# PHP 0.7.8 — validated release

- Complete: durable username_N allocation, initial activation collision recovery after remote identity checks, stable retry names, admin display of service name. No active client renames or duplicate grants.
- Files changed: Commerce, Panel, AdminView, schema, check, panel-name-migration.sql, mock and MySQL tests, upgrade guide and version labels.
- Validation: 105 checks passed; 33 PHP lint passes. Collision with occupied _1 advances to _2, preserves old remote client and retries one grant after lost response.
- Build: PHP ready; unchanged APK 0.7.5.
- Remaining: production deployment and retry affected order. Existing multi-purchase model retains one service per account.
- Next: import panel-name-migration.sql, deploy package, run check.php and retry existing stuck order. Do not delete/recreate it.

# PHP 0.7.7 — tested release

- Complete: all-state order override and physical purge, receipt/payment cleanup, free claim cleanup, worker state recheck, redacted panel rejection reason and operation, redundant update avoidance, read-only order-check CLI.
- Files changed: Management, ManagementView, Portal, Commerce, Panel, Diagnostics, version labels, order-check.php, test fixtures/regressions, upgrade guide.
- Validation: 103 checks passed (21 baseline, 29 mock, 11 payment SQL, 42 account SQL); 33 PHP lint passes. Initial reused test DB key mismatch resolved by recreating only isolated nava_test database.
- Build: PHP 0.7.7 ready. No Android changes; existing APK 0.7.5.
- Remaining: actual production PANEL_REJECTED cause unconfirmed; deploy and obtain improved rejection reason.
- Next: deploy package, check.php, retry affected order once and run order-check.php with its order id. Do not recreate the subscription or erase an order just to diagnose it.

# PHP 0.7.6 — implementation and validation complete

- Completed: independent managed URL rebasing, manual overrides, link archive/restore, absolute quota/expiry queue, unpaid order edit/cancel, order archive/restore, stage-specific diagnostics.
- Changed: SubscriptionLinks, Management, ManagementView, RuntimeSettings, Subscription, Commerce, Panel, Portal, AdminView, Diagnostics, bootstrap, check, schema, migration, tests and upgrade guide.
- Validation: 21 baseline + 26 mock + 10 payment/MySQL + 25 account/management/MySQL = 82 passed. 32 PHP files passed lint.
- Build: PHP release ready; no Android changes. APK 0.7.5 retained.
- Remaining: deployment and real upstream 503 diagnosis with new subscription base URL.
- Next: import migration, deploy folders, run check.php, save new base and test. Keep worker Cron active.

# WORK_STATUS — 0.7.5 implementation and build complete

- Completed: PHP subscription fetching/usage fallback/diagnosis/repair, Bearer normalization/atomic settings, retryable free activation, modern panel update compatibility, independent Android account refresh and batched connection config retrieval.
- Tests: 71 PHP/mock/MySQL checks passed; 29 PHP files passed lint; 14 Android tests passed. Reports: validation/VALIDATION-0.7.5.md and associated logs/XML.
- Latest build: BUILD SUCCESSFUL (September 12, 2026), assembleLiveDebug + testLiveDebugUnitTest, 43 tasks executed.
- APK: com.nava.vpn, version 0.7.5, code 10; signature v2 verified with the retained previous certificate. Four native ABIs; API http://hosting.stormvps.ir/api; DEMO=false, TRIAL=false.
- APK SHA-256: 177316d81260dacf86c55a07e420f44a7d8ab2427f28848c5874e11328277445
- Release outputs: output/Nava-0.7.5.apk, output/nava-cpanel-0.7.5.zip, output/nava-project-0.7.5.zip, output/UPGRADE-0.7.5.md and output/SHA256-0.7.5.json. Reusable packaging: scripts/package-release.py.
- Remaining outside this environment: deploy the PHP update to the existing cPanel account; inspect/repair the affected account's stored URL using its admin page; install the APK and test an actual phone connection. No remote deployment or physical-device connection is claimed.
- Exact next step for the user: follow php/UPGRADE-0.7.5.md, updating the backend before the APK. Preserve the existing config, keys, receipts and database.
- Do not restart completed implementation, dependency investigation or test stages. Historical checkpoints below explain the interrupted build environments.

## Historical checkpoints

# WORK_STATUS — current checkpoint

- Current source: 0.7.5, Android version code 10; all implementation below has been recovered byte-for-byte from the saved checkpoint.
- Completed validation: 21 PHP baseline + 26 mock-panel regression + 10 payment/MySQL + 14 account/MySQL checks passed; 29 PHP files passed lint. Do not rerun completed stages without a new risk.
- September 12 runtime reset interrupted the Android build. Restored source and retained signing key; restored complete JDK 17, SDK 35, build-tools 35.0.0 and Gradle 8.11.1. SDK archive checksums verified.
- Current build: assembleLiveDebug and testLiveDebugUnitTest running; log validation/android-build-0.7.5.log. No new APK yet.
- Next: finish this build, fix actual compile errors if any, verify signing, package APK/PHP/source and save deliverables.

