diff --git a/.gitignore b/.gitignore
index 95ad27922d..7b86f4e797 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,3 +65,4 @@ Desktop.ini
 !.gitignore
 !/.github
 !/.dockerignore
+/tmp/
diff --git a/core/functions/session_proxy.php b/core/functions/session_proxy.php
index d8551eefff..2764ef9450 100644
--- a/core/functions/session_proxy.php
+++ b/core/functions/session_proxy.php
@@ -33,7 +33,9 @@ public static function disabled(): bool
     }
 
     /**
-     * Drops the session middleware from a front-end group while sessions are disabled.
+     * Drops the session middleware from a front-end group while sessions are disabled,
+     * and with it what reads the store: ShareErrorsFromSession would throw
+     * "Session store not set on request" on every routed front-end request.
      * @param string[] $middleware
      * @return string[]
      */
@@ -46,6 +48,7 @@ public static function filterMiddleware(array $middleware): array
         return array_values(array_filter($middleware, static fn ($m) => !in_array($m, [
             \Illuminate\Session\Middleware\StartSession::class,
             \EvolutionCMS\Middleware\SessionProxy::class,
+            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
         ], true)));
     }
 
diff --git a/core/lang/az/global.php b/core/lang/az/global.php
index d5a5a951f1..adb4c203e1 100644
--- a/core/lang/az/global.php
+++ b/core/lang/az/global.php
@@ -269,6 +269,7 @@
 $_lang["resource_parent"] = 'Ana resurs';
 $_lang["resource_parent_help"] = 'Ana resursu təyin etmək üçün ikona klikləyin, sonra Sayt Ağacında bir resurs seçərək yeni ana resurs təyin edin.';
 $_lang["resource_permissions_error"] = 'Bu resursu, daxil ola bildiyiniz ən azı bir resurs qrupuna təyin edin.';
+$_lang["resource_save_unconfirmed"] = 'Yadda saxlama təsdiqlənmədi. Redaktor saxlanılmış vəziyyəti göstərmək üçün yenidən yüklənəcək.';
 $_lang["resource_setting"] = 'Resurs ayarı';
 $_lang["resource_summary"] = 'Qısa məzmun (giriş mətni)';
 $_lang["resource_summary_help"] = 'Resurs üçün qısa xülasə daxil edin';
diff --git a/core/lang/be/global.php b/core/lang/be/global.php
index ec3223eb28..712fd87f52 100644
--- a/core/lang/be/global.php
+++ b/core/lang/be/global.php
@@ -257,6 +257,7 @@
 $_lang["resource_parent"] = 'Бацькоўскі рэсурс';
 $_lang["resource_parent_help"] = 'Націсніце значок, каб выбраць бацькоўскі рэсурс для гэтага рэсурсу.';
 $_lang["resource_permissions_error"] = 'Для гэтага рэсурсу патрэбныя дазволы. Калі ласка, патрабуйце дазволы ад адміністратара сайта.';
+$_lang["resource_save_unconfirmed"] = 'Захаванне не пацверджана. Рэдактар будзе перазагружаны, каб паказаць захаваны стан.';
 $_lang["resource_setting"] = 'Налады рэсурсу';
 $_lang["resource_summary"] = 'Кароткі змест';
 $_lang["resource_summary_help"] = 'Увядзіце кароткае апісанне ці змест гэтага рэсурсу.';
diff --git a/core/lang/bg/global.php b/core/lang/bg/global.php
index 2f56cee9d6..6684bf6838 100644
--- a/core/lang/bg/global.php
+++ b/core/lang/bg/global.php
@@ -721,6 +721,7 @@
 $_lang["resource_parent"] = 'Родител на Документа';
 $_lang["resource_parent_help"] = 'Щракнете на горната икона, за да разрешите (или забраните) избирането на родителя на този документ. След това, щракнете върху документ от дървото, за да укажете неговия нов родителски документ.';
 $_lang["resource_permissions_error"] = 'Assign this Resource to at least one Resource Group to which you have access.';
+$_lang["resource_save_unconfirmed"] = 'Записът не беше потвърден. Редакторът ще се презареди, за да покаже съхраненото състояние.';
 $_lang["resource_setting"] = 'Настройки на Документа';
 $_lang["resource_summary"] = 'Резюме (introtext)';
 $_lang["resource_summary_help"] = 'Въведете кратко резюме за документа';
diff --git a/core/lang/cs/global.php b/core/lang/cs/global.php
index 22c2bd0d52..3301b9f2df 100644
--- a/core/lang/cs/global.php
+++ b/core/lang/cs/global.php
@@ -725,6 +725,7 @@
 $_lang["resource_parent"] = 'Umístění dokumentu';
 $_lang["resource_parent_help"] = 'Klikněte v adresářovém stromě na ikonku složky pro jeho otevření (zavření), a potom na dokument v stromu, který chcete nastavit jako umístění dokumentu.';
 $_lang["resource_permissions_error"] = 'Přiřaďte tento dokument alespoň do jedné skupiny dokumentů, kterou můžete používat.';
+$_lang["resource_save_unconfirmed"] = 'Uložení se nepodařilo potvrdit. Editor se znovu načte a zobrazí uložený stav.';
 $_lang["resource_setting"] = 'Nastavení dokumentu';
 $_lang["resource_summary"] = 'Souhrn (introtext)';
 $_lang["resource_summary_help"] = 'Model stručného souhrnu dokumentu';
diff --git a/core/lang/da/global.php b/core/lang/da/global.php
index 0178d6e069..2fcb8e7f28 100644
--- a/core/lang/da/global.php
+++ b/core/lang/da/global.php
@@ -722,6 +722,7 @@
 $_lang["resource_parent"] = 'Ovenstående ressource';
 $_lang["resource_parent_help"] = 'Klik på ikonet for at aktivere funktionen. Klik derefter på den ressource i website træet som denne ressource fremover skal være under.';
 $_lang["resource_permissions_error"] = 'Tilføj denne ressource til mindst én ressource gruppe du selv har rettigheder til.';
+$_lang["resource_save_unconfirmed"] = 'Gemningen kunne ikke bekræftes. Editoren genindlæses for at vise den gemte tilstand.';
 $_lang["resource_setting"] = 'Ressource redigering';
 $_lang["resource_summary"] = 'Introduktion';
 $_lang["resource_summary_help"] = 'Indtast et kort resume for denne ressource';
diff --git a/core/lang/de/global.php b/core/lang/de/global.php
index 829c951a74..1e03a9fd99 100644
--- a/core/lang/de/global.php
+++ b/core/lang/de/global.php
@@ -767,6 +767,7 @@
 $_lang["resource_parent"] = 'Container';
 $_lang["resource_parent_help"] = 'Klicken Sie auf eine Ressource im Baum, um diese als übergeordnete Ressource zu wählen.';
 $_lang["resource_permissions_error"] = 'Weisen Sie diese Ressource mindestens einer Ressourcen-Gruppe zu, zu der Sie Zugriff haben.';
+$_lang["resource_save_unconfirmed"] = 'Das Speichern konnte nicht bestätigt werden. Der Editor wird neu geladen und zeigt den gespeicherten Stand.';
 $_lang["resource_setting"] = 'Ressourcen-Eigenschaften';
 $_lang["resource_summary"] = 'Zusammenfassung';
 $_lang["resource_summary_help"] = 'Geben Sie eine kurze inhaltliche Zusammenfassung der Ressource ein.';
diff --git a/core/lang/en/global.php b/core/lang/en/global.php
index f0ec7db704..2b7edf1ad5 100644
--- a/core/lang/en/global.php
+++ b/core/lang/en/global.php
@@ -786,6 +786,7 @@
 $_lang["resource_parent"] = 'Resource parent';
 $_lang["resource_parent_help"] = 'Click the icon to enable setting a Resource parent, then click a Resource in the Site Tree to set a new parent.';
 $_lang["resource_permissions_error"] = 'Assign this Resource to at least one Resource Group to which you have access.';
+$_lang["resource_save_unconfirmed"] = 'The save could not be confirmed. The editor reloads to show the stored state.';
 $_lang["resource_setting"] = 'Resource setting';
 $_lang["resource_summary"] = 'Summary (introtext)';
 $_lang["resource_summary_help"] = 'Type a brief summary of the Resource';
diff --git a/core/lang/es/global.php b/core/lang/es/global.php
index 97c4d0aeeb..925d0fa0c9 100644
--- a/core/lang/es/global.php
+++ b/core/lang/es/global.php
@@ -769,6 +769,7 @@
 $_lang["resource_parent"] = 'Padre del documento';
 $_lang["resource_parent_help"] = 'Haz clic en el icono de arriba para habilitar (o deshabilitar) seleccionar el padre de este documento. Luego, haz clic en un documento del árbol para seleccionar su nuevo padre.';
 $_lang["resource_permissions_error"] = 'Asigna este Documento a por lo menos un Grupo de Documentos al que puedas acceder.';
+$_lang["resource_save_unconfirmed"] = 'No se pudo confirmar el guardado. El editor se recargará para mostrar el estado almacenado.';
 $_lang["resource_setting"] = 'Configuración de documento';
 $_lang["resource_summary"] = 'Resumen (introtext)';
 $_lang["resource_summary_help"] = 'Escribe un resumen corto del documento';
diff --git a/core/lang/fa/global.php b/core/lang/fa/global.php
index 307241ca0e..6c7669d472 100644
--- a/core/lang/fa/global.php
+++ b/core/lang/fa/global.php
@@ -722,6 +722,7 @@
 $_lang["resource_parent"] = 'سرگروه پرونده';
 $_lang["resource_parent_help"] = 'برای انتخاب یا مشخص کردن سرگروه این پرونده روی نماد یا آیکون بالا کلیک کنید سپس از طریق درختی روی پرونده کلیک کنید تا سرگروه جدید آنرا تعیین کنید';
 $_lang["resource_permissions_error"] = 'Assign this Resource to at least one Resource Group to which you have access.';
+$_lang["resource_save_unconfirmed"] = 'ذخیره‌سازی تأیید نشد. ویرایشگر برای نمایش وضعیت ذخیره‌شده دوباره بارگذاری می‌شود.';
 $_lang["resource_setting"] = 'تنظیمات پرونده';
 $_lang["resource_summary"] = 'خلاصه یا مقدمه ی کوتاه مطلب';
 $_lang["resource_summary_help"] = 'خلاصه ای مختصر از پرونده را در اینجا ذکر کنید.';
diff --git a/core/lang/fi/global.php b/core/lang/fi/global.php
index a8e6de7354..e906a98307 100644
--- a/core/lang/fi/global.php
+++ b/core/lang/fi/global.php
@@ -721,6 +721,7 @@
 $_lang["resource_parent"] = 'Sivun paikka';
 $_lang["resource_parent_help"] = 'Napsauta ensin yllä olevaa kansiokuvaketta ja sitten sivukartasta sitä sivua, jonka alle tämä sivu sijoitetaan.';
 $_lang["resource_permissions_error"] = 'Sijoita tämä sivu vähintään yhteen sivuryhmään, johon myös itselläsi on käyttöoikeudet.';
+$_lang["resource_save_unconfirmed"] = 'Tallennusta ei voitu vahvistaa. Editori ladataan uudelleen tallennetun tilan näyttämiseksi.';
 $_lang["resource_setting"] = 'Sivun asetukset';
 $_lang["resource_summary"] = 'Yhteenveto';
 $_lang["resource_summary_help"] = 'Sivun yhteenveto.';
diff --git a/core/lang/fr/global.php b/core/lang/fr/global.php
index cc0440267e..807f1da0e2 100644
--- a/core/lang/fr/global.php
+++ b/core/lang/fr/global.php
@@ -724,6 +724,7 @@
 $_lang["resource_parent"] = 'Ressource parente';
 $_lang["resource_parent_help"] = 'Cliquez sur l\'icône ci-dessus pour activer (ou désactiver) la sélection d\'une Ressource parente. Cliquez ensuite sur une Ressource dans l\'Arbre du Site pour la choisir comme parente.';
 $_lang["resource_permissions_error"] = 'Assignez cette Ressource à au moins un Groupe de Ressources auquel vous avez accès.';
+$_lang["resource_save_unconfirmed"] = 'L\'enregistrement n\'a pas pu être confirmé. L\'éditeur se recharge pour afficher l\'état enregistré.';
 $_lang["resource_setting"] = 'Propriétés de la Ressource';
 $_lang["resource_summary"] = 'Résumé';
 $_lang["resource_summary_help"] = 'Rédigez un bref résumé de la Ressource';
diff --git a/core/lang/he/global.php b/core/lang/he/global.php
index 207bc3675f..2006bb504f 100644
--- a/core/lang/he/global.php
+++ b/core/lang/he/global.php
@@ -722,6 +722,7 @@
 $_lang["resource_parent"] = 'אב המסמך';
 $_lang["resource_parent_help"] = 'Click on the icon above to enable (or disable) selecting this document\'s parent. Next, click a document in the tree to set its new parent.';
 $_lang["resource_permissions_error"] = 'Assign this Document to at least one Document Group which you can access.';
+$_lang["resource_save_unconfirmed"] = 'לא ניתן היה לאשר את השמירה. העורך ייטען מחדש כדי להציג את המצב השמור.';
 $_lang["resource_setting"] = 'הגדרות מסמך';
 $_lang["resource_summary"] = 'סיכום (introtext)';
 $_lang["resource_summary_help"] = 'Type a brief summary of the document';
diff --git a/core/lang/it/global.php b/core/lang/it/global.php
index d415271379..d2d7c016de 100644
--- a/core/lang/it/global.php
+++ b/core/lang/it/global.php
@@ -769,6 +769,7 @@
 $_lang["resource_parent"] = 'Risorsa genitore';
 $_lang["resource_parent_help"] = 'Selezionate una Risorsa nella struttura ad albero per impostarla come genitore di questa Risorsa.';
 $_lang["resource_permissions_error"] = 'Assegnate questa Risorsa ad almeno un Gruppo Risorse al quale avete accesso.';
+$_lang["resource_save_unconfirmed"] = 'Il salvataggio non è stato confermato. L\'editor verrà ricaricato per mostrare lo stato memorizzato.';
 $_lang["resource_setting"] = 'Impostazioni Risorsa';
 $_lang["resource_summary"] = 'Sommario';
 $_lang["resource_summary_help"] = 'Inserire un breve sommario della Risorsa';
diff --git a/core/lang/ja/global.php b/core/lang/ja/global.php
index a94fedc5a3..131476e637 100644
--- a/core/lang/ja/global.php
+++ b/core/lang/ja/global.php
@@ -797,6 +797,7 @@
 $_lang["resource_parent"] = '親リソース';
 $_lang["resource_parent_help"] = 'コンテナアイコンをクリックすると、このリソースの親(コンテナ)を変更できる状態になります。アイコンが変化している状態で、親にしたいリソースをリソースツリー上でクリックしてください。もう一度クリックすると元に戻ります。';
 $_lang["resource_permissions_error"] = 'このリソースを、少なくともアクセス可能な一つ以上のリソースグループへ割り当ててください。';
+$_lang["resource_save_unconfirmed"] = '保存を確認できませんでした。保存済みの状態を表示するためエディターを再読み込みします。';
 $_lang["resource_setting"] = 'リソース設定';
 $_lang["resource_summary"] = '要約(序説)';
 $_lang["resource_summary_help"] = 'リソースの要約を入力します。リソース変数：[*introtext*]';
diff --git a/core/lang/nl/global.php b/core/lang/nl/global.php
index e9df93c16b..4187816b2e 100644
--- a/core/lang/nl/global.php
+++ b/core/lang/nl/global.php
@@ -757,6 +757,7 @@
 $_lang["resource_parent"] = 'Hoofdpagina';
 $_lang["resource_parent_help"] = 'Selecteer een Pagina in de Website boomstructuur om het als Hoofdpagina van deze Pagina in te stellen.';
 $_lang["resource_permissions_error"] = 'Koppel deze Pagina aan tenminste 1 Paginagroep waar u toegang tot heeft.';
+$_lang["resource_save_unconfirmed"] = 'Het opslaan kon niet worden bevestigd. De editor wordt opnieuw geladen om de opgeslagen staat te tonen.';
 $_lang["resource_setting"] = 'Pagina instellingen';
 $_lang["resource_summary"] = 'Samenvatting (introductietekst)';
 $_lang["resource_summary_help"] = 'Typ een korte beschrijving van de Pagina.';
diff --git a/core/lang/nn/global.php b/core/lang/nn/global.php
index 14650968e6..0a737347f2 100644
--- a/core/lang/nn/global.php
+++ b/core/lang/nn/global.php
@@ -721,6 +721,7 @@
 $_lang["resource_parent"] = 'Dokumenteier';
 $_lang["resource_parent_help"] = 'Klikk på det ovenstående mappeikonet for å sette (eller fjerne) eiervalg. Klikk deretter på et dokument i dokumenttreet for å sette det som eier til dette dokumententet.';
 $_lang["resource_permissions_error"] = 'Assign this Resource to at least one Resource Group to which you have access.';
+$_lang["resource_save_unconfirmed"] = 'Lagringen kunne ikke bekreftes. Editoren lastes på nytt for å vise den lagrede tilstanden.';
 $_lang["resource_setting"] = 'Dokumentinnstillinger';
 $_lang["resource_summary"] = 'Sammendrag';
 $_lang["resource_summary_help"] = 'Skriv et kort sammendrag av dokumentet';
diff --git a/core/lang/pl/global.php b/core/lang/pl/global.php
index 8561051913..1ead2c86f2 100644
--- a/core/lang/pl/global.php
+++ b/core/lang/pl/global.php
@@ -770,6 +770,7 @@
 $_lang["resource_parent"] = 'Dokument nadrzędny';
 $_lang["resource_parent_help"] = 'Kliknij na powyższej ikonie folderu aby włączyć (lub wyłączyć) wybór dokumentu nadrzędnego, a następnie kliknij na dokumencie w drzewie, żeby ustawić go jako nadrzędny dla tego dokumentu.';
 $_lang["resource_permissions_error"] = 'Przypisz ten zasób przynajmniej do jednej grupy zasobów do której masz dostęp.';
+$_lang["resource_save_unconfirmed"] = 'Nie udało się potwierdzić zapisu. Edytor zostanie przeładowany, aby pokazać zapisany stan.';
 $_lang["resource_setting"] = 'Ustawienia dokumentu';
 $_lang["resource_summary"] = 'Wstęp';
 $_lang["resource_summary_help"] = 'Wpisz krótki wstęp dla dokumentu';
diff --git a/core/lang/pt/global.php b/core/lang/pt/global.php
index 4e209d6889..9530d7f931 100644
--- a/core/lang/pt/global.php
+++ b/core/lang/pt/global.php
@@ -721,6 +721,7 @@
 $_lang["resource_parent"] = 'Document pai';
 $_lang["resource_parent_help"] = 'Clique no ícone acima para activar (ou desactivar) a selecção do \'pai\' deste documento. Em seguida clique num documento da árvore para atribuir-lhe parentesco.';
 $_lang["resource_permissions_error"] = 'Assign this Resource to at least one Resource Group to which you have access.';
+$_lang["resource_save_unconfirmed"] = 'Não foi possível confirmar a gravação. O editor será recarregado para mostrar o estado guardado.';
 $_lang["resource_setting"] = 'Configurações do documento';
 $_lang["resource_summary"] = 'Introdução';
 $_lang["resource_summary_help"] = 'Escreva um breve resumo do conteúdo do documento.';
diff --git a/core/lang/sk/global.php b/core/lang/sk/global.php
index 257922584a..75cd85f004 100644
--- a/core/lang/sk/global.php
+++ b/core/lang/sk/global.php
@@ -788,6 +788,7 @@
 $_lang["resource_parent"] = 'Priečinok';
 $_lang["resource_parent_help"] = 'Kliknite na ikonu kontajnera hore pre zapnutie (vypnutie) režimu výberu rodičovského zdroja, potom ho vyberte v strome webu vľavo.';
 $_lang["resource_permissions_error"] = 'Prepojte tento zdroj aspoň s jednou skupinou zdrojov, ku ktorej máte prístup.';
+$_lang["resource_save_unconfirmed"] = 'Uloženie sa nepodarilo potvrdiť. Editor sa znova načíta a zobrazí uložený stav.';
 $_lang["resource_setting"] = 'Nastavenia zdroja';
 $_lang["resource_summary"] = 'Anotácia (úvod)';
 $_lang["resource_summary_help"] = 'Zadajte krátky popis zdroja';
diff --git a/core/lang/sv/global.php b/core/lang/sv/global.php
index d3630b4c38..ee9766dda3 100644
--- a/core/lang/sv/global.php
+++ b/core/lang/sv/global.php
@@ -722,6 +722,7 @@
 $_lang["resource_parent"] = 'Resursförälder';
 $_lang["resource_parent_help"] = 'Klicka på ikonen för att aktivera val av förälder för denna resurs. Klicka sedan på en resurs i webbplatsträdet för att ange den som ny förälder.';
 $_lang["resource_permissions_error"] = 'Tilldela denna resurs till minst en resursgrupp som du kan komma åt.';
+$_lang["resource_save_unconfirmed"] = 'Sparningen kunde inte bekräftas. Redigeraren laddas om för att visa det sparade läget.';
 $_lang["resource_setting"] = 'Resursinställningar';
 $_lang["resource_summary"] = 'Sammanfattning';
 $_lang["resource_summary_help"] = 'Skriv en kort sammanfattning av resursen';
diff --git a/core/lang/uk/global.php b/core/lang/uk/global.php
index 922da98a80..a0e5f04d5e 100644
--- a/core/lang/uk/global.php
+++ b/core/lang/uk/global.php
@@ -793,6 +793,7 @@
 $_lang["resource_parent"] = 'Папка';
 $_lang["resource_parent_help"] = 'Клацніть мишею на значку контейнера вгорі, щоб включити (виключити) режим вибору батьківського ресурсу, потім виберіть його в дереві сайту зліва.';
 $_lang["resource_permissions_error"] = 'Зв\'яжіть цей ресурс принаймні з однією групою ресурсів, до якої у Вас є доступ.';
+$_lang["resource_save_unconfirmed"] = 'Збереження не підтверджено. Редактор перезавантажиться, щоб показати збережений стан.';
 $_lang["resource_setting"] = 'Налаштування ресурса';
 $_lang["resource_summary"] = 'Анотація (введення)';
 $_lang["resource_summary_help"] = 'Введіть короткий опис ресурсу';
diff --git a/core/lang/zh/global.php b/core/lang/zh/global.php
index 9fb1880cd6..a30d0d7ab8 100644
--- a/core/lang/zh/global.php
+++ b/core/lang/zh/global.php
@@ -722,6 +722,7 @@
 $_lang["resource_parent"] = '文档之父本。';
 $_lang["resource_parent_help"] = '点上面文件夹的图标来激活或禁止父本的选择，当激活的时候，你可以从文档树中选择一文档作为本文档的父本。';
 $_lang["resource_permissions_error"] = 'Assign this Resource to at least one Resource Group to which you have access.';
+$_lang["resource_save_unconfirmed"] = '无法确认保存。编辑器将重新加载以显示已保存的状态。';
 $_lang["resource_setting"] = '文档设置';
 $_lang["resource_summary"] = '摘要 (介绍)';
 $_lang["resource_summary_help"] = '输入文档的大纲';
diff --git a/core/src/Core.php b/core/src/Core.php
index 24a2f0e5f1..e569307ac4 100644
--- a/core/src/Core.php
+++ b/core/src/Core.php
@@ -401,20 +401,21 @@ public function checkAuth($context = '')
      */
     public function checkAccess($userId): bool
     {
-        if (empty($context)) {
-            $context = $this->getContext();
-        }
-        $user = User::query()->find(evo()->getLoginUserID($context));
-        if (is_null($user)) {
+        // one query for the three block columns; a user without an attributes row passes as before
+        $row = User::query()
+            ->leftJoin('user_attributes', 'user_attributes.internalKey', '=', 'users.id')
+            ->where('users.id', (int) $userId)
+            ->first(['users.id', 'user_attributes.blocked', 'user_attributes.blockeduntil', 'user_attributes.blockedafter']);
+        if (is_null($row)) {
             return false;
         }
-        if ($user->attributes->blocked != 0) {
+        if ((int) $row->blocked != 0) {
             return false;
         }
-        if ($user->attributes->blockeduntil > time()) {
+        if ((int) $row->blockeduntil > time()) {
             return false;
         }
-        if ($user->attributes->blockedafter < time() && $user->attributes->blockedafter > 0) {
+        if ((int) $row->blockedafter < time() && (int) $row->blockedafter > 0) {
             return false;
         }
         return true;
@@ -1318,14 +1319,14 @@ protected function runPubStatusSync($timeNow)
      * Otherwise runs at shutdown, so it works on every SAPI including Apache mod_php, plain CGI and Windows/IIS
      * @param callable $callback
      */
-    protected function deferAfterResponse(callable $callback)
+    public function deferAfterResponse(callable $callback)
     {
         register_shutdown_function(function () use ($callback) {
             $this->finishRequest();
             try {
                 $callback();
             } catch (\Throwable $e) {
-                Log::error('Deferred publish-status sync failed: ' . $e->getMessage());
+                Log::error('Deferred after-response work failed: ' . $e->getMessage(), ['exception' => $e]);
             }
         });
     }
@@ -3944,9 +3945,9 @@ public function lockElement($type, $id)
         if (!$type || !$id || !$userId) {
             return false;
         }
-        return ActiveUserLock::query()->updateOrCreate(['elementId' => $id],
-            ['internalKey' => $userId, 'elementType' => $type, 'lasthit' => $this->time, 'sid' => $this->sid]);
+        Services\ManagerActivity::instance()->lock($type, $id, (int) $userId, (string) $this->sid, (int) $this->time);
 
+        return true;
     }
 
     /**
@@ -4001,19 +4002,8 @@ public function updateValidatedUserSession()
         // web users are stored with negative keys
         $userId = $this->getLoginUserType() == 'manager' ? $this->getLoginUserID() : -$this->getLoginUserID();
         if ($userId != false) {
-            Models\ActiveUserSession::where('internalKey', $userId)->delete();
-            Models\ActiveUserSession::where('sid', $this->sid)->delete();
-            try {
-                Models\ActiveUserSession::updateOrCreate([
-                    'internalKey' => $userId,
-                    'sid' => $this->sid,
-                ], [
-                    'lasthit' => $this->time,
-                    'ip' => $_SESSION['ip'],
-                ]);
-            } catch (\Exception $exception) {
-
-            }
+            Services\ManagerActivity::instance()
+                ->touchSession((int) $userId, (string) $this->sid, (int) $this->time, (string) $_SESSION['ip']);
         }
     }
 
