Batch 2 of docs/0-PRIVATE-DATA-2026.md (step 4 of docs/ROADMAP-2026.md), with the server half of batch 4. The browser now reaches public/ and nothing else: the code, config/, storage/ and the whole uploads/ lie at the project level, so no server misconfiguration can serve a journal, a backup or a closed upload folder. Public upload addresses keep working through a light path of the front controller that answers before the core boots.

Core changes:

1. The public/ tree (public/*, .htaccess, nginx.conf.example):
2. templates/, plugins/, sound/, demo/, .htaccess, favicon.ico, robots.txt, error.html and sitemap.xml move into public/

3. index.php, setup.php and update.php move into public/ whole and define BASE_DIR and PUBLIC_DIR themselves; public/admin.php stays the short file that runs admin/index.php

4. public/.htaccess drops RewriteBase and refuses the PHP and the markup of the themes; a project-level .htaccess rewrites every request into public/ and refuses everything without mod_rewrite

5. nginx.conf.example: root on public/, location ^~ /uploads/ to index.php, the theme refusals and the error pages
6. One upload root and the light path (core/stream.php, core/system.php, core/classes/*):

7. core/stream.php: UPLOADS_DIR, getUploadPublic(), getUploadUrl(), getUploadRequest(), setUploadStream() and getFileStream()

   • The light path serves a public folder with nosniff, a sandbox policy, a day of public cache, ETag, 304 and ranges
   • Every other folder, a dot segment, a traversal or a missing file answers 404 without loading the core
8. getFileStream() takes a cache mode (none, private, public) and sends the sandbox policy on every answer

9. No caller spells 'uploads/' into an address: the parser, getImgText(), the upload rules, avatars, presentation and the file layer ask getUploadUrl(); a private folder has no direct address

10. The upload service creates a missing folder of its owner on the first write; a missing folder is no refusal of a rule
11. addEditorUpload() builds the file context after the write, so the first upload into a new folder reports its file
12. Guards and paths (core/, admin/, modules/, blocks/):

13. Every .htaccess and guard index.html outside public/ goes, with their writers in FileManager, NodeService, CaptchaStore and update.php; the counters create storage/counter themselves

14. Every path that relied on the working directory reads BASE_DIR or PUBLIC_DIR: language files, module scans, theme assets, logos, ranks, flags, the sitemap, the file scan, the template editor and the .htaccess and robots.txt editor

15. The critical files of the file manager follow PUBLIC_DIR, so a document root named public_html keeps them

16. The installer records the mode of the document root as webroot in config/global.php and shows it as a check row; the avatar folder ships as avatars below uploads/ with its own settings label

17. Documentation and help (README.md, UPGRADING.md, docs/, admin/info/, modules/*/admin/info/ru.md):

18. README and the help of the security section explain both modes, Apache, LiteSpeed, nginx and three variants for shared hosting; UPGRADING.md and the help point at nginx.conf.example

19. The plans record the decisions of the batch, the real entries in public/ and the writer that creates a folder
20. Tests and tools (tests/, tools/):

21. New PublicTreeTest: the light path over real HTTP without the core, nothing of the project on public/, both .htaccess files, getUploadUrl() and no guard outside public/

22. New NginxConfigTest: nginx.conf.example refuses exactly what public/.htaccess refuses, file by file, and passes nginx -t where a binary is set in SLAED_NGINX

23. The probe servers serve public/ and run the real light path; the probes write no guards
24. ui-contract, ui-audit and the pre-commit hook watch public/templates and public/plugins

Benefits:

• No server rule is needed to keep config/, storage/ or a closed upload folder private
• One sender and one list decide every upload address and its delivery; closing an owner is one line of the list
• nginx gets a tested server block instead of rules copied from the documentation

Technical notes:

• Breaking change: the document root of a site must point at public/, or the project-level .htaccess must rewrite into it on Apache or LiteSpeed; a server without .htaccess support needs nginx.conf.example

• Upload addresses uploads/<folder>/<name> of public folders do not change; files of Node types have no direct address

• NodeProfileTest fails 11 of 14 on the stand as on the clean HEAD before this change; the installer of the probe does not reach the database there

A load test showed the ready-page cache paying only on Node lists while its write guard, generations and signed markers touched every write; it leaves the system and the template, parser and data caches carry a page. Batch 1 of docs/0-PRIVATE-DATA-2026.md lands with it: a refused login no longer records the attempted password, and the request journal moves onto Logger, so its secrets are masked and cookies and the session leave only their names. The four plans before release 8.0 are numbered and ordered by docs/ROADMAP-2026.md.

