconds is skipped instead of stalling the whole scan.', 'ow-consent' ), 1, 60 ); ?>
					<?php self::field_text( 'scanner_alert_email', __( 'Alert email (new tracker)', 'ow-consent' ), __( 'Notified after an automatic scan that found uncategorized trackers. Falls back to the site administrator address when empty.', 'ow-consent' ), 'email' ); ?>
				</table>
				<p><button type="submit" class="button"><?php esc_html_e( 'Save schedule', 'ow-consent' ); ?></button></p>
			</form>
		</div>

		<?php if ( ! $table_ok ) : ?>
			<?php self::render_missing_table( __( 'Discovered trackers', 'ow-consent' ) ); ?>
		<?php else : ?>
		<div class="owco-section">
			<h2><?php esc_html_e( 'Discovered trackers', 'ow-consent' ); ?></h2>
			<p class="owco-help"><?php esc_html_e( 'Giving a tracker a category does two things: it appears under that heading in the generated cookie policy, and a matching rule is written into the tracker catalogue so the blocker actually holds it back until the visitor consents.', 'ow-consent' ); ?></p>

			<p style="margin-bottom:10px;">
				<?php
				$cat_links = array(
					''        => __( 'All', 'ow-consent' ),
					// Glyph concatenated outside the gettext call so it cannot be lost in translation.
					'unknown' => '⚠ ' . __( 'Uncategorized', 'ow-consent' ),
				);
				foreach ( OWCO_Core::categories() as $filter_cat ) {
					$cat_links[ $filter_cat ] = OWCO_Core::category_label( $filter_cat );
				}
				foreach ( $cat_links as $val => $lbl ) :
					$link_args = array_diff_key( $carry, array( 'filter' => '', 'paged' => '' ) );
					if ( '' !== $val ) { $link_args['filter'] = $val; }
					$url   = self::tab_url( 'scanner', $link_args );
					$style = ( $filter === $val ) ? 'background:#0f172a;color:#fff;' : '';
				?>
					<a href="<?php echo esc_url( $url ); ?>" class="button" style="<?php echo esc_attr( $style ); ?>"><?php echo esc_html( $lbl ); ?></a>
				<?php endforeach; ?>
			</p>

			<form method="get" style="margin-bottom:14px;display:flex;gap:8px;flex-wrap:wrap;align-items:flex-end;">
				<input type="hidden" name="page" value="<?php echo esc_attr( self::MENU_SLUG ); ?>">
				<input type="hidden" name="tab" value="scanner">
				<input type="hidden" name="filter" value="<?php echo esc_attr( $filter ); ?>">
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Search a domain or a name', 'ow-consent' ); ?></span>
					<input type="search" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>" placeholder="<?php esc_attr_e( 'Domain or name', 'ow-consent' ); ?>">
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by element type', 'ow-consent' ); ?></span>
					<select name="kind">
						<option value=""><?php esc_html_e( 'Every element type', 'ow-consent' ); ?></option>
						<?php foreach ( self::scanner_kind_labels() as $slug => $label ) : ?>
							<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $filters['kind'], $slug ); ?>><?php echo esc_html( $label ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by review state', 'ow-consent' ); ?></span>
					<select name="state">
						<option value=""><?php esc_html_e( 'Reviewed and not reviewed', 'ow-consent' ); ?></option>
						<option value="unconfirmed"<?php selected( $filters['state'], 'unconfirmed' ); ?>><?php esc_html_e( 'Not reviewed by a human', 'ow-consent' ); ?></option>
						<option value="confirmed"<?php selected( $filters['state'], 'confirmed' ); ?>><?php esc_html_e( 'Confirmed by a human', 'ow-consent' ); ?></option>
					</select>
				</label>
				<button type="submit" class="button"><?php esc_html_e( 'Filter', 'ow-consent' ); ?></button>
				<a class="button" href="<?php echo esc_url( self::tab_url( 'scanner' ) ); ?>"><?php esc_html_e( 'Reset', 'ow-consent' ); ?></a>
				<a class="button" href="<?php echo esc_url( self::export_url( 'scanner', 'csv', $carry ) ); ?>"><?php esc_html_e( 'Export CSV', 'ow-consent' ); ?></a>
			</form>

			<?php if ( empty( $rows ) ) : ?>
				<p><em><?php
					echo empty( $carry )
						? esc_html__( 'No tracker detected.', 'ow-consent' )
						: esc_html__( 'No tracker matches these filters.', 'ow-consent' );
				?></em></p>
			<?php else :
				$cat_options = array( 'unknown' => __( 'Uncategorized', 'ow-consent' ) );
				foreach ( OWCO_Core::categories() as $opt_slug ) {
					$cat_options[ $opt_slug ] = OWCO_Core::category_label( $opt_slug );
				}
				$kind_labels = self::scanner_kind_labels();
			?>
				<form method="post">
					<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
					<input type="hidden" name="owco_admin_action" value="bulk_classify">
					<?php foreach ( array( 'filter', 'kind', 'state' ) as $keep_arg ) : ?>
						<input type="hidden" name="_owco_<?php echo esc_attr( $keep_arg ); ?>" value="<?php echo esc_attr( isset( $carry[ $keep_arg ] ) ? (string) $carry[ $keep_arg ] : '' ); ?>">
					<?php endforeach; ?>
					<input type="hidden" name="_owco_paged" value="<?php echo esc_attr( (string) $paged ); ?>">

					<p style="display:flex;gap:8px;align-items:center;flex-wrap:wrap;">
						<label for="owco-bulk-category" style="font-weight:600;"><?php esc_html_e( 'Classify the selected trackers as', 'ow-consent' ); ?></label>
						<select id="owco-bulk-category" name="bulk_category">
							<?php // Neutral default: the first entry of $cat_options is "Uncategorized", and pre-selecting it turned an accidental submit into a mass un-classification. ?>
							<option value="" disabled selected><?php esc_html_e( '— Choose a category —', 'ow-consent' ); ?></option>
							<?php foreach ( $cat_options as $opt => $opt_label ) : ?>
								<option value="<?php echo esc_attr( $opt ); ?>"><?php echo esc_html( $opt_label ); ?></option>
							<?php endforeach; ?>
						</select>
						<button type="submit" class="button"><?php esc_html_e( 'Apply to the selection', 'ow-consent' ); ?></button>
					</p>

					<table class="owco-table">
						<thead>
							<tr>
								<th style="width:2em;"><span class="screen-reader-text"><?php esc_html_e( 'Select', 'ow-consent' ); ?></span></th>
								<th><?php esc_html_e( 'Type', 'ow-consent' ); ?></th>
								<th><?php esc_html_e( 'Domain / Name', 'ow-consent' ); ?></th>
								<th><?php esc_html_e( 'Category', 'ow-consent' ); ?></th>
								<th><?php esc_html_e( 'Seen on', 'ow-consent' ); ?></th>
								<th><?php esc_html_e( 'Action', 'ow-consent' ); ?></th>
							</tr>
						</thead>
						<tbody>
						<?php foreach ( $rows as $r ) :
							$fid_row    = (int) $r['id'];
							$is_unknown = ( 'unknown' === (string) $r['category_guess'] );
							$kind       = (string) $r['kind'];
						?>
							<tr style="<?php echo $is_unknown ? 'background:#fef2f2;' : ''; ?>">
								<td>
									<label class="screen-reader-text" for="owco-pick-<?php echo esc_attr( (string) $fid_row ); ?>"><?php
										/* translators: %s: domain or name of the detected tracker */
										printf( esc_html__( 'Select %s', 'ow-consent' ), esc_html( (string) $r['domain'] ) );
									?></label>
									<input type="checkbox" id="owco-pick-<?php echo esc_attr( (string) $fid_row ); ?>" name="finding_ids[]" value="<?php echo esc_attr( (string) $fid_row ); ?>">
								</td>
								<td><code><?php echo esc_html( isset( $kind_labels[ $kind ] ) ? $kind_labels[ $kind ] : $kind ); ?></code></td>
								<td>
									<strong><?php echo esc_html( (string) $r['domain'] ); ?></strong><br>
									<small style="color:#64748b;"><?php echo esc_html( (string) $r['name'] ); ?></small>
									<?php if ( ! empty( $r['confirmed'] ) ) : ?>
										<br><span class="owco-pill ok"><?php esc_html_e( 'Confirmed', 'ow-consent' ); ?></span>
									<?php endif; ?>
								</td>
								<td>
									<label class="screen-reader-text" for="owco-finding-<?php echo esc_attr( (string) $fid_row ); ?>"><?php esc_html_e( 'Category', 'ow-consent' ); ?></label>
									<select form="owco-classify-<?php echo esc_attr( (string) $fid_row ); ?>" id="owco-finding-<?php echo esc_attr( (string) $fid_row ); ?>" name="finding_category" onchange="this.form.submit()">
										<?php foreach ( $cat_options as $opt => $opt_label ) : ?>
											<option value="<?php echo esc_attr( $opt ); ?>" <?php selected( (string) $r['category_guess'], $opt ); ?>><?php echo esc_html( $opt_label ); ?></option>
										<?php endforeach; ?>
									</select>
									<noscript><button type="submit" form="owco-classify-<?php echo esc_attr( (string) $fid_row ); ?>" class="button button-small"><?php esc_html_e( 'Apply', 'ow-consent' ); ?></button></noscript>
								</td>
								<td><?php echo esc_html( (string) $r['discovered_at'] ); ?></td>
								<td>
									<?php if ( ! empty( $r['page_url'] ) ) : ?>
										<a href="<?php echo esc_url( (string) $r['page_url'] ); ?>" target="_blank" rel="noopener" class="button button-small"><?php esc_html_e( 'View page', 'ow-consent' ); ?></a>
									<?php endif; ?>
								</td>
							</tr>
						<?php endforeach; ?>
						</tbody>
					</table>
				</form>

				<?php
				// The single-row classify forms live outside both the table and the bulk
				// form: nesting a <form> in a <form>, or inside a <tr>, is invalid HTML and
				// the browser silently drops it. The row controls point at them by id.
				foreach ( $rows as $r ) :
					$fid_row = (int) $r['id'];
				?>
					<form method="post" id="owco-classify-<?php echo esc_attr( (string) $fid_row ); ?>">
						<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
						<input type="hidden" name="owco_admin_action" value="confirm_finding">
						<input type="hidden" name="finding_id" value="<?php echo esc_attr( (string) $fid_row ); ?>">
						<?php foreach ( array( 'filter', 'kind', 'state' ) as $keep_arg ) : ?>
							<input type="hidden" name="_owco_<?php echo esc_attr( $keep_arg ); ?>" value="<?php echo esc_attr( isset( $carry[ $keep_arg ] ) ? (string) $carry[ $keep_arg ] : '' ); ?>">
						<?php endforeach; ?>
						<input type="hidden" name="_owco_paged" value="<?php echo esc_attr( (string) $paged ); ?>">
					</form>
				<?php endforeach; ?>

