Layout
B-L01
640px max-width
All backend pages use max-width:480px. padding:64px 20px 100px. Dense information layout — more data per screen, less whitespace than frontend.
Locked 07/04/26
B-L02
Fixed 44px top bar
Top bar height 44px — fixed — yttcom.net left — breadcrumb + version stamp right. Body padding-top: 56px. Never deviate.
Locked 07/01/26
B-L03
Fixed bottom tabs
Bottom tabs fixed — border-top — current page gets .here class (purple color + purple border). Body padding-bottom: 80px. Links to parent and siblings only.
Locked 07/01/26
Control Panels
B-C01
Stats strip at top
Any panel showing data uses a stats strip — key numbers visible immediately without scrolling. Format: large number above, small label below.
Established 07/04/26
B-C02
Tab-based navigation for multiple data types
When a panel shows 2+ data types, use horizontal tabs not separate pages. Active tab gets bottom border accent color. Content switches without page reload.
Established 07/04/26
B-C03
Expandable cards for detail
List items show title/key info collapsed. Tap to expand full detail. Chevron indicates expand state. Collapsed by default — scan fast, expand what you need.
Established 07/04/26
B-C04
Live search on every data list
Any list with 5+ items gets a live search bar. Results filter as you type — no submit button needed. Clear button appears when search is active.
Established 07/04/26
Database Rules
B-D01
Per-system private DB + community shared DBs
Each system has system.db in systems/[system]/data/. Community DBs (records/db/records.db, sys-backup.db) at backend/sys-com/db/. Transfers at transfers/transfers.db. Never mix private and community data.
Locked D015 07/04/26
B-D02
SQLite for structured data — JSON for flexible data
Admin/build systems use SQLite. Travel, Kitchen, Inner Life use JSON. Health, Finance, Daily Life use SQLite. Build order: Travel → Health → Finance.
Locked 07/01/26
B-D03
API pattern — token-gated PHP + SQLite
Every system DB has an api.php alongside it. GET = read (table param). POST = write (action param). Token required on every request. Deploy via WAF bypass (base64 → trash → bootstrap).
Established 07/04/26
Deploy Rules
B-S01
file_write_web.php — Admin token
All HTML/MD file writes use file_write_web.php with --data-urlencode for all three params (token, path, content). Always verify with HTTP 200 after deploy.
Locked 07/01/26
B-S02
WAF bypass for PHP files
WAF blocks PHP content via file_write_web.php. Pattern: base64 encode → write .txt to systems/trash/ → write bootstrap .php to systems/trash/ → execute GET → bootstrap self-deletes → verify.
Locked 07/01/26