Step 78, batch 2 of docs/11-UPDATE-2026.md: the core of the connector without clients. A path v<n>/<service>/<action> reaches a core service or the api.php of an active module through the guards of .rules/api.md in their fixed order, and every reply is the envelope or, for an action that declares reply file, a stored file. Beside it the admin stand gets hover panels on its cockpit, the presentation shows the real OPcache, and the spelling "кеш" becomes the standard of the panel.

Core changes:

1. Router (core/classes/api/router.php, error.php, client.php):

2. getResponse() runs route, maintenance and switches, CORS, the flood of the address, auth, size and input, then the handler; every refusal is an ApiError of the closed code list

   • An action with a key or a secret answers 401 until the clients of the connector exist; a public one is called

with the guest ApiClient

• A preflight is answered 204 without auth; a foreign Origin is 403, a listed one is echoed on every reply

• A request reads only the service its path names; a declaration with an unknown key, a key action without a scope of its service, a public action that is not GET or an unknown param type is refused whole, logged, and answers 500

• The common.php of a module loads after the last guard; a fault of a handler is logged under the request id and answers 500 internal without a word of the reason

• setApiReply() writes the envelope, a 204 without body or type, or hands a file to getFileStream()

  • The mode file takes only a file below storage/update/ or the upload root, so a slip sends no dump or journal
  • A reply that cannot be encoded becomes 500 internal; a public cached action is public, max-age only without

Authorization

1. Input and limits (core/classes/api/input.php, limit.php, core/classes/cache.php):

2. ApiInput reads the declared params by type: num, word, text, json, ver; a param without def is required, an undeclared one is dropped, a refusal is the 422 that names the param; a body must be a JSON object

3. ApiLimit keeps a token bucket per address in the file cache under a keyed hash; IPv6 counts by its /64 and a mapped IPv4 as IPv4

4. Cache::setDirPath() becomes public for the buckets
5. Services and settings (core/classes/api/services/system.php, config/api.php, tools/api.http, .gitignore):

6. system/ping answers the empty success; system/schema is the live reference of the public actions, built from the declarations and kept a minute by a public cache

7. config/api.php holds active, maint, off, the global CORS list and the limits flood, burst and size
8. tools/api.http carries the requests for the REST Client; tools/.env is ignored
9. Tests (tests/Unit/ApiRouterTest.php, tests/Support/route_probe.php, tests/Unit/ApiEntryTest.php):

10. The probe mode router writes three modules for the run and proves the route, versions, the order of the guards pair by pair, typed input, the envelope, the crash log, CORS, the switches, the flood and the mode file

11. ApiInput and ApiLimit are also tested in-process; ApiEntryTest expects the answering system/ping

12. Admin stand and presentation (public/demo/admin/*, modules/presentation/index.php, theme lite presentation.css, partials/presentation-hero.html):

13. Every ring and the lamp of the cockpit open the bell panel on hover; the lamp lists only broken signals
14. The cache ring of the presentation shows the hit rate of the real OPcache, or off when it is disabled

15. The lamp of the presentation is the one-colour mark of the theme masked in the tone of the state, no second coloured logo beside the header

16. Spelling and documentation (admin/lang/ru.php, admin/info/*, modules/changelog/admin/info/ru.md, config/presentation.php, docs/*):

17. "кеш" instead of "кэш" in the constants, the help and the presentation text

18. .rules/api.md gains the action key reply (owner, 2026-10-15); docs/2027-CONNECTOR.md, docs/ARCHITECTURE.md, docs/2027-ADMIN-UX.md, the plan and the roadmap follow

Benefits:

• A module offers an API by one declaration file, without a line of the core naming it
• Every refusal has one shape, and no reply of the API carries a reason, a path or HTML

Technical notes:

• New config file config/api.php; a site without it runs the API on with the shipped limits
• No schema or URL change; the site and the panel answer as before
• Full phpunit green: 1865 tests, 24889 assertions, 14 skipped

Step 77, batch 1 of docs/11-UPDATE-2026.md: a path under /api/ defines API_FILE and boots the core without theme, template, parser, visual classes, session or the layer of the user, and ApiRouter answers it before a line of the site runs. The router knows no route yet, so every path answers 404 no_route; the guards and the services follow in batch 2.

