Implements the full 2026-07 performance plan: exact locked statistics, deferred post-response tracking, derived config, streaming GeoIP, shared category map, parser cache, cache GC, and a guest page cache that keeps every visitor-bound token isolated through signed dynamic-region markers.

Core changes:

1. Statistics and tracking (core/system.php):

2. Rewrite updateStatsTrack around one c+ handle with a single LOCK_EX

   • read, day/month rotation, truncate and write share one lock
   • first hit of a new day now records its own IP (hosts=1) and user
   • three duplicated counter-field blocks collapsed into one

3. Replace sessions.log with a signed base64url stats cookie

   • fields v1|sid|fst|lst|hits|country|cts|uniq-day|ip-hash, HMAC via

getSecret('stats'), verified with hash_equals, tamper resets session

• country carries a 24h TTL and is bound to the IP hash
• updateSessionState removed, sessions.log and its global lock retired

• Split tracking into pre-output cookies and post-response writes

  • addDeferredTask/setDeferredTasks queue with shutdown backstop
  • session_write_close before deferred writes, drains on all exits
  • news article counter update moved into the deferred queue

• Literal stripos matching for bots, fbots, and auto_links patterns

  • removes regex injection from config and DB values, caches results
• Conditional lastvis update (60s window) and _session upsert
• Session schema (setup/sql/table.sql, table_update6_3.sql):
• UNIQUE KEY on _session.uname for new installs

• mksessuniq migration: dedup by max(time, id), drop old index, add unique, idempotent on re-run; code uses INSERT ... ON DUPLICATE KEY

• Derived config cache v2 (core/system.php):

• getConfig stores derived data in config/local.php (version 2)

  • per-theme asset manifests with stat fingerprints, parsed SEO

graph/schema templates, logo dimensions per theme

• doCss/doScript drop per-request glob/stat sweeps, bundle hash only computed when bundling is enabled

• Streaming GeoIP (core/classes/geoip.php):

• MMDB reader works through fseek/fread ranges instead of loading the whole database file; metadata resolved from the last 128 KiB

  • byte-exact with the old reader, peak memory 25 MB -> 2 MB
  • fread(handle, 0) guarded (old substr was silently empty)

• Category map and parser cache (core/system.php, core/helpers.php, modules/news/index.php):

• getCategoryMap consolidates two duplicated category queries behind an epoch-keyed data cache with raw titles

• news list caches filterContent output keyed by content hash, parser config, theme, locale, and parser version; [block]/[hide]/[usephp]/ [attach] and local <img> content bypasses the cache

• Guest page cache with dynamic regions (core/system.php, core/classes/cache.php, core/security.php, blocks/*):

• Signed markers [[sldyn:type:par:hmac]] via getSecret('dynreg') keep user content from forging substitutable markers

• Regions: CSRF tokens (getPageToken), captcha (getPageCaptcha), and the whole voting widget; cache files contain zero live tokens

• Poison guard: a live getSiteToken/getCaptcha call during a cacheable build prevents storing the page entirely

• Default-deny route allowlist inside checkPageCache (news list only)

• Fail-closed sidecar with body hash and dyn flag; dynamic pages are no-store and never answer 304; substitution runs on hit and miss

• cache = 1 enabled in config/global.php
• Cache GC (core/classes/cache.php, core/system.php):

• deleteStaleTree recursively sweeps storage/cache/templates and the data cache joins the cachegc scheduler job

Benefits:

• Guest cache hit generation time 0.307s -> ~0.055s (5.3x)
• Uncached pages roughly halved (search 0.17s -> 0.09s)
• Day counters survive concurrent requests and day rollover
• CSRF/captcha isolation between visitors verified with two cookie jars

Technical notes:

• config/local.php cache version bumped to 2, rebuilt automatically

• theme asset changes now require a config rebuild (admin save or deleting config/local.php)

• _session migration applied to the dev DB; verify on MySQL before production rollout (developed against MariaDB 11.7)

• ip/agent freshness for logged-in users delayed up to 60 seconds

• docs/PERFORMANCE.md updated; docs/PERFORMANCE-REMEDIATION-2026.md is the completed plan, ready for deletion after review

Implements a dependency-free OAuth2 Authorization Code Flow with PKCE as the new external sign-in, removes the legacy uLogin integration completely and consolidates theme templates while keeping both themes self-contained.

