edgepress 2026.9.8 → 2026.9.10

package/README.md

@@ -63,10 +63,10 @@ Posts under content/posts/ use the Markdown renderer. Themes own shared head, na
 
 The only persisted page-audit report is the accessible PDF at tools/page-check.pdf. Desktop and mobile screenshots are embedded in the PDF and removed from temporary storage afterward. Automated checks do not replace manual accessibility or legal review.
 
-The main navigation includes a Posts entry to the localized article archive. The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. Article pages show a linked table of contents and code blocks have accessible copy buttons. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
+The main navigation includes a Posts entry to the localized article archive. The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. Long articles show a floating, scroll-aware table of contents, and code blocks have accessible copy buttons. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
 
-Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The starter config uses `https://edgepress.js.gripe` and credits `toewpq`; the privacy policy still reports that its real operator name and working privacy contact must be added before publication.
+Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The starter config uses `https://edgepress.js.gripe` and credits `toewpq`. Before production use, confirm that the configured operator name identifies the responsible person or organization and complete any applicable representative or data protection officer details.
 
-Version 2026.9.8 records the eighth requested release update for September 2026. It is available as the `edgepress` npm package. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), and [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/).
+Version 2026.9.10 records the tenth requested release update for September 2026. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/), [request 9 notes](content/posts/2026-09-26-edgepress-release-2026-9-9/), and [request 10 notes](content/posts/2026-09-27-edgepress-release-2026-9-10/).
 
-This release adds Markdown video syntax for posts, locale-deduplicated chronological archives, Markdown-rendered post excerpts, date-based consent policy metadata, localized service disclosures, and separate consent-component layout checks. Optional services remain disabled until a visitor makes an explicit choice.
+This release keeps privacy choices across locale changes, adds localized page-block links, improves article tag links, loads search code only on search pages, redraws two SVG icons, and simplifies privacy wording. Optional services remain disabled until a visitor makes an explicit choice.

package/config.yml

@@ -99,6 +99,7 @@ plugins:
       #   dataCategories: { en: Describe data sent by this container., zh-CN: 填写此容器发送的数据类别。 }
       #   recipient: { en: Google LLC, zh-CN: Google LLC }
       #   retention: { en: Configure the retention period., zh-CN: 填写适用的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
       #   containerId: GTM-ABCD123
       # - id: social-pixel
       #   provider: meta-pixel
@@ -107,6 +108,7 @@ plugins:
       #   dataCategories: { en: Describe data sent by this pixel., zh-CN: 填写此像素发送的数据类别。 }
       #   recipient: { en: Meta Platforms, Inc., zh-CN: Meta Platforms, Inc. }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://www.facebook.com/privacy/policy/
       #   pixelId: "123456789012345"
     statistics:
       enabled: true
@@ -120,14 +122,15 @@ plugins:
             en: Measure page views and page-load performance after consent.
             zh-CN: 经访客同意后衡量页面浏览量和页面加载性能。
           dataCategories:
-            en: Performance timing and page-view metrics. Report dimensions can include page path, referrer, device type, browser, operating system, and country.
-            zh-CN: 性能计时和页面浏览指标。报告维度可能包括页面路径、来源页、设备类型、浏览器、操作系统和国家或地区。
+            en: Performance timing and page-view metrics; dimensions can include path, referrer, device, browser, operating system, and country. Cloudflare receives the beacon request's source IP and says it discards it at the nearest data center without storing it in core databases or logs.
+            zh-CN: 性能计时和页面浏览指标，维度可能包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 会在信标请求中接收来源 IP，并表示会在最近的数据中心将其丢弃，不保存到核心数据库或日志中。
           recipient:
             en: Cloudflare, Inc.
             zh-CN: Cloudflare, Inc.
           retention:
             en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard history is available for 6 months.
             zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
+          privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
           token: "8347d72ba9f84e6783bf441e7832a80e"
       # Examples use public provider IDs only.
       # - id: primary-analytics
@@ -137,6 +140,7 @@ plugins:
       #   dataCategories: { en: Describe the data processed by this property., zh-CN: 填写此媒体资源处理的数据类别。 }
       #   recipient: { en: Google LLC, zh-CN: Google LLC }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
       #   measurementId: G-ABC12345
       # - id: edge-analytics
       #   provider: cloudflare-web-analytics
@@ -145,6 +149,7 @@ plugins:
       #   dataCategories: { en: Describe the data processed by this site., zh-CN: 填写此站点处理的数据类别。 }
       #   recipient: { en: Cloudflare, Inc., zh-CN: Cloudflare, Inc. }
       #   retention: { en: Configure the retention period., zh-CN: 填写数据保留期限。 }
+      #   privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
       #   token: 01234567-89ab-cdef-0123-456789abcdef
       # - id: baidu-analytics
       #   provider: baidu-tongji
@@ -153,6 +158,7 @@ plugins:
       #   dataCategories: { en: Describe data sent to this site ID., zh-CN: 填写此站点编号接收的数据类别。 }
       #   recipient: { en: Baidu, Inc., zh-CN: 百度 }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://privacy.baidu.com/policy.html
       #   siteId: abcdef0123456789abcdef01
     advertising:
       enabled: true
@@ -165,6 +171,7 @@ plugins:
       #   dataCategories: { en: Describe the data processed for ad delivery., zh-CN: 填写广告投放处理的数据类别。 }
       #   recipient: { en: Google LLC, zh-CN: Google LLC }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
       #   clientId: ca-pub-1234567890123456
     captcha:
       enabled: true
@@ -177,6 +184,7 @@ plugins:
       #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
       #   recipient: { en: Cloudflare, Inc., zh-CN: Cloudflare, Inc. }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://www.cloudflare.com/privacypolicy/
       #   siteKey: 0x4AAAAAAABBBBBBBBCCCCCCDDDD
       # - id: signup-form-check
       #   provider: google-recaptcha
@@ -185,6 +193,7 @@ plugins:
       #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
       #   recipient: { en: Google LLC, zh-CN: Google LLC }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
       #   siteKey: 6LcAbCdEfGhIjKlMnOpQrStUvWxYz0123456789a
       # - id: support-form-check
       #   provider: hcaptcha
@@ -193,6 +202,8 @@ plugins:
       #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
       #   recipient: { en: Intuition Machines, Inc., zh-CN: Intuition Machines, Inc. }
       #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://www.hcaptcha.com/privacy
       #   siteKey: 0123456789abcdefghijklmnopqrstuvwx
 # Add browser services under plugins.consent after filling the real site operator details above.
-# Every configured service waits for the visitor's explicit consent before its vendor code loads.
+# Every configured service needs a privacyUrl linking to the provider's current privacy information.
+# Each service waits for explicit visitor consent before its vendor code loads.

