Журнал изменений

The mail plan gains its stage 2 entry and is corrected wherever the implementation measured something the plan had assumed, so a session reading only the plan sees the delivered design rather than the designed one.

Core changes:

1. Progress and decisions (docs/MAIL-2026.md):

• stage 2 recorded: what was built, what was verified and against what
• the claim is described as it is implemented and measured: the predicate is the leading columns of the claim index, and exclusivity comes from the claim moving a row behind the lock window
  • the measurement that decided it is written down, 202 ms against 1.9 ms
• the upgrade statement lives in table_update6_3.sql, with the reason: 6.3 is the release this ships in, and a new file would give a fresh install the table and an upgraded one nothing
• the drain job is priority 2, as the plan's own paragraph argues; its code block said 1 and is corrected
• an empty drain run reports success and never idle, because the scheduler counts every other status as a failure and this job runs every five minutes
• retention is keyed on the creation stamp, the only one the table has
• the test send reports what the run did, not what the queue accepted

2. Blockers (docs/MAIL-2026.md):

• concurrency closed: two processes racing one queue of 400 rows claimed 200 each with no overlap
• added: delivery is still proven only against a loopback sink, the transactional retention delete cannot use an index prefix, and the queue rows on the mail tab were verified as controls rather than as behaviour

3. Facts re-measured:

• the admin config module line references, shifted by the six queue rows

Benefits:

• the two places where the plan contradicted itself or the engine are settled in the plan rather than only in the code
• the next stage starts from measured numbers

Technical notes:

• no code changes
• the execution cookbook is left untouched; marking the order table is the reader's step after the commit

Two more procedural core subsystems get a concrete migration plan in the shape the 2026 plans already use, and the analysis document that only listed candidates is retired now that its two remaining entries have plans of their own.

Core changes:

1. Database backup (docs/BACKUP-2026.md):

• addBackupTask() is replaced by one final Backup class owning database export and the creation of one verified, restorable artifact
• scheduler access, locking, state and presentation stay in the scheduler
• named Backup rather than DatabaseBackup, with addDatabaseBackup() as its first public operation so the short class name does not imply filesystem coverage
• one atomic replacement: atomic output, consistent reading, checked writes, exact artifact identity, cleanup and restore verification are part of the first implementation rather than a later hardening pass

2. Uploads (docs/UPLOAD-2026.md):

• upload(), check_file() and check_size() are replaced by one Upload class
• the separate editor upload implementation joins the same validation and storage boundary
• owner context, quota locking, DNS-pinned remote transfer, stale-partial recovery and the supported-flow criteria are settled without fallbacks

3. Retired analysis (docs/REFACTOR_CLASS_CANDIDATES.md):

• removed; the candidates it ranked are covered by the mail, comment, backup and upload plans

Benefits:

• both subsystems now have a plan that states a final contract instead of a direction, so neither can be half-migrated
• the docs directory holds plans that are executed rather than a list that is read

Technical notes:

• no PHP source changed
• both plans are proposed, not started
• both replace their contracts outright: no compatibility wrapper and no behavior-preserving intermediate implementation

Stage 1 of docs/COMMENTS-REDESIGN-2026.md closes here. The comment table now has exactly one owner: the three global helpers that shared it are gone, the last consumer reaching it through an assembled table name is closed, and a guard test asserts the boundary for the whole stage rather than for one batch.

Core changes:

1. Counter and resolver absorbed (core/classes/comment.php):

• numcom() becomes the private updateTargetCount()
  • three unreachable branches dropped: account/members, gallery, multimedia
  • their points slots 3, 17 and 29 leave the code; the users.points CSV keeps all 45 positions, because the list is indexed positionally
• getCommentMode() becomes the public getTargetMode()
• both index one MODULES map holding the target table and the points slot of the eight modules that render comments
  • the counter map and the supported-module list stop being two lists
• getStatusCount() added for the admin sidebar

2. The HTML monolith is deleted (core/system.php, core/user.php):

• ashowcom() removed; its frontend half is getCommentList() in core/user.php, directly above setComShow(), which is where the design puts the rendering
• the seven defined('ADMIN_FILE') branches are deleted rather than moved
  • core/user.php is required only under MODULE_FILE, so they were unreachable
• core/system.php shrinks from 5944 to 5689 lines

3. The last direct consumer is closed (core/admin.php):

• the waiting-content chip reads getStatusCount(CommentStatus::Pending)
• getAdminCountRow() takes an optional precomputed count and skips its own query when it is given; the other fifteen sidebar rows are unchanged
• the dead table, where and rate keys leave the comment entry of getProfileModules(), which is the shape that hid two consumers from earlier sweeps

4. Stage guard (tests/Unit/CommentIsolationTest.php):

• no production file but the class names the comment table
• the files that build a table name from a variable are a closed list, and neither getProfileModules() nor getAdminCountRow() can be handed comments
• the retired globals are defined nowhere and named nowhere
• the module map keeps its eight modules and their slots; the points CSV keeps its length

Benefits:

• one reader and one writer for the comment table, so a counter can no longer drift from the rows it counts
• the resolver that authorizes a target and the counter that follows a write sit behind the same private boundary, so the trust boundary stage 0 closed cannot be reopened from inside the project
• the render is 135 lines of markup assembly with no SQL and no dead branches

Technical notes:

• no table or column changes
• behaviour and markup preserved: 80 URLs per round compared against the pre-move tree, 80/80 identical descending, and the moderator branch the guest probe cannot reach proven by source equivalence
• measured on the live table: no stored row carries a module outside the map, so the dropped counter branches were unreachable in data as well as in code
• breaking change for third-party code: ashowcom(), numcom() and getCommentMode() no longer exist; no wrapper and no alias is provided

Stage 1, batch 5 of docs/COMMENTS-REDESIGN-2026.md. The profile feed, the profile hub and the eight module delete handlers stop reaching the comment table themselves, which leaves one runtime consumer outside the class and removes the last statement that pasted an id list into IN (...).

