chore: promote changelog [Unreleased] → [02.65.00]

# Conflicts:
#	.mokogit/workflows/issue-branch.yml

.gitattributes

@@ -49,7 +49,7 @@
 *.eot binary
 
 # Export ignore (not included in archives)
-.mokogitea/ export-ignore
+.mokogit/ export-ignore
 .editorconfig export-ignore
 .gitattributes export-ignore
 .gitignore export-ignore

.mokogit/CLAUDE.md

@@ -7,7 +7,7 @@ Full-site backup and restore for Joomla — database, files, and configuration.
 | Field | Value |
 |---|---|
 | **Package** | `pkg_mokosuitebackup` |
-| **Language** | PHP 8.1+ |
+| **Language** | PHP 8.3+ |
 | **Branch** | develop on `dev`, merge to `main` (protected) |
 | **Wiki** | [MokoSuiteBackup Wiki](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteBackup/wiki) |
 
@@ -29,7 +29,7 @@ Joomla **package** with four sub-extensions:
 ### com_mokosuitebackup (Component)
 - Admin backend for managing backup profiles and records
 - Backup engine: `Engine/BackupEngine`, `Engine/DatabaseDumper`, `Engine/FileScanner`, `Engine/Archiver`
-- Joomla 4/5 MVC: Controllers, Models, Views, Tables
+- Joomla 6 MVC: Controllers, Models, Views, Tables
 - Namespace: `Joomla\Component\MokoSuiteBackup\Administrator`
 - DB tables: `#__mokosuitebackup_profiles`, `#__mokosuitebackup_records`
 - CLI: `cli/mokosuitebackup.php` for cron-based backups
@@ -57,15 +57,15 @@ Joomla **package** with four sub-extensions:
 
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, `*.min.css`/`*.min.js`
 - **Attribution**: `Authored-by: Moko Consulting`
-- **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
+- **Workflow directory**: `.mokogit/` (not `.gitea/` or `.github/`)
 - **Minification**: handled at build time (CI)
-- **Wiki**: documentation lives in the MokoGitea wiki, not `docs/` files
-- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)
+- **Wiki**: documentation lives in the MokoGIT wiki, not `docs/` files
+- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogit/wiki)
 
 ## Coding Standards
 
-- PHP 8.1+ minimum
-- Joomla 4/5 DI container pattern: `services/provider.php` → Extension class
+- PHP 8.3+ minimum (Joomla 6)
+- Joomla 6 DI container pattern: `services/provider.php` → Extension class
 - Legacy stub `.php` file required for plugin loader but empty
 - `SubscriberInterface` for event subscription (not `on*` method naming)
 - `bind() → check() → store()` for Table operations (not `save()`)

.mokogit/workflows/auto-bump.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/auto-bump.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/auto-bump.yml
 # VERSION: 09.02.00
 # BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
 
@@ -22,7 +22,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 permissions:
   contents: write
@@ -34,17 +34,16 @@ jobs:
     if: >-
       !contains(github.event.head_commit.message, '[skip ci]') &&
       !contains(github.event.head_commit.message, '[skip bump]') &&
-      !startsWith(github.event.head_commit.message, 'Merge pull request') &&
-      !startsWith(github.event.repository.name, 'Template-')
+      !startsWith(github.event.head_commit.message, 'Merge pull request')
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           fetch-depth: 1
 
-      - name: Setup mokocli tools
+      - name: Setup MokoCLI tools
         run: |
           if ! command -v composer &> /dev/null; then
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
@@ -53,7 +52,7 @@ jobs:
             echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
           else
             git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/MokoCLI.git" \
+              "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
               /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
@@ -63,5 +62,5 @@ jobs:
         run: |
           php ${MOKO_CLI}/version_auto_bump.php \
             --path . --branch "${GITHUB_REF_NAME}" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+            --token "${{ secrets.MOKOGIT_TOKEN }}" \
+            --repo-url "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

.mokogit/workflows/auto-release.yml

@@ -3,18 +3,18 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/auto-release.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/universal/auto-release.yml.template
 # VERSION: 05.01.00
-# BRIEF: Universal build & release � detects platform from manifest.xml
+# BRIEF: Universal build & release � detects platform from MokoGIT repo metadata (API)
 #
 # +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
 # +=======================================================================+
 # |                                                                        |
-# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
+# |  Reads MokoGIT repo metadata (joomla|dolibarr|generic) to branch logic. |
 # |                                                                        |
 # |  Platform-specific:                                                    |
 # |    joomla:   XML manifest, type-prefixed packages                      |
@@ -31,7 +31,7 @@ on:
     branches:
       - main
     paths-ignore:
-      - '.mokogitea/workflows/**'
+      - '.mokogit/workflows/**'
       - '*.md'
       - 'wiki/**'
       - '.editorconfig'
@@ -52,9 +52,9 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
 permissions:
   contents: write
@@ -77,13 +77,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           fetch-depth: 1
           submodules: recursive
 
-      - name: Setup mokocli tools
+      - name: Setup MokoCLI tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
@@ -95,7 +95,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -104,58 +104,30 @@ jobs:
 
       - name: Rename branch to rc
         run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
-          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
-          PR="${{ github.event.pull_request.number }}"
-
-          # Resolve the source branch HEAD commit.
-          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
-            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
-          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
-          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
-
-          # Point rc at the source commit. If rc already exists (a protected branch that
-          # cannot be deleted), force-update its ref in place instead of delete+recreate:
-          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
-          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
-            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
-            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
-              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
-          else
-            echo "Creating rc from ${FROM}"
-            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
-              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
-          fