The block "Администрация" (adminblock(), bkey admin) and its twin "Наблюдение" are redesigned on the demo stand: the series demo/ab-01…09 carries the variants, and the owner's choice - the floating menu 09 and the merged block 08 - stands in the panel etalon demo/admin/ and in the new site etalon demo/site/, with marks, descriptions and one shared stylesheet, so the transfer into the themes is one step. On the live site the total of the visitor summary gets its own icon.

Core changes:

1. Admin block series (public/demo/ab-01-card.html … ab-09-menu.html, public/demo/assets/ablock.js, public/demo/assets/ablock.css, public/demo/assets/demo.js, public/demo/README.md):

2. Nine faces, each in two rooms: ?ctx=admin on the admin theme with the block form, ?ctx=site on the lite theme

   • ablock.js holds the corpus of the stand: block id 2 word for word, the queue, the sessions, the live tick,

the summary, the window "Наблюдение" and the stand desk

• 01-08 merge "Администрация" and "Наблюдение" into one block; 08 "Пульт" is the leader: the summary, six square icon keys (panel, statistics, refresh, site, own links, logout), the own links open as the rows of the user block

• 09 "Плавающее меню" is the leader of the menu: a solid layer over the page, placed anywhere and remembered, turned across or upright, folded with the slide of the column blocks, only the icon under the hand grows

• demo.js lists the series (DEMO_ABLOCK); README.md records the series, its history and the rejected ideas
• Panel etalon (public/demo/admin/index.html, public/demo/admin/admin.js, public/demo/admin/admin.css):

• М1-М14: the floating menu with its pins from the fan of a section, the quick jump, the watch ring, the own links, the admin window, the turn, the fold and the grip; Options get "Плавающее меню", "Меню на сайте" and "Позиция меню" (top, right, bottom, left; a place set by the grip reads "Произвольная")

• А1-А8: block 08 on the home, always, whatever the menu; the rail shows it beside its icon, opening upward
• The window "Наблюдение" (#sl-stats): filter by kind, pause, figures, the hour, shares, who and where, pages, countries

• Fixes found on the stand: the grip cancelled by the page's own drag (preventDefault, pointercancel), the growth measured from the wrong parent (the hovered icon now grows), the toast lifted only over a menu lying at the bottom

• Five own links: Sypex Dumper (dead, flagged), SLAED CMS on GitHub, PageSpeed Insights, Google Search Console, Яндекс Вебмастер; each row ends with the chevron of the site's user block

• Labels in plain words; the legend gets the sections М and А and rewrites Г5, Э13, Н4, Н5, В09.3
• Site etalon (public/demo/site/index.html, public/demo/site/site.js, public/demo/site/site.css):

• The server answer of the live news page under an administrator: the real lite chrome, without htmx, the pseudo-cron, the debug panel and the form tokens; the stand posts nothing and calls no server

• Block 08 first in the column, always; menu 09 with what the site needs of its own: the mark into the panel with the queue sum when folded, "Эта страница в панели", the queue (four apps, one bell upright), "Все разделы" with search and stars instead of Ctrl+K, the setToast pill with "Отменить"

• The panel's Options act here at once (shared keys sl.dock.side, sl.dock.pins, sl.dock.mag; sl.dock.site switches the site); the place dragged on the site is the site's own

• Marks С1-С14 with their descriptions and the stand desk of the site
• Shared stylesheet (public/demo/assets/admin-block.css):

• The menu, the block and the window move out of admin.css into one file both etalons link; admin.css keeps only the lift over its toast host and the rail rule, site.css only what the site adds

• Visitor summary of the site (public/templates/lite/partials/session-summary.html, public/templates/lite/assets/css/theme.css, tools/ui-contract.php):

• The total line carries bi-people in the text tone and stands in the column of the lines above it
• Its rule body now equals the two changelog rules; the dup allowlist entry names it with the reason
• Scheduler (config/scheduler.php):
• The update check runs at 24 0 instead of 40 4

Benefits:

• The owner judges the menu and the block where they will live, in the panel and on the site, before any transfer
• One markup and one stylesheet for the menu, the block and the window on both themes
• The live block's faults (list markers, the empty ring, the dead link, the wrong tooltip) are shown and repaired

Technical notes:

• Storage of the stand only: sl.dock, sl.dock.site, sl.dock.side, sl.dock.at, sl.dock.dir, sl.dock.fold, sl.dock.mag, sl.dock.pins, sl.dock.site.at, sl.dock.site.dir, sl.dock.site.fold