Core changes:

1. Target deletion and the profile count (core/classes/comment.php):

• deleteTarget() removes the comments of target rows a module admin has just deleted
  • one placeholder per id, so a bulk selection reaches the statement as bound values and the single case needs no second method
  • no counter is moved: a target that is gone has no row left to hold one, which is what the eight handlers did before the move
• getUserCount() answers the published comment count of one account, the number the profile hub shows beside its other module counters

2. Profile reads (core/user.php, modules/account/index.php):

• getProfileLastView() drops the comment branch of its UNION and fills the comment tab from getUserList()
• the profile hub drops the same branch and takes its count from getUserCount(), keeping the rating and favourites values it wrote before
• the unreachable "no parts" guard of the feed moved to the query itself, so a comment-only feed still renders and the empty case is unchanged

3. Module delete handlers (eight admin modules):

• faq, files, links, media, news, pages, shop and voting call deleteTarget() and hold no comment statement any more

4. Bulk id list (modules/shop/admin/index.php):

• productops() builds $keys/$pars the way the news and pages handlers already did
  • all six IN (...) clauses bind, closing the interpolation the plan lists as an acceptance criterion of this stage

5. Parity probe and guard (tests/):

• contract_probe.php gains three modes: the pre-move feed function beside the migrated one, deleteTarget() driven inside a rolled-back transaction, and the hub values of both versions
• CommentTargetTest.php asserts the migrated call sites and the measured behaviour, and pins the comment entry out of both UNION branches

Benefits:

• every runtime comment read and write goes through one class, except the admin sidebar chip recorded as open in the plan
• a target delete can no longer reach past the module it names
• the shop handler stops assembling SQL from a joined id list

Technical notes:

• no table or column changes; no behaviour change intended, and none measured
• the feed renders byte for byte against the UNION it replaces: 10 accounts, six with comments, one without, plus a missing, a zero and a negative id
• deleteTarget() measured on all eight modules, on a bulk selection, on a target id shared by five modules, and against crafted id lists and a crafted module name, all inside a transaction that is rolled back
• the eight routes exercised over real HTTP with a signed-in administrator: each removed only its own module's rows, a wrong token removed none, a repeated delete was a no-op, every per-module total returned to the value it started from
• core/admin.php:319 still counts pending comments through getAdminCountRow(), which assembles the table name from a variable; it is left for a batch that owns the admin sidebar

Stage 1, batch 4 of docs/COMMENTS-REDESIGN-2026.md. The admin comment module no longer touches the comment table: every read and write it performed now goes through the Comment class, which leaves the class as the only place that knows how a comment is stored, permitted and counted.

Core changes:

1. Moderation write methods (core/classes/comment.php):

• deleteComment() removes one comment and takes the target counter and the author points back when the removed row was published
  • the module and the target come from the stored row, never from the request, so the stage 0 trust boundary holds for deletion too
• updateBody() stores the body a moderator typed, verbatim
  • the moderation form is not the author edit path and applies neither checkEditRules() nor filterHtml() nor the edit window
• setStatus() takes the read-then-compare guard the moderation module always had
  • a comment already carrying the wanted status is answered as done without writing, so a repeated click cannot count its target twice
  • the frontend path inherits the guard and loses a double count it never intended; the rendered fragment is unchanged

2. Moderation module (admin/modules/comments.php):

• the module selector reads getModuleList(), the list and its count read getAdminList(), the edit form reads getComment()
• the four write handlers call setStatus(), deleteComment() and updateBody(); no handler takes $db any more
• the pager renders through getTplPagerView() from the total the list itself counted, replacing getTplPager() and its separate COUNT
  • the $where/$wcnt pair is gone, and with it the second, differently spelled description of one list
• the rewritten list loop drops its snake_case names per .rules/global.md

3. Trust boundary guard (tests/Unit/CommentTrustBoundaryTest.php):

• deleteComment() joined the methods asserted to read module and target from the stored row
• the numcom() assertion follows the $cid the new status guard needs

Benefits:

• the moderation list can no longer count one thing and show another
• a repeated approve or delete leaves counters and points untouched
• the admin panel gains prepared statements everywhere it had them by hand, and loses one hand-built subquery

Technical notes:

• no table or column changes; the current sort is untouched
• three measured behaviour changes, each a consequence of the move: an out-of-range page now clamps instead of answering "no information", &num=0 no longer builds "LIMIT -25, 25", and delete() redirects by the tab the request came from instead of by the deleted row's status
• parity measured over real HTTP with a signed-in administrator: 42 URLs in two rounds, 39 byte-identical in the module content region, the three others being the page clamp above; 16 write scenarios left identical rows, bodies, target counters, points and row count