				<?php self::render_pagination( $total, $paged, 'scanner', $carry ); ?>
			<?php endif; ?>
		</div>
		<?php endif; ?>
		<?php
	}

	/**
	 * Translated names of the element kinds the scanner records.
	 *
	 * @return array<string,string>
	 */
	protected static function scanner_kind_labels() {
		return array(
			'script'        => __( 'Script', 'ow-consent' ),
			'inline_script' => __( 'Inline script', 'ow-consent' ),
			'iframe'        => __( 'Iframe', 'ow-consent' ),
			'stylesheet'    => __( 'Stylesheet', 'ow-consent' ),
			'pixel'         => __( 'Tracking pixel', 'ow-consent' ),
			'cookie'        => __( 'Cookie', 'ow-consent' ),
			'link'          => __( 'Link', 'ow-consent' ),
			'preconnect'    => __( 'Resource hint', 'ow-consent' ),
		);
	}

	/* ---------------- Tracker catalogue ---------------- */

	/**
	 * The blocking catalogue (wp_owco_scripts) — what the blocker actually consults.
	 *
	 * Until 1.2.0 this table had no interface at all: the plugin raised an admin notice
	 * asking the operator to repair invalid patterns on a screen that did not exist, and a
	 * tracker the catalogue did not know could never be blocked by hand.
	 *
	 * @return void
	 */
	protected static function render_tab_catalog() {
		if ( ! self::table_ready( OWCO_TABLE_SCRIPTS ) ) {
			self::render_missing_table( __( 'Tracker catalogue', 'ow-consent' ) );
			return;
		}

		global $wpdb;
		$filters = self::catalog_filters();
		$where   = self::catalog_where( $filters );
		$paged   = self::current_paged();
		$columns = array( 'id', 'pattern', 'pattern_type', 'match_target', 'name', 'vendor', 'category', 'privacy_policy_url' );

		if ( '1' === $filters['invalid'] ) {
			// Only PCRE can say whether a regex compiles, so the "needs attention" view is
			// decided in PHP. Paginating the SQL candidates first would hand the admin empty
			// pages, so the (deliberately small) candidate set is filtered whole instead.
			$select = self::select_clause( OWCO_TABLE_SCRIPTS, $columns );
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- table and columns are bound as %i by select_clause(); $where is the clause build_where() already prepared and must not be rescanned. A repair screen must show the catalogue as it is right now.
			$candidates = $wpdb->get_results( $select . $where . ' ORDER BY category ASC, pattern ASC LIMIT 300', ARRAY_A );
			$rows       = array();
			foreach ( (array) $candidates as $candidate ) {
				if ( '' !== self::catalog_row_problem( $candidate ) ) { $rows[] = $candidate; }
			}
			$total = count( $rows );
			$paged = 1;
		} else {
			$total = self::count_rows( OWCO_TABLE_SCRIPTS, $where );
			$rows  = self::fetch_page( OWCO_TABLE_SCRIPTS, $columns, $where, 'category ASC, pattern ASC', $paged );
		}

		$categories = OWCO_Core::categories();
		$carry      = array_filter( array(
			'cat'     => $filters['cat'],
			'target'  => $filters['target'],
			'ptype'   => $filters['ptype'],
			's'       => $filters['s'],
			'invalid' => $filters['invalid'],
		), 'strlen' );
		?>
		<div class="owco-section">
			<h2><?php esc_html_e( 'Tracker catalogue', 'ow-consent' ); ?></h2>
			<p><?php esc_html_e( 'These rules are the only thing the blocker consults. A third-party script, iframe or cookie that matches a rule is held back until the visitor has consented to the rule\'s category; anything that matches nothing falls back to the policy set on the Compliance tab.', 'ow-consent' ); ?></p>
			<p class="owco-help"><?php esc_html_e( 'The catalogue ships pre-filled with the common trackers. Add a rule when the scanner finds something the catalogue does not know, and delete one only if it blocks a service you actually need before consent.', 'ow-consent' ); ?></p>
		</div>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Add a blocking rule', 'ow-consent' ); ?></h2>
			<form method="post">
				<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
				<input type="hidden" name="owco_admin_action" value="catalog_save">
				<input type="hidden" name="catalog_id" value="0">
				<?php self::catalog_state_inputs( $carry, $paged ); ?>
				<table class="form-table">
					<tr>
						<th><label for="owco-new-pattern"><?php esc_html_e( 'Pattern', 'ow-consent' ); ?></label></th>
						<td>
							<input type="text" id="owco-new-pattern" name="catalog_pattern" class="regular-text" maxlength="255" placeholder="example-tracker.com" required>
							<?php self::field_help( __( 'A host fragment such as googletagmanager.com, a cookie name such as _ga, or a regular expression when the type below says so.', 'ow-consent' ) ); ?>
						</td>
					</tr>
					<tr>
						<th><label for="owco-new-ptype"><?php esc_html_e( 'Pattern type', 'ow-consent' ); ?></label></th>
						<td>
							<select id="owco-new-ptype" name="catalog_pattern_type">
								<?php foreach ( self::catalog_pattern_type_labels() as $slug => $label ) : ?>
									<option value="<?php echo esc_attr( $slug ); ?>"><?php echo esc_html( $label ); ?></option>
								<?php endforeach; ?>
							</select>
						</td>
					</tr>
					<tr>
						<th><label for="owco-new-target"><?php esc_html_e( 'Matched against', 'ow-consent' ); ?></label></th>
						<td>
							<select id="owco-new-target" name="catalog_match_target">
								<?php foreach ( self::catalog_target_labels() as $slug => $label ) : ?>
									<option value="<?php echo esc_attr( $slug ); ?>"><?php echo esc_html( $label ); ?></option>
								<?php endforeach; ?>
							</select>
							<?php self::field_help( __( 'A short name such as "fr" is only safe against cookie names: matched against URLs it would fire inside unrelated file names.', 'ow-consent' ) ); ?>
						</td>
					</tr>
					<tr>
						<th><label for="owco-new-category"><?php esc_html_e( 'Consent category', 'ow-consent' ); ?></label></th>
						<td>
							<select id="owco-new-category" name="catalog_category">
								<?php foreach ( $categories as $slug ) : ?>
									<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( 'marketing', $slug ); ?>><?php echo esc_html( OWCO_Core::category_label( $slug ) ); ?></option>
								<?php endforeach; ?>
							</select>
						</td>
					</tr>
					<tr>
						<th><label for="owco-new-name"><?php esc_html_e( 'Display name', 'ow-consent' ); ?></label></th>
						<td><input type="text" id="owco-new-name" name="catalog_name" class="regular-text" maxlength="190" placeholder="<?php esc_attr_e( 'Google Analytics', 'ow-consent' ); ?>"></td>
					</tr>
					<tr>
						<th><label for="owco-new-vendor"><?php esc_html_e( 'Vendor', 'ow-consent' ); ?></label></th>
						<td><input type="text" id="owco-new-vendor" name="catalog_vendor" class="regular-text" maxlength="190"></td>
					</tr>
					<tr>
						<th><label for="owco-new-policy"><?php esc_html_e( 'Vendor privacy policy', 'ow-consent' ); ?></label></th>
						<td>
							<input type="url" id="owco-new-policy" name="catalog_policy_url" class="regular-text" maxlength="500" placeholder="https://">
							<?php self::field_help( __( 'Printed next to the tracker in the generated cookie policy.', 'ow-consent' ) ); ?>
						</td>
					</tr>
				</table>
				<p><button type="submit" class="button button-primary"><?php esc_html_e( 'Add the rule', 'ow-consent' ); ?></button></p>
			</form>
		</div>

		<div class="owco-section">
			<h2><?php esc_html_e( 'Blocking rules', 'ow-consent' ); ?></h2>

			<form method="get" style="margin-bottom:14px;display:flex;gap:8px;flex-wrap:wrap;align-items:flex-end;">
				<input type="hidden" name="page" value="<?php echo esc_attr( self::MENU_SLUG ); ?>">
				<input type="hidden" name="tab" value="catalog">
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Search the catalogue', 'ow-consent' ); ?></span>
					<input type="search" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>" placeholder="<?php esc_attr_e( 'Pattern, name or vendor', 'ow-consent' ); ?>">
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by category', 'ow-consent' ); ?></span>
					<select name="cat">
						<option value=""><?php esc_html_e( 'Every category', 'ow-consent' ); ?></option>
						<?php foreach ( $categories as $slug ) : ?>
							<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $filters['cat'], $slug ); ?>><?php echo esc_html( OWCO_Core::category_label( $slug ) ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by what the pattern is matched against', 'ow-consent' ); ?></span>
					<select name="target">
						<option value=""><?php esc_html_e( 'URLs and cookie names', 'ow-consent' ); ?></option>
						<?php foreach ( self::catalog_target_labels() as $slug => $label ) : ?>
							<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $filters['target'], $slug ); ?>><?php echo esc_html( $label ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label>
					<span class="screen-reader-text"><?php esc_html_e( 'Filter by pattern type', 'ow-consent' ); ?></span>
					<select name="ptype">
						<option value=""><?php esc_html_e( 'Every pattern type', 'ow-consent' ); ?></option>
						<?php foreach ( self::catalog_pattern_type_labels() as $slug => $label ) : ?>
							<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $filters['ptype'], $slug ); ?>><?php echo esc_html( $label ); ?></option>
						<?php endforeach; ?>
					</select>
				</label>
				<label style="display:inline-flex;align-items:center;gap:5px;">
					<input type="checkbox" name="invalid" value="1" <?php checked( '1', $filters['invalid'] ); ?>>
					<?php esc_html_e( 'Only rules that cannot fire', 'ow-consent' ); ?>
				</label>
				<button type="submit" class="button"><?php esc_html_e( 'Filter', 'ow-consent' ); ?></button>
				<a class="button" href="<?php echo esc_url( self::tab_url( 'catalog' ) ); ?>"><?php esc_html_e( 'Reset', 'ow-consent' ); ?></a>
				<a class="button" href="<?php echo esc_url( self::export_url( 'catalog', 'csv', $carry ) ); ?>"><?php esc_html_e( 'Export CSV', 'ow-consent' ); ?></a>
			</form>

