Batches 8, 9 and 10 of docs/UPLOAD-2026.md: admin upload moves onto the Upload class and the procedural pipeline is deleted, the 2026 format set goes live across every configuration and render path, and the final sweep proves nothing legacy survived. Two audits of that sweep are folded in, each of which found real defects rather than style.

Core changes:

1. Admin upload and settings (admin/modules/uploads.php, config/uploads.php):

2. uploadsave() publishes local first and remote second through the class

   • every limit comes from the all record, nothing is hardcoded at the call site
   • the all record carries 104857600 bytes and 1600x1600 to match

3. configsave() validates extensions against Upload::getSupportedTypes()

   • an unsupported extension is dropped, reported and never stored as enabled
   • both extension fields show the supported list as a hint
4. upload(), check_file() and check_size() are gone with their last caller
5. The 2026 format set (config/uploads.php, config/filetype.php, config/files.php):

6. the canonical 21 formats replace the old 26

   • ten formats withdrawn, each on its own evidence, two spellings corrected
   • modules gain only webp and avif; the full set reaches typ and the all record

7. config/filetype.php becomes five family templates over 21 keys

   • audio renders through audio, video through video, pdf through object
   • the dead screens class is gone and the lightbox binds to sl-attach
8. Upload class hardening (core/classes/upload.php):

9. images must decode, not merely parse a header

   • a truncated png passed getimagesize() and was published before this
   • a missing decoder answers unsupported instead of passing the file through
10. the remote write callback rejects a short write instead of counting it whole
11. the address policy blocks every IPv6 range IANA marks as not globally reachable
12. the class owned naming grammar is matched at its fixed salt length
13. Configuration writer (core/system.php, setup/index.php):

14. a value whose line would pass 180 characters is written as a concatenation

    • the split is deterministic, so an unchanged save round trips byte for byte
    • the installer copy follows, or a fresh install would write a different file
15. Verification (tests/, tools/upload-route-check.php):

16. UploadIntegrationTest drives the resolver and the accessor against real config

    • all fourteen module records survive resolve and serialize byte for byte
    • the five adapters are held to the ordering rule of the plan

17. tools/upload-route-check.php walks 47 rows of the route matrix over real HTTP

    • credentials come from the environment, TLS verification is on by default
    • every scenario compares tree and database around itself and cleans up

Benefits:

• one publication primitive, one rule parser, one type policy, one lock location
• every publishing flow validates by content rather than by extension alone
• the acceptance of the plan is reproducible from the repository, not by hand

Technical notes:

• ext-gd joins ext-curl and ext-fileinfo in the composer require block

• behavior changes: content stored with a withdrawn format renders as a plain link, a guest no longer sees historical files in the editor panel, and a build without a GD decoder refuses that image format instead of accepting it

• nine other configuration files still hold over-long lines and will be rewritten in the wrapped format the first time each is saved from its own settings tab

• stored reference formats are unchanged: avatar filenames, project relative _files.url values and the editor JSON shape all keep their existing contracts

• setContentActive() still runs before the checked UPDATE of the admin files handler; that ordering predates this migration and is left to its own task

Batches 6 and 7 of docs/UPLOAD-2026.md. Every remaining visitor-facing publisher now reaches the filesystem through Upload::addUploadedFile() after its own method, token and business checks have passed, so a preview, a refused form or a failed row write can no longer leave a file nobody references.

Core changes:

1. Account avatar (modules/account/index.php):

2. saveavatar() gates the whole operation behind POST and the account token

   • the old line validated the token only when op arrived in the POST body,

so GET ?op=saveavatar&avatar=<preset> wrote users.avatar with no token

• the preset branch now sits inside that gate and still calls no upload

• the upload publishes through the class and stores the returned filename

  • the rule is built from the $conf['users'] avatar keys, maxquota 0
  • adirectory loses exactly one leading uploads/ before it is passed on
• a failed profile write deletes the exact path this request published
• Avatar preset grid (templates/lite/fragments/table-row.html, theme.css):
• the is_avatar_link branch gained a form/button variant keyed on action

• sl-avatar-link moved from the anchor onto the form and got the two rules that strip the button chrome; line-height: 0 keeps the row height intact

• Frontend file module (modules/files/index.php):

• send() calls the class only when the save passed every check

  • a file counts as submitted when its error is not UPLOAD_ERR_NO_FILE
  • a refused file no longer falls back to the typed external URL
  • the gate also reads $conf['files']['upload'], which the old code ignored
• the row write is checked and compensated against the returned path
• Admin file module (modules/files/admin/index.php):

• save() publishes straight into the selected path field, else the configured one, so the publish-then-rename branch no longer runs for a new upload

  • relocation of an already stored file with no new upload is unchanged
  • preview and delete publish nothing at all now

