Every writer in the project emitted PHP_EOL, so the same code produced CRLF on a Windows host and LF on a Linux one - in JSON log records, in generated PHP files and in the configuration the installer writes. All of them now emit "\n", and CRLF is produced only where a protocol requires it. The two hand-repair SQL files are gone with everything that referenced them.

Core changes:

1. Log writers emit LF (core/classes/logger.php, admin/modules/database.php, core/security.php, core/system.php):

2. The JSONL record terminator of all six channels, database.log, log.log and days.log

   • A record separator that depends on the host makes one machine format two ways
   • The reader was already tolerant, splitting on any break, so no stored log breaks
3. Generated files emit LF (setup/index.php, admin/modules/lang.php, admin/modules/editor.php, admin/modules/blocks.php):

4. The installer carried its own copy of setConfigFile() and wrote the same config files with CRLF

   • A configuration file therefore ended up mixed, depending on whether the installer or the panel touched it last
5. Language files, block files, editor templates and robots.txt follow the same rule
6. The block generator loses the hardcoded CRLF around its heredoc marker, which also removes a parser risk
7. The admin IP filter stops missing a break (admin/modules/security.php):
8. strtr() stripped PHP_EOL and therefore missed a lone LF on Linux and a lone CR on Windows
9. It now strips CR, LF and space, so the stored list cannot carry a stray break on either host
10. Mail bodies and assembled text emit LF (core/classes/mail.php, core/security.php, admin/modules/*, modules/help):
11. The SMTP transport already normalises a body to CRLF before the dialogue, so that boundary is the only place CRLF belongs
12. The retired repair files leave the tree (setup/sql/, docs/VERSIONS.md, tests/):
13. update6_3_patch.sql and update6_3_text_once.sql are gone, and nothing references them any more
14. The upgrade matrix drops to two rows, the hand-patch section and its recount route are removed
15. The splitter scenario moves onto the shipped upgrade channel instead of the deleted file
16. The privat probe drives one channel, and its expectation follows

Benefits:

• A log, a generated file and a configuration read the same on every host the project runs on
• One rule instead of a per-call-site choice: LF inside the application, CRLF only at the protocol boundary
• The suite covers seven scenarios that were silently skipping on the missing files

Technical notes:

• Existing logs stay mixed; old CRLF records are still read, because the reader splits on any break
• A raw editor file written by the previous code on Windows shows its guard prefix once, and the first save repairs it
• No schema change, no route contract change, and no compatibility layer for the removed files

The editor windows are moved by their whole head and show the handle where a hand looks for one, the upload preferences stop hiding half of themselves behind a sub-tab, and the documentation of the section is written against the screens as they are. The one writing route that reached the disk without a record now leaves one behind.

Core changes:

1. Head of the editor windows (templates/{admin,lite}/partials/editor-toastui-*.html, plugins/editors/toastui/assets/editor-upload.js, templates/{admin,lite}/assets/editors/toastui/skin.css):

2. The whole plate of the head carries the window, under the left button alone

   • A button of the head keeps its own press, so closing still closes and expanding expands
   • An expanded window hides the handle and drops the cursor: it has nowhere left to move

3. The handle moved to the right beside the other two buttons and became a grip

   • The computed styles of the three icons were compared first: no overlay and no filter
   • arrows-move draws four arrows and a crossing at sixteen pixels and reads as a blot
4. Hovering paints the button in a system tone by the chip formula: green, blue, red
5. The caption carries the icon of the button that opens the window, in the folder family
6. Upload preferences on one page (admin/modules/uploads.php):

7. The sub-tabs are gone: the general block and the module blocks stand in the one form they always shared, under the one save button they always had

8. The directory picker is drawn on the catalogue alone, which is the screen it navigates

   • getUploadsSearch() loses the argument it never received and the dead branch behind it
9. Captions that name what a field does (admin/lang/{locale}.php, lang/{locale}.php):

10. The general block speaks of attachments and their output template, not of applications

    • The width and the height name the placeholder they are substituted into
11. The note of the link section of the rail matches its neighbours in length and in ending
12. Journal of the editor upload (core/system.php):

13. addEditorUpload() writes one record per submitted file, as the two other routes of the window already did for deletion and packing

    • A refusal is recorded with the reason the upload service answered
    • Until now this was the one route of the project that stored a file and left no trace
14. Documentation of the section (admin/info/uploads/ru.md):

15. Rewritten against the screens: the system files tab it never described, the desk conveniences, the policy of closed paths, the source editor and the window of the editor

16. The removed sub-tabs, the retired setting and the paginator leave the text with them
17. The opening names the tabs in one sentence, the way the newest help documents do

Benefits:

• A window says by its cursor and its handle exactly what it can do, and hides both where it cannot do it

• One page of preferences instead of two panels behind a switch nobody needed
• A caption that names its own effect instead of a word that means nothing here
• Every route that puts a file on the disk can be accounted for afterwards

Technical notes:

• No schema change, no configuration change and no route contract changed
• tests/Unit/FileManagerCatalogTest.php gains the journal of the editor upload

• uploads/files/files-WGVl13gb5m-7885.png is a test image found in the working tree; it is committed with the set because the tree is committed whole and may be removed

Stages 4 through 7 of docs/FILE-MANAGER-CONCEPT-2026.md close together: the system area can be edited and rewritten under one lock protocol, the upload catalogue and the editor window are both drawn from the same descriptor, and every changing action of either screen travels by POST with a token and leaves an entry in the journal behind it.