@@ -4703,7 +4693,8 @@ public function clearCache($type = '', $report = false)
         } elseif ($type === 'document') {
             $sync = new Legacy\Cache();
             $sync->setCachepath($cache_dir);
-            $sync->refreshDocumentCache($this);
+            // a manager request gets its answer first, the file rebuild follows once the response is out
+            $sync->refreshDocumentCache($this, $this->isBackend() && !is_cli());
         } elseif (preg_match('@^[1-9]\d*$@', $type)) {
             $key = ($this->getConfig('cache_type') == 2) ? $this->makePageCacheKey($type) : $type;
             $file_name = "docid_" . $key . "_*.pageCache.php";
diff --git a/core/src/Legacy/Cache.php b/core/src/Legacy/Cache.php
index 007fc48863..65a562b304 100644
--- a/core/src/Legacy/Cache.php
+++ b/core/src/Legacy/Cache.php
@@ -153,13 +153,20 @@ public function emptyCache($evo = null)
      * @param null|Interfaces\CoreInterface $evo
      * @since 3.5.8
      */
-    public function refreshDocumentCache($evo = null)
+    /**
+     * @param bool $deferRebuild rebuild siteCache.idx.php after the response instead of inside it; the purge
+     *                           itself stays synchronous so no stale page is served meanwhile
+     */
+    public function refreshDocumentCache($evo = null, bool $deferRebuild = false)
     {
         $evo = $this->resolveCore($evo);
         \Illuminate\Support\Facades\Cache::flush();
         $this->clearPageCache();
-        $this->buildCache($evo);
-        $this->publishTimeConfig();
+        $rebuild = function () use ($evo) {
+            $this->buildCache($evo);
+            $this->publishTimeConfig();
+        };
+        $deferRebuild ? $evo->deferAfterResponse($rebuild) : $rebuild();
     }
 
     /**
diff --git a/core/src/ManagerTheme.php b/core/src/ManagerTheme.php
index 87e095602b..ec759f4048 100644
--- a/core/src/ManagerTheme.php
+++ b/core/src/ManagerTheme.php
@@ -8,7 +8,6 @@
 use EvolutionCMS\Exceptions\ServiceValidationException;
 use EvolutionCMS\Interfaces\ManagerThemeInterface;
 use EvolutionCMS\Interfaces\CoreInterface;
-use EvolutionCMS\Models\ActiveUser;
 use EvolutionCMS\Models\UserAttribute;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
@@ -483,6 +482,9 @@ public function handleRoute()
 
         $response = $evo->router->dispatch($request);
         $response->send();
+
+        // Bookkeeping writes go out after the client has its page; Tracy still has its bar to append, so it stays attached.
+        Services\ManagerActivity::instance()->flush(!\Tracy\Debugger::isEnabled());
     }
 
     public function handle($action, array $data = [])
@@ -518,8 +520,11 @@ public function handle($action, array $data = [])
         /********************************************************************/
         // log action, unless it's a frame request
         if ($action > 0 && \in_array($action, [1, 2, 7], true) === false) {
-            $log = new Legacy\LogHandler;
-            $log->initAndWriteLog();
+            // $_SESSION['itemname'] is dropped below, so it is captured for the deferred write
+            $itemName = (string) ($_SESSION['itemname'] ?? '');
+            Services\ManagerActivity::instance()->defer(static function () use ($itemName): void {
+                (new Legacy\LogHandler)->initAndWriteLog('', '', '', '', '', $itemName);
+            });
         }
         /********************************************************************/
 
@@ -820,15 +825,14 @@ public function saveAction($action)
         $this->getCore()->getManagerApi()->action = $action;
 
         if ((int)$action > 1) {
-            ActiveUser::where('internalKey', $this->getCore()->getLoginUserID('mgr'))->forceDelete();
-            $activeUser = new ActiveUser;
-            $activeUser->sid = session_id();
-            $activeUser->internalKey = (int)$this->getCore()->getLoginUserID('mgr');
-            $activeUser->username = $_SESSION['mgrShortname'];
-            $activeUser->lasthit = (int)$this->getCore()->tstart;
-            $activeUser->action = (int)$action;
-            $activeUser->id = (int)$this->getItemId();
-            $activeUser->save();
+            Services\ManagerActivity::instance()->setAction(
+                (int)$this->getCore()->getLoginUserID('mgr'),
+                (string)session_id(),
+                (string)$_SESSION['mgrShortname'],
+                (int)$this->getCore()->tstart,
+                (int)$action,
+                (int)$this->getItemId()
+            );
             $flag = true;
         }
 
