The variable naming rule demanded at least two characters, which the code base contradicted in about eighty places, including the filter table in getVar(). A rule that is never followed stops guiding anything, so the exception is written down instead.

Core changes:

1. Naming rule (CONTRIBUTING.md):

2. Allow a single letter where the name carries no domain meaning

   • Loop counters and parameters of single-expression closures
   • Any variable holding a domain value keeps the 2-8 character rule
3. Test inventory (docs/TESTS.md):
4. List the unit tests that were added since the file was last updated
5. Note that the contract tests drive production code through the CLI probe
6. Completed plans (docs/FRONTEND-DIAL.md, docs/PROFILE-BACKLOG.md):
7. Remove the plan documents whose work is finished

Benefits:

• The written rules match the code that reviewers actually read
• Newcomers find the current test layout instead of an outdated list

Technical notes:

• Documentation only, no runtime change

Form fields like lng[ru][] could not be read at all: the key syntax stopped at one level, and a mismatched key silently produced false from filter_input(), which then reached the scalar filters. Several admin forms were broken by exactly that, so the helper is extended instead of worked around per module.

Core changes:

1. Key syntax (core/security.php):

2. Parse a key as a path so leading segments walk nested form fields

   • lng[ru][] returns the whole branch, lng[ru][_A] one element
   • deep[a][b][c] and row[2][id] work the same way
   • The existing forms key, key[] and key[n] behave exactly as before
3. Walk the path once before the branches instead of per branch
4. Missing and mismatched values (core/security.php):

5. Treat an array reached through a scalar key as missing

   • A wrong form name now yields the default instead of false

6. Return an array default before any scalar filter runs

   • filterNum() no longer receives an array and logs a conversion warning
7. Contract tests (tests/Unit/InputVarContractTest.php):

8. Exercise the real helper through the CLI probe, not a replica

   • Typed array keys still drop empty values and reindex
   • Untyped array keys return the payload untouched for index alignment
   • Nested paths are covered for post, get and req, including a missing branch

Benefits:

• Forms with nested fields are readable without bypassing input filtering
• A form and handler name mismatch fails visibly instead of silently
• The helper keeps a single source of truth for input access

Technical notes:

• Purely additive for existing callers: the typed array branch is unchanged

• The scalar branch reads filter_input(), which has no payload in CLI, so it is verified through real HTTP rather than the probe

The parser passed any data: URI through untouched, so a guest without upload rights had an unlimited byte channel into the database and a clickable data:text/html href in every comment. Enforcement now happens at render time, which also covers rows that are already stored.

Core changes:

1. Image sources (core/classes/parser.php):

2. Accept a data: source only as a whitelisted base64 raster image

   • Allowed types are png, jpeg, jpg, gif and webp, matched case-insensitively
   • The decoded payload must not exceed Parser::EMBEDMAX (65536 bytes)
   • Anything else returns null and renders the existing image placeholder

3. Cap the encoded length before the regex or base64_decode() runs

   • A multi-megabyte payload is refused without allocating a decoded buffer

4. Force the derived file name to 'image' for data: sources

   • A rejected payload no longer leaks into the alt and title attributes

5. Cover all three ingestion paths in both safe and unsafe mode

   • Markdown images, BB [img] and persisted raw <img src> repairs
6. Link contexts (core/classes/parser.php):

7. Refuse data: in filterUrl() regardless of the safe flag

   • Untrusted guest content is rendered unsafe, where the policy was skipped
   • Trusted content keeps ftp:, tel: and other hrefs as before

8. Hand data: image sources straight to the whitelist

   • Safe mode previously rewrote every legitimate embed to src="#"

9. Shared limit and meta images (plugins/editors/toastui/driver.php, core/system.php):

10. Publish Parser::EMBEDMAX to the editor as its client-side embedmax

    • The client limit is UX only and can no longer drift from the server
11. Drop data: sources in getImgText() so og:image points at a real resource

Benefits:

• Upload permissions can no longer be bypassed through an inline embed
• Oversized rows, heavy pages and bloated backups are prevented at the source
• A data: URI can never appear in an href, only as escaped text

Technical notes:

• Existing rows are covered because the rule runs at render time
• Legitimate embeds above 64 KiB stop rendering and show the placeholder

• ParserFixturesTest covers both modes, hostile MIME tricks, whitespace variants, the exact size limit and a multi-megabyte payload

Trims the function comments added by the performance remediation work to the 180-character line limit while keeping their meaning; no code or behavior changes.