package/content/pages/home/zh-cn.md

@@ -29,7 +29,7 @@ blocks:
               width: 418
           cta:
             label: 从快速入门开始
-            url: /quick-start/
+            url: /[launge]/quick-start/
           highlights:
             - 在本地化 Markdown 前置数据中编辑页面
             - 使用 Markdown 撰写文章
@@ -43,19 +43,19 @@ blocks:
             - title: 页面使用可编辑元素
               icon: layout-grid
               text: 先设置栏数，再选择元素类型，并在各页面文件中编辑对应内容。
-              url: /theme-development/
+              url: /[launge]/theme-development/
             - title: 文章使用 Markdown
               icon: file-text
               text: 使用 Markdown 撰写长文，由内置渲染器进行清理和排版。
-              url: /project-introduction/
+              url: /[launge]/project-introduction/
             - title: 主题负责视觉设计
               icon: palette
               text: 使用 HTML 局部模板构建布局，并将各主题的配色保留在样式表中。
-              url: /theme-development/
+              url: /[launge]/theme-development/
             - title: 集成遵循用户同意
               icon: shield-check
               text: 配置跟踪、统计、广告或人机验证服务及其供应商信息。
-              url: /plugin-development/
+              url: /[launge]/plugin-development/
   - columns: 2
     cells:
       -
@@ -70,9 +70,9 @@ blocks:
               title: 项目指南
               items:
                 - label: 项目介绍
-                  url: /project-introduction/
+                  url: /[launge]/project-introduction/
                 - label: 快速入门
-                  url: /quick-start/
+                  url: /[launge]/quick-start/
       -
         - type: section
           title: 扩展项目
@@ -86,9 +86,9 @@ blocks:
               title: 开发指南
               items:
                 - label: 主题开发
-                  url: /theme-development/
+                  url: /[launge]/theme-development/
                 - label: 插件开发
-                  url: /plugin-development/
+                  url: /[launge]/plugin-development/
   - columns: 1
     cells:
       -