• both row writes are checked; a failure deletes the published path and logs a stranded file through Logger::addFile()

• Plan record (docs/UPLOAD-2026.md):

• last completed batch, the decisions of batches 6 and 7, and what the route tests actually proved on the stand

Benefits:

• no upload path can publish before authorization, CSRF and validation pass
• stored size and path come from the class instead of a probed request path
• one publication primitive, lock-guarded and collision-free, for five flows
• the admin file handler writes each file exactly once

Technical notes:

• stored reference formats are unchanged: users.avatar keeps the filename only and _files.url keeps the project-relative uploads/<dir>/<file> shape

• Breaking: avatar presets are POST-only now, so a bookmarked GET link that set a preset stops working

• Breaking: an operator publishing through the frontend file form no longer gets a name without an owner suffix; the flow stores the user id or 0

• config/files.php still lists gzip, which the type map does not know, so a .gzip upload is refused until batch 9 corrects the spelling to gz

• admin upload and the format switch are untouched; upload(), check_file() and check_size() stay until batch 8 removes their last caller

Replaces the procedural database dump with a Backup class that proves what it produced, puts the scheduler on an operating system lock with a defined crash state, and closes the admin mutations that were reachable by a plain GET carrying a credential.

Core changes:

1. Database backup (core/classes/backup.php):

2. New Backup class replaces addBackupTask(), which is deleted without an alias or wrapper

   • Preflight fails before any output: settings, compressor, backup root, staging, link() probe, privileges
   • Export runs in one consistent snapshot, streams unbuffered, checks every write and fsyncs the dump
   • The archive is decompressed again and compared against the dump before it may become an artifact
   • Publication uses link(), which refuses to replace an existing name; the mode is set before linking
   • Retention ages both naming schemes together and is off by default

3. Absence of an object class is proven by effective privilege, never inferred from an empty catalog

   • Role-derived grants and MySQL partial revokes are resolved per vendor branch
   • Views are counted through information_schema.TABLES, which needs no SHOW VIEW
4. Scheduler protocol (core/system.php):

5. The operating system lock is the only authority on whether a job runs; JSON is status

   • A crashed run is reconciled to a defined state and becomes due again without file surgery
   • last_run survives reconciliation, so a crashed job resumes at its next slot
   • A scheduled run re-checks its slot while holding the lock, so one slot cannot run twice
   • A state that cannot be written refuses the run instead of reporting success
6. Job state now carries the contract fields plus the metrics of the run that just finished
7. Request boundary (core/security.php, admin/modules/*.php, index.php):
8. checkAdminPost() requires POST and reads the token from the body, scoped to its module
9. Fifteen admin modules migrated; row actions render through the dial POST contract
10. The direct scheduler endpoint accepts only pseudo and cron, and the isAdmin() bypass is gone
11. The pseudo trigger carries its credential in a body instead of an address
12. Consumers and documentation (admin/modules/scheduler.php, monitor.php, admin/info/scheduler/ru.md):
13. The list derives its state from the lock and the JSON together and shows a crashed job as such
14. A running job shows live elapsed time instead of the previous run's duration
15. The monitor measures published artifacts instead of the whole directory tree
16. The help page gained the backup section, a cron example with a POST body and the storage deny rule
17. Tests (tests/Unit, tests/Support):
18. Pure contract tests for the class, integration probes against a disposable schema, lock protocol tests
19. The mail probe now runs in its own schema, because claiming a batch took rows from the live queue

Benefits:

• A backup either exists as a verified, restorable artifact or fails before producing anything
• Two instances of one job cannot overlap, and a crashed one recovers without manual intervention
• An admin action can no longer be triggered by a link, a prefetcher or a link preview

Breaking changes:

• Cron must call the scheduler with POST; a GET invocation is refused
• addBackupTask() is removed; addSchedulerLock() and deleteSchedulerLock() are renamed
• addSchedulerTrigger() returns an array instead of a URL string

Stages 4 and 5 of the comment redesign land together with the machinery that keeps them honest: replies grow real branches, deletion leaves a tombstone while a living reply hangs under it, and the denormalised comment counter on every target gains a sweep that repairs drift instead of letting it rot. The four help pages the panel serves were rewritten against the code rather than against memory, because every one of them described a version that no longer exists.

