Batch 8 of docs/1-FILES-2026.md (step 14 of docs/ROADMAP-2026.md). uploads/archive/ leaves the public list of the light path, and update.php points a direct address a text keeps into the 6.2 folder of a type it does not belong to at the go=file address of a published material of that type which carries the name: one owner and one route per file.

Core changes:

1. The archive retired (core/stream.php):
2. archive is off getUploadPublic(), so every address under uploads/archive/ answers 410, an existing file included
3. Addresses of another owner (public/update.php):

4. getMigrateForeign() rewrites uploads/<dir>/<name> and its thumb into ./index.php?go=file&own=node&id=<id>&key=<name>

   • [code] and [php] keep their examples, another host and a name outside the attachment grammar stay
   • A name no material carries keeps its address, which answers 410

5. setMigrateForeign() runs after the data step on every run of the migration over Node texts, comments, the forum, private messages, site messages, newsletters, blocks, signatures, own blocks and polls

   • The material is the first published one of the type whose text, [usehtml] address or published comment carries

the name; the own folder of a material and of its comments stays with batch 3

• A text the longer address would push past its column keeps its addresses and is named in the notes of the run

1. Tests and probes (tests/Unit/UpdateAttachTest.php, tests/Unit/PublicTreeTest.php, tests/Unit/UploadFormatTest.php, tests/Support/format_probe.php):

2. UpdateAttachTest covers the pointing, the thumb, the kept example, the other host and the name no material carries
3. PublicTreeTest refuses uploads/archive/ and gives it no address; the format probe renders through presentation
4. Documentation and plans (docs/*, UPGRADING.md):

5. The files plan records batch 8, the stand run and the decisions "A file of another owner" and "The stand texts of batch 3"; the roadmap ticks step 14

6. UPGRADING.md drops archive from the public folders and describes the pointing of foreign addresses

Benefits:

• No file of the archive is readable by its address any more

• A forum post, a message or a newsletter that showed a file of a news or files material keeps showing it to the reader of that material, without a copy

Technical notes:

• Breaking: uploads/archive/<name> answers 410

• On the stand the conversion of batch 3 ran again (122 materials, 4 comments) and the pointing reached message #16, newsletter #11 and forum post #2791; no stored text addresses uploads/archive/

• No schema change

Batch 6 of docs/1-FILES-2026.md (step 12 of docs/ROADMAP-2026.md). uploads/account/ leaves the public list of the light path and holds the files of the private messages alone; the signature, the own block and the comments on a profile upload into the new closed folder uploads/profile/, and every page renders a signature in the file context of its account.

Core changes:

1. The private message adapter (core/stream.php, core/system.php, core/classes/access.php, core/classes/privat.php, core/user.php, core/admin.php):

2. account is off getUploadPublic(); getFileService() wires privat to uploads/account/ and checkPrivatFile()

   • A name a message carries goes to a side that still holds it (Privat::getMessageBody())
   • A moderator of account reads every message; the panel list renders a body in ['privat', $id]

3. checkPrivatNames() lets a writer bind an own upload or a name a message they still read carries, so a reply quotes and a forward carries its files; addPrivateMessage() refuses any other name (Privat::getAttachBodies())

4. The profile owner (config/uploads.php, core/system.php, core/user.php, modules/account/*):
5. A new owner profile with its rule in config/uploads.php, moderated as account through checkUploadModer()

6. checkProfileFile() grants the names of a signature to whoever may open the profile; checkProfileNames() refuses a foreign name in the signature and the own block on savehome

7. The signature, the own block and the comments on a profile upload into profile (getCommentPlace())

8. getUserSign() renders a signature in ['profile', $uid] on the forum, the profile, the private message and the comments, which printed the stored source unparsed until now; getUserBlock() renders in ['profile', $uid]

9. The mail texts of the panel render against the public folder all
10. One set of upload helpers (core/system.php, core/user.php, core/classes/node/service.php):
11. getUploadOwner() names the closed owner of an upload module for the editor window and every renderer
12. checkUploadPreview() and checkUploadNames() replace the copies inside the forum adapter and serve all three owners
13. FileAccess::PREVIEW gains privat and profile

