The window canon read its geometry through getBoundingClientRect(), which returns the transformed box while the entry animation still holds the window at scale(0.97). Every placement, pin and clamp now reads offsetWidth, offsetLeft and offsetTop, which ignore transforms. The same class of defect is fixed where editor JavaScript wrote inline geometry over the phone sheet rule of the canon, and the last duplicate of the canon foot is gone.

Core changes:

1. The canon engine (plugins/system/slaed.js):

2. setWindowPlace centres on the layout width instead of the drawn one

   • an 880px window was written to left 293px instead of 280px, measured at 1440
   • the error was always the width times 1.5%, and invisible under prefers-reduced-motion

3. The drag pins the layout position rather than the transformed one

   • grabbing the head during the opening animation jumped the window 13.2px by X and 24.0px by Y
   • the jump then stuck, because data-sl-moved stops the canon re-centring the window
4. setWindowBounds clamps against the layout width for the same reason
5. The emoji panel (plugins/editors/toastui/assets/editor-emoji.js):

6. place() and sizePanel() stand down on a phone

   • both wrote inline geometry that beat the sheet rule of the canon and pushed the panel past the edge
   • the owner is now written before that turn is taken, or a second press stops closing the panel
7. The editor fullscreen (plugins/editors/toastui/assets/editor-tags.js):

8. Escape reaches the fullscreen only when no window stands in front of it

   • one press used to close the file manager and drop the fullscreen at once
9. The window foot (templates//assets/editors/toastui/skin.css, templates//partials/editor-toastui-files.html):

10. The file manager takes the canon foot, buttons and status line

    • 74 lines per theme that restated the canon values under sl-fm-* names are deleted
    • the foot now follows --sl-modal-pad, so on a phone it agrees with every other window

11. The canon gains :hover:not([disabled]) on both foot buttons

    • the guard existed only in the deleted copy, so a disabled button lit up in every other window
12. Sizes and names (templates/*/assets/css/theme.css, templates/lite/fragments/window-share.html):
13. sl-modal-md is deleted: it restated the default 560px and the default needs no class
14. Documentation (docs/WINDOW.md, demo/window-canon.html):

15. docs/WINDOW.md describes the window as it is: structure, four axes, tokens, data attributes, JavaScript API, naming, where each window lives, traps and a check list

16. docs/WINDOW-CANON-2026.md is removed; it was a work plan and its work is done

17. The reference page drops a dead sl-toastui-shot class, draws its gallery with the shipped sl-shot-* rules instead of an inline grid, and states what is rather than what was

Benefits:

• A window opens where it is meant to, and a hand that reaches for it at once is not punished
• One declaration of the foot, so a change to the canon reaches the file manager too
• The reference page cannot show a layout the system does not ship

Technical notes:

• Visible change in the admin theme: the primary foot button of the file manager now darkens on hover (#076698) where it used to lighten (#207fb6), because the canon derives the hover from --sl-modal-tone while the deleted copy used --sl-color-primary-hover. It now behaves as every other canon button in that theme

• .sl-modal-info collapses when empty, which the deleted .sl-fm-foot-info did not; the foot keeps its right alignment either way

• .sl-fm-foot in the admin theme is untouched: it belongs to the file browser, which is not a window

• Verified in both themes at 1440x900 and 390x844: 37 checks green, centring error 0px, drag jump 0x0, console clean; 829 tests pass

The two shipped themes become reference etalons for hundreds of independent copies, so the plan fixes the only thing that travels between them: convention. It replaces the wish for consolidation with one machine-checked metric and records the architecture decisions that are now closed.