diff --git a/core/src/Services/DocumentSave/DocumentSaveContext.php b/core/src/Services/DocumentSave/DocumentSaveContext.php
new file mode 100644
index 0000000000..f778de6bf9
--- /dev/null
+++ b/core/src/Services/DocumentSave/DocumentSaveContext.php
@@ -0,0 +1,132 @@
+<?php
+
+namespace EvolutionCMS\Services\DocumentSave;
+
+use Closure;
+use EvolutionCMS\Legacy\Permissions;
+use EvolutionCMS\Models\MemberGroup;
+
+/**
+ * Everything the save needs from the manager session and the CMS, as plain values and
+ * closures, so the service can run outside the manager (tests, CLI, an AJAX lane).
+ * @since 3.5.9
+ */
+final class DocumentSaveContext
+{
+    /** @var int[]|null */
+    private ?array $userGroups = null;
+
+    /**
+     * @param int[] $managerDocgroups document groups of the session ($_SESSION['mgrDocgroups'])
+     * @param Closure(string):mixed $config
+     * @param Closure(string):bool $permission
+     * @param Closure(string, array):void $event
+     * @param Closure(string):string $stripAlias
+     * @param Closure(string):int $toTimestamp
+     * @param Closure(int):array $parentIds
+     * @param Closure(int):bool $canCreateIn udperms check for a parent
+     * @param Closure():array $userGroupsLoader document groups the user is a member of, read fresh
+     * @param Closure(string):string $lang
+     */
+    public function __construct(
+        public readonly int $userId,
+        public readonly int $role,
+        public readonly array $managerDocgroups,
+        public readonly int $now,
+        private readonly Closure $config,
+        private readonly Closure $permission,
+        private readonly Closure $event,
+        private readonly Closure $stripAlias,
+        private readonly Closure $toTimestamp,
+        private readonly Closure $parentIds,
+        private readonly Closure $canCreateIn,
+        private readonly Closure $userGroupsLoader,
+        private readonly Closure $lang,
+    ) {
+    }
+
+    public static function fromManager(): self
+    {
+        $evo = evo();
+        $userId = (int) $evo->getLoginUserID('mgr');
+
+        return new self(
+            userId: $userId,
+            role: (int) ($_SESSION['mgrRole'] ?? 0),
+            managerDocgroups: array_map('intval', (array) ($_SESSION['mgrDocgroups'] ?? [])),
+            now: $evo->timestamp((int) get_by_key($_SERVER, 'REQUEST_TIME', 0)),
+            config: fn (string $key) => $evo->getConfig($key),
+            permission: fn (string $name) => (bool) $evo->hasPermission($name),
+            event: function (string $name, array $params) use ($evo) {
+                $evo->invokeEvent($name, $params);
+            },
+            stripAlias: fn (string $alias) => (string) $evo->stripAlias($alias),
+            toTimestamp: fn (string $date) => (int) $evo->toTimeStamp($date),
+            parentIds: fn (int $id) => (array) $evo->getParentIds($id),
+            canCreateIn: fn (int $parent) => Permissions::canCreateIn($parent),
+            userGroupsLoader: fn () => array_values(array_unique(array_map('intval', MemberGroup::query()
+                ->join('membergroup_access', 'membergroup_access.membergroup', '=', 'member_groups.user_group')
+                ->where('member_groups.member', $userId)
+                ->pluck('documentgroup')->all()))),
+            lang: fn (string $key) => (string) __('global.' . $key),
+        );
+    }
+
+    public function isAdministrator(): bool
+    {
+        return $this->role === 1;
+    }
+
+    public function config(string $key): mixed
+    {
+        return ($this->config)($key);
+    }
+
+    public function can(string $permission): bool
+    {
+        return ($this->permission)($permission);
+    }
+
+    public function fire(string $event, array $params): void
+    {
+        ($this->event)($event, $params);
+    }
+
+    public function stripAlias(string $alias): string
+    {
+        return ($this->stripAlias)($alias);
+    }
+
+    public function toTimestamp(string $date): int
+    {
+        return ($this->toTimestamp)($date);
+    }
+
+    /**
+     * @return int[]
+     */
+    public function parentIds(int $id): array
+    {
+        return ($this->parentIds)($id);
+    }
+
+    public function canCreateIn(int $parent): bool
+    {
+        return ($this->canCreateIn)($parent);
+    }
+
+    /**
+     * Document groups the user belongs to, queried once per save.
+     *
+     * @return int[]
+     */
+    public function userGroups(): array
+    {
+        return $this->userGroups ??= ($this->userGroupsLoader)();
+    }
+
+    public function lang(string $key): string
+    {
+        return ($this->lang)($key);
+    }
+}
diff --git a/core/src/Services/DocumentSave/DocumentSaveDenied.php b/core/src/Services/DocumentSave/DocumentSaveDenied.php
new file mode 100644
index 0000000000..20dc6973a2
--- /dev/null
+++ b/core/src/Services/DocumentSave/DocumentSaveDenied.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace EvolutionCMS\Services\DocumentSave;
+
+use RuntimeException;
+
+/**
+ * The save was refused; the message is already translated for the user.
+ * @since 3.5.9
+ */
+final class DocumentSaveDenied extends RuntimeException
+{
+    /**
+     * @param bool $restoreForm send the user back to the editor with the posted values kept
+     */
+    public function __construct(string $message, public readonly bool $restoreForm = true)
+    {
+        parent::__construct($message);
+    }
+}
diff --git a/core/src/Services/DocumentSave/DocumentSaveResult.php b/core/src/Services/DocumentSave/DocumentSaveResult.php
new file mode 100644
index 0000000000..048409af43
--- /dev/null
+++ b/core/src/Services/DocumentSave/DocumentSaveResult.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace EvolutionCMS\Services\DocumentSave;
+
+/**
+ * @since 3.5.9
+ */
+final class DocumentSaveResult
+{
+    /**
+     * @param 'new'|'edit' $mode
+     */
+    public function __construct(
+        public readonly int $id,
+        public readonly string $mode,
+        public readonly string $type,
+        public readonly int $parent,
+        public readonly string $pagetitle,
+        public readonly string $alias,
+        public readonly int $editedon = 0,
+    ) {
+    }
+
+    public function isNew(): bool
+    {
+        return $this->mode === 'new';
+    }
+}
diff --git a/core/src/Services/DocumentSaveService.php b/core/src/Services/DocumentSaveService.php
new file mode 100644
index 0000000000..c4696ae2c9
--- /dev/null
+++ b/core/src/Services/DocumentSaveService.php
@@ -0,0 +1,299 @@
+<?php
+
+namespace EvolutionCMS\Services;
+
+use EvolutionCMS\Models\DocumentGroup;
+use EvolutionCMS\Models\SiteContent;
+use EvolutionCMS\Services\DocumentSave\DocumentSaveContext;
+use EvolutionCMS\Services\DocumentSave\DocumentSaveDenied;
+use EvolutionCMS\Services\DocumentSave\DocumentSaveResult;
+use EvolutionCMS\Support\DocumentPrivacy;
+use EvolutionCMS\Support\DocumentSave\DocumentGroupSync;
+use EvolutionCMS\Support\DocumentSave\PublishState;
+use EvolutionCMS\Support\DocumentSave\TemplateVariableInput;
+use EvolutionCMS\Support\DocumentSave\TemplateVariableValues;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Saves the resource editor form: checks, one transaction of writes, then the events.
+ *
+ * OnBeforeDocFormSave fires before the transaction and OnDocFormSave after it has been
+ * committed, so a plugin never sees uncommitted rows and cannot undo the save by exiting.
+ * @since 3.5.9
+ */
+final class DocumentSaveService
+{
+    public function __construct(private readonly DocumentSaveContext $ctx)
+    {
+    }
+
+    public static function forManager(): self
+    {
+        return new self(DocumentSaveContext::fromManager());
+    }
+
+    /**
+     * @param array $input the posted editor form
+     * @throws DocumentSaveDenied
+     */
+    public function save(array $input): DocumentSaveResult
+    {
+        $ctx = $this->ctx;
+
+        $id = is_numeric($input['id'] ?? null) ? (int) $input['id'] : 0;
+        $mode = ($id > 0 || in_array((string) ($input['mode'] ?? ''), ['73', '27'], true)) ? 'edit' : 'new';
+
+        $type = (string) ($input['type'] ?? 'document');
+        $pagetitle = (string) ($input['pagetitle'] ?? '');
+        if (trim($pagetitle) === '') {
+            $pagetitle = $ctx->lang($type === 'reference' ? 'untitled_weblink' : 'untitled_resource');
+        }
+        $parent = (int) get_by_key($input, 'parent', 0, 'is_scalar');
+        $template = (int) ($input['template'] ?? 0);
+        $makePublic = ($input['chkalldocs'] ?? '') === 'on';
+        $groupPairs = $makePublic ? [] : get_by_key($input, 'docgroups', [], 'is_array');
+        $usePermissions = (int) $ctx->config('use_udperms') === 1;
+
+        $existing = null;
+        if ($mode === 'edit') {
+            $existing = SiteContent::withTrashed()->find($id);
+            if ($existing === null) {
+                throw new DocumentSaveDenied($ctx->lang('error_no_results'), false);
+            }
+        }
+
+        $alias = $this->resolveAlias((string) ($input['alias'] ?? ''), $pagetitle, $id, $parent);
+
+        // a non administrator may not take their own groups off the document
+        if (!$ctx->isAdministrator()
+            && DocumentGroupSync::locksOut(DocumentGroupSync::postedGroups($groupPairs), $ctx->userGroups())) {
+            throw new DocumentSaveDenied($ctx->lang('resource_permissions_error'));
+        }
+
+        if ($usePermissions && ($existing === null || (int) $existing->parent !== $parent) && !$ctx->canCreateIn($parent)) {
+            throw new DocumentSaveDenied($ctx->lang('access_permission_parent_denied'));
+        }
+
+        $tvs = TemplateVariableValues::forTemplate($template, $id, !$ctx->isAdministrator(), $ctx->managerDocgroups);
+        $tvValues = TemplateVariableInput::values($tvs, $input);
+
+        $now = $ctx->now;
+        $pubDate = empty($input['pub_date']) ? 0 : $ctx->toTimestamp((string) $input['pub_date']);
+        $unpubDate = empty($input['unpub_date']) ? 0 : $ctx->toTimestamp((string) $input['unpub_date']);
+        $published = PublishState::fromDates((int) ($input['published'] ?? 0), $pubDate, $unpubDate, $now);
+        $mayPublish = $ctx->can('publish_document');
+
+        $fields = [
+            'introtext' => $input['introtext'] ?? '',
+            'content' => $input['ta'] ?? '',
+            'pagetitle' => $pagetitle,
+            'longtitle' => $input['longtitle'] ?? '',
+            'type' => $type,
+            'description' => $input['description'] ?? '',
+            'alias' => $alias,
+            'link_attributes' => $input['link_attributes'] ?? '',
+            'isfolder' => (int) ($input['isfolder'] ?? 0),
+            'richtext' => (int) ($input['richtext'] ?? 0),
+            'parent' => $parent,
+            'template' => $template,
+            'menuindex' => (int) ($input['menuindex'] ?? 0),
+            'searchable' => (int) ($input['searchable'] ?? 0),
+            'cacheable' => (int) ($input['cacheable'] ?? 0),
+            'editedby' => $ctx->userId,
+            'editedon' => $now,
+            'contentType' => $input['contentType'] ?? 'text/html',
+            'content_dispo' => (int) ($input['content_dispo'] ?? 0),
+            'hide_from_tree' => (int) ($input['hide_from_tree'] ?? 0),
+            'menutitle' => $input['menutitle'] ?? '',
+            'hidemenu' => (int) ($input['hidemenu'] ?? 0),
+            'alias_visible' => (int) ($input['alias_visible'] ?? 0),
+        ];
+
+        // find() hides trashed rows, so a missing parent is a trashed one
+        $parentRow = $parent > 0 ? SiteContent::withTrashed()->select('id', 'isfolder', 'deleted')->find($parent) : null;
+        if ($parent > 0 && ($parentRow === null || (int) $parentRow->deleted === 1)) {
+            $fields['deleted'] = 1;
+        }
+
+        if ($mode === 'new') {
+            $fields['createdby'] = $ctx->userId;
+            $fields += PublishState::forNew($published, $pubDate, $unpubDate, $now, $ctx->userId, $mayPublish);
+
+            // only the event sees this id: the row gets auto increment, as it always did (id is not fillable)
+            $ctx->fire('OnBeforeDocFormSave', ['mode' => 'new', 'id' => $this->announcedId()]);
+
+            $editedon = 0;
+            $id = $this->transaction(function () use (&$editedon, $fields, $tvs, $tvValues, $parent, $parentRow, $groupPairs, $usePermissions) {
+                $document = SiteContent::withTrashed()->create($fields);
+                $id = (int) $document->getKey();
+                $editedon = (int) $document->editedon;
+                TemplateVariableValues::sync($id, $tvs, $tvValues);
+                if ($usePermissions) {
+                    $this->attachGroupsToNew($id, $parent, $groupPairs);
+                }
+                $this->markAsFolder($parentRow);
+
+                return $id;
+            });
+
+            $ctx->fire('OnDocFormSave', ['mode' => 'new', 'id' => $id]);
+        } else {
+            $this->guardEdit($existing, $parent, $published, $pubDate, $unpubDate);
+
+            $oldParent = (int) $existing->parent;
+            if (SiteContent::withTrashed()->where('parent', $id)->exists()) {
+                $fields['isfolder'] = 1;
+            }
+            $fields += PublishState::forEdit($published, $pubDate, $unpubDate, $now, $ctx->userId, $mayPublish, $existing->getAttributes());
+
+            $ctx->fire('OnBeforeDocFormSave', ['mode' => 'upd', 'id' => $id]);
+
+            $editedon = 0;
+            $this->transaction(function () use (&$editedon, $existing, $id, $fields, $tvs, $tvValues, $parent, $oldParent, $parentRow, $groupPairs, $makePublic, $usePermissions) {
+                foreach ($fields as $field => $value) {
+                    $existing->{$field} = $value;
+                }
+                $existing->save();
+                $editedon = (int) $existing->editedon;
+                TemplateVariableValues::sync($id, $tvs, $tvValues);
+                if ($usePermissions && ($this->ctx->can('manage_groups') || $this->ctx->can('manage_document_permissions'))) {
+                    $kept = DocumentGroupSync::forExistingDocument($id, $groupPairs, $this->ctx->userGroups(), $this->ctx->can('manage_groups'), $makePublic);
+                    if (!$kept) {
+                        throw new DocumentSaveDenied($this->ctx->lang('resource_permissions_error'));
+                    }
+                }
+                $this->markAsFolder($parentRow);
+                if ($oldParent !== $parent && $oldParent > 0
+                    && !SiteContent::withTrashed()->where('parent', $oldParent)->exists()) {
+                    SiteContent::withTrashed()->where('id', $oldParent)->update(['isfolder' => 0]);
+                }
+            });
+
+            $ctx->fire('OnDocFormSave', ['mode' => 'upd', 'id' => $id]);
+        }
+
+        // after the event, a plugin may have changed the groups
+        DocumentPrivacy::refresh($id);
+
+        return new DocumentSaveResult($id, $mode, $type, $parent, $pagetitle, $alias, $editedon);
+    }
+
+    /**
+     * Rules that only apply to an existing document.
+     */
+    private function guardEdit(SiteContent $existing, int $parent, int $published, int $pubDate, int $unpubDate): void
+    {
+        $ctx = $this->ctx;
+        $id = (int) $existing->getKey();
+
+        if ($id === (int) $ctx->config('site_start')) {
+            if ($published === 0) {
+                throw new DocumentSaveDenied('Document is linked to site_start variable and cannot be unpublished!', false);
+            }
+            if ($pubDate > $ctx->now || $unpubDate !== 0) {
+                throw new DocumentSaveDenied('Document is linked to site_start variable and cannot have publish or unpublish dates set!', false);
+            }
+        }
+        if ($parent === $id) {
+            throw new DocumentSaveDenied("Document can not be it's own parent!", false);
+        }
+        if (in_array($id, array_map('intval', $ctx->parentIds($parent)), true)) {
+            throw new DocumentSaveDenied("Document descendant can not be it's parent!", false);
+        }
+    }
+
+    /**
+     * The alias to store: generated, stripped and checked for duplicates as the settings ask.
+     */
+    private function resolveAlias(string $alias, string $pagetitle, int $id, int $parent): string
+    {
+        $ctx = $this->ctx;
+
+        if (!$ctx->config('friendly_urls')) {
+            return $alias === '' ? '' : $ctx->stripAlias($alias);
+        }
+
+        $allowDuplicates = (bool) $ctx->config('allow_duplicate_alias');
+
+        if ($alias === '') {
+            if (!$ctx->config('automatic_alias')) {
+                return '';
+            }
+            $alias = strtolower($ctx->stripAlias(trim($pagetitle)));
+
+            // a duplicate gets a counter; without allow_duplicate_alias the whole site counts
+            $base = $alias;
+            $count = 1;
+            while ($this->aliasQuery($alias, $id, $allowDuplicates ? $parent : null)->exists()) {
+                $alias = $base . $count++;
+            }
+
+            return $alias;
+        }
+
+        $alias = $ctx->stripAlias($alias);
+        // with duplicates allowed, or alias paths on, only the same level has to be unique
+        $sameLevelOnly = $allowDuplicates || $ctx->config('use_alias_path');
+        $duplicate = $this->aliasQuery($alias, $id, $sameLevelOnly ? $parent : null)->first();
+        if ($duplicate !== null) {
+            throw new DocumentSaveDenied(sprintf($ctx->lang('duplicate_alias_found'), $duplicate->id, $alias));
+        }
+
+        return $alias;
+    }
+
+    private function aliasQuery(string $alias, int $id, ?int $parent)
+    {
+        return SiteContent::withTrashed()->select('id')
+            ->where('id', '<>', $id)
+            ->where('alias', $alias)
+            ->when($parent !== null, fn ($q) => $q->where('parent', $parent));
+    }
+
+    /**
+     * The id docid_incrmnt_method promises to OnBeforeDocFormSave: first gap, max + 1, or '' for auto increment.
+     */
+    private function announcedId(): int|string
+    {
+        switch ((string) $this->ctx->config('docid_incrmnt_method')) {
+            case '1':
+                $table = SiteContent::query()->getQuery()->getGrammar()->wrapTable('site_content');
+                $id = SiteContent::withTrashed()
+                    ->leftJoin('site_content as t1', function ($join) use ($table) {
+                        $join->on(DB::raw($table . '.id + 1'), '=', 't1.id');
+                    })
+                    ->whereNull('t1.id')->min('site_content.id');
+
+                return (int) $id + 1;
+            case '2':
+                return (int) SiteContent::withTrashed()->max('id') + 1;
+            default:
+                return '';
+        }
+    }
+
+    private function attachGroupsToNew(int $id, int $parent, array $groupPairs): void
+    {
+        $ctx = $this->ctx;
+        $groupsOfParent = $parent > 0
+            ? array_map('intval', DocumentGroup::query()->where('document', $parent)->pluck('document_group')->all())
+            : [];
+        $manageGroups = $ctx->can('manage_groups');
+        $manageDocPerms = $ctx->can('manage_document_permissions');
+        $userGroups = ($manageGroups || $manageDocPerms) ? $ctx->userGroups() : [];
+
+        DocumentGroupSync::forNewDocument($id, $groupPairs, $groupsOfParent, $userGroups, $manageGroups, $manageDocPerms);
+    }
+
+    private function markAsFolder(?SiteContent $parentRow): void
+    {
+        if ($parentRow !== null && (int) $parentRow->isfolder !== 1) {
+            SiteContent::withTrashed()->where('id', $parentRow->getKey())->update(['isfolder' => 1]);
+        }
+    }
+
+    private function transaction(callable $callback): mixed
+    {
+        return SiteContent::resolveConnection()->transaction($callback);
+    }
+}
diff --git a/core/src/Services/ManagerActivity.php b/core/src/Services/ManagerActivity.php
new file mode 100644
index 0000000000..5466d8b425
--- /dev/null
+++ b/core/src/Services/ManagerActivity.php
@@ -0,0 +1,145 @@
+<?php
+
+namespace EvolutionCMS\Services;
+
+use EvolutionCMS\Models\ActiveUser;
+use EvolutionCMS\Models\ActiveUserLock;
+use EvolutionCMS\Models\ActiveUserSession;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Per-request manager bookkeeping (active session, current action, element lock, manager log)
+ * collected during the request and written in one transaction once the response is out.
+ *
+ * Each of these used to be its own autocommit statement inside the request - six or seven
+ * fsyncs on every manager page, about 55 ms of the ~80 ms bootstrap on an fsync-per-commit
+ * MySQL. Nothing in the same request reads its own bookkeeping back (the lock and action
+ * queries exclude the current user), so nothing observable moves.
+ * @since 3.5.9
+ */
+final class ManagerActivity
+{
+    private static ?self $instance = null;
+
+    /** @var array<int, callable> */
+    private array $jobs = [];
+
+    private bool $flushed = false;
+
+    private bool $shutdownRegistered = false;
+
+    public static function instance(): self
+    {
+        return self::$instance ??= new self();
+    }
+
+    public static function reset(): void
+    {
+        self::$instance = null;
+    }
+
+    /**
+     * Queues a write; the queue is flushed after the response or, when the request exits early, at shutdown.
+     */
+    public function defer(callable $job): void
+    {
+        $this->jobs[] = $job;
+        $this->flushed = false;
+
+        if (!$this->shutdownRegistered) {
+            $this->shutdownRegistered = true;
+            register_shutdown_function(function (): void {
+                $this->flush();
+            });
+        }
+    }
+
+    /**
+     * Replaces the active_user_sessions row of the user: one row per user, keyed by the current session id.
+     */
+    public function touchSession(int $userId, string $sid, int $time, string $ip): void
+    {
+        $this->defer(static function () use ($userId, $sid, $time, $ip): void {
+            ActiveUserSession::query()
+                ->where('internalKey', $userId)
+                ->orWhere('sid', $sid)
+                ->delete();
+            ActiveUserSession::query()->insert([
+                'internalKey' => $userId,
+                'sid' => $sid,
+                'lasthit' => $time,
+                'ip' => $ip,
+            ]);
+        });
+    }
+
+    /**
+     * Records which manager action (and item) the user is on: one row per user in active_users.
+     */
+    public function setAction(int $userId, string $sid, string $username, int $time, int $action, ?int $itemId): void
+    {
+        $this->defer(static function () use ($userId, $sid, $username, $time, $action, $itemId): void {
+            ActiveUser::query()->where('internalKey', $userId)->delete();
+            ActiveUser::query()->insert([
+                'sid' => $sid,
+                'internalKey' => $userId,
+                'username' => $username,
+                'lasthit' => $time,
+                'action' => (string) $action,
+                'id' => $itemId,
+            ]);
+        });
+    }
+
+    /**
+     * Takes or refreshes the element lock, same row selection as before: the lock is keyed by element id.
+     */
+    public function lock(int $type, int $id, int $userId, string $sid, int $time): void
+    {
+        $this->defer(static function () use ($type, $id, $userId, $sid, $time): void {
+            ActiveUserLock::query()->updateOrCreate(
+                ['elementId' => $id],
+                ['internalKey' => $userId, 'elementType' => $type, 'lasthit' => $time, 'sid' => $sid]
+            );
+        });
+    }
+
+    public function hasPending(): bool
+    {
+        return $this->jobs !== [];
+    }
+
+    /**
+     * Runs the queued writes in one transaction. With $detach the response is flushed to the client first
+     * (FPM / LiteSpeed), so the writes cost the request nothing; other SAPIs just run them at the end.
+     * Idempotent: the second call is a no-op unless something was queued in between.
+     */
+    public function flush(bool $detach = false): void
+    {
+        if ($this->flushed || $this->jobs === []) {
+            return;
+        }
+        $this->flushed = true;
+        $jobs = $this->jobs;
+        $this->jobs = [];
+
+        if ($detach) {
+            evo()->finishRequest();
+        }
+
+        try {
+            DB::transaction(static function () use ($jobs): void {
+                foreach ($jobs as $job) {
+                    $job();
+                }
+            });
+        } catch (\Throwable $e) {
+            if (!$detach) {
+                throw $e;
+            }
+            // the client is gone already, the log is all that is left to tell
+            Log::error('Manager activity write failed: ' . $e->getMessage(), ['exception' => $e]);
+        }
+    }
+}
diff --git a/core/src/Support/DocumentPrivacy.php b/core/src/Support/DocumentPrivacy.php
new file mode 100644
index 0000000000..254effb8ed
--- /dev/null
+++ b/core/src/Support/DocumentPrivacy.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace EvolutionCMS\Support;
+
+use EvolutionCMS\Models\DocumentGroup;
+use EvolutionCMS\Models\SiteContent;
+
+/**
+ * Keeps privateweb / privatemgr in step with the user groups behind the groups of a document.
+ * @since 3.5.9
+ */
+final class DocumentPrivacy
+{
+    public const WEB = 1;
+    public const MANAGER = 0;
+
+    /**
+     * Both flags of one document in a select and an update; one flag when a context is given.
+     */
+    public static function refresh(int $documentId, ?int $context = null): void
+    {
+        $contexts = DocumentGroup::query()
+            ->join('membergroup_access', 'document_groups.document_group', '=', 'membergroup_access.documentgroup')
+            ->where('document_groups.document', $documentId)
+            ->distinct()
+            ->pluck('membergroup_access.context')
+            ->map(fn ($context) => (int) $context)
+            ->all();
+
+        $flags = [];
+        if ($context !== self::MANAGER) {
+            $flags['privateweb'] = in_array(self::WEB, $contexts, true) ? 1 : 0;
+        }
+        if ($context !== self::WEB) {
+            $flags['privatemgr'] = in_array(self::MANAGER, $contexts, true) ? 1 : 0;
+        }
+
+        SiteContent::withTrashed()->where('id', $documentId)->update($flags);
+    }
+
+    /**
+     * Recomputes one flag for every document, after the access groups screen changed the links.
+     */
+    public static function refreshAll(int $context): void
+    {
+        $field = $context === self::WEB ? 'privateweb' : 'privatemgr';
+
+        $ids = DocumentGroup::query()
+            ->join('membergroup_access', function ($join) use ($context) {
+                $join->on('document_groups.document_group', '=', 'membergroup_access.documentgroup')
+                    ->where('membergroup_access.context', '=', $context);
+            })
+            ->distinct()
+            ->pluck('document_groups.document')
+            ->map(fn ($id) => (int) $id)
+            ->all();
+
+        SiteContent::withTrashed()->where($field, 1)
+            ->when($ids, fn ($q) => $q->whereNotIn('id', $ids))
+            ->update([$field => 0]);
+        if ($ids) {
+            SiteContent::withTrashed()->whereIn('id', $ids)->where($field, 0)->update([$field => 1]);
+        }
+    }
+}
diff --git a/core/src/Support/DocumentSave/DocumentGroupSync.php b/core/src/Support/DocumentSave/DocumentGroupSync.php
new file mode 100644
index 0000000000..e3645e0212
--- /dev/null
+++ b/core/src/Support/DocumentSave/DocumentGroupSync.php
@@ -0,0 +1,144 @@
+<?php
+
+namespace EvolutionCMS\Support\DocumentSave;
+
+use EvolutionCMS\Models\DocumentGroup;
+
+/**
+ * Applies the resource-group checkboxes of the editor to the document_groups table.
+ * @since 3.5.9
+ */
+final class DocumentGroupSync
+{
+    /**
+     * Group ids of the posted "group,link" pairs.
+     *
+     * @return int[]
+     */
+    public static function postedGroups(array $pairs): array
+    {
+        $groups = [];
+        foreach ($pairs as $pair) {
+            if (is_scalar($pair)) {
+                $groups[] = (int) explode(',', (string) $pair)[0];
+            }
+        }
+
+        return array_values(array_unique($groups));
+    }
+
+    /**
+     * A user without one of their own groups left in the posted set would lock themselves out.
+     *
+     * @param int[] $posted
+     * @param int[] $userGroups
+     */
+    public static function locksOut(array $posted, array $userGroups): bool
+    {
+        return $posted !== [] && array_intersect($posted, $userGroups) === [];
+    }
+
+    /**
+     * @param int[] $groupsOfParent
+     * @param int[] $userGroups
+     */
+    public static function forNewDocument(int $documentId, array $pairs, array $groupsOfParent, array $userGroups, bool $manageGroups, bool $manageDocPerms): void
+    {
+        if (!$manageGroups && !$manageDocPerms) {
+            self::insert($documentId, $groupsOfParent); // inherit from the parent
+            return;
+        }
+
+        $groups = [];
+        foreach (self::postedGroups($pairs) as $group) {
+            if ($manageGroups || in_array($group, $userGroups)) {
+                $groups[] = $group;
+            }
+        }
+        // the parent groups the user cannot manage stay attached
+        if ($manageDocPerms) {
+            foreach ($groupsOfParent as $group) {
+                if (!in_array($group, $userGroups)) {
+                    $groups[] = $group;
+                }
+            }
+        }
+        // nothing of their own picked: keep every group of the parent
+        if (!$manageGroups && array_intersect($groups, $userGroups) === []) {
+            $groups = array_merge($groups, $groupsOfParent);
+        }
+
+        self::insert($documentId, $groups);
+    }
+
+    /**
+     * Returns false when the change would leave the user without access to the document.
+     *
+     * @param int[] $userGroups
+     */
+    public static function forExistingDocument(int $documentId, array $pairs, array $userGroups, bool $manageGroups, bool $makePublic): bool
+    {
+        $canTouch = fn (int $group): bool => $manageGroups || in_array($group, $userGroups);
+
+        $wanted = [];
+        foreach ($pairs as $pair) {
+            if (!is_scalar($pair)) {
+                continue;
+            }
+            [$group, $link] = array_pad(explode(',', (string) $pair, 2), 2, 'new');
+            if ($canTouch((int) $group)) {
+                $wanted[(int) $group] = $link;
+            }
+        }
+
+        $current = [];
+        $untouchable = [];
+        foreach (DocumentGroup::query()->where('document', $documentId)->get(['id', 'document_group']) as $row) {
+            if ($canTouch($row->document_group)) {
+                $current[$row->document_group] = $row->id;
+            } else {
+                $untouchable[] = $row->document_group;
+            }
+        }
+
+        $insert = [];
+        foreach ($wanted as $group => $link) {
+            if (isset($current[$group])) {
+                unset($current[$group]);
+            } elseif ($link === 'new') {
+                $insert[] = $group;
+            }
+        }
+
+        if (!$manageGroups && $userGroups !== []) {
+            $remaining = array_merge($untouchable, array_diff(array_keys($wanted), array_keys($current)), $insert);
+            if (array_intersect($userGroups, $remaining) === []) {
+                return false;
+            }
+        }
+
+        self::insert($documentId, $insert);
+        if ($current) {
+            DocumentGroup::query()->whereIn('id', array_values($current))->delete();
+        }
+        if ($makePublic) {
+            DocumentGroup::query()->where('document', $documentId)->delete();
+        }
+
+        return true;
+    }
+
+    /**
+     * @param int[] $groups
+     */
+    private static function insert(int $documentId, array $groups): void
+    {
+        $rows = [];
+        foreach (array_unique($groups) as $group) {
+            $rows[] = ['document_group' => (int) $group, 'document' => $documentId];
+        }
+        if ($rows) {
+            DocumentGroup::query()->insert($rows);
+        }
+    }
+}
diff --git a/core/src/Support/DocumentSave/PublishState.php b/core/src/Support/DocumentSave/PublishState.php
new file mode 100644
index 0000000000..a76795f406
--- /dev/null
+++ b/core/src/Support/DocumentSave/PublishState.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace EvolutionCMS\Support\DocumentSave;
+
+/**
+ * Resolves the published flag, dates and publisher of a document being saved.
+ * @since 3.5.9
+ */
+final class PublishState
+{
+    /**
+     * A publish date in the past publishes, one in the future or a passed unpublish date unpublishes.
+     */
+    public static function fromDates(int $published, int $pubDate, int $unpubDate, int $now): int
+    {
+        if ($pubDate > 0 && $pubDate < $now) {
+            $published = 1;
+        } elseif ($pubDate > $now) {
+            $published = 0;
+        }
+        if ($unpubDate > 0 && $unpubDate < $now) {
+            $published = 0;
+        }
+
+        return $published;
+    }
+
+    /**
+     * @return array{published:int, pub_date:int, unpub_date:int, publishedon:int, publishedby:int}
+     */
+    public static function forNew(int $published, int $pubDate, int $unpubDate, int $now, int $userId, bool $mayPublish): array
+    {
+        $published = self::fromDates($published, $pubDate, $unpubDate, $now);
+        if (!$mayPublish) {
+            $published = $pubDate = $unpubDate = 0;
+        }
+
+        return [
+            'published' => $published,
+            'pub_date' => $pubDate,
+            'unpub_date' => $unpubDate,
+            'publishedon' => $published ? ($pubDate ?: $now) : 0,
+            'publishedby' => $published ? $userId : 0,
+        ];
+    }
+
+    /**
+     * @param array $existing the stored row: published, pub_date, unpub_date, publishedon, publishedby
+     * @return array{published:int, pub_date:int, unpub_date:int, publishedon:int, publishedby:int}
+     */
+    public static function forEdit(int $published, int $pubDate, int $unpubDate, int $now, int $userId, bool $mayPublish, array $existing): array
+    {
+        // without publish_document the publish state stays as it was
+        if (!$mayPublish) {
+            return [
+                'published' => (int) $existing['published'],
+                'pub_date' => (int) $existing['pub_date'],
+                'unpub_date' => (int) $existing['unpub_date'],
+                'publishedon' => (int) $existing['publishedon'],
+                'publishedby' => (int) $existing['publishedby'],
+            ];
+        }
+
+        $published = self::fromDates($published, $pubDate, $unpubDate, $now);
+        $wasPublished = (int) $existing['published'];
+
+        if (!$wasPublished && $published) {
+            $publishedon = $now;
+            $publishedby = $userId;
+        } elseif ($pubDate > 0 && $pubDate <= $now && $published) {
+            $publishedon = $pubDate;
+            $publishedby = $userId;
+        } elseif ($wasPublished && !$published) {
+            $publishedon = 0;
+            $publishedby = 0;
+        } else {
+            $publishedon = (int) $existing['publishedon'];
+            $publishedby = (int) $existing['publishedby'];
+        }
+
+        return [
+            'published' => $published,
+            'pub_date' => $pubDate,
+            'unpub_date' => $unpubDate,
+            'publishedon' => $publishedon,
+            'publishedby' => $publishedby,
+        ];
+    }
+}
diff --git a/core/src/Support/DocumentSave/SaveResponse.php b/core/src/Support/DocumentSave/SaveResponse.php
new file mode 100644
index 0000000000..9ae21aedf8
--- /dev/null
+++ b/core/src/Support/DocumentSave/SaveResponse.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace EvolutionCMS\Support\DocumentSave;
+
+use EvolutionCMS\Services\DocumentSave\DocumentSaveResult;
+
+/**
+ * What the editor is told after a save: where the form flow goes next, and the same
+ * facts as JSON for the in-place save.
+ * @since 3.5.9
+ */
+final class SaveResponse
+{
+    /**
+     * @param string $stay '' close, '1' new, '2' keep editing
+     * @param string $listingPath sort/dir/page of the children listing, already escaped
+     */
+    public static function redirectUrl(DocumentSaveResult $saved, string $stay, bool $refreshPreview, string $listingPath, string $siteUrl): string
+    {
+        $id = $saved->id;
+        if (!$saved->isNew() && $refreshPreview) {
+            return $siteUrl . "index.php?id=$id&z=manprev";
+        }
+
+        if ($stay !== '') {
+            $newAction = $saved->type === 'reference' ? '72' : '4';
+            $url = $stay === '2'
+                ? "index.php?a=27&id=$id&r=1&stay=2"
+                : "index.php?a=$newAction&pid={$saved->parent}&r=1&stay=" . (int) $stay;
+        } else {
+            $url = "index.php?a=3&id=$id&r=1";
+        }
+
+        return $saved->isNew() ? $url : $url . $listingPath;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function payload(DocumentSaveResult $saved, string $redirect, string $token = ''): array
+    {
+        return [
+            'success' => true,
+            'id' => $saved->id,
+            'mode' => $saved->mode,
+            'type' => $saved->type,
+            'parent' => $saved->parent,
+            'pagetitle' => $saved->pagetitle,
+            'alias' => $saved->alias,
+            'editedon' => $saved->editedon,
+            'redirect' => $redirect,
+            'token' => $token,
+        ];
+    }
+}
diff --git a/core/src/Support/DocumentSave/TemplateVariableInput.php b/core/src/Support/DocumentSave/TemplateVariableInput.php
new file mode 100644
index 0000000000..9352280442
--- /dev/null
+++ b/core/src/Support/DocumentSave/TemplateVariableInput.php
@@ -0,0 +1,62 @@
+<?php
+
+namespace EvolutionCMS\Support\DocumentSave;
+
+/**
+ * Turns the posted form field of one template variable into the value to store.
+ * @since 3.5.9
+ */
+final class TemplateVariableInput
+{
+    private const URL_SCHEMES = ['feed://', 'ftp://', 'http://', 'https://', 'mailto:'];
+
+    /**
+     * Null means the stored row has to go: the field is empty, "0" or equal to the TV default.
+     *
+     * @param array $tv row with id, type and default_text
+     * @param array $input the posted form
+     */
+    public static function value(array $tv, array $input): ?string
+    {
+        $key = 'tv' . $tv['id'];
+        $raw = $input[$key] ?? '';
+
+        switch ($tv['type']) {
+            case 'url':
+                $value = is_scalar($raw) ? (string) $raw : '';
+                $prefix = $input[$key . '_prefix'] ?? '--';
+                if ($prefix != '--') {
+                    $value = $prefix . str_replace(self::URL_SCHEMES, '', $value);
+                }
+                break;
+            case 'file':
+                $value = is_scalar($raw) ? (string) $raw : '';
+                break;
+            default:
+                // checkboxes and multiple selects post arrays
+                $value = is_array($raw) ? implode('||', array_values($raw)) : (string) $raw;
+        }
+
+        if (empty($value) || $value == ($tv['default_text'] ?? '')) {
+            return null;
+        }
+
+        return $value;
+    }
+
+    /**
+     * Desired value per TV id for every TV the user may edit.
+     *
+     * @param array $tvs rows from TemplateVariableValues::forTemplate()
+     * @return array<int, string|null>
+     */
+    public static function values(array $tvs, array $input): array
+    {
+        $values = [];
+        foreach ($tvs as $tv) {
+            $values[(int) $tv['id']] = self::value($tv, $input);
+        }
+
+        return $values;
+    }
+}
diff --git a/core/src/Support/DocumentSave/TemplateVariableValues.php b/core/src/Support/DocumentSave/TemplateVariableValues.php
new file mode 100644
index 0000000000..e72c3bb0b2
--- /dev/null
+++ b/core/src/Support/DocumentSave/TemplateVariableValues.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace EvolutionCMS\Support\DocumentSave;
+
+use EvolutionCMS\Models\SiteTmplvar;
+use EvolutionCMS\Models\SiteTmplvarContentvalue;
+
+/**
+ * Reads and writes the TV values of one document with as few queries as the diff needs.
+ * @since 3.5.9
+ */
+final class TemplateVariableValues
+{
+    /**
+     * TVs of a template with the value stored for the document. Non-administrators only
+     * get the TVs without access rules or whose document belongs to one of their groups.
+     *
+     * @return array<int, array{id:int, name:string, type:string, default_text:string, value_id:int|null, value:string|null}>
+     */
+    public static function forTemplate(int $template, int $documentId, bool $restrictToGroups, array $managerGroups): array
+    {
+        $query = SiteTmplvar::query()->distinct()
+            ->select('site_tmplvars.id', 'site_tmplvars.name', 'site_tmplvars.type', 'site_tmplvars.default_text',
+                'site_tmplvar_contentvalues.id as value_id', 'site_tmplvar_contentvalues.value')
+            ->join('site_tmplvar_templates', 'site_tmplvar_templates.tmplvarid', '=', 'site_tmplvars.id')
+            ->leftJoin('site_tmplvar_contentvalues', function ($join) use ($documentId) {
+                $join->on('site_tmplvar_contentvalues.tmplvarid', '=', 'site_tmplvars.id')
+                    ->where('site_tmplvar_contentvalues.contentid', '=', $documentId);
+            })
+            ->leftJoin('site_tmplvar_access', 'site_tmplvar_access.tmplvarid', '=', 'site_tmplvars.id')
+            ->where('site_tmplvar_templates.templateid', $template)
+            ->orderBy('site_tmplvars.rank');
+
+        if ($restrictToGroups) {
+            $query->leftJoin('document_groups', 'site_tmplvar_contentvalues.contentid', '=', 'document_groups.document')
+                ->where(function ($q) use ($managerGroups) {
+                    $q->whereNull('site_tmplvar_access.documentgroup')
+                        ->orWhereIn('document_groups.document_group', $managerGroups);
+                });
+        }
+
+        $rows = [];
+        foreach ($query->get() as $row) {
+            $rows[] = [
+                'id' => (int) $row->id,
+                'name' => (string) $row->name,
+                'type' => (string) $row->type,
+                'default_text' => (string) $row->default_text,
+                'value_id' => $row->value_id === null ? null : (int) $row->value_id,
+                'value' => $row->value,
+            ];
+        }
+
+        return $rows;
+    }
+
+    /**
+     * One insert, one delete and an update per changed value; untouched rows cost nothing.
+     *
+     * @param array $tvs rows from forTemplate()
+     * @param array<int, string|null> $desired TV id => value, null removes the row
+     */
+    public static function sync(int $documentId, array $tvs, array $desired): void
+    {
+        $insert = [];
+        $delete = [];
+        foreach ($tvs as $tv) {
+            $value = $desired[$tv['id']] ?? null;
+            if ($value === null) {
+                if ($tv['value_id'] !== null) {
+                    $delete[] = $tv['id'];
+                }
+            } elseif ($tv['value_id'] === null) {
+                $insert[] = ['tmplvarid' => $tv['id'], 'contentid' => $documentId, 'value' => $value];
+            } elseif ((string) $tv['value'] !== $value) {
+                SiteTmplvarContentvalue::query()
+                    ->where('contentid', $documentId)->where('tmplvarid', $tv['id'])
+                    ->update(['value' => $value]);
+            }
+        }
+
+        if ($insert) {
+            SiteTmplvarContentvalue::query()->insert($insert);
+        }
+        if ($delete) {
+            SiteTmplvarContentvalue::query()->where('contentid', $documentId)->whereIn('tmplvarid', $delete)->delete();
+        }
+    }
+}
diff --git a/core/tests/Mocks/no_session_worker.php b/core/tests/Mocks/no_session_worker.php
index a7264a7b51..46ed620667 100644
--- a/core/tests/Mocks/no_session_worker.php
+++ b/core/tests/Mocks/no_session_worker.php
@@ -44,5 +44,6 @@ public function save(): void { $this->calls[] = 'save'; }
         Illuminate\Session\Middleware\StartSession::class,
         EvolutionCMS\Middleware\SessionProxy::class,
         Illuminate\Routing\Middleware\SubstituteBindings::class,
+        Illuminate\View\Middleware\ShareErrorsFromSession::class,
     ]),
 ]);
diff --git a/core/tests/Support/DocumentSaveDatabase.php b/core/tests/Support/DocumentSaveDatabase.php
new file mode 100644
index 0000000000..dc8007ee7f
--- /dev/null
+++ b/core/tests/Support/DocumentSaveDatabase.php
@@ -0,0 +1,169 @@
+<?php
+
+namespace Tests\Support;
+
+use EvolutionCMS\Services\DocumentSave\DocumentSaveContext;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Support\Facades\Facade;
+
+/**
+ * An in-memory SQLite copy of every table the document save touches, plus a
+ * DocumentSaveContext that answers from arrays instead of the manager session.
+ */
+final class DocumentSaveDatabase
+{
+    public static function boot(): Capsule
+    {
+        $capsule = new Capsule();
+        $capsule->addConnection(['driver' => 'sqlite', 'database' => ':memory:', 'prefix' => '']);
+        $capsule->setAsGlobal();
+        // model events, so the closure table hooks of SiteContent run as they do in the manager
+        $capsule->setEventDispatcher(new Dispatcher($capsule->getContainer()));
+        $capsule->bootEloquent();
+
+        $container = $capsule->getContainer();
+        $container->instance('db', $capsule->getDatabaseManager());
+        Facade::clearResolvedInstances();
+        Facade::setFacadeApplication($container);
+        Model::setConnectionResolver($capsule->getDatabaseManager());
+        // a model boots once per process; re-boot so its listeners land on this dispatcher
+        Model::clearBootedModels();
+
+        $schema = $capsule->getConnection()->getSchemaBuilder();
+
+        $schema->create('site_content', function (Blueprint $table) {
+            $table->increments('id');
+            $table->string('type')->default('document');
+            $table->string('contentType')->default('text/html');
+            $table->string('pagetitle')->default('');
+            $table->string('longtitle')->default('');
+            $table->string('description')->default('');
+            $table->string('alias')->default('');
+            $table->string('link_attributes')->default('');
+            $table->integer('published')->default(0);
+            $table->integer('pub_date')->default(0);
+            $table->integer('unpub_date')->default(0);
+            $table->integer('parent')->default(0);
+            $table->integer('isfolder')->default(0);
+            $table->text('introtext')->nullable();
+            $table->text('content')->nullable();
+            $table->integer('richtext')->default(1);
+            $table->integer('template')->default(0);
+            $table->integer('menuindex')->default(0);
+            $table->integer('searchable')->default(1);
+            $table->integer('cacheable')->default(1);
+            $table->integer('createdby')->default(0);
+            $table->integer('createdon')->default(0);
+            $table->integer('editedby')->default(0);
+            $table->integer('editedon')->default(0);
+            $table->integer('deleted')->default(0);
+            $table->integer('deletedon')->default(0);
+            $table->integer('deletedby')->default(0);
+            $table->integer('publishedon')->default(0);
+            $table->integer('publishedby')->default(0);
+            $table->string('menutitle')->default('');
+            $table->integer('hide_from_tree')->default(0);
+            $table->integer('privateweb')->default(0);
+            $table->integer('privatemgr')->default(0);
+            $table->integer('content_dispo')->default(0);
+            $table->integer('hidemenu')->default(0);
+            $table->integer('alias_visible')->default(1);
+        });
+        $schema->create('site_content_closure', function (Blueprint $table) {
+            $table->increments('closure_id');
+            $table->integer('ancestor');
+            $table->integer('descendant');
+            $table->integer('depth');
+        });
+        $schema->create('site_tmplvars', function (Blueprint $table) {
+            $table->increments('id');
+            $table->string('type')->default('text');
+            $table->string('name')->default('');
+            $table->text('default_text')->nullable();
+            $table->integer('rank')->default(0);
+        });
+        $schema->create('site_tmplvar_templates', function (Blueprint $table) {
+            $table->integer('tmplvarid');
+            $table->integer('templateid');
+        });
+        $schema->create('site_tmplvar_contentvalues', function (Blueprint $table) {
+            $table->increments('id');
+            $table->integer('tmplvarid');
+            $table->integer('contentid');
+            $table->text('value')->nullable();
+            $table->unique(['tmplvarid', 'contentid']);
+        });
+        $schema->create('site_tmplvar_access', function (Blueprint $table) {
+            $table->increments('id');
+            $table->integer('tmplvarid');
+            $table->integer('documentgroup');
+        });
+        $schema->create('document_groups', function (Blueprint $table) {
+            $table->increments('id');
+            $table->integer('document_group');
+            $table->integer('document');
+        });
+        $schema->create('membergroup_access', function (Blueprint $table) {
+            $table->increments('id');
+            $table->integer('membergroup');
+            $table->integer('documentgroup');
+            $table->integer('context')->default(0);
+        });
+        $schema->create('member_groups', function (Blueprint $table) {
+            $table->increments('id');
+            $table->integer('user_group');
+            $table->integer('member');
+        });
+
+        return $capsule;
+    }
+
+    /**
+     * @param array $config settings the save reads, e.g. use_udperms, friendly_urls
+     * @param string[] $permissions granted manager permissions
+     * @param int[] $userGroups document groups the user is a member of
+     * @param array $events collects every fired event as [name, params, snapshot]
+     * @param callable|null $snapshot called on every event, its result is stored next to the event
+     */
+    public static function context(
+        array $config = [],
+        array $permissions = [],
+        int $role = 1,
+        array $userGroups = [],
+        array &$events = [],
+        ?callable $snapshot = null,
+        int $now = 1_700_000_000,
+        ?callable $canCreateIn = null,
+    ): DocumentSaveContext {
+        return new DocumentSaveContext(
+            userId: 7,
+            role: $role,
+            managerDocgroups: $userGroups,
+            now: $now,
+            config: fn (string $key) => $config[$key] ?? null,
+            permission: fn (string $name) => in_array($name, $permissions, true),
+            event: function (string $name, array $params) use (&$events, $snapshot) {
+                $events[] = [$name, $params, $snapshot ? $snapshot() : null];
+            },
+            stripAlias: fn (string $alias) => preg_replace('/[^a-z0-9-]+/', '-', strtolower($alias)),
+            toTimestamp: fn (string $date) => (int) strtotime($date),
+            // like Core::getParentIds(): the ancestors of $id, not $id itself
+            parentIds: function (int $id) {
+                $ids = [];
+                while ($id > 0) {
+                    $id = (int) Capsule::table('site_content')->where('id', $id)->value('parent');
+                    if ($id > 0) {
+                        $ids[] = $id;
+                    }
+                }
+                return $ids;
+            },
+            canCreateIn: $canCreateIn ?? fn (int $parent) => true,
+            userGroupsLoader: fn () => $userGroups,
+            lang: fn (string $key) => $key === 'duplicate_alias_found' ? 'duplicate %s %s' : $key,
+        );
+    }
+}
diff --git a/core/tests/Unit/CoreCheckAccessTest.php b/core/tests/Unit/CoreCheckAccessTest.php
new file mode 100644
index 0000000000..abc83006a1
--- /dev/null
+++ b/core/tests/Unit/CoreCheckAccessTest.php
@@ -0,0 +1,68 @@
+<?php
+
+use EvolutionCMS\Core;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Schema\Blueprint;
+
+/**
+ * users 1..5 with one attributes row each, except 5 which has none:
+ *  1 clear, 2 blocked, 3 blocked until tomorrow, 4 blocked after yesterday, 5 no attributes row
+ */
+beforeEach(function () {
+    $capsule = new Capsule();
+    $capsule->addConnection(['driver' => 'sqlite', 'database' => ':memory:', 'prefix' => 'evo_']);
+    $capsule->setAsGlobal();
+    $capsule->bootEloquent();
+    Model::setConnectionResolver($capsule->getDatabaseManager());
+
+    $schema = $capsule->getConnection()->getSchemaBuilder();
+    $schema->create('users', function (Blueprint $table) {
+        $table->increments('id');
+        $table->string('username')->default('');
+    });
+    $schema->create('user_attributes', function (Blueprint $table) {
+        $table->increments('id');
+        $table->integer('internalKey')->default(0);
+        $table->integer('blocked')->default(0);
+        $table->integer('blockeduntil')->default(0);
+        $table->integer('blockedafter')->default(0);
+    });
+    foreach ([1, 2, 3, 4, 5] as $id) {
+        Capsule::table('users')->insert(['id' => $id, 'username' => "user$id"]);
+    }
+    foreach ([
+        ['internalKey' => 1],
+        ['internalKey' => 2, 'blocked' => 1],
+        ['internalKey' => 3, 'blockeduntil' => time() + 86400],
+        ['internalKey' => 4, 'blockedafter' => time() - 86400],
+    ] as $row) {
+        Capsule::table('user_attributes')->insert($row);
+    }
+
+    $this->core = (new ReflectionClass(Core::class))->newInstanceWithoutConstructor();
+});
+
+afterEach(function () {
+    Capsule::connection()->disconnect();
+    \Illuminate\Container\Container::setInstance(null);
+});
+
+test('checkAccess admits a clear user and a user without an attributes row', function () {
+    expect($this->core->checkAccess(1))->toBeTrue()
+        ->and($this->core->checkAccess(5))->toBeTrue();
+});
+
+test('checkAccess refuses blocked, temporarily blocked and expired users, and unknown ids', function () {
+    expect($this->core->checkAccess(2))->toBeFalse()
+        ->and($this->core->checkAccess(3))->toBeFalse()
+        ->and($this->core->checkAccess(4))->toBeFalse()
+        ->and($this->core->checkAccess(99))->toBeFalse();
+});
+
+test('checkAccess is a single query', function () {
+    Capsule::connection()->enableQueryLog();
+    $this->core->checkAccess(1);
+
+    expect(Capsule::connection()->getQueryLog())->toHaveCount(1);
+});
diff --git a/core/tests/Unit/Manager/ReferenceTypeSwitchFlowTest.php b/core/tests/Unit/Manager/ReferenceTypeSwitchFlowTest.php
index 8e77a77a7b..4ade7d2af7 100644
--- a/core/tests/Unit/Manager/ReferenceTypeSwitchFlowTest.php
+++ b/core/tests/Unit/Manager/ReferenceTypeSwitchFlowTest.php
@@ -16,8 +16,10 @@
     $processorPath = dirname(__DIR__, 4) . '/manager/processors/save_content.processor.php';
     $processor = file_get_contents($processorPath);
 