Core changes:

1. Ready-page cache removed (core/classes/cache.php, core/system.php, index.php, core/classes/node/*, admin/modules/config.php):

2. Stored pages, their route contract, the signed dynamic markers of tokens, captcha and polls are gone

   • The write guard around content writes, the cache generation per database write and the Node list deadline go too
3. One cache API: Cache::getFile(), Cache::deleteStale(), Cache::setHeaders() with none, private or public
4. Styles and scripts are linked one file at a time; bundling, inlining, CSS compression, data URIs and go=asset are gone
5. The category map is dropped by every writer of a category title, parent, order or icon
6. Changelog entries and OAuth key sets live in the data cache; the cachegc job sweeps files older than a day
7. Settings and schema (config/global.php, config/scheduler.php, update.php, storage/update/sql/*.sql):
8. cache is the on/off switch of the parser cache; cache_b, cache_l, cache_t, cache_css, cache_script, css_c, css_e, css_h, script_h are gone
9. The cachegc job is titled Cache cleanup; the dead index expires is dropped from the schema
10. No secret reaches a journal (core/system.php, core/security.php, core/classes/logger.php, core/monitor.php):

11. addLoginReport() loses its password parameter; its five call sites in admin/index.php and the account module follow

    • A full login journal is moved away before the file is opened, so the entry that triggers the rotation is kept
12. addLog() and getVariablesInfo() are removed; the request journal is the Logger channel request, file request.log
13. getSecurityEventHours() reads request.log; the label key log of the security section becomes request
14. Presentation, panel and themes (modules/presentation/, plugins/presentation/, templates/, admin/, blocks/*):
15. The request path of the presentation shows the parser cache, the compiled templates, the category map and the live page
16. The message page draws its separator as markup; the settings, scheduler and security help follow the changes
17. Tests, plans and reference (tests/, docs/, tools/*):

18. JournalSecretTest with tests/Support/journal_probe.php: no password, cookie or session value in any journal, a refused login without the attempted string, the rotation entry in the new file, the dashboard on request.log

19. CacheContractTest replaces PageCacheContractTest; the Node, rating, route and comment probes lose the page cache

20. docs/ROADMAP-2026.md orders the plans 0-PRIVATE-DATA, 1-FILES, 2-PROD-FINDINGS and the new 3-ASSET-CACHE; docs/PAGE-CACHE-ROUTES-2026.md is closed and removed, its lasting part is in docs/VERSIONS.md

Benefits:

• A journal is no longer a credential store travelling into backups and rotation archives
• One definition of a secret, MASKKEYS of Logger, serves every structured journal
• Content writes no longer pay for a cache that served only one kind of page

Technical notes:

• Breaking: addLoginReport(int $id, int $typ, string $login); addLog() and getVariablesInfo() are gone
• Breaking: the request journal is request.log with one JSON line per request instead of the text of log.log

• Breaking: NodeException::BLOCKED, the quick-edit result blocked, getPageToken(), getPageCaptcha(), NodeQuery::getNodeDeadline() and setHead() with a closure are gone; Cache::getPath(), getHash(), getQueryVars(), setPrivateHeaders() and getAssetFiles() are replaced

• The removed settings keys vanish on the next save of the settings form; no migration of existing journals

The two separate inline edits of comments and forum posts become one protocol, QuickEdit, with strict GET and POST routes, a stamp of the stored row and a fixed order under the lock of each kind: existence, the right, an equal text saved without a write, and only then a conflict. Node gains the quick edit of the intro and the body on the public page for its moderator and, inside limits.edit, for the signed-in author; editor assets load once per page, so a fragment no longer leaves the editor hidden or runs an engine twice.

