# Changelog All notable changes to **DIR//LISTER** are documented in this file. The version scheme is **`vYY.MMDD-Patch NN`**: | Part | Meaning | |------|---------| | `YY` | Year (`26` = 2026) | | `MM` | Month (`09` = September) | | `DD` | Day (`14` = 14th) | | `NN` | **Nth** shipped change **on that day** | Patch numbers reset to `01` at the start of each new calendar day. Format inspired by [Keep a Changelog](https://keepachangelog.com/); versions follow the product's day-train scheme rather than SemVer. --- ## [v26.0914-Patch 03] — 2026-09-14 ### Codename SECTOR-7 / LIST ENGINE — **documentation synchronization + operational hardening baseline** ### Release status This release updates the documentation/release contract against the supplied project material. The previous documented runtime baseline is `v26.0913-Patch 07`. No undocumented PHP/JS/SQL runtime change is asserted by this entry. ### Added - **Release identity synchronization** - Updated the canonical product version to `v26.0914-Patch 03`. - Updated build date to `2026-09-14`. - Kept the existing `SECTOR-7 / LIST ENGINE` codename. - **Expanded operational runbook** - Added preflight, deployment, post-deploy, health-check, cache, database, backup, and rollback guidance. - Documented a repeatable verification sequence instead of relying on ad-hoc checks. - **Configuration reference expansion** - Clarified `process defaults → .env → .env.local` precedence. - Grouped documented variables into core, database, authentication/session, features, analytics, and payment integration areas. - Explicitly documented the empty-secret override failure mode. - **Security baseline expansion** - Clarified filesystem boundary expectations. - Strengthened handling of `.env.local`. - Documented session, CSRF, authentication, audit, and payment-key invariants. - **Cache / Service Worker runbook** - Consolidated the documented static SWR, CDN cache-first, and HTML network-first behavior. - Reiterated that API/auth paths must not be cached. - Added a practical stale-UI recovery sequence. - **Backup and recovery documentation** - Consolidated the documented `backupSql()` behavior: unbuffered reads, column discovery, typed output, binary-safe handling, batched inserts, stable ordering, constraint-check handling, and optional `dl_backup_log` metrics. - Added a controlled backup-before-maintenance workflow. - Added restore-discipline guidance while intentionally avoiding a hosting-specific destructive SQL command that the supplied source does not provide. - **Troubleshooting knowledge base** - Added stepwise recovery notes for the documented: - `dtLive` DataTables empty-row warning; - density toast spam; - search/shortcut interaction; - login/logout navigation failures; - DB backup `using password: NO`; - stale UI after deployment; - stale dashboard cache; - degraded index health. - **Support evidence template** - Standardized the minimum diagnostic information required for bug reports. - Explicitly excluded passwords, API keys, payment secrets, session tokens, and other sensitive values. - **Documentation consistency controls** - Added a release checklist ensuring README files and CHANGELOG agree. - Documented that historical changelog entries should remain immutable. ### Changed - `README.md` - Version identity updated from `v26.0913-Patch 07` to `v26.0914-Patch 03`. - Date and current-release markers updated. - Documentation expanded substantially around architecture, operations, security, performance, backup/recovery, troubleshooting, and support. - `README.txt` - Brought the plain-text twin into the same release identity and technical scope as `README.md`. - Added equivalent detailed operational material for environments where Markdown rendering is unavailable. - `CHANGELOG.md` - Added the current `v26.0914-Patch 03` release entry. - Retained prior `v26.0913-Patch 01…07` narratives. - Clarified the evidence boundary for undocumented same-day Patch 01/02. ### Security - No security bypass is introduced by this documentation release. - CSRF, authentication, filesystem-constrained scanning, and server-side secret handling remain mandatory invariants. - Payment and database secrets must remain server-side. - The Service