14. The grant of a stored text no longer asks the extensions of the upload rule, Node included: the rule decides the upload, the preview and a new binding, not whether a stored name is served

15. Migration (public/update.php):

16. setUpdateAttach() replaces setUpdateForum() and runs over the forum and the private messages

    • The stand ran it once over the messages: the three addresses of brandbook.pdf (#1690, #1691, #1694) became [attach]
17. Tests and probes (tests/Unit/*, tests/Support/route_probe.php):

18. FileAccessTest and getRouteAccount() cover both sides, a deleted side, a third account, a guest, a moderator, the previews, a forward, a foreign and a deleted name, the signature on three pages, closed profiles and the profile form

19. NodeServiceTest the moderator of profile; PublicTreeTest the two closed folders; UpdateAttachTest a labelled link of a private message

20. Browser tooling (package.json, tools/browser-audit.mjs):
21. playwright ^1.63.0; chrome-remote-interface leaves the dev dependencies
22. browser-audit.mjs prefers the Chromium build pinned by the installed playwright over older revisions on disk
23. Documentation and plans (docs/*, UPGRADING.md):

24. The files plan records batch 6 and the decisions "The profile folder", "A name in a private message", "The administrator and private files" and "The rule governs the upload"; the roadmap ticks step 12

25. UPGRADING.md, ARCHITECTURE.md and PARSER.md describe the closed account folder, the profile folder and the file contexts ['privat', $id] and ['profile', $uid]

Benefits:

• A file sent in a private message is no longer readable by anyone who knows its address
• Narrowing an upload rule no longer cuts off what was uploaded under it

Technical notes:

• Breaking: uploads/account/<name> and uploads/profile/<name> answer 410; update.php rewrites the addresses of the private messages to [attach]

• config/uploads.php gains the rule profile; a 6.2 signature, own block or mail text with an [attach] of a file in uploads/account/ needs that file copied into uploads/profile/ or uploads/all/ (UPGRADING.md)

• Until batch 7 an attachment of the own block or of a profile comment has no address; neither carries one today
• No schema change

Roadmap steps 7 to 10 land together: item 1 of the production findings, and batches 2, 3 and 4 of the files plan. FileAccess now owns the delivery decision of every file through one adapter per owner, the parser asks it for each address instead of building one, and go=file is the single file address of the site, Node included.

Core changes:

1. One route for every file (core/classes/access.php, core/system.php, public/index.php, modules/node/index.php):

2. FileAccess takes one adapter per owner of the closed set FileAccess::OWNERS as two closures, folder and grant

   • getFilePath() adds the shared checks: a bare name of a supported type, the file inside the folder of its owner,

a thumb only when its copy exists; every refusal is an empty answer

• getFileUrl() answers the go=file address of a closed owner, the Node preview of a type, the direct link of a

public folder

• getFileService() wires node (grant through NodeService::getNodeFile(), the type of a material read from its row, nothing while a configuration journal holds the type) and public (no route)

• setFileRoute() serves go=file: the query is exactly an owner with its target or the preview of a Node type, GET and HEAD only, every refusal the same 404

• op=attach and setNodeAttach() are retired; getNodeQuery() moved to the core as getStrictQuery()
• setErrorOut() treats go=file as a non-HTML answer
• Parser file context (core/classes/parser.php, core/user.php, core/classes/node/view.php, modules/search/index.php):
• filterContent() and filterDoc() take array $own (['node', $nid]) in place of int $nid; the cache key carries it
• filterAttach() asks FileAccess for the folder and every address, and makes a thumb only where the owner has a folder
• The editor file list and the preview of an unsaved resource take their address from getFileUrl()
• Inline attachment (config/filetype.php, admin/modules/uploads.php, window-body-insert.html, filemanager.js, lang/*):

• [attach ... size=full] renders the template full at the own size of the image and makes no thumb, falling back to the template of its extension when full is empty

