Rewriting the input filter tests against the shipped functions instead of local replicas exposed a fatal in filterFields() and two silent behaviour drifts. The captcha helper also poisoned every cacheable build unconditionally, even when captcha was switched off and returned an empty string.

Core changes:

1. Scalar input reaching filterFields() (core/security.php):

2. Branch on is_array() instead of the truthiness helper isArray()

   • A non-empty string passed the old check and hit implode(), raising a

TypeError that killed the request

• getVar(..., 'field') feeds exactly that, so account, help, order, forum,

news and pages could fatal on a scalar field value

• Filter a scalar through the text filter instead of returning an empty string
• Captcha as a dynamic region (core/system.php, core/user.php, modules/*):
• Accept register, comment and contact next to login in checkDynamicMark()

• Read the captcha through getPageCaptcha() on 17 frontend call sites

  • getCaptcha() marks the build as uncacheable before it even asks whether

captcha is active, so a form dropped the page cache in every configuration

• The admin login keeps the direct call: the admin area is never cached

1. Comment length guard (core/user.php):

2. Compare the longest word instead of the last one

   • The loop overwrote its own result, so only the final word was measured
3. Count characters with mb_strlen() so cyrillic is not charged twice

4. Filter tests without replicas (tests/Unit/InputFilterTest.php, tests/Support/contract_probe.php):

5. Drive the real functions through a new filters probe scenario

6. Correct three assertions that described the replicas, not the code

   • filterVar() returns an empty array, not an empty string, for a bad list
   • filterHtml() loses a lone backslash to stripslashes before encoding
   • filterHtml() returns an empty string, never null
7. Extend the marker contract test with the widened captcha whitelist

8. Naming and memory (core/security.php, core/classes/parser.php, admin/index.php):

9. Rename the global filterUrl() to filterWebUrl()

   • It normalises a submitted address and did not relate to the parser link

policy Parser::filterUrl(), which refuses dangerous schemes

• Build the getVar() filter table once per request instead of per call
• Hash the image memo key so an inline data URI is not held twice

Benefits:

• A scalar field value no longer fatals the request
• Pages carrying a form stay cacheable
• The filter tests fail when the filters change, which they did not before

Technical notes:

• No schema, route or storage changes
• checkDynamicMark() still rejects adminlogin, empty and unknown parameters
• InputFilterTest shrank from 31 replica-based cases to 8 contract cases

Five admin handlers addressed a name[] form field with a scalar key or passed an array default into a scalar filter. The result ranged from a log warning to settings that were silently discarded on every save.

Core changes:

1. Language editor (admin/modules/lang.php):

2. Read constants and translations by index through nested keys

   • Form fields carry an explicit index and a hidden row count
   • The saved file no longer depends on browser field ordering

3. Stop overwriting the posted translations with the file contents

   • The loop variable holding the file body was shadowing the input

4. Add getLangConstants() and use it in both the editor and the save handler

   • It understands single and double quoted values, so an apostrophe in a

translation survives instead of truncating the parsed value

• Escaping on write covers the backslash as well, so a trailing backslash

can no longer break the generated file

• Remove dead merge and unset code left from an earlier revision
• RSS feed list (modules/rss/admin/index.php):

• Read the 50 rows as untyped arrays so their indexes stay aligned

  • The previous scalar key produced false and wiped every feed to zeros
• Strip the pipe separator and line breaks from the stored values

• Drop the required attribute from the hidden feed rows

  • With 49 empty required rows the browser refused to submit the form at all
• Comments, sitemap and account (admin/modules/, modules//admin):

• Address the checkbox and select arrays as id[], mod[] and warn[]

  • Single-row approve and delete no longer log an array conversion
  • The sitemap module selection is stored instead of falling back to zero
  • User warnings survive a redisplay of the account form after an error

Benefits:

• Language and feed editing actually persist what the admin entered
• Admin actions stop writing warnings into the PHP log
• Existing values keep their meaning: nothing is rewritten on read

Technical notes:

• No schema or config format changes
• The language editor normalises quoting on first save; values stay identical
• Verified live in the admin UI with backups restored afterwards

Posting a comment failed for every visitor: the htmx button carried no CSRF token, so the ajax dispatcher answered with a token mismatch, and the handler read its identifiers from POST while the form sends them in the query string.