			<?php if ( empty( $rows ) ) : ?>
				<p><em><?php esc_html_e( 'No rule matches these filters.', 'ow-consent' ); ?></em></p>
			<?php else : ?>
				<?php
				// One <form> per row, kept OUTSIDE the table: a <form> between <tr> and <td>
				// is invalid HTML and every browser hoists it out of the table, which silently
				// detaches the controls from it. The rows reference these by the `form`
				// attribute instead.
				foreach ( $rows as $row ) :
					$rid = (int) $row['id'];
				?>
					<form method="post" id="owco-cat-form-<?php echo esc_attr( (string) $rid ); ?>">
						<?php wp_nonce_field( self::SAVE_NONCE_ACTION, '_owco_nonce' ); ?>
						<input type="hidden" name="catalog_id" value="<?php echo esc_attr( (string) $rid ); ?>">
						<input type="hidden" name="catalog_policy_url" value="<?php echo esc_attr( (string) $row['privacy_policy_url'] ); ?>">
						<?php self::catalog_state_inputs( $carry, $paged ); ?>
					</form>
				<?php endforeach; ?>

				<table class="owco-table">
					<thead>
						<tr>
							<th><?php esc_html_e( 'Pattern', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Type', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Matched against', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Identification', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Category', 'ow-consent' ); ?></th>
							<th><?php esc_html_e( 'Action', 'ow-consent' ); ?></th>
						</tr>
					</thead>
					<tbody>
					<?php foreach ( $rows as $row ) :
						$rid     = (int) $row['id'];
						$fid     = 'owco-cat-form-' . $rid;
						$problem = self::catalog_row_problem( $row );
						$row_target = ( isset( $row['match_target'] ) && '' !== (string) $row['match_target'] ) ? (string) $row['match_target'] : 'url';
					?>
						<tr style="<?php echo '' !== $problem ? 'background:#fef2f2;' : ''; ?>">
							<td>
								<label class="screen-reader-text" for="owco-cat-pattern-<?php echo esc_attr( (string) $rid ); ?>"><?php esc_html_e( 'Pattern', 'ow-consent' ); ?></label>
								<input type="text" form="<?php echo esc_attr( $fid ); ?>" id="owco-cat-pattern-<?php echo esc_attr( (string) $rid ); ?>" name="catalog_pattern" value="<?php echo esc_attr( (string) $row['pattern'] ); ?>" maxlength="255" style="width:100%;min-width:180px;font-family:ui-monospace,Menlo,monospace;font-size:11px;">
								<?php if ( '' !== $problem ) : ?>
									<small style="color:#b91c1c;display:block;margin-top:4px;">⚠ <?php echo esc_html( $problem ); ?></small>
								<?php endif; ?>
							</td>
							<td>
								<label class="screen-reader-text" for="owco-cat-ptype-<?php echo esc_attr( (string) $rid ); ?>"><?php esc_html_e( 'Pattern type', 'ow-consent' ); ?></label>
								<select form="<?php echo esc_attr( $fid ); ?>" id="owco-cat-ptype-<?php echo esc_attr( (string) $rid ); ?>" name="catalog_pattern_type">
									<?php foreach ( self::catalog_pattern_type_labels() as $slug => $label ) : ?>
										<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( (string) $row['pattern_type'], $slug ); ?>><?php echo esc_html( $label ); ?></option>
									<?php endforeach; ?>
								</select>
							</td>
							<td>
								<label class="screen-reader-text" for="owco-cat-target-<?php echo esc_attr( (string) $rid ); ?>"><?php esc_html_e( 'Matched against', 'ow-consent' ); ?></label>
								<select form="<?php echo esc_attr( $fid ); ?>" id="owco-cat-target-<?php echo esc_attr( (string) $rid ); ?>" name="catalog_match_target">
									<?php foreach ( self::catalog_target_labels() as $slug => $label ) : ?>
										<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( $row_target, $slug ); ?>><?php echo esc_html( $label ); ?></option>
									<?php endforeach; ?>
								</select>
							</td>
							<td>
								<label class="screen-reader-text" for="owco-cat-name-<?php echo esc_attr( (string) $rid ); ?>"><?php esc_html_e( 'Display name', 'ow-consent' ); ?></label>
								<input type="text" form="<?php echo esc_attr( $fid ); ?>" id="owco-cat-name-<?php echo esc_attr( (string) $rid ); ?>" name="catalog_name" value="<?php echo esc_attr( (string) $row['name'] ); ?>" maxlength="190" style="width:100%;min-width:140px;">
								<label class="screen-reader-text" for="owco-cat-vendor-<?php echo esc_attr( (string) $rid ); ?>"><?php esc_html_e( 'Vendor', 'ow-consent' ); ?></label>
								<input type="text" form="<?php echo esc_attr( $fid ); ?>" id="owco-cat-vendor-<?php echo esc_attr( (string) $rid ); ?>" name="catalog_vendor" value="<?php echo esc_attr( (string) $row['vendor'] ); ?>" maxlength="190" style="width:100%;min-width:140px;margin-top:4px;" placeholder="<?php esc_attr_e( 'Vendor', 'ow-consent' ); ?>">
							</td>
							<td>
								<label class="screen-reader-text" for="owco-cat-category-<?php echo esc_attr( (string) $rid ); ?>"><?php esc_html_e( 'Consent category', 'ow-consent' ); ?></label>
								<select form="<?php echo esc_attr( $fid ); ?>" id="owco-cat-category-<?php echo esc_attr( (string) $rid ); ?>" name="catalog_category">
									<?php foreach ( $categories as $slug ) : ?>
										<option value="<?php echo esc_attr( $slug ); ?>"<?php selected( (string) $row['category'], $slug ); ?>><?php echo esc_html( OWCO_Core::category_label( $slug ) ); ?></option>
									<?php endforeach; ?>
								</select>
							</td>
							<td style="white-space:nowrap;">
								<button type="submit" form="<?php echo esc_attr( $fid ); ?>" name="owco_admin_action" value="catalog_save" class="button button-small button-primary"><?php esc_html_e( 'Save', 'ow-consent' ); ?></button>
								<button type="submit" form="<?php echo esc_attr( $fid ); ?>" name="owco_admin_action" value="catalog_delete" class="button button-small"
									onclick="return confirm('<?php echo esc_js( __( 'Delete this blocking rule? Whatever it covers will stop being blocked before consent.', 'ow-consent' ) ); ?>');"><?php esc_html_e( 'Delete', 'ow-consent' ); ?></button>
							</td>
						</tr>
					<?php endforeach; ?>
					</tbody>
				</table>
				<?php if ( '1' !== $filters['invalid'] ) : ?>
					<?php self::render_pagination( $total, $paged, 'catalog', $carry ); ?>
				<?php else : ?>
					<p class="owco-help"><?php
						printf(
							/* translators: %s: number of unusable blocking rules found */
							esc_html( _n( '%s rule cannot fire as written. Fix its pattern, change what it is matched against, or delete it.', '%s rules cannot fire as written. Fix their patterns, change what they are matched against, or delete them.', $total, 'ow-consent' ) ),
							esc_html( number_format_i18n( $total ) )
						);
					?></p>
				<?php endif; ?>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * Hidden inputs carrying the current listing state through a catalogue write, so the
	 * redirect lands the admin back on the row they were editing.
	 *
	 * @param array $carry Active filters.
	 * @param int   $paged Current page.
	 * @return void
	 */
	protected static function catalog_state_inputs( array $carry, $paged ) {
		foreach ( $carry as $key => $value ) {
			echo '<input type="hidden" name="_owco_' . esc_attr( $key ) . '" value="' . esc_attr( (string) $value ) . '">';
		}
		echo '<input type="hidden" name="_owco_paged" value="' . esc_attr( (string) (int) $paged ) . '">';
	}

	/**
	 * Translated names of the pattern types.
	 *
	 * @return array<string,string>
	 */
	protected static function catalog_pattern_type_labels() {
		return array(
			'host'             => __( 'Text fragment (recommended)', 'ow-consent' ),
			'regex'            => __( 'Regular expression', 'ow-consent' ),
			'inline_signature' => __( 'Inline script signature', 'ow-consent' ),
		);
	}

	/**
	 * Translated names of the match targets.
	 *
	 * @return array<string,string>
	 */
	protected static function catalog_target_labels() {
		return array(
			'url'    => __( 'Resource URL', 'ow-consent' ),
			'cookie' => __( 'Cookie name', 'ow-consent' ),
		);
	}

	/* =================================================================
	 * SHARED SCREEN INFRASTRUCTURE
	 * ============================================================== */

	/** @var int Rows per page on every paginated listing. */
	const PER_PAGE = 25;

	/**
	 * True when a plugin-owned table really exists in this database.
	 *
	 * Every listing screen calls this first: a failed activation, a half-finished
	 * migration or a manually dropped table used to turn the whole admin page into a
	 * white screen of fatal errors instead of a readable "not installed yet" message.
	 *
	 * @param string $table Fully-qualified table name.
	 * @return bool
	 */
	protected static function table_ready( $table ) {
		static $cache = array();
		$table = (string) $table;
		if ( '' === $table ) { return false; }
		if ( isset( $cache[ $table ] ) ) { return $cache[ $table ]; }

		global $wpdb;
		$suppress = $wpdb->suppress_errors( true );
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- schema probe on a plugin-owned table; the answer is memoised for the whole request and there is nothing to cache between requests.
		$found = $wpdb->get_var( $wpdb->prepare( 'SHOW TABLES LIKE %s', $wpdb->esc_like( $table ) ) );
		$wpdb->suppress_errors( $suppress );

		$cache[ $table ] = ( (string) $found === $table );
		return $cache[ $table ];
	}

	/**
	 * Message shown in place of a listing whose storage is not there.
	 *
	 * @param string $title Translated section title.
	 * @return void
	 */
	protected static function render_missing_table( $title ) {
		?>
		<div class="owco-section">
			<h2><?php echo esc_html( $title ); ?></h2>
			<p><span class="owco-pill bad"><?php esc_html_e( 'Not installed', 'ow-consent' ); ?></span></p>
			<p><?php esc_html_e( 'The database table backing this screen does not exist. Deactivate and reactivate OW Consent to let it rebuild the schema; if the problem persists, your database user is probably not allowed to create tables.', 'ow-consent' ); ?></p>
		</div>
		<?php
	}

	/**
	 * Current page number of a paginated listing.
	 *
	 * @return int
	 */
	protected static function current_paged() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only pagination cursor on an admin listing.
		$paged = isset( $_GET['paged'] ) ? absint( wp_unslash( $_GET['paged'] ) ) : 1;
		return max( 1, $paged );
	}

	/**
	 * A read-only GET filter value, sanitized as a key.
	 *
	 * @param string $name    Query argument name.
	 * @param array  $allowed Accepted values; anything else collapses to $default.
	 * @param string $default Value used when absent or rejected.
	 * @return string
	 */
	protected static function get_filter_key( $name, array $allowed = array(), $default = '' ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only listing filter on an admin screen.
		$raw = isset( $_GET[ $name ] ) ? sanitize_key( wp_unslash( $_GET[ $name ] ) ) : '';
		if ( '' === $raw ) { return (string) $default; }
		if ( ! empty( $allowed ) && ! in_array( $raw, $allowed, true ) ) { return (string) $default; }
		return $raw;
	}

	/**
	 * A free-text GET filter value.
	 *
	 * @param string $name  Query argument name.
	 * @param int    $limit Maximum length kept.
	 * @return string
	 */
	protected static function get_filter_text( $name, $limit = 190 ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only listing filter on an admin screen.
		$raw = isset( $_GET[ $name ] ) ? sanitize_text_field( wp_unslash( $_GET[ $name ] ) ) : '';
		$raw = trim( $raw );
		return ( strlen( $raw ) > $limit ) ? substr( $raw, 0, $limit ) : $raw;
	}

	/**
	 * A GET date filter, normalised to YYYY-MM-DD or ''.
	 *
	 * @param string $name Query argument name.
	 * @return string
	 */
	protected static function get_filter_date( $name ) {
		$raw = self::get_filter_text( $name, 10 );
		if ( ! preg_match( '/^\d{4}-\d{2}-\d{2}$/', $raw ) ) { return ''; }
		$parts = explode( '-', $raw );
		if ( ! checkdate( (int) $parts[1], (int) $parts[2], (int) $parts[0] ) ) { return ''; }
		return $raw;
	}

	/**
	 * Turn a local calendar day into the UTC bound stored in the ledger / DSAR tables.
	 *
	 * Those tables store UTC while the administrator types a date in the site timezone,
	 * so a naive comparison silently shifts the window by the UTC offset.
	 *
	 * @param string $date  YYYY-MM-DD, already validated.
	 * @param bool   $start True for 00:00:00, false for 23:59:59.
	 * @return string MySQL datetime in UTC.
	 */
	protected static function local_day_to_utc( $date, $start = true ) {
		$local = $date . ( $start ? ' 00:00:00' : ' 23:59:59' );
		$gmt   = get_gmt_from_date( $local, 'Y-m-d H:i:s' );
		return is_string( $gmt ) && '' !== $gmt ? $gmt : $local;
	}

	/**
	 * Render a UTC datetime in the site timezone, so admins do not read a shifted clock.
	 *
	 * @param string $utc MySQL datetime stored in UTC.
	 * @return string
	 */
	protected static function utc_to_local_display( $utc ) {
		$utc = (string) $utc;
		if ( '' === $utc || '0000-00-00 00:00:00' === $utc ) { return '—'; }
		$ts = strtotime( $utc . ' UTC' );
		if ( ! $ts ) { return $utc; }
		return (string) wp_date( 'Y-m-d H:i', $ts );
	}

	/**
	 * Standard pager under a listing.
	 *
	 * @param int    $total     Total matching rows.
	 * @param int    $paged     Current page.
	 * @param string $tab       Tab slug the links point back to.
	 * @param array  $base_args Filter arguments to preserve across pages.
	 * @return void
	 */
	protected static function render_pagination( $total, $paged, $tab, array $base_args = array() ) {
		$total    = max( 0, (int) $total );
		$per_page = self::PER_PAGE;
		$pages    = (int) ceil( $total / $per_page );
		if ( $pages < 2 ) { return; }

		$base_args             = array_merge( $base_args, array( 'page' => self::MENU_SLUG, 'tab' => (string) $tab ) );
		$base_args['paged']    = '%#%';
		$links                 = paginate_links( array(
			'base'      => add_query_arg( $base_args, admin_url( 'admin.php' ) ),
			'format'    => '',
			'current'   => min( max( 1, (int) $paged ), $pages ),
			'total'     => $pages,
			'type'      => 'plain',
			'prev_text' => '&laquo;',
			'next_text' => '&raquo;',
		) );
		if ( ! $links ) { return; }
		?>
		<div class="tablenav" style="margin-top:12px;">
			<div class="tablenav-pages">
				<span class="displaying-num"><?php
					printf(
						/* translators: %s: total number of rows matching the current filters */
						esc_html( _n( '%s item', '%s items', $total, 'ow-consent' ) ),
						esc_html( number_format_i18n( $total ) )
					);
				?></span>
				<?php echo wp_kses_post( $links ); ?>
			</div>
		</div>
		<?php
	}

	/* =================================================================
	 * LISTING QUERIES
	 *
	 * Each screen exposes its filter state as a plain array so the listing, the pager
	 * and the export all reproduce exactly the same selection.
	 * ============================================================== */

	/**
	 * Assemble a prepared WHERE clause.
	 *
	 * @param array $clauses SQL fragments with %s / %d placeholders.
	 * @param array $values  Values bound in the same order.
	 * @return string Ready-to-concatenate clause, already escaped, or ''.
	 */
	protected static function build_where( array $clauses, array $values ) {
		global $wpdb;
		if ( empty( $clauses ) ) { return ''; }
		$sql = ' WHERE ' . implode( ' AND ', $clauses );
		if ( empty( $values ) ) { return $sql; }
		// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- this IS the prepare() call: $clauses holds only literal fragments with placeholders, every dynamic value travels in $values.
		return (string) $wpdb->prepare( $sql, $values );
	}

	/**
	 * Assemble a `SELECT <columns> FROM <table>` head with every identifier bound.
	 *
	 * The listings and the exports all read a fixed, code-owned column list, but until
	 * now that list and the table name reached SQL as raw text. WordPress 6.2 lets an
	 * identifier be bound like any other value, so each column and the table travel as
	 * an %i replacement and $wpdb does the quoting — nothing is interpolated by hand,
	 * and nothing here is backticked in the query string, since %i brings its own.
	 *
	 * One prepare() per identifier keeps every query string a literal, which is what
	 * makes the call auditable: there is no fragment here that a reader has to trust.
	 *
	 * @param string       $table   Table name from a plugin constant.
	 * @param string|array $columns Column names, as an array or a comma-separated list.
	 * @return string Ready-to-concatenate SELECT head, already escaped.
	 */
	protected static function select_clause( $table, $columns ) {
		global $wpdb;
		if ( ! is_array( $columns ) ) {
			$columns = explode( ',', (string) $columns );
		}

		$parts = array();
		foreach ( $columns as $column ) {
			$column = trim( (string) $column );
			if ( '' === $column ) { continue; }
			$parts[] = (string) $wpdb->prepare( '%i', $column );
		}
		if ( empty( $parts ) ) {
			$parts[] = (string) $wpdb->prepare( '%i', 'id' );
		}

		return 'SELECT ' . implode( ', ', $parts ) . ' FROM ' . (string) $wpdb->prepare( '%i', (string) $table );
	}

	/**
	 * Count the rows a prepared WHERE clause selects.
	 *
	 * @param string $table Table name from a plugin constant.
	 * @param string $where Prepared WHERE clause, possibly ''.
	 * @return int
	 */
	protected static function count_rows( $table, $where ) {
		global $wpdb;
		if ( ! self::table_ready( $table ) ) { return 0; }
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- the table identifier is bound as %i; $where is the clause build_where() already prepared, and re-preparing it here would rescan the values it bound. A live counter must not be cached.
		return (int) $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i', $table ) . $where );
	}

	/**
	 * Fetch one page of a listing.
	 *
	 * @param string       $table   Table name from a plugin constant.
	 * @param string|array $columns Explicit column list.
	 * @param string       $where   Prepared WHERE clause, possibly ''.
	 * @param string       $order   ORDER BY fragment, from a literal in the calling method.
	 * @param int          $paged   1-based page number.
	 * @return array<int,array<string,mixed>>
	 */
	protected static function fetch_page( $table, $columns, $where, $order, $paged ) {
		global $wpdb;
		if ( ! self::table_ready( $table ) ) { return array(); }
		$offset = ( max( 1, (int) $paged ) - 1 ) * self::PER_PAGE;
		$limit  = $wpdb->prepare( ' LIMIT %d OFFSET %d', self::PER_PAGE, $offset );
		$select = self::select_clause( $table, $columns );
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- table and columns are bound as %i by select_clause(); $where and $limit are already prepared and must not be rescanned; $order is an ORDER BY fragment written as a literal at each of the four call sites in this class. A triage/audit listing must reflect the table as it is right now.
		$rows = $wpdb->get_results( $select . $where . ' ORDER BY ' . $order . $limit, ARRAY_A );
		return is_array( $rows ) ? $rows : array();
	}

	/**
	 * Ledger filter state read from the query string.
	 *
	 * @return array<string,string>
	 */
	protected static function ledger_filters() {
		$token = self::get_filter_text( 'token', 40 );
		if ( ! preg_match( '/^[a-f0-9]{1,32}$/i', $token ) ) { $token = ''; }
		return array(
			'event'   => self::get_filter_key( 'event', self::ledger_events(), '' ),
			'profile' => self::get_filter_key( 'profile', array_keys( self::profile_labels() ), '' ),
			'token'   => strtolower( $token ),
			'from'    => self::get_filter_date( 'from' ),
			'to'      => self::get_filter_date( 'to' ),
		);
	}

	/**
	 * Prepared WHERE clause for the ledger listing.
	 *
	 * `created_at` is stored in UTC while the administrator types a date in the site
	 * timezone, so both bounds are converted before they are bound.
	 *
	 * @param array $f Filter state.
	 * @return string
	 */
	protected static function ledger_where( array $f ) {
		$clauses = array();
		$values  = array();
		if ( '' !== $f['event'] ) {
			$clauses[] = 'event = %s';
			$values[]  = $f['event'];
		}
		if ( '' !== $f['profile'] ) {
			$clauses[] = 'profile = %s';
			$values[]  = $f['profile'];
		}
		if ( '' !== $f['token'] ) {
			$clauses[] = 'visitor_token LIKE %s';
			global $wpdb;
			$values[] = $wpdb->esc_like( $f['token'] ) . '%';
		}
		if ( '' !== $f['from'] ) {
			$clauses[] = 'created_at >= %s';
			$values[]  = self::local_day_to_utc( $f['from'], true );
		}
		if ( '' !== $f['to'] ) {
			$clauses[] = 'created_at <= %s';
			$values[]  = self::local_day_to_utc( $f['to'], false );
		}
		return self::build_where( $clauses, $values );
	}

	/**
	 * Event slugs the ledger can hold, in a stable order.
	 *
	 * @return array<int,string>
	 */
	protected static function ledger_events() {
		return array( 'accept_all', 'reject_all', 'save_preferences', 'withdraw', 'renew', 'gpc', 'optout', 'form', 'import', 'retention_anchor' );
	}

	/**
	 * Translated name of a ledger event, falling back to the stored slug.
	 *
	 * @param string $event Event slug.
	 * @return string
	 */
	protected static function ledger_event_label( $event ) {
		$labels = array(
			'accept_all'       => __( 'Accept all', 'ow-consent' ),
			'reject_all'       => __( 'Reject all', 'ow-consent' ),
			'save_preferences' => __( 'Saved preferences', 'ow-consent' ),
			'withdraw'         => __( 'Withdrawal', 'ow-consent' ),
			'renew'            => __( 'Renewal', 'ow-consent' ),
			'gpc'              => __( 'Global Privacy Control signal', 'ow-consent' ),
			'optout'           => __( 'Opt-out', 'ow-consent' ),
			'form'             => __( 'Form submission', 'ow-consent' ),
			'import'           => __( 'Imported', 'ow-consent' ),
			'retention_anchor' => __( 'Retention anchor', 'ow-consent' ),
		);
		$event = (string) $event;
		return isset( $labels[ $event ] ) ? $labels[ $event ] : $event;
	}

	/**
	 * DSAR filter state read from the query string.
	 *
	 * @return array<string,string>
	 */
	protected static function dsar_filters() {
		return array(
			'status'  => self::get_filter_key( 'status', array( 'pending', 'verified', 'resolved', 'rejected', 'expired' ), '' ),
			'type'    => self::get_filter_key( 'type', array_keys( self::dsar_type_map() ), '' ),
			'overdue' => self::get_filter_key( 'overdue', array( '1' ), '' ),
			's'       => self::get_filter_text( 's', 190 ),
			'from'    => self::get_filter_date( 'from' ),
			'to'      => self::get_filter_date( 'to' ),
		);
	}

	/**
	 * Prepared WHERE clause for the DSAR queue.
	 *
	 * @param array $f Filter state.
	 * @return string
	 */
	protected static function dsar_where( array $f ) {
		global $wpdb;
		$clauses = array();
		$values  = array();
		if ( '' !== $f['status'] ) {
			$clauses[] = 'status = %s';
			$values[]  = $f['status'];
		}
		if ( '' !== $f['type'] ) {
			$clauses[] = 'request_type = %s';
			$values[]  = $f['type'];
		}
		if ( '' !== $f['s'] ) {
			$clauses[] = 'subject_email LIKE %s';
			$values[]  = '%' . $wpdb->esc_like( $f['s'] ) . '%';
		}
		if ( '' !== $f['from'] ) {
			$clauses[] = 'created_at >= %s';
			$values[]  = self::local_day_to_utc( $f['from'], true );
		}
		if ( '' !== $f['to'] ) {
			$clauses[] = 'created_at <= %s';
			$values[]  = self::local_day_to_utc( $f['to'], false );
		}
		if ( '1' === $f['overdue'] ) {
			$clauses[] = "status IN ('pending','verified')";
			$clauses[] = 'due_at < %s';
			$values[]  = gmdate( 'Y-m-d H:i:s' );
		}
		return self::build_where( $clauses, $values );
	}

	/**
	 * Scanner filter state read from the query string.
	 *
	 * @return array<string,string>
	 */
	protected static function scanner_filters() {
		$cats   = OWCO_Core::categories();
		$cats[] = 'unknown';
		return array(
			'filter' => self::get_filter_key( 'filter', $cats, '' ),
			'kind'   => self::get_filter_key( 'kind', array( 'script', 'inline_script', 'iframe', 'stylesheet', 'pixel', 'cookie', 'link', 'preconnect' ), '' ),
			'state'  => self::get_filter_key( 'state', array( 'confirmed', 'unconfirmed' ), '' ),
			's'      => self::get_filter_text( 's', 190 ),
		);
	}

	/**
	 * Prepared WHERE clause for the scanner findings.
	 *
	 * @param array $f Filter state.
	 * @return string
	 */
	protected static function scanner_where( array $f ) {
		global $wpdb;
		$clauses = array();
		$values  = array();
		if ( '' !== $f['filter'] ) {
			$clauses[] = 'category_guess = %s';
			$values[]  = $f['filter'];
		}
		if ( '' !== $f['kind'] ) {
			$clauses[] = 'kind = %s';
			$values[]  = $f['kind'];
		}
		if ( 'confirmed' === $f['state'] ) {
			$clauses[] = 'confirmed = 1';
		} elseif ( 'unconfirmed' === $f['state'] ) {
			$clauses[] = 'confirmed = 0';
		}
		if ( '' !== $f['s'] ) {
			$like      = '%' . $wpdb->esc_like( $f['s'] ) . '%';
			$clauses[] = '( domain LIKE %s OR name LIKE %s )';
			$values[]  = $like;
			$values[]  = $like;
		}
		return self::build_where( $clauses, $values );
	}

	/**
	 * Catalogue filter state read from the query string.
	 *
	 * @return array<string,string>
	 */
	protected static function catalog_filters() {
		return array(
			'cat'     => self::get_filter_key( 'cat', OWCO_Core::categories(), '' ),
			'target'  => self::get_filter_key( 'target', array( 'url', 'cookie' ), '' ),
			'ptype'   => self::get_filter_key( 'ptype', self::catalog_pattern_types(), '' ),
			'invalid' => self::get_filter_key( 'invalid', array( '1' ), '' ),
			's'       => self::get_filter_text( 's', 190 ),
		);
	}

	/**
	 * Prepared WHERE clause for the tracker catalogue.
	 *
	 * The "needs attention" filter is expressed in SQL for the part MySQL can decide
	 * (a dot-less short host pattern) and widened to every regex row, which PHP then
	 * re-validates one by one in render_tab_catalog().
	 *
	 * @param array $f Filter state.
	 * @return string
	 */
	protected static function catalog_where( array $f ) {
		global $wpdb;
		$clauses = array();
		$values  = array();
		if ( '' !== $f['cat'] ) {
			$clauses[] = 'category = %s';
			$values[]  = $f['cat'];
		}
		if ( '' !== $f['target'] ) {
			$clauses[] = 'match_target = %s';
			$values[]  = $f['target'];
		}
		if ( '' !== $f['ptype'] ) {
			$clauses[] = 'pattern_type = %s';
			$values[]  = $f['ptype'];
		}
		if ( '' !== $f['s'] ) {
			$like      = '%' . $wpdb->esc_like( $f['s'] ) . '%';
			$clauses[] = '( pattern LIKE %s OR name LIKE %s OR vendor LIKE %s )';
			$values[]  = $like;
			$values[]  = $like;
			$values[]  = $like;
		}
		if ( '1' === $f['invalid'] ) {
			$clauses[] = "( pattern_type = 'regex' OR ( match_target = 'url' AND pattern_type = 'host' AND ( CHAR_LENGTH(pattern) < 6 OR pattern NOT LIKE %s ) ) )";
			$values[]  = '%.%';
		}
		return self::build_where( $clauses, $values );
	}

	/**
	 * Why a catalogue rule can never fire, or '' when it is fine.
	 *
	 * @param array $row Catalogue row.
	 * @return string Translated explanation.
	 */
	protected static function catalog_row_problem( array $row ) {
		$pattern = isset( $row['pattern'] ) ? (string) $row['pattern'] : '';
		$type    = isset( $row['pattern_type'] ) ? (string) $row['pattern_type'] : 'host';
		$target  = isset( $row['match_target'] ) && '' !== (string) $row['match_target'] ? (string) $row['match_target'] : 'url';

		if ( '' === (string) preg_replace( '/[\s\p{C}\p{Z}]+/u', '', $pattern ) ) {
			return __( 'the pattern is empty or invisible, so the rule matches nothing', 'ow-consent' );
		}
		if ( 'regex' === $type && ! OWCO_Core::validate_regex_pattern( $pattern ) ) {
			return __( 'this regular expression does not compile, or backtracks catastrophically — the matcher skips it at runtime', 'ow-consent' );
		}
		if ( 'url' === $target && 'host' === $type && ( strlen( $pattern ) < 6 || strpos( $pattern, '.' ) === false ) ) {
			return __( 'too short and dot-less for a URL: it would match unrelated file names, so the matcher refuses it. Switch it to the "Cookie name" target or give the real host.', 'ow-consent' );
		}
		$category = isset( $row['category'] ) ? (string) $row['category'] : '';
		if ( '' !== $category && ! in_array( $category, OWCO_Core::categories(), true ) ) {
			return __( 'the category no longer exists, so consent can never be granted for it', 'ow-consent' );
		}
		return '';
	}

	/**
	 * DSAR request types, slug => translated short label.
	 *
	 * @return array<string,string>
	 */
	protected static function dsar_type_map() {
		return array(
			'access'        => __( 'Access', 'ow-consent' ),
			'rectification' => __( 'Rectification', 'ow-consent' ),
			'erasure'       => __( 'Erasure', 'ow-consent' ),
			'portability'   => __( 'Portability', 'ow-consent' ),
			'restrict'      => __( 'Restriction', 'ow-consent' ),
			'object'        => __( 'Objection', 'ow-consent' ),
			'optout'        => __( 'Opt-out', 'ow-consent' ),
			'withdraw'      => __( 'Withdrawal', 'ow-consent' ),
		);
	}

	/* =================================================================
	 * EXPORTS
	 * ============================================================== */

