@@ -2138,7 +2138,22 @@ contacting every contributor individually.
   → removed at v2.0.0 (#1123 D1). Page-tail helpers are inlined as
   self-contained vanilla JS per page (see `web/pages/admin.edit.ban.php`
   / `admin.edit.comms.php` for canonical examples); toasts go through
-  `window.SBPP.showToast` from the theme JS.
+  `window.SBPP.showToast` from the theme JS. The trailing per-row
+  `<script>LoadServerHost('SID', …)</script>` echo on the Add Admin
+  form (`admin.admins.php`) and the per-group
+  `<script>LoadServerHostPlayersList('<sids>', …)</script>` echo on
+  the Server Groups list (`admin.groups.php`) survived the v2.0
+  cutover and raised one `ReferenceError` per server / per server
+  group on every page load with no visible effect (the static `<span
+  id="saSID">IP:port</span>` fallback / the literal "Servers populate
+  via the legacy LoadServerHostPlayersList hook." placeholder masked
+  the symptom). Both went at #1404 along with the orphan
+  `AdminAdminsAddView::server_script` ctor param and the
+  `<div id="servers_{gid}">` hydration slot; `DeadJsCallSitesTest` is
+  the per-file forbidden-substring gate so a fork pasting back the
+  v1.x shape gets caught at PR time. Hydration follow-ups tracked at
+  #1405 (Add Admin per-server access list) / #1406 (Server Groups
+  per-group server cards).
 - `onclick="if (typeof <Helper> === 'function') <Helper>(...)"`
   legacy-helper presence guards in templates (the v1.x sourcebans.js
   defensiveness pattern that survived the #1123 D1 deletion of the
@@ -2825,6 +2840,7 @@ contacting every contributor individually.
 | Action -> permission lock              | `web/tests/api/PermissionMatrixTest.php`                 |
 | Trap PHP 8.1 null-into-scalar deprecations at runtime (the bits PHPStan can't see) | `web/tests/integration/Php82DeprecationsTest.php` (#1273) — process-isolated render harness with a stub Smarty + `set_error_handler` that promotes `E_DEPRECATED` / `E_USER_DEPRECATED` to `\ErrorException`. Mirrors the LostPasswordChromeTest stub-Smarty pattern; each test method runs in a separate process because the page handlers declare top-level helpers (`setPostKey()` etc.) that PHP can't redeclare in one process. Add a marquee route here whenever a new high-traffic page handler ships, especially if it reads nullable `:prefix_*` columns or `$_POST` / `$_GET` lookups. |
 | Pin the "every `:name` PDO placeholder needs as many `bind()` calls as occurrences" contract under native prepares | `web/tests/integration/SrvAdminsPdoParamTest.php` (#1314) — two methods. `testReusedNamedPlaceholderUnderNativePreparesIsRejected` issues a tiny `SELECT 1 ... WHERE aid = :sid OR aid = :sid` against `Sbpp\Db\Database` with one `bind()` and asserts it throws `HY093`; this is the contract pin (also a regression guard if anyone re-flips `EMULATE_PREPARES` back to `true`). `testAdminSrvadminsPageRendersWithoutPdoException` is the page-level regression guard for the actual #1314 fatal — process-isolated `require` of `pages/admin.srvadmins.php` with `?id=0` asserting no `PDOException` escapes. Mirrors the Php82DeprecationsTest stub-Smarty + process-isolation shape. |
+| Pin "dead v1.x JS call sites + their server-side feeders stay deleted" (the `<script>LoadServerHost(...)</script>` / `$data['unban_link']` / `$info['popup']` shapes the v2.0.0 `sourcebans.js` cutover left without a JS landing site) | `web/tests/integration/DeadJsCallSitesTest.php` (#1404) — three methods, 12 assertions. Per-file forbidden-substring map (`page.banlist.php` / `page.commslist.php` / `page.home.php` / `admin.admins.php` / `admin.groups.php`) scanned against the **comment-stripped** source of each handler via `php_strip_whitespace()`, so the cleanup's own `// #1404 — ...` explanatory comments (and pre-existing historical-context comments that name the dead helpers in passing) don't false-fire the gate. The Smarty half (`{$server_script nofilter}`, the `<div id="servers_{$group.gid}">` hydration slot, the "Servers populate via the legacy LoadServerHostPlayersList hook." placeholder copy) is pinned by `testDeadTemplateSidesStayDropped` (also comment-stripped via `{* *}`-regex). The View-DTO side (`Sbpp\View\AdminAdminsAddView::server_script` orphan property) is pinned independently by `testAdminAdminsAddViewDoesNotCarryServerScriptProperty` so the failure points at the View directly instead of cascading through SmartyTemplateRule. Pure file scanning — extends `PHPUnit\Framework\TestCase` (no DB / session / Smarty bring-up). Sister #1402 (rewire dead JS handlers) and #1403 (ShowBox→`window.SBPP.showToast` rewrite) extend the per-file forbidden-substring map as their PRs land. |
 | Add an E2E spec                        | `web/tests/e2e/specs/<smoke|flows|a11y|responsive>/...` + `web/tests/e2e/pages/...` |
 | Add a route to the screenshot gallery  | `web/tests/e2e/specs/_screenshots.spec.ts` (`ROUTES` array) |
 | Tweak mobile (<=768px) chrome layout   | `web/themes/default/css/theme.css` — see the `#1207` `@media (max-width: 768px)` blocks for the canonical shapes (icon-only topbar search, full-width drawer + scroll lock). Sub-paged admin routes (servers / mods / groups / comms / settings / admins / bans) use the `<details open>` accordion in the `#1259` `@media (min-width: 1024px)` block (sidebar inline at `<1024px`, sticky 14rem rail at `>=1024px`); see "Sub-paged admin routes" in Conventions. |
 
