The two-column layout demo grows the two shelves it was missing and becomes a specification a fresh session can implement from: every decision it implies is written down next to the code that has to carry it. The counters and flags the layout reuses are fixed in the theme itself, so the fix reaches the cabinet and the mailbox that use them today.

Core changes:

1. Missing shelves and their contract (demo/private-messages-final-2026.html):

2. Sections for the saved box and the compose form, both with their own states

   • Saved: its own quota ring, bookmark flags, unsave in the row and in bulk
   • Compose: recipient autocomplete, the card with the recipient quota ring,

the real Toast UI, and all five answers the send route can give

• A saved message no longer appears in the inbox, because the box predicate excludes it, and the shelf badges split the unread between them

• The backend contract records what the layout demands: one main swap with addressable out-of-band targets, a snapshot page, the editor filled through its own API, the two-step deep link, and the mobile pane switch

• Counters and state flags (templates/lite/assets/css/theme.css, templates/lite/fragments/span.html):

• sl-chip-icon turns a label-less state flag into a round badge, and the fragment emits it only when the flag carries no text, so the chips that do carry a label keep their pill

• sl-cab-badge and sl-pm-new centre their digit and declare border-box: one digit was sitting against the left padding inside a 32px oval

• Unread badge (core/user.php):

• getUserNavItems() caps the counter at 99+, because the badge is a circle on a tile and a four-digit number stretched it across the label

• Work plan (docs/PRIVATE-MESSAGES-2026.md):

• Seven batches from the data contracts to the conditional search index, each with its own verification, plus the predicate table every list query must match and the four questions that must be answered before their batch

Benefits:

• The redesign can start in a new session from one document instead of being re-derived from a demo

• Every counter in the theme is centred by the same method the chips use

• Three audit rounds are answered in the plan: native prepares, the flat autocomplete contract, POST-only opening and snapshot parity

Technical notes:

• No schema change, no new SQL, no route touched

• The plan defers the search index to its own approved batch, because a BTREE index cannot serve a leading wildcard and FULLTEXT changes search semantics

The page-cache generation counter lived inside storage/cache/pages, the directory the manual cache clear empties, so the clear reset the counter every stored page is keyed by. It now sits with the other persistent counters in storage/counter, and the clear advances it instead.

Core changes:

1. Page-cache generation (core/classes/cache.php):

2. getEpoch() and addEpoch() read and write COUNTER_DIR/cache.log

   • the counter is state, not a cache artifact: deleteAll() and the cache size report no longer reach it
   • the exclusive lock, the single bump per request and the zero on a missing file are unchanged

3. deleteAll() ends on a bump of its own

   • unlink() reports failure silently, so a page the sweep could not remove has to stay unreachable
   • the directory guard moved into the body, so the bump runs even with no cache tree on disk
4. Test bootstrap (tests/bootstrap.php):
5. COUNTER_DIR is defined next to CACHE_DIR and LOGS_DIR, so the harness matches the constants core gives the class
6. Documentation (docs/PAGE-CACHE-ROUTES-2026.md, admin/info/config/ru.md):
7. the invalidation section names the counter file and the bump the clear performs
8. the admin help gains the invalidation rule: admin writes, comment operations, post and vote from the front
9. the cache structure list gains storage/cache/pages/locks, which appears only under cache_l

Benefits:

• a cache clear can no longer resurrect a page whose file survived the sweep
• the counter stops being counted and swept as if it were a cached file
• the admin panel now explains why the page cache retires itself after an edit

Technical notes:

• storage: the counter is storage/counter/cache.log; the documented cache clear on upgrade removes the obsolete storage/cache/pages/epoch
• interface unchanged: getEpoch() and addEpoch() keep their signatures and all twelve call sites
• backward compatible: an installation without the file reads zero, exactly as before

The rendered-content cache kept every fragment, so short comments and teasers filled the directory while a daily rewrite cost more than the hits it saved. A size threshold now decides, the sweep that ages the leftovers out is enabled, and the settings screen loses the two fields that described the same decision twice or described nothing. On the way through, request logs stopped carrying the passwords a warning used to record.

Core changes:

1. A size threshold for the rendered-content cache (core/classes/parser.php):

2. CACHEMIN is 2048 bytes of source and getCachePath() returns nothing below it

   • The gate sits in the one function both the read and the write pass, so the two stay symmetric
   • The unit is bytes because parsing cost scales with bytes, not with characters
   • The empty-source case is covered by the threshold, so no separate check remains

3. Break-even is near 700 bytes, but only at some thirty hits a day per fragment; from 2 KB a write repays after three or four hits, which is almost any traffic level

4. The sweep that removes what already accumulated (config/scheduler.php):
5. The cachegc job is enabled; it removes files older than max(cache_t * 24, 86400), never below CACHETTL
6. The threshold stops new sub-threshold files but never removes existing ones: nothing else ages them
7. Secrets stop reaching the logs (core/classes/logger.php, core/security.php, admin/modules/config.php):