	/**
	 * Stream one of the four listings as CSV or JSON.
	 *
	 * Reached only through handle_save(), which has already checked `manage_options` and
	 * the nonce. Every field goes through csv_cell(), so a hostile page URL or cookie name
	 * cannot become a live formula in the compliance officer's spreadsheet.
	 *
	 * @param string $what 'ledger', 'dsar', 'scanner' or 'catalog'.
	 * @return void Exits on success.
	 */
	protected static function handle_export( $what ) {
		$format = self::get_filter_key( 'owco_format', array( 'csv', 'json' ), 'csv' );
		$stamp  = gmdate( 'Ymd-His' );

		if ( 'ledger' === $what ) {
			if ( ! self::table_ready( OWCO_TABLE_LEDGER ) ) { return; }
			$table   = OWCO_TABLE_LEDGER;
			$where   = self::ledger_where( self::ledger_filters() );
			$columns = array( 'id', 'created_at', 'visitor_token', 'event', 'categories', 'profile', 'source', 'ip_pseudonymous', 'page_url', 'prev_hash', 'row_hash', 'policies_hash', 'banner_revision', 'plugin_version' );
			$sql     = self::select_clause( $table, $columns ) . $where . ' ORDER BY id ASC';
			$mapper  = array( __CLASS__, 'map_ledger_export_row' );
			if ( 'json' === $format ) {
				self::stream_json( 'owco-ledger-' . $stamp . '.json', self::ledger_export_meta(), $sql, $mapper );
			}
			self::stream_csv( 'owco-ledger-' . $stamp . '.csv', self::ledger_export_headers(), $sql, $mapper );
			return;
		}

		if ( 'dsar' === $what ) {
			if ( ! self::table_ready( OWCO_TABLE_DSAR ) ) { return; }
			$table   = OWCO_TABLE_DSAR;
			$where   = self::dsar_where( self::dsar_filters() );
			// verification_token / token_hash are identity credentials and never leave the table.
			$columns = array( 'id', 'created_at', 'request_type', 'subject_email', 'status', 'verified_at', 'due_at', 'handled_at', 'handled_by_user_id', 'response_notes' );
			$sql     = self::select_clause( $table, $columns ) . $where . ' ORDER BY id ASC';
			$mapper  = array( __CLASS__, 'map_dsar_export_row' );
			if ( 'json' === $format ) {
				self::stream_json( 'owco-dsar-' . $stamp . '.json', array( 'format' => 'ow-consent/dsar-register', 'generated_at' => gmdate( 'c' ) ), $sql, $mapper );
			}
			self::stream_csv( 'owco-dsar-' . $stamp . '.csv', array(
				__( 'ID', 'ow-consent' ),
				__( 'Received (UTC)', 'ow-consent' ),
				__( 'Type', 'ow-consent' ),
				__( 'Email', 'ow-consent' ),
				__( 'Status', 'ow-consent' ),
				__( 'Verified (UTC)', 'ow-consent' ),
				__( 'Deadline (UTC)', 'ow-consent' ),
				__( 'Handled (UTC)', 'ow-consent' ),
				__( 'Handled by (user ID)', 'ow-consent' ),
				__( 'Response notes', 'ow-consent' ),
			), $sql, $mapper );
			return;
		}

		if ( 'scanner' === $what ) {
			if ( ! self::table_ready( OWCO_TABLE_SCANNER ) ) { return; }
			$table   = OWCO_TABLE_SCANNER;
			$where   = self::scanner_where( self::scanner_filters() );
			$columns = array( 'id', 'discovered_at', 'kind', 'name', 'domain', 'category_guess', 'confirmed', 'vendor', 'page_url' );
			$sql     = self::select_clause( $table, $columns ) . $where . ' ORDER BY id ASC';
			$mapper  = array( __CLASS__, 'map_scanner_export_row' );
			if ( 'json' === $format ) {
				self::stream_json( 'owco-trackers-' . $stamp . '.json', array( 'format' => 'ow-consent/scanner-findings', 'generated_at' => gmdate( 'c' ) ), $sql, $mapper );
			}
			self::stream_csv( 'owco-trackers-' . $stamp . '.csv', array(
				__( 'ID', 'ow-consent' ),
				__( 'Discovered', 'ow-consent' ),
				__( 'Type', 'ow-consent' ),
				__( 'Name', 'ow-consent' ),
				__( 'Domain', 'ow-consent' ),
				__( 'Category', 'ow-consent' ),
				__( 'Confirmed', 'ow-consent' ),
				__( 'Vendor', 'ow-consent' ),
				__( 'Seen on', 'ow-consent' ),
			), $sql, $mapper );
			return;
		}

		if ( 'catalog' === $what ) {
			if ( ! self::table_ready( OWCO_TABLE_SCRIPTS ) ) { return; }
			$table   = OWCO_TABLE_SCRIPTS;
			$where   = self::catalog_where( self::catalog_filters() );
			$columns = array( 'id', 'pattern', 'pattern_type', 'match_target', 'name', 'vendor', 'category', 'privacy_policy_url' );
			$sql     = self::select_clause( $table, $columns ) . $where . ' ORDER BY id ASC';
			$mapper  = array( __CLASS__, 'map_catalog_export_row' );
			if ( 'json' === $format ) {
				self::stream_json( 'owco-catalog-' . $stamp . '.json', array( 'format' => 'ow-consent/tracker-catalog', 'generated_at' => gmdate( 'c' ) ), $sql, $mapper );
			}
			self::stream_csv( 'owco-catalog-' . $stamp . '.csv', array(
				__( 'ID', 'ow-consent' ),
				__( 'Pattern', 'ow-consent' ),
				__( 'Pattern type', 'ow-consent' ),
				__( 'Matched against', 'ow-consent' ),
				__( 'Name', 'ow-consent' ),
				__( 'Vendor', 'ow-consent' ),
				__( 'Category', 'ow-consent' ),
				__( 'Privacy policy', 'ow-consent' ),
			), $sql, $mapper );
		}
	}

	/**
	 * Column headers of the ledger export.
	 *
	 * @return array<int,string>
	 */
	protected static function ledger_export_headers() {
		return array(
			__( 'ID', 'ow-consent' ),
			__( 'Date (UTC)', 'ow-consent' ),
			__( 'Visitor token', 'ow-consent' ),
			__( 'Event', 'ow-consent' ),
			__( 'Categories granted', 'ow-consent' ),
			__( 'Profile', 'ow-consent' ),
			__( 'Source', 'ow-consent' ),
			__( 'Pseudonymised IP', 'ow-consent' ),
			__( 'Page', 'ow-consent' ),
			__( 'Previous hash', 'ow-consent' ),
			__( 'Row hash', 'ow-consent' ),
			__( 'Policies hash', 'ow-consent' ),
			__( 'Banner revision', 'ow-consent' ),
			__( 'Plugin version', 'ow-consent' ),
		);
	}

	/**
	 * Envelope of the JSON ledger export: what a supervisory authority needs to re-verify
	 * the extract without the rest of the chain.
	 *
	 * @return array<string,mixed>
	 */
	protected static function ledger_export_meta() {
		$algo = (string) OWCO_Core::setting( 'ledger_hash_algo' );
		if ( '' === $algo ) { $algo = 'sha256'; }
		$key_source = '';
		if ( class_exists( 'OWCO_Consent' ) && method_exists( 'OWCO_Consent', 'ledger_key_source' ) ) {
			$key_source = (string) OWCO_Consent::ledger_key_source();
		}
		return array(
			'format'         => 'ow-consent/consent-ledger',
			'generated_at'   => gmdate( 'c' ),
			'site'           => home_url( '/' ),
			'plugin_version' => defined( 'OWCO_VERSION' ) ? OWCO_VERSION : '',
			'chain'          => array(
				'scheme'     => 'HMAC-' . strtoupper( $algo ),
				'key_source' => $key_source,
				'note'       => 'Each row_hash is an HMAC over the row fields plus the previous row_hash.',
			),
		);
	}

	/**
	 * @param array $r Ledger row.
	 * @return array<int,mixed>
	 */
	protected static function map_ledger_export_row( $r ) {
		return array(
			isset( $r['id'] ) ? (int) $r['id'] : 0,
			isset( $r['created_at'] ) ? $r['created_at'] : '',
			isset( $r['visitor_token'] ) ? $r['visitor_token'] : '',
			isset( $r['event'] ) ? $r['event'] : '',
			isset( $r['categories'] ) ? $r['categories'] : '',
			isset( $r['profile'] ) ? $r['profile'] : '',
			isset( $r['source'] ) ? $r['source'] : '',
			isset( $r['ip_pseudonymous'] ) ? $r['ip_pseudonymous'] : '',
			isset( $r['page_url'] ) ? $r['page_url'] : '',
			isset( $r['prev_hash'] ) ? $r['prev_hash'] : '',
			isset( $r['row_hash'] ) ? $r['row_hash'] : '',
			isset( $r['policies_hash'] ) ? $r['policies_hash'] : '',
			isset( $r['banner_revision'] ) ? $r['banner_revision'] : '',
			isset( $r['plugin_version'] ) ? $r['plugin_version'] : '',
		);
	}

	/**
	 * @param array $r DSAR row.
	 * @return array<int,mixed>
	 */
	protected static function map_dsar_export_row( $r ) {
		return array(
			isset( $r['id'] ) ? (int) $r['id'] : 0,
			isset( $r['created_at'] ) ? $r['created_at'] : '',
			isset( $r['request_type'] ) ? $r['request_type'] : '',
			isset( $r['subject_email'] ) ? $r['subject_email'] : '',
			isset( $r['status'] ) ? $r['status'] : '',
			isset( $r['verified_at'] ) ? $r['verified_at'] : '',
			isset( $r['due_at'] ) ? $r['due_at'] : '',
			isset( $r['handled_at'] ) ? $r['handled_at'] : '',
			isset( $r['handled_by_user_id'] ) ? (int) $r['handled_by_user_id'] : 0,
			isset( $r['response_notes'] ) ? $r['response_notes'] : '',
		);
	}

	/**
	 * @param array $r Scanner row.
	 * @return array<int,mixed>
	 */
	protected static function map_scanner_export_row( $r ) {
		return array(
			isset( $r['id'] ) ? (int) $r['id'] : 0,
			isset( $r['discovered_at'] ) ? $r['discovered_at'] : '',
			isset( $r['kind'] ) ? $r['kind'] : '',
			isset( $r['name'] ) ? $r['name'] : '',
			isset( $r['domain'] ) ? $r['domain'] : '',
			isset( $r['category_guess'] ) ? $r['category_guess'] : '',
			! empty( $r['confirmed'] ) ? 1 : 0,
			isset( $r['vendor'] ) ? $r['vendor'] : '',
			isset( $r['page_url'] ) ? $r['page_url'] : '',
		);
	}

	/**
	 * @param array $r Catalogue row.
	 * @return array<int,mixed>
	 */
	protected static function map_catalog_export_row( $r ) {
		return array(
			isset( $r['id'] ) ? (int) $r['id'] : 0,
			isset( $r['pattern'] ) ? $r['pattern'] : '',
			isset( $r['pattern_type'] ) ? $r['pattern_type'] : '',
			isset( $r['match_target'] ) ? $r['match_target'] : '',
			isset( $r['name'] ) ? $r['name'] : '',
			isset( $r['vendor'] ) ? $r['vendor'] : '',
			isset( $r['category'] ) ? $r['category'] : '',
			isset( $r['privacy_policy_url'] ) ? $r['privacy_policy_url'] : '',
		);
	}

