Both proposed plans are corrected where their own self-review found a contract that would still have been unsafe or non-deterministic when implemented, so neither can be built from a design that has a known gap in it.

Core changes:

1. Scheduler access and locking (docs/BACKUP-2026.md):

2. the access matrix is written out per entry: an authenticated administrator is never a token bypass, pseudo-cron accepts only the session-bound site token, cron only the configured static one, and manual or unknown triggers are rejected on the direct endpoint

3. job exclusion moves from scheduler JSON to a process-held non-blocking flock kept for the whole run, so lock_timeout stays a budget and a diagnostic rather than permission for a second process to start

4. the shared admin dial gains a form mode: edit stays an anchor, run, unlock and delete become submit buttons inside one POST form the template owns

5. Deterministic export and restore (docs/BACKUP-2026.md):

6. the export session fixes time zone and SQL mode beside the isolation level and restores every value it changed, and failing to establish or restore it is a failed run

7. the dump prologue sets the same interpretation on the restoring side
8. the verification list, the risk table and the completion criteria follow
9. Remote transfer (docs/UPLOAD-2026.md):

10. CNAME traversal is bounded and fails closed, every A and AAAA answer of the terminal name is validated, and a host without a validated public answer is rejected

11. environment and configured proxies are disabled per hop, because a proxy moves DNS and connection enforcement outside the application

12. the work order, the security criteria and the risk table follow

Benefits:

• the two remaining procedural subsystems have plans whose security boundaries are settled before any code is written

• the corrections are recorded in each plan's progress table, so a later session can see that the earlier revision was superseded rather than lost

Technical notes:

• no PHP source changed and neither migration has started

• both plans keep replacing their contracts outright, with no compatibility wrapper and no behavior-preserving intermediate implementation

The mail plan gains its stage 2 entry and is corrected wherever the implementation measured something the plan had assumed, so a session reading only the plan sees the delivered design rather than the designed one.

Core changes:

1. Progress and decisions (docs/MAIL-2026.md):
2. stage 2 recorded: what was built, what was verified and against what

3. the claim is described as it is implemented and measured: the predicate is the leading columns of the claim index, and exclusivity comes from the claim moving a row behind the lock window

   • the measurement that decided it is written down, 202 ms against 1.9 ms

4. the upgrade statement lives in table_update6_3.sql, with the reason: 6.3 is the release this ships in, and a new file would give a fresh install the table and an upgraded one nothing

5. the drain job is priority 2, as the plan's own paragraph argues; its code block said 1 and is corrected

6. an empty drain run reports success and never idle, because the scheduler counts every other status as a failure and this job runs every five minutes

7. retention is keyed on the creation stamp, the only one the table has
8. the test send reports what the run did, not what the queue accepted
9. Blockers (docs/MAIL-2026.md):

10. concurrency closed: two processes racing one queue of 400 rows claimed 200 each with no overlap

11. added: delivery is still proven only against a loopback sink, the transactional retention delete cannot use an index prefix, and the queue rows on the mail tab were verified as controls rather than as behaviour

12. Facts re-measured:
13. the admin config module line references, shifted by the six queue rows

Benefits:

• the two places where the plan contradicted itself or the engine are settled in the plan rather than only in the code

• the next stage starts from measured numbers

Technical notes:

• no code changes

• the execution cookbook is left untouched; marking the order table is the reader's step after the commit

Two more procedural core subsystems get a concrete migration plan in the shape the 2026 plans already use, and the analysis document that only listed candidates is retired now that its two remaining entries have plans of their own.

Core changes:

1. Database backup (docs/BACKUP-2026.md):

2. addBackupTask() is replaced by one final Backup class owning database export and the creation of one verified, restorable artifact

3. scheduler access, locking, state and presentation stay in the scheduler

4. named Backup rather than DatabaseBackup, with addDatabaseBackup() as its first public operation so the short class name does not imply filesystem coverage

5. one atomic replacement: atomic output, consistent reading, checked writes, exact artifact identity, cleanup and restore verification are part of the first implementation rather than a later hardening pass

6. Uploads (docs/UPLOAD-2026.md):
7. upload(), check_file() and check_size() are replaced by one Upload class

8. the separate editor upload implementation joins the same validation and storage boundary

9. owner context, quota locking, DNS-pinned remote transfer, stale-partial recovery and the supported-flow criteria are settled without fallbacks

10. Retired analysis (docs/REFACTOR_CLASS_CANDIDATES.md):

11. removed; the candidates it ranked are covered by the mail, comment, backup and upload plans

Benefits:

• both subsystems now have a plan that states a final contract instead of a direction, so neither can be half-migrated

• the docs directory holds plans that are executed rather than a list that is read

Technical notes:

• no PHP source changed
• both plans are proposed, not started

• both replace their contracts outright: no compatibility wrapper and no behavior-preserving intermediate implementation

Stage 1 of docs/COMMENTS-REDESIGN-2026.md closes here. The comment table now has exactly one owner: the three global helpers that shared it are gone, the last consumer reaching it through an assembled table name is closed, and a guard test asserts the boundary for the whole stage rather than for one batch.