Core changes:

1. Source editor of the system area (core/classes/filemanager.php, admin/modules/uploads.php):

2. getFileBody() and setFileBody() read and replace the body of one text file

   • the version is the digest of the bytes on disk and is compared inside the directory lock
   • a mismatch answers 409, writes nothing and hands the fresh version back to the author
   • the line separator is taken from the file, so a save never rewrites every line of it
3. fmedit() and fmsave() put the editor in the place of the list while the tree stays
4. the guard of an unsaved edit reaches htmx swaps, links and beforeunload alike
5. Writing operations of the system area (core/classes/filemanager.php, admin/modules/uploads.php):

6. addFileEntry(), addDirectory(), updateFileName(), addFileCopy(), updateFilePath(), deleteFileEntry(), addFileArchive() and addFilesArchive()

   • both sides of a compound path are asked of the policy separately
   • two directories are locked in sorted order, so two writers never wait on each other
   • a name already taken is refused inside the lock, where the answer is still current
7. one form of the browser carries the argument of a rename, a copy and a move
8. Catalogue of the administration (core/admin.php, admin/modules/uploads.php, templates/admin/*):

9. the whole upload tree is browsed with the rights of an administrator: tree, crumbs, rows and tiles, properties, fan, marks, bulk bar, gallery, upload queue and pager

10. deletion and archiving left their GET links for POST routes of the module
11. the server path moved out of the heading of the section into a property of the object
12. Window of the editor (plugins/editors/toastui/, templates/lite|admin/partials/):
13. editorFiles answers the descriptor of the file layer together with capabilities and quota
14. getEditorRouteRule() asks the three questions every route of go=4 asks
15. editorDelete and editorArchive hand a module moderator the two operations section 14 named

16. the window follows the approved mock-up: a rail of insertion ways, sections that state the rights they were given, compact and expanded catalogue, filter, fan, marks, gallery and an upload queue, with the five states of the process each carrying its own words

17. Language constants (lang/{locale}.php, admin/lang/{locale}.php):
18. EDITOR for the window and UPLOADS for the catalogue, in all six locales
19. _RETRY becomes a global constant and its scoped copy is dropped

Benefits:

• one file layer answers three screens, so a path, a name and a lock are decided in one place
• a permission is read off the descriptor of the object instead of a role derived in the client
• every changing action is a POST with a token and an entry in storage/logs/error_file.log
• the two themes carry the same components under the same names

Technical notes:

• new routes: index.php go=4 editorDelete and editorArchive; the contract of editorUpload and editorFiles is otherwise unchanged and their token now travels in the body

• the JSON of the editor never carries an absolute server path; only the administrative context receives realpath, and it is shown in the properties of the selected object

• getEditorImageData() is gone together with the row it used to build; the one list of embeddable types is read from Parser::EMBEDIMG by the editor driver

• _UPLOADS_RETRY is removed in favour of the global _RETRY
• no schema change, no configuration change, backward compatible

The file manager concept becomes an implementation plan: every stage carries its own reading map, acceptance rule and stop condition, so one session opens the document, reads its stage and works. The mockups both screens are built from are committed beside it, and the theme gaps found while building them are closed in the themes rather than patched in the mockups.

Core changes:

1. Implementation plan (docs/FILE-MANAGER-CONCEPT-2026.md):

2. The document turns from a concept into a plan of ten stages

   • Every stage names why it comes now, what to do, how to verify, what to

commit and when to stop and ask

• Every stage carries a reading map: the plan sections, the source files with

line numbers and the tests it needs, so a session reads about 500 lines
instead of the whole document

• Stage 2 is split: 2a builds the class, 2b moves the managed name and the

lock out of Upload and migrates both callers

• The FileManager contract is renamed to the project rule

  • getFileList, getFileData, getFileBody, setFileBody, addFileEntry,

addDirectory, deleteFileEntry, updateFileName, addFileCopy, updateFilePath,
addFileArchive, getFileOwner, checkFileAccess, isFileEditable

• list, stat, read and write are refused as names: none of them passes the

verb plus noun rule and half are taken by PHP itself

• Three mechanisms are described once and shared by both screens: the sl-dial action fan, the sl-modal preview gallery, and the checkbox selection with its bulk bar

• The save protocol takes the lock around the whole compare and replace, because a version check beside the lock protects nothing

• The path policy answers per operation instead of hiding entries from a listing, and rename, copy and move check both sides of the path

• System files gain their own download route: a direct link would let the server execute index.php instead of handing it over

• Language constants go to UPLOADS and EDITOR, each matching its own configuration namespace

