Steps 9 and 10 of docs/PRIVAT-2026.md still recorded themselves as uncommitted after cfa91cb8 shipped them. The progress table is what a session reads to decide where the work stands, so a stale evidence line there is a wrong answer to the next question asked of it.

Core changes:

1. Progress table (docs/PRIVAT-2026.md):

2. rows 9 and 10 open with the commit that carries them instead of "Not committed"

   • row 9 is the format column in all three update channels
   • row 10 is tools/privat-migrate.php with its probe and its test

Benefits:

• the plan reads the same on every machine that pulls it, which is what makes the migration resumable across sessions

Technical notes:

• documentation only, no code, schema or behavior touched

Stage 1 of docs/PRIVAT-2026.md. The procedural private-message subsystem becomes one Privat class, and the single status column both participants shared becomes four independent state columns, so what one of them saves or deletes no longer rewrites what the other one sees. Every frontend, block, profile and admin caller moves in the same change; no compatibility wrapper, schema detection or dual schema fallback is left behind.

Core changes:

1. Storage model in all three update channels (setup/sql/):

2. status becomes viewed, and saved, delin and delout join it as own columns

   • the backfill reads status through the new runifcol() guard before rencol()

consumes it, so the step disappears by itself once the rename has happened

• modcol() forces viewed onto TINYINT UNSIGNED NOT NULL DEFAULT 0, which a bare

rename cannot do: it keeps the BOOLEAN a column storing 2 was declared as

• the single-column keys uidin, uidout and status give way to five composites

  • in_box, in_new and out_box serve the mailboxes, their counts and their quotas
  • out_new and flood were added on measured plans, not on expectation: the

outgoing unread badge was a full table scan and the send interval a filesort

• update6_3_patch.sql gains section 5, so an installation already running 6.3 is not left behind by a release whose runtime code reads the new columns

• the stale addidx on status is deleted: the same file created and then dropped it
• The subsystem (core/classes/privat.php, core/system.php):

• final class Privat owns every read and write of the table, built beside Comment

  • every mailbox predicate is written once, so a list, its counter and its quota

can never disagree, and no caller restates a state column

• every mutation is transactional and authorizes itself through the detail

predicate of the side that asked; one foreign id refuses the whole batch

• addMessage() answers ['id' => int, 'error' => string] from a closed code set

  • the id is getSqlLastId(), not the newest row of the table, which under a

concurrent send put a foreign message id in the notification link

• both accounts are locked in one statement ascending by id, and the interval

and both quotas are read behind that lock

• the recipient is resolved before the transaction opens, because the first

plain read of a transaction fixes the snapshot every later one answers from

• a deadlock or a lock timeout is retried once, and only for a send that owns

its transaction

1. Mailboxes and routes (core/user.php, index.php, modules/account/index.php, blocks/user_info.php):

2. reads are GET routes that carry no token, mutations are POST with the token in the body; save and delete no longer travel as credentials in an address

3. opening a message is what marks it read, so that one is POST and CSRF checked

4. one mutation route serves a row action and a bulk action alike; inbox, saved and outbox gained read, unread, save and delete over a selection

5. only the opening mailbox is rendered, the other tabs are fetched on click

6. the detail view resolves the counterpart, so the outbox shows the sender the recipient's profile instead of their own

7. the session counter cache is gone: both sidebar badges are counted per render

8. Administrator panel and account deletion (core/admin.php, admin/modules/ privat.php, admin/index.php, modules/account/admin/index.php, core/system.php):

9. the admin list reads the class, pages from the same numbers its rows came from and renders the five derived states as labelled chips

10. the duplicate go=5 delete route is deleted rather than re-secured; one POST handler remains behind checkAdminPost('privat') and the existing isAdmin(true)

11. both paths that delete a user row now clean the mailboxes in the same transaction, and the counterpart keeps a readable copy of an anonymous account

12. the private-message branch of ad_status() is gone with the column it rendered
13. Templates and language (templates/lite/, lang/):

14. table, table-row, content-list, block-content and inline-badge gained the check column, the bulk slot and the state flags; theme.css owns their styling

15. six new PRIVAT constants in all six locales, none of them a scoped duplicate
16. Verification (tests/):

17. PrivatMigrationTest drives both upgrade channels through states A to D in a disposable schema and holds every one of them to the fresh definition

18. PrivatClassTest holds the predicates, the limits, the independence of the two sides, the bounded bulk actions and two real concurrent sends

19. SchemaUpdateValidationTest reads modcol declarations and both channels

Benefits:

• one owner of the table, one place a mailbox rule can be wrong

• sender and recipient states are independent, which is what the old model could not express at all

