What's new in 3.6.0 (April 28, 2026)

Released April 28, 2026.

Added

• FFL Document NAS Migration, FFL/SOT files moved off local disk onto the NAS, New serve-ffl-doc.php proxy streams files from NAS with basename sanitization + extension whitelist (pdf/jpg/jpeg/png/gif/webp/tif/tiff), .htaccess fallback in uploads/ffl/, uploads/ffl_licenses/, uploads/sot_licenses/ , local file present serves directly, missing falls through to NAS proxy, DB paths unchanged (uploads/ffl/<file>) , admin UI and existing code paths keep working, Upload entry points (GunBroker eFFL fetch, customer FFL upload, admin FFL/SOT edit, FFL queue review) now mirror new files to NAS, Fixed an FFL admin page showing "no FFL" despite the document being on the NAS
• Picker Decision Simulator , cron/compare_picker_vs_actual.php replays last N actual fulfillments through the rule based picker, Result on 100 orders: 67% exact match (distributor + ship type), 73% same distributor, 79% same DS/STS, Added AUTOFULFILL_SIM_ONLY guard in cron/auto_fulfill_orders.php for safe replay, Identified three improvement areas: the store's own warehouse invisible to picker (7 NO_PICK), over flips to STS on mid cost items, distributor preference tuning needed
• Feed Caching Layer , Wikiarms/Gun.Deals feeds now cache to cache/feeds/, Cache hit serves in ~0.26s vs 5, 10 min for live generation, 2-hour TTL, atomic rename pattern, X-Feed-Cache: HIT age=Ns header, New cron/generate_feeds.php runs hourly via a dedicated Windows Task Scheduler feed regeneration task, Sanity check validates XML structure (declaration, opens/closes, min size) before promoting tmp file, Feed URLs unchanged , consumers (WikiArms IPs, Gun.Deals) need no reconfiguration
• WikiArms Server Allowlist , Verified feed access from 23.105.168.20/21/22
• Kroll Exclusive AI Content , cron/batch-kroll-ai-content.php rewrites titles + descriptions for Kroll exclusive firearms, 81 firearms processed with GPT-5-mini (Kroll only filter via SUM by warehouse SQL), Flags: --all-kroll, --firearms-only, --force
• Ruger Always STS Rule , Hardcoded $mfgFirearmsAlwaysSts = ['ruger'] in cron/auto_fulfill_orders.php, No distributor will dropship Ruger firearms (RSR Appendix G + equivalents), Picker forces STS when requires_ffl=1 AND manufacturer matches "ruger" (case insensitive)
• RSR NFA Class III Dropship , RSR will now dropship NFA items (suppressors, SBRs) when receiving FFL has SOT on file, Picker reads ffl_is_class3 from order context (atf_ffl_dealers.is_class3=1), When true and item is NFA + RSR sourced, allows DS instead of forcing STS
• Auto Fulfill Dropship Only Scope , cron/auto_fulfill_orders.php excludes any item where AI picks to_store (STS), Splits queue into dropship eligible (auto run) vs manual STS (don't run), Davidson's also stays manual even if picked DS

Improved

• Image Hosting Architecture, the store image host now serves exclusively from the NAS via Apache mod_cache_disk + SMB, GunBroker.cacheImageLocally() is now a pass through (normalizes the store image host and returns), Original ~250-line implementation kept as dead code below the early return for reference, Eliminates dual storage waste; all image traffic now hits NAS via Apache cache
• NAS Keepalive Required, a Windows scheduled task (every 1 min) holds SMB sessions open, Without it, SMB sessions go Unavailable, Apache threads leak, site hangs (incident: 2026-04-25), Prewarm cron/script removed after thread leak incident
• Stock Sync FFL Exclusion, the local stock sync cron now excludes FFL required products from the local_inventory branch, Root cause of a suppressor selling while physically out of stock: a bogus local_inventory row for an FFL item, FFL items belong ONLY in warehouse_inventory (FastBound tracked); never trust local_inventory for FFL, LEFT JOIN to products filters COALESCE(p.ffl_required, 0) = 0
• Hazmat Detection Hardening , Bulk disabled 38 smokeless powder / primer / percussion cap products previously listing without is_hazmat=1, Winchester StaBall (UPC 39288503316) + 37 others identified by category match, Closed gap that allowed Reloading > Powder products onto GunBroker
• EasyPost Return Label Emails , Inline logo + EasyPost label PDF/PNG attachment, easypost_resend_return_label.php and easypost_buy_return_label.php use tgdInlineLocalImages() for CID logo, Label attachment fetched live with proper MIME detection
• Kroll Image Path Fix , Repaired image_url paths from /k/ (Kinsey's) to /kr/ (Kroll) for 200,325 products, cron/fast_kroll_image_fix.php bulk copies the authoritative distributor mirror IMAGE column -> products.image_url, cron/repair_kroll_image_urls.php handles per item HEAD checked repair with 4-layer touch (products, product_images, gunbroker_listings, remote table)

Fixed

• Ghost inventory, a suppressor sold despite being physically gone, Two table mismatch: warehouse_inventory correctly showed transferred, but local_inventory had ghost qty=1 from manual Jan 27 entry, Deleted ghost row, found and confirmed 4 more FFL ghost rows in local_inventory, Patched sync to prevent recurrence
• Disk Full Crisis (C: drive) , Recovered ~140 GB, 23 GB orphan GunBroker image cache (assets/images/products/cache/gb_* files, all 117,562 verified zero reference, 7+ weeks stale) , deleted entire batch, 3.36 GB SQL dumps moved off the local desktop to NAS backup storage, Final free space went from 0 GB → 39 GB, Apache thread/VirtualAlloc failures resolved
• WikiArms Missing UPC 713780991047 , Diagnosed as feed timeout (sort position #103,779 of 103,779 not reached before memory/time limits), Cache layer now serves full 111,338 offers reliably

Security

• FFL Path Traversal Prevention , serve-ffl-doc.php reduces filename to basename(), whitelists extensions, no directory listing

Removed

• Local Image Cache Pre Warm, cron/precache_gb_images.php-style logic retired with the move to NAS backed image hosting

All releases: What's new in Trinity. The same notes are on the What's New page in your admin.

<!-- search: what's new whats new change log changelog release notes update version 3.6.0 april 28 2026 April 2026 ffl document nas migration picker decision simulator feed caching layer wikiarms server allowlist kroll exclusive ai content ruger always sts rule rsr nfa class iii dropship auto fulfill dropship only scope image hosting architecture nas keepalive required stock sync ffl exclusion hazmat detection hardening easypost return label emails kroll image path fix ghost inventory disk full crisis c drive wikiarms missing upc 713780991047 ffl path traversal prevention local image cache pre warm -->