The parser decides escaping from a trust boundary instead of a stored flag, comments and private messages gain their own runtime, and every column an author writes into is wide enough for what the editor is allowed to produce. Three schema paths — fresh install, 6.2 upgrade and the deployed patch — now agree column for column and index for index.

Core changes:

1. Trust boundary and tag policy (core/security.php, core/classes/parser.php):

2. filterTrustedTags() becomes the single authority over [usehtml] and [usephp]

   • both tags are reserved for the super administrator and stripped for everyone else
   • filterText() and filterHtml() pass the capability, comments and messages never do

3. the pipeline runs filterCode() before filterBbBlocks(), so a documented example is quoted rather than executed

4. a breaks format renders a single newline as a line break without touching authored text

5. the persistent parse cache moves from the news module into the parser and keys on the configuration hash

6. Comment runtime (core/classes/comment.php, core/user.php):

7. format, iphash and the materialised path are gone; branches resolve through recursive CTEs over pid, and tombstones survive by an upward keep walk

8. reqkey is BINARY(16) under a unique index, so a repeated submit returns the first row instead of writing a second

9. the flood window reads (ip, time, id) and the edit mark reaches the rendered view
10. Private messages (core/classes/privat.php):

11. four independent states replace one overloaded status column, with a single owner per side and no shared flag between inbox and outbox

12. Room for embedded images (setup/sql/*.sql):

13. fifteen columns that hold an authored text widen to MEDIUMTEXT

    • EMBEDMAX allows 65536 bytes of binary, which is 87384 characters of base64 before the

data URI prefix, while TEXT holds 65535

• with STRICT_TRANS_TABLES the overflow is a lost post, not a lost image

• the summary columns stay TEXT on purpose, because a list query draws twenty of them onto one page and an image referenced by address still fits there in a few dozen characters

• users.sig moves from VARCHAR(255) to TEXT: of 828 stored signatures the longest is exactly 255 and 95 sit above 240

• Deployment and tooling (setup/sql/update6_3_patch.sql, setup/sql/update6_3_text_once.sql):

• one idempotent patch carries a deployed 6.3 to full parity, including the mail queue and the campaign columns it never received

• a one-time text repair normalises stored break markup and entities in comment and message bodies, ordered so that authored text is never mistaken for writer output

• the address policy, the upload rule reader and getImgText() stop guessing the module and take it explicitly

Benefits:

• an author capability decides what may be written, and the escaping policy decides how it is rendered; neither can be reached through the other

• a repeated submit, a lost connection or a double click can no longer duplicate a comment
• a branch and its tombstones are answered by one query instead of a maintained path column
• an embedded image can no longer end a post with ERROR 1406
• fresh install, upgrade and patch produce the same 38 tables, 494 columns and 172 indexes

Technical notes:

• reqkey is stored as raw bytes; the query interpolator renders non-UTF-8 values as 0x hex

• comment.body, privat.body and thirteen further columns are MEDIUMTEXT; intro columns, users.block and order.info stay TEXT

• update6_3_patch.sql and update6_3_text_once.sql are both idempotent and safe to re-run

• deployment order: files, update6_3_patch.sql, update6_3_text_once.sql, then clear storage/cache/pages

• no breaking change for stored content: every existing body renders unchanged

Steps 9 and 10 of docs/PRIVAT-2026.md still recorded themselves as uncommitted after cfa91cb8 shipped them. The progress table is what a session reads to decide where the work stands, so a stale evidence line there is a wrong answer to the next question asked of it.

Core changes:

1. Progress table (docs/PRIVAT-2026.md):

2. rows 9 and 10 open with the commit that carries them instead of "Not committed"

   • row 9 is the format column in all three update channels
   • row 10 is tools/privat-migrate.php with its probe and its test

Benefits:

• the plan reads the same on every machine that pulls it, which is what makes the migration resumable across sessions

Technical notes:

• documentation only, no code, schema or behavior touched

Stage 1 of docs/PRIVAT-2026.md. The procedural private-message subsystem becomes one Privat class, and the single status column both participants shared becomes four independent state columns, so what one of them saves or deletes no longer rewrites what the other one sees. Every frontend, block, profile and admin caller moves in the same change; no compatibility wrapper, schema detection or dual schema fallback is left behind.