8. Logger masks request data by key name before it is bounded, in getContext() and only there

   • Any key holding pass, pwd, secret, token, key or code keeps its name and loses its value
   • The diagnostic context of a call is left alone, because it carries keys a name rule would destroy

9. The address is masked as well, in url and referer: an OAuth callback and a reset link carry their secret in the query string

10. The flood report names the posted fields instead of dumping them, so a password cannot arrive through the message text either

11. The hand-written unset() in mailtest() is gone: one rule replaces one special case
12. Four cache settings instead of six (admin/modules/config.php, config/global.php, core/system.php, index.php):
13. cache_c and the second minify pass are gone; the stored page is now exactly the page that was served
14. cache_d is merged into cache_b, which becomes a number of days with 0 for off

15. Browser caching no longer depends on db_t; the publicly cached response drops the generation-time marker instead, decided where the public headers are actually sent

16. OpenSearch, XSL and the asset route stop reading a setting: the first two take Cache::STATICDAYS, the third keeps its immutable year

17. The page identity becomes pc3 and cache_version becomes 4, so no entry written under the old rules can be served and every install rebuilds its merged configuration

18. The configuration writer stops mangling what it stores (core/system.php, setup/index.php, config/filetype.php):

19. One value is one line however long it is; a configuration file is data, and the line limit governs code a person writes

    • The line-splitting cut multibyte characters in half, so one save of a localized form produced a

file that was no longer valid UTF-8

• The installer carried a second copy of the same splitter and would have produced files the panel

does not

• Line endings are normalized on the way in, because a textarea posts CRLF into a source file of this repository

• One blind spot of the cache gets a record (core/classes/cache.php):

• A stored file that exists but cannot be read is written to the file channel once per process

  • The page re-renders and the guard prevents the warning that would otherwise name it
  • One record per process, because a locked append per read would cost more than the fact is worth
• Documentation and help (docs/PERFORMANCE.md, docs/PARSER.md, admin/info/config/ru.md, admin/info/scheduler/ru.md, UPGRADING.md):
• The performance guide gains the parser layer it never described, with the threshold and its reason
• The parser guide loses a cache guard that does not exist: the exclusion is $this->vary in the class

• The configuration help describes what pages/data really stores, the new field set and the real scope of the caching options, which is the front page and the news list, not every section

• The scheduler help had the cachegc job as disabled and as a full wipe; it is enabled and removes stale files only

• docs/PAGE-CACHE-ROUTES-2026.md is the plan for widening the page cache to the other modules

Benefits:

• The rendered-content directory holds the few documents that are expensive to parse instead of thousands of fragments that never repaid their write

• A warning raised during a login, a registration or a profile save no longer records the password
• Two settings fewer to explain, and the stored page can no longer differ from the served one
• Saving the settings form on a localized installation no longer corrupts config/global.php

Technical notes:

• Breaking: an installation running cache_b = '1' must set cache_b to its former cache_d, because a bare 1 now means one day. This install runs cache_b = '0' and carries nothing over

• Breaking: cache_c and cache_d are removed from config/global.php; cache_version = 4 forces every install to rebuild config/local.php on the first request

• Every stored page becomes unreachable at once through the pc3 prefix; cachegc removes the files

• The browser-cache branch for HTML stays unreachable in practice while any page carries a CSRF token marker, which makes its entry dynamic and therefore no-store

The shipped configuration carried a live master secret, and the route walk still addressed the upload record by positions that moved a release ago. Both are corrected here, together with the leftovers the audit of the editor upload plan surfaced.

Core changes:

1. The master secret becomes per installation (config/security.php):

2. The shipped secret is emptied, so getSecret() generates one on first use

   • core/security.php already carries that branch; it never fired while a value shipped
   • setup/index.php writes back the value it reads, so every installation ran on the same secret
   • The secret feeds csrf, dynreg, captcha, field, stats and upload
3. The route walk addresses fields by name (tools/upload-route-check.php):

4. setUploadSwitch() reads the key order out of setUploadRuleData() instead of naming positions

   • The record lost adminlist and holds twelve fields; the walk still wrote to positions ten and eleven
   • The access matrix and the guest isolation skipped silently, and the run still exited zero

5. A skipped row can be marked required, and a required skip now fails the run

   • Skips shaped by the stand stay non fatal: no remote URL, captcha left on, no image on the page
6. The configuration cache is dropped without suppression (core/system.php):
7. The suppressed unlink becomes a guarded one, so a missing cache is no error and a real one is not hidden
8. Documentation and the avatar library (UPGRADING.md, templates/lite/images/avatars):
9. The runtime cache step deletes config/local.php, which no fingerprint ever invalidates
10. The two closed plan documents leave the tree
11. The 0-NEW staging tree is gone; presets holds the library and system holds user, guest and deleted
12. Tests and one locale (tests/Unit, admin/lang/fr.php):
13. CommentWriteTest passes over a module with no writable target, which carries no delta to compare
14. Two file manager tests lose the double quoted string the formatter rejected
15. _EDFILEG takes the single quoted form the constant rules require