## Earlier checkpoints (historical)

# WORK_STATUS — 0.7.5 debugging

- Prior release preserved: PHP 0.7.4, Android Live 0.7.0/code 9. Historical logs: android/WORK_STATUS.md.
- Runtime outage rolled workspace back to 0.7.4. Recovery is restoring the already designed 0.7.5 changes, not restarting the project.
- Recovered evidence: supplied sub returned HTTP 200, full numeric quota headers and one VLESS/WS server with both Nava and Hiddify user agents. The affected account's saved URL is still unverified.
- Saved work recovered separately: Subscription-0.7.5-in-progress.php. Other pending files were not finalized before outage and are being restored from the recorded patches.
- Baseline 21 PHP checks passed in the interrupted environment; this is not validation of the finished 0.7.5 changes.
- Remaining: restore changes, regression tests, Android refresh/batch configs, signed APK, deployment ZIP.
- Next: finish restoring Core/Diagnostics/Panel/RuntimeSettings dependencies, then execute PHP tests using isolated CLI tools.

## Restored implementation and verified PHP regression checkpoint
- Restored PHP changes and added mock-panel.php/regression.php. Public cPanel entrypoints now find nava-backend outside public_html.
- Added independent concurrent Android account refresh, batch config retrieval, longer read timeout and readable non-JSON error; code 10/version 0.7.5. Three AccountRefresh tests added.
- Results: 21 baseline PHP checks pass; 26 executed regression checks pass against a local HTTP panel (including post-commit failure/retry with one creation, top-up, status toggles, ownership, quota fallback, mixed parsing, redirects, gzip and diagnostics).
- Files changed: PHP src/{Core,Diagnostics,RuntimeSettings,Subscription,Panel,Commerce,Api,Portal,AdminView,bootstrap}, bin/{worker,panel-check,subscription-check}, public_html/api/{_bootstrap,index,admin,payment}; Android {Api,AppModel,AccountRefresh,MainActivity,app/build.gradle.kts,AccountRefreshTest}; tests and validation reports.
- Build: Android assembleLiveDebug and testLiveDebugUnitTest running. Full PHP lint results are in validation/php-lint.log.
- Remaining: fix Build failures, verify signature, validate DB workflows if runtime supports isolated MySQL, package/save final ZIP and APK.
- Exact next step: inspect validation/android-build-0.7.5.log and complete build. Do not repeat implementation or finished tests without a new risk.

## Database and application integration verified
- Completed: 10 receipt/payment MySQL checks and 14 MySQL + mock panel + account API checks, all passed. Covered free claim retry with one two-GiB grant, actual account dashboard/configs, paid data/time changes, encrypted settings/atomic rollback, account-specific link diagnosis and repair.
- Files added: php/nava-backend/tests/mysql-regression.php; validation/mysql-regression.log; validation/mysql-manual.log.
- Build finding: inherited GRADLE_OPTS pointed at an unreachable old proxy and overrode the current Java proxy settings. Build restarted with the current environment proxy and certificate for this invocation.
- Remaining: finish Android compilation/unit tests, package signed APK and deployment/source ZIPs, update instructions and persist outputs.
- Exact next step: inspect the running Android build log and address compile/test errors if any. Database implementation and completed tests do not need repeating.

## Deployment guide and final PHP lint
- Completed: current Persian cPanel/upgrade guides replace outdated statements; old guides preserved under docs/history. Session startup failure now reports SESSION_STORAGE instead of continuing into repeated CSRF errors.
- Files changed: README.md, php/{README-CPANEL,UPGRADE-0.7.5}.md, php/nava-backend/src/Portal.php, validation/php-lint.log.
- Validation: all 29 PHP files pass syntax checks; earlier 71 PHP/mock/MySQL checks are complete.
- Latest Android result: dependency resolution succeeded; build stopped because the provided Java installation has no JAVA_COMPILER capability. Installing the matching JDK compiler into isolated tooling.
- Remaining: Android compile/tests/signature; final deliverables.
- Exact next step: extract openjdk-17-jdk-headless, set JAVA_HOME to the complete JDK and resume the same cached Live build.

## September 12 recovery
- Completed: restored the saved checkpoint without reimplementing files; byte-for-byte comparison passed. Retained signing certificate SHA-256: 11668bb87625d058be2c81cdec67abeaef200b02539d56f8d9af4bb2edc3abe0.
- Checked the existing local reference source of modern 3x-ui: client get returns obj.client with UUID/subId/limitHwid; update accepts a flattened model.Client plus limitHwid. The retained adapter matches this format.
- No additional production panel mutation, payment or database operation occurred.
- Latest build: restarted after restoring missing build tools. Dependencies are downloading into the new runtime.
- Next: complete Kotlin/Java compilation and unit tests, then verify and immediately save the APK together with source/deployment artifacts.