Stages 4 and 5 of docs/COMMENTS-REDESIGN-2026.md. A comment action answers the one comment it touched instead of repainting the whole list, every mutation is a POST with its token out of the URL, and a comment may now answer another one: the reply is stored as a parent id and a sortable path, the page paginates root comments and carries each root with its branch, and a removed comment that still has a live reply stays as a tombstone.

Core changes:

1. Fragment responses (core/user.php, core/system.php, index.php):

2. addComment() answers one comment fragment and names its own placement

   • HX-Reswap and HX-Retarget decide afterbegin, afterend or the status zone
   • a full slice sheds its far-end row out of band, branch included
   • a pending comment answers the moderation notice, never a row in the list
3. getCommentView() renders one stored comment for the list and for a response

4. addComment, updateCommentStatus and deleteComment are POST only, refused in one place before any handler runs

5. deleteComment is a new frontend route
6. status and delete name their swap in the response, so a refusal removes nothing
7. updateComment() writes its refusal instead of returning it into a discarded value
8. the form clears only on a stored comment, through HX-Trigger and the shared script
9. Tokens and idempotency (core/user.php, core/helpers.php, plugins/system/slaed.js):

10. no comment action carries a token in its URL any more

    • the form carries a hidden token from getPageToken()
    • the moderation actions inherit one X-CSRF-TOKEN header per comment
    • getTplAjaxTextarea() moved to the same shape, which takes the forum editor too
11. a comment that offers no action declares no token at all
12. the idempotency key is minted in the browser and renewed only after a stored comment
13. Reply threads (core/classes/comment.php, setup/sql/table.sql, setup/sql/table_update6_3.sql):
14. pid and an ascii-binary path of ten-digit segments, with two indexes for them

15. getParentPath() refuses a parent of another target, a removed one, one the writer cannot see and one already at twenty segments

16. getList() counts and paginates roots and answers each with its whole branch
17. getBranch() answers one branch with an explicit limit

18. a removed comment with a live reply stays as a tombstone, by predicate rather than by a stored flag

19. existing comments become roots of their own and nothing is ever re-parented
20. Pagination transport (core/user.php, templates/lite/fragments/link.html):
21. the rows moved into a container of their own and the pager renders after it
22. one control appends the next page and replaces itself with the answer
23. its href is the ordinary page URL, so a reader without HTMX follows a plain link

24. getCommentPage() answers rows and the next control, and refuses a page past the last instead of answering the last one a second time

25. Links that name one comment (core/classes/comment.php, core/user.php):
26. getRootPage() answers the page a comment is rendered on

27. the notification and the other-page notice carry at=<comment id>, which setComShow() resolves, so an anchor no longer dies when newer comments arrive

28. Upgrade defects found and fixed on the way (setup/sql/table_update6_3.sql):

29. _users dropped network in the same file that modified it, so a re-run failed and discarded thirteen other column changes with it

30. _admins.editor was declared BOOLEAN while table.sql defines VARCHAR(32): it failed on any installation carrying an editor name, and would have destroyed those names had it ever passed

31. _users.points was declared twice and the second declaration undid the first
32. table.sql aligns points to NOT NULL DEFAULT 0
33. Page cache (core/classes/comment.php, index.php):
34. the five writes of the class invalidate after their own writes succeeded
35. a refusal, a no-op transition and a replayed key invalidate nothing
36. the ajax router no longer decides invalidation by route

Benefits:

• a comment action costs one fragment instead of a 51 KB list repaint, and the reader keeps scroll position and focus

• no token is baked into a URL or served to a reader who cannot act
• a link to a comment resolves for as long as the comment exists
• a discussion carries structure instead of a naming convention
• an upgrade no longer discards its own column changes without saying so

Technical notes:

• _comment gains pid INT UNSIGNED and path VARCHAR(255) ascii_bin plus modul_cid_pid_time and modul_cid_path; the backfill runs before the indexes

• a fresh install and the upgrade produce an identical table definition, rehearsed twice against the pre-6.3 shapes

• SchemaUpdateValidationTest compares column definitions and rejects a column declared twice with two definitions

• four new language constants in all six locales; _PCOPEN removed with its last reader

• CommentTransportTest (15 cases) and CommentThreadTest (10 cases) both fail against the pre-change tree

• comment pages stay canonical to their target page, so pagination adds no indexable URLs

Both plans keep their scope and gain the contracts their reviews found missing: the backup plan pins the scheduler boundary it depends on, and the upload plan pins the storage contracts its callers already rely on.