Benefits:

• Two installations no longer share one secret, so a token forged against one does not travel
• The acceptance walk of the editor upload runs its access matrix and its guest isolation again
• A green suite: no formatter finding and no PHPUnit warning

Technical notes:

• The secret is regenerated per installation; the previous value remains in the history of this file
• Every session and CSRF token is invalidated once the configuration cache is rebuilt
• No schema change, no route contract change and no runtime compatibility layer added

Stages 8 and 9 of docs/FILE-MANAGER-CONCEPT-2026.md close the plan. Both screens answer the pointer and the keyboard the way a file manager on a desktop does, the last duplicate list and the last legacy download helper are gone, and the catalogue scrolls with the page while holding nothing back from an administrator.

Core changes:

1. Desk conveniences on both screens (plugins/system/slaed.js, templates/admin/assets/js/admin-ui.js, plugins/editors/toastui/assets/editor-upload.js):

2. The right button opens the fan of the object under the pointer, where the pointer stands

   • The owner is the box holding exactly one fan, so the empty ground of a tile grid keeps the browser menu
   • The direction is read off the theme instead of being known by the client

3. A modifier marks instead of navigating: Ctrl one object, Shift the whole span

   • The marking press is caught in the capture phase, so a row does not follow its own address
   • The current object does not move, because the panel beside the list describes it
4. Arrows walk what is visible, Space marks, Enter does what a press does

5. A file dropped anywhere reaches the shown directory, an object dropped on a directory is moved

   • The move opens the same operation form with the target filled in, because a moved file loses its published address
6. The window of the editor opens on the first available rail section and returns the focus that opened it
7. Cleanup of the file layer (core/admin.php, admin/modules/uploads.php, index.php, core/system.php):

8. getAdminUploadFiles() and the two quick lists it fed are gone together with their go=5 route

   • The catalogue is now the only list of the upload tree the administration has
   • The directory selector stays, because it is what walks the browser to a module

9. stream() becomes getFileStream(), the single download path of the project

   • The opaque type replaces application/force-download and the empty Content-Range
   • The name reaches the header encoded and reduced to its own last segment
   • A missing or unreadable file answers 404 instead of an empty attachment
   • getAdminFileDownload() decides the right and hands the file over; four callers outside the file manager follow the same path
10. modules/files takes a streaming branch only for a file that lies on this server
11. The catalogue scrolls with the page (core/admin.php, templates/admin/partials/*, templates/admin/assets/css/theme.css):
12. No pager and no box of its own: a directory stands at its full length

13. The tree, the properties, the column titles and the bulk bar hold themselves in the window

    • The card and the admin wrapper clip with overflow: clip, because hidden makes a scroll container and kills every sticky inside it
14. An administrator is answered the whole directory; what may not be seen is decided by the path policy and never by a number
15. The retired list length leaves the project (core/system.php, admin/modules/uploads.php, config/uploads.php, admin/lang/*):
16. adminlist was the page size of the removed quick list and had no reader left
17. The module rule drops the field and carries twelve, config/uploads.php is migrated record by record
18. The settings form loses the input, six locales lose _F_5, _UPLOADS_SEEN and _UPLOADS_CUT
19. Visual corrections against the approved mockup (templates/admin/, demo/):
20. The tile leaves room for its fan, marks on a plate under the name the editor window already uses, and names size and day
21. The fan of a tile opens as one row, the shape it has in a list and in the editor window
22. The tree step is 8px, both side columns are 250px, the filter group stands over the properties column
23. The type column is gone: the extension is in the name and the kind is in the icon
24. bi-folder replaces bi-folder2, and bi-folder-fill marks the open node
25. Tests and plan (tests/Unit/, tools/upload-route-check.php, docs/):
26. DeskKeysTest holds the context menu, the modifiers, the keys, the focus and the two kinds of dragging
27. FileManagerCatalogTest holds the single list, the single download path and the scrolled directory
28. The plan marks stages 8 and 9 closed and records every decision taken after them, with its price

Benefits:

• One download path writes the headers of every download in the project, so a stored file can no longer be answered with a type that executes
• One list of the upload tree instead of three, and one place where a directory turns into rows and tiles
• An administrator sees a directory whole, and the settings that count files stay where they belong: the editor window and the visitor
• The two screens carry the same components under the same names, so a component fixed once is fixed on both

Technical notes:

• Breaking change: the module upload rule loses adminlist and holds twelve pipe-separated fields; config/uploads.php is migrated in this commit and a rule written for the previous format would be read shifted
• A rule written short by hand still answers the guest limit with the user one, because zero in that position would mean no limit for the one role that never had one
• New helper getFileStream() replaces stream(); admin/modules/security.php, modules/clients, modules/files and modules/shop are migrated to it
• Removed route: index.php go=5 getAdminUploadFiles; no other route changed its contract
• No schema change; no stored file is touched or renamed