Stages 4 through 7 of docs/FILE-MANAGER-CONCEPT-2026.md close together: the system area can be edited and rewritten under one lock protocol, the upload catalogue and the editor window are both drawn from the same descriptor, and every changing action of either screen travels by POST with a token and leaves an entry in the journal behind it.

Core changes:

1. Source editor of the system area (core/classes/filemanager.php, admin/modules/uploads.php):

2. getFileBody() and setFileBody() read and replace the body of one text file

   • the version is the digest of the bytes on disk and is compared inside the directory lock
   • a mismatch answers 409, writes nothing and hands the fresh version back to the author
   • the line separator is taken from the file, so a save never rewrites every line of it
3. fmedit() and fmsave() put the editor in the place of the list while the tree stays
4. the guard of an unsaved edit reaches htmx swaps, links and beforeunload alike
5. Writing operations of the system area (core/classes/filemanager.php, admin/modules/uploads.php):

6. addFileEntry(), addDirectory(), updateFileName(), addFileCopy(), updateFilePath(), deleteFileEntry(), addFileArchive() and addFilesArchive()

   • both sides of a compound path are asked of the policy separately
   • two directories are locked in sorted order, so two writers never wait on each other
   • a name already taken is refused inside the lock, where the answer is still current
7. one form of the browser carries the argument of a rename, a copy and a move
8. Catalogue of the administration (core/admin.php, admin/modules/uploads.php, templates/admin/*):

9. the whole upload tree is browsed with the rights of an administrator: tree, crumbs, rows and tiles, properties, fan, marks, bulk bar, gallery, upload queue and pager

10. deletion and archiving left their GET links for POST routes of the module
11. the server path moved out of the heading of the section into a property of the object
12. Window of the editor (plugins/editors/toastui/, templates/lite|admin/partials/):
13. editorFiles answers the descriptor of the file layer together with capabilities and quota
14. getEditorRouteRule() asks the three questions every route of go=4 asks
15. editorDelete and editorArchive hand a module moderator the two operations section 14 named

16. the window follows the approved mock-up: a rail of insertion ways, sections that state the rights they were given, compact and expanded catalogue, filter, fan, marks, gallery and an upload queue, with the five states of the process each carrying its own words

17. Language constants (lang/{locale}.php, admin/lang/{locale}.php):
18. EDITOR for the window and UPLOADS for the catalogue, in all six locales
19. _RETRY becomes a global constant and its scoped copy is dropped

Benefits:

• one file layer answers three screens, so a path, a name and a lock are decided in one place
• a permission is read off the descriptor of the object instead of a role derived in the client
• every changing action is a POST with a token and an entry in storage/logs/error_file.log
• the two themes carry the same components under the same names

Technical notes:

• new routes: index.php go=4 editorDelete and editorArchive; the contract of editorUpload and editorFiles is otherwise unchanged and their token now travels in the body

• the JSON of the editor never carries an absolute server path; only the administrative context receives realpath, and it is shown in the properties of the selected object

• getEditorImageData() is gone together with the row it used to build; the one list of embeddable types is read from Parser::EMBEDIMG by the editor driver

• _UPLOADS_RETRY is removed in favour of the global _RETRY
• no schema change, no configuration change, backward compatible

The file manager concept becomes an implementation plan: every stage carries its own reading map, acceptance rule and stop condition, so one session opens the document, reads its stage and works. The mockups both screens are built from are committed beside it, and the theme gaps found while building them are closed in the themes rather than patched in the mockups.

Core changes:

1. Implementation plan (docs/FILE-MANAGER-CONCEPT-2026.md):

2. The document turns from a concept into a plan of ten stages

   • Every stage names why it comes now, what to do, how to verify, what to

commit and when to stop and ask

• Every stage carries a reading map: the plan sections, the source files with

line numbers and the tests it needs, so a session reads about 500 lines
instead of the whole document

• Stage 2 is split: 2a builds the class, 2b moves the managed name and the

lock out of Upload and migrates both callers

• The FileManager contract is renamed to the project rule

  • getFileList, getFileData, getFileBody, setFileBody, addFileEntry,

addDirectory, deleteFileEntry, updateFileName, addFileCopy, updateFilePath,
addFileArchive, getFileOwner, checkFileAccess, isFileEditable

• list, stat, read and write are refused as names: none of them passes the

verb plus noun rule and half are taken by PHP itself

• Three mechanisms are described once and shared by both screens: the sl-dial action fan, the sl-modal preview gallery, and the checkbox selection with its bulk bar

• The save protocol takes the lock around the whole compare and replace, because a version check beside the lock protects nothing

• The path policy answers per operation instead of hiding entries from a listing, and rename, copy and move check both sides of the path

• System files gain their own download route: a direct link would let the server execute index.php instead of handing it over

• Language constants go to UPLOADS and EDITOR, each matching its own configuration namespace

• Editor uploads plan (docs/EDITOR-UPLOADS-2026.md):

• The plan is closed: the editor mode of tools/upload-route-check.php was walked against a live stand with every row passing

  • The access matrix of four settings combinations against three roles
  • The guest isolation of two sessions
  • The write guard over real HTTP