Core changes:

1. Comment form (core/user.php):

2. Append getPageToken() to the addComment request URL

   • getPageToken() is used instead of getSiteToken() so a cacheable build

receives a signed dynamic-region marker rather than a frozen token

1. Comment handler (core/user.php):

2. Read id, cid and mod through getVar('req', ...) like updatePost() does

   • The htmx button sends them as query parameters, not as form fields

3. Guard the flood check against a first-time visitor

   • strtotime() no longer receives null when the IP has no previous comment

Benefits:

• Guests and members can post comments again
• The deprecation notice disappears from the PHP log on every first comment

Technical notes:

• No schema or route changes; only input reading and the request URL differ
• Verified through a real guest submission followed by admin moderation

Partial writes were reported as success, so a truncated cache body or a torn counter record could survive as valid data. Public responses could also carry a Set-Cookie header into a shared proxy, letting one visitor's state reach the next one.

Core changes:

1. Atomic cache body write (core/classes/cache.php):

2. Treat a short write as a failure instead of trusting a non-false return

   • The temp file is removed without the error-suppression operator
   • Only a complete body ever reaches the target path through rename()

3. Drop every pending Set-Cookie when emitting Cache-Control: public

   • A shared proxy or CDN can no longer store a visitor-bound cookie
   • Sessions and CSRF are unaffected: token and captcha pages are no-store
4. Append safety for counters and logs (core/system.php):

5. Rework addFile() append mode around fopen/flock/fwrite

   • The write position is recorded before writing
   • An incomplete append is rolled back with ftruncate()
   • A short write is reported as a failure to the caller
6. Contract test coverage (tests/Support/contract_probe.php, tests/Unit):

7. Extend the CLI probe with a scratch COUNTER_DIR and new scenarios

   • stathit drives the real updateStatsTrack() per process
   • appendfail proves a blocked append is reported, not silently lost
   • geoip measures the streaming reader against the real corpus
8. Add StatsContractTest and GeoipReaderTest, extend PageCacheContractTest
9. Add the getvar scenario used by the input contract tests that follow

Benefits:

• A truncated write can no longer be served as a valid cached page
• Statistics stay exact under parallel hits instead of losing records
• Public caching becomes safe for shared proxies

Technical notes:

• No storage format changes; counters and cache files keep their layout
• Backward compatible: only failure paths and response headers changed

• Documentation updated in docs/PERFORMANCE.md; the remediation plan is done and its document removed

Closes the correctness and availability gaps from the 2026 performance remediation plan: the public page cache can no longer be amplified by arbitrary query input or foreign hosts, and the exact visitor statistics survive IO failures without losing or double-counting entities.

Core changes:

1. Bounded page-cache identity (core/system.php, core/classes/cache.php):

2. Cache::getQueryVars() validates the request query against a per-route key/value regex contract, dropping tracking keys centrally

   • unknown, duplicate, or malformed keys render live and create no entry
   • replaces the now-dead Cache::filterCacheUrl()

3. getCacheRouteVars() adds the canonical homeurl host gate and feeds getPageHash(), which builds the pc2-versioned identity from validated values so num=1, encodings, and foreign Host values cannot fork entries

4. Dynamic-region marker contract (core/system.php):

5. checkDynamicMark() allowlists token scopes ajax/account/scheduler, captcha action login, and positive voting IDs

6. invalid emitters poison the build, log, and fall back to live rendering
7. the contract is revalidated at serve time so forged markers stay inert
8. Fail-safe exact statistics (core/system.php):

9. v2 stats cookie carries only session metrics and country cache; no client state can suppress an exact count

10. ips.log/user.log sets are the source of truth with hosts/users counters derived from set size, so any single write failure self-heals

11. statistic.log is replaced atomically via temp file and rename under a stable statistic.lock; partial writes can never trigger a day reset

12. rollover verifies full day lines, rolls back short appends, aborts on any archive/rename/unlink failure before destroying state, and names archives from the data date

13. checkUniqueIp()/check_user() consolidated into updateStatsTrack()
14. Regression coverage (tests/):

15. PageCacheContractTest exercises the production functions directly and through contract_probe.php, which boots the real core per scenario with LOGS_DIR redirected to scratch so failure paths stay assertable

Benefits:

• guest requests cannot grow the cache key space or host namespaces
• exact unique hosts/users stay correct across injected IO failures
• rotation failures preserve data and retry instead of deleting sources

Technical notes:

• pc2 identity version makes pre-contract cache files unreachable; normal GC removes them without a purge

• v1 stats cookies are discarded by design (disposable analytics state)

• OPcache/cron deployment (Batch 4) remains a manual environment step; docs/PERFORMANCE-REMEDIATION-2026.md stays OPEN with recorded results