Core changes:

1. Comment wording (core/system.php, core/classes/cache.php):

2. updateStatsCookie, updateStatsTrack, marker contract, and page-cache contract comments rewritten concisely within one line each

3. Test probe (tests/Support/contract_probe.php):
4. header comment shortened to the same limit

Technical notes:

• legacy over-length lines elsewhere are untouched, out of scope

Implements the full 2026-07 performance plan: exact locked statistics, deferred post-response tracking, derived config, streaming GeoIP, shared category map, parser cache, cache GC, and a guest page cache that keeps every visitor-bound token isolated through signed dynamic-region markers.

Core changes:

1. Statistics and tracking (core/system.php):

2. Rewrite updateStatsTrack around one c+ handle with a single LOCK_EX

   • read, day/month rotation, truncate and write share one lock
   • first hit of a new day now records its own IP (hosts=1) and user
   • three duplicated counter-field blocks collapsed into one

3. Replace sessions.log with a signed base64url stats cookie

   • fields v1|sid|fst|lst|hits|country|cts|uniq-day|ip-hash, HMAC via

getSecret('stats'), verified with hash_equals, tamper resets session

• country carries a 24h TTL and is bound to the IP hash
• updateSessionState removed, sessions.log and its global lock retired

• Split tracking into pre-output cookies and post-response writes

  • addDeferredTask/setDeferredTasks queue with shutdown backstop
  • session_write_close before deferred writes, drains on all exits
  • news article counter update moved into the deferred queue

• Literal stripos matching for bots, fbots, and auto_links patterns

  • removes regex injection from config and DB values, caches results
• Conditional lastvis update (60s window) and _session upsert
• Session schema (setup/sql/table.sql, table_update6_3.sql):
• UNIQUE KEY on _session.uname for new installs

• mksessuniq migration: dedup by max(time, id), drop old index, add unique, idempotent on re-run; code uses INSERT ... ON DUPLICATE KEY

• Derived config cache v2 (core/system.php):

• getConfig stores derived data in config/local.php (version 2)

  • per-theme asset manifests with stat fingerprints, parsed SEO

graph/schema templates, logo dimensions per theme

• doCss/doScript drop per-request glob/stat sweeps, bundle hash only computed when bundling is enabled

• Streaming GeoIP (core/classes/geoip.php):

• MMDB reader works through fseek/fread ranges instead of loading the whole database file; metadata resolved from the last 128 KiB

  • byte-exact with the old reader, peak memory 25 MB -> 2 MB
  • fread(handle, 0) guarded (old substr was silently empty)

• Category map and parser cache (core/system.php, core/helpers.php, modules/news/index.php):

• getCategoryMap consolidates two duplicated category queries behind an epoch-keyed data cache with raw titles

• news list caches filterContent output keyed by content hash, parser config, theme, locale, and parser version; [block]/[hide]/[usephp]/ [attach] and local <img> content bypasses the cache

• Guest page cache with dynamic regions (core/system.php, core/classes/cache.php, core/security.php, blocks/*):

• Signed markers [[sldyn:type:par:hmac]] via getSecret('dynreg') keep user content from forging substitutable markers

• Regions: CSRF tokens (getPageToken), captcha (getPageCaptcha), and the whole voting widget; cache files contain zero live tokens

• Poison guard: a live getSiteToken/getCaptcha call during a cacheable build prevents storing the page entirely

• Default-deny route allowlist inside checkPageCache (news list only)

• Fail-closed sidecar with body hash and dyn flag; dynamic pages are no-store and never answer 304; substitution runs on hit and miss

• cache = 1 enabled in config/global.php
• Cache GC (core/classes/cache.php, core/system.php):

• deleteStaleTree recursively sweeps storage/cache/templates and the data cache joins the cachegc scheduler job

Benefits:

• Guest cache hit generation time 0.307s -> ~0.055s (5.3x)
• Uncached pages roughly halved (search 0.17s -> 0.09s)
• Day counters survive concurrent requests and day rollover
• CSRF/captcha isolation between visitors verified with two cookie jars

Technical notes:

• config/local.php cache version bumped to 2, rebuilt automatically

• theme asset changes now require a config rebuild (admin save or deleting config/local.php)

• _session migration applied to the dev DB; verify on MySQL before production rollout (developed against MariaDB 11.7)

• ip/agent freshness for logged-in users delayed up to 60 seconds

• docs/PERFORMANCE.md updated; docs/PERFORMANCE-REMEDIATION-2026.md is the completed plan, ready for deletion after review