+    $response = file_get_contents(dirname(__DIR__, 4) . '/core/src/Support/DocumentSave/SaveResponse.php');
+
     expect($processor)->toContain('$newResourceAction = ($type == "reference") ? "72" : "4";');
-    expect($processor)->toContain('if ($type == "reference") {');
+    expect($response)->toContain("\$newAction = \$saved->type === 'reference' ? '72' : '4';");
     expect($processor)->not->toContain('if ($_POST[\'mode\'] == "72")');
     expect($processor)->not->toContain('if ($_POST[\'mode\'] == "4")');
 });
diff --git a/core/tests/Unit/NoSessionModeTest.php b/core/tests/Unit/NoSessionModeTest.php
index 8f7ccc4fb6..fff1b65508 100644
--- a/core/tests/Unit/NoSessionModeTest.php
+++ b/core/tests/Unit/NoSessionModeTest.php
@@ -3,6 +3,7 @@
 use EvolutionCMS\Middleware\SessionProxy;
 use Illuminate\Routing\Middleware\SubstituteBindings;
 use Illuminate\Session\Middleware\StartSession;
+use Illuminate\View\Middleware\ShareErrorsFromSession;
 
 // Constants are process-global, so every combination boots in its own PHP process.
 function noSessionRun(string $noSession, string $manager): array
@@ -29,7 +30,7 @@ function noSessionRun(string $noSession, string $manager): array
 
     expect($r['disabled'])->toBeFalse()
         ->and($r['store'])->toBe(['start', 'put', 'save'])
-        ->and($r['middleware'])->toBe([StartSession::class, SessionProxy::class, SubstituteBindings::class]);
+        ->and($r['middleware'])->toBe([StartSession::class, SessionProxy::class, SubstituteBindings::class, ShareErrorsFromSession::class]);
 });
 