• The uploads screen edits full beside the extensions; the insert window offers Thumbnail or Full size
• Node texts off the archive (public/update.php, core/classes/node/service.php, core/classes/parser.php):

• update.php moves, copies and renames no file; getMigrateAttach() turns a direct address of the own folder into [attach] with the name unchanged, and a source inside [usehtml] into the go=file address of its material

• getNodeFile() grants the names such an address carries and no longer needs a managed name for a stored material
• checkImageSource() keeps the query of a local source, so an attachment image no longer renders as index.php
• Retired addresses (core/security.php, core/stream.php, nginx.conf.example):
• A path that is no address answers 404, a missing upload 410, and /index.php/... a 301 to the clean address
• Tests and probes (tests/Unit/, tests/Support/, tools/*):
• FileAccessTest: closed owners, every address form, a carried name whatever its form, refusals of every other name
• UpdateAttachTest for the migration of 6.2 texts; ParserFixturesTest for the file context and the full-size form
• The route probes follow go=file: 20 crafted queries refused, POST 405, the retired op=attach 404
• Documentation and plans (docs/*, UPGRADING.md, README.md, admin and module help):
• NODE.md, PARSER.md, ARCHITECTURE.md describe the file route and the file context
• The files plan records batches 2 to 4 and the decision "One file address"; the roadmap ticks steps 7 to 10
• docs/4-EDITOR-2026.md, the plan of the editor work, joins the roadmap
• Design demos (public/demo/*):

• The editor variants ed-plain-01..08 and ed-code-01..09 with their CodeMirror bundle, and the Node header variants nh-01..10

Benefits:

• One decision and one sender for every uploaded file, so closing the forum, private messages and comments in the next batches is one adapter each

• No address of a file is spelled outside FileAccess

Technical notes:

• Breaking: op=attach answers 404; the stand rewrote its 184 [usehtml] addresses to go=file, and production never carried op=attach

• Breaking: Parser::filterContent() and filterDoc() take array $own instead of int $nid as the sixth argument
• No closed owner but Node is wired yet; forum follows in batch 5

Batch 3 of docs/0-PRIVATE-DATA-2026.md (step 5 of docs/ROADMAP-2026.md). A random marker check.txt lies in the project and in storage/, config/, uploads/ and admin/info; an hourly scheduler job asks each at the address it would have under the site address and judges by the body, never by the status. The panel warns when a root is open, unknown or not checked within a day, and switching a Node type on asks the same check for the upload root.

Core changes:

1. The self-check (core/system.php, config/scheduler.php, .gitignore):
2. getPrivateRoots() names the project and the four folders that hold the secrets
3. setPrivateMark() keeps a random 32-hex marker per folder, written again under a lock when missing or damaged

4. checkPrivateRoots() asks every marker over getSchedulerFetch() with the transport as a seam for tests

   • open: the marker is in the body, whatever the status; closed: any other answer; unknown: no answer or no http(s) site address

5. addSelfCheckTask() is the system job selfcheck, every hour at minute 20; it keeps the verdict of every root in its scheduler state and fails on a root that is not closed

6. The markers are ignored by git, so a shipped copy cannot let a copy of the delivery pass for the site
7. Panel (admin/index.php, admin/modules/security.php, admin/lang/*.php):

8. getSelfCheckAlert() warns on the home of the panel about an open or unknown root, with its addresses, and about a verdict older than a day; the security section adds the all-clear with the time of the last run

9. _SEC_CHECK_DONE, _SEC_CHECK_NONE, _SEC_CHECK_OPEN and _SEC_CHECK_UNK in all six locales
10. Node types (core/classes/node/service.php):

11. checkTypeGuard() asks checkPrivateRoots() for the upload root alone instead of a request to the type folder; only closed lets a type go public