Core changes:

1. OAuth client (core/classes/oauth.php, config/oauth.php):

2. Static Oauth class: provider config, PKCE auth URL, token exchange, hardened curl layer, JWKS cache with rotation, full RS256 id_token validation (exp/nbf/iat with skew, iss list, aud/azp, nonce)

   • Microsoft email trusted only with xms_edov or consumer tenant
   • state bound to the browser via __Host-oauth-st cookie (anti link-CSRF)

3. One-time flow storage in {prefix}_oauth_temp (state/pending kinds), permanent links in {prefix}_user_oauth, audit log in log_oauth.log

4. Account module (modules/account/index.php):

5. New ops: oauth_init, oauth (callback), oauth_finish, oauth_unlink

   • first sign-in offers linking to an existing account or creating a new

one; OAuth-created accounts store an unguessable '!'-prefixed marker

• unlink refuses to remove the last login method

• uLogin op network and all its guards removed; login/passmail/savepass work by password state instead of the dropped users.network column

• users_temp now stores bcrypt hashes; activate() keeps a transitional fallback for old plaintext rows

• Admin (modules/account/admin/index.php):
• Provider settings (activation, Client ID/Secret) in account preferences

• oauthlist view with forced unlink via POST buttons, link cleanup on user delete, pending-users list shows the activation code instead of the stored password

• Schema and migration (setup/sql/table.sql, table_update6_3.sql):
• New tables user_oauth and oauth_temp with engine/charset placeholders

• Idempotent migration archives legacy identities as provider 'ulogin' rows and drops the users.network column

• Themes (templates/admin, templates/lite):
• OAuth buttons, finish form and profile links tab; unified post-button

• Both login blocks render one block-login-form fragment via include, fixing the broken sidebar login (wrong field name, missing CSRF token)

• block-search-form merged into search-form; nine twin fragments synced between themes; speed dial fan opens only from its toggle

• Session write lock released before scheduler jobs (index.php) so long pseudo-cron runs no longer block the visitor session

Benefits:

• Passwordless sign-in without composer dependencies on shared hosting
• No plaintext passwords at rest anywhere in the system
• Fewer duplicated templates with identical twin fragments across themes

Technical notes:

• Redirect URI: index.php?name=account&op=oauth (HTTPS required)
• Providers ship disabled; admin help documents the full setup procedure
• Verified by 29 JWT unit tests, mock-OIDC E2E flows and phpunit (194 OK)

Post-release polish of the redesigned profile plus design demos for the account home page.

Core changes:

1. Profile status and identity (modules/account/index.php, account-profile.html):

2. Online/offline chip with bi-wifi / bi-wifi-off on success/danger tokens; new global _OFFLINE constant and capitalized _ONLINE in all six locales

3. Avatar ring colored by group like the user block: special group color first, otherwise the highest reached points group, validated hex passed as --sl-profile-ring

4. Signature block, site and hub queries reuse the existing selects, no extra queries added

5. Activity feed (core/user.php, account-profile-feed*.html, theme.css):

6. Entry dates render through the standard date-badge fragment at system chip sizes; custom 10px sizing removed

7. Spinning bi-arrow-repeat indicator on the tabs row in primary tone; overlay positioning keeps tab panels at full feed width

8. Indicator pauses together with the hovered feed scroll via :has()
9. Avatar geometry (theme.css):

10. box-sizing fixes for the profile avatar and the user block ring and avatar, so images no longer overlap the conic ring and sit centered

11. Dead code (theme.css, modules/account/index.php):

12. unused sl-user-group-special styles and the unused g.color column in the profile select removed

13. Cabinet design demos (demo/):

14. account-home-2026.html with six directions and account-home-final-2026.html with three finals, a module toggle simulator, auto-fit action shelf, files-category tone tiles and auto-scrolling panels; deferred work listed in docs/PROFILE-BACKLOG.md

Benefits:

• Status and group identity readable at a glance on any profile
• Feed visuals match the sitewide chip and date language
• Ready-to-transfer blueprint for the account home redesign

Align every editor surface with the active theme's visual language and add a size-limited base64 embed option to the image dialog. Harden the integration with the vendor engine after three virtual-DOM regressions.

