The document stopped being a briefing that asks the reader to confirm a problem and became the task itself: the cause is named, the four points that produce it are given with file and line, and every one of the twenty-one allowed types gets the structural check its fallback must pass.

Core changes:

1. Statement of the task (docs/UPLOAD-FILEINFO-PLAN-2026.md):

2. the constraint is stated first: a clean SLAED without Composer or vendor

   • routes, JSON, result shape and the database stay as they are
   • content validation is not weakened, and GD and cURL stay required where they already were
3. the cause is named: production PHP 8.4.22 built with --disable-fileinfo
4. The points that produce the refusal:
5. checkUploadInput() answers unsupported before input, size and extension are looked at
6. the same read blocks remote upload
7. getFileMime() answers null when finfo is absent or cannot be created
8. the route shows unsupported as a format error
9. The filename contract:

10. the extension comes from the submitted name and the content from the temporary path

    • the fallback never reads the type off the name the file is finally stored under
11. The work itself:
12. the order of checks is fixed so a missing Fileinfo cannot mask missing, size or transfer
13. one content validator serves local and remote upload, reading through fopen/fread/fseek
14. a table gives the required structural check and the canonical MIME for each allowed type

Benefits:

• the reader of the plan can start writing code instead of first reproducing the fault
• a per-format table makes the acceptance of the change checkable rather than arguable

Technical notes:

• documentation only: no code, schema or configuration is touched by this commit

Batches 5 and 6 of docs/PRIVATE-MESSAGES-2026.md finish the two-column mailbox: the compose form answers with a recipient card that grades the mailbox a message would land in, and a focus deck puts the unread of both received folders above the list instead of on page four of one. The same pass corrects a quota that refused sends it had no business refusing and one that refused every send whenever the setting was zero.

Core changes:

1. Recipient card and the bounded autocomplete (core/system.php, core/helpers.php):

2. getUserCardData() resolves one exactly matched name and grades the mailbox it would land in

   • the grade folds getPercentTone() into room, nearly full and full, and never shows a number
   • a mailbox no setting bounds is graded none rather than well

3. getUserList() answers a richer shape behind rich=1 and bounds both branches

   • {items, card} in one round trip, card filled only when the name resolved exactly
   • the rich branch answers 10 and the flat one 50, where it answered 1246 for a single letter
4. getTplUserSearchInput() takes the card container a field opts in with
5. Focus deck over the inbox (core/user.php, core/classes/privat.php):
6. getRecentList() takes an unread argument reading the cabinet badge predicate across both folders
7. getNewWhere() is that predicate, written once for the badge and the deck instead of twice

8. getPrivatFocus() builds the deck, which renders over the inbox alone as the demo draws it

   • every slot addresses the inbox and carries the page, the search, the filters and the sort
   • the inbox action set gains unsave, because the deck shows saved messages never read
9. Forwarding and the compose state (core/user.php, templates/lite/partials/privat-view.html):

10. the compose view reads id and fwd, loads the source under the reader's own predicate

    • an empty recipient, a localised prefix and the body without the quote wrapper
11. the compose state names what bounds a send: the interval and the two stored lengths
12. Quota corrections (core/classes/privat.php):

13. checkQuota() no longer refuses on the recipient's saved folder

    • an arriving row carries no saved flag, so it can only land in the inbox
    • the saved quota stays enforced in setMessageSaved(), where a message is moved into it

14. both quota reads test the bound before comparing against it

    • a setting of zero is the absence of a bound, as the outbox, the ring and both alerts read it
    • count >= 0 used to be true forever, so a zero setting refused every send and every save
15. Out-of-band discipline (core/user.php):

16. the row travels back only where the caller stands on it, which the list row asks for

    • the deck and the deep link do not, because a swap with no target is an error and not a no-op

Benefits:

• a full mailbox is visible before the send and not only in the refusal that follows it
• what is unread is reachable from the top of the list rather than through the pager
• a suggestion list is bounded, so a large membership cannot answer a page of a database
• one predicate behind the badge and the deck, so a counter and its cards cannot drift apart

Technical notes:

• no schema change: setup/sql is untouched and batch 7 is closed on its measurement
• the flat autocomplete keeps its array shape for the twelve forms that read it, bounded at 50
• span.html and input.html gain additive keys only; no existing caller renders differently
• ten strings restyled and _PRFWD translated across de, en, fr, pl, ru and uk
• PHPStan clean, 819 tests, PHP-CS-Fixer clean; the two quota tests fail against the unfixed code

The two-column layout demo grows the two shelves it was missing and becomes a specification a fresh session can implement from: every decision it implies is written down next to the code that has to carry it. The counters and flags the layout reuses are fixed in the theme itself, so the fix reaches the cabinet and the mailbox that use them today.

