The update plan closes its batch 8: Backup gets a portion mode on a bare PDO, one part per call with the progress kept by the caller, so the installer can back up the database before its file phase and the rescuer can restore it without loading the core. Its entry is frozen in 8.0.0 as contract version 1.

Core changes:

1. Portion mode of Backup (core/classes/backup.php):
2. getSiteTables() lists the base tables of a prefix without those of a longer prefix that has its own _admins

3. checkDumpAccess() names the missing SELECT, INSERT, CREATE, DROP, and REFERENCES on MySQL with foreign keys

   • the rights come from SHOW GRANTS, nothing is written, so "Check installation" may call it

4. getDumpState() and addDumpPart() write parts 000001.sql.gz, at most one table and about 4 MB of SQL each

   • an integer key is read by seek, any other table by offset in key or full column order
   • every part is written under a temporary name and renamed, free space is checked before each one
   • the last part writes the index dump.json with the hash, table and rows of every part

5. getRestoreState() and addRestorePart() check the hash of a part, unpack it and run it

   • part 0 first drops every table of the prefix: the listed ones come back from their parts, the others were

created after the list was fixed

• head names the part that recreates the current table, where a caller resumes after a lost result

• A state or index of another format, an index with a table lacking contiguous parts, a damaged part, a finished dump in the directory, a prefix outside its grammar and a connection that does not throw are refused by name

• Parts shared by both modes (core/classes/backup.php):
• Grant reading, session state, columns and keys of a table are static and used by the full mode too
• A grant names its database as a LIKE pattern, so hosting grants on user_db or user_% prove the schema
• FLOAT and DOUBLE are written in their shortest exact form; the string cast of PHP cut them to 14 digits
• Tests (tests/Unit/BackupPartTest.php, tests/Support/dump_probe.php, tests/Unit/BackupContractTest.php):

• The probe loads only the class and config/db.php and runs every part of the dump and of two restores in a process of its own: in place after a failed step, and into an empty database

• Its schema holds a prefix ab, a longer prefix ab_x, a look-alike abc, MyISAM, a composite key, a keyless table, a stored generated column, a DOUBLE and a foreign key; tables are compared by rows and CHECKSUM TABLE

• A lost result inside a table is replayed from its head without a duplicate row
• An account with SELECT alone lacks INSERT, CREATE and DROP; an escaped pattern grant is enough
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md, docs/TESTS.md):
• Batch 8 and roadmap step 84 are closed; the contract v1 of the portion mode stands in "Installation"

Benefits:

• The database backup of an installation runs in short requests on any host and on any engine
• A restore never touches a table of another program sharing the database

Technical notes:

• Backup::FORMAT is 1; a change of the entry is version 2, and version 1 stays readable

• MariaDB 11.8 gives identical tables with a stored generated column different CHECKSUM TABLE values, so the probe compares such a table by its rows

• The light mode "Apply database steps" still takes the full dbbackup dump in one request
• No schema, URL or API contract of the site changes

The update plan closes its batch 7: the installer merges the missing options of the shipped config/ into the files of the site at any depth, while lists, field sets and the sections of Node types stay as the site holds them; the language files and the themes admin and lite are replaced whole without a stop, and the panel warns where they are edited. A delta now carries every settings file of config/, so the merge always sees the shipped state.

Core changes:

1. Settings merge (core/classes/update.php):

2. getConfigMerge() adds every missing key of the shipped value at any depth and names the paths it added

   • a list of the shipped value is taken whole, also at the top, a clash of shapes keeps the site value
   • a section of a Node type (node.types, fields.node, uploads, ratings 'node.<type>') present on the site is

kept, missing it is never added, so a deleted type never comes back

• a field set present on the site is kept whole, a new field set of the release is added
• modules.modules and scheduler.jobs merge recursively: new modules, jobs and keys of each entry arrive

• addConfigMerge($dir, $test) reads config/ of the package, checks the shape of both sides and writes only files with missing options; node, fields, uploads and ratings go in one Closure save of setConfigFile()

  • $test only names the paths, for "Check installation" of a later batch
  • a package with a Node file but no node.php is refused before anything is written
• Languages and themes (core/classes/update.php, admin/modules/lang.php, admin/modules/template.php, admin/lang/*.php):

• isSwapFile() and Update::THEMES: language files of lang/, admin/lang/ and both lang folders of a module, and the themes admin and lite; addStage() keeps them out of the stop list stage.changed

• _UPDATE_LANGS on the list and the editor of Languages, _UPDATE_THEMES on Templates and Styles of admin and lite, in six locales

• Release tool (tools/release.php):
• addDelta() puts every settings file of config/ into the delta, changed or not
• Help (admin/info/lang/ru.md, admin/info/template/ru.md, admin/info/update/ru.md):
• Language files and the two themes on update; their place in "Changed files" and "Check integrity"
• Tests (tests/Unit/UpdateMergeTest.php, tests/Support/config_probe.php, tests/Unit/UpdateFetchTest.php, tests/Unit/ReleaseToolTest.php):
• The probe mode merge runs the trial and the write on a scratch copy of config/
• A changed language file stays out of stage.changed; the delta carries an unchanged settings file
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
• Batch 7 and roadmap step 83 are closed; the owner's decisions on owned sections and on the delta are recorded