• For the transfer: setToast() of slaed.js gains an undo action, the lite theme gains the token --sl-solid-text, setSlideMotion() gains an axis option

• No breaking change: the only change to a shipped template is the added icon of the summary total

The update plan closes its batch 10 and does the documents of batch 11 (roadmap steps 86 and 87). tools/rehearse.php installs the previous release clean and updates it by both archives under the real signatures, and publish refuses a release without that green record. The general rehearsal through a real master on two OSPanel projects found five faults, all fixed. docs/UPDATE.md is the lasting reference of releasing, signing, the master, the installation and privacy. Step 87 stays open: the key ceremony was postponed by the owner, so the factory keys are still the test keys and UpdateSignTest::theFactoryKeysAreRealAndPublished is red until the real keys are in.

Core changes:

1. Rehearsal (tools/rehearse.php, tools/release.php, tools/sign.php):

2. rehearse.php: a clean run of the new full archive through its own setup.php, then a full and a delta run, each on the previous release installed clean into a disposable folder and database

   • the archive and its signed manifest go to Update of that site as an upload by hand, so the site verifies itself
   • dry run, installation, self-check, integrity, the schema against the clean run, "Вернуть предыдущую версию" to

the byte, empty error journals; children without OPcache

• a green run writes storage/release/<version>/rehearsal.json with the SHA-256 of each archive

• release.php publish refuses without the rehearsal record of the same archives (checkRehearsal())

• sign.php points to the rehearsal after signing, and sign.php --note writes <id>.sig where publish and the master read it, not <id>.json.sig

• Faults of the general rehearsal (core/classes/update.php, core/monitor.php, .gitignore):
• addAudit() no longer reports the public/setup.php the installer deleted as a missing file

• getMonitorDiskSnapshot() reads zero on a host without disk_free_space()/disk_total_space() instead of failing the start page of the panel

• .gitignore lets storage/update/step/*.sql into git; the database steps would have missed the release
• Light mode backup (admin/update.php, admin/lang/*.php):

• "Применить шаги базы" takes the portion dump of the site tables, as step 4 of an installation does, instead of the full dump of the job dbbackup: a foreign MyISAM table of a shared database left the site closed

  • a dump that does not fit into one request continues with the next click (_UPDATE_BACKPART in six languages)
  • the used backup is set aside under its time and is not taken again after a failed step
• Shipped configuration (config/security.php, config/modules.php):
• No test ban, no row of the module master, error level 0; the secret stays empty and getSecret() makes one per site
• Factory keys seam (core/classes/update.php, modules/master/common.php, modules/master/admin/index.php):

• Update::getFactoryKeys() starts every key chain: Update::PRIMARY and Update::RECOVERY, or UPDATE_KEYS where a test run defines it before the core; getKeyFile(), the master and its tab of keys read through it

• No request and no setting can define a constant, so the source of trust still changes by code only

• Tests (tests/Support/test_keys.php, tests/bootstrap.php, tests/Support/probe_boot.php, tests/Support/route_web.php, tests/Support/route_probe.php, tests/Unit/*.php):

• test_keys.php defines UPDATE_KEYS from tests/Fixtures/update in the PHPUnit bootstrap, the probe boot and the router
• ReleaseToolTest pins the test keys in the copy of update.php of its scratch repository

• theFactoryKeysAreRealAndPublished replaces theFactoryKeysAreTheTestKeys: the core ships real keys and README.md their fingerprints

• ReleaseToolTest: publish refused without a rehearsal and with the record of another archive, publish --note finds the signature; UpdateFetchTest: the deleted installer; UpdateGateTest: a foreign MyISAM table, a dump of the site only, no second backup after a failed step

• Reference (docs/UPDATE.md, docs/VERSIONS.md, UPGRADING.md, README.md, docs/ARCHITECTURE.md, docs/TESTS.md):

• docs/UPDATE.md: parts, releasing, signature and keys with the ceremony and the key change, manifest and packages, notes, the master, the client, settings, database steps, storage, installation and contract v1, refusals, rehearsal, statistics and privacy with the privacy note of slaed.net, security, tests, reasons

• docs/VERSIONS.md records the updater with its breaking changes; UPGRADING.md gets "Updates From the Panel"
• README.md gets "Updates and Release Keys" with placeholders for the two fingerprints
• docs/ARCHITECTURE.md gets "Update Boundary"; docs/TESTS.md lists the updater tests

• Help and references (admin/info/update/ru.md, modules/master/admin/info/ru.md, docs/2027-*.md, .gitattributes, tests/Support/apply_probe.php):

