# Encoded sidebar link correction

The reported screenshot shows /admin/catalog at the domain root, while the app is installed under /xb/public/. The previous response normalizer matched only literal-slash URL attributes. Admin sidebar URL attributes were escaped using HTML entities (for example /admin/catalog), so those links escaped normalization. Public hardcoded links worked, which explains why anonymous public checks missed the authenticated sidebar problem.

CommerceUrls::html now decodes each quoted URL attribute before deciding whether it is a local root-relative URL. Encoded and plain links/forms/assets use the same configured application root, and external URLs remain unchanged. Only app/Services/CommerceUrls.php changes application behavior in this correction.

Six focused PHP checks pass, covering plain links, hexadecimal/decimal entities, form actions, uploaded media and external URL preservation. The strengthened HTTP matrix passes 171 checks across root/index.php, subfolder/index.php, and subfolder/clean routing. Every actual sidebar destination was opened locally, including Categories. Earlier checks that inspected only already-absolute URLs were insufficient; the new checks also reject remaining root-relative internal sidebar links.

Replace the existing app/Services/CommerceUrls.php with this version and open the correct /xb/public/index.php/admin URL again. Existing database/admin credentials and installer state remain unchanged. Real hosting after replacement has not been verified remotely; prior feature-audit limitations remain.