 test('sessions stay on when NO_SESSION is absent or false', function () {
diff --git a/core/tests/Unit/Services/DocumentSaveServiceTest.php b/core/tests/Unit/Services/DocumentSaveServiceTest.php
new file mode 100644
index 0000000000..3d54360d1b
--- /dev/null
+++ b/core/tests/Unit/Services/DocumentSaveServiceTest.php
@@ -0,0 +1,299 @@
+<?php
+
+use EvolutionCMS\Services\DocumentSave\DocumentSaveDenied;
+use EvolutionCMS\Services\DocumentSaveService;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Support\Facades\Facade;
+use Tests\Support\DocumentSaveDatabase;
+
+afterEach(fn () => Facade::clearResolvedInstances());
+
+const DS_NOW = 1_700_000_000;
+
+/**
+ *  1 folder (group 3, published)
+ *   └ 2 page   (group 3, TV 1 = "old", TV 2 = "keep")
+ *  4 other folder
+ * Template 1 carries TVs 1 and 2; document group 3 is linked to a web user group.
+ */
+function bootSaveFixture(): Capsule
+{
+    $capsule = DocumentSaveDatabase::boot();
+    foreach ([
+        ['id' => 1, 'pagetitle' => 'folder', 'alias' => 'folder', 'isfolder' => 1, 'published' => 1, 'privateweb' => 1],
+        ['id' => 2, 'pagetitle' => 'page', 'alias' => 'page', 'parent' => 1, 'template' => 1, 'published' => 1, 'publishedon' => 500, 'publishedby' => 4, 'privateweb' => 1],
+        ['id' => 4, 'pagetitle' => 'other', 'alias' => 'other', 'isfolder' => 1],
+    ] as $row) {
+        Capsule::table('site_content')->insert($row);
+    }
+    Capsule::table('site_content_closure')->insert([
+        ['ancestor' => 1, 'descendant' => 1, 'depth' => 0],
+        ['ancestor' => 2, 'descendant' => 2, 'depth' => 0],
+        ['ancestor' => 1, 'descendant' => 2, 'depth' => 1],
+        ['ancestor' => 4, 'descendant' => 4, 'depth' => 0],
+    ]);
+    Capsule::table('site_tmplvars')->insert([
+        ['id' => 1, 'name' => 'one', 'type' => 'text', 'default_text' => '', 'rank' => 1],
+        ['id' => 2, 'name' => 'two', 'type' => 'text', 'default_text' => '', 'rank' => 2],
+    ]);
+    Capsule::table('site_tmplvar_templates')->insert([['tmplvarid' => 1, 'templateid' => 1], ['tmplvarid' => 2, 'templateid' => 1]]);
+    Capsule::table('site_tmplvar_contentvalues')->insert([
+        ['tmplvarid' => 1, 'contentid' => 2, 'value' => 'old'],
+        ['tmplvarid' => 2, 'contentid' => 2, 'value' => 'keep'],
+    ]);
+    Capsule::table('document_groups')->insert([
+        ['document_group' => 3, 'document' => 1],
+        ['document_group' => 3, 'document' => 2],
+    ]);
+    Capsule::table('membergroup_access')->insert([['membergroup' => 1, 'documentgroup' => 3, 'context' => 1]]);
+
+    return $capsule;
+}
+
+function saveForm(array $overrides = []): array
+{
+    return $overrides + [
+        'id' => '', 'mode' => '4', 'pagetitle' => 'New page', 'alias' => '', 'type' => 'document',
+        'parent' => '1', 'template' => '1', 'published' => '1', 'pub_date' => '', 'unpub_date' => '',
+        'ta' => 'body', 'introtext' => '', 'longtitle' => '', 'description' => '', 'link_attributes' => '',
+        'isfolder' => '0', 'richtext' => '1', 'menuindex' => '0', 'searchable' => '1', 'cacheable' => '1',
+        'contentType' => 'text/html', 'content_dispo' => '0', 'hide_from_tree' => '0', 'menutitle' => '',
+        'hidemenu' => '0', 'alias_visible' => '1', 'syncsite' => '1',
+    ];
+}
+
+function dbSnapshot(): array
+{
+    return [
+        'level' => Capsule::connection()->transactionLevel(),
+        'titles' => Capsule::table('site_content')->orderBy('id')->pluck('pagetitle')->all(),
+    ];
+}
+
+test('a new document is created with its tvs, inherited groups, folder flag and privacy in one go', function () {
+    bootSaveFixture();
+    $events = [];
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(
+        config: ['use_udperms' => 1, 'friendly_urls' => 1, 'automatic_alias' => 1],
+        permissions: ['publish_document'],
+        role: 2,
+        userGroups: [3],
+        events: $events,
+        snapshot: 'dbSnapshot',
+    ));
+    Capsule::table('site_content')->where('id', 4)->update(['isfolder' => 0]);
+
+    $result = $service->save(saveForm(['parent' => '4', 'tv1' => 'first', 'tv2' => '', 'docgroups' => []]));
+
+    $row = Capsule::table('site_content')->find($result->id);
+    expect($result->isNew())->toBeTrue()
+        ->and($result->alias)->toBe('new-page')
+        ->and($row->pagetitle)->toBe('New page')
+        ->and((int) $row->published)->toBe(1)
+        ->and((int) $row->publishedby)->toBe(7)
+        ->and((int) $row->createdby)->toBe(7)
+        // createdon is not fillable; the creating hook of the model writes it, for the legacy processor too
+        ->and((int) $row->createdon)->toBeGreaterThan(0)
+        ->and($result->editedon)->toBe((int) $row->editedon)
+        ->and($result->editedon)->toBeGreaterThan(0)
+        ->and(Capsule::table('site_tmplvar_contentvalues')->where('contentid', $result->id)->pluck('value', 'tmplvarid')->all())->toBe([1 => 'first'])
+        ->and(Capsule::table('site_content')->where('id', 4)->value('isfolder'))->toBe(1)
+        ->and(Capsule::table('site_content_closure')->where('descendant', $result->id)->count())->toBe(2);
+
+    // events: before fires with no row and outside a transaction, after fires once the row is committed
+    expect(array_column($events, 0))->toBe(['OnBeforeDocFormSave', 'OnDocFormSave'])
+        ->and($events[0][1])->toBe(['mode' => 'new', 'id' => ''])
+        ->and($events[0][2])->toBe(['level' => 0, 'titles' => ['folder', 'page', 'other']])
+        ->and($events[1][1])->toBe(['mode' => 'new', 'id' => $result->id])
+        ->and($events[1][2])->toBe(['level' => 0, 'titles' => ['folder', 'page', 'other', 'New page']]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('OnBeforeDocFormSave still announces the id docid_incrmnt_method promises', function () {
+    bootSaveFixture();
+    $events = [];
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['docid_incrmnt_method' => 2], events: $events));
+    $service->save(saveForm());
+
+    $gaps = [];
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['docid_incrmnt_method' => 1], events: $gaps));
+    $service->save(saveForm());
+
+    // max + 1 with ids 1, 2, 4 is 5; the first gap is 3; the row itself is auto increment either way
+    expect($events[0][1])->toBe(['mode' => 'new', 'id' => 5])
+        ->and($gaps[0][1])->toBe(['mode' => 'new', 'id' => 3])
+        ->and($events[1][1]['id'])->toBe(5)
+        ->and($gaps[1][1]['id'])->toBe(6);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a new document under a private parent inherits its groups and becomes private', function () {
+    bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['use_udperms' => 1], permissions: ['publish_document'], role: 2, userGroups: [3]));
+
+    $result = $service->save(saveForm(['parent' => '1']));
+
+    expect(Capsule::table('document_groups')->where('document', $result->id)->pluck('document_group')->all())->toBe([3])
+        ->and((int) Capsule::table('site_content')->where('id', $result->id)->value('privateweb'))->toBe(1);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('without publish_document a new document is stored unpublished', function () {
+    bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(role: 2));
+
+    $result = $service->save(saveForm(['published' => '1', 'pub_date' => '2020-01-01']));
+
+    expect(Capsule::table('site_content')->find($result->id))->toMatchObject(['published' => 0, 'pub_date' => 0, 'publishedon' => 0]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('editing writes the tv diff, moves the document and fixes both folder flags', function () {
+    $capsule = bootSaveFixture();
+    $events = [];
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(
+        config: ['use_udperms' => 1],
+        permissions: ['publish_document', 'manage_groups'],
+        events: $events,
+        snapshot: 'dbSnapshot',
+    ));
+
+    $capsule->getConnection()->enableQueryLog();
+    $result = $service->save(saveForm([
+        'id' => '2', 'mode' => '27', 'pagetitle' => 'moved', 'alias' => 'moved', 'parent' => '4',
+        'tv1' => 'new', 'tv2' => 'keep', 'docgroups' => ['3,1'],
+    ]));
+    $queries = count($capsule->getConnection()->getQueryLog());
+
+    $row = Capsule::table('site_content')->find(2);
+    expect($result->isNew())->toBeFalse()
+        ->and($row->pagetitle)->toBe('moved')
+        ->and((int) $row->parent)->toBe(4)
+        ->and((int) $row->publishedon)->toBe(500)
+        ->and(Capsule::table('site_tmplvar_contentvalues')->where('contentid', 2)->pluck('value', 'tmplvarid')->all())->toBe([1 => 'new', 2 => 'keep'])
+        ->and(Capsule::table('document_groups')->where('document', 2)->pluck('document_group')->all())->toBe([3])
+        // the old parent lost its last child, the new one gained one
+        ->and((int) Capsule::table('site_content')->where('id', 1)->value('isfolder'))->toBe(0)
+        ->and((int) Capsule::table('site_content')->where('id', 4)->value('isfolder'))->toBe(1)
+        ->and(Capsule::table('site_content_closure')->where('descendant', 2)->where('ancestor', 4)->exists())->toBeTrue()
+        ->and(array_column($events, 0))->toBe(['OnBeforeDocFormSave', 'OnDocFormSave'])
+        ->and($events[1][1])->toBe(['mode' => 'upd', 'id' => 2])
+        ->and($events[1][2]['level'])->toBe(0)
+        // the legacy processor needed ~30 queries for this form
+        ->and($queries)->toBeLessThanOrEqual(20);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('an unchanged edit does not touch the tv table', function () {
+    $capsule = bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(permissions: ['publish_document']));
+
+    $capsule->getConnection()->enableQueryLog();
+    $service->save(saveForm(['id' => '2', 'mode' => '27', 'pagetitle' => 'page', 'alias' => 'page', 'tv1' => 'old', 'tv2' => 'keep']));
+
+    $tvWrites = array_filter($capsule->getConnection()->getQueryLog(), fn ($q) => preg_match('/^(insert|update|delete)\b.*site_tmplvar_contentvalues/', $q['query']));
+    expect($tvWrites)->toBe([]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('removing the last own group rolls the whole save back and fires no after event', function () {
+    bootSaveFixture();
+    $events = [];
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(
+        config: ['use_udperms' => 1],
+        permissions: ['publish_document', 'manage_document_permissions'],
+        role: 2,
+        userGroups: [3],
+        events: $events,
+    ));
+
+    // chkalldocs: the group list is empty, which passes the early check but leaves the user with nothing
+    $save = fn () => $service->save(saveForm(['id' => '2', 'mode' => '27', 'pagetitle' => 'changed', 'alias' => 'page', 'chkalldocs' => 'on', 'tv1' => 'changed']));
+
+    expect($save)->toThrow(DocumentSaveDenied::class, 'resource_permissions_error')
+        ->and(Capsule::table('site_content')->where('id', 2)->value('pagetitle'))->toBe('page')
+        ->and(Capsule::table('site_tmplvar_contentvalues')->where('contentid', 2)->where('tmplvarid', 1)->value('value'))->toBe('old')
+        ->and(Capsule::table('document_groups')->where('document', 2)->count())->toBe(1)
+        ->and(array_column($events, 0))->toBe(['OnBeforeDocFormSave'])
+        ->and(Capsule::connection()->transactionLevel())->toBe(0);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a duplicate alias is refused with the id of the other document', function () {
+    bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['friendly_urls' => 1]));
+
+    try {
+        $service->save(saveForm(['alias' => 'other']));
+        $this->fail('expected a denial');
+    } catch (DocumentSaveDenied $denied) {
+        expect($denied->getMessage())->toBe('duplicate 4 other')
+            ->and($denied->restoreForm)->toBeTrue();
+    }
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('an automatic alias gets a counter while it collides', function () {
+    bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['friendly_urls' => 1, 'automatic_alias' => 1]));
+
+    expect($service->save(saveForm(['pagetitle' => 'Other']))->alias)->toBe('other1')
+        ->and($service->save(saveForm(['pagetitle' => 'Other']))->alias)->toBe('other2');
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('the parent permission is checked for new documents and on a move only', function () {
+    bootSaveFixture();
+    $asked = [];
+    $context = DocumentSaveDatabase::context(
+        config: ['use_udperms' => 1],
+        permissions: ['publish_document'],
+        canCreateIn: function (int $parent) use (&$asked) {
+            $asked[] = $parent;
+            return $parent !== 4;
+        },
+    );
+    $service = new DocumentSaveService($context);
+
+    // same parent: not asked
+    $service->save(saveForm(['id' => '2', 'mode' => '27', 'alias' => 'page', 'parent' => '1']));
+    expect($asked)->toBe([]);
+
+    $save = fn () => $service->save(saveForm(['id' => '2', 'mode' => '27', 'alias' => 'page', 'parent' => '4']));
+    expect($save)->toThrow(DocumentSaveDenied::class, 'access_permission_parent_denied')
+        ->and($asked)->toBe([4])
+        ->and((int) Capsule::table('site_content')->where('id', 2)->value('parent'))->toBe(1);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a non administrator cannot post a group list without one of their own groups', function () {
+    bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['use_udperms' => 1], role: 2, userGroups: [3]));
+
+    $save = fn () => $service->save(saveForm(['docgroups' => ['9,new']]));
+
+    expect($save)->toThrow(DocumentSaveDenied::class, 'resource_permissions_error')
+        ->and(Capsule::table('site_content')->count())->toBe(3);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('structural guards refuse a missing document, a self parent and a descendant parent', function () {
+    bootSaveFixture();
+    $service = new DocumentSaveService(DocumentSaveDatabase::context(config: ['site_start' => 1], permissions: ['publish_document']));
+
+    $denied = function (array $form) use ($service): DocumentSaveDenied {
+        try {
+            $service->save(saveForm($form));
+        } catch (DocumentSaveDenied $e) {
+            return $e;
+        }
+        $this->fail('expected a denial');
+    };
+
+    expect($denied(['id' => '99', 'mode' => '27'])->getMessage())->toBe('error_no_results')
+        ->and($denied(['id' => '99', 'mode' => '27'])->restoreForm)->toBeFalse()
+        ->and($denied(['id' => '2', 'mode' => '27', 'parent' => '2'])->getMessage())->toContain('own parent')
+        ->and($denied(['id' => '1', 'mode' => '27', 'parent' => '2'])->getMessage())->toContain('descendant')
+        ->and($denied(['id' => '1', 'mode' => '27', 'parent' => '0', 'published' => '0'])->getMessage())->toContain('cannot be unpublished')
+        ->and($denied(['id' => '1', 'mode' => '27', 'parent' => '0', 'unpub_date' => '2030-01-01'])->getMessage())->toContain('unpublish dates');
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('the save processor delegates to the service and keeps the redirect and cache logic', function () {
+    $source = file_get_contents(dirname(__DIR__, 4) . '/manager/processors/save_content.processor.php');
+
+    expect($source)->toContain('DocumentSaveService::forManager()->save($_POST)')
+        ->and($source)->toContain('catch (\EvolutionCMS\Services\DocumentSave\DocumentSaveDenied $denied)')
+        ->and($source)->toContain("hasPermission('save_document')")
+        ->and($source)->toContain("clearCache('document')")
+        ->and($source)->not->toContain('invokeEvent')
+        ->and($source)->not->toContain('SiteTmplvarContentvalue');
+});
diff --git a/core/tests/Unit/Services/ManagerActivityTest.php b/core/tests/Unit/Services/ManagerActivityTest.php
new file mode 100644
index 0000000000..ea659b7671
--- /dev/null
+++ b/core/tests/Unit/Services/ManagerActivityTest.php
@@ -0,0 +1,148 @@
+<?php
+
+use EvolutionCMS\Services\ManagerActivity;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Facade;
+
+function bootActivityDatabase(): Capsule
+{
+    $capsule = new Capsule();
+    $capsule->addConnection(['driver' => 'sqlite', 'database' => ':memory:', 'prefix' => '']);
+    $capsule->setAsGlobal();
+    $capsule->bootEloquent();
+
+    $container = $capsule->getContainer();
+    $container->instance('db', $capsule->getDatabaseManager());
+    Facade::clearResolvedInstances();
+    Facade::setFacadeApplication($container);
+    Model::setConnectionResolver($capsule->getDatabaseManager());
+
+    $schema = $capsule->getConnection()->getSchemaBuilder();
+    $schema->create('active_user_sessions', function (Blueprint $table) {
+        $table->string('sid', 128)->primary();
+        $table->integer('internalKey')->default(0);
+        $table->integer('lasthit')->default(0);
+        $table->string('ip')->default('');
+    });
+    $schema->create('active_users', function (Blueprint $table) {
+        $table->string('sid', 128)->primary();
+        $table->integer('internalKey')->default(0);
+        $table->string('username', 50)->default('');
+        $table->integer('lasthit')->default(0);
+        $table->string('action', 10)->default('');
+        $table->integer('id')->nullable();
+    });
+    $schema->create('active_user_locks', function (Blueprint $table) {
+        $table->increments('id');
+        $table->string('sid', 128)->default('');
+        $table->integer('internalKey')->default(0);
+        $table->integer('elementType')->default(0);
+        $table->integer('elementId')->default(0);
+        $table->integer('lasthit')->default(0);
+    });
+
+    return $capsule;
+}
+
+beforeEach(function () {
+    ManagerActivity::reset();
+    $this->capsule = bootActivityDatabase();
+});
+
+afterEach(function () {
+    ManagerActivity::instance()->flush();
+    ManagerActivity::reset();
+    Facade::clearResolvedInstances();
+    Facade::setFacadeApplication(null);
+    Capsule::connection()->disconnect();
+    \Illuminate\Container\Container::setInstance(null);
+});
+
+test('nothing is written until flush', function () {
+    $activity = ManagerActivity::instance();
+    $activity->touchSession(7, 'sid-a', 1000, '10.0.0.1');
+    $activity->setAction(7, 'sid-a', 'admin', 1000, 27, 42);
+    $activity->lock(7, 42, 7, 'sid-a', 1000);
+
+    expect($activity->hasPending())->toBeTrue()
+        ->and(Capsule::table('active_user_sessions')->count())->toBe(0)
+        ->and(Capsule::table('active_users')->count())->toBe(0)
+        ->and(Capsule::table('active_user_locks')->count())->toBe(0);
+
+    $activity->flush();
+
+    expect($activity->hasPending())->toBeFalse()
+        ->and(Capsule::table('active_user_sessions')->get()->map(fn ($r) => (array) $r)->all())
+            ->toBe([['sid' => 'sid-a', 'internalKey' => 7, 'lasthit' => 1000, 'ip' => '10.0.0.1']])
+        ->and((array) Capsule::table('active_users')->first())
+            ->toBe(['sid' => 'sid-a', 'internalKey' => 7, 'username' => 'admin', 'lasthit' => 1000, 'action' => '27', 'id' => 42])
+        ->and(Capsule::table('active_user_locks')->where('elementId', 42)->value('internalKey'))->toBe(7);
+});
+
+test('a session replaces the stale rows of the same user and of the same sid', function () {
+    Capsule::table('active_user_sessions')->insert([
+        ['sid' => 'old-of-user', 'internalKey' => 7, 'lasthit' => 1, 'ip' => ''],
+        ['sid' => 'sid-a', 'internalKey' => 3, 'lasthit' => 1, 'ip' => ''],
+        ['sid' => 'someone-else', 'internalKey' => 9, 'lasthit' => 1, 'ip' => ''],
+    ]);
+
+    ManagerActivity::instance()->touchSession(7, 'sid-a', 2000, '10.0.0.2');
+    ManagerActivity::instance()->flush();
+
+    expect(Capsule::table('active_user_sessions')->orderBy('sid')->pluck('internalKey', 'sid')->all())
+        ->toBe(['sid-a' => 7, 'someone-else' => 9]);
+});
+
+test('an action keeps one active_users row per user and refreshes an existing lock in place', function () {
+    Capsule::table('active_users')->insert(['sid' => 'old', 'internalKey' => 7, 'username' => 'admin', 'lasthit' => 1, 'action' => '3', 'id' => null]);
+    Capsule::table('active_user_locks')->insert(['sid' => 'old', 'internalKey' => 7, 'elementType' => 7, 'elementId' => 42, 'lasthit' => 1]);
+
+    $activity = ManagerActivity::instance();
+    $activity->setAction(7, 'new', 'admin', 5000, 27, 42);
+    $activity->lock(7, 42, 7, 'new', 5000);
+    $activity->flush();
+
+    expect(Capsule::table('active_users')->pluck('sid')->all())->toBe(['new'])
+        ->and(Capsule::table('active_user_locks')->count())->toBe(1)
+        ->and((array) Capsule::table('active_user_locks')->select('sid', 'lasthit')->first())->toBe(['sid' => 'new', 'lasthit' => 5000]);
+});
+
+test('flush runs queued jobs once, in order, and is a no-op afterwards', function () {
+    $order = [];
+    $activity = ManagerActivity::instance();
+    $activity->defer(function () use (&$order) { $order[] = 'first'; });
+    $activity->defer(function () use (&$order) { $order[] = 'second'; });
+
+    $activity->flush();
+    $activity->flush();
+
+    expect($order)->toBe(['first', 'second']);
+
+    $activity->defer(function () use (&$order) { $order[] = 'third'; });
+    $activity->flush();
+
+    expect($order)->toBe(['first', 'second', 'third']);
+});
+
+test('a failing job rolls the whole batch back and surfaces the error when attached', function () {
+    $activity = ManagerActivity::instance();
+    $activity->touchSession(7, 'sid-a', 1000, '10.0.0.1');
+    $activity->defer(function () { throw new RuntimeException('boom'); });
+
+    expect(fn () => $activity->flush())->toThrow(RuntimeException::class, 'boom')
+        ->and(Capsule::table('active_user_sessions')->count())->toBe(0)
+        ->and($activity->hasPending())->toBeFalse();
+});
+
+test('the manager hands its bookkeeping to the service and flushes after the response is sent', function () {
+    $core = file_get_contents(dirname(__DIR__, 3) . '/src/Core.php');
+    $theme = file_get_contents(dirname(__DIR__, 3) . '/src/ManagerTheme.php');
+
+    expect($core)->toContain('ManagerActivity::instance()')
+        ->and($core)->not->toContain("ActiveUserSession::where('sid', \$this->sid)->delete()")
+        ->and($theme)->toContain('$response->send();')
+        ->and(strpos($theme, 'ManagerActivity::instance()->flush('))->toBeGreaterThan(strpos($theme, '$response->send();'))
+        ->and($theme)->not->toContain('->forceDelete()');
+});
diff --git a/core/tests/Unit/Support/DocumentPrivacyTest.php b/core/tests/Unit/Support/DocumentPrivacyTest.php
new file mode 100644
index 0000000000..2e512f7ffc
--- /dev/null
+++ b/core/tests/Unit/Support/DocumentPrivacyTest.php
@@ -0,0 +1,97 @@
+<?php
+
+use EvolutionCMS\Support\DocumentPrivacy;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Support\Facades\Facade;
+use Tests\Support\DocumentSaveDatabase;
+
+afterEach(fn () => Facade::clearResolvedInstances());
+
+/**
+ * Group 3 is linked to a web user group, group 4 to a manager user group, group 5 to nothing.
+ * Document 10 is in 3, 11 in 4, 12 in 5, 13 in 3 and 4, 14 has no group but stale flags.
+ */
+function bootPrivacyFixture(): Capsule
+{
+    $capsule = DocumentSaveDatabase::boot();
+    foreach ([
+        ['id' => 10, 'pagetitle' => 'web'],
+        ['id' => 11, 'pagetitle' => 'mgr'],
+        ['id' => 12, 'pagetitle' => 'unlinked group'],
+        ['id' => 13, 'pagetitle' => 'both', 'deleted' => 1],
+        ['id' => 14, 'pagetitle' => 'stale', 'privateweb' => 1, 'privatemgr' => 1],
+    ] as $row) {
+        Capsule::table('site_content')->insert($row);
+    }
+    Capsule::table('document_groups')->insert([
+        ['document_group' => 3, 'document' => 10],
+        ['document_group' => 4, 'document' => 11],
+        ['document_group' => 5, 'document' => 12],
+        ['document_group' => 3, 'document' => 13],
+        ['document_group' => 4, 'document' => 13],
+    ]);
+    Capsule::table('membergroup_access')->insert([
+        ['membergroup' => 1, 'documentgroup' => 3, 'context' => DocumentPrivacy::WEB],
+        ['membergroup' => 2, 'documentgroup' => 4, 'context' => DocumentPrivacy::MANAGER],
+    ]);
+
+    return $capsule;
+}
+
+function privacyOf(int $id): array
+{
+    $row = Capsule::table('site_content')->where('id', $id)->first(['privateweb', 'privatemgr']);
+
+    return [(int) $row->privateweb, (int) $row->privatemgr];
+}
+
+test('refresh sets both flags of one document from the linked user groups', function () {
+    $capsule = bootPrivacyFixture();
+    $capsule->getConnection()->enableQueryLog();
+
+    foreach ([10, 11, 12, 13, 14] as $id) {
+        DocumentPrivacy::refresh($id);
+    }
+
+    expect($capsule->getConnection()->getQueryLog())->toHaveCount(10)
+        ->and(privacyOf(10))->toBe([1, 0])
+        ->and(privacyOf(11))->toBe([0, 1])
+        ->and(privacyOf(12))->toBe([0, 0])
+        // trashed documents are refreshed too
+        ->and(privacyOf(13))->toBe([1, 1])
+        ->and(privacyOf(14))->toBe([0, 0]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('refresh with a context leaves the other flag alone, as the legacy include did', function () {
+    bootPrivacyFixture();
+
+    DocumentPrivacy::refresh(14, DocumentPrivacy::WEB);
+    expect(privacyOf(14))->toBe([0, 1]);
+
+    DocumentPrivacy::refresh(14, DocumentPrivacy::MANAGER);
+    expect(privacyOf(14))->toBe([0, 0]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('refreshAll recomputes one flag for the whole site and leaves the other alone', function () {
+    bootPrivacyFixture();
+
+    DocumentPrivacy::refreshAll(DocumentPrivacy::WEB);
+
+    expect(privacyOf(10))->toBe([1, 0])
+        ->and(privacyOf(13))->toBe([1, 0])
+        ->and(privacyOf(14))->toBe([0, 1]);
+
+    DocumentPrivacy::refreshAll(DocumentPrivacy::MANAGER);
+
+    expect(privacyOf(11))->toBe([0, 1])
+        ->and(privacyOf(13))->toBe([1, 1])
+        ->and(privacyOf(14))->toBe([0, 0]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('the legacy include delegates to DocumentPrivacy', function () {
+    $source = file_get_contents(dirname(__DIR__, 4) . '/manager/includes/secure_web_documents.inc.php');
+
+    expect($source)->toContain('DocumentPrivacy::refresh((int) $docid, $context)')
+        ->and($source)->toContain('DocumentPrivacy::refreshAll($context)')
+        ->and($source)->toContain('@deprecated since 3.5.9');
+});
diff --git a/core/tests/Unit/Support/DocumentSave/DocumentGroupSyncTest.php b/core/tests/Unit/Support/DocumentSave/DocumentGroupSyncTest.php
new file mode 100644
index 0000000000..b29c001dd1
--- /dev/null
+++ b/core/tests/Unit/Support/DocumentSave/DocumentGroupSyncTest.php
@@ -0,0 +1,110 @@
+<?php
+
+use EvolutionCMS\Support\DocumentSave\DocumentGroupSync;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Support\Facades\Facade;
+use Tests\Support\DocumentSaveDatabase;
+
+afterEach(fn () => Facade::clearResolvedInstances());
+
+function groupsOf(int $document): array
+{
+    return Capsule::table('document_groups')->where('document', $document)->orderBy('document_group')->pluck('document_group')->map(fn ($g) => (int) $g)->all();
+}
+
+test('posted pairs reduce to unique group ids', function () {
+    expect(DocumentGroupSync::postedGroups(['3,new', '5,17', '3,new', ['bad']]))->toBe([3, 5]);
+});
+
+test('a user locks themselves out only when none of the chosen groups is theirs', function () {
+    expect(DocumentGroupSync::locksOut([], [1]))->toBeFalse()
+        ->and(DocumentGroupSync::locksOut([3, 5], [5]))->toBeFalse()
+        ->and(DocumentGroupSync::locksOut([3, 5], [8]))->toBeTrue()
+        ->and(DocumentGroupSync::locksOut([3], []))->toBeTrue();
+});
+
+test('without group permissions a new document inherits the groups of its parent', function () {
+    DocumentSaveDatabase::boot();
+
+    DocumentGroupSync::forNewDocument(50, ['3,new'], [7, 8], [3], false, false);
+
+    expect(groupsOf(50))->toBe([7, 8]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('manage_groups attaches exactly the posted groups', function () {
+    DocumentSaveDatabase::boot();
+
+    DocumentGroupSync::forNewDocument(50, ['3,new', '5,new', '5,new'], [7], [], true, false);
+
+    expect(groupsOf(50))->toBe([3, 5]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('manage_document_permissions keeps the parent groups the user cannot manage', function () {
+    DocumentSaveDatabase::boot();
+
+    // 9 is not the user's group and is dropped; 7 is a parent group outside the user's reach and stays
+    DocumentGroupSync::forNewDocument(50, ['3,new', '9,new'], [7, 3], [3], false, true);
+
+    expect(groupsOf(50))->toBe([3, 7]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a user who picks none of their own groups keeps all groups of the parent', function () {
+    DocumentSaveDatabase::boot();
+
+    DocumentGroupSync::forNewDocument(50, [], [7, 3], [3], false, true);
+
+    expect(groupsOf(50))->toBe([3, 7]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('editing inserts the new pairs and deletes the unchecked ones', function () {
+    DocumentSaveDatabase::boot();
+    Capsule::table('document_groups')->insert([
+        ['id' => 1, 'document_group' => 3, 'document' => 50],
+        ['id' => 2, 'document_group' => 4, 'document' => 50],
+        ['id' => 3, 'document_group' => 4, 'document' => 51],
+    ]);
+
+    $kept = DocumentGroupSync::forExistingDocument(50, ['3,1', '5,new'], [], true, false);
+
+    expect($kept)->toBeTrue()
+        ->and(groupsOf(50))->toBe([3, 5])
+        ->and(groupsOf(51))->toBe([4]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a user without manage_groups cannot touch groups outside their own', function () {
+    DocumentSaveDatabase::boot();
+    Capsule::table('document_groups')->insert([
+        ['id' => 1, 'document_group' => 3, 'document' => 50],
+        ['id' => 2, 'document_group' => 8, 'document' => 50],
+    ]);
+
+    // tries to drop 8 (not theirs) and add 9 (not theirs), adds 5 (theirs)
+    $kept = DocumentGroupSync::forExistingDocument(50, ['3,1', '5,new', '9,new'], [3, 5], false, false);
+
+    expect($kept)->toBeTrue()
+        ->and(groupsOf(50))->toBe([3, 5, 8]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('removing the last own group is refused before anything is written', function () {
+    DocumentSaveDatabase::boot();
+    Capsule::table('document_groups')->insert([
+        ['id' => 1, 'document_group' => 3, 'document' => 50],
+        ['id' => 2, 'document_group' => 8, 'document' => 50],
+    ]);
+
+    $kept = DocumentGroupSync::forExistingDocument(50, [], [3], false, false);
+
+    expect($kept)->toBeFalse()
+        ->and(groupsOf(50))->toBe([3, 8]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('making the document public removes every group', function () {
+    DocumentSaveDatabase::boot();
+    Capsule::table('document_groups')->insert([
+        ['id' => 1, 'document_group' => 3, 'document' => 50],
+        ['id' => 2, 'document_group' => 8, 'document' => 50],
+    ]);
+
+    expect(DocumentGroupSync::forExistingDocument(50, [], [], true, true))->toBeTrue()
+        ->and(groupsOf(50))->toBe([]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
diff --git a/core/tests/Unit/Support/DocumentSave/PublishStateTest.php b/core/tests/Unit/Support/DocumentSave/PublishStateTest.php
new file mode 100644
index 0000000000..1d4b10189a
--- /dev/null
+++ b/core/tests/Unit/Support/DocumentSave/PublishStateTest.php
@@ -0,0 +1,44 @@
+<?php
+
+use EvolutionCMS\Support\DocumentSave\PublishState;
+
+const PS_NOW = 1_700_000_000;
+
+test('a publish date decides the flag relative to now', function () {
+    expect(PublishState::fromDates(0, PS_NOW - 10, 0, PS_NOW))->toBe(1)
+        ->and(PublishState::fromDates(1, PS_NOW + 10, 0, PS_NOW))->toBe(0)
+        ->and(PublishState::fromDates(1, 0, PS_NOW - 10, PS_NOW))->toBe(0)
+        ->and(PublishState::fromDates(1, 0, PS_NOW + 10, PS_NOW))->toBe(1)
+        ->and(PublishState::fromDates(1, 0, 0, PS_NOW))->toBe(1);
+});
+
+test('a new document without publish_document is always unpublished with no dates', function () {
+    expect(PublishState::forNew(1, PS_NOW - 5, PS_NOW + 5, PS_NOW, 7, false))
+        ->toBe(['published' => 0, 'pub_date' => 0, 'unpub_date' => 0, 'publishedon' => 0, 'publishedby' => 0]);
+});
+
+test('a new published document records the publisher and uses the publish date when set', function () {
+    expect(PublishState::forNew(1, 0, 0, PS_NOW, 7, true))
+        ->toBe(['published' => 1, 'pub_date' => 0, 'unpub_date' => 0, 'publishedon' => PS_NOW, 'publishedby' => 7])
+        ->and(PublishState::forNew(0, PS_NOW - 100, 0, PS_NOW, 7, true))
+        ->toBe(['published' => 1, 'pub_date' => PS_NOW - 100, 'unpub_date' => 0, 'publishedon' => PS_NOW - 100, 'publishedby' => 7]);
+});
+
+test('editing without publish_document keeps the stored state and dates', function () {
+    $existing = ['published' => 1, 'pub_date' => 11, 'unpub_date' => 22, 'publishedon' => 33, 'publishedby' => 4];
+
+    // the legacy processor wrote the literal strings 'pub_date' / 'unpub_date' here
+    expect(PublishState::forEdit(0, 0, 0, PS_NOW, 7, false, $existing))
+        ->toBe(['published' => 1, 'pub_date' => 11, 'unpub_date' => 22, 'publishedon' => 33, 'publishedby' => 4]);
+});
+
+test('editing tracks the publish transition', function () {
+    $unpublished = ['published' => 0, 'pub_date' => 0, 'unpub_date' => 0, 'publishedon' => 0, 'publishedby' => 0];
+    $published = ['published' => 1, 'pub_date' => 0, 'unpub_date' => 0, 'publishedon' => 500, 'publishedby' => 4];
+
+    expect(PublishState::forEdit(1, 0, 0, PS_NOW, 7, true, $unpublished)['publishedon'])->toBe(PS_NOW)
+        ->and(PublishState::forEdit(1, 0, 0, PS_NOW, 7, true, $unpublished)['publishedby'])->toBe(7)
+        ->and(PublishState::forEdit(0, 0, 0, PS_NOW, 7, true, $published))->toMatchArray(['publishedon' => 0, 'publishedby' => 0])
+        ->and(PublishState::forEdit(1, 0, 0, PS_NOW, 7, true, $published))->toMatchArray(['publishedon' => 500, 'publishedby' => 4])
+        ->and(PublishState::forEdit(1, PS_NOW - 50, 0, PS_NOW, 7, true, $published))->toMatchArray(['publishedon' => PS_NOW - 50, 'publishedby' => 7]);
+});
diff --git a/core/tests/Unit/Support/DocumentSave/SaveResponseTest.php b/core/tests/Unit/Support/DocumentSave/SaveResponseTest.php
new file mode 100644
index 0000000000..eb74395869
--- /dev/null
+++ b/core/tests/Unit/Support/DocumentSave/SaveResponseTest.php
@@ -0,0 +1,67 @@
+<?php
+
+use EvolutionCMS\Services\DocumentSave\DocumentSaveResult;
+use EvolutionCMS\Support\DocumentSave\SaveResponse;
+
+$edited = new DocumentSaveResult(12, 'edit', 'document', 3, 'Page', 'page', 1_700_000_000);
+$created = new DocumentSaveResult(40, 'new', 'reference', 3, 'Link', 'link');
+
+test('after an edit the listing sort survives the redirect, after a create it does not', function () use ($edited, $created) {
+    expect(SaveResponse::redirectUrl($edited, '2', false, '&dir=ASC&sort=pagetitle&page=2', 'http://s/'))
+        ->toBe('index.php?a=27&id=12&r=1&stay=2&dir=ASC&sort=pagetitle&page=2')
+        ->and(SaveResponse::redirectUrl($created, '2', false, '&dir=ASC', 'http://s/'))
+        ->toBe('index.php?a=27&id=40&r=1&stay=2');
+});
+
+test('close goes to the resource overview and "add another" to the editor of the same type', function () use ($edited, $created) {
+    expect(SaveResponse::redirectUrl($edited, '', false, '', 'http://s/'))->toBe('index.php?a=3&id=12&r=1')
+        ->and(SaveResponse::redirectUrl($edited, '1', false, '', 'http://s/'))->toBe('index.php?a=4&pid=3&r=1&stay=1')
+        // a weblink opens the weblink form, whatever the original mode was
+        ->and(SaveResponse::redirectUrl($created, '1', false, '', 'http://s/'))->toBe('index.php?a=72&pid=3&r=1&stay=1');
+});
+
+test('the preview flow only exists for an existing resource', function () use ($edited, $created) {
+    expect(SaveResponse::redirectUrl($edited, '2', true, '&dir=ASC', 'http://s/'))->toBe('http://s/index.php?id=12&z=manprev')
+        ->and(SaveResponse::redirectUrl($created, '2', true, '', 'http://s/'))->toBe('index.php?a=27&id=40&r=1&stay=2');
+});
+
+test('the JSON answer carries what the editor writes back plus where the form flow would go', function () use ($edited) {
+    expect(SaveResponse::payload($edited, 'index.php?a=27&id=12', 'tok'))->toBe([
+        'success' => true,
+        'id' => 12,
+        'mode' => 'edit',
+        'type' => 'document',
+        'parent' => 3,
+        'pagetitle' => 'Page',
+        'alias' => 'page',
+        'editedon' => 1_700_000_000,
+        'redirect' => 'index.php?a=27&id=12',
+        'token' => 'tok',
+    ]);
+});
+
+test('the save processor answers JSON to the in-place save and redirects everyone else', function () {
+    $root = dirname(__DIR__, 5);
+    $processor = file_get_contents($root . '/manager/processors/save_content.processor.php');
+    $editor = file_get_contents($root . '/manager/actions/mutate_content.dynamic.php');
+
+    expect($processor)->toContain('$ajax = is_ajax();')
+        ->and($processor)->toContain("\$respondJson(200, \\EvolutionCMS\\Support\\DocumentSave\\SaveResponse::payload(\$saved, \$redirectUrl, csrf_token()));")
+        // plugin output during the save is buffered away from the JSON
+        ->and(substr_count($processor, 'ob_end_clean();'))->toBe(2)
+        ->and($processor)->toContain("if (\$ajax) {\n    ob_start();\n}")
+        ->and($processor)->toContain("\$respondJson(422, ['success' => false, 'message' => \$denied->getMessage()]);")
+        ->and($processor)->toContain("\$respondJson(403, ['success' => false, 'message' => __(\"global.error_no_privileges\")]);")
+        ->and($processor)->toContain('SaveResponse::redirectUrl($saved, $stay, $refreshPreview, $add_path, EVO_SITE_URL)')
+        // the in-place save posts to index.php?a=5 with the XHR marker; the form post stays the fallback
+        ->and($editor)->toContain("revision(MGR_DIR . '/media/script/document-save-helper.js')")
+        ->and($editor)->toContain('ajaxSaveHelper.usesAjax(document.mutate)')
+        ->and($editor)->toContain("xhr.open('POST', ajaxSaveHelper.requestUrl(form.a.value), true);")
+        ->and($editor)->toContain("xhr.setRequestHeader('X-REQUESTED-WITH', 'XMLHttpRequest');")
+        ->and($editor)->toContain('xhr.send(ajaxSaveHelper.requestBody(new FormData(form), tokenMeta));')
+        // a save that cannot be confirmed is never replayed
+        ->and($editor)->not->toContain('classicSave')
+        ->and($editor)->toContain("js_json(\$_lang['resource_save_unconfirmed'])")
+        ->and($editor)->toContain("button.classList.add('saved');")
+        ->and($editor)->toContain('parent.evo.tree.restoreTree()');
+});
diff --git a/core/tests/Unit/Support/DocumentSave/TemplateVariableInputTest.php b/core/tests/Unit/Support/DocumentSave/TemplateVariableInputTest.php
new file mode 100644
index 0000000000..29e467d223
--- /dev/null
+++ b/core/tests/Unit/Support/DocumentSave/TemplateVariableInputTest.php
@@ -0,0 +1,42 @@
+<?php
+
+use EvolutionCMS\Support\DocumentSave\TemplateVariableInput;
+
+$text = ['id' => 3, 'type' => 'text', 'default_text' => 'dflt'];
+
+test('a plain value is stored as posted', function () use ($text) {
+    expect(TemplateVariableInput::value($text, ['tv3' => 'hello']))->toBe('hello');
+});
+
+test('empty values, "0" and the default text mean "remove the row"', function () use ($text) {
+    expect(TemplateVariableInput::value($text, []))->toBeNull()
+        ->and(TemplateVariableInput::value($text, ['tv3' => '']))->toBeNull()
+        // the legacy processor treated "0" as empty; the row is dropped and the default shows
+        ->and(TemplateVariableInput::value($text, ['tv3' => '0']))->toBeNull()
+        ->and(TemplateVariableInput::value($text, ['tv3' => 'dflt']))->toBeNull();
+});
+
+test('checkboxes and multiple selects are joined with the || delimiter', function () use ($text) {
+    expect(TemplateVariableInput::value($text, ['tv3' => ['a' => 'one', 'b' => 'two']]))->toBe('one||two');
+});
+
+test('url fields get the chosen prefix after stripping any scheme the user typed', function () {
+    $url = ['id' => 5, 'type' => 'url', 'default_text' => ''];
+
+    expect(TemplateVariableInput::value($url, ['tv5' => 'http://example.org', 'tv5_prefix' => 'https://']))->toBe('https://example.org')
+        ->and(TemplateVariableInput::value($url, ['tv5' => 'mailto:me@example.org', 'tv5_prefix' => '--']))->toBe('mailto:me@example.org')
+        ->and(TemplateVariableInput::value($url, ['tv5' => 'example.org']))->toBe('example.org');
+});
+
+test('file fields ignore array input', function () {
+    $file = ['id' => 6, 'type' => 'file', 'default_text' => ''];
+
+    expect(TemplateVariableInput::value($file, ['tv6' => 'assets/a.pdf']))->toBe('assets/a.pdf')
+        ->and(TemplateVariableInput::value($file, ['tv6' => ['x']]))->toBeNull();
+});
+
+test('values() keys the desired value by tv id for every tv of the template', function () use ($text) {
+    $tvs = [$text, ['id' => 4, 'type' => 'text', 'default_text' => '']];
+
+    expect(TemplateVariableInput::values($tvs, ['tv3' => 'x']))->toBe([3 => 'x', 4 => null]);
+});
diff --git a/core/tests/Unit/Support/DocumentSave/TemplateVariableValuesTest.php b/core/tests/Unit/Support/DocumentSave/TemplateVariableValuesTest.php
new file mode 100644
index 0000000000..36f3bc4808
--- /dev/null
+++ b/core/tests/Unit/Support/DocumentSave/TemplateVariableValuesTest.php
@@ -0,0 +1,85 @@
+<?php
+
+use EvolutionCMS\Support\DocumentSave\TemplateVariableValues;
+use Illuminate\Database\Capsule\Manager as Capsule;
+use Illuminate\Support\Facades\Facade;
+use Tests\Support\DocumentSaveDatabase;
+
+afterEach(fn () => Facade::clearResolvedInstances());
+
+/**
+ * Template 1 has TVs 1..3; TV 3 is restricted to document group 9. Document 100 stores TVs 1 and 2.
+ */
+function bootTvFixture(): Capsule
+{
+    $capsule = DocumentSaveDatabase::boot();
+    Capsule::table('site_tmplvars')->insert([
+        ['id' => 1, 'name' => 'one', 'type' => 'text', 'default_text' => '', 'rank' => 2],
+        ['id' => 2, 'name' => 'two', 'type' => 'text', 'default_text' => 'd2', 'rank' => 1],
+        ['id' => 3, 'name' => 'three', 'type' => 'text', 'default_text' => '', 'rank' => 3],
+        ['id' => 4, 'name' => 'other-template', 'type' => 'text', 'default_text' => '', 'rank' => 0],
+    ]);
+    Capsule::table('site_tmplvar_templates')->insert([
+        ['tmplvarid' => 1, 'templateid' => 1], ['tmplvarid' => 2, 'templateid' => 1],
+        ['tmplvarid' => 3, 'templateid' => 1], ['tmplvarid' => 4, 'templateid' => 2],
+    ]);
+    Capsule::table('site_tmplvar_access')->insert([['tmplvarid' => 3, 'documentgroup' => 9]]);
+    Capsule::table('site_tmplvar_contentvalues')->insert([
+        ['id' => 10, 'tmplvarid' => 1, 'contentid' => 100, 'value' => 'v1'],
+        ['id' => 11, 'tmplvarid' => 2, 'contentid' => 100, 'value' => 'v2'],
+        ['id' => 12, 'tmplvarid' => 1, 'contentid' => 200, 'value' => 'other doc'],
+    ]);
+
+    return $capsule;
+}
+
+test('an administrator gets every tv of the template, ordered by rank, with the stored value', function () {
+    bootTvFixture();
+
+    $rows = TemplateVariableValues::forTemplate(1, 100, false, []);
+
+    expect(array_column($rows, 'id'))->toBe([2, 1, 3])
+        ->and($rows[0])->toMatchArray(['value_id' => 11, 'value' => 'v2', 'default_text' => 'd2'])
+        ->and($rows[2])->toMatchArray(['value_id' => null, 'value' => null]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a restricted tv is hidden from a user whose document is not in its group', function () {
+    bootTvFixture();
+
+    expect(array_column(TemplateVariableValues::forTemplate(1, 100, true, [5]), 'id'))->toBe([2, 1]);
+
+    Capsule::table('document_groups')->insert(['document_group' => 5, 'document' => 100]);
+    Capsule::table('site_tmplvar_contentvalues')->insert(['tmplvarid' => 3, 'contentid' => 100, 'value' => 'v3']);
+
+    expect(array_column(TemplateVariableValues::forTemplate(1, 100, true, [5]), 'id'))->toBe([2, 1, 3]);
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('sync writes only the differences and leaves other documents alone', function () {
+    $capsule = bootTvFixture();
+    $tvs = TemplateVariableValues::forTemplate(1, 100, false, []);
+
+    $capsule->getConnection()->enableQueryLog();
+    // TV 1 unchanged, TV 2 removed, TV 3 added
+    TemplateVariableValues::sync(100, $tvs, [1 => 'v1', 2 => null, 3 => 'new']);
+
+    $log = array_column($capsule->getConnection()->getQueryLog(), 'query');
+    expect($log)->toHaveCount(2)
+        ->and($log[0])->toStartWith('insert into')
+        ->and($log[1])->toStartWith('delete from')
+        ->and(Capsule::table('site_tmplvar_contentvalues')->where('contentid', 100)->orderBy('tmplvarid')->pluck('value', 'tmplvarid')->all())
+        ->toBe([1 => 'v1', 3 => 'new'])
+        ->and(Capsule::table('site_tmplvar_contentvalues')->where('id', 12)->value('value'))->toBe('other doc');
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
+
+test('a changed value is updated in place and an unchanged form costs no query', function () {
+    $capsule = bootTvFixture();
+    $tvs = TemplateVariableValues::forTemplate(1, 100, false, []);
+
+    $capsule->getConnection()->enableQueryLog();
+    TemplateVariableValues::sync(100, $tvs, [1 => 'v1', 2 => 'v2', 3 => null]);
+    expect($capsule->getConnection()->getQueryLog())->toBe([]);
+
+    TemplateVariableValues::sync(100, $tvs, [1 => 'changed', 2 => 'v2', 3 => null]);
+    expect($capsule->getConnection()->getQueryLog())->toHaveCount(1)
+        ->and(Capsule::table('site_tmplvar_contentvalues')->where('id', 10)->value('value'))->toBe('changed');
+})->skip(!extension_loaded('pdo_sqlite'), 'pdo_sqlite is required');
diff --git a/core/vendor/composer/autoload_classmap.php b/core/vendor/composer/autoload_classmap.php
index cf73027e97..da4da0b094 100644
--- a/core/vendor/composer/autoload_classmap.php
+++ b/core/vendor/composer/autoload_classmap.php
@@ -1369,6 +1369,11 @@
     'EvolutionCMS\\Services\\ComposerVersionSynchronizer' => $baseDir . '/src/Services/ComposerVersionSynchronizer.php',
     'EvolutionCMS\\Services\\ConfigService' => $baseDir . '/src/Services/ConfigService.php',
     'EvolutionCMS\\Services\\DatabaseBackupService' => $baseDir . '/src/Services/DatabaseBackupService.php',
+    'EvolutionCMS\\Services\\DocumentSaveService' => $baseDir . '/src/Services/DocumentSaveService.php',
+    'EvolutionCMS\\Services\\DocumentSave\\DocumentSaveContext' => $baseDir . '/src/Services/DocumentSave/DocumentSaveContext.php',
+    'EvolutionCMS\\Services\\DocumentSave\\DocumentSaveDenied' => $baseDir . '/src/Services/DocumentSave/DocumentSaveDenied.php',
+    'EvolutionCMS\\Services\\DocumentSave\\DocumentSaveResult' => $baseDir . '/src/Services/DocumentSave/DocumentSaveResult.php',
+    'EvolutionCMS\\Services\\ManagerActivity' => $baseDir . '/src/Services/ManagerActivity.php',
     'EvolutionCMS\\Services\\PasswordRecoveryService' => $baseDir . '/src/Services/PasswordRecoveryService.php',
     'EvolutionCMS\\Services\\Store\\CatalogService' => $baseDir . '/src/Services/Store/CatalogService.php',
     'EvolutionCMS\\Services\\Store\\InstalledStateService' => $baseDir . '/src/Services/Store/InstalledStateService.php',
@@ -1401,6 +1406,12 @@
     'EvolutionCMS\\Support\\DataGrid' => $baseDir . '/src/Support/DataGrid.php',
     'EvolutionCMS\\Support\\DataSetPager' => $baseDir . '/src/Support/DataSetPager.php',
     'EvolutionCMS\\Support\\DocBlock' => $baseDir . '/src/Support/DocBlock.php',
+    'EvolutionCMS\\Support\\DocumentPrivacy' => $baseDir . '/src/Support/DocumentPrivacy.php',
+    'EvolutionCMS\\Support\\DocumentSave\\DocumentGroupSync' => $baseDir . '/src/Support/DocumentSave/DocumentGroupSync.php',
+    'EvolutionCMS\\Support\\DocumentSave\\PublishState' => $baseDir . '/src/Support/DocumentSave/PublishState.php',
+    'EvolutionCMS\\Support\\DocumentSave\\SaveResponse' => $baseDir . '/src/Support/DocumentSave/SaveResponse.php',
+    'EvolutionCMS\\Support\\DocumentSave\\TemplateVariableInput' => $baseDir . '/src/Support/DocumentSave/TemplateVariableInput.php',
+    'EvolutionCMS\\Support\\DocumentSave\\TemplateVariableValues' => $baseDir . '/src/Support/DocumentSave/TemplateVariableValues.php',
     'EvolutionCMS\\Support\\FileManagerAccess' => $baseDir . '/src/Support/FileManagerAccess.php',
     'EvolutionCMS\\Support\\Formatter\\CSSMinify' => $baseDir . '/src/Support/Formatter/CSSMinify.php',
     'EvolutionCMS\\Support\\Formatter\\HtmlFormatter' => $baseDir . '/src/Support/Formatter/HtmlFormatter.php',
diff --git a/core/vendor/composer/autoload_static.php b/core/vendor/composer/autoload_static.php
index e21a21ce48..9add00eab6 100644
--- a/core/vendor/composer/autoload_static.php
+++ b/core/vendor/composer/autoload_static.php
@@ -2046,6 +2046,11 @@ class ComposerStaticInit925fea465a58fa69f06ccf2629003e87
         'EvolutionCMS\\Services\\ComposerVersionSynchronizer' => __DIR__ . '/../..' . '/src/Services/ComposerVersionSynchronizer.php',
         'EvolutionCMS\\Services\\ConfigService' => __DIR__ . '/../..' . '/src/Services/ConfigService.php',
         'EvolutionCMS\\Services\\DatabaseBackupService' => __DIR__ . '/../..' . '/src/Services/DatabaseBackupService.php',
+        'EvolutionCMS\\Services\\DocumentSaveService' => __DIR__ . '/../..' . '/src/Services/DocumentSaveService.php',
+        'EvolutionCMS\\Services\\DocumentSave\\DocumentSaveContext' => __DIR__ . '/../..' . '/src/Services/DocumentSave/DocumentSaveContext.php',
+        'EvolutionCMS\\Services\\DocumentSave\\DocumentSaveDenied' => __DIR__ . '/../..' . '/src/Services/DocumentSave/DocumentSaveDenied.php',
+        'EvolutionCMS\\Services\\DocumentSave\\DocumentSaveResult' => __DIR__ . '/../..' . '/src/Services/DocumentSave/DocumentSaveResult.php',
+        'EvolutionCMS\\Services\\ManagerActivity' => __DIR__ . '/../..' . '/src/Services/ManagerActivity.php',
         'EvolutionCMS\\Services\\PasswordRecoveryService' => __DIR__ . '/../..' . '/src/Services/PasswordRecoveryService.php',
         'EvolutionCMS\\Services\\Store\\CatalogService' => __DIR__ . '/../..' . '/src/Services/Store/CatalogService.php',
         'EvolutionCMS\\Services\\Store\\InstalledStateService' => __DIR__ . '/../..' . '/src/Services/Store/InstalledStateService.php',
@@ -2078,6 +2083,12 @@ class ComposerStaticInit925fea465a58fa69f06ccf2629003e87
         'EvolutionCMS\\Support\\DataGrid' => __DIR__ . '/../..' . '/src/Support/DataGrid.php',
         'EvolutionCMS\\Support\\DataSetPager' => __DIR__ . '/../..' . '/src/Support/DataSetPager.php',
         'EvolutionCMS\\Support\\DocBlock' => __DIR__ . '/../..' . '/src/Support/DocBlock.php',
+        'EvolutionCMS\\Support\\DocumentPrivacy' => __DIR__ . '/../..' . '/src/Support/DocumentPrivacy.php',
+        'EvolutionCMS\\Support\\DocumentSave\\DocumentGroupSync' => __DIR__ . '/../..' . '/src/Support/DocumentSave/DocumentGroupSync.php',
+        'EvolutionCMS\\Support\\DocumentSave\\PublishState' => __DIR__ . '/../..' . '/src/Support/DocumentSave/PublishState.php',
+        'EvolutionCMS\\Support\\DocumentSave\\SaveResponse' => __DIR__ . '/../..' . '/src/Support/DocumentSave/SaveResponse.php',
+        'EvolutionCMS\\Support\\DocumentSave\\TemplateVariableInput' => __DIR__ . '/../..' . '/src/Support/DocumentSave/TemplateVariableInput.php',
+        'EvolutionCMS\\Support\\DocumentSave\\TemplateVariableValues' => __DIR__ . '/../..' . '/src/Support/DocumentSave/TemplateVariableValues.php',
         'EvolutionCMS\\Support\\FileManagerAccess' => __DIR__ . '/../..' . '/src/Support/FileManagerAccess.php',
         'EvolutionCMS\\Support\\Formatter\\CSSMinify' => __DIR__ . '/../..' . '/src/Support/Formatter/CSSMinify.php',
         'EvolutionCMS\\Support\\Formatter\\HtmlFormatter' => __DIR__ . '/../..' . '/src/Support/Formatter/HtmlFormatter.php',
diff --git a/core/vendor/evolutioncms-services/user-manager/src/Services/Users/UserLogin.php b/core/vendor/evolutioncms-services/user-manager/src/Services/Users/UserLogin.php
index e0838d4ec7..1223844ff5 100644
--- a/core/vendor/evolutioncms-services/user-manager/src/Services/Users/UserLogin.php
+++ b/core/vendor/evolutioncms-services/user-manager/src/Services/Users/UserLogin.php
@@ -284,7 +284,7 @@ public function authProcess()
 