Core changes:

1. Backup plan (docs/BACKUP-2026.md):

2. the scheduler boundary is specified rather than assumed

   • every state-changing action is POST; GET only displays state
   • browser actions validate the SLAED CSRF token, cron authenticates by bearer

token in the body and never through the URL

• an OS flock keyed by the canonical job name owns a run; JSON status and

heartbeat are diagnostic only and unlock may not break a live lock

• dbbackup.settings defaults are synchronized across both config sources, and the 6.3 upgrade fills only missing keys

• the nine migration helper procedures are a release prerequisite; Backup fails closed while they exist and never deletes schema objects

• schema fingerprinting excludes AUTO_INCREMENT counters and table statistics
• scheduler row actions render through the real dial fragment
• the verification matrix names upgrade, route, concurrency and restore tests
• Upload plan (docs/UPLOAD-2026.md):

• deleteStoredFile() joins the public surface for the orphan case

  • a database write that fails after publication removes that exact result
  • containment and the destination lock are re-checked on the delete path

• paths are root-relative on both ends, and the stored name keeps the owner suffix the editor ownership filter reads

• go=4 stays as the editor route with two explicit cases and rejects the rest

• DNS resolution, cURL execution and the clock sit behind replaceable internal methods so the security cases are testable without a network

Benefits:

• both plans can now be handed to an implementer without a second review round
• the backup plan no longer depends on scheduler behaviour nobody wrote down
• the upload plan states the contracts a caller would otherwise rediscover

Technical notes:

• documentation only; no code, schema or configuration changes
• neither plan is started, and both keep their no-compatibility-wrapper rule

Stage 2 of docs/COMMENTS-REDESIGN-2026.md. The comment body becomes the source the author wrote and the parser escapes it on read, every write is transactional and idempotent, and the table gains the columns and indexes that make a soft delete, an idempotency key and a keyed flood fingerprint possible.

Core changes:

1. Comment subsystem (core/classes/comment.php):

2. checkRules() replaces checkAddRules()/checkEditRules() as one ordered rule set

   • the length rule measures the longest word, not the last one
   • it counts characters instead of bytes
   • the add-only rules (guest name, flood window, captcha) stay bound to the add

3. add, edit, status and delete are transactional with checked results

   • status and delete are conditional updates, so a parallel request cannot count twice
   • the row is read FOR UPDATE inside the same transaction
   • an operation joins a transaction that is already open instead of refusing
4. deleteComment() marks the row instead of erasing it, and every read filters it
5. addComment() stores reqkey, iphash and format and answers a replay from the failed insert
6. filterCommentBody() replaces filterHtml() in the write path and stores source
7. getBodyFormat() refuses html as a comment format
8. CommentMode replaces the bare acomm comparisons, getTargetMode() answers the enum
9. listings sort on time, id
10. Parser (core/classes/parser.php):

11. filterContent() and filterDoc() take the source format as a fifth argument

    • plain recognises no Markdown construct and turns line endings into breaks
    • anything else is Markdown, which is what every existing caller gets
12. the inline BB pairs stash their tags, so safe = true keeps them readable
13. Schema (setup/sql/table.sql, setup/sql/table_update6_3.sql):
14. five columns added: format, edited, deleted, reqkey, iphash
15. five indexes added, cid and modul_status dropped, KEY time kept
16. new addcol procedure, reqkey backfilled before its unique index is created
17. a fresh install and the upgrade produce an identical table definition
18. Storage migration (tools/comment-migrate.php):
19. classify writes the format of every row in its own reviewable pass
20. convert rewrites the bodies per class, in batches, resumable through a ledger
21. iphash backfills the flood fingerprint from the stored address
22. report and sample answer read-only, and --db runs the whole thing on a copy
23. Render sites (core/user.php, core/system.php, admin/modules/comments.php):
24. all four comment renders moved to safe = true and pass the row format
25. the moderation save reads the raw field, because the body is source now
26. Tests (tests/Unit/CommentStateTest.php, tests/Support/contract_probe.php):
27. 15 cases over a probe that signs in as an administrator before the core boots

28. repeated status transitions, idempotent delete, replayed key, stable sort, round-trip of both classes and the write-path normalisation are all measured

29. the stage 0 guard and the parser fixtures follow the two shapes this stage changed

Benefits:

• stored XSS through the comment path is closed by the rendering model itself

• a moderation click, a double submit and a repeated delete can no longer move a target counter or an author's points twice