• The walk needs two accounts and not four: is_moder() reads the admin session only, so one account answers as moderator in one cookie jar and as a member in the other

• Admin theme (templates/admin/assets/css/theme.css):

• sl-but-mini drops the browser chrome that drew a second border over its round fill, as the lite theme already did

• sl-is-muted, the disabled state, sl-bulk-bar and sl-bulk-count arrive under the names they already carry in lite

• sl-modal-wide and sl-modal-image arrive so a gallery has a frame to open in
• A selected table row is now distinguishable from a hovered one
• Lite theme (templates/lite/assets/css/theme.css):
• sl-bulk-count joins sl-bulk-bar under the name the admin theme uses
• Approved mockups (demo/filemanager-*.html):

• filemanager-v2-rail.html is the editor window: a side rail of three insert ways, the module storage, four permission scenarios, the action fan, the gallery and multiple selection

• filemanager-admin-2026.html is the admin full mode: file catalogue and system files on one shell, built from existing theme components

• Eight earlier variants are kept as the record of why the rail was chosen

Benefits:

• A session can work on one stage without reading the whole plan

• The mockups are a working reference, not a picture: they use production classes, so moving them into code is mechanical

• The two themes now carry the same component set under the same names, which removes the need to redefine anything locally

Technical notes:

• No PHP was touched; the file manager itself is not implemented yet

• The theme additions are new rules only, no existing selector changed its meaning, verified against the live admin and front pages

• The next stage is 1: the loading and error states in the mockups

The parser decides escaping from a trust boundary instead of a stored flag, comments and private messages gain their own runtime, and every column an author writes into is wide enough for what the editor is allowed to produce. Three schema paths — fresh install, 6.2 upgrade and the deployed patch — now agree column for column and index for index.

Core changes:

1. Trust boundary and tag policy (core/security.php, core/classes/parser.php):

2. filterTrustedTags() becomes the single authority over [usehtml] and [usephp]

   • both tags are reserved for the super administrator and stripped for everyone else
   • filterText() and filterHtml() pass the capability, comments and messages never do

3. the pipeline runs filterCode() before filterBbBlocks(), so a documented example is quoted rather than executed

4. a breaks format renders a single newline as a line break without touching authored text

5. the persistent parse cache moves from the news module into the parser and keys on the configuration hash

6. Comment runtime (core/classes/comment.php, core/user.php):

7. format, iphash and the materialised path are gone; branches resolve through recursive CTEs over pid, and tombstones survive by an upward keep walk

8. reqkey is BINARY(16) under a unique index, so a repeated submit returns the first row instead of writing a second

9. the flood window reads (ip, time, id) and the edit mark reaches the rendered view
10. Private messages (core/classes/privat.php):

11. four independent states replace one overloaded status column, with a single owner per side and no shared flag between inbox and outbox

12. Room for embedded images (setup/sql/*.sql):

13. fifteen columns that hold an authored text widen to MEDIUMTEXT

    • EMBEDMAX allows 65536 bytes of binary, which is 87384 characters of base64 before the

data URI prefix, while TEXT holds 65535

• with STRICT_TRANS_TABLES the overflow is a lost post, not a lost image

• the summary columns stay TEXT on purpose, because a list query draws twenty of them onto one page and an image referenced by address still fits there in a few dozen characters

• users.sig moves from VARCHAR(255) to TEXT: of 828 stored signatures the longest is exactly 255 and 95 sit above 240

• Deployment and tooling (setup/sql/update6_3_patch.sql, setup/sql/update6_3_text_once.sql):

• one idempotent patch carries a deployed 6.3 to full parity, including the mail queue and the campaign columns it never received

• a one-time text repair normalises stored break markup and entities in comment and message bodies, ordered so that authored text is never mistaken for writer output

• the address policy, the upload rule reader and getImgText() stop guessing the module and take it explicitly

Benefits:

• an author capability decides what may be written, and the escaping policy decides how it is rendered; neither can be reached through the other

• a repeated submit, a lost connection or a double click can no longer duplicate a comment
• a branch and its tombstones are answered by one query instead of a maintained path column
• an embedded image can no longer end a post with ERROR 1406
• fresh install, upgrade and patch produce the same 38 tables, 494 columns and 172 indexes

Technical notes:

• reqkey is stored as raw bytes; the query interpolator renders non-UTF-8 values as 0x hex

• comment.body, privat.body and thirteen further columns are MEDIUMTEXT; intro columns, users.block and order.info stay TEXT

• update6_3_patch.sql and update6_3_text_once.sql are both idempotent and safe to re-run

• deployment order: files, update6_3_patch.sql, update6_3_text_once.sql, then clear storage/cache/pages

• no breaking change for stored content: every existing body renders unchanged

Steps 9 and 10 of docs/PRIVAT-2026.md still recorded themselves as uncommitted after cfa91cb8 shipped them. The progress table is what a session reads to decide where the work stands, so a stale evidence line there is a wrong answer to the next question asked of it.