package/content/pages/plugin-development/en.md

@@ -43,7 +43,7 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - Add browser providers in config.yml under plugins.consent.tracking, plugins.consent.statistics, plugins.consent.advertising, or plugins.consent.captcha. Each service needs a unique ID, provider, purpose, dataCategories, recipient, retention, and its public site identifier. Localized fields are maps keyed by every enabled locale, such as en and zh-CN.
+                - Add browser providers in config.yml under plugins.consent.tracking, plugins.consent.statistics, plugins.consent.advertising, or plugins.consent.captcha. Each service needs a unique ID, provider, purpose, dataCategories, recipient, retention, a privacyUrl pointing to the provider's current privacy information, and its public site identifier. privacyUrl must be an HTTPS URL. Localized fields are maps keyed by every enabled locale, such as en and zh-CN.
                 - Available providers include Google Tag Manager and Meta Pixel; Cloudflare Web Analytics, Google Analytics, and Baidu Tongji; Google AdSense; and Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.
                 - Set plugins.consent.proposedDate to the YYYY-MM-DD date the notice was drafted. Set effectiveDate when the notice takes effect; omit it while no effective date has been set. Updating either date makes saved consent stale, so visitors are asked again.
                 - Provider code is imported only after the visitor accepts that integration. The first layer offers accept and reject together; service data and individual switches are available in its details. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.

package/content/pages/plugin-development/zh-cn.md

@@ -43,7 +43,7 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - 在 config.yml 的 plugins.consent.tracking、plugins.consent.statistics、plugins.consent.advertising 或 plugins.consent.captcha 下添加浏览器供应商。每项需要唯一 ID、provider、purpose、dataCategories、recipient、retention 和公开站点标识。多语言字段需使用语言映射，覆盖已启用的每种语言，例如 en 与 zh-CN。
+                - 在 config.yml 的 plugins.consent.tracking、plugins.consent.statistics、plugins.consent.advertising 或 plugins.consent.captcha 下添加浏览器供应商。每项需要唯一 ID、provider、purpose、dataCategories、recipient、retention、指向供应商当前隐私说明的 privacyUrl，以及公开站点标识。privacyUrl 必须是 HTTPS 地址。多语言字段需使用语言映射，覆盖已启用的每种语言，例如 en 与 zh-CN。
                 - 可用供应商包括 Google Tag Manager 和 Meta Pixel；Cloudflare Web Analytics、Google Analytics 和百度统计；Google AdSense；以及 Cloudflare Turnstile、Google reCAPTCHA 和 hCaptcha。
                 - plugins.consent.proposedDate 必须设置为 YYYY-MM-DD 格式的告知拟定日期。告知生效后再设置 effectiveDate；尚未生效时可以省略。修改任一日期都会使旧的同意记录失效，并重新询问访客。
                 - 只有访客接受对应集成后才会导入供应商代码。首层同时提供接受和拒绝，数据详情与逐项开关位于展开内容中。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。