Core changes:

1. Entry (public/index.php, core/stream.php):
2. A path under api/ is the branch of the API, taken after the light path of uploads/ and before the site

3. getUploadRequest() becomes getRequestPath($dir), which reads both uploads/ and api/

   • MODULE_FILE stays defined in the API, core/stream.php needs it before the branch is known
4. Light core (core/system.php, core/classes/api/router.php):

5. Under API_FILE the core loads config, database, security, logger, cache, mail, geoip, route, the class map of Node and the helpers; theme, Template, Parser, captcha, oauth, field, point, rating, comment, quick, privat, editor, core/user.php and core/admin.php stay out

6. ApiRouter::getResponse() returns the reply, ApiRouter::setApiReply() is the one writer of status, headers and the envelope of .rules/api.md: ok, data or error with code and text, meta with id, ver, ms and now

   • A valid X-Request-Id is echoed, any other is replaced; every reply is no-store and nosniff
7. Security in the API (core/security.php, core/classes/pdo.php):
8. No cut of the path, no ?error= page, no session, no flood check by session, no visitor or language cookie

9. The request scan of the site is skipped: ApiInput is the filter of the API, so v=../8.0.1 becomes a 422 there and never a ban of the caller here

10. Errors are never displayed; a ban answers 403 no_scope, a lost database, an uncaught exception or a fatal error 500 internal, all in JSON without a word of the reason

11. Tests (tests/Unit/ApiEntryTest.php, tests/Support/route_probe.php, tests/Support/route_web.php):

12. The probe mode entry drives the real index.php and admin.php: the envelope, the files the light core loads, the session state at the end of a request, a deep path, a POST, a HEAD, the scan, a ban, a lost database, and the site and the panel beside it

    • Five deliberate regressions of the core were each caught by the test
13. Documentation (docs/ARCHITECTURE.md, docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
14. The entry of the API in "Entry Points"; step 1 of the plan and step 77 of the roadmap closed

Benefits:

• A fault of a page can never render into a reply of the API, and a reply of the API never carries HTML
• An API request costs no theme, template or session

Technical notes:

• No schema, URL or config change; the site, the panel and setup.php answer as before

• Full phpunit: 1855 tests, one failure in AssetVersionTest from a stale config/local.php of the stand after a change of presentation.css outside this step; green after the cache was rebuilt

Three audits of docs/11-UPDATE-2026.md were checked against the code and folded in. The site fetches releases only from slaed.net, the installer comes from the verified new package while the installed rescue keeps the way back, and the parts of 8.0.0 that no later release can fix are frozen as contract version 1.

Core changes:

1. Sources, signature and release (docs/11-UPDATE-2026.md):

2. The client fetches only from slaed.net, with no redirect; GitHub Releases stay for people, and a GitHub mirror can come in 8.x if the traffic of slaed.net demands it

   • the manifest carries no URL; versions are strictly X.Y.Z, the code name is the constant SLAED_CODENAME

3. Order of a release: build, sign, rehearse, publish; the tag stays local until publish

   • publish refuses test factory keys and an archive without a green rehearsal of its hash
   • build refuses an archive grown by more than 20 % until --max confirms it
   • the delta compares two files.json lists; the first release after 8.0 is an empty 8.0.1
4. A pause withdraws the offer: the found version is reset and a manual upload needs the manifest the master serves now
5. Installation and rollback (docs/11-UPDATE-2026.md):

6. Contract version 1 frozen in 8.0.0: the apply.lock schema, the backup layout, the entry of the portioned dump, and the call of the rescue by the entry guard

7. The executor run/apply.php is copied from the verified new package; core/rescue.php is replaced only at step 8

8. All three entry points answer 503 before the core while apply.lock exists or the schema lags the code; the rescue form goes straight to the installed rescue

9. The new Backup mode dumps in portions without InnoDB and only the table list of the site fixed at preflight; the restore drops only tables created by the failed install

10. Database steps run before the config merge in the light boot UPDATE_FILE, with its own admin login; the manual path goes through it on a closed site

11. Every rollback returns files, config/ with the step marks and the database, then clears opcache, config/local.php and the page and asset caches

12. The config merge is recursive with lists kept whole; config/ files stay out of the integrity check and deletion
13. Preflight checks opcache reset rights and the database privileges of the dump; a self-check and a dry run follow
14. Master (docs/11-UPDATE-2026.md):
15. master/file is read-only; the rollout cohort is crc32 of sid and version; the flood guard counts IPv6 per /64
16. The scheduler task masterwatch pauses a release by its failure rate and mails the owner
17. Help in the panel (docs/11-UPDATE-2026.md):