         EvolutionCMS()->cleanupExpiredLocks();
         EvolutionCMS()->cleanupMultipleActiveUsers();
-        if(!defined('NO_SESSION')) {
+        if (!(class_exists('EvoSessionProxy', false) && \EvoSessionProxy::disabled())) {
             $this->writeSession();
         }
         // successful login so reset fail count and update key values
diff --git a/manager/actions/mutate_content.dynamic.php b/manager/actions/mutate_content.dynamic.php
index 289f6dd01a..c4c3fe75d8 100644
--- a/manager/actions/mutate_content.dynamic.php
+++ b/manager/actions/mutate_content.dynamic.php
@@ -163,12 +163,66 @@
         .image_for_field[data-image=""] { display: none }
 
     </style>
+    <script src="<?= revision(MGR_DIR . '/media/script/document-save-helper.js') ?>"></script>
     <script type="text/javascript">
       /* <![CDATA[ */
 
       // save tree folder state
       if(parent.tree) parent.tree.saveFolderState();
 
+      // Save and keep editing: post the form over XHR and stay on the page instead of
+      // reloading the editor. Anything unexpected hands over to the classic form post.
+      var ajaxSaveHelper = window.modxDocumentSaveHelper;
+      var ajaxSaving = false;
+      function ajaxSave() {
+        if (ajaxSaving) return;
+        var form = document.mutate;
+        var button = document.getElementById('Button1');
+        var done = function () {
+          ajaxSaving = false;
+          if (button) { button.classList.remove('saving'); button.blur(); }
+        };
+        // let every editor that syncs its textarea on submit do so; a synthetic event does not navigate
+        if (window.tinymce && tinymce.triggerSave) tinymce.triggerSave();
+        if (window.CKEDITOR && CKEDITOR.instances) {
+          for (var name in CKEDITOR.instances) CKEDITOR.instances[name].updateElement();
+        }
+        form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
+        var tokenMeta = document.querySelector('meta[name="csrf-token"]');
+        var unconfirmed = function (reload) {
+          documentDirty = !reload;
+          alert(<?= js_json($_lang['resource_save_unconfirmed']) ?>);
+          if (reload) window.location.reload();
+        };
+        var xhr = new XMLHttpRequest();
+        xhr.open('POST', ajaxSaveHelper.requestUrl(form.a.value), true);
+        xhr.setRequestHeader('X-REQUESTED-WITH', 'XMLHttpRequest');
+        xhr.setRequestHeader('Accept', 'application/json');
+        xhr.onload = function () {
+          done();
+          var answer = ajaxSaveHelper.parseResponse(xhr.status, xhr.responseText);
+          if (!answer.ok) {
+            if (answer.unconfirmed) { unconfirmed(true); return; }
+            documentDirty = true;
+            alert(answer.message || (xhr.status + ' ' + xhr.statusText));
+            return;
+          }
+          ajaxSaveHelper.applyResult(form, answer.result, document.querySelector('#create_edit > h1'), tokenMeta);
+          if (button) {
+            button.classList.add('saved');
+            setTimeout(function () { button.classList.remove('saved'); }, 1500);
+          }
+          if (parent.evo && parent.evo.tree && parent.evo.tree.restoreTree) parent.evo.tree.restoreTree();
+        };
+        xhr.onerror = function () {
+          done();
+          unconfirmed(false); // no answer at all: the user decides whether to save again
+        };
+        ajaxSaving = true;
+        if (button) button.classList.add('saving');
+        xhr.send(ajaxSaveHelper.requestBody(new FormData(form), tokenMeta));
+      }
+
       function changestate(el) {
         if(parseInt(el.value) === 1) {
           el.value = 0;
@@ -189,6 +243,10 @@ function changestate(el) {
           syncReferenceContent();
           documentDirty = false;
           form_save = true;
+          if (ajaxSaveHelper && window.FormData && ajaxSaveHelper.usesAjax(document.mutate)) {
+            ajaxSave();
+            return;
+          }
           document.mutate.save.click();
         },
         delete: function() {
diff --git a/manager/includes/secure_web_documents.inc.php b/manager/includes/secure_web_documents.inc.php
index 125859cc44..c5f951f1e4 100755
--- a/manager/includes/secure_web_documents.inc.php
+++ b/manager/includes/secure_web_documents.inc.php
@@ -3,6 +3,8 @@
     die("<b>INCLUDE_ORDERING_ERROR</b><br /><br />Please use the EVO Content Manager instead of accessing this file directly.");
 }
 
+use EvolutionCMS\Support\DocumentPrivacy;
+
 /**
  *    Secure Web Documents
  *    This script will mark web documents as private
@@ -11,34 +13,23 @@
  *    is assigned to the document group that the document belongs to.
  *
  * @param string $docid
+ * @deprecated since 3.5.9 use EvolutionCMS\Support\DocumentPrivacy
+ * @todo [remove@3.7] Remove in Evolution CMS 3.7
  */
 function secureWebDocument($docid = '', $context = 1)
 {
-    $context = $context == 0 ? 0 : 1;
-    $privateField = $context ? 'privateweb' : 'privatemgr';
+    $context = $context == 0 ? DocumentPrivacy::MANAGER : DocumentPrivacy::WEB;
     if (is_numeric($docid) && $docid > 0) {
-        \EvolutionCMS\Models\SiteContent::withTrashed()->find($docid)->update([$privateField => 0]);
+        DocumentPrivacy::refresh((int) $docid, $context);
     } else {
-        \EvolutionCMS\Models\SiteContent::withTrashed()->where($privateField, 1)->update([$privateField => 0]);
-    }
-
-    $documentIds = \EvolutionCMS\Models\SiteContent::withTrashed()->select('site_content.id')->distinct()
-        ->leftJoin('document_groups', 'site_content.id', '=', 'document_groups.document')
-        ->leftJoin('membergroup_access', function(Illuminate\Database\Query\JoinClause $join) use ($context) {
-            $join->on('document_groups.document_group', '=', 'membergroup_access.documentgroup')
-                ->where('membergroup_access.context', '=', $context);
-        })->where('membergroup_access.id', '>', 0);
-    if (is_numeric($docid) && $docid > 0) {
-        $documentIds = $documentIds->where('site_content.id', $docid);
-    }
-
-    $ids = $documentIds->get()->pluck('id');
-
-    if (count($ids) > 0) {
-        \EvolutionCMS\Models\SiteContent::withTrashed()->whereIn('id', $ids)->update([$privateField => 1]);
+        DocumentPrivacy::refreshAll($context);
     }
 }
 
+/**
+ * @deprecated since 3.5.9 use EvolutionCMS\Support\DocumentPrivacy
+ * @todo [remove@3.7] Remove in Evolution CMS 3.7
+ */
 function secureMgrDocument($docid = '', $context = 0)
 {
     secureWebDocument($docid, $context);
diff --git a/manager/media/script/document-save-helper.js b/manager/media/script/document-save-helper.js
new file mode 100644
index 0000000000..5e4ea1ae7f
--- /dev/null
+++ b/manager/media/script/document-save-helper.js
@@ -0,0 +1,125 @@
+(function (root, factory) {
+    var exported = factory();
+
+    if (typeof module === 'object' && module.exports) {
+        module.exports = exported;
+    }
+
+    root.modxDocumentSaveHelper = exported;
+}(typeof globalThis !== 'undefined' ? globalThis : this, function () {
+    'use strict';
+
+    var TITLE_LENGTH = 50;
+
+    function fieldValue(form, name) {
+        var field = form && form.elements ? form.elements[name] : null;
+        return field && typeof field.value === 'string' ? field.value : '';
+    }
+
+    // The in-place save covers "save and keep editing" of an existing resource; a new
+    // resource still needs one navigation to its own editor, and "close" / "add another"
+    // navigate away anyway, so those keep the form post.
+    function usesAjax(form, capabilities) {
+        capabilities = capabilities || {};
+        if (capabilities.formData === false || capabilities.xhr === false) {
+            return false;
+        }
+        if (fieldValue(form, 'stay') !== '2') {
+            return false;
+        }
+        if (fieldValue(form, 'refresh_preview') === '1') {
+            return false;
+        }
+
+        return parseInt(fieldValue(form, 'id'), 10) > 0;
+    }
+
+    // The action goes into the query string so the request reads as the manager action it is.
+    function requestUrl(action, base) {
+        return (base || 'index.php') + '?a=' + encodeURIComponent(String(action || '5'));
+    }
+
+    // The form body of the XHR: the action is in the URL (the manager refuses it in both
+    // places) and the CSRF token is the page's current one.
+    function requestBody(body, tokenMeta) {
+        body.delete('a');
+        var token = tokenMeta && tokenMeta.getAttribute ? tokenMeta.getAttribute('content') : '';
+        if (token) {
+            body.set('_token', token);
+        }
+        return body;
+    }
+
+    function parseResponse(status, text) {
+        var body = null;
+        try {
+            body = JSON.parse(text);
+        } catch (e) {
+            body = null;
+        }
+        if (!body || typeof body !== 'object') {
+            // not our JSON: an expired session, a plugin that exited, a fatal error. The
+            // save may or may not have run, so it is never replayed; the editor reloads.
+            return { ok: false, message: '', unconfirmed: true };
+        }
+        if (status === 200 && body.success === true) {
+            return { ok: true, result: body };
+        }
+
+        return { ok: false, message: typeof body.message === 'string' ? body.message : '', unconfirmed: false };
+    }
+
+    function shortTitle(title) {
+        title = String(title || '');
+        return title.length > TITLE_LENGTH ? title.substr(0, TITLE_LENGTH) + '...' : title;
+    }
+
+    // Writes back what the server may have changed: the alias it generated or cleaned,
+    // the title it substituted for an empty one, the heading that shows it, and the
+    // CSRF token in case the session rotated it.
+    function applyResult(form, result, heading, tokenMeta) {
+        var changed = [];
+        var fields = { alias: result.alias, pagetitle: result.pagetitle };
+        if (typeof result.token === 'string' && result.token !== '') {
+            fields._token = result.token;
+            if (tokenMeta && tokenMeta.getAttribute('content') !== result.token) {
+                tokenMeta.setAttribute('content', result.token);
+                changed.push('meta');
+            }
+        }
+
+        Object.keys(fields).forEach(function (name) {
+            var field = form && form.elements ? form.elements[name] : null;
+            if (!field || typeof fields[name] !== 'string' || field.value === fields[name]) {
+                return;
+            }
+            field.value = fields[name];
+            changed.push(name);
+        });
+
+        if (heading && heading.childNodes) {
+            for (var i = 0; i < heading.childNodes.length; i++) {
+                var node = heading.childNodes[i];
+                if (node.nodeType === 3 && node.nodeValue.replace(/\s/g, '') !== '') {
+                    var text = shortTitle(result.pagetitle);
+                    if (node.nodeValue !== text) {
+                        node.nodeValue = text;
+                        changed.push('heading');
+                    }
+                    break;
+                }
+            }
+        }
+
+        return changed;
+    }
+
+    return {
+        usesAjax: usesAjax,
+        requestUrl: requestUrl,
+        requestBody: requestBody,
+        parseResponse: parseResponse,
+        applyResult: applyResult,
+        shortTitle: shortTitle
+    };
+}));
diff --git a/manager/media/script/main.js b/manager/media/script/main.js
index 68cff85d7b..fc2c42e45f 100644
--- a/manager/media/script/main.js
+++ b/manager/media/script/main.js
@@ -329,7 +329,7 @@ function document_onload() {
         actionStay['stay2'] = '<i class="' + evo.style.icon_pencil + '"></i>';
         actionStay['stay3'] = '<i class="' + evo.style.icon_reply + '"></i>';
         if (actionSelect.value) {
-            actionSaveButton.innerHTML += '<i class="' + evo.style.icon_plus + '"></i><span> + </span>' + actionStay['stay' + actionSelect.value] + '<span>' + actionSelect.children['stay' + actionSelect.value].innerHTML + '</span>';
+            actionSaveButton.innerHTML = actionSaveButton.innerHTML.trim() + '<i class="' + evo.style.icon_plus + '"></i><span class="save-join">+</span>' + actionStay['stay' + actionSelect.value] + '<span>' + actionSelect.children['stay' + actionSelect.value].innerHTML + '</span>';
         }
         var actionSelectNewOption = null, actionSelectOptions = actionSelect.children, div = document.createElement('div');
         div.className = 'dropdown-menu';
diff --git a/manager/media/script/tests/document-save-helper.test.js b/manager/media/script/tests/document-save-helper.test.js
new file mode 100644
index 0000000000..d36626c31b
--- /dev/null
+++ b/manager/media/script/tests/document-save-helper.test.js
@@ -0,0 +1,100 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const helper = require('../document-save-helper');
+
+function form(values) {
+    const elements = {};
+    Object.keys(values).forEach((name) => { elements[name] = { value: values[name] }; });
+    return { elements };
+}
+
+test('usesAjax only for "save and keep editing" of an existing resource', () => {
+    assert.equal(helper.usesAjax(form({ id: '12', stay: '2', refresh_preview: '0' })), true);
+    // a new resource needs the navigation to its own editor
+    assert.equal(helper.usesAjax(form({ id: '0', stay: '2', refresh_preview: '0' })), false);
+    assert.equal(helper.usesAjax(form({ id: '', stay: '2' })), false);
+    // close and "add another" navigate away
+    assert.equal(helper.usesAjax(form({ id: '12', stay: '', refresh_preview: '0' })), false);
+    assert.equal(helper.usesAjax(form({ id: '12', stay: '1', refresh_preview: '0' })), false);
+    // the preview flow redirects to the site
+    assert.equal(helper.usesAjax(form({ id: '12', stay: '2', refresh_preview: '1' })), false);
+    assert.equal(helper.usesAjax(form({ id: '12', stay: '2' }), { formData: false }), false);
+    assert.equal(helper.usesAjax(null), false);
+});
+
+test('requestUrl puts the action into the query string', () => {
+    assert.equal(helper.requestUrl('5'), 'index.php?a=5');
+    assert.equal(helper.requestUrl(5, 'index.php'), 'index.php?a=5');
+    assert.equal(helper.requestUrl(undefined), 'index.php?a=5');
+});
+
+test('requestBody drops the action and carries the token of the page', () => {
+    const entries = { a: '5', _token: 'stale', pagetitle: 'x' };
+    const body = {
+        delete: (name) => { delete entries[name]; },
+        set: (name, value) => { entries[name] = value; },
+    };
+    const meta = { getAttribute: () => 'fresh' };
+
+    assert.equal(helper.requestBody(body, meta), body);
+    assert.deepEqual(entries, { _token: 'fresh', pagetitle: 'x' });
+
+    // without a meta tag the hidden field of the form stays
+    helper.requestBody(body, null);
+    assert.equal(entries._token, 'fresh');
+});
+
+test('parseResponse tells a save apart from a refusal and from a non-JSON answer', () => {
+    const saved = helper.parseResponse(200, '{"success":true,"id":12,"alias":"a"}');
+    assert.equal(saved.ok, true);
+    assert.equal(saved.result.id, 12);
+
+    const denied = helper.parseResponse(422, '{"success":false,"message":"duplicate alias"}');
+    assert.deepEqual(denied, { ok: false, message: 'duplicate alias', unconfirmed: false });
+
+    const csrf = helper.parseResponse(403, '{"error":"CSRF token mismatch","code":"csrf_token_mismatch"}');
+    assert.deepEqual(csrf, { ok: false, message: '', unconfirmed: false });
+
+    // the login page, a plugin that exited, a fatal error: the save may have run and is never replayed
+    assert.deepEqual(helper.parseResponse(200, '<html>login</html>'), { ok: false, message: '', unconfirmed: true });
+    assert.deepEqual(helper.parseResponse(500, '<html>error</html>'), { ok: false, message: '', unconfirmed: true });
+    assert.deepEqual(helper.parseResponse(200, ''), { ok: false, message: '', unconfirmed: true });
+});
+
+test('applyResult writes back the generated alias, the substituted title and the heading', () => {
+    const f = form({ alias: '', pagetitle: '', id: '12' });
+    const title = { nodeType: 3, nodeValue: 'old' };
+    const heading = { childNodes: [{ nodeType: 1 }, { nodeType: 3, nodeValue: '\n   ' }, title, { nodeType: 1 }] };
+
+    const changed = helper.applyResult(f, { alias: 'untitled-resource', pagetitle: 'Untitled Resource' }, heading);
+
+    assert.deepEqual(changed, ['alias', 'pagetitle', 'heading']);
+    assert.equal(f.elements.alias.value, 'untitled-resource');
+    assert.equal(f.elements.pagetitle.value, 'Untitled Resource');
+    assert.equal(title.nodeValue, 'Untitled Resource');
+});
+
+test('applyResult rotates the CSRF token in the form and the meta tag', () => {
+    const f = form({ alias: 'a', pagetitle: 'A', _token: 'old' });
+    let content = 'old';
+    const meta = { getAttribute: () => content, setAttribute: (name, value) => { content = value; } };
+
+    assert.deepEqual(helper.applyResult(f, { alias: 'a', pagetitle: 'A', token: 'new' }, null, meta), ['meta', '_token']);
+    assert.equal(f.elements._token.value, 'new');
+    assert.equal(content, 'new');
+    // no token in the answer leaves both alone
+    assert.deepEqual(helper.applyResult(f, { alias: 'a', pagetitle: 'A' }, null, meta), []);
+});
+
+test('applyResult leaves unchanged fields alone and survives a missing heading', () => {
+    const f = form({ alias: 'same', pagetitle: 'Same' });
+
+    assert.deepEqual(helper.applyResult(f, { alias: 'same', pagetitle: 'Same' }, null), []);
+    assert.deepEqual(helper.applyResult(form({}), { alias: 'x', pagetitle: 'y' }), []);
+});
+
+test('shortTitle truncates like the editor heading does', () => {
+    assert.equal(helper.shortTitle('short'), 'short');
+    assert.equal(helper.shortTitle('x'.repeat(60)), 'x'.repeat(50) + '...');
+    assert.equal(helper.shortTitle(undefined), '');
+});
diff --git a/manager/media/style/default/css/custom.css b/manager/media/style/default/css/custom.css
index 70e2e82b8a..f88ccb102b 100644
--- a/manager/media/style/default/css/custom.css
+++ b/manager/media/style/default/css/custom.css
@@ -51,7 +51,14 @@ select[name=context] + input[type=submit] { float: none; margin: 0; }
 #actions .btn-group .btn-group #Button1 { min-width: 100%; text-align: left; float: right; }
 #actions .btn-group .btn-success { box-shadow: inset 0 -2px 0 rgba(0, 0, 0, .07); }
 #actions .btn-group .btn-success:hover { box-shadow: none }
-#actions .btn-group .plus { z-index: 2; float: right; margin: -2.4em 0 0 0; width: 2rem; padding-left: 0; padding-right: 0; text-align: center; cursor: default; }
+/* the in-place save: the join box between "Save" and the stay option shows +, a spinner, then a check mark, at one width */
+#actions .btn-group #Button1 .save-join { display: inline-block; position: relative; width: 1.4em; margin: 0 .25em; text-align: center }
+#actions .btn-group #Button1.saving { pointer-events: none; opacity: .75 }
+#actions .btn-group #Button1.saving .save-join, #actions .btn-group #Button1.saved .save-join { color: transparent }
+#actions .btn-group #Button1.saving .save-join::before { content: ''; position: absolute; left: 50%; top: 50%; width: .8em; height: .8em; margin: -.45em 0 0 -.45em; border: 2px solid rgba(255, 255, 255, .45); border-top-color: #fff; border-radius: 50%; animation: evo-save-spin .7s linear infinite }
+#actions .btn-group #Button1.saved .save-join::before { content: '\2713'; position: absolute; left: 0; right: 0; top: 0; color: #fff }
+@keyframes evo-save-spin { to { transform: rotate(360deg) } }
+#actions .btn-group .plus { z-index: 2; float: right; margin: -2.4em 0 0 0; width: 2rem; padding-left: 0; padding-right: 0; text-align: center; cursor: pointer; }
 #actions .btn-group .plus::before { content: "\f107"; font-weight: 900; font-family: 'Font Awesome 5 Free' }
 #actions .btn-group .show .plus::before { content: "\f106"; }
 #actions .btn-group select#stay { display: block; position: relative; z-index: -1; clear: both; width: auto; height: 0; margin: -100% 0 -2rem 0; font-size: 0.675rem; opacity: 0; visibility: hidden; }
@@ -70,6 +77,11 @@ select[name=context] + input[type=submit] { float: none; margin: 0; }
     #actions .btn-group .btn span, #actions .btn-group select#stay, #_actions .btn-group .btn span { display: none }
 