package/content/pages/privacy-policy/en.md

@@ -2,75 +2,92 @@
 title: Privacy policy
 lang: en
 slug: privacy-policy
-description: Current data handling, consent controls, configured integrations, and publication details for this EdgePress site.
+description: How this site handles request data, consent choices, optional analytics, data rights, and supplier disclosures.
 blocks:
   - columns: 1
     cells:
       -
         - type: section
-          title: Site operator
+          title: Controller and contact
           tone: soft
           blocks:
             - type: privacy-controller
               nameLabel: Controller
               contactLabel: Privacy contact
               missingTitle: Publication setup required
-              missingText: config.yml still needs the site's real operator name and a working privacy contact. Add both before publishing this policy.
+              missingText: Add the responsible person's or organization's real name and a working privacy contact in config.yml before publishing.
+            - type: text
+              text: Confirm that the configured name identifies the responsible person or legal entity. Add a postal address, EU representative, or data protection officer contact here when applicable to the operator.
   - columns: 2
     cells:
       -
         - type: section
-          title: What this starter site does
+          title: Site requests and legal bases
           blocks:
             - type: text
               paragraphs:
-                - This source build contains public pages, posts, search data, a sitemap, and an Atom feed. It does not include a visitor account system, comments, or a contact form.
-                - The Worker exposes an optional /api/v1/ proxy for a backend. It forwards requests only when the deployer configures a Service Binding or BACKEND_URL together with the BACKEND_TOKEN secret. This starter site does not submit page content to that API.
-                - Hosting and delivery providers may process connection and request data to operate the site. The operator must identify the providers and describe their applicable terms and retention before publication.
+                - This site publishes pages and posts and provides client-side search. It has no visitor accounts, comments, or contact form in this build.
+                - To deliver and protect the site, the hosting and network providers receive request data such as IP address, requested path, request time, and browser or device headers. Where GDPR applies, the operator relies on legitimate interests in serving a secure and reliable site (Article 6(1)(f)); the operator must document the balancing assessment and confirm actual hosting logs and retention in the deployment account.
+                - Optional browser services listed below load only after an affirmative choice. Where their processing includes personal data and consent is the chosen legal basis, it is based on consent (Article 6(1)(a)). Refusing optional services does not prevent access to the site's basic pages.
       -
         - type: section
           title: Optional browser services
           blocks:
             - type: text
-              text: This list is regenerated on each build from enabled browser services in config.yml under plugins.consent. It shows each service name, provider category, purpose, data categories, recipient, and configured retention period.
+              text: This list is generated from enabled services in config.yml. It identifies each purpose, data category, recipient, retention period, and the supplier's own privacy information.
             - type: privacy-services
-              emptyText: No optional third-party browser services are configured in this source build.
+              emptyText: No optional third-party browser services are configured.
   - columns: 1
     cells:
       -
         - type: section
-          title: Consent preferences
+          title: Cloudflare Web Analytics
+          blocks:
+            - type: text
+              paragraphs:
+                - When accepted, the Cloudflare beacon reports page-view and browser performance metrics. Its published dimensions include page path, referrer, device, browser, operating system, and country. Cloudflare says its beacon receives the source IP as part of the HTTP request, discards it at the nearest data center, and does not store it in its core databases or logs; Cloudflare also says the beacon does not use browser storage.
+                - Cloudflare states that unsampled beacon data is retained for 7 days and then aggregated to about 10% for longer-term storage; dashboard history is available for 6 months. The beacon may be processed in a different country or region from the visitor. The operator must check the actual Cloudflare account, plan, and applicable data processing terms before publication.
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: Consent, retention, and transfers
           tone: accent
           blocks:
             - type: text
               paragraphs:
-                - Optional browser integrations stay off until a visitor actively accepts them. No service is selected on a first visit. Accept and reject are both available at the same level; visitors can also open the service details and save a granular choice.
-                - The interface stores the selected service IDs in first-party browser storage for the configured period. This preference record is stored on the visitor's device; it is not a server-side audit log.
-                - Visitors can reopen Privacy settings to change or withdraw a choice. If they withdraw a previously active service, the page reloads so the integration can stop running.
+                - The privacy choice is saved in the visitor's browser on that device for the configured period. This site does not send the choice to the operator or keep a server-side receipt. A visitor can reopen Privacy settings to change or withdraw it; withdrawal stops an active integration after the page reloads. If the operator relies on consent to process personal data, the operator must ensure it can demonstrate consent as required by GDPR Article 7.
+                - Hosting and security log retention depends on the deployed provider account and is not set by this source configuration. Cloudflare's data processing addendum describes transfer safeguards, including standard contractual clauses for restricted transfers; the operator must confirm the applicable agreement and safeguards for this deployment.
             - type: privacy-consent
-              storageLabel: Browser storage key
+              storageLabel: Saved on
               expiryLabel: Preference expiry
               proposedDateLabel: Notice proposed
               effectiveDateLabel: Notice effective
               expiryText: "{days} days after saving"
-  - columns: 1
-    cells:
       -
         - type: section
-          title: Provider and legal details
+          title: Your rights
           blocks:
             - type: text
               paragraphs:
-                - Before enabling a provider, the operator must document the information it receives, purposes, recipients, applicable retention, and any cross-border transfers. Public site identifiers may be configured in the browser; CAPTCHA secret keys must stay on a trusted server, which must verify each response token.
-                - This starter configuration cannot determine the operator's jurisdiction, legal bases, retention obligations, or the rights that apply to a particular deployment. Complete this policy for the actual site and seek qualified advice where needed.
-                - Review the current privacy information and terms for every provider listed above. Confirm that its actual data collection, recipients, retention, and transfer practices match this policy before publication and whenever the configuration changes.
+                - Where GDPR applies, you may request access, rectification, erasure, restriction, or object to processing. You may request data portability where the legal conditions apply, and withdraw consent at any time without affecting processing that was lawful before withdrawal.
+                - Contact the controller using the details above to exercise a right or ask a question. You may also complain to the competent data protection supervisory authority, including in the EU country where you live, work, or believe an infringement occurred.
+                - This site does not configure solely automated decisions that produce legal or similarly significant effects. The operator should update this notice if that changes or if the site adds accounts, forms, or other data uses.
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Legal reference
+          blocks:
             - type: link-list
-              title: Primary legal references
+              title: Official documents
               items:
-                - label: GDPR text on EUR-Lex
-                  url: https://eur-lex.europa.eu/eli/reg/2016/679
-                - label: UK ICO information notice guidance
-                  url: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment/what-information-you-must-supply-under-the-gdpr/
-                - label: China Personal Information Protection Law
-                  url: https://www.miit.gov.cn/jgsj/zfs/fl/art/2022/art_515a4b20c12f430eab54bb4f56d89f56.html
----
+                - label: General Data Protection Regulation (EUR-Lex)
+                  url: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
+                - label: Cloudflare RUM beacon privacy details
+                  url: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+                - label: Cloudflare Web Analytics retention and FAQ
+                  url: https://developers.cloudflare.com/web-analytics/faq/
+                - label: Cloudflare Data Processing Addendum
+                  url: https://www.cloudflare.com/cloudflare-customer-dpa/
+---