• concurrent sends cannot both take the last free place of a mailbox

• fresh install, 6.2 upgrade and 6.3 patch end on the same table, and each is safe to run twice

Technical notes:

• the schema section and the runtime code of this release are deployed together: either half alone answers an SQL error on every private-message page

• behavior changes, each intended: a sender may delete a message already read, a saved message stays in the sender's outbox, one participant's delete leaves the other's copy, read and unread are two actions, and a send is refused when the recipient's saved folder is full and not only their inbox

• the notification preference is psmail, the setting the profile form has always offered and which had no effect while the code read the forum preference fsmail

• docs/VERSIONS.md carries the dated entry with the channel table
• docs/PRIVAT-2026.md stays: stage 2, the content contract, is not started
• stored titles and bodies keep their current encoding contract until then

Batches 8, 9 and 10 of docs/UPLOAD-2026.md: admin upload moves onto the Upload class and the procedural pipeline is deleted, the 2026 format set goes live across every configuration and render path, and the final sweep proves nothing legacy survived. Two audits of that sweep are folded in, each of which found real defects rather than style.

Core changes:

1. Admin upload and settings (admin/modules/uploads.php, config/uploads.php):

2. uploadsave() publishes local first and remote second through the class

   • every limit comes from the all record, nothing is hardcoded at the call site
   • the all record carries 104857600 bytes and 1600x1600 to match

3. configsave() validates extensions against Upload::getSupportedTypes()

   • an unsupported extension is dropped, reported and never stored as enabled
   • both extension fields show the supported list as a hint
4. upload(), check_file() and check_size() are gone with their last caller
5. The 2026 format set (config/uploads.php, config/filetype.php, config/files.php):

6. the canonical 21 formats replace the old 26

   • ten formats withdrawn, each on its own evidence, two spellings corrected
   • modules gain only webp and avif; the full set reaches typ and the all record

7. config/filetype.php becomes five family templates over 21 keys

   • audio renders through audio, video through video, pdf through object
   • the dead screens class is gone and the lightbox binds to sl-attach
8. Upload class hardening (core/classes/upload.php):

9. images must decode, not merely parse a header

   • a truncated png passed getimagesize() and was published before this
   • a missing decoder answers unsupported instead of passing the file through
10. the remote write callback rejects a short write instead of counting it whole
11. the address policy blocks every IPv6 range IANA marks as not globally reachable
12. the class owned naming grammar is matched at its fixed salt length
13. Configuration writer (core/system.php, setup/index.php):

14. a value whose line would pass 180 characters is written as a concatenation

    • the split is deterministic, so an unchanged save round trips byte for byte
    • the installer copy follows, or a fresh install would write a different file
15. Verification (tests/, tools/upload-route-check.php):

16. UploadIntegrationTest drives the resolver and the accessor against real config

    • all fourteen module records survive resolve and serialize byte for byte
    • the five adapters are held to the ordering rule of the plan

17. tools/upload-route-check.php walks 47 rows of the route matrix over real HTTP

    • credentials come from the environment, TLS verification is on by default
    • every scenario compares tree and database around itself and cleans up

Benefits:

• one publication primitive, one rule parser, one type policy, one lock location
• every publishing flow validates by content rather than by extension alone
• the acceptance of the plan is reproducible from the repository, not by hand

Technical notes:

• ext-gd joins ext-curl and ext-fileinfo in the composer require block

• behavior changes: content stored with a withdrawn format renders as a plain link, a guest no longer sees historical files in the editor panel, and a build without a GD decoder refuses that image format instead of accepting it

• nine other configuration files still hold over-long lines and will be rewritten in the wrapped format the first time each is saved from its own settings tab

• stored reference formats are unchanged: avatar filenames, project relative _files.url values and the editor JSON shape all keep their existing contracts

• setContentActive() still runs before the checked UPDATE of the admin files handler; that ordering predates this migration and is left to its own task

Batches 6 and 7 of docs/UPLOAD-2026.md. Every remaining visitor-facing publisher now reaches the filesystem through Upload::addUploadedFile() after its own method, token and business checks have passed, so a preview, a refused form or a failed row write can no longer leave a file nobody references.