Core changes:

1. Storage model in all three update channels (setup/sql/):

2. status becomes viewed, and saved, delin and delout join it as own columns

   • the backfill reads status through the new runifcol() guard before rencol()

consumes it, so the step disappears by itself once the rename has happened

• modcol() forces viewed onto TINYINT UNSIGNED NOT NULL DEFAULT 0, which a bare

rename cannot do: it keeps the BOOLEAN a column storing 2 was declared as

• the single-column keys uidin, uidout and status give way to five composites

  • in_box, in_new and out_box serve the mailboxes, their counts and their quotas
  • out_new and flood were added on measured plans, not on expectation: the

outgoing unread badge was a full table scan and the send interval a filesort

• update6_3_patch.sql gains section 5, so an installation already running 6.3 is not left behind by a release whose runtime code reads the new columns

• the stale addidx on status is deleted: the same file created and then dropped it
• The subsystem (core/classes/privat.php, core/system.php):

• final class Privat owns every read and write of the table, built beside Comment

  • every mailbox predicate is written once, so a list, its counter and its quota

can never disagree, and no caller restates a state column

• every mutation is transactional and authorizes itself through the detail

predicate of the side that asked; one foreign id refuses the whole batch

• addMessage() answers ['id' => int, 'error' => string] from a closed code set

  • the id is getSqlLastId(), not the newest row of the table, which under a

concurrent send put a foreign message id in the notification link

• both accounts are locked in one statement ascending by id, and the interval

and both quotas are read behind that lock

• the recipient is resolved before the transaction opens, because the first

plain read of a transaction fixes the snapshot every later one answers from

• a deadlock or a lock timeout is retried once, and only for a send that owns

its transaction

1. Mailboxes and routes (core/user.php, index.php, modules/account/index.php, blocks/user_info.php):

2. reads are GET routes that carry no token, mutations are POST with the token in the body; save and delete no longer travel as credentials in an address

3. opening a message is what marks it read, so that one is POST and CSRF checked

4. one mutation route serves a row action and a bulk action alike; inbox, saved and outbox gained read, unread, save and delete over a selection

5. only the opening mailbox is rendered, the other tabs are fetched on click

6. the detail view resolves the counterpart, so the outbox shows the sender the recipient's profile instead of their own

7. the session counter cache is gone: both sidebar badges are counted per render

8. Administrator panel and account deletion (core/admin.php, admin/modules/ privat.php, admin/index.php, modules/account/admin/index.php, core/system.php):

9. the admin list reads the class, pages from the same numbers its rows came from and renders the five derived states as labelled chips

10. the duplicate go=5 delete route is deleted rather than re-secured; one POST handler remains behind checkAdminPost('privat') and the existing isAdmin(true)

11. both paths that delete a user row now clean the mailboxes in the same transaction, and the counterpart keeps a readable copy of an anonymous account

12. the private-message branch of ad_status() is gone with the column it rendered
13. Templates and language (templates/lite/, lang/):

14. table, table-row, content-list, block-content and inline-badge gained the check column, the bulk slot and the state flags; theme.css owns their styling

15. six new PRIVAT constants in all six locales, none of them a scoped duplicate
16. Verification (tests/):

17. PrivatMigrationTest drives both upgrade channels through states A to D in a disposable schema and holds every one of them to the fresh definition

18. PrivatClassTest holds the predicates, the limits, the independence of the two sides, the bounded bulk actions and two real concurrent sends

19. SchemaUpdateValidationTest reads modcol declarations and both channels

Benefits:

• one owner of the table, one place a mailbox rule can be wrong

• sender and recipient states are independent, which is what the old model could not express at all

• concurrent sends cannot both take the last free place of a mailbox

• fresh install, 6.2 upgrade and 6.3 patch end on the same table, and each is safe to run twice

Technical notes:

• the schema section and the runtime code of this release are deployed together: either half alone answers an SQL error on every private-message page

• behavior changes, each intended: a sender may delete a message already read, a saved message stays in the sender's outbox, one participant's delete leaves the other's copy, read and unread are two actions, and a send is refused when the recipient's saved folder is full and not only their inbox

• the notification preference is psmail, the setting the profile form has always offered and which had no effect while the code read the forum preference fsmail

• docs/VERSIONS.md carries the dated entry with the channel table
• docs/PRIVAT-2026.md stays: stage 2, the content contract, is not started
• stored titles and bodies keep their current encoding contract until then

Batches 8, 9 and 10 of docs/UPLOAD-2026.md: admin upload moves onto the Upload class and the procedural pipeline is deleted, the 2026 format set goes live across every configuration and render path, and the final sweep proves nothing legacy survived. Two audits of that sweep are folded in, each of which found real defects rather than style.