• the flood check runs on an indexed fingerprint instead of a plain address
• the list, its count and its pager can no longer disagree about a deleted row

Technical notes:

• the body format is stored per row: plain or markdown, never html

• the upgrade is idempotent, but tools/comment-migrate.php is not optional - until classify and convert have run, comments render with their old escaping

• 121 of 7353 rendered comments change on purpose and are recorded in the plan

• docs/BACKUP-2026.md and docs/UPLOAD-2026.md carry an unrelated rewrite that was already in the working tree

The order table of the shared execution cookbook records that the mail queue and drain stage is finished and committed, so the next chat opens at the row after it instead of re-reading a stage that is already in the tree.

Core changes:

1. Order of work (docs/EXECUTION-2026.md):
2. row 4, mail stage 2, struck through and marked done

3. the next open row is comments stage 2, which still needs its one comment-baseline capture before its first chat

Benefits:

• the cookbook keeps telling a fresh session where to start

Technical notes:

• no code changes and no changes to the prompts or the templates

Stage 2 of docs/MAIL-2026.md. addQueue() stores a row and answers accepted into the queue; delivery moves to a scheduler job that claims, sends and records under a lock, so no request waits on a transport and no failure stays invisible. No call site changes: all 26 moved to $mailer->addQueue() in stage 1.

Core changes:

1. The queue table (setup/sql/table.sql, setup/sql/table_update6_3.sql):

2. {prefix}_mail holds kind, sender, email, title, body, ref, prio, time, ntime, tries, status, camp, hold, locked, lockid, phase, code and error

3. the claim index leads with hold, status, prio, ntime, id; kind_status_time and kind_ref_status serve retention and the campaign queries stage 3 adds

4. the upgrade statement creates the table with its primary key alone and adds every secondary index through addidx, so a half-applied schema is repaired instead of refused

5. Queue and drain (core/classes/mail.php):

6. addQueue() stores instead of delivering; every value is bounded against the column that holds it, and an oversized subject is refused where the caller can still be told rather than by a failing write

7. getBatch() claims one batch in a single conditional UPDATE and moves the rows behind the lock window, which is what makes the claim exclusive

   • the predicate is exactly what the claim index leads with: with a marker

column in it the optimizer left that index and filesorted 99 267 rows

• setResult() records the outcome, grows the backoff per attempt and fails the row at the attempt cap; a reference to a body that is gone is not retried

• updateQueue() is time-boxed rather than count-boxed, honours mail.rate across runs through the job state, and keeps one transport connection for the run

• deleteQueue() prunes accepted rows per kind and never touches a failed one
• sending is private: the queue is the only way out
• Scheduler job (config/scheduler.php, core/system.php, setup/index.php):
• maildrain ships active, runs every five minutes and stays manually triggerable

• addMailTask() maps a run to the job status: an empty queue is a success, a run that refused everything it tried is a failure

• the upgrade inserts the job into an existing config/scheduler.php
• Queue settings and the test send (admin/modules/config.php, admin/lang/*.php):

• batch, rate, tries, backoff, keep and keepbulk get a row on the mail tab and are validated on save

• the test send queues and then drains inside the request, so the button still reports the transport's own words; a run that sent nothing says so instead of claiming a delivery nobody observed

• seven constants added to all six locales
• Tests (tests/Unit/MailQueueTest.php, tests/Unit/MailDrainTest.php, tests/Support/):
• 25 tests over the statements the queue issues and the bounds it holds

• 15 tests driving the live database and a loopback SMTP sink through tests/Support/mail_probe.php and tests/Support/mail_relay.php

• the stage 1 transport tests now enter delivery the way the drain does

Benefits:

• a request that sends mail returns at once: the security notice measured here queues in 0.11 s where the same path used to wait on mail()

• a refused delivery is retried behind a backoff and recorded instead of being discarded

• one SMTP handshake per drain run rather than one per message

• the claim reads its 25 rows in 1.9 ms with 100 000 pending, against 202 ms before the predicate was written against the index

Technical notes:

• new table {prefix}_mail; a fresh install and an upgrade produce the same definition, the upgrade is idempotent and repairs a partially applied one

• two processes racing one queue of 400 rows claimed 200 each with no overlap

• breaking change: mail becomes asynchronous on every installation that takes this release, and addQueue() answers accepted into the queue, never delivered

• no compatibility layer and no runtime schema detection
• config/mail.php is unchanged: stage 1 already shipped every queue key