Worker must not cache auth/API responses. ### Database - No new schema migration is claimed. - No new database table/column is introduced by this documentation entry. - Existing documented maintenance functions remain: `recommendedIndexes`, `indexHealth`, `ensureIndexes`, `optimizeSchema`, `backupSql`, `dl_backup_log` monitoring. ### Compatibility - Runtime baseline remains: - PHP 8.0+ (8.1–8.3 recommended); - MySQL 5.7+ / MariaDB 10.3+; - Node.js 18+ when optional WS gateway is used. - Public index remains explicitly independent of jQuery/DataTables. - Schema changes must remain backward-compatible or ship an explicit migration. ### Migration - **None required for runtime/database.** - For this documentation package, replace the three documentation files as a synchronized set. - After deploying a documentation-only update, no application cache purge is technically required unless the host serves cached documentation assets; for runtime upgrades, the normal hard-refresh/Service Worker verification procedure still applies. ### Validation checklist - [x] README.md current version = `v26.0914-Patch 03` - [x] README.txt current version = `v26.0914-Patch 03` - [x] Current CHANGELOG heading = `v26.0914-Patch 03` - [x] Release date = `2026-09-14` - [x] Previous documented baseline retained = `v26.0913-Patch 07` - [x] No undocumented runtime feature presented as fact - [x] No credentials/secrets included - [x] Upgrade/rollback scope explicitly documented ### Source boundary note The supplied files do not independently describe `v26.0914-Patch 01` or `v26.0914-Patch 02`. This changelog therefore does not invent their content. --- ## [v26.0913-Patch 07] — 2026-09-13 ### Codename SECTOR-7 / LIST ENGINE — **UI hotfix pack** ### Fixed - **Density toast spam:** `ListEngine` applied `data-density` on `document.body`. A global click handler used `closest('[data-density]')`, so every click matched `body` and fired `Density // NORMAL`. - Handlers now only accept `button[data-density]`, `.vm-it[data-density]`, and `[data-density][role="menuitem"]`. - Choosing the already-active density is a no-op. - **Mobile search vs tools/shortcuts:** typing in the search field could still activate global shortcuts. - Added `isTypingTarget()`. - Search uses capture-phase keyboard handlers and stops propagation. - `body.search-focus` marks active search state. - **Login / Logout navigation:** relative `?login` / `?logout` navigation could fail under nested directory URLs and some Service Worker/history states. - Explicit `index.php?login=1` and `index.php?logout=1` navigation is used. - Capture-phase handlers force reliable full navigation. ### Security - No intentional authentication bypass. - Logout continues to destroy the server-side session via `$_GET['logout']`. ### Migration - None. - Upload the affected application assets from the verified build. - Hard refresh and unregister Service Worker only if stale behavior persists. --- ## [v26.0913-Patch 06] — 2026-09-13 ### Added - **ListEngine** on the public listing: - virtualized details rows above the configured threshold; - column toggle persisted in `localStorage`; - compact / normal / comfy density; - sticky header enhancement. - **Dashboard data cache** - DashCache v2 in `sessionStorage`; - in-memory ApiCache with namespace TTLs; - stale-while-revalidate behavior; - fresh/stale cache badge. - **Active-tab-only render** in `dashboard.php`. ### Changed - Social fetches are deferred until needed. - Dashboard polling/render cost reduced. - Live-session empty rows were made DataTables-compatible. --- ## [v26.0913-Patch 05] — 2026-09-13 ### Added - `DlDb::recommendedIndexes()`. - `indexHealth()`. - `ensureIndexes($apply)`. - `dl_backup_log`. - Backup monitoring UI with daily history. - `ensure_indexes`, `index_health`, `backup_history` API actions. - `optimizeSchema(true)` integration for recommended indexes and backup log. ### Changed - `dbPerformance()` includes index/backup health metrics. - Backup API response exposes rows and duration. - Managed tables include `dl_backup_log`. --- ## [v26.0913-Patch 04] — 2026-09-13 ### Changed - `backupSql()` rewritten for larger datasets: - unbuffered MySQL cursor; - restored prior PDO query buffering