Core changes:

1. Protocol (core/classes/quick.php, core/system.php, index.php, templates/lite/fragments/quick-edit.html):
2. QuickEdit: closed forms of kind, id, field and stamp, closed result codes, QuickEdit::getStamp() for texts without a version
3. getQuickService() builds one adapter per kind; each source renders its editor with the literal store of its column

4. getQuickEdit (GET) and updateQuickEdit (POST) check the method first, then the token from the X-CSRF-TOKEN header alone

   • 405 / 403 / 404 / 409 / 422 / 500 / 503 per outcome; a conflict answers the current text with its fresh stamp
   • A save answers the region with the edited mark out of band and a note as the event header sl-quick-note
5. One fragment holds the form, the conflict answer and the always-printed mark wrapper
6. Comments (core/classes/comment.php, core/user.php):
7. Comment::updateComment() takes the stamp, decides existence, right, window, equality and stamp under the row lock
8. setWriteBegin() answers blocked for a closed guard and storage for a failed BEGIN
9. getCommentBody() renders the body and the mark for the page and the quick edit alike
10. The route op=updateComment and its handler are gone
11. Forum (core/user.php, modules/forum/index.php, index.php):

12. updateForumBody() writes under the write guard: topic row, then post row, the place and the right read again

    • A topic closed or a post moved after the editor opened refuses the author; the page cache moves only after a write
13. getForumSource() and getForumBody() serve the page and the quick edit
14. updatePost(), its route, its epoch bump in the router and getTplAjaxTextarea() are gone
15. Node (core/classes/node/.php, modules/node/, config/node.php, update.php):

16. NodeService::updateNodeText() and getTextSource(): intro or body of a type without an extension

    • Moderator in every state; author of a pending or published material inside limits.edit from creation
    • An author edit of a published material goes back to Pending in the same write unless the author publishes directly
17. NodeStatus gains Published -> Pending; NodeException gains BLOCKED (7, HTTP 503) for a closed write guard
18. setNodeWrite() reports a closed guard as BLOCKED and moves no cache generation for a work that wrote nothing
19. limits.edit (default 600, 0 off) on the limits tab; update.php adds it to an existing config/node.php
20. The view partials wrap intro and body in regions; the public page offers the quick edit before the full editor
21. A material the visitor may neither edit nor read answers 404, as Node answers a missing and a closed one alike
22. Editor assets (core/classes/editor.php, plugins/editors/, plugins/system/.js, core/helpers.php):
23. Editor::getAssetTags(): plain tags on a page load, the client loader SlaedEditors on an htmx fragment
24. Editor::getInitScript(): the init waits for its engine, checks its node and registers its teardown
25. setQuickEdit in slaed.js: Cancel without a request, Escape and Ctrl+Enter, the warning toast, the conflict question
26. A region swapped away destroys its editors and clears both Toast UI registries
27. Tests, language and help:
28. QuickEditTest drives both routes over real HTTP for comments, forum posts and Node materials
29. NodeServiceTest covers updateNodeText(); comment, forum and node tests follow the new contracts
30. Seven site constants, _SAVEBUSY and the panel label _NODE_AEDIT in all six locales
31. Help of comments, forum, Node, categories and settings; docs/ARCHITECTURE.md, NODE.md, VERSIONS.md, FILES-2026.md

Benefits:

• A refusal or an expired session no longer swaps an alert over the typed text
• Two editors of one item can no longer overwrite each other unnoticed; a repeated save writes nothing twice
• One protocol, one fragment and one client handler instead of two inline paths and HTML built in PHP

Technical notes:

• Breaking: Comment::updateComment(int $id, string $body, string $stamp) answers a result code
• Breaking: NodeException::BLOCKED is new; setNodeWrite() reported a closed guard as STORAGE
• New configuration key node.limits.edit; a limits section missing it makes every Node type invalid until update.php runs
• No schema change

The last two batches of the installer plan land: the probes walk the new setup.php end to end, the help moves into the permanent references and the plan file is deleted. The installer stops deleting itself on an installed site, which a development copy needs, and its CSRF token moves from storage/install.php into the session. Site mail is sent as multipart/alternative from the site address, with Date and Message-ID on every transport.