@@ -32,7 +32,6 @@ public function __construct(
         public readonly array $server_list,
         public readonly array $server_admin_group_list,
         public readonly array $server_group_list,
-        public readonly string $server_script,
     ) {
     }
 }
@@ -128,16 +128,23 @@
     $servers                 = $GLOBALS['PDO']->query("SELECT * FROM `:prefix_servers`")->resultset();
     $server_admin_group_list = $GLOBALS['PDO']->query("SELECT * FROM `:prefix_srvgroups`")->resultset();
     $server_group_list       = $GLOBALS['PDO']->query("SELECT * FROM `:prefix_groups` WHERE type != 3")->resultset();
-    $server_list             = [];
-    $serverscript            = "<script type=\"text/javascript\">";
+    // #1404 — the pre-fix loop also built a `$serverscript` `<script>`
+    // blob that emitted `LoadServerHost('sid', 'id', 'saSID');` per
+    // server. The `LoadServerHost` helper was deleted with
+    // `sourcebans.js` at #1123 D1, so every page load raised
+    // `ReferenceError: LoadServerHost is not defined` once per
+    // configured server with no visible effect (the `sa<SID>` <span>
+    // already renders bare `IP:port` text from `$server_list`).
+    // Hydration to per-server hostnames is the next step — tracked as
+    // a follow-up ticket; see AGENTS.md "Anti-patterns" for the
+    // matching `LoadServerHost` entry.
+    $server_list = [];
     foreach ($servers as $server) {
-        $serverscript .= "LoadServerHost('" . $server['sid'] . "', 'id', 'sa" . $server['sid'] . "');";
         $info['sid']  = $server['sid'];
         $info['ip']   = $server['ip'];
         $info['port'] = $server['port'];
         array_push($server_list, $info);
     }
-    $serverscript .= "</script>";
 
     \Sbpp\View\Renderer::render($theme, new \Sbpp\View\AdminAdminsAddView(
         // See AdminAdminsListView for why we don't splat Perms::for().
@@ -146,7 +153,6 @@
         server_list: $server_list,
         server_admin_group_list: $server_admin_group_list,
         server_group_list: $server_group_list,
-        server_script: $serverscript,
     ));
     echo '</div></div><!-- /.admin-sidebar-content + /.admin-sidebar-shell — opened by new AdminTabs(...) above -->';
     return;
 