Core changes:

1. Counter and resolver absorbed (core/classes/comment.php):

2. numcom() becomes the private updateTargetCount()

   • three unreachable branches dropped: account/members, gallery, multimedia
   • their points slots 3, 17 and 29 leave the code; the users.points CSV keeps

all 45 positions, because the list is indexed positionally

• getCommentMode() becomes the public getTargetMode()

• both index one MODULES map holding the target table and the points slot of the eight modules that render comments

  • the counter map and the supported-module list stop being two lists
• getStatusCount() added for the admin sidebar
• The HTML monolith is deleted (core/system.php, core/user.php):

• ashowcom() removed; its frontend half is getCommentList() in core/user.php, directly above setComShow(), which is where the design puts the rendering

• the seven defined('ADMIN_FILE') branches are deleted rather than moved

  • core/user.php is required only under MODULE_FILE, so they were unreachable
• core/system.php shrinks from 5944 to 5689 lines
• The last direct consumer is closed (core/admin.php):
• the waiting-content chip reads getStatusCount(CommentStatus::Pending)

• getAdminCountRow() takes an optional precomputed count and skips its own query when it is given; the other fifteen sidebar rows are unchanged

• the dead table, where and rate keys leave the comment entry of getProfileModules(), which is the shape that hid two consumers from earlier sweeps

• Stage guard (tests/Unit/CommentIsolationTest.php):
• no production file but the class names the comment table

• the files that build a table name from a variable are a closed list, and neither getProfileModules() nor getAdminCountRow() can be handed comments

• the retired globals are defined nowhere and named nowhere

• the module map keeps its eight modules and their slots; the points CSV keeps its length

Benefits:

• one reader and one writer for the comment table, so a counter can no longer drift from the rows it counts

• the resolver that authorizes a target and the counter that follows a write sit behind the same private boundary, so the trust boundary stage 0 closed cannot be reopened from inside the project

• the render is 135 lines of markup assembly with no SQL and no dead branches

Technical notes:

• no table or column changes

• behaviour and markup preserved: 80 URLs per round compared against the pre-move tree, 80/80 identical descending, and the moderator branch the guest probe cannot reach proven by source equivalence

• measured on the live table: no stored row carries a module outside the map, so the dropped counter branches were unreachable in data as well as in code

• breaking change for third-party code: ashowcom(), numcom() and getCommentMode() no longer exist; no wrapper and no alias is provided

Stage 1, batch 5 of docs/COMMENTS-REDESIGN-2026.md. The profile feed, the profile hub and the eight module delete handlers stop reaching the comment table themselves, which leaves one runtime consumer outside the class and removes the last statement that pasted an id list into IN (...).

Core changes:

1. Target deletion and the profile count (core/classes/comment.php):

2. deleteTarget() removes the comments of target rows a module admin has just deleted

   • one placeholder per id, so a bulk selection reaches the statement as

bound values and the single case needs no second method

• no counter is moved: a target that is gone has no row left to hold

one, which is what the eight handlers did before the move

• getUserCount() answers the published comment count of one account, the number the profile hub shows beside its other module counters

• Profile reads (core/user.php, modules/account/index.php):

• getProfileLastView() drops the comment branch of its UNION and fills the comment tab from getUserList()

• the profile hub drops the same branch and takes its count from getUserCount(), keeping the rating and favourites values it wrote before

• the unreachable "no parts" guard of the feed moved to the query itself, so a comment-only feed still renders and the empty case is unchanged

• Module delete handlers (eight admin modules):

• faq, files, links, media, news, pages, shop and voting call deleteTarget() and hold no comment statement any more

• Bulk id list (modules/shop/admin/index.php):

• productops() builds $keys/$pars the way the news and pages handlers already did

  • all six IN (...) clauses bind, closing the interpolation the plan

lists as an acceptance criterion of this stage

1. Parity probe and guard (tests/):

2. contract_probe.php gains three modes: the pre-move feed function beside the migrated one, deleteTarget() driven inside a rolled-back transaction, and the hub values of both versions

3. CommentTargetTest.php asserts the migrated call sites and the measured behaviour, and pins the comment entry out of both UNION branches

Benefits:

• every runtime comment read and write goes through one class, except the admin sidebar chip recorded as open in the plan

• a target delete can no longer reach past the module it names
• the shop handler stops assembling SQL from a joined id list

Technical notes:

• no table or column changes; no behaviour change intended, and none measured

• the feed renders byte for byte against the UNION it replaces: 10 accounts, six with comments, one without, plus a missing, a zero and a negative id

• deleteTarget() measured on all eight modules, on a bulk selection, on a target id shared by five modules, and against crafted id lists and a crafted module name, all inside a transaction that is rolled back

• the eight routes exercised over real HTTP with a signed-in administrator: each removed only its own module's rows, a wrong token removed none, a repeated delete was a no-op, every per-module total returned to the value it started from

• core/admin.php:319 still counts pending comments through getAdminCountRow(), which assembles the table name from a variable; it is left for a batch that owns the admin sidebar