18. admin/info/update/ru.md and modules/master/admin/info/ru.md are written by the step that builds each part; the help of the scheduler, languages and templates follows; a step is not done without its help

19. Roadmap (docs/ROADMAP-2026.md, docs/2027-ADMIN-UX.md):
20. The update plan is batches 0-11 at steps 76-87; the database batch is split from the installation batch
21. DIAL moves to step 88 after the updater; Close stays last at 89

Benefits:

• A fault of the installer is fixed by the next release instead of being frozen into every site
• No path of the plan runs new code on an old schema or overwrites tables of another installation

Technical notes:

• Plans only; no code, theme or schema change

The Phoenix stand had fifteen separate faces of the logo; three of them are merged into one screensaver of sixty seconds that starts after a rest of the hand, runs in a circle and fades out when the hand comes back. A second stand page lets the owner hear and choose the sounds of messages, mentions, alerts, wins and moderation before a standard of sound is written.

Core changes:

1. Screensaver (public/demo/assets/phoenix.js):

2. One scene on its own clock in acts: the page dims to 75% while the code of the system rains in, sparks rise from the code into a giant A, the A falls to ash, the ash takes fire into the big logo whose letters grow around the A, the logo falls to ash and flies pixel by pixel into the header, falls again and becomes the real logo

   • one particle for the whole scene, a square of smouldering ash; colours change by ramps, dots sit on whole

screen pixels, the rain is made of lines of core/system.php

• the quiet: ash rises from the foot of the page and every six seconds the beam of the installer crosses the

letters of the logo, sparks leave the A and the version badge flashes

• Chance comes from a seed and the ash moves in fixed steps, so any second can be reached by seeking

• Screensaver rules: it starts after the chosen rest on the page (60 s by default), loops while nobody wakes it, a move, a key, a wheel or a scroll fades it out in 0.8 s; the quiet stays on as the ground of the page

  • the measures of a round are taken when it starts, the beam follows the logo where it is now
  • prefers-reduced-motion and the Motion option skip the scene and show the end state
• The fourteen other faces and their machinery are removed
• Stand player (public/demo/phoenix.html):

• The dock is a player: play and pause, a stopwatch, a scrubber, chapters per act, speed 1/4, 1/2 and 1, the rest before the screensaver (10 s, 60 s, 5 min, off) and Launch (R)

  • its clicks and keys neither wake nor count as the hand on the page; a paused player is left alone
• Styles (public/demo/assets/phoenix-fx.css):

• Only what the screensaver uses: the ground over and under the page, the dimming veil next to it, the badge that springs out and shines with every beam

• Sound lab (public/demo/snd-01-lab.html):

• Zones with variants: personal messages in and out, mentions and replies, alerts in their five theme tones (error, warn, success, info, accent, each with a silent choice), wins, the moderation queue

  • synthesised voices in D minor, the key of the Phoenix theme, and three cuts of its strongest moments

• Rules shown live: a sound always with a counter and the number in the tab title, one sound per category in 2.5 s, quiet on an open tab for what comes from others, full for the answer to one's own action, only alerts that appear sound, the silent switch of the phone where Safari allows it

• A master switch in sl.sound (1 or 0) next to sl.motion; zones, variants and volume in sl.sound.set

Benefits:

• One screensaver that tells the return of the system and gets out of the way the moment it is not wanted
• The sounds are chosen by ear on a working page before any of them goes into the theme

Technical notes:

• Stand pages only (public/demo/); no theme, core or schema change
• Music in the screensaver was weighed and left out: it is the default effect of the system

Readable addresses are the only form of a page address since 2026-10-14. The README and the help of the settings now state the one thing a server must do for them, so an installation on a server without the rule does not end with a start page that opens and every other page answering 404.

Core changes:

1. Requirements (README.md):

2. Web Server names Apache or LiteSpeed with mod_rewrite and nginx with the server block of nginx.conf.example

   • another PHP-capable server (IIS, Caddy) needs its own rule: every path that is no file or folder goes to index.php

3. The server section adds what happens without that rule: the start page opens, every other page gets the 404 of the server

4. Help of the settings (admin/info/config/ru.md):

5. Page addresses and canonical: readable addresses are the only form and cannot be turned off; the separators / and - are fixed

   • the server rule, public/.htaccess for Apache and LiteSpeed, try_files of nginx.conf.example for nginx

Benefits:

• An administrator learns the server requirement before the installation, not from a site that answers 404

Technical notes:

• Text only; no code, template or schema change