@@ -137,12 +137,20 @@
 // ------------------------------------------------------------------
 // Server groups (`:prefix_groups` WHERE type = 3).
 //
-// `LoadServerHostPlayersList(...)` inline scripts are still emitted
-// for any third-party theme that forked the pre-v2.0.0 default and
-// renders an accordion-revealed server list per row. The shipped
-// template omits the accordion entirely (the marquee surface is the
-// master-detail flag grid above, not these server-of-servers
-// groupings) and ignores the script tags.
+// #1404 — the pre-fix loop also echoed a per-row
+// `<script>LoadServerHostPlayersList('<sids>', 'id', 'servers_<gid>')</script>`
+// blob meant to async-hydrate the per-group server list into the
+// matching `<div id="servers_{gid}">` slot. The helper was deleted
+// with `sourcebans.js` at #1123 D1, so every page load raised
+// `ReferenceError: LoadServerHostPlayersList is not defined` once
+// per server group AND left the slot showing the literal "Servers
+// populate via the legacy LoadServerHostPlayersList hook." copy
+// admin-facing forever. The echo + the slot + the placeholder copy
+// all went together; the `:prefix_servers_groups` lookup that fed
+// the SID list went too (nothing else read it). Hydration to per-
+// group server cards is the next step — tracked as a follow-up
+// ticket; see AGENTS.md "Anti-patterns" for the matching
+// `LoadServerHostPlayersList` entry.
 // ------------------------------------------------------------------
 $server_group_rows = $GLOBALS['PDO']->query("SELECT * FROM `:prefix_groups` WHERE type = '3'")->resultset();
 $server_list   = [];
@@ -155,18 +163,6 @@
     $cnt = $GLOBALS['PDO']->single();
     $row['server_count'] = (int) $cnt['cnt'];
 
-    $GLOBALS['PDO']->query("SELECT server_id FROM `:prefix_servers_groups` WHERE group_id = :gid");
-    $GLOBALS['PDO']->bind(':gid', $row['gid']);
-    $servers_in_group = $GLOBALS['PDO']->resultset();
-
-    $server_arr = "";
-    foreach ($servers_in_group as $server) {
-        $server_arr .= $server['server_id'] . ";";
-    }
-    echo "<script>";
-    echo "LoadServerHostPlayersList('" . $server_arr . "', 'id', 'servers_" . $row['gid'] . "');";
-    echo "</script>";
-
     $server_list[]   = $row;
     $server_counts[] = $row['server_count'];
 }
 
@@ -855,12 +855,15 @@ function setPostKey()
     // automatically (see the smarter-default block in admin.bans.php),
     // but we make it explicit + drop the dead fragment.
     $data['groups_link']     = CreateLinkR('<i class="fas fa-users fa-lg"></i> Show Groups', "index.php?p=admin&c=bans&section=group-ban&fid=" . urlencode($data['communityid']));
-    $data['friend_ban_link'] = CreateLinkR('<i class="fas fa-trash fa-lg"></i> Ban Friends', '#', '', '_self', false, "BanFriendsProcess('" . $data['communityid'] . "','" . $data['player'] . "');return false;");
+    // #1404 — `friend_ban_link`, `unban_link`, and `delete_link` were
+    // v1.x `CreateLinkR`-built `BanFriendsProcess` / `UnbanBan` /
+    // `RemoveBan` `<a onclick=…>` blobs; the helpers were deleted with
+    // `sourcebans.js` at #1123 D1 and no v2.0+ template ever consumed
+    // the fields. Modern unban / delete affordances live on the
+    // `.row-actions` cell in `page_bans.tpl` (`data-action="bans-unban"`
+    // / `data-action="bans-delete"`). Pinned by `DeadJsCallSitesTest`.
     $data['edit_link']       = CreateLinkR('<i class="fas fa-edit fa-lg"></i> Edit Details', "index.php?p=admin&c=bans&o=edit" . $pagelink . "&id=" . $row['ban_id'] . "&key=" . $_SESSION['banlist_postkey']);
 
-    $data['unban_link']  = CreateLinkR('<i class="fas fa-undo fa-lg"></i> Unban', "#", "", "_self", false, "UnbanBan('" . $row['ban_id'] . "', '" . $_SESSION['banlist_postkey'] . "', '" . $pagelink . "', '" . $data['player'] . "', 1, false);return false;");
-    $data['delete_link'] = CreateLinkR('<i class="fas fa-trash fa-lg"></i> Delete Ban', "#", "", "_self", false, "RemoveBan('" . $row['ban_id'] . "', '" . $_SESSION['banlist_postkey'] . "', '" . $pagelink . "', '" . $data['player'] . "', 0, false);return false;");
-
 