     #actions .btn-group .btn .fa, #_actions .btn-group .btn .fa { display: inline-block }
+    /* icons only: the plus icon takes the spinner and the check mark, the join box goes */
+    #actions .btn-group #Button1 .save-join { display: none }
+    #actions .btn-group #Button1 .fa-plus { position: relative; margin: 0 3px }
+    #actions .btn-group #Button1.saving .fa-plus::before { content: ''; position: absolute; left: 50%; top: 50%; width: .8em; height: .8em; margin: -.45em 0 0 -.45em; border: 2px solid rgba(255, 255, 255, .45); border-top-color: #fff; border-radius: 50%; animation: evo-save-spin .7s linear infinite }
+    #actions .btn-group #Button1.saved .fa-plus::before { content: '\2713'; font-family: inherit; font-weight: normal }
 
     #actions .btn-group .dropdown-menu { width: 2rem }
     #actions .btn-group .dropdown-menu span { padding-left: 0; padding-right: 0; text-align: center }
@@ -84,7 +96,7 @@ select[name=context] + input[type=submit] { float: none; margin: 0; }
 #actions .actionButtons li a, #actions .actionButtons .plus { float: left; padding: 0 10px !important; height: 32px; line-height: 30px; -webkit-user-select: none; user-select: none; }
 #actions .actionButtons li:last-child { margin: 0 }
 #actions .actionButtons #Button1 a { width: 100%; text-align: left; }
-#actions .actionButtons .plus { overflow: hidden; float: right; margin: -32px 0 0 0; width: 35px; border-radius: 0 3px 3px 0 !important; text-align: center; cursor: default; font: normal normal normal 0/30px 'Font Awesome 5 Free' }
+#actions .actionButtons .plus { overflow: hidden; float: right; margin: -32px 0 0 0; width: 35px; border-radius: 0 3px 3px 0 !important; text-align: center; cursor: pointer; font: normal normal normal 0/30px 'Font Awesome 5 Free' }
 #actions .actionButtons .plus::before { content: "\f107"; font-size: 14px }
 #actions .actionButtons .show .plus::before { content: "\f106"; }
 #actions .actionButtons .dropdown-menu { display: none; position: absolute; z-index: -1; left: auto; right: 0; top: 100%; width: 100%; min-width: 35px; margin: -2px 0 0; padding: 2px 0 0; text-align: left; font-size: 1em; background-color: #fff; border: 1px solid #32ab9a; border-top: none; border-radius: 0 0 3px 3px; overflow: hidden; }
diff --git a/manager/processors/save_content.processor.php b/manager/processors/save_content.processor.php
index 1bfbb3fc77..597b26a356 100755
--- a/manager/processors/save_content.processor.php
+++ b/manager/processors/save_content.processor.php
@@ -3,39 +3,27 @@
     die("<b>INCLUDE_ORDERING_ERROR</b><br /><br />Please use the EVO Content Manager instead of accessing this file directly.");
 }
 $modx = EvolutionCMS();
+
+// the editor saves in place over XHR and expects JSON instead of the redirect
+$ajax = is_ajax();
+$respondJson = static function (int $status, array $payload): void {
+    http_response_code($status);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+    exit;
+};
+
 if (!evo()->hasPermission('save_document')) {
+    if ($ajax) {
+        $respondJson(403, ['success' => false, 'message' => __("global.error_no_privileges")]);
+    }
     evo()->webAlertAndQuit(__("global.error_no_privileges"));
 }
 
-// preprocess POST values
-$id = is_numeric($_POST['id']) ? $_POST['id'] : '';
-
-$introtext = $_POST['introtext'] ?? '';
-$content = $_POST['ta'] ?? '';
-$pagetitle = $_POST['pagetitle'] ?? '';
-$description = $_POST['description'] ?? '';
-$alias = $_POST['alias'];
-$link_attributes = $_POST['link_attributes'];
-$isfolder = (int)$_POST['isfolder'];
-$richtext = (int)$_POST['richtext'];
-$published = (int)$_POST['published'];
-$parentId = $parent = (int)get_by_key($_POST, 'parent', 0, 'is_scalar');
-$template = (int)$_POST['template'];
-$menuindex = !empty($_POST['menuindex']) ? (int)$_POST['menuindex'] : 0;
-$searchable = (int)$_POST['searchable'];
-$cacheable = (int)$_POST['cacheable'];
-$syncsite = (int)$_POST['syncsite'];
-$pub_date = $_POST['pub_date'];
-$unpub_date = $_POST['unpub_date'];
-$document_groups = (isset($_POST['chkalldocs']) && $_POST['chkalldocs'] == 'on') ? [] : get_by_key($_POST, 'docgroups', [], 'is_array');
-$type = $_POST['type'];
-$contentType = $_POST['contentType'];
-$contentdispo = (int)$_POST['content_dispo'];
-$longtitle = $_POST['longtitle'];
-$hide_from_tree = (int)$_POST['hide_from_tree'];
-$menutitle = $_POST['menutitle'];
-$hidemenu = (int)$_POST['hidemenu'];
-$aliasvisible = (int)$_POST['alias_visible'];
+$id = is_numeric($_POST['id'] ?? null) ? (int)$_POST['id'] : 0;
+$type = $_POST['type'] ?? 'document';
+$syncsite = (int)($_POST['syncsite'] ?? 0);
+$stay = (string)($_POST['stay'] ?? '');
 
 /************* webber ********/
 $sd=isset($_POST['dir']) && strtolower($_POST['dir']) === 'asc' ? '&dir=ASC' : '&dir=DESC';
@@ -43,659 +31,53 @@
 $pg=isset($_POST['page'])?'&page='.(int)$_POST['page']:'';
 $add_path=$sd.$sb.$pg;
 
-
-
-$no_esc_pagetitle = $_POST['pagetitle'];
-if (trim($no_esc_pagetitle) == "") {
-    if ($type == "reference") {
-        $no_esc_pagetitle = $pagetitle = $_lang['untitled_weblink'];
-    } else {
-        $no_esc_pagetitle = $pagetitle = $_lang['untitled_resource'];
-    }
-}
-
-
-$actionToTake = ((int)$id > 0 || $_POST['mode'] == '73' || $_POST['mode'] == '27') ? "edit" : "new";
+$actionToTake = ($id > 0 || ($_POST['mode'] ?? '') == '73' || ($_POST['mode'] ?? '') == '27') ? "edit" : "new";
 $newResourceAction = ($type == "reference") ? "72" : "4";
 $editResourceAction = "27";
 $newResourceRedirect = "index.php?a={$newResourceAction}";
 $editResourceRedirect = "index.php?a={$editResourceAction}&id={$id}";
 
-// friendly url alias checks
-if ($modx->getConfig('friendly_urls')) {
-    // auto assign alias
-    if (!$alias && $modx->getConfig('automatic_alias')) {
-        $alias = strtolower($modx->stripAlias(trim($pagetitle)));
-        if(!$modx->getConfig('allow_duplicate_alias')) {
-
-            if (\EvolutionCMS\Models\SiteContent::withTrashed()
-                    ->where('id', '<>', $id)
-                    ->where('alias', $alias)->count() > 0) {
-                $cnt = 1;
-                $tempAlias = $alias;
-
-                while (\EvolutionCMS\Models\SiteContent::withTrashed()
-                        ->where('id', '<>', $id)
-                        ->where('alias', $tempAlias)->count() > 0) {
-                    $tempAlias = $alias;
-                    $tempAlias .= $cnt;
-                    $cnt++;
-                }
-                $alias = $tempAlias;
-            }
-        }else{
-            if (\EvolutionCMS\Models\SiteContent::withTrashed()
-                    ->where('id', '<>', $id)
-                    ->where('alias', $alias)
-                    ->where('parent', $parent)->count() > 0) {
-                $cnt = 1;
-                $tempAlias = $alias;
-                while (\EvolutionCMS\Models\SiteContent::withTrashed()
-                        ->where('id', '<>', $id)
-                        ->where('alias', $tempAlias)
-                        ->where('parent', $parent)->count() > 0) {
-                    $tempAlias = $alias;
-                    $tempAlias .= $cnt;
-                    $cnt++;
-                }
-                $alias = $tempAlias;
-            }
-        }
-    }
-
-    // check for duplicate alias name if not allowed
-    elseif ($alias && !$modx->getConfig('allow_duplicate_alias')) {
-        $alias = $modx->stripAlias($alias);
-        $docid = \EvolutionCMS\Models\SiteContent::withTrashed()->select('id')
-            ->where('id', '<>', $id)
-            ->where('alias', $alias);
-        if ($modx->getConfig('use_alias_path')) {
-            // only check for duplicates on the same level if alias_path is on
-            $docid = $docid->where('parent', $parent);
-        }
-        $docid = $docid->first();
-        if (!is_null($docid)) {
-            if ($actionToTake == 'edit') {
-                $modx->getManagerApi()->saveFormValues($editResourceAction);
-                $modx->webAlertAndQuit(sprintf($_lang["duplicate_alias_found"], $docid->id, $alias), $editResourceRedirect);
-            } else {
-                $modx->getManagerApi()->saveFormValues($newResourceAction);
-                $modx->webAlertAndQuit(sprintf($_lang["duplicate_alias_found"], $docid->id, $alias), $newResourceRedirect);
-            }
-        }
-    }
-
-    // strip alias of special characters
-    elseif ($alias) {
-        $alias = $modx->stripAlias($alias);
-        $docid = \EvolutionCMS\Models\SiteContent::withTrashed()->select('id')
-            ->where('id', '<>', $id)
-            ->where('alias', $alias)
-            ->where('parent', $parent)
-            ->first();
-        if (!is_null($docid)) {
-            if ($actionToTake == 'edit') {
-                $modx->getManagerApi()->saveFormValues($editResourceAction);
-                $modx->webAlertAndQuit(sprintf($_lang["duplicate_alias_found"], $docid->id, $alias), $editResourceRedirect);
-            } else {
-                $modx->getManagerApi()->saveFormValues($newResourceAction);
-                $modx->webAlertAndQuit(sprintf($_lang["duplicate_alias_found"], $docid->id, $alias), $newResourceRedirect);
-            }
-        }
-    }
-}
-elseif ($alias) {
-    $alias = $modx->stripAlias($alias);
+// a plugin may echo from OnDocFormSave; that must not end up inside the JSON
+if ($ajax) {
+    ob_start();
 }
-
-// determine published status
-$currentdate = $modx->timestamp((int)get_by_key($_SERVER, 'REQUEST_TIME', 0));
-
-if (empty ($pub_date)) {
-    $pub_date = 0;
-} else {
-    $pub_date = $modx->toTimeStamp($pub_date);
-
-    if ($pub_date < $currentdate) {
-        $published = 1;
+try {
+    $saved = \EvolutionCMS\Services\DocumentSaveService::forManager()->save($_POST);
+} catch (\EvolutionCMS\Services\DocumentSave\DocumentSaveDenied $denied) {
+    if ($ajax) {
+        ob_end_clean();
+        $respondJson(422, ['success' => false, 'message' => $denied->getMessage()]);
     }
-    elseif ($pub_date > $currentdate) {
-        $published = 0;
+    if (!$denied->restoreForm) {
+        $modx->webAlertAndQuit($denied->getMessage());
     }
-}
-
-if (empty ($unpub_date)) {
-    $unpub_date = 0;
-} else {
-    $unpub_date = $modx->toTimeStamp($unpub_date);
-    if ($unpub_date < $currentdate) {
-        $published = 0;
+    if ($actionToTake == 'edit') {
+        $modx->getManagerApi()->saveFormValues($editResourceAction);
+        $modx->webAlertAndQuit($denied->getMessage(), $editResourceRedirect);
     }
+    $modx->getManagerApi()->saveFormValues($newResourceAction);
+    $modx->webAlertAndQuit($denied->getMessage(), $newResourceRedirect);
 }
 
-// get document groups for current user
-$tmplvars =[];
-$docgrp = array_unique(\EvolutionCMS\Models\MemberGroup::query()
-    ->join('membergroup_access', 'membergroup_access.membergroup', '=', 'member_groups.user_group')
-    ->where('member_groups.member', $modx->getLoginUserID('mgr'))->pluck('documentgroup')->toArray());
-
-// ensure that user has not made this document inaccessible to themselves
-if($_SESSION['mgrRole'] != 1 && is_array($document_groups)) {
-    $document_group_list = implode(',', $document_groups);
-    $document_group_list = array_filter(explode(',', $document_group_list), 'is_numeric');
-    if(!empty($document_group_list)) {
-        $count = \EvolutionCMS\Models\MembergroupAccess::query()
-            ->join('member_groups', 'membergroup_access.membergroup', '=', 'member_groups.user_group')
-            ->whereIn('membergroup_access.documentgroup', $document_group_list)
-            ->where('member_groups.member', $_SESSION['mgrInternalKey'])->count('member_groups.id');
-
-        if($count == 0) {
-            if ($actionToTake == 'edit') {
-                $modx->getManagerApi()->saveFormValues($editResourceAction);
-                $modx->webAlertAndQuit($_lang["resource_permissions_error"], $editResourceRedirect);
-            } else {
-                $modx->getManagerApi()->saveFormValues($newResourceAction);
-                $modx->webAlertAndQuit($_lang["resource_permissions_error"], $newResourceRedirect);
-            }
-        }
-    }
-}
+$id = $saved->id;
 
-$tvs = \EvolutionCMS\Models\SiteTmplvar::query()->distinct()
-    ->select('site_tmplvars.*', 'site_tmplvar_contentvalues.value')
-    ->join('site_tmplvar_templates', 'site_tmplvar_templates.tmplvarid', '=', 'site_tmplvars.id')
-    ->leftJoin('site_tmplvar_contentvalues', function ($join) use ($id) {
-        $join->on('site_tmplvar_contentvalues.tmplvarid', '=', 'site_tmplvars.id');
-        $join->on('site_tmplvar_contentvalues.contentid', '=', \DB::raw($id));
-    })->leftjoin('site_tmplvar_access', 'site_tmplvar_access.tmplvarid', '=', 'site_tmplvars.id')
-    ->where('site_tmplvar_templates.templateid', $template)->orderBy('site_tmplvars.rank');
-if($_SESSION['mgrRole']!= 1){
-    $tvs = $tvs->leftJoin('document_groups', 'site_tmplvar_contentvalues.contentid', '=', 'document_groups.document');
-    $tvs = $tvs->where(function ($query) {
-        $query->whereNull('site_tmplvar_access.documentgroup')
-            ->orWhereIn('document_groups.document_group', $_SESSION['mgrDocgroups']);
-    });
-}
-$tvs = $tvs->get();
-foreach ($tvs->toArray() as $row) {
-    $tmplvar = '';
-    switch ($row['type']) {
-        case 'url':
-            $tmplvar = $_POST["tv" . $row['id']];
-            if ($_POST["tv" . $row['id'] . '_prefix'] != '--') {
-                $tmplvar = str_replace([
-                    "feed://",
-                    "ftp://",
-                    "http://",
-                    "https://",
-                    "mailto:"
-                ], "", $tmplvar);
-                $tmplvar = $_POST["tv" . $row['id'] . '_prefix'] . $tmplvar;
-            }
-            break;
-        case 'file':
-            $tmplvar = $_POST["tv" . $row['id']];
-            break;
-        default:
-            $tmp = get_by_key($_POST, 'tv' . $row['id']);
-            if (is_array($tmp)) {
-                // handles checkboxes & multiple selects elements
-                $feature_insert = [];
-                foreach ($tmp as $featureValue => $feature_item) {
-                    $feature_insert[count($feature_insert)] = $feature_item;
-                }
-                $tmplvar = implode("||", $feature_insert);
-            } else {
-                $tmplvar = $tmp;
-            }
-            break;
-    }
-    // save value if it was modified
-    if (!empty($tmplvar) && $tmplvar != $row['default_text']) {
-        $tmplvars[$row['id']] = [
-            $row['id'],
-            $tmplvar
-        ];
-    } else {
-        // Mark the variable for deletion
-        $tmplvars[$row['name']] = $row['id'];
-    }
-}
+// Set the item name for logger
+$_SESSION['itemname'] = $saved->pagetitle;
 
-// get the document, but only if it already exists
-if ($actionToTake != "new") {
-    $existingDocument = \EvolutionCMS\Models\SiteContent::withTrashed()->find($id);
-    if (is_null($existingDocument)) {
-        $modx->webAlertAndQuit($_lang["error_no_results"]);
-    }
-    $existingDocument = $existingDocument->toArray();
+if ($syncsite == 1) {
+    // empty cache
+    $modx->clearCache('document');
 }
 
-
-
-// check to see if the user is allowed to save the document in the place he wants to save it in
-if ($modx->getConfig('use_udperms') == 1) {
-    if (!isset($existingDocument) || $existingDocument['parent'] != $parent) {
-        $udperms = new EvolutionCMS\Legacy\Permissions();
-        $udperms->user = $modx->getLoginUserID('mgr');
-        $udperms->document = $parent;
-        $udperms->role = $_SESSION['mgrRole'];
-
-        if (!$udperms->checkPermissions()) {
-            if ($actionToTake == 'edit') {
-                $modx->getManagerApi()->saveFormValues($editResourceAction);
-                $modx->webAlertAndQuit($_lang['access_permission_parent_denied'], $editResourceRedirect);
-            } else {
-                $modx->getManagerApi()->saveFormValues($newResourceAction);
-                $modx->webAlertAndQuit($_lang['access_permission_parent_denied'], $newResourceRedirect);
-            }
-        }
-    }
+$refreshPreview = ($_POST['refresh_preview'] ?? '') == '1';
+if (!$saved->isNew() && !$refreshPreview && $stay != '2') {
+    $modx->unlockElement(7, $id);
 }
 