Core changes:

1. Theme etalon plan (docs/THEME-ETALON-2026.md):

2. Records the closed decisions so they are not re-litigated

   • Themes stay independent: no inheritance in Template, no shared core.css
   • No PHP changes: the theme path boundary and the engine grammar stay as they are
   • One canon of names and semantics, values per theme
   • Three CSS files per theme: tokens.css, base.css, theme.css

3. Carries the measured baseline the audit tool has to reproduce

   • 1164 literal visual declarations in lite/theme.css, 655 in admin
   • 236 selectors shared by both themes, 121 of them divergent
   • 33 same-named templates carrying different markup
   • gradients, transition and z-index are tokenised nowhere at all

4. Defines ten batches, each with its cause, its steps and its own check

   • admin reaches zero literals first, lite mirrors it afterwards
   • token hygiene runs before the scales, while renaming is still free
   • the public token API is frozen last, once both themes reach zero

Benefits:

• One address per visual decision, verified by a tool instead of by eye
• A new theme is created by editing tokens.css and nothing else
• The etalon stops contradicting itself before hundreds of themes inherit it

Technical notes:

• No code, no CSS and no template changes in this commit
• The audit tool, the strict rule file and the baseline screenshots are batch 0
• Utilities and a shared core were dropped on purpose: a 6% gain against theme independence

The structural validators of the upload service walk a container to a bounded depth, and three of them refused a file the moment that bound was reached. An ordinary tar of 300 members, a fragmented MP4 and a gzip file of concatenated members were rejected on a build without Fileinfo, while the magic database accepted all three.

Core changes:

1. Bounded walks that answer at their bound (core/classes/upload.php):

2. checkTarBody() reads the two closing zero blocks from the end of the file

   • Where the walk reaches the marker it still reads both blocks itself, so a half marker followed

by junk, a missing marker and data running past the end of the file all stay refused

• The bound alone ends the walk, so the member count of an archive no longer decides its type

• checkBoxBody() answers the declared track at the bound, so a file of more boxes than the walk visits is proven by its file type box, its brands and the handler of its track

• checkGzipBody() walks a gzip file member by member

  • getGzipHead() reads the RFC 1952 header of one member at any offset of the file
  • getGzipStop() takes the end of a stream from inflate_get_read_len(), holds the member against

its own checksum and length and returns the offset the next member begins at

• Bytes behind the last member that open no header are refused, as is a member whose trailer

disagrees with its stream

1. Regression fixtures (tests/Support/upload_probe.php, tests/Unit/UploadFallbackTest.php):

2. New bulky scenario: a 300 member tar, a padded archive, a 403 box MP4 and a concatenated gzip are published, each under its own extension and with the canonical type of its format

3. Their corrupt counterparts stay refused: a broken header inside the walk, a missing end of archive, a half marker, no marker at all, many boxes without a track, a broken second member and trailing bytes behind the last one

4. Help revision (admin/info/uploads/ru.md):

5. New section on how the type of an upload is decided

   • Fileinfo is the preferred reader and belongs on the server; the structural walk answers only

where it is absent, does not open or cannot name the file

• A type the database named against the extension is refused rather than asked a second time
• One table of what each of the 21 formats has to prove, one of the components a server needs,

and one of the four capability reasons error_file.log distinguishes

• Two corrections of the catalogue description

  • The upload rule belongs to the module of the open directory, not to the record of all, and the

quota of that module does not limit the administration

• The template variables list [quot] and the real order behind [width], [height], [tsrc] and [rel]

1. Task file (docs/UPLOAD-FILEINFO-PLAN-2026.md):
2. Removed, because the plan it carried is implemented and verified

Benefits:

• An ordinary long archive is published again on a build without Fileinfo
• A disguised, truncated or corrupted container is still refused by the structure it claims

• One page names the preferred reader, the components a server needs and the two different reasons an upload can be refused for

Technical notes:

• Routes, JSON, the eight key result shape and the database are unchanged
• No new required extension: inflate_get_read_len() belongs to ext-zlib, which stays a suggestion

• Verified on a build with the extension and on one without it: the suite, every one of the 21 formats, real world archives, and the HTTP flows of the catalogue, the editor and the frontend

The document stopped being a briefing that asks the reader to confirm a problem and became the task itself: the cause is named, the four points that produce it are given with file and line, and every one of the twenty-one allowed types gets the structural check its fallback must pass.