     $data['server_id'] = $row['ban_server'];
 
 
@@ -674,18 +674,14 @@ function setPostKey()
 
     $data['edit_link'] = CreateLinkR('<i class="fas fa-edit fa-lg"></i> Edit Details', "index.php?p=admin&c=comms&o=edit" . $pagelink . "&id=" . $row['ban_id'] . "&key=" . $_SESSION['banlist_postkey']);
 
-    switch ($data['type']) {
-        case 2:
-            $data['unban_link'] = CreateLinkR('<i class="fas fa-undo fa-lg"></i> UnGag', "#", "", "_self", false, "UnGag('" . $row['ban_id'] . "', '" . $_SESSION['banlist_postkey'] . "', '" . $pagelink . "', '" . $data['player'] . "', 1);return false;");
-            break;
-        case 1:
-            $data['unban_link'] = CreateLinkR('<i class="fas fa-undo fa-lg"></i> UnMute', "#", "", "_self", false, "UnMute('" . $row['ban_id'] . "', '" . $_SESSION['banlist_postkey'] . "', '" . $pagelink . "', '" . $data['player'] . "', 1);return false;");
-            break;
-        default:
-            break;
-    }
-
-    $data['delete_link'] = CreateLinkR('<i class="fas fa-trash fa-lg"></i> Delete Block', "#", "", "_self", false, "RemoveBlock('" . $row['ban_id'] . "', '" . $_SESSION['banlist_postkey'] . "', '" . $pagelink . "', '" . $data['player'] . "', 0);return false;");
+    // #1404 — the `unban_link` (UnGag/UnMute switch arms) and
+    // `delete_link` fields were `CreateLinkR`-built `UnGag` / `UnMute`
+    // / `RemoveBlock` `<a onclick=…>` blobs; the helpers were deleted
+    // with `sourcebans.js` at #1123 D1 and no v2.0+ template ever
+    // consumed the fields. Modern unmute / delete affordances live on
+    // the `.row-actions` cell in `page_comms.tpl`
+    // (`data-action="comms-unblock"` / `data-action="comms-delete"`).
+    // Pinned by `DeadJsCallSitesTest`.
 
     $data['server_id'] = $row['ban_server'];
 
 
@@ -66,11 +66,16 @@ function SbppServerQryHelpers(): string
     }
     $info['link_url'] = "window.location = '" . $info['search_link'] . "';";
 
-    // To print a name in the popup instead an empty string
-    if (empty($cleaned_name)) {
-        $cleaned_name = "<i>No nickname present</i>";
-    }
-    $info['popup']    = "ShowBox('Blocked player: " . $cleaned_name . "', '" . $cleaned_name . " tried to enter<br />' + document.getElementById('" . $info['server'] . "').title + '<br />at " . $info['date'] . "<br /><div align=middle><a href=" . $info['search_link'] . ">Click here for ban details.</a></div>', 'red', '', true);";
+    // #1404 — `$info['popup']` carried a `ShowBox(...)` `<script>`
+    // blob that v1.x stitched into each row's onclick. `ShowBox`
+    // was deleted with `sourcebans.js` at #1123 D1 and no v2.0+
+    // template ever consumed `{$player.popup}` (the dashboard
+    // reads `short_name` / `search_link` / `bid` / `sname` /
+    // `blocked_human` instead). The no-nickname placeholder
+    // (`<i>No nickname present</i>`) that fed the popup string
+    // went with it; the dashboard's `{if $p.short_name}…{else}no
+    // nickname{/if}` arm renders the empty-name fallback. Pinned
+    // by `DeadJsCallSitesTest`.
 
     $GLOBALS['server_qry'] .= "__sbppLoadServerHostProperty(" . (int) $row['sid'] . ", 'block_" . (int) $row['sid'] . "_$blcount', 'title');";
Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,6 @@ public function __construct(`
`32`	`32`	`public readonly array $server_list,`
`33`	`33`	`public readonly array $server_admin_group_list,`
`34`	`34`	`public readonly array $server_group_list,`
`35`		`- public readonly string $server_script,`
`36`	`35`	`) {`
`37`	`36`	`}`
`38`	`37`	`}`