Core changes:

1. Missing shelves and their contract (demo/private-messages-final-2026.html):

2. Sections for the saved box and the compose form, both with their own states

   • Saved: its own quota ring, bookmark flags, unsave in the row and in bulk
   • Compose: recipient autocomplete, the card with the recipient quota ring,

the real Toast UI, and all five answers the send route can give

• A saved message no longer appears in the inbox, because the box predicate excludes it, and the shelf badges split the unread between them

• The backend contract records what the layout demands: one main swap with addressable out-of-band targets, a snapshot page, the editor filled through its own API, the two-step deep link, and the mobile pane switch

• Counters and state flags (templates/lite/assets/css/theme.css, templates/lite/fragments/span.html):

• sl-chip-icon turns a label-less state flag into a round badge, and the fragment emits it only when the flag carries no text, so the chips that do carry a label keep their pill

• sl-cab-badge and sl-pm-new centre their digit and declare border-box: one digit was sitting against the left padding inside a 32px oval

• Unread badge (core/user.php):

• getUserNavItems() caps the counter at 99+, because the badge is a circle on a tile and a four-digit number stretched it across the label

• Work plan (docs/PRIVATE-MESSAGES-2026.md):

• Seven batches from the data contracts to the conditional search index, each with its own verification, plus the predicate table every list query must match and the four questions that must be answered before their batch

Benefits:

• The redesign can start in a new session from one document instead of being re-derived from a demo

• Every counter in the theme is centred by the same method the chips use

• Three audit rounds are answered in the plan: native prepares, the flat autocomplete contract, POST-only opening and snapshot parity

Technical notes:

• No schema change, no new SQL, no route touched

• The plan defers the search index to its own approved batch, because a BTREE index cannot serve a leading wildcard and FULLTEXT changes search semantics

The page-cache generation counter lived inside storage/cache/pages, the directory the manual cache clear empties, so the clear reset the counter every stored page is keyed by. It now sits with the other persistent counters in storage/counter, and the clear advances it instead.

Core changes:

1. Page-cache generation (core/classes/cache.php):

2. getEpoch() and addEpoch() read and write COUNTER_DIR/cache.log

   • the counter is state, not a cache artifact: deleteAll() and the cache size report no longer reach it
   • the exclusive lock, the single bump per request and the zero on a missing file are unchanged

3. deleteAll() ends on a bump of its own

   • unlink() reports failure silently, so a page the sweep could not remove has to stay unreachable
   • the directory guard moved into the body, so the bump runs even with no cache tree on disk
4. Test bootstrap (tests/bootstrap.php):
5. COUNTER_DIR is defined next to CACHE_DIR and LOGS_DIR, so the harness matches the constants core gives the class
6. Documentation (docs/PAGE-CACHE-ROUTES-2026.md, admin/info/config/ru.md):
7. the invalidation section names the counter file and the bump the clear performs
8. the admin help gains the invalidation rule: admin writes, comment operations, post and vote from the front
9. the cache structure list gains storage/cache/pages/locks, which appears only under cache_l

Benefits:

• a cache clear can no longer resurrect a page whose file survived the sweep
• the counter stops being counted and swept as if it were a cached file
• the admin panel now explains why the page cache retires itself after an edit

Technical notes:

• storage: the counter is storage/counter/cache.log; the documented cache clear on upgrade removes the obsolete storage/cache/pages/epoch
• interface unchanged: getEpoch() and addEpoch() keep their signatures and all twelve call sites
• backward compatible: an installation without the file reads zero, exactly as before

The rendered-content cache kept every fragment, so short comments and teasers filled the directory while a daily rewrite cost more than the hits it saved. A size threshold now decides, the sweep that ages the leftovers out is enabled, and the settings screen loses the two fields that described the same decision twice or described nothing. On the way through, request logs stopped carrying the passwords a warning used to record.