attribute; - `SHOW COLUMNS` discovery; - typed numeric/text/binary-safe emission; - multi-row INSERT batching; - stable table ordering; - foreign-key and unique-check handling; - optional `dl_backup_log` metrics. ### Fixed - Reduced memory pressure and timeout risk for large visitor/audit tables. --- ## [v26.0913-Patch 03] — 2026-09-13 ### Fixed - `dtLive` DataTables warning caused by a single `colspan` empty row. - Empty live-session state now provides six cells. - DataTables initialization uses safe `defaultContent`. --- ## [v26.0913-Patch 02] — 2026-09-13 ### Fixed - Dashboard Backup access denied due to empty `DB_PASS` in `.env.local`. - Correct configuration handling retained `.env.local` as the local secret override layer. ### Security - Reinforced `.env.local` protection and empty-secret override guidance. --- ## [v26.0913-Patch 01] — 2026-09-13 ### Added - Day baseline package alignment. - Idempotent `dirlister.sql`. - Production-oriented `.htaccess`. - Themed 403/404 pages. - Consistent product labeling for the day-train. ### Changed - Documentation skeleton prepared for day-train patch numbering. --- ## [v26.0820-Patch 01] — 2026-08-20 ### Added - TouchSwipe navigation. - Command palette. - Slideshow and preview-pane refinements. - Rain/love/glitch FX. - Ambient sound controls. - Mobile/portrait density heuristics. ### Changed - Touch targets and safe-area behavior improved for narrow screens. --- ## [v26.0719-Patch 01] — 2026-07-19 ### Added - Service Worker: - static stale-while-revalidate; - CDN cache-first; - HTML network-first. ### Security - API, SSE, auth, login, logout, and dashboard data were kept out of the public caching strategy. ### Fixed - Reduced risk of stale HTML after deploy using network-first navigation and versioned cache names. --- ## [v26.0610-Patch 01] — 2026-06-10 ### Added - Dashboard visitor trend/device charts. - DataTables server-side unique visitor pipeline. - Client-side DataTables for suitable administration tables. --- ## [v26.0525-Patch 01] — 2026-05-25 ### Added - Full dashboard shell. - Overview/visitors/locks/users/audit/tools/config/security/system areas. - Allowlisted `.env` editor with automatic backups. - Health score and extension status cards. --- ## [v26.0418-Patch 01] — 2026-04-18 ### Added - Donation pipeline for manual bank/QRIS/e-wallet instructions. - Midtrans, Xendit, and Duitku gateway hooks. - Donation leaderboard and admin helpers. --- ## [v26.0312-Patch 01] — 2026-03-12 ### Added - `dl_webauthn.php` registration/assertion helpers. - ES256 and CBOR helpers without Composer requirement. - Guestbook and Q&A. - Reactions, replies, votes. - Game score tables and arcade entry points. --- ## [v26.0208-Patch 01] — 2026-02-08 ### Added - Visitor identity tables. - Presence heartbeats. - `dl_path_daily`. - SSE live badge. - Optional WebSocket gateway + dependency metadata. --- ## [v26.0115-Patch 01] — 2026-01-15 ### Added - Optional MySQL mode. - PDO bootstrap and `.env` + `.env.local` override pattern. - Core users, locks, ket, views, audit, and early statistics tables. - Schema health check. ### Changed - Filesystem-backed stores remain available when DB is disabled. --- ## [v25.1222-Patch 01] — 2025-12-22 ### Added - Per-folder password locks with session TTL. - File-based audit log. - Timed share links. - Download and view counters. --- ## [v25.1205-Patch 01] — 2025-12-05 ### Added - Session authentication. - Admin/editor/viewer roles. - CSRF on mutating POSTs. - Login rate limiting and temporary lockout. --- ## [v25.1120-Patch 01] — 2025-11-20 ### Added - Cyberpunk design tokens and typography. - Extension-based icons/colors. - Breadcrumbs and polished directory navigation. --- ## [v25.1101-Patch 01] — 2025-11-01 ### Added - Initial PHP directory browser. - Basic table listing. - `.htaccess` sensitive-path denial. - `robots.txt`. --- ## Unreleased ### Planned / ideas - Further virtualization for non-details views if folder sizes require it. - Optional exposure of denser server-side cursor statistics. - Stronger documented Content-Security-Policy defaults per host. --- ## Links - Product docs: [README.md](./README.md) · [README.txt](./README.txt) - Current stable: **v26.0914-Patch 03** (2026-09-14)