• The help of the light mode and of the integrity check follows the behaviour; the help of the master explains the rehearsal and the new signatures of served releases and notes after a change of the primary key

• Every reference to docs/11-UPDATE-2026.md points to docs/UPDATE.md
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
• Batch 10 and roadmap step 86 are closed; batch 11 and step 87 record what is done and that the ceremony waits

Benefits:

• No release reaches a site without being installed and rolled back on a clean copy first
• The light mode works on a shared database with tables of other programs
• A test run keeps signing with the test keys once the core ships the real ones

Technical notes:

• Breaking: the shipped config/security.php has error level 0 and no bans; config/modules.php has no row master
• The factory keys are still the test keys; release.php publish refuses them, so nothing can be published yet
• No schema, URL or API contract of the site changes

The update plan closes its batch 8: Backup gets a portion mode on a bare PDO, one part per call with the progress kept by the caller, so the installer can back up the database before its file phase and the rescuer can restore it without loading the core. Its entry is frozen in 8.0.0 as contract version 1.

Core changes:

1. Portion mode of Backup (core/classes/backup.php):
2. getSiteTables() lists the base tables of a prefix without those of a longer prefix that has its own _admins

3. checkDumpAccess() names the missing SELECT, INSERT, CREATE, DROP, and REFERENCES on MySQL with foreign keys

   • the rights come from SHOW GRANTS, nothing is written, so "Check installation" may call it

4. getDumpState() and addDumpPart() write parts 000001.sql.gz, at most one table and about 4 MB of SQL each

   • an integer key is read by seek, any other table by offset in key or full column order
   • every part is written under a temporary name and renamed, free space is checked before each one
   • the last part writes the index dump.json with the hash, table and rows of every part

5. getRestoreState() and addRestorePart() check the hash of a part, unpack it and run it

   • part 0 first drops every table of the prefix: the listed ones come back from their parts, the others were

created after the list was fixed

• head names the part that recreates the current table, where a caller resumes after a lost result

• A state or index of another format, an index with a table lacking contiguous parts, a damaged part, a finished dump in the directory, a prefix outside its grammar and a connection that does not throw are refused by name

• Parts shared by both modes (core/classes/backup.php):
• Grant reading, session state, columns and keys of a table are static and used by the full mode too
• A grant names its database as a LIKE pattern, so hosting grants on user_db or user_% prove the schema
• FLOAT and DOUBLE are written in their shortest exact form; the string cast of PHP cut them to 14 digits
• Tests (tests/Unit/BackupPartTest.php, tests/Support/dump_probe.php, tests/Unit/BackupContractTest.php):

• The probe loads only the class and config/db.php and runs every part of the dump and of two restores in a process of its own: in place after a failed step, and into an empty database

• Its schema holds a prefix ab, a longer prefix ab_x, a look-alike abc, MyISAM, a composite key, a keyless table, a stored generated column, a DOUBLE and a foreign key; tables are compared by rows and CHECKSUM TABLE

• A lost result inside a table is replayed from its head without a duplicate row
• An account with SELECT alone lacks INSERT, CREATE and DROP; an escaped pattern grant is enough
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md, docs/TESTS.md):
• Batch 8 and roadmap step 84 are closed; the contract v1 of the portion mode stands in "Installation"

Benefits:

• The database backup of an installation runs in short requests on any host and on any engine
• A restore never touches a table of another program sharing the database

Technical notes:

• Backup::FORMAT is 1; a change of the entry is version 2, and version 1 stays readable

• MariaDB 11.8 gives identical tables with a stored generated column different CHECKSUM TABLE values, so the probe compares such a table by its rows

• The light mode "Apply database steps" still takes the full dbbackup dump in one request
• No schema, URL or API contract of the site changes

The update plan closes its batch 7: the installer merges the missing options of the shipped config/ into the files of the site at any depth, while lists, field sets and the sections of Node types stay as the site holds them; the language files and the themes admin and lite are replaced whole without a stop, and the panel warns where they are edited. A delta now carries every settings file of config/, so the merge always sees the shipped state.