Core changes:

1. Statement of the task (docs/UPLOAD-FILEINFO-PLAN-2026.md):

2. the constraint is stated first: a clean SLAED without Composer or vendor

   • routes, JSON, result shape and the database stay as they are
   • content validation is not weakened, and GD and cURL stay required where they already were
3. the cause is named: production PHP 8.4.22 built with --disable-fileinfo
4. The points that produce the refusal:
5. checkUploadInput() answers unsupported before input, size and extension are looked at
6. the same read blocks remote upload
7. getFileMime() answers null when finfo is absent or cannot be created
8. the route shows unsupported as a format error
9. The filename contract:

10. the extension comes from the submitted name and the content from the temporary path

    • the fallback never reads the type off the name the file is finally stored under
11. The work itself:
12. the order of checks is fixed so a missing Fileinfo cannot mask missing, size or transfer
13. one content validator serves local and remote upload, reading through fopen/fread/fseek
14. a table gives the required structural check and the canonical MIME for each allowed type

Benefits:

• the reader of the plan can start writing code instead of first reproducing the fault
• a per-format table makes the acceptance of the change checkable rather than arguable

Technical notes:

• documentation only: no code, schema or configuration is touched by this commit

Batches 5 and 6 of docs/PRIVATE-MESSAGES-2026.md finish the two-column mailbox: the compose form answers with a recipient card that grades the mailbox a message would land in, and a focus deck puts the unread of both received folders above the list instead of on page four of one. The same pass corrects a quota that refused sends it had no business refusing and one that refused every send whenever the setting was zero.

Core changes:

1. Recipient card and the bounded autocomplete (core/system.php, core/helpers.php):

2. getUserCardData() resolves one exactly matched name and grades the mailbox it would land in

   • the grade folds getPercentTone() into room, nearly full and full, and never shows a number
   • a mailbox no setting bounds is graded none rather than well

3. getUserList() answers a richer shape behind rich=1 and bounds both branches

   • {items, card} in one round trip, card filled only when the name resolved exactly
   • the rich branch answers 10 and the flat one 50, where it answered 1246 for a single letter
4. getTplUserSearchInput() takes the card container a field opts in with
5. Focus deck over the inbox (core/user.php, core/classes/privat.php):
6. getRecentList() takes an unread argument reading the cabinet badge predicate across both folders
7. getNewWhere() is that predicate, written once for the badge and the deck instead of twice

8. getPrivatFocus() builds the deck, which renders over the inbox alone as the demo draws it

   • every slot addresses the inbox and carries the page, the search, the filters and the sort
   • the inbox action set gains unsave, because the deck shows saved messages never read
9. Forwarding and the compose state (core/user.php, templates/lite/partials/privat-view.html):

10. the compose view reads id and fwd, loads the source under the reader's own predicate

    • an empty recipient, a localised prefix and the body without the quote wrapper
11. the compose state names what bounds a send: the interval and the two stored lengths
12. Quota corrections (core/classes/privat.php):

13. checkQuota() no longer refuses on the recipient's saved folder

    • an arriving row carries no saved flag, so it can only land in the inbox
    • the saved quota stays enforced in setMessageSaved(), where a message is moved into it

14. both quota reads test the bound before comparing against it

    • a setting of zero is the absence of a bound, as the outbox, the ring and both alerts read it
    • count >= 0 used to be true forever, so a zero setting refused every send and every save
15. Out-of-band discipline (core/user.php):

16. the row travels back only where the caller stands on it, which the list row asks for

    • the deck and the deep link do not, because a swap with no target is an error and not a no-op

Benefits:

• a full mailbox is visible before the send and not only in the refusal that follows it
• what is unread is reachable from the top of the list rather than through the pager
• a suggestion list is bounded, so a large membership cannot answer a page of a database
• one predicate behind the badge and the deck, so a counter and its cards cannot drift apart

Technical notes:

• no schema change: setup/sql is untouched and batch 7 is closed on its measurement
• the flat autocomplete keeps its array shape for the twelve forms that read it, bounded at 50
• span.html and input.html gain additive keys only; no existing caller renders differently
• ten strings restyled and _PRFWD translated across de, en, fr, pl, ru and uk
• PHPStan clean, 819 tests, PHP-CS-Fixer clean; the two quota tests fail against the unfixed code