Benefits:

• A new option of a release reaches every site without overwriting what the site saved
• A deleted Node type or field never returns through an update

Technical notes:

• The string form of setConfigFile() stores scalars as strings, as every panel save does
• The merge has no caller yet: the installation of batch 9 runs it after the database steps
• Breaking change for release archives: a delta is larger by the settings files of config/

The update plan closes its batch 6: a site fetches the release the master offers now, resumes a broken download, accepts a manually uploaded archive only for that offer, reads the zip through its own central directory and unpacks it with ZipArchive or PharData into storage/update/client/stage/, checked against files.json of the package.

Core changes:

1. Update client, fetching and unpacking (core/classes/update.php):
2. getOffer() re-verifies the found manifest by the keys in force, getPackKind() takes a delta only on its exact from

3. addDownload() fetches master/file under work.lock through getRemoteLink(), shared with getRemote()

   • no longer than 40 s or half of max_execution_time, resumed by Range, a server without Range starts over
4. addUpload() tells a full archive from a delta by size and SHA-256

5. addStage() checks size and hash, reads the central directory by getZipList() and unpacks by addZipFiles()

   • refused: a path outside isPackagePath(), a Unix mode of no regular file, encryption, ZIP64, a case-insensitive

twin, a sum of usize beyond the manifest

• every entry is counted and hashed, the list is checked against files.json and, for a delta, the installed list
• stage/<version>.part becomes stage/<version>; PharData lets go of a refused archive by Phar::unlinkArchive()

• getChangedList(), addAudit() over the folders of AUDIT, deleteStage() when the found version changes or goes
• state.json carries stage, fault and audit
• Page "Updates" (admin/modules/update.php, admin/lang/*.php, admin/info/update/ru.md):
• The overview shows the package, the disk space, the last refusal and the integrity
• "Download" / "Continue download", "Check integrity" and the block "Upload archive"; the upload asks the master again
• 25 strings UPDATE* in six locales; the help takes sections 3 and 4
• addAudit() checks public/<name>.php of $conf['security']['afile'] against the entry public/admin.php
• Master schema and tests (modules/master/sql/table.sql, .gitignore, tests/Unit/UpdateFetchTest.php):

• table.sql of the module master missed git under the rule *.sql; rebuilt from the queries of the module and the probe, and .gitignore excepts modules//sql/.sql, so MasterTest runs on any copy

• UpdateFetchTest covers download, upload, the central directory, both readers and the audit
• Plans (docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
• Step 6 of the update plan and step 82 of the roadmap are closed
• Step 9 learns that the new public/admin.php of a package takes the place of public/<name>.php

Benefits:

• A release reaches the stage only whole, signed and matching its list, whatever the host offers for zip
• A slow host resumes instead of starting over, and a refused archive leaves no lock on Windows

Technical notes:

• New files of storage/update/client/: work.lock, tmp/, stage/; all gitignored
• No schema, URL or API contract of the site changes

Step 78, batch 2 of docs/11-UPDATE-2026.md: the core of the connector without clients. A path v<n>/<service>/<action> reaches a core service or the api.php of an active module through the guards of .rules/api.md in their fixed order, and every reply is the envelope or, for an action that declares reply file, a stored file. Beside it the admin stand gets hover panels on its cockpit, the presentation shows the real OPcache, and the spelling "кеш" becomes the standard of the panel.

Core changes:

1. Router (core/classes/api/router.php, error.php, client.php):

2. getResponse() runs route, maintenance and switches, CORS, the flood of the address, auth, size and input, then the handler; every refusal is an ApiError of the closed code list

   • An action with a key or a secret answers 401 until the clients of the connector exist; a public one is called

with the guest ApiClient

• A preflight is answered 204 without auth; a foreign Origin is 403, a listed one is echoed on every reply

• A request reads only the service its path names; a declaration with an unknown key, a key action without a scope of its service, a public action that is not GET or an unknown param type is refused whole, logged, and answers 500

• The common.php of a module loads after the last guard; a fault of a handler is logged under the request id and answers 500 internal without a word of the reason

• setApiReply() writes the envelope, a 204 without body or type, or hands a file to getFileStream()

  • The mode file takes only a file below storage/update/ or the upload root, so a slip sends no dump or journal
  • A reply that cannot be encoded becomes 500 internal; a public cached action is public, max-age only without

Authorization

1. Input and limits (core/classes/api/input.php, limit.php, core/classes/cache.php):

2. ApiInput reads the declared params by type: num, word, text, json, ver; a param without def is required, an undeclared one is dropped, a refusal is the 422 that names the param; a body must be a JSON object