Core changes:

1. Settings merge (core/classes/update.php):

2. getConfigMerge() adds every missing key of the shipped value at any depth and names the paths it added

   • a list of the shipped value is taken whole, also at the top, a clash of shapes keeps the site value
   • a section of a Node type (node.types, fields.node, uploads, ratings 'node.<type>') present on the site is

kept, missing it is never added, so a deleted type never comes back

• a field set present on the site is kept whole, a new field set of the release is added
• modules.modules and scheduler.jobs merge recursively: new modules, jobs and keys of each entry arrive

• addConfigMerge($dir, $test) reads config/ of the package, checks the shape of both sides and writes only files with missing options; node, fields, uploads and ratings go in one Closure save of setConfigFile()

  • $test only names the paths, for "Check installation" of a later batch
  • a package with a Node file but no node.php is refused before anything is written
• Languages and themes (core/classes/update.php, admin/modules/lang.php, admin/modules/template.php, admin/lang/*.php):

• isSwapFile() and Update::THEMES: language files of lang/, admin/lang/ and both lang folders of a module, and the themes admin and lite; addStage() keeps them out of the stop list stage.changed

• _UPDATE_LANGS on the list and the editor of Languages, _UPDATE_THEMES on Templates and Styles of admin and lite, in six locales

• Release tool (tools/release.php):
• addDelta() puts every settings file of config/ into the delta, changed or not
• Help (admin/info/lang/ru.md, admin/info/template/ru.md, admin/info/update/ru.md):
• Language files and the two themes on update; their place in "Changed files" and "Check integrity"
• Tests (tests/Unit/UpdateMergeTest.php, tests/Support/config_probe.php, tests/Unit/UpdateFetchTest.php, tests/Unit/ReleaseToolTest.php):
• The probe mode merge runs the trial and the write on a scratch copy of config/
• A changed language file stays out of stage.changed; the delta carries an unchanged settings file
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
• Batch 7 and roadmap step 83 are closed; the owner's decisions on owned sections and on the delta are recorded

Benefits:

• A new option of a release reaches every site without overwriting what the site saved
• A deleted Node type or field never returns through an update

Technical notes:

• The string form of setConfigFile() stores scalars as strings, as every panel save does
• The merge has no caller yet: the installation of batch 9 runs it after the database steps
• Breaking change for release archives: a delta is larger by the settings files of config/

The update plan closes its batch 6: a site fetches the release the master offers now, resumes a broken download, accepts a manually uploaded archive only for that offer, reads the zip through its own central directory and unpacks it with ZipArchive or PharData into storage/update/client/stage/, checked against files.json of the package.

Core changes:

1. Update client, fetching and unpacking (core/classes/update.php):
2. getOffer() re-verifies the found manifest by the keys in force, getPackKind() takes a delta only on its exact from

3. addDownload() fetches master/file under work.lock through getRemoteLink(), shared with getRemote()

   • no longer than 40 s or half of max_execution_time, resumed by Range, a server without Range starts over
4. addUpload() tells a full archive from a delta by size and SHA-256

5. addStage() checks size and hash, reads the central directory by getZipList() and unpacks by addZipFiles()

   • refused: a path outside isPackagePath(), a Unix mode of no regular file, encryption, ZIP64, a case-insensitive

twin, a sum of usize beyond the manifest

• every entry is counted and hashed, the list is checked against files.json and, for a delta, the installed list
• stage/<version>.part becomes stage/<version>; PharData lets go of a refused archive by Phar::unlinkArchive()

• getChangedList(), addAudit() over the folders of AUDIT, deleteStage() when the found version changes or goes
• state.json carries stage, fault and audit
• Page "Updates" (admin/modules/update.php, admin/lang/*.php, admin/info/update/ru.md):
• The overview shows the package, the disk space, the last refusal and the integrity
• "Download" / "Continue download", "Check integrity" and the block "Upload archive"; the upload asks the master again
• 25 strings UPDATE* in six locales; the help takes sections 3 and 4
• addAudit() checks public/<name>.php of $conf['security']['afile'] against the entry public/admin.php
• Master schema and tests (modules/master/sql/table.sql, .gitignore, tests/Unit/UpdateFetchTest.php):

• table.sql of the module master missed git under the rule *.sql; rebuilt from the queries of the module and the probe, and .gitignore excepts modules//sql/.sql, so MasterTest runs on any copy

• UpdateFetchTest covers download, upload, the central directory, both readers and the audit
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
• Step 6 of the update plan and step 82 of the roadmap are closed
• Step 9 learns that the new public/admin.php of a package takes the place of public/<name>.php

Benefits:

• A release reaches the stage only whole, signed and matching its list, whatever the host offers for zip
• A slow host resumes instead of starting over, and a refused archive leaves no lock on Windows

Technical notes:

• New files of storage/update/client/: work.lock, tmp/, stage/; all gitignored
• No schema, URL or API contract of the site changes