Core changes:

1. A size threshold for the rendered-content cache (core/classes/parser.php):

2. CACHEMIN is 2048 bytes of source and getCachePath() returns nothing below it

   • The gate sits in the one function both the read and the write pass, so the two stay symmetric
   • The unit is bytes because parsing cost scales with bytes, not with characters
   • The empty-source case is covered by the threshold, so no separate check remains

3. Break-even is near 700 bytes, but only at some thirty hits a day per fragment; from 2 KB a write repays after three or four hits, which is almost any traffic level

4. The sweep that removes what already accumulated (config/scheduler.php):
5. The cachegc job is enabled; it removes files older than max(cache_t * 24, 86400), never below CACHETTL
6. The threshold stops new sub-threshold files but never removes existing ones: nothing else ages them
7. Secrets stop reaching the logs (core/classes/logger.php, core/security.php, admin/modules/config.php):

8. Logger masks request data by key name before it is bounded, in getContext() and only there

   • Any key holding pass, pwd, secret, token, key or code keeps its name and loses its value
   • The diagnostic context of a call is left alone, because it carries keys a name rule would destroy

9. The address is masked as well, in url and referer: an OAuth callback and a reset link carry their secret in the query string

10. The flood report names the posted fields instead of dumping them, so a password cannot arrive through the message text either

11. The hand-written unset() in mailtest() is gone: one rule replaces one special case
12. Four cache settings instead of six (admin/modules/config.php, config/global.php, core/system.php, index.php):
13. cache_c and the second minify pass are gone; the stored page is now exactly the page that was served
14. cache_d is merged into cache_b, which becomes a number of days with 0 for off

15. Browser caching no longer depends on db_t; the publicly cached response drops the generation-time marker instead, decided where the public headers are actually sent

16. OpenSearch, XSL and the asset route stop reading a setting: the first two take Cache::STATICDAYS, the third keeps its immutable year

17. The page identity becomes pc3 and cache_version becomes 4, so no entry written under the old rules can be served and every install rebuilds its merged configuration

18. The configuration writer stops mangling what it stores (core/system.php, setup/index.php, config/filetype.php):

19. One value is one line however long it is; a configuration file is data, and the line limit governs code a person writes

    • The line-splitting cut multibyte characters in half, so one save of a localized form produced a

file that was no longer valid UTF-8

• The installer carried a second copy of the same splitter and would have produced files the panel

does not

• Line endings are normalized on the way in, because a textarea posts CRLF into a source file of this repository

• One blind spot of the cache gets a record (core/classes/cache.php):

• A stored file that exists but cannot be read is written to the file channel once per process

  • The page re-renders and the guard prevents the warning that would otherwise name it
  • One record per process, because a locked append per read would cost more than the fact is worth
• Documentation and help (docs/PERFORMANCE.md, docs/PARSER.md, admin/info/config/ru.md, admin/info/scheduler/ru.md, UPGRADING.md):
• The performance guide gains the parser layer it never described, with the threshold and its reason
• The parser guide loses a cache guard that does not exist: the exclusion is $this->vary in the class

• The configuration help describes what pages/data really stores, the new field set and the real scope of the caching options, which is the front page and the news list, not every section

• The scheduler help had the cachegc job as disabled and as a full wipe; it is enabled and removes stale files only

• docs/PAGE-CACHE-ROUTES-2026.md is the plan for widening the page cache to the other modules

Benefits:

• The rendered-content directory holds the few documents that are expensive to parse instead of thousands of fragments that never repaid their write

• A warning raised during a login, a registration or a profile save no longer records the password
• Two settings fewer to explain, and the stored page can no longer differ from the served one
• Saving the settings form on a localized installation no longer corrupts config/global.php

Technical notes:

• Breaking: an installation running cache_b = '1' must set cache_b to its former cache_d, because a bare 1 now means one day. This install runs cache_b = '0' and carries nothing over

• Breaking: cache_c and cache_d are removed from config/global.php; cache_version = 4 forces every install to rebuild config/local.php on the first request

• Every stored page becomes unreachable at once through the pc3 prefix; cachegc removes the files

• The browser-cache branch for HTML stays unreachable in practice while any page carries a CSRF token marker, which makes its entry dynamic and therefore no-store