Core changes:

1. Installer (setup.php, templates/admin/pages/setup.html, templates/admin/assets/css/theme.css):

2. setSetupShut() answers an installed site with the refusal only: no form, no write and no delete

   • The installer deletes itself only on the closing stop of its own installation
   • A file that stays keeps the _DELSETUP warning of the panel

3. The CSRF token is a random value in the session of the installing browser

   • storage/install.php, getSetupToken() and its two unlink() calls are gone
   • A token of another browser is refused like none

4. Zip and Zlib are optional: a missing one is a warning row (is_warn, .sl-is-warn) that lets the server stop pass

   • mbstring, PDO MySQL and JSON still hold the stop
5. Mail (core/classes/mail.php, core/system.php, core/user.php, modules/account, modules/forum, admin/modules/config.php):
6. Every message is multipart/alternative: a plain-text part derived from the HTML, then the HTML part
7. Date and Message-ID are written for every transport; X-Priority stays normal
8. From is the configured identity, else the site address; a form visitor becomes Reply-To, never the sender
9. getMailFrame() wraps a text into the plain-text mtemp frame; every caller goes through it
10. addQueue() stores the body through getOutputHtml()
11. Languages (admin/lang/*.php):
12. _SETUP_NOOPT for a missing optional extension
13. _SETUP_ZIP and _SETUP_ZLIB name the ZIP and GZ archives they serve
14. Tests (tests/Support/, tests/Unit/):

15. The install probe walks the seven stops over HTTP, checks the refusals with the own and a foreign token, and expects a shut installer to stay in place

16. Mail tests cover the frame, the queued body format, the sender, Reply-To, Date and Message-ID

17. Docs and housekeeping (docs/*, README.md, SECURITY.md, UPGRADING.md, CONTRIBUTING.md, .htaccess, robots.txt, admin/modules/editor.php, core/classes/filemanager.php, .gitignore, demo/*):

18. docs/SETUP-2026.md is deleted; the installer lives in docs/ARCHITECTURE.md "Installation", the 6.3 update in docs/NODE.md "The 6.3 update"

19. UPGRADING.md states that the release does not update a 6.2 site
20. The setup/ directory rules and the setup.php entry of the critical files of the file manager are dropped

Benefits:

• A development copy of an installed site keeps its installer
• The installer writes nothing outside config/ before the run and leaves no token file behind
• A server without Zip or Zlib installs
• Site mail passes SPF and DMARC of the site domain and carries the headers filters score

Technical notes:

• No schema change
• storage/install.php is no longer written; an existing one is unused
• An installed site with setup.php left in the root shows the panel warning until the file is deleted

The help tab of the materials section grew from one page of notes into a full operator guide, written as the current state of the system and checked against modules/node/admin/index.php, the Node classes and docs/NODE.md.

Core changes:

1. Help (modules/node/admin/info/ru.md):
2. Terms: type, material, resource and its role, extension, profile

3. The list: filters, the five states and the allowed moves, the trash, what a permanent deletion removes, the version check

4. The material form: fields by the features of the type, deferred publication and the nodepublish job, editor attachments [attach=...], concurrent editing, reports on resources

5. Types: life of a type, the nginx rule for uploads/<type>, records of removed sections, every setting of a type with tables of the seven display modes, the twelve features and the six display modes of a resource role

6. The ten shipped types, the support extension (queue, working card, states, mail) and the sync extension (source, period, manual check, back-off after errors), the four limits with their defaults, the rights

7. 14 callouts of the five kinds the parser knows; the nginx rule stands under its callout, because a fence inside a callout is dropped

Benefits:

• An operator finds the answer on the tab instead of in the developer reference

Technical notes:

• Russian only, as every help page of the panel; renders cleanly on the stand