package/content/pages/privacy-policy/zh-cn.md

@@ -2,75 +2,92 @@
 title: 隐私政策
 lang: zh-CN
 slug: privacy-policy
-description: 本 EdgePress 网站当前的数据处理方式、同意管理、已配置集成和发布前信息。
+description: 说明本网站如何处理请求数据、同意偏好、可选统计服务、个人权利和供应商信息。
 blocks:
   - columns: 1
     cells:
       -
         - type: section
-          title: 网站运营者
+          title: 个人信息处理者与联系
           tone: soft
           blocks:
             - type: privacy-controller
-              nameLabel: 个人信息处理者
+              nameLabel: 处理者
               contactLabel: 隐私联系
               missingTitle: 发布前需要补充信息
-              missingText: config.yml 尚未填写真实运营者名称和有效的隐私联系方式。正式发布前请补充这两项信息。
+              missingText: 正式发布前，请在 config.yml 中填写负责个人或组织的真实名称和有效隐私联系方式。
+            - type: text
+              text: 请确认上方名称能识别负责的个人或法律实体。若运营者情形适用，还应在本政策中补充邮寄地址、欧盟代表或数据保护官的联系方式。
   - columns: 2
     cells:
       -
         - type: section
-          title: 此起始站点当前的功能
+          title: 网站请求与处理依据
           blocks:
             - type: text
               paragraphs:
-                - 此源项目生成公开页面、文章、搜索数据、站点地图和 Atom 订阅。它不包含访客账户系统、评论功能或联系表单。
-                - Worker 提供可选的 /api/v1/ 后端代理。只有部署者配置 Service Binding，或同时设置 BACKEND_URL 和 BACKEND_TOKEN 密钥后，代理才会转发请求。此起始站点不会将页面内容提交到该接口。
-                - 托管和内容分发服务商可能为运行网站而处理连接和请求数据。运营者应在发布前确认实际服务商，说明适用条款和数据保留期限。
+                - 本网站发布页面和文章，并提供在访客浏览器中运行的站内搜索。本构建版本没有访客账户、评论或联系表单。
+                - 为传送和保护网站，托管及网络服务商会收到请求数据，例如 IP 地址、请求路径、请求时间以及浏览器或设备请求头。在 GDPR 适用时，运营者以提供安全、可靠网站服务的合法利益为依据（第 6 条第 1 款 (f) 项）；运营者应记录利益衡量，并在部署账户中确认实际日志内容与保留期限。
+                - 下方列出的可选浏览器服务只有在访客主动选择后才加载。若相关处理涉及个人数据且以同意为法律依据，则依据第 6 条第 1 款 (a) 项处理。拒绝可选服务不会阻止访问网站基本页面。
       -
         - type: section
           title: 可选浏览器服务
           blocks:
             - type: text
-              text: 下方列表会在每次构建时根据 config.yml 中 plugins.consent 下已启用的浏览器服务重新生成，显示服务名称、供应商类别、用途、数据类别、接收方和配置的保留期限。
+              text: 此列表根据 config.yml 中启用的服务生成，列明处理目的、数据类别、接收方、保留期限及供应商自己的隐私说明。
             - type: privacy-services
-              emptyText: 此源项目当前没有配置可选的第三方浏览器服务。
+              emptyText: 当前没有配置可选的第三方浏览器服务。
   - columns: 1
     cells:
       -
         - type: section
-          title: 同意偏好
+          title: Cloudflare 网站分析
+          blocks:
+            - type: text
+              paragraphs:
+                - 访客接受后，Cloudflare 信标会报告页面浏览和浏览器性能指标。Cloudflare 公布的报告维度包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 表示，信标会在正常 HTTP 请求中接收来源 IP，在最近的数据中心丢弃该 IP，且不会将其保存到核心数据库或日志中；Cloudflare 也表示该信标不会使用浏览器存储。
+                - Cloudflare 表示未采样信标数据保留 7 天，之后汇总为约 10% 的长期数据；仪表板可查看最近 6 个月的数据。信标可能在访客所在国家或地区以外处理。发布前，运营者应核实实际 Cloudflare 账户、套餐和适用的数据处理条款。
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: 同意、保留期限与跨境传输
           tone: accent
           blocks:
             - type: text
               paragraphs:
-                - 可选浏览器集成只有在访客主动接受后才会加载。首次访问时没有预先选中的服务；接受和拒绝选项处于同一层级，访客也可以展开服务详情并保存逐项选择。
-                - 同意界面会在第一方浏览器存储中保存访客选择的服务 ID，并遵循下方配置的有效期限。该偏好记录只保存在访客设备上，不是服务器端审计日志。
-                - 访客可以重新打开“隐私设置”更改或撤回选择。撤回之前已启用的服务后，页面会重新载入，以停止该集成继续运行。
+                - 隐私选择保存在访客当前设备的浏览器中，并遵循所配置的期限。本网站不会将这项选择发送给运营者，也不会在服务器保存回执。访客可重新打开“隐私设置”修改或撤回选择；撤回后，页面重新载入以停止已启用的集成。若运营者依赖同意处理个人数据，必须确保能够按照 GDPR 第 7 条证明已取得同意。
+                - 托管和安全日志的保留期取决于部署服务商账户，本源配置没有设置该期限。Cloudflare 数据处理附录说明了受限传输的保障机制，包括标准合同条款；运营者应核实本部署适用的协议和保障措施。
             - type: privacy-consent
-              storageLabel: 浏览器存储键
-              expiryLabel: 偏好过期时间
-              proposedDateLabel: 隐私告知拟定日期
-              effectiveDateLabel: 隐私告知生效日期
-              expiryText: "保存后 {days} 天"
-  - columns: 1
-    cells:
+              storageLabel: 保存位置
+              expiryLabel: 偏好有效期
+              proposedDateLabel: 告知拟定日期
+              effectiveDateLabel: 告知生效日期
+              expiryText: 保存后 {days} 天
       -
         - type: section
-          title: 供应商与法律信息
+          title: 你的权利
           blocks:
             - type: text
               paragraphs:
-                - 启用供应商前，运营者应记录供应商接收的信息、处理目的、接收方、适用保留期限和跨境传输情况。浏览器配置中只能填写公开站点标识；CAPTCHA 密钥必须保存在可信服务器中，并由服务器验证每个响应令牌。
-                - 此起始配置无法确定实际部署的运营者所在地、法律依据、数据保留义务或适用的个人权利。请根据实际网站完成政策，必要时咨询合格的专业人员。
-                - 请核对上方每个供应商当前的隐私说明和适用条款，确认其实际收集的数据、接收方、保留期限和传输方式与本政策一致。发布前以及配置变更后都应重新检查。
+                - GDPR 适用时，你可以请求访问、更正、删除或限制处理，也可以在适用条件下反对处理。满足法律条件时，你可以请求数据可携；你也可以随时撤回同意，撤回不影响撤回前基于同意进行的合法处理。
+                - 如需行使权利或提出问题，请使用上方的处理者联系方式。你也可以向有管辖权的数据保护监管机构投诉，包括你居住或工作的欧盟国家，或你认为发生违规的国家。
+                - 本网站当前未配置会产生法律影响或类似重大影响的纯自动化决策。如果此情况改变，或网站新增账户、表单等数据用途，运营者应更新本告知。
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: 法律与供应商资料
+          blocks:
             - type: link-list
-              title: 主要法律资料
+              title: 官方资料
               items:
-                - label: EUR-Lex GDPR 正文
-                  url: https://eur-lex.europa.eu/eli/reg/2016/679
-                - label: 英国 ICO 隐私告知指引
-                  url: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment/what-information-you-must-supply-under-the-gdpr/
-                - label: 中国个人信息保护法
-                  url: https://www.miit.gov.cn/jgsj/zfs/fl/art/2022/art_515a4b20c12f430eab54bb4f56d89f56.html
----
+                - label: 欧盟《通用数据保护条例》（EUR-Lex）
+                  url: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
+                - label: Cloudflare RUM 信标隐私说明
+                  url: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+                - label: Cloudflare 网站分析保留期限与常见问题
+                  url: https://developers.cloudflare.com/web-analytics/faq/
+                - label: Cloudflare 数据处理附录
+                  url: https://www.cloudflare.com/cloudflare-customer-dpa/
+---