	/**
	 * Nonced URL of one of the streaming exports.
	 *
	 * @param string $what Export slug: ledger, dsar, scanner or catalog.
	 * @param string $format 'csv' or 'json'.
	 * @param array  $args Filter arguments to reproduce in the export.
	 * @return string
	 */
	protected static function export_url( $what, $format = 'csv', array $args = array() ) {
		$args = array_merge( $args, array(
			'page'          => self::MENU_SLUG,
			'owco_action'    => 'export_' . (string) $what,
			'owco_format'    => ( 'json' === $format ) ? 'json' : 'csv',
		) );
		return wp_nonce_url(
			add_query_arg( $args, admin_url( 'admin.php' ) ),
			self::SAVE_NONCE_ACTION,
			'_owco_nonce_url'
		);
	}

	/**
	 * Neutralise spreadsheet formula injection in an exported field.
	 *
	 * A cell whose first character is `=`, `+`, `-`, `@`, a tab or a carriage return is
	 * executed as a formula by Excel, LibreOffice and Google Sheets. Since the ledger and
	 * the scanner store third-party strings (page URLs, cookie names, vendor names), a
	 * hostile value could otherwise run when the compliance officer opens the export.
	 * FIX-CONTRACT §6.
	 *
	 * @param mixed $value Raw field value.
	 * @return string
	 */
	protected static function csv_cell( $value ) {
		if ( is_array( $value ) || is_object( $value ) ) {
			$encoded = wp_json_encode( $value );
			$value   = is_string( $encoded ) ? $encoded : '';
		}
		if ( null === $value || false === $value ) { $value = ''; }
		if ( true === $value ) { $value = '1'; }
		$value = (string) $value;
		if ( '' === $value ) { return ''; }
		if ( strpos( "=+-@\t\r", $value[0] ) !== false ) {
			return "'" . $value;
		}
		return $value;
	}

	/**
	 * Recursively apply csv_cell() to a JSON export, so a downstream "save as CSV" is safe too.
	 *
	 * @param mixed $value Value to sanitise.
	 * @return mixed
	 */
	protected static function json_cell( $value ) {
		if ( is_array( $value ) ) {
			$out = array();
			foreach ( $value as $k => $v ) {
				$out[ $k ] = self::json_cell( $v );
			}
			return $out;
		}
		if ( is_int( $value ) || is_float( $value ) || is_bool( $value ) || null === $value ) {
			return $value;
		}
		return self::csv_cell( $value );
	}

	/**
	 * Send download headers and drop any buffering, so the body is streamed row by row
	 * instead of assembled in memory (a 200 000-row ledger does not fit in the PHP limit).
	 *
	 * @param string $filename Suggested file name.
	 * @param string $mime     MIME type.
	 * @return void
	 */
	protected static function start_download( $filename, $mime ) {
		nocache_headers();
		$guard = 0;
		while ( ob_get_level() > 0 && $guard < 20 ) {
			if ( ! @ob_end_clean() ) { break; } // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- an unremovable buffer (zlib.output_compression) must not abort the download.
			$guard++;
		}
		header( 'Content-Type: ' . $mime . '; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename="' . $filename . '"' );
		header( 'X-Content-Type-Options: nosniff' );
	}

	/**
	 * Stream a query as CSV, page by page, with formula-injection-safe cells.
	 *
	 * @param string   $filename Suggested file name.
	 * @param array    $headers  Column headers (already translated).
	 * @param string   $sql      Prepared SQL WITHOUT the LIMIT clause; must be safe to append to.
	 * @param callable $mapper   Maps one row (associative) to a flat array of cells.
	 * @return void Exits.
	 */
	protected static function stream_csv( $filename, array $headers, $sql, $mapper ) {
		global $wpdb;

		// Headers are already out: a printed database error would land inside the file.
		$wpdb->suppress_errors( true );
		self::start_download( $filename, 'text/csv' );

		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- writing to the PHP output stream is the only way to stream a download; WP_Filesystem cannot target php://output.
		$out = fopen( 'php://output', 'w' );
		if ( ! $out ) { exit; }

		// UTF-8 BOM so Excel opens accented vendor names correctly.
		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- php://output stream, see above.
		fwrite( $out, "\xEF\xBB\xBF" );
		fputcsv( $out, $headers );

		$offset = 0;
		$chunk  = 500;
		do {
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $sql is assembled by the only caller, handle_export(): a SELECT head whose table and columns select_clause() bound as %i, plus a WHERE clause build_where() already prepared, which must not be rescanned. Only the numeric LIMIT is appended here, itself prepared. An export must read the table as it is now.
			$rows = $wpdb->get_results( $sql . $wpdb->prepare( ' LIMIT %d OFFSET %d', $chunk, $offset ), ARRAY_A );
			if ( empty( $rows ) ) { break; }
			foreach ( $rows as $row ) {
				$cells = call_user_func( $mapper, $row );
				fputcsv( $out, array_map( array( __CLASS__, 'csv_cell' ), (array) $cells ) );
			}
			$offset += $chunk;
			// Long exports must not die on max_execution_time halfway through a file.
			// phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged,WordPress.PHP.NoSilencedErrors.Discouraged -- streaming an arbitrarily large table needs more than the default limit; the call is disabled on some hosts and its failure is not actionable.
			@set_time_limit( 60 );
		} while ( count( $rows ) === $chunk );

		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- php://output stream, see above.
		fclose( $out );
		exit;
	}

	/**
	 * Stream a query as a JSON array, page by page.
	 *
	 * @param string   $filename Suggested file name.
	 * @param array    $meta     Envelope metadata.
	 * @param string   $sql      Prepared SQL WITHOUT the LIMIT clause.
	 * @param callable $mapper   Maps one row (associative) to an exportable array.
	 * @return void Exits.
	 */
	protected static function stream_json( $filename, array $meta, $sql, $mapper ) {
		global $wpdb;

		// Headers are already out: a printed database error would land inside the file.
		$wpdb->suppress_errors( true );
		self::start_download( $filename, 'application/json' );

		$envelope = wp_json_encode( $meta );
		$prefix   = is_string( $envelope ) ? rtrim( $envelope, '}' ) . ',"rows":[' : '{"rows":[';
		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSON download body produced by wp_json_encode(); HTML escaping would corrupt the file.
		echo $prefix;

		$offset = 0;
		$chunk  = 500;
		$first  = true;
		do {
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $sql is assembled by the only caller, handle_export(): a SELECT head whose table and columns select_clause() bound as %i, plus a WHERE clause build_where() already prepared, which must not be rescanned. Only the numeric LIMIT is appended here, itself prepared. An export must read the table as it is now.
			$rows = $wpdb->get_results( $sql . $wpdb->prepare( ' LIMIT %d OFFSET %d', $chunk, $offset ), ARRAY_A );
			if ( empty( $rows ) ) { break; }
			foreach ( $rows as $row ) {
				$json = wp_json_encode( self::json_cell( call_user_func( $mapper, $row ) ) );
				if ( ! is_string( $json ) ) { continue; }
				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSON download body produced by wp_json_encode(); HTML escaping would corrupt the file.
				echo ( $first ? '' : ',' ) . $json;
				$first = false;
			}
			$offset += $chunk;
			// phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged,WordPress.PHP.NoSilencedErrors.Discouraged -- streaming an arbitrarily large table needs more than the default limit; the call is disabled on some hosts and its failure is not actionable.
			@set_time_limit( 60 );
		} while ( count( $rows ) === $chunk );

		echo ']}';
		exit;
	}

	/**
	 * Store a one-shot admin message for the screen we are about to redirect to.
	 *
	 * @param string $type    'success' or 'error'.
	 * @param string $message Translated message.
	 * @return void
	 */
	protected static function set_screen_result( $type, $message ) {
		set_transient(
			'owco_admin_screen_result',
			array( 'type' => ( 'error' === $type ? 'error' : 'success' ), 'message' => (string) $message ),
			60
		);
	}

	/**
	 * Render and forget the message stored by set_screen_result().
	 *
	 * @return void
	 */
	protected static function render_screen_result() {
		$result = get_transient( 'owco_admin_screen_result' );
		if ( ! is_array( $result ) || empty( $result['message'] ) ) { return; }
		delete_transient( 'owco_admin_screen_result' );
		$class = ( isset( $result['type'] ) && 'error' === $result['type'] ) ? 'bad' : 'ok';
		?>
		<div class="owco-banner-status <?php echo esc_attr( $class ); ?>" style="margin-bottom:14px;">
			<?php echo esc_html( 'bad' === $class ? '✗' : '✓' ); ?>
			<?php echo esc_html( (string) $result['message'] ); ?>
		</div>
		<?php
	}

	/* =================================================================
	 * FIELD HELPERS
	 * ============================================================== */

	/**
	 * Print the italic help line under a control, when one was provided.
	 *
	 * @param string $help Already-translated help text (plain text, escaped here).
	 * @return void
	 */
	protected static function field_help( $help ) {
		$help = (string) $help;
		if ( '' === $help ) { return; }
		echo '<p class="owco-help">' . esc_html( $help ) . '</p>';
	}

	/**
	 * Translated default for the settings whose empty value resolves to a translation.
	 *
	 * Only the banner copy and the category labels behave that way: OWCO_Core::texts() and
	 * category_label()/category_description() return the translated string whenever the
	 * stored value is empty or still equals the untranslated English source. Every other
	 * key keeps its literal default, so this answers '' for them and the field stays
	 * bound to the effective value.
	 *
	 * @param string $key Setting key.
	 * @return string Translated default, or '' when the key has no such fallback.
	 */
	protected static function field_i18n_default( $key ) {
		$key   = (string) $key;
		$slots = array(
			'text_title'            => 'title',
			'text_message'          => 'message',
			'text_accept_all'       => 'accept_all',
			'text_reject_all'       => 'reject_all',
			'text_preferences'      => 'preferences',
			'text_save'             => 'save',
			'floating_button_label' => 'floating_label',
		);
		if ( isset( $slots[ $key ] ) ) {
			$texts = (array) OWCO_Core::texts();
			return isset( $texts[ $slots[ $key ] ] ) ? (string) $texts[ $slots[ $key ] ] : '';
		}
		foreach ( OWCO_Core::categories() as $slug ) {
			if ( 'cat_' . $slug . '_label' === $key ) {
				return (string) OWCO_Core::category_label( $slug );
			}
			if ( 'cat_' . $slug . '_desc' === $key ) {
				return (string) OWCO_Core::category_description( $slug );
			}
		}
		return '';
	}