Core changes:

1. Account avatar (modules/account/index.php):

2. saveavatar() gates the whole operation behind POST and the account token

   • the old line validated the token only when op arrived in the POST body,

so GET ?op=saveavatar&avatar=<preset> wrote users.avatar with no token

• the preset branch now sits inside that gate and still calls no upload

• the upload publishes through the class and stores the returned filename

  • the rule is built from the $conf['users'] avatar keys, maxquota 0
  • adirectory loses exactly one leading uploads/ before it is passed on
• a failed profile write deletes the exact path this request published
• Avatar preset grid (templates/lite/fragments/table-row.html, theme.css):
• the is_avatar_link branch gained a form/button variant keyed on action

• sl-avatar-link moved from the anchor onto the form and got the two rules that strip the button chrome; line-height: 0 keeps the row height intact

• Frontend file module (modules/files/index.php):

• send() calls the class only when the save passed every check

  • a file counts as submitted when its error is not UPLOAD_ERR_NO_FILE
  • a refused file no longer falls back to the typed external URL
  • the gate also reads $conf['files']['upload'], which the old code ignored
• the row write is checked and compensated against the returned path
• Admin file module (modules/files/admin/index.php):

• save() publishes straight into the selected path field, else the configured one, so the publish-then-rename branch no longer runs for a new upload

  • relocation of an already stored file with no new upload is unchanged
  • preview and delete publish nothing at all now

• both row writes are checked; a failure deletes the published path and logs a stranded file through Logger::addFile()

• Plan record (docs/UPLOAD-2026.md):

• last completed batch, the decisions of batches 6 and 7, and what the route tests actually proved on the stand

Benefits:

• no upload path can publish before authorization, CSRF and validation pass
• stored size and path come from the class instead of a probed request path
• one publication primitive, lock-guarded and collision-free, for five flows
• the admin file handler writes each file exactly once

Technical notes:

• stored reference formats are unchanged: users.avatar keeps the filename only and _files.url keeps the project-relative uploads/<dir>/<file> shape

• Breaking: avatar presets are POST-only now, so a bookmarked GET link that set a preset stops working

• Breaking: an operator publishing through the frontend file form no longer gets a name without an owner suffix; the flow stores the user id or 0

• config/files.php still lists gzip, which the type map does not know, so a .gzip upload is refused until batch 9 corrects the spelling to gz

• admin upload and the format switch are untouched; upload(), check_file() and check_size() stay until batch 8 removes their last caller

Replaces the procedural database dump with a Backup class that proves what it produced, puts the scheduler on an operating system lock with a defined crash state, and closes the admin mutations that were reachable by a plain GET carrying a credential.

Core changes:

1. Database backup (core/classes/backup.php):

2. New Backup class replaces addBackupTask(), which is deleted without an alias or wrapper

   • Preflight fails before any output: settings, compressor, backup root, staging, link() probe, privileges
   • Export runs in one consistent snapshot, streams unbuffered, checks every write and fsyncs the dump
   • The archive is decompressed again and compared against the dump before it may become an artifact
   • Publication uses link(), which refuses to replace an existing name; the mode is set before linking
   • Retention ages both naming schemes together and is off by default

3. Absence of an object class is proven by effective privilege, never inferred from an empty catalog

   • Role-derived grants and MySQL partial revokes are resolved per vendor branch
   • Views are counted through information_schema.TABLES, which needs no SHOW VIEW
4. Scheduler protocol (core/system.php):

5. The operating system lock is the only authority on whether a job runs; JSON is status

   • A crashed run is reconciled to a defined state and becomes due again without file surgery
   • last_run survives reconciliation, so a crashed job resumes at its next slot
   • A scheduled run re-checks its slot while holding the lock, so one slot cannot run twice
   • A state that cannot be written refuses the run instead of reporting success
6. Job state now carries the contract fields plus the metrics of the run that just finished
7. Request boundary (core/security.php, admin/modules/*.php, index.php):
8. checkAdminPost() requires POST and reads the token from the body, scoped to its module
9. Fifteen admin modules migrated; row actions render through the dial POST contract
10. The direct scheduler endpoint accepts only pseudo and cron, and the isAdmin() bypass is gone
11. The pseudo trigger carries its credential in a body instead of an address
12. Consumers and documentation (admin/modules/scheduler.php, monitor.php, admin/info/scheduler/ru.md):
13. The list derives its state from the lock and the JSON together and shows a crashed job as such
14. A running job shows live elapsed time instead of the previous run's duration
15. The monitor measures published artifacts instead of the whole directory tree
16. The help page gained the backup section, a cron example with a POST body and the storage deny rule
17. Tests (tests/Unit, tests/Support):
18. Pure contract tests for the class, integration probes against a disposable schema, lock protocol tests
19. The mail probe now runs in its own schema, because claiming a batch took rows from the live queue

Benefits:

• A backup either exists as a verified, restorable artifact or fails before producing anything
• Two instances of one job cannot overlap, and a crashed one recovers without manual intervention
• An admin action can no longer be triggered by a link, a prefetcher or a link preview

Breaking changes:

• Cron must call the scheduler with POST; a GET invocation is refused
• addBackupTask() is removed; addSchedulerLock() and deleteSchedulerLock() are renamed
• addSchedulerTrigger() returns an array instead of a URL string