package/content/pages/project-introduction/en.md

@@ -82,7 +82,7 @@ blocks:
                   - No longer shipped; the compatibility manifest records the removal release.
             - type: text
               paragraphs:
-                - "Monthly releases use the year.month.request format. This release is 2026.9.1: the first requested release update for September 2026."
+                - "Monthly releases use the year.month.request format. This release is 2026.9.10: the tenth requested release update for September 2026."
                 - Ship a minor release when the monthly review is ready, and use patch releases for defects, security fixes, and dependency updates. Support the previous major release with security fixes for 12 months after a new major line begins.
                 - Before a release, update project-compatibility.json and this feature matrix together. Run edgepress doctor to review the local Node.js version, Worker entry, and configured compatibility date.
 ---

package/content/pages/project-introduction/zh-cn.md

@@ -82,7 +82,7 @@ blocks:
                   - 不再随项目发布；兼容性清单记录移除版本。
             - type: text
               paragraphs:
-                - 月度版本使用“年.月.请求序号”格式。本次版本为 2026.9.1，即 2026 年 9 月针对本次需求的第一次更新。
+                - 月度版本使用“年.月.请求序号”格式。本次版本为 2026.9.10，即 2026 年 9 月针对本次需求的第十次更新。
                 - 月度审核就绪后发布次版本；缺陷、安全修复和依赖更新使用修订版本。新主版本发布后，前一主版本继续获得 12 个月的安全修复支持。
                 - 发布前应同步更新 project-compatibility.json 和此功能清单。运行 edgepress doctor 可检查本机 Node.js 版本、Worker 入口和兼容日期。
 ---

package/content/pages/theme-development/en.md

@@ -38,6 +38,7 @@ blocks:
               paragraphs:
                 - The shared layout renders every page and post. The head, header, and footer partials provide common site components. Configure the page-title suffix and separator, site title, shared navigation, language links, footer text, and component visibility in config.yml.
                 - Use double-brace placeholders for escaped values. The approved raw placeholders are generated page content, JSON-LD, and EdgePress-generated navigation markup. Keep the skip link, one main landmark, labeled navigation, visible focus, and one page-level h1.
+                - Page-block links can use /[launge]/quick-start/. The generated page replaces [launge] with the current language path and removes the segment for the default language, so the same link works in both locales.
                 - Keep the body as a full-height vertical layout and let main grow so the footer stays at the bottom on short pages.
                 - Style shared code blocks, copy buttons, and article contents in the theme. Code lines wrap on small viewports, copy controls have visible keyboard focus, and the generated post contents list links to heading anchors.
       -

package/content/pages/theme-development/zh-cn.md

@@ -38,6 +38,7 @@ blocks:
               paragraphs:
                 - 共享布局会渲染所有页面和文章。head、header 和 footer 局部模板提供常见网站组件。在 config.yml 中配置页面标题后缀与分隔符、站点标题、全站导航、语言链接、页脚内容和组件显示状态。
                 - 使用双花括号占位符输出经过转义的值。唯一允许的原样占位符是生成的页面内容、JSON-LD 和 EdgePress 生成的导航标记。保留跳转链接、唯一 main 主区域、带标签的导航、可见焦点和一个页面级 h1。
+                - 页面块中的站内链接可写成 /[launge]/quick-start/。生成页面会把 [launge] 替换为当前语言路径；默认语言会移除该段，因此同一链接可用于中英文页面。
                 - 将 body 保持为全高纵向布局，并让 main 延伸，这样短页面的页脚也会留在视口底部。
                 - 在主题中统一设计代码块、复制按钮和文章目录。窄屏代码行会自动折行，复制控件具有清晰的键盘焦点，生成的文章目录会链接到标题锚点。
       -