3. ApiLimit keeps a token bucket per address in the file cache under a keyed hash; IPv6 counts by its /64 and a mapped IPv4 as IPv4

4. Cache::setDirPath() becomes public for the buckets
5. Services and settings (core/classes/api/services/system.php, config/api.php, tools/api.http, .gitignore):

6. system/ping answers the empty success; system/schema is the live reference of the public actions, built from the declarations and kept a minute by a public cache

7. config/api.php holds active, maint, off, the global CORS list and the limits flood, burst and size
8. tools/api.http carries the requests for the REST Client; tools/.env is ignored
9. Tests (tests/Unit/ApiRouterTest.php, tests/Support/route_probe.php, tests/Unit/ApiEntryTest.php):

10. The probe mode router writes three modules for the run and proves the route, versions, the order of the guards pair by pair, typed input, the envelope, the crash log, CORS, the switches, the flood and the mode file

11. ApiInput and ApiLimit are also tested in-process; ApiEntryTest expects the answering system/ping

12. Admin stand and presentation (public/demo/admin/*, modules/presentation/index.php, theme lite presentation.css, partials/presentation-hero.html):

13. Every ring and the lamp of the cockpit open the bell panel on hover; the lamp lists only broken signals
14. The cache ring of the presentation shows the hit rate of the real OPcache, or off when it is disabled

15. The lamp of the presentation is the one-colour mark of the theme masked in the tone of the state, no second coloured logo beside the header

16. Spelling and documentation (admin/lang/ru.php, admin/info/*, modules/changelog/admin/info/ru.md, config/presentation.php, docs/*):

17. "кеш" instead of "кэш" in the constants, the help and the presentation text

18. .rules/api.md gains the action key reply (owner, 2026-10-15); docs/2027-CONNECTOR.md, docs/ARCHITECTURE.md, docs/2027-ADMIN-UX.md, the plan and the roadmap follow

Benefits:

• A module offers an API by one declaration file, without a line of the core naming it
• Every refusal has one shape, and no reply of the API carries a reason, a path or HTML

Technical notes:

• New config file config/api.php; a site without it runs the API on with the shipped limits
• No schema or URL change; the site and the panel answer as before
• Full phpunit green: 1865 tests, 24889 assertions, 14 skipped

Step 77, batch 1 of docs/11-UPDATE-2026.md: a path under /api/ defines API_FILE and boots the core without theme, template, parser, visual classes, session or the layer of the user, and ApiRouter answers it before a line of the site runs. The router knows no route yet, so every path answers 404 no_route; the guards and the services follow in batch 2.

Core changes:

1. Entry (public/index.php, core/stream.php):
2. A path under api/ is the branch of the API, taken after the light path of uploads/ and before the site

3. getUploadRequest() becomes getRequestPath($dir), which reads both uploads/ and api/

   • MODULE_FILE stays defined in the API, core/stream.php needs it before the branch is known
4. Light core (core/system.php, core/classes/api/router.php):

5. Under API_FILE the core loads config, database, security, logger, cache, mail, geoip, route, the class map of Node and the helpers; theme, Template, Parser, captcha, oauth, field, point, rating, comment, quick, privat, editor, core/user.php and core/admin.php stay out

6. ApiRouter::getResponse() returns the reply, ApiRouter::setApiReply() is the one writer of status, headers and the envelope of .rules/api.md: ok, data or error with code and text, meta with id, ver, ms and now

   • A valid X-Request-Id is echoed, any other is replaced; every reply is no-store and nosniff
7. Security in the API (core/security.php, core/classes/pdo.php):
8. No cut of the path, no ?error= page, no session, no flood check by session, no visitor or language cookie

9. The request scan of the site is skipped: ApiInput is the filter of the API, so v=../8.0.1 becomes a 422 there and never a ban of the caller here

10. Errors are never displayed; a ban answers 403 no_scope, a lost database, an uncaught exception or a fatal error 500 internal, all in JSON without a word of the reason

11. Tests (tests/Unit/ApiEntryTest.php, tests/Support/route_probe.php, tests/Support/route_web.php):

12. The probe mode entry drives the real index.php and admin.php: the envelope, the files the light core loads, the session state at the end of a request, a deep path, a POST, a HEAD, the scan, a ban, a lost database, and the site and the panel beside it

    • Five deliberate regressions of the core were each caught by the test
13. Documentation (docs/ARCHITECTURE.md, docs/11-UPDATE-2026.md, docs/ROADMAP-2026.md):
14. The entry of the API in "Entry Points"; step 1 of the plan and step 77 of the roadmap closed

Benefits:

• A fault of a page can never render into a reply of the API, and a reply of the API never carries HTML
• An API request costs no theme, template or session

Technical notes:

• No schema, URL or config change; the site, the panel and setup.php answer as before

• Full phpunit: 1855 tests, one failure in AssetVersionTest from a stale config/local.php of the stand after a change of presentation.css outside this step; green after the cache was rebuilt