Core changes:

1. Theme token contract (templates/*/assets/css/base.css):

2. field group (--sl-field-*), --sl-color-text-heading, --sl-color-on-dark, --sl-color-primary-hover, --sl-radius-card, --sl-shadow-input canonized; admin defines the field group, lite gains primary-hover

3. --sl-field-focus-ring is a color composed as 0 0 0 3px var() in place
4. Editor skin vendor alignment (templates/*/assets/editors/toastui/skin.css):

5. chrome, work area, toolbar states, mode switch, dropdown, popups, buttons, inputs, tabs, table selector, context menu, focus rings, selection, placeholders, md syntax accents and WYSIWYG content colors mapped to tokens

6. one control standard across all windows: theme font chain (vendor font stack removed), fields 32px/12px/field tokens, buttons 32px/12px, hints 11px; emoji tabs restyled as the popup button pair with primary active

7. toolbar header painted by the wrapper (rounded corners fixed), md tab bottom border restored, popup pinned to the right edge by CSS instead of the racy JS left assignment

8. Image dialog (plugins/editors/toastui/, templates/*/partials/):

9. three insert modes as theme-owned radios: upload to server (default), attachment thumbnail, and NEW base64 embed into the text with a 32 KB client limit (_EMODE* constants in all six locales)

10. file selection uploads automatically (no OK click), drag and drop included

11. system sl-alert everywhere: upload limits, messages and errors render in an extras strip; file field and hints unified with the file manager

12. Vendor virtual-DOM integration hard rules (editor-upload.js):

13. no foreign DOM inside vendor popups: SLAED nodes live in the extras strip and absolutely positioned blocks raised together with the window

14. vendor node text patched via nodeValue, never textContent

15. popup closing detected by a MutationObserver on the popup style attribute, fixing stuck header strips for guests and async close paths

16. Fullscreen (editor-tags.js):

17. height driven by the engine setHeight('100%') with save/restore, bottom tabs and mode switch stay visible; the 100vh CSS override removed

Benefits:

• Switching a theme now changes the complete editor look including geometry
• Anonymous and privileged flows verified end to end without JS errors
• docs/DATA-URI-SECURITY-PLAN.md records the follow-up server-side hardening

Complete the 'theme owns visuals, plugin owns mechanics' migration: every SLAED-authored visual asset now lives in the theme, plugins keep only logic and versioned vendor engines, and switching a theme changes the entire look.

Core changes:

1. Editor asset contract (core/classes/editor.php, plugins/editors/toastui/):

2. Theme skin moved to templates/<theme>/assets/editors/toastui/skin.css

   • loaded by Editor::getThemeSkin() right after the engine CSS
   • resolved from the effective editor key after all fallbacks
   • deduplicated per theme:key pair, missing declared skin is logged

3. Dialog markup moved to theme partials editor-toastui-{dialogs,files,templates}.html

   • dialogs partial renders window headers via a template loop
   • EditorToastTemplate bypass class deleted, standard getHtmlPart() used

4. Plugin JS builds no markup: emoji panel and file manager clone theme-owned <template> blocks and fill textContent/src/data-* only

5. Plugin JS renamed to editor-{tags,emoji,upload}.js; dead unminified vendor build toastui-editor.js removed

6. Theme structure validator (core/system.php):

7. checkThemeAssets() checks the canonical structure including editor assets declared in editor manifests

8. applied on all theme selection paths: user list/save, admin user edit, global config, getTheme() runtime guard

9. Avatars (core/user.php, modules/account/index.php, setup/):
10. system avatars and presets live in templates/<theme>/images/avatars/

11. getUserAvatarUrl() resolves presets/system from the active theme and accepts only the canonical presets/<name>.<ext> format

12. idempotent upgrade migration added to table_update6_3.sql with a PHP-side verification counter in setup

13. Icons and tokens (templates/, core/security.php):
14. Bootstrap Icons vendor directory renamed to assets/vendor/bootstrap-icons/

15. canonical token dictionary normalized: primary, bg-soft, text-muted, shadow-panel replace brand-link, surface, muted, shadow-medium everywhere

16. setExit() uses getThemeAssets() for emergency pages, getThemeCssFiles() and the manual icon CSS include removed

17. editor classes renamed to sl-editor-icon- / sl-editor-emoji-
18. toolbar icon color now follows --sl-color-text-muted
19. img_find() renamed to getThemeImagePath()

20. Multilingual search (lang/, plugins/editors/toastui/assets/i18n/, templates/admin/assets/js/):

21. emoji set stored as plain symbols, names and search keywords generated from Unicode CLDR for de/en/fr/pl/ru/uk with localized tooltips

22. editor labels moved to language constants (_EEMOJI*, _ETABS) in all six locale files

23. admin icon picker searches by official Bootstrap Icons tags plus CLDR-derived locale term maps, lazy-loaded on first open

Benefits:

• A theme is a complete, replaceable visual package validated on activation
• Editor CSS order is deterministic: engine first, theme skin second
• No innerHTML markup in plugin JS; designers restyle without touching plugins
• Reproducible avatar migration for existing installations