Core changes:

1. Threaded discussion (core/classes/comment.php):

2. getBranch() answers one branch whole, so a reader may open a capped thread

   • getTreeRows() caps replies per root and reports what it withheld
   • getParentPath() resolves a parent inside the target it belongs to
   • MAXDEPTH bounds a branch at twenty levels
3. deleteUser() detaches a departed author without erasing the discussion
4. getBodyFormat() is private again; nothing outside the class chose a format
5. Counter drift (core/classes/comment.php, core/system.php):

6. getCountDrift() compares every stored counter against its live count

   • the visibility predicate lives in one place: published and not deleted
   • a target with no counter and no comment is never examined

7. updateCountDrift() recomputes inside the UPDATE, so a comment written between the report and the repair cannot be overwritten by a stale figure

8. addCommentTask() dispatches the sweep and names the modules it repaired
9. Scheduler job (config/scheduler.php, core/system.php, setup/index.php):
10. commentsync runs nightly, writes nothing when every counter agrees
11. the installer seeds the job so an upgraded site is not left without it
12. Manual sweep (tools/comment-recount.php):
13. report shows the drift, fix repairs it, both over the same class
14. Targeted schema patch (setup/sql/update6_3_patch.sql):

15. one file for a site already running 6.3: thread columns, their indexes and the path backfill, the admin and user column types, the counter sweep

16. guarded by procedures that add a column or an index only when it is absent, so the file may be run twice without a second thought

17. Panel help rewritten (admin/info/*/ru.md):
18. comments: threads, tombstones, capped replies, soft deletion, counters
19. newsletter: the queue tab, the eight campaign states, the real policy fields
20. config: the mail section, transport, queue and the address a reader sees

21. scheduler: all seven system jobs with their keys, defaults and schedules

    • Mail delivery was missing entirely, and nothing in the panel said that

the site stops sending mail when it is off

• Newsletter was documented as disabled by default, which it is not

• headings match the house scheme; the decorative icons are gone

Benefits:

• A wrong counter is now found and repaired rather than displayed forever
• An upgraded site can be patched from the admin panel, without the installer
• The help a reader opens describes the version they are running

Technical notes:

• Storage: pid and path on _comment, ascii_bin, ten-digit padded segments

• The counter counts published, undeleted comments; a tombstone is excluded while the visible replies below it are counted

• The thread patch is idempotent and carries no destructive statement

• Backward compatible: comments written before the upgrade stay roots, and no attempt is made to rebuild branches out of quoted names in their text

Stages 3 and 4 of docs/MAIL-2026.md. A mailing stops being a list of addresses rendered into a select and posted back, and becomes a criterion the scheduler expands into the queue in resumable slices, guarded by a suppression registry, a canary slice and a circuit breaker. The queue it writes into gains the admin view that was missing, so an installation can no longer accumulate mail silently.

Core changes:

1. Campaign state and the suppression registry (setup/sql/table.sql, setup/sql/table_update6_3.sql):

2. {prefix}_newsletter carries the campaign state machine

   • status, audit, apar, cursor, expect, total, fails, note
   • mails is dropped, after setup/index.php has moved anything still pending into the queue

3. {prefix}_maildead added, keyed by the normalised address

   • email uses a binary collation so case folding lives in the normaliser alone
4. delcol joins the idempotent migration helpers beside addcol and addidx
5. Delivery, verification and campaign control (core/classes/mail.php):

6. checkAddress() runs the ladder: syntax, recorded outcomes, cached domain resolution

   • every step fails open, so no check can become a precondition for delivery

7. failures are classified by the phase that produced them

   • only a permanent verdict at RCPT TO may touch the suppression registry
   • a transport-wide refusal stops the run instead of spending an attempt per row

8. setCampReady(), setCampFree(), setCampAbort() and the circuit breaker

   • the sample is drawn one address per recipient domain and never releases the rest
9. getStats(), getList(), setQueueRetry() and deleteQueueRows() serve the queue view
10. Audience producer (core/system.php):
11. updateNewsletter() expands one criterion in slices under a time budget, writing its cursor
12. getMailAudience() and getMailAudienceNum() resolve a criterion to its query and its count
13. addAdminMail() no longer rewrites _admins.modules; the admin screen owns that write
14. addMailTask() reports a transport-wide refusal as a failed run
15. Admin screens (admin/modules/newsletter.php, admin/modules/config.php):
16. the audience selector stores a criterion and never a list of addresses
17. the queue tab filters by kind and status and offers retry and delete
18. every state change is a POST carrying checkSiteToken()
19. the mail tab gains the verify and dnsttl rows
20. Documentation and locales (docs/, admin/lang/*.php, README.md and the root documents):
21. both stages recorded in the plan with their decisions, defects and open blockers
22. 21 constants added to all six admin locales
23. root documents drop their "last updated" lines and state the 8.4 requirement

Benefits:

• a mailing of any size stores one row per recipient and one copy of its body
• a damaged list is measured before it is sent to rather than after the damage
• a failed message is visible, retryable and explains itself in the operator's words
• a queue behind a stopped drain now says so on the screen that lists it

Technical notes:

• config/newsletter.php holds campaign policy alone; count and active are gone
• the newsletter scheduler job is now the producer and ships active
• the fresh schema and the upgraded schema were diffed and are identical
• breaking: {prefix}_newsletter.mails is removed, so the 6.3 upgrade must run first