-$resourceArray = [
-    "introtext"        => $introtext ,
-    "content"          => $content ,
-    "pagetitle"        => $pagetitle ,
-    "longtitle"        => $longtitle ,
-    "type"             => $type ,
-    "description"      => $description ,
-    "alias"            => $alias ,
-    "link_attributes"  => $link_attributes ,
-    "isfolder"         => $isfolder ,
-    "richtext"         => $richtext ,
-    "published"        => $published ,
-    "parent"           => $parent ,
-    "template"         => $template ,
-    "menuindex"        => $menuindex ,
-    "searchable"       => $searchable ,
-    "cacheable"        => $cacheable ,
-    "editedby"         => $modx->getLoginUserID('mgr') ,
-    "editedon"         => $currentdate ,
-    "pub_date"         => $pub_date ,
-    "unpub_date"       => $unpub_date ,
-    "contentType"      => $contentType ,
-    "content_dispo"    => $contentdispo ,
-    "hide_from_tree"   => $hide_from_tree ,
-    "menutitle"        => $menutitle ,
-    "hidemenu"         => $hidemenu ,
-    "alias_visible"    => $aliasvisible
-];
-
-switch ($actionToTake) {
-    case 'new' :
-        $resourceArray['createdby'] = $modx->getLoginUserID('mgr');
-        $resourceArray['createdon'] = $currentdate;
-        // invoke OnBeforeDocFormSave event
-        switch($modx->config['docid_incrmnt_method'])
-        {
-            case '1':
-                $id = \EvolutionCMS\Models\SiteContent::withTrashed()
-                    ->leftJoin('site_content as t1', function ($join) {
-                        $join->on(\DB::raw(evo()->getDatabase()->getFullTableName('site_content').'.id +1'), '=', 't1.id');
-                    })
-                    ->whereNull('t1.id')->min('site_content.id');
-                $id++;
-
-                break;
-            case '2':
-                $id = \EvolutionCMS\Models\SiteContent::max('id');
-                $id++;
-                break;
-
-            default:
-                $id = '';
-        }
-
-        $modx->invokeEvent("OnBeforeDocFormSave", [
-            "mode" => "new",
-            "id" => $id
-        ]);
-
-        $parentDeleted = $parentId > 0 && empty(\EvolutionCMS\Models\SiteContent::find($parentId));
-        if ($parentDeleted) {
-            $resourceArray['deleted'] = 1;
-        }
-        // deny publishing if not permitted
-        if (!$modx->hasPermission('publish_document')) {
-            $pub_date = 0;
-            $unpub_date = 0;
-            $published = 0;
-        }
-
-        $publishedon = ($published ? $currentdate : 0);
-        $publishedby = ($published ? $modx->getLoginUserID('mgr') : 0);
-
-        if ((!empty($pub_date))&&($published)){
-            $publishedon=$pub_date;
-        }
-
-
-        $resourceArray['pub_date'] = $pub_date;
-        $resourceArray['publishedon'] = $publishedon;
-        $resourceArray['publishedby'] = $publishedby;
-        $resourceArray['unpub_date'] = $unpub_date;
-
-        if ($id != '')
-            $resourceArray["id"] = $id;
-
-        $key = \EvolutionCMS\Models\SiteContent::withTrashed()->create($resourceArray)->getKey();
-
-        $tvChanges = [];
-        foreach ($tmplvars as $field => $value) {
-            if (is_array($value)) {
-                $tvId = $value[0];
-                $tvVal = $value[1];
-                \EvolutionCMS\Models\SiteTmplvarContentvalue::query()->create(['tmplvarid' => $tvId, 'contentid' => $key, 'value' => $tvVal]);
-            }
-        }
-
-
-        // document access permissions
-        if ($modx->getConfig('use_udperms') && $parent != 0) {
-            $groupsParent = \EvolutionCMS\Models\DocumentGroup::select('document_group', 'document')
-                ->where('document', $parent)->pluck('document_group')->toArray();
-        } else {
-            $groupsParent = [];
-        }
-        if ($modx->getConfig('use_udperms') == 1 && $modx->hasAnyPermissions(['manage_groups', 'manage_document_permissions']) && is_array($document_groups)) {
-            $new_groups = [];
-            $groupsToInsert = [];
-            foreach ($document_groups as $value_pair) {
-                // first, split the pair (this is a new document, so ignore the second value
-                [$group] = explode(',', $value_pair); // @see actions/mutate_content.dynamic.php @ line 1138 (permissions list)
-                $group = (int)$group;
-                if ($modx->hasPermission('manage_groups')) {
-                    $new_groups[] = ['document_group' => $group, 'document' => $key];
-                    $groupsToInsert[] = $group;
-                    continue;
-                }
-                if ($modx->hasPermission('manage_document_permissions')) {
-                    if (in_array($group, $docgrp)) {
-                        $new_groups[] = ['document_group' => $group, 'document' => $key];
-                        $groupsToInsert[] = $group;
-                    }
-                }
-            }
-            if ($modx->hasPermission('manage_document_permissions')) {
-                foreach ($groupsParent as $group) {
-                    if (!in_array($group, $docgrp)) {
-                        $new_groups[] = ['document_group' => $group, 'document' => $key];
-                        $groupsToInsert[] = $group;
-                    }
-                }
-            }
-            if (!$modx->hasPermission('manage_groups')) {
-                if (!array_intersect($groupsToInsert, $docgrp)) {
-                    foreach ($groupsParent as $group){
-                        $new_groups[] = ['document_group' => $group, 'document' => $key];
-                    }
-                }
-            }
-            if (!empty($new_groups)) {
-                \EvolutionCMS\Models\DocumentGroup::query()->insertOrIgnore($new_groups);
-            }
-        } else {
-            if(!($modx->hasAnyPermissions(['manage_groups', 'manage_document_permissions']))) {
-                // inherit document access permissions
-                foreach ($groupsParent as $group){
-                    \EvolutionCMS\Models\DocumentGroup::insert(['document_group'=>$group, 'document'=>$key]);
-                }
-            }
-        }
-
-        // update parent folder status
-        if ($resourceArray['parent'] != 0) {
-            $fields = ['isfolder' => 1];
-            \EvolutionCMS\Models\SiteContent::withTrashed()->where('id',$resourceArray['parent'])->update(['isfolder'=>1]);
-        }
-
-        // invoke OnDocFormSave event
-        $modx->invokeEvent("OnDocFormSave", [
-            "mode" => "new",
-            "id" => $key
-        ]);
-
-        // secure web documents - flag as private
-        include EVO_MANAGER_PATH . "includes/secure_web_documents.inc.php";
-        secureWebDocument($key);
-        secureMgrDocument($key);
-
-        // Set the item name for logger
-        $_SESSION['itemname'] = $no_esc_pagetitle;
-
-        if ($syncsite == 1) {
-            // empty cache
-            $modx->clearCache('document');
-        }
-
-        // redirect/stay options
-        if ($_POST['stay'] != '') {
-            if ($type == "reference") {
-                $a = ($_POST['stay'] == '2') ? "27&id=$key" : "72&pid=$parentId";
-            } else {
-                $a = ($_POST['stay'] == '2') ? "27&id=$key" : "4&pid=$parentId";
-            }
-            $redirectUrl = "index.php?a=" . $a . "&r=1&stay=" . (int)$_POST['stay'];
-        } else {
-            $redirectUrl = "index.php?a=3&id=$key&r=1";
-        }
-        evo()->sendRedirect($redirectUrl, 0, headers_sent() ? 'REDIRECT_SCRIPT' : '');
-        break;
-    case 'edit' :
-        // get the document's current parent
-        $oldparent = $existingDocument['parent'];
-        $doctype = $existingDocument['type'];
-
-        if ($id == $modx->getConfig('site_start') && $published == 0) {
-            $modx->getManagerApi()->saveFormValues(27);
-            $modx->webAlertAndQuit("Document is linked to site_start variable and cannot be unpublished!");
-        }
-        $today = $modx->timestamp((int)get_by_key($_SERVER, 'REQUEST_TIME', 0));
-        if ($id == $modx->getConfig('site_start') && ($pub_date > $today || $unpub_date != "0")) {
-            $modx->getManagerApi()->saveFormValues(27);
-            $modx->webAlertAndQuit("Document is linked to site_start variable and cannot have publish or unpublish dates set!");
-        }
-        if ($parent == $id) {
-            $modx->getManagerApi()->saveFormValues(27);
-            $modx->webAlertAndQuit("Document can not be it's own parent!");
-        }
-
-        $parents = $modx->getParentIds($parent);
-        if (in_array($id, $parents)) {
-            $modx->webAlertAndQuit("Document descendant can not be it's parent!");
-        }
-
-        // check to see document is a folder
-        $child = \EvolutionCMS\Models\SiteContent::withTrashed()->select('id')->where('parent', $id)->first();
-        if (!is_null($child)) {
-            $resourceArray['isfolder'] = 1;
-        }
-
-        // set publishedon and publishedby
-        $was_published = $existingDocument['published'];
-
-        // keep original publish state, if change is not permitted
-        if (!$modx->hasPermission('publish_document')) {
-            $published = $was_published;
-            $pub_date = 'pub_date';
-            $unpub_date = 'unpub_date';
-        }
-
-        // if it was changed from unpublished to published
-        if (!$was_published && $published) {
-            $publishedon = $currentdate;
-            $publishedby = $modx->getLoginUserID('mgr');
-        }elseif ((!empty($pub_date)&& $pub_date<=$currentdate && $published)) {
-            $publishedon = $pub_date;
-            $publishedby = $modx->getLoginUserID('mgr');
-        }elseif ($was_published && !$published) {
-            $publishedon = 0;
-            $publishedby = 0;
-        } else {
-            $publishedon = $existingDocument['publishedon'];
-            $publishedby = $existingDocument['publishedby'];
-        }
-
-        $resourceArray['pub_date'] = $pub_date;
-        $resourceArray['publishedon'] = $publishedon;
-        $resourceArray['publishedby'] = $publishedby;
-
-        // invoke OnBeforeDocFormSave event
-        $modx->invokeEvent("OnBeforeDocFormSave", [
-            "mode" => "upd",
-            "id" => $id
-        ]);
-        $parentDeleted = $parentId > 0 && empty(\EvolutionCMS\Models\SiteContent::find($parentId));
-        if ($parentDeleted) {
-            $resourceArray['deleted'] = 1;
-        }
-        $resource = \EvolutionCMS\Models\SiteContent::withTrashed()->find($id);
-        foreach($resourceArray as $key=>$value){
-            $resource->{$key} = $value;
-        }
-        $resource->save();
-
-        // update template variables
-        $tvs = \EvolutionCMS\Models\SiteTmplvarContentvalue::select('id', 'tmplvarid')->where('contentid', $id)->get();
-        $tvIds = [];
-        foreach ($tvs as $tv) {
-            $tvIds[$tv->tmplvarid] = $tv->id;
-        }
-        $tvDeletions = [];
-        $tvChanges = [];
-        $tvAdded = [];
-
-        foreach ($tmplvars as $field => $value) {
-
-            if (!is_array($value)) {
-                if (isset($tvIds[$value])) $tvDeletions[] = $tvIds[$value];
-            } else {
-                $tvId = $value[0];
-                $tvVal = $value[1];
-                if (isset($tvIds[$tvId])) {
-                    \EvolutionCMS\Models\SiteTmplvarContentvalue::query()->find($tvIds[$tvId])->update(['tmplvarid' => $tvId, 'contentid' => $id, 'value' => $tvVal]);
-                } else {
-                    \EvolutionCMS\Models\SiteTmplvarContentvalue::query()->create(['tmplvarid' => $tvId, 'contentid' => $id, 'value' => $tvVal]);
-                }
-            }
-        }
-
-        if (!empty($tvDeletions)) {
-            \EvolutionCMS\Models\SiteTmplvarContentvalue::query()->whereIn('id', $tvDeletions)->delete();
-        }
-
-        // set document permissions
-        if ($modx->getConfig('use_udperms') == 1 && $modx->hasAnyPermissions(['manage_groups', 'manage_document_permissions']) && is_array($document_groups)) {
-            $new_groups = [];
-            // process the new input
-            foreach ($document_groups as $value_pair) {
-                [$group, $link_id] = explode(',', $value_pair); // @see actions/mutate_content.dynamic.php @ line 1138 (permissions list)
-                if (in_array($group, $docgrp) || $modx->hasPermission('manage_groups')) {
-                    $new_groups[$group] = $link_id;
-                }
-            }
-
-            // grab the current set of permissions on this document the user can access
-            $documentGroups = \EvolutionCMS\Models\DocumentGroup::select('id','document_group')
-                ->where('document', $id)->get();
-
-            $old_groups = [];
-            foreach ($documentGroups as $documentGroup) {
-                if (in_array($documentGroup->document_group, $docgrp) || $modx->hasPermission('manage_groups')) {
-                    $old_groups[$documentGroup->document_group] = $documentGroup->id;
-                }
-            }
-            // update the permissions in the database
-            $insertions = $deletions = [];
-            foreach ($new_groups as $group => $link_id) {
-                if (in_array($group, $docgrp) || $modx->hasPermission('manage_groups')) {
-                    if (array_key_exists($group, $old_groups)) {
-                        unset($old_groups[$group]);
-                        continue;
-                    } elseif ($link_id == 'new') {
-                        $insertions[] = ['document_group' => (int) $group, 'document' => $id];
-                    }
-                }
-            }
-            if (!empty($insertions)) {
-                \EvolutionCMS\Models\DocumentGroup::query()->insert($insertions);
-            }
-            if (!$modx->hasPermission('manage_groups')) {
-                $remainingGroups = \EvolutionCMS\Models\DocumentGroup::select('document_groups.document_group')->whereNotIn('id',
-                    $old_groups)->where('document_groups.document', $id)->pluck('document_group')->toArray();
-                if (!empty($docgrp) && !array_intersect($docgrp, $remainingGroups)) {
-                    $modx->webAlertAndQuit($_lang["resource_permissions_error"], "index.php?a=27&id={$id}");
-                }
-            }
-            if (!empty($old_groups)) {
-                \EvolutionCMS\Models\DocumentGroup::query()->whereIn('id', $old_groups)->delete();
-            }
-            // necessary to remove all permissions as document is public
-            if ((isset($_POST['chkalldocs']) && $_POST['chkalldocs'] == 'on')) {
-                \EvolutionCMS\Models\DocumentGroup::query()->where('document', $id)->delete();
-            }
-        }
-
-        // do the parent stuff
-        if ($resourceArray['parent'] != 0) {
-            $parent = \EvolutionCMS\Models\SiteContent::withTrashed()->find($_REQUEST['parent']);
-            $parent->isfolder = 1;
-            $parent->save();
-        }
-
-        // finished moving the document, now check to see if the old_parent should no longer be a folder
-        $countChildOldParent = \EvolutionCMS\Models\SiteContent::withTrashed()->where('parent', $oldparent)->count();
-
-        if ($countChildOldParent == 0) {
-            $oldParent = \EvolutionCMS\Models\SiteContent::withTrashed()->find($oldparent);
-            $oldParent->isfolder = 0;
-            $oldParent->save();
-        }
-
-
-        // invoke OnDocFormSave event
-        $modx->invokeEvent("OnDocFormSave", [
-            "mode" => "upd",
-            "id" => $id
-        ]);
-
-        // secure web documents - flag as private
-        include EVO_MANAGER_PATH . "includes/secure_web_documents.inc.php";
-        secureWebDocument($id);
-        secureMgrDocument($id);
-
-
-        // Set the item name for logger
-        $_SESSION['itemname'] = $no_esc_pagetitle;
-
-        if ($syncsite == 1) {
-            // empty cache
-            $modx->clearCache('document');
-        }
+$redirectUrl = \EvolutionCMS\Support\DocumentSave\SaveResponse::redirectUrl($saved, $stay, $refreshPreview, $add_path, EVO_SITE_URL);
 
-        if ($_POST['refresh_preview'] == '1')
-            $redirectUrl = EVO_SITE_URL . "index.php?id=$id&z=manprev";
-        else {
-            if ($_POST['stay'] != '2' && $id > 0) {
-                $modx->unlockElement(7, $id);
-            }
-            if ($_POST['stay'] != '') {
-                $id = $_REQUEST['id'];
-                if ($type == "reference") {
-                    // weblink
-                    $a = ($_POST['stay'] == '2') ? "27&id=$id" : "72&pid=$parentId";
-                } else {
-                    // document
-                    $a = ($_POST['stay'] == '2') ? "27&id=$id" : "4&pid=$parentId";
-                }
-                $redirectUrl = "index.php?a=" . $a . "&r=1&stay=" . (int)$_POST['stay'] . $add_path;
-            } else {
-                $redirectUrl = "index.php?a=3&id=$id&r=1" . $add_path;
-            }
-        }
-        evo()->sendRedirect($redirectUrl, 0, headers_sent() ? 'REDIRECT_SCRIPT' : '');
-        break;
-    default :
-        $modx->webAlertAndQuit("No operation set in request.");
+if ($ajax) {
+    ob_end_clean();
+    $respondJson(200, \EvolutionCMS\Support\DocumentSave\SaveResponse::payload($saved, $redirectUrl, csrf_token()));
 }
+evo()->sendRedirect($redirectUrl, 0, headers_sent() ? 'REDIRECT_SCRIPT' : '');
diff --git a/manager/processors/web_access_groups.processor.php b/manager/processors/web_access_groups.processor.php
index a219df26e1..7d269a0f7c 100755
--- a/manager/processors/web_access_groups.processor.php
+++ b/manager/processors/web_access_groups.processor.php
@@ -111,12 +111,7 @@
 
 // secure web documents - flag as private
 if ($updategroupaccess == true) {
-    include EVO_MANAGER_PATH . "includes/secure_web_documents.inc.php";
-    if ($context) {
-        secureWebDocument();
-    } else {
-        secureMgrDocument();
-    }
+    \EvolutionCMS\Support\DocumentPrivacy::refreshAll($context ? \EvolutionCMS\Support\DocumentPrivacy::WEB : \EvolutionCMS\Support\DocumentPrivacy::MANAGER);
     // Update the private group column
     $columnName = $context ? 'private_webgroup' : 'private_memgroup';
     $resp = \EvolutionCMS\Models\DocumentgroupName::query()->select('documentgroup_names.id',
diff --git a/tmp/admin-save-performance-plan.md b/tmp/admin-save-performance-plan.md
deleted file mode 100644
index 6d28c86d4f..0000000000
--- a/tmp/admin-save-performance-plan.md
+++ /dev/null
@@ -1,204 +0,0 @@
-# Evolution CMS manager: making document save the fastest in the phramark admin workload
-
-Date: 2026-09-21
-Source data: `c:\projects\Opensource\phramark\docs\results.json` (generated 2026-09-20T14:43Z),
-live reproduction against the `evo-parser` container on http://127.0.0.1:8080.
-
-## 1. What the benchmark measures
-
-`serverMs` for a step is the sum of every top-level document request (HTML navigations and
-form posts, including redirects) between the click and the settled editor, plus known CMS
-XHR endpoints (Winter's `X-Winter-Request-Handler`, MODX's `/connectors/index.php`) — see
-`benchmark/workloads/admin/lib/document-timer.mjs`.
-
-For Evolution a save is **POST `a=5` + the 302'd GET `a=27`** (full editor re-render).
-For Winter it is one XHR. Evo pays for two requests and a page render where the leader pays
-for one JSON call.
-
-### Admin results, JIT off, median serverMs
-
-| stack            | login | open-edit | **save-edit** | open-create | save-create | total wall |
-|------------------|------:|----------:|--------------:|------------:|------------:|-----------:|
-| evo-parser       |   243 |       102 |       **439** |          84 |         502 |    11.6 s |
-| evo-latte        |   252 |       100 |       **422** |          83 |         529 |    12.0 s |
-| evo-latte-parser |   253 |       100 |       **414** |          84 |         509 |    11.9 s |
-| evo-phalcon      |   251 |       104 |       **424** |          84 |         518 |    11.7 s |
-| drupal-11        |   323 |       124 |       **350** |          44 |         313 |     6.0 s |
-| typo3            |  1241 |       155 |       **399** |         111 |         763 |    18.5 s |
-| winter           |   193 |        33 |        **36** |          34 |          67 |     4.3 s |
-| modx             |   367 |       211 |       **138** |         169 |         355 |    15.5 s |
-| wordpress-gantry |   263 |        72 |       **132** |          79 |         141 |     9.1 s |
-
-Observations before touching any framework question:
-
-1. **All four Evo stacks are identical on admin.** aPhalcon and aLatteX only touch the front
-   end. The admin cost is CMS logic, not the DB adapter or the template engine.
-2. **Save costs 4x an editor load, and `phpPeakMb` jumps 1.2 -> 5.9 MB only on save**
-   (every other step stays ~1.2 MB). That is a compile spike, not data.
-3. Login is 1 808 ms wall for 243 ms server: the frameset renders a **27 228-node DOM**
-   (Winter 5 230, Drupal 2 498). Every step also carries ~60 ms client-side overhead.
-
-## 2. Root cause, reproduced
-
-`manager/processors/save_content.processor.php:467-470` (and `:672-675` for the update
-branch) call `$modx->clearCache('full')` whenever `syncsite=1`, which is the form default.
-That runs `Legacy\Cache::emptyCache()` (`core/src/Legacy/Cache.php:112-144`), which on
-**every document save** does:
-
-- `Illuminate\Support\Facades\Cache::flush()` — wipes the whole Laravel cache store
-- unlinks every `assets/cache/*.pageCache.php`
-- **`opcache_reset()`** — discards the compiled bytecode of the entire Laravel + Evo tree
-- `buildCache()` — regenerates `siteCache.idx.php`; with default settings
-  (`full_aliaslisting=0`) that enumerates all documents (10 000 in the fixture). The benchmark
-  sets `full_aliaslisting=1` (`benchmark/fixtures/setup.php:204`), so this part is skipped
-  there — real-world sites are hit *harder* than the benchmark shows.
-
-The redirected GET then runs on a cold opcache (`opcache.validate_timestamps=0`,
-`memory_consumption=512` in `benchmark/config/php.ini` — nothing was warming it back).
-
-### Live measurement (curl, same session, editor form payload replayed verbatim)
-
-| scenario                         | POST a=5     | GET a=27 after | sum           |
-|----------------------------------|-------------:|---------------:|--------------:|
-| `syncsite=1` (form default)      | 260–500 ms   | 420–940 ms     | ~750–1200 ms  |
-| `syncsite=0`                     | 130–280 ms   | 100–170 ms     | ~300 ms       |
-| warm editor load, no save        | —            | ~160 ms        |               |
-| unknown action `a=999` (bootstrap only) | —     | ~90–120 ms     |               |
-
-curl through Docker Desktop adds roughly 40–60 ms per request compared to what Playwright
-records in-container, so relative numbers are the point.
-
-Cost breakdown of a save today:
-
-- **~60 %** cache flush + opcache reset + cold recompile on the redirect
-- **~25 %** fixed manager bootstrap, paid twice (POST + GET): ~75–85 ms per request
-- **~15 %** the processor's own work: ~15–25 independent queries, TV loop with per-row
-  `find()->update()`, `DocumentGroup` reconciliation, `secure_web_documents.inc.php` include
-
-## 3. Plan
-
-### Phase 1 — Stop nuking the cache on save (1–2 days, ~2x faster)
-
-Target: save-edit 439 -> ~200 ms. Ahead of Drupal/TYPO3, level with MODX/WordPress.
-
-- `Legacy\Cache::emptyCache()`: remove `opcache_reset()` from the document-save path. Keep it
-  for element saves (snippet/plugin/chunk/module code) and the explicit "Clear cache" action.
-  This is the one deliberate `core/src/Legacy/` edit; it fixes a concrete bug.
-- Replace `Cache::flush()` with keyed/tagged invalidation (`site_settings`, `doc:{id}`,
-  `siteCache`).
-- `buildCache()` on document save: update the single alias row in the listing, or mark
-  `siteCache.idx.php` stale and rebuild lazily on the next *front-end* request where it is
-  actually consumed. No synchronous 10k-row rebuild inside the manager request.
-- Page cache: delete `docid_{id}` plus ancestors/siblings whose menus render it, not
-  `*.pageCache.php` wholesale.
-- Unit tests for the invalidation matrix (document save / element save / settings save /
-  explicit clear). Re-run `benchmark/scripts/bench` on the `evo-parser` admin cell.
-
-### Phase 2 — Processor diet (2–3 days)
-
-Target: POST work ~40 -> ~15 ms.
-
-- One transaction around the save.
-- TVs: one query for current values, one bulk upsert, one bulk delete. Today: a `distinct()`
-  join over all TVs at the top (`:204-220`), then `find()->update()` per TV (`:577`).
-- Skip `DocumentGroup` reconciliation and `secureWebDocument()` / `secureMgrDocument()`
-  when privacy/group fields are unchanged; `$existingDocument` (`:267`) is already loaded to
-  diff against.
-- Drop `SiteContent::max('id')` / the `id + 1` self-join id hunting on create (`:333-342`)
-  where auto-increment already answers.
-- Move the 700-line processor into `core/src/Services/DocumentSaveService.php`; leave a thin
-  controller in `manager/processors/`. Prerequisite for Phase 3 and for any fast lane.
-
-### Phase 3 — AJAX save, no editor reload (2–3 days)
-
-Target: save-edit ~= one request ~= 90 ms; then bootstrap-bound.
-
-- `a=5` answers JSON when called with `X-Requested-With: XMLHttpRequest` (id, alias,
-  `editedon`, refreshed CSRF token); the editor JS updates the form in place. The form POST
-  remains as the no-JS fallback. CSRF: send `_token` from `<meta name="csrf-token">` (see
-  AGENTS.md, CSRF rules).
-- `save-create` still needs one navigation to `a=27&id=<new>`, same as Winter.
-- **Fairness:** phramark counts Winter's XHR by header and MODX's by URL
-  (`document-timer.mjs:12-13`). Add the Evo endpoint to that list in the same way so the XHR
-  *is* counted. Otherwise the improvement would be a measurement artefact, not a win.
-
-### Phase 4 — Manager bootstrap diet (1–2 weeks; this is what makes Evo first)
-
-Target: fixed cost ~80 -> ~35 ms per request. Winter's whole save is 36 ms.
-
-- Profile first: add php-spx (or xhprof) to `benchmark/images/php`, trace `a=27` and `a=5`.
-  Candidates, all unverified until profiled:
-  - ~30 service providers booted eagerly on every request -> defer the manager-irrelevant ones.
-  - Lexicon: full language arrays per request -> per-action files.
-  - `OnManagerPageInit` / theme init, `ManagerTheme` action map, Blade compile checks.
-  - Settings and user-permission loading: must hit cache, not DB, per request.
-  - Session: `session.lazy_write`, no unnecessary `session_regenerate_id`.
-- Autoload is 44 ms cold on CLI in the container; under FPM with opcache it should be ~2 ms.
-  Verify the deployed vendor is `classmap-authoritative` in the benchmark image and that the
-  Phase 1 cache changes never invalidate it.
-
-### Phase 5 — Front-end wall time (parallel track, biggest user-visible win)
-
-`totalWallMs` 11.6 s vs Winter 4.3 s; login 1 808 ms wall for 243 ms server.
-
-- Lazy document tree: render root + expanded path only, fetch children on expand (the AJAX
-  expand endpoint already exists — make it the default instead of pre-rendering 27k nodes).
-- Audit per-step client overhead (~60 ms on every action): scripts loaded in the mainframe
-  on every navigation, `stay=2` re-initialising editors.
-- JS/Blade work in `manager/media/style/*` and the tree views; independent of the PHP phases.
-
-## 4. Phalcon in the manager — assessment
-
-Recommendation: do not port the manager to Phalcon. The benchmark itself is the evidence.
-
-- **evo-phalcon == evo-parser on every admin metric** (424 vs 439 save-edit). Phalcon is
-  loaded in that container and buys nothing for the manager, because the manager cost is Evo
-  logic (cache flush, processor, bootstrap), not framework dispatch speed.
-- **The guest win (p50 51 ms vs 393 ms) is not "Phalcon is fast", it is "takeover skips the
-  CMS".** aPhalcon's `frontend.takeover` renders the content row straight into a Latte view:
-  no parser pass, no snippets, no plugin events, no `documentListing`
-  (`c:\projects\Opensource\evo\aPhalcon\README.md`, "takeover" section). A plain-PHP takeover
-  without the extension lands in the same ballpark. Porting the manager to Phalcon without
-  rewriting what it does reproduces evo-phalcon's admin numbers: unchanged.
-- Cost of doing it anyway: a C extension most shared hosts do not ship, a second dispatch
-  model to maintain under `/manager`, and every extra hooking `OnManagerPageInit`,
-  `OnDocFormSave`, etc. needs a shim.
-
-Where Phalcon can be tested cheaply and fairly: after Phase 2 extracts
-`DocumentSaveService`, build a **fast-lane entry point** (`manager/api.php`) that boots only
-session + DB + the service for the AJAX save.
-
-1. Implement it in plain PHP / Illuminate first and measure.
-2. Optionally implement the same lane as a `Phalcon\Mvc\Micro` inside aPhalcon behind a config
-   flag (`manager.fastlane => true`) and measure again.
-
-If the plain lane reaches ~35 ms the extension has nothing left to add. Either way Phalcon
-stays an opt-in accelerator in the sibling plugin, not a core dependency — consistent with
-how aPhalcon is positioned today.
-
-## 5. Expected trajectory — save-edit, serverMs
-
-| after       | estimate | rank                                  |
-|-------------|---------:|---------------------------------------|
-| today       |      439 | 8 / 8                                 |
-| Phase 1     |     ~200 | 4 (behind Winter, WordPress, MODX)    |
-| Phase 2 + 3 |      ~90 | 2 (behind Winter)                     |
-| Phase 4     |   ~35–45 | 1–2, tied with Winter                 |
-
-Phase 1 is a small PR and pays back on every real site immediately — more than in the
-benchmark, given `full_aliaslisting=0` defaults. Start there, land the profiler in the phramark
-PHP image alongside it, and let the Phase 4 profile decide the order of the bootstrap work.
-
-## Appendix — how the reproduction was done
-
-```sh
-B=http://127.0.0.1:8080/manager/index.php
-H=(-A Mozilla/5.0 -H 'Accept: text/html' -H 'Accept-Language: en' -e "$B")
-# manager/index.php returns 404 without Accept-Language; CSRF check needs a Referer
-curl -s "${H[@]}" -c cj.txt -b cj.txt -d 'username=benchmark&password=benchmark-admin&ajax=0' "$B?a=0"
-curl -s "${H[@]}" -c cj.txt -b cj.txt -o edit.html "$B?a=27&id=10104"
-# scrape every input/textarea/select of the editor form into post.txt (stay=2), then:
-curl -s "${H[@]}" -b cj.txt -c cj.txt -o /dev/null -w '%{time_total}\n' --data-binary @post.txt "$B"
-curl -s "${H[@]}" -b cj.txt -c cj.txt -o /dev/null -w '%{time_total}\n' "$B?a=27&id=10104&r=1&stay=2"
-# repeat with syncsite=0 in post.txt
-```
diff --git a/tmp/udperms-check-never-denies.md b/tmp/udperms-check-never-denies.md
deleted file mode 100644
index 46c5cc1659..0000000000
--- a/tmp/udperms-check-never-denies.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# `Legacy\Permissions::checkPermissions()` never denies a document
-
-Date: 2026-09-21. Found while porting the target-folder permission check into the tree
-drag-and-drop handler (`fix-move-document-missing-checks`, bd4342d83). Not fixed there —
-it is a separate Legacy bug and deserves its own branch.
-
-## Where
-
-`core/src/Legacy/Permissions.php:69-81` (`checkPermissions()`), used by:
-
-- `Controllers\MoveDocument::checkNewParentPermission()` / `processDisplay()` (a=51)
-- `Support\MoveDocumentTargetGuard::deniedForUser()` (tree drag-and-drop, since bd4342d83)
-- `manager/actions/mutate_menuindex_sort.dynamic.php:19-25`
-- `core/functions/actions/mutate_content.php` and the other manager actions that instantiate
-  `new Permissions()` with `->document = $id` (grep `udperms->document`)
-
-## What is wrong
-
-The query that is supposed to answer "may this user see document `$this->document`"
-never filters by that id:
-
-```php
-$query = SiteContent::query()->select('id');
-if (!empty($docgrp)) {
-    $query = $query->leftJoin('document_groups', 'site_content.id', '=', 'document_groups.document')
-        ->where(function ($q) use ($docgrp) {
-            $q->where('document_groups.document_group', $docgrp)   // (2)
-              ->orWhere('site_content.privatemgr', 0);
-        });
-} else {
-    $query->where('privatemgr', 0);
-}
-if ($query->count() > 0) {          // (1)
-    $permissionsok = true;
-}
-```
-
-1. No `->where('site_content.id', $this->document)`. `count() > 0` is true as soon as *any*
-   non-private (or any group-accessible) document exists, i.e. always on a real site. For every
-   non-admin role with `use_udperms = 1` the check returns true regardless of the target.
-2. `$docgrp` is `implode(' || dg.document_group = ', $_SESSION['mgrDocgroups'])` — a leftover
-   raw-SQL fragment from the original MODX query. Bound as a single value in `where(...)`, it
-   only matches when the user is in exactly one group (`"3"`); with two groups the bound value
-   is the literal string `"3 || dg.document_group = 5"` and matches nothing, so the
-   `privatemgr = 0` branch carries the whole result.
-
-Result: udperms cannot deny moving/creating into a private folder, and cannot deny opening the
-move page for a private document. The only denial that still fires is the root case before the
-query — and it fires for the wrong reason (see the global below).
-
-## Fix outline
-
-- Add `->where('site_content.id', (int) $this->document)` and use `whereIn('document_groups.document_group', $_SESSION['mgrDocgroups'])`.
-- Keep the `privatemgr = 0` OR-branch (public documents stay visible), and keep the root
-  short-circuits above the query unchanged.
-- `global $udperms_allowroot` (`Permissions.php:33`) is never assigned anywhere in core or
-  manager (grep), so it is always null: the "allowed at root" short-circuit (`== 1`) never
-  fires and the root denial (`== 0`, loose) fires for every non-admin creating/duplicating at
-  root even when the setting is on. Read `evo()->getConfig('udperms_allowroot')` instead, as
-  `ajax.php:657` already does.
-- Tests: in-memory `site_content` + `document_groups` with a private folder the user is not in
-  (expect false), one they are in (expect true), a public one (expect true), user in two groups.
-  Then a manager-level check for a=51 and the tree `movedocument` with a private target.