• Editor uploads plan (docs/EDITOR-UPLOADS-2026.md):

• The plan is closed: the editor mode of tools/upload-route-check.php was walked against a live stand with every row passing

  • The access matrix of four settings combinations against three roles
  • The guest isolation of two sessions
  • The write guard over real HTTP

• The walk needs two accounts and not four: is_moder() reads the admin session only, so one account answers as moderator in one cookie jar and as a member in the other

• Admin theme (templates/admin/assets/css/theme.css):

• sl-but-mini drops the browser chrome that drew a second border over its round fill, as the lite theme already did

• sl-is-muted, the disabled state, sl-bulk-bar and sl-bulk-count arrive under the names they already carry in lite

• sl-modal-wide and sl-modal-image arrive so a gallery has a frame to open in
• A selected table row is now distinguishable from a hovered one
• Lite theme (templates/lite/assets/css/theme.css):
• sl-bulk-count joins sl-bulk-bar under the name the admin theme uses
• Approved mockups (demo/filemanager-*.html):

• filemanager-v2-rail.html is the editor window: a side rail of three insert ways, the module storage, four permission scenarios, the action fan, the gallery and multiple selection

• filemanager-admin-2026.html is the admin full mode: file catalogue and system files on one shell, built from existing theme components

• Eight earlier variants are kept as the record of why the rail was chosen

Benefits:

• A session can work on one stage without reading the whole plan

• The mockups are a working reference, not a picture: they use production classes, so moving them into code is mechanical

• The two themes now carry the same component set under the same names, which removes the need to redefine anything locally

Technical notes:

• No PHP was touched; the file manager itself is not implemented yet

• The theme additions are new rules only, no existing selector changed its meaning, verified against the live admin and front pages

• The next stage is 1: the loading and error states in the mockups

The parser decides escaping from a trust boundary instead of a stored flag, comments and private messages gain their own runtime, and every column an author writes into is wide enough for what the editor is allowed to produce. Three schema paths — fresh install, 6.2 upgrade and the deployed patch — now agree column for column and index for index.

Core changes:

1. Trust boundary and tag policy (core/security.php, core/classes/parser.php):

2. filterTrustedTags() becomes the single authority over [usehtml] and [usephp]

   • both tags are reserved for the super administrator and stripped for everyone else
   • filterText() and filterHtml() pass the capability, comments and messages never do

3. the pipeline runs filterCode() before filterBbBlocks(), so a documented example is quoted rather than executed

4. a breaks format renders a single newline as a line break without touching authored text

5. the persistent parse cache moves from the news module into the parser and keys on the configuration hash

6. Comment runtime (core/classes/comment.php, core/user.php):

7. format, iphash and the materialised path are gone; branches resolve through recursive CTEs over pid, and tombstones survive by an upward keep walk

8. reqkey is BINARY(16) under a unique index, so a repeated submit returns the first row instead of writing a second

9. the flood window reads (ip, time, id) and the edit mark reaches the rendered view
10. Private messages (core/classes/privat.php):

11. four independent states replace one overloaded status column, with a single owner per side and no shared flag between inbox and outbox

12. Room for embedded images (setup/sql/*.sql):

13. fifteen columns that hold an authored text widen to MEDIUMTEXT

    • EMBEDMAX allows 65536 bytes of binary, which is 87384 characters of base64 before the

data URI prefix, while TEXT holds 65535

• with STRICT_TRANS_TABLES the overflow is a lost post, not a lost image

• the summary columns stay TEXT on purpose, because a list query draws twenty of them onto one page and an image referenced by address still fits there in a few dozen characters

• users.sig moves from VARCHAR(255) to TEXT: of 828 stored signatures the longest is exactly 255 and 95 sit above 240

• Deployment and tooling (setup/sql/update6_3_patch.sql, setup/sql/update6_3_text_once.sql):

• one idempotent patch carries a deployed 6.3 to full parity, including the mail queue and the campaign columns it never received

• a one-time text repair normalises stored break markup and entities in comment and message bodies, ordered so that authored text is never mistaken for writer output

• the address policy, the upload rule reader and getImgText() stop guessing the module and take it explicitly

Benefits:

• an author capability decides what may be written, and the escaping policy decides how it is rendered; neither can be reached through the other

• a repeated submit, a lost connection or a double click can no longer duplicate a comment
• a branch and its tombstones are answered by one query instead of a maintained path column
• an embedded image can no longer end a post with ERROR 1406
• fresh install, upgrade and patch produce the same 38 tables, 494 columns and 172 indexes

Technical notes:

• reqkey is stored as raw bytes; the query interpolator renders non-UTF-8 values as 0x hex

• comment.body, privat.body and thirteen further columns are MEDIUMTEXT; intro columns, users.block and order.info stay TEXT

• update6_3_patch.sql and update6_3_text_once.sql are both idempotent and safe to re-run

• deployment order: files, update6_3_patch.sql, update6_3_text_once.sql, then clear storage/cache/pages

• no breaking change for stored content: every existing body renders unchanged