	/**
	 * What to show in a field that has a translated default: the administrator's own
	 * override, or nothing.
	 *
	 * Binding those fields to OWCO_Core::setting() printed the untranslated English source
	 * into the input, so a French administrator who saved the form froze English into
	 * wp_options for every locale — and the help text promising "leave empty to use the
	 * translated default" described a field that was never empty. The value therefore
	 * comes from the stored option, and a stored value that still equals the shipped
	 * English default counts as "not overridden", exactly as OWCO_Core reads it.
	 *
	 * @param string $key Setting key.
	 * @return string
	 */
	protected static function field_stored_override( $key ) {
		$stored = OWCO_Core::stored_setting( $key, '' );
		$stored = is_scalar( $stored ) ? (string) $stored : '';
		if ( '' === $stored ) { return ''; }

		$defaults = OWCO_Core::default_settings();
		$english  = isset( $defaults[ $key ] ) && is_scalar( $defaults[ $key ] ) ? (string) $defaults[ $key ] : '';
		return ( '' !== $english && $stored === $english ) ? '' : $stored;
	}

	/**
	 * Checkbox bound to a boolean setting.
	 *
	 * The hidden `0` sibling is what tells save_settings_from_post() that this key belongs
	 * to the submitted form: a bool missing from the POST means "another tab", never
	 * "unchecked".
	 *
	 * @param string $key   Setting key.
	 * @param string $label Translated label.
	 * @param string $help  Optional translated help text.
	 * @return void
	 */
	protected static function field_bool( $key, $label, $help = '' ) {
		$v = (bool) OWCO_Core::setting( $key );
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<input type="hidden" name="owco[<?php echo esc_attr( $key ); ?>]" value="0">
				<label class="switch">
					<input type="checkbox" id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]" value="1" <?php checked( $v, true ); ?>>
					<?php echo $v ? esc_html__( 'Enabled', 'ow-consent' ) : esc_html__( 'Enable', 'ow-consent' ); ?>
				</label>
				<?php self::field_help( $help ); ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Single-line input bound to a string setting.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Translated label.
	 * @param string $help  Optional translated help text.
	 * @param string $type  HTML input type: text (default), email or url.
	 * @return void
	 */
	protected static function field_text( $key, $label, $help = '', $type = 'text' ) {
		$type        = in_array( $type, array( 'text', 'email', 'url', 'tel' ), true ) ? $type : 'text';
		$placeholder = self::field_i18n_default( $key );
		if ( '' !== $placeholder ) {
			$v = self::field_stored_override( $key );
		} else {
			$v           = OWCO_Core::setting( $key );
			$v           = is_scalar( $v ) ? (string) $v : '';
			$placeholder = ( 'url' === $type ) ? 'https://' : '';
		}
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<input type="<?php echo esc_attr( $type ); ?>" id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]" value="<?php echo esc_attr( $v ); ?>" class="regular-text"<?php echo '' === $placeholder ? '' : ' placeholder="' . esc_attr( $placeholder ) . '"'; ?>>
				<?php self::field_help( $help ); ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Number input bound to an integer setting.
	 *
	 * @param string   $key   Setting key.
	 * @param string   $label Translated label.
	 * @param string   $help  Optional translated help text.
	 * @param int|null $min   Optional minimum accepted by OWCO_Core::sanitize_setting().
	 * @param int|null $max   Optional maximum accepted by OWCO_Core::sanitize_setting().
	 * @return void
	 */
	protected static function field_int( $key, $label, $help = '', $min = null, $max = null ) {
		$v = (int) OWCO_Core::setting( $key );
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<input type="number" step="1" id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]" value="<?php echo esc_attr( $v ); ?>" class="small-text"
					<?php echo null === $min ? '' : ' min="' . esc_attr( (int) $min ) . '"'; ?>
					<?php echo null === $max ? '' : ' max="' . esc_attr( (int) $max ) . '"'; ?>>
				<?php self::field_help( $help ); ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Comma-separated list of small positive integers, bound to an array setting.
	 *
	 * OWCO_Core::sanitize_setting() splits the submitted string on commas/whitespace and
	 * keeps the values in range, so a plain text input is enough here.
	 *
	 * @param string $key   Setting key holding an array of ints.
	 * @param string $label Translated label.
	 * @param string $help  Optional translated help text.
	 * @return void
	 */
	protected static function field_int_list( $key, $label, $help = '' ) {
		$v    = OWCO_Core::setting( $key );
		$list = array();
		foreach ( (array) $v as $item ) {
			if ( is_scalar( $item ) ) {
				$list[] = (int) $item;
			}
		}
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<input type="text" id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]" value="<?php echo esc_attr( implode( ', ', $list ) ); ?>" class="regular-text" inputmode="numeric">
				<?php self::field_help( $help ); ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Multi-line input bound to a textarea setting.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Translated label.
	 * @param string $help  Optional translated help text.
	 * @return void
	 */
	protected static function field_textarea( $key, $label, $help = '' ) {
		$placeholder = self::field_i18n_default( $key );
		if ( '' !== $placeholder ) {
			$v = self::field_stored_override( $key );
		} else {
			$v = OWCO_Core::setting( $key );
			$v = is_scalar( $v ) ? (string) $v : '';
		}
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<textarea id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]" rows="3" class="large-text"<?php echo '' === $placeholder ? '' : ' placeholder="' . esc_attr( $placeholder ) . '"'; ?>><?php echo esc_textarea( $v ); ?></textarea>
				<?php self::field_help( $help ); ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Page picker : dropdown of all published pages + a "Generate now" inline button
	 * for the matching policy type (privacy_policy / cookie_policy / legal_notice).
	 * Posts the URL of the selected page into the `link_*` setting.
	 */
	protected static function field_page_picker( $key, $label, $policy_type = '' ) {
		$current_url = (string) OWCO_Core::setting( $key );
		$current_id  = $current_url ? url_to_postid( $current_url ) : 0;

		// Look for an already-generated policy of this type.
		$generated_id = 0;
		if ( $policy_type ) {
			$found = get_posts( array(
				'post_type'   => 'page',
				'post_status' => array( 'publish', 'draft', 'private' ),
				// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- postmeta is indexed on meta_key, and a taxonomy would not model "the page generated for this document type".
				'meta_key'    => '_owco_policy_type',
				// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- the pair meta_key + meta_value IS the identity of the generated page; $policy_type is one of the plugin's own document slugs, the meta_key half is indexed, the query asks for one id only, and it runs on an admin settings row.
				'meta_value'  => $policy_type,
				'numberposts' => 1,
				'fields'      => 'ids',
			) );
			$generated_id = $found ? (int) $found[0] : 0;
		}

		// All pages dropdown.
		$pages = get_pages( array( 'post_status' => 'publish,draft,private', 'sort_column' => 'post_title' ) );
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<select id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]" style="min-width:340px;" data-owco-page-picker="1">
					<option value=""><?php esc_html_e( '— No page selected —', 'ow-consent' ); ?></option>
					<?php foreach ( $pages as $p ) :
						$url = get_permalink( $p->ID );
						$is_owco = (string) get_post_meta( $p->ID, '_owco_policy_type', true ) === $policy_type;
						$badge  = $is_owco ? ' ★' : '';
						$status = $p->post_status !== 'publish' ? ' [' . $p->post_status . ']' : '';
					?>
						<option value="<?php echo esc_attr( $url ); ?>" <?php selected( $current_url, $url ); ?>>
							<?php echo esc_html( $p->post_title . $badge . $status ); ?>
						</option>
					<?php endforeach; ?>
				</select>

				<?php if ( $policy_type ) :
					$gen_url = wp_nonce_url(
						add_query_arg( array(
							'page'              => self::MENU_SLUG,
							'tab'               => 'compliance',
							'owco_action'        => 'generate_policy_inline',
							'policy_type'       => $policy_type,
						), admin_url( 'admin.php' ) ),
						self::SAVE_NONCE_ACTION,
						'_owco_nonce_url'
					);
				?>
					<?php if ( $generated_id ) : ?>
						<a href="<?php echo esc_url( get_edit_post_link( $generated_id ) ); ?>" class="button button-small" style="margin-left:6px;">
							<span aria-hidden="true">✎</span> <?php esc_html_e( 'Edit', 'ow-consent' ); ?>
						</a>
					<?php endif; ?>
					<?php if ( self::policy_type_available( $policy_type ) ) : ?>
						<a href="<?php echo esc_url( $gen_url ); ?>"
						   class="button button-secondary"
						   style="margin-left:6px;"
						   onclick="return confirm('<?php echo esc_js( $generated_id ? __( 'Regenerate the existing page? The content will be entirely replaced.', 'ow-consent' ) : __( 'Generate the page now?', 'ow-consent' ) ); ?>');">
							<span aria-hidden="true"><?php echo $generated_id ? '🔄' : '📄'; ?></span>
							<?php echo $generated_id ? esc_html__( 'Regenerate', 'ow-consent' ) : esc_html__( 'Generate', 'ow-consent' ); ?>
						</a>
					<?php else : ?>
						<p class="owco-help" style="margin-top:6px;"><?php echo esc_html( self::policy_language_gap_text() ); ?></p>
					<?php endif; ?>
				<?php endif; ?>

				<?php if ( $current_url ) : ?>
					<p class="owco-help" style="margin-top:6px;">
						<a href="<?php echo esc_url( $current_url ); ?>" target="_blank">↗ <?php echo esc_html( $current_url ); ?></a>
					</p>
				<?php endif; ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Dropdown bound to an enumerated setting.
	 *
	 * @param string $key     Setting key.
	 * @param string $label   Translated label.
	 * @param array  $options value => translated label.
	 * @param string $help    Optional translated help text.
	 * @return void
	 */
	protected static function field_select( $key, $label, array $options, $help = '' ) {
		$v = OWCO_Core::setting( $key );
		$v = is_scalar( $v ) ? (string) $v : '';
		?>
		<tr>
			<th><label for="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<select id="<?php echo esc_attr( $key ); ?>" name="owco[<?php echo esc_attr( $key ); ?>]">
					<?php foreach ( $options as $val => $lbl ) : ?>
						<option value="<?php echo esc_attr( $val ); ?>" <?php selected( $v, (string) $val ); ?>><?php echo esc_html( $lbl ); ?></option>
					<?php endforeach; ?>
				</select>
				<?php self::field_help( $help ); ?>
			</td>
		</tr>
		<?php
	}
}