package/content/posts/2026-09-26-edgepress-release-2026-9-9/en.md

@@ -0,0 +1,30 @@
+---
+title: "EdgePress September 2026 update: request 9"
+author: toewpq
+date: 2026-09-26
+lang: en
+slug: edgepress-release-2026-9-9
+tags:
+  - release
+  - privacy
+  - accessibility
+description: A floating article contents widget, a compact consent interface, supplier privacy links, and expanded bilingual privacy disclosures.
+---
+
+This is the ninth requested EdgePress update for September 2026.
+
+## Floating article contents
+
+Long articles now reveal a compact table-of-contents control after the reader scrolls. It opens and closes on demand, supports keyboard dismissal, and moves to the lower-left corner on mobile screens.
+
+## A clearer consent interface
+
+The consent panel now keeps the service purpose and choice visible while placing data categories, recipients, retention, and the supplier's privacy page in expandable details. Accept and reject remain equally prominent. The configured site operator and privacy contact share a compact line in the policy.
+
+Each configured browser service requires an HTTPS `privacyUrl`. The consent panel and generated privacy policy link to that page, and the privacy policy refreshes its provider list and consent dates from the current configuration at build time.
+
+## Bilingual privacy disclosures
+
+The English and Chinese policy pages describe request data, processing purposes and legal bases, visitor rights, consent withdrawal, configured retention, and cross-border processing information. They also state that the browser-only consent choice is not a server-side receipt.
+
+Page-content layout and consent-interface checks remain separate in the audit report.

package/content/posts/2026-09-26-edgepress-release-2026-9-9/zh-cn.md

@@ -0,0 +1,30 @@
+---
+title: EdgePress 2026 年 9 月更新：第 9 次需求
+author: toewpq
+date: 2026-09-26
+lang: zh-CN
+slug: edgepress-release-2026-9-9
+tags:
+  - 发布
+  - 隐私
+  - 无障碍
+description: 新增浮动文章目录，精简同意面板，支持供应商隐私链接，并扩充双语隐私披露。
+---
+
+这是 EdgePress 在 2026 年 9 月针对第 9 次需求的更新。
+
+## 浮动文章目录
+
+长文章会在读者向下滚动后显示精简的目录入口。目录可按需展开和收起，支持键盘关闭；移动端入口位于左下方。
+
+## 更清楚的同意界面
+
+同意面板会直接显示服务用途和选择开关，将数据类别、接收方、保留期限及供应商隐私页面放入可展开详情。接受和拒绝保持同等醒目。隐私政策中的网站运营者和隐私联系方式采用紧凑的并排布局。
+
+每项浏览器服务都必须配置 HTTPS `privacyUrl`。同意面板和自动生成的隐私政策都会链接到该页面；隐私政策中的供应商列表和同意日期会在构建时根据当前配置更新。
+
+## 双语隐私披露
+
+中英文政策现已说明请求数据、处理目的与法律依据、访客权利、撤回同意、已配置的保留期限及跨境处理信息，并明确说明同意选择只保存在访客浏览器，不会作为回执传回服务器。
+
+页面内容布局和同意界面仍由审核工具分别检查。

package/content/posts/2026-09-27-edgepress-release-2026-9-10/en.md

@@ -0,0 +1,31 @@
+---
+title: "EdgePress September 2026 update: request 10"
+author: toewpq
+date: 2026-09-27
+lang: en
+slug: edgepress-release-2026-9-10
+tags:
+  - release
+  - internationalization
+  - privacy
+  - themes
+description: Keep privacy choices across locales, localize page-block links, and improve article tags, search loading, and SVG icons.
+---
+
+This is the tenth requested EdgePress update for September 2026.
+
+## Keep privacy choices when changing languages
+
+Privacy choices now use a locale-independent configuration fingerprint, so switching page languages keeps the saved choice active. Existing choices from the previous locale-specific format migrate automatically. A change to notice dates or service configuration still asks visitors to choose again.
+
+## Link to pages in the current language
+
+Page-block links can use `/[launge]/quick-start/`. The build replaces the marker with the current locale path and omits the locale segment for the default language. Links from the Chinese homepage now open the matching Chinese guides.
+
+## Improve article tags and search
+
+Article pages show their tags as clear links to the matching tag pages. The search script loads only on search pages; tag navigation uses native links and works without JavaScript.
+
+## Redraw icons and simplify privacy wording
+
+The settings and plug SVG icons have been redrawn. The privacy policy now explains in plain language that a visitor's choice stays on their device, without exposing an internal storage key.