12. Installer and update (public/setup.php, public/update.php):
13. The last part of setup.php, the one that runs with the core, writes the markers
14. update.php adds the job selfcheck to a scheduler that does not carry it; two long comments are shortened
15. Documentation and help (docs/*, admin/info/scheduler/ru.md, modules/node/admin/info/ru.md, .gitmessage):
16. The plan records batch 3 and the project as the fifth watched root; the roadmap ticks step 5
17. NODE.md, the scheduler help and the Node help describe the check behind switching a type on
18. .gitmessage states one task, one commit
19. Tests (tests/Unit/SelfCheckTest.php, tests/Support/check_probe.php, tests/Unit/NodeConfigTest.php, tests/Support/node_probe.php):

20. New SelfCheckTest: every root at its own address with its own marker, three verdicts, the body decides and not the status, a missing marker written again, the job state shown by the panel, a stale verdict counted as none

21. The gate of the Node probe runs on the marker of the upload root instead of a served file of the type folder

Benefits:

• An operator learns from the panel, not from a leak, that a document root or a server alias exposes the project
• One check serves the panel, the scheduler and the switch of a Node type

Technical notes:

• New scheduler job selfcheck; existing sites gain it through update.php
• check.txt markers are written per installation and never shipped
• No schema change

Batches 0 and 1 of docs/1-FILES-2026.md. Node types no longer share the upload root with the modules: they live below one root of their own, so a type can only meet another type there, and every builder of an upload path asks one function instead of spelling 'uploads/'.$mod. The plan carries the owner's decisions and the inventory of the stand database that the later batches rely on.

Core changes:

1. One root for the types (core/system.php, core/classes/parser.php, modules/node/index.php, update.php):

2. NODE_DIR is UPLOADS_DIR.'/node'; getUploadFolder($mod, $node) answers node/<type> for a type, the own name for a module

   • The flag names a type the registry does not carry yet or no longer, as type operations and update.php do
3. getUploadRuleData(), getUploadPlaceRule() (store), getImgText(), Parser::filterAttach() and getNodeAssetPath() ask it
4. Node service and locks (core/classes/node/service.php, core/classes/filemanager.php):

5. setTypeRoot(), checkTypeGuard(), setTypeWrite(), updateNodeTypeStatus(), deleteNodeType(), checkNodeFiles(), setNodeWrite() and getNodeFile() build the type folder through getUploadFolder()

6. checkNewName() drops its scan of the upload root; a module name and a key of config/uploads.php stay refused
7. FileManager::getPathLock() takes uploads/node/<type> as the root of an upload area, so two types never wait for each other
8. Administration (core/admin.php, admin/modules/uploads.php):
9. getAdminUploadRule() reads the type out of a path below uploads/node and hands the owner on as mod

10. getUploadsFolders() lists the folders of the upload root with the type folders below uploads/node

    • The default folder setting keeps an owner name, its label shows the path
11. The tree and the documents (uploads/, UPGRADING.md, docs/, modules/node/admin/info/ru.md, admin/info/config/ru.md):
12. uploads/{content,docs,faq,files,help,links,news} move to uploads/node/, which carries index.html and .htaccess
13. UPGRADING.md gives the operator the folder move; NODE.md and the help name uploads/node/<type>
14. docs/1-FILES-2026.md records the decisions of batches 0 and 1 and the inventory; docs/ROADMAP-2026.md ticks steps 2 and 3
15. Tests and tools (tests/*, tools/node-profile.php, tools/upload-route-check.php):
16. The probe routers follow the nginx rule below a folder of the upload root instead of one level only
17. Route, node, install, upload and image probes build their type folders below uploads/node
18. New: the folder of a type through every rule builder, two types as two lock areas, names a folder of the root carries

Benefits:

• A type can no longer collide with a module folder, and the type check no longer scans the upload root
• The place of the types is decided once, which batch 2 of 0-PRIVATE-DATA-2026.md needs to take uploads/node out of public/

Technical notes:

• Breaking: a site whose type folders sit at uploads/<type>/ moves each to uploads/node/<type>/ before the new files serve
• No public address changes: texts reach type files through op=attach and op=asset by name, no stored row carries the folder
• NodeProfileTest fails 11 of 14 as on a clean HEAD (the installer copy never gets config/db.php); not caused by this change