Core changes:

1. Progress table (docs/PRIVAT-2026.md):

2. rows 9 and 10 open with the commit that carries them instead of "Not committed"

   • row 9 is the format column in all three update channels
   • row 10 is tools/privat-migrate.php with its probe and its test

Benefits:

• the plan reads the same on every machine that pulls it, which is what makes the migration resumable across sessions

Technical notes:

• documentation only, no code, schema or behavior touched

Stage 1 of docs/PRIVAT-2026.md. The procedural private-message subsystem becomes one Privat class, and the single status column both participants shared becomes four independent state columns, so what one of them saves or deletes no longer rewrites what the other one sees. Every frontend, block, profile and admin caller moves in the same change; no compatibility wrapper, schema detection or dual schema fallback is left behind.

Core changes:

1. Storage model in all three update channels (setup/sql/):

2. status becomes viewed, and saved, delin and delout join it as own columns

   • the backfill reads status through the new runifcol() guard before rencol()

consumes it, so the step disappears by itself once the rename has happened

• modcol() forces viewed onto TINYINT UNSIGNED NOT NULL DEFAULT 0, which a bare

rename cannot do: it keeps the BOOLEAN a column storing 2 was declared as

• the single-column keys uidin, uidout and status give way to five composites

  • in_box, in_new and out_box serve the mailboxes, their counts and their quotas
  • out_new and flood were added on measured plans, not on expectation: the

outgoing unread badge was a full table scan and the send interval a filesort

• update6_3_patch.sql gains section 5, so an installation already running 6.3 is not left behind by a release whose runtime code reads the new columns

• the stale addidx on status is deleted: the same file created and then dropped it
• The subsystem (core/classes/privat.php, core/system.php):

• final class Privat owns every read and write of the table, built beside Comment

  • every mailbox predicate is written once, so a list, its counter and its quota

can never disagree, and no caller restates a state column

• every mutation is transactional and authorizes itself through the detail

predicate of the side that asked; one foreign id refuses the whole batch

• addMessage() answers ['id' => int, 'error' => string] from a closed code set

  • the id is getSqlLastId(), not the newest row of the table, which under a

concurrent send put a foreign message id in the notification link

• both accounts are locked in one statement ascending by id, and the interval

and both quotas are read behind that lock

• the recipient is resolved before the transaction opens, because the first

plain read of a transaction fixes the snapshot every later one answers from

• a deadlock or a lock timeout is retried once, and only for a send that owns

its transaction

1. Mailboxes and routes (core/user.php, index.php, modules/account/index.php, blocks/user_info.php):

2. reads are GET routes that carry no token, mutations are POST with the token in the body; save and delete no longer travel as credentials in an address

3. opening a message is what marks it read, so that one is POST and CSRF checked

4. one mutation route serves a row action and a bulk action alike; inbox, saved and outbox gained read, unread, save and delete over a selection

5. only the opening mailbox is rendered, the other tabs are fetched on click

6. the detail view resolves the counterpart, so the outbox shows the sender the recipient's profile instead of their own

7. the session counter cache is gone: both sidebar badges are counted per render

8. Administrator panel and account deletion (core/admin.php, admin/modules/ privat.php, admin/index.php, modules/account/admin/index.php, core/system.php):

9. the admin list reads the class, pages from the same numbers its rows came from and renders the five derived states as labelled chips

10. the duplicate go=5 delete route is deleted rather than re-secured; one POST handler remains behind checkAdminPost('privat') and the existing isAdmin(true)

11. both paths that delete a user row now clean the mailboxes in the same transaction, and the counterpart keeps a readable copy of an anonymous account

12. the private-message branch of ad_status() is gone with the column it rendered
13. Templates and language (templates/lite/, lang/):

14. table, table-row, content-list, block-content and inline-badge gained the check column, the bulk slot and the state flags; theme.css owns their styling

15. six new PRIVAT constants in all six locales, none of them a scoped duplicate
16. Verification (tests/):

17. PrivatMigrationTest drives both upgrade channels through states A to D in a disposable schema and holds every one of them to the fresh definition

18. PrivatClassTest holds the predicates, the limits, the independence of the two sides, the bounded bulk actions and two real concurrent sends

19. SchemaUpdateValidationTest reads modcol declarations and both channels

Benefits:

• one owner of the table, one place a mailbox rule can be wrong

• sender and recipient states are independent, which is what the old model could not express at all

• concurrent sends cannot both take the last free place of a mailbox

• fresh install, 6.2 upgrade and 6.3 patch end on the same table, and each is safe to run twice

Technical notes:

• the schema section and the runtime code of this release are deployed together: either half alone answers an SQL error on every private-message page

• behavior changes, each intended: a sender may delete a message already read, a saved message stays in the sender's outbox, one participant's delete leaves the other's copy, read and unread are two actions, and a send is refused when the recipient's saved folder is full and not only their inbox

• the notification preference is psmail, the setting the profile form has always offered and which had no effect while the code read the forum preference fsmail

• docs/VERSIONS.md carries the dated entry with the channel table
• docs/PRIVAT-2026.md stays: stage 2, the content contract, is not started
• stored titles and bodies keep their current encoding contract until then