Core changes:

1. Admin upload and settings (admin/modules/uploads.php, config/uploads.php):

2. uploadsave() publishes local first and remote second through the class

   • every limit comes from the all record, nothing is hardcoded at the call site
   • the all record carries 104857600 bytes and 1600x1600 to match

3. configsave() validates extensions against Upload::getSupportedTypes()

   • an unsupported extension is dropped, reported and never stored as enabled
   • both extension fields show the supported list as a hint
4. upload(), check_file() and check_size() are gone with their last caller
5. The 2026 format set (config/uploads.php, config/filetype.php, config/files.php):

6. the canonical 21 formats replace the old 26

   • ten formats withdrawn, each on its own evidence, two spellings corrected
   • modules gain only webp and avif; the full set reaches typ and the all record

7. config/filetype.php becomes five family templates over 21 keys

   • audio renders through audio, video through video, pdf through object
   • the dead screens class is gone and the lightbox binds to sl-attach
8. Upload class hardening (core/classes/upload.php):

9. images must decode, not merely parse a header

   • a truncated png passed getimagesize() and was published before this
   • a missing decoder answers unsupported instead of passing the file through
10. the remote write callback rejects a short write instead of counting it whole
11. the address policy blocks every IPv6 range IANA marks as not globally reachable
12. the class owned naming grammar is matched at its fixed salt length
13. Configuration writer (core/system.php, setup/index.php):

14. a value whose line would pass 180 characters is written as a concatenation

    • the split is deterministic, so an unchanged save round trips byte for byte
    • the installer copy follows, or a fresh install would write a different file
15. Verification (tests/, tools/upload-route-check.php):

16. UploadIntegrationTest drives the resolver and the accessor against real config

    • all fourteen module records survive resolve and serialize byte for byte
    • the five adapters are held to the ordering rule of the plan

17. tools/upload-route-check.php walks 47 rows of the route matrix over real HTTP

    • credentials come from the environment, TLS verification is on by default
    • every scenario compares tree and database around itself and cleans up

Benefits:

• one publication primitive, one rule parser, one type policy, one lock location
• every publishing flow validates by content rather than by extension alone
• the acceptance of the plan is reproducible from the repository, not by hand

Technical notes:

• ext-gd joins ext-curl and ext-fileinfo in the composer require block

• behavior changes: content stored with a withdrawn format renders as a plain link, a guest no longer sees historical files in the editor panel, and a build without a GD decoder refuses that image format instead of accepting it

• nine other configuration files still hold over-long lines and will be rewritten in the wrapped format the first time each is saved from its own settings tab

• stored reference formats are unchanged: avatar filenames, project relative _files.url values and the editor JSON shape all keep their existing contracts

• setContentActive() still runs before the checked UPDATE of the admin files handler; that ordering predates this migration and is left to its own task

Batches 6 and 7 of docs/UPLOAD-2026.md. Every remaining visitor-facing publisher now reaches the filesystem through Upload::addUploadedFile() after its own method, token and business checks have passed, so a preview, a refused form or a failed row write can no longer leave a file nobody references.

Core changes:

1. Account avatar (modules/account/index.php):

2. saveavatar() gates the whole operation behind POST and the account token

   • the old line validated the token only when op arrived in the POST body,

so GET ?op=saveavatar&avatar=<preset> wrote users.avatar with no token

• the preset branch now sits inside that gate and still calls no upload

• the upload publishes through the class and stores the returned filename

  • the rule is built from the $conf['users'] avatar keys, maxquota 0
  • adirectory loses exactly one leading uploads/ before it is passed on
• a failed profile write deletes the exact path this request published
• Avatar preset grid (templates/lite/fragments/table-row.html, theme.css):
• the is_avatar_link branch gained a form/button variant keyed on action

• sl-avatar-link moved from the anchor onto the form and got the two rules that strip the button chrome; line-height: 0 keeps the row height intact

• Frontend file module (modules/files/index.php):

• send() calls the class only when the save passed every check

  • a file counts as submitted when its error is not UPLOAD_ERR_NO_FILE
  • a refused file no longer falls back to the typed external URL
  • the gate also reads $conf['files']['upload'], which the old code ignored
• the row write is checked and compensated against the returned path
• Admin file module (modules/files/admin/index.php):

• save() publishes straight into the selected path field, else the configured one, so the publish-then-rename branch no longer runs for a new upload

  • relocation of an already stored file with no new upload is unchanged
  • preview and delete publish nothing at all now

• both row writes are checked; a failure deletes the published path and logs a stranded file through Logger::addFile()

• Plan record (docs/UPLOAD-2026.md):

• last completed batch, the decisions of batches 6 and 7, and what the route tests actually proved on the stand

Benefits:

• no upload path can publish before authorization, CSRF and validation pass
• stored size and path come from the class instead of a probed request path
• one publication primitive, lock-guarded and collision-free, for five flows
• the admin file handler writes each file exactly once

Technical notes:

• stored reference formats are unchanged: users.avatar keeps the filename only and _files.url keeps the project-relative uploads/<dir>/<file> shape

• Breaking: avatar presets are POST-only now, so a bookmarked GET link that set a preset stops working

• Breaking: an operator publishing through the frontend file form no longer gets a name without an owner suffix; the flow stores the user id or 0

• config/files.php still lists gzip, which the type map does not know, so a .gzip upload is refused until batch 9 corrects the spelling to gz

• admin upload and the format switch are untouched; upload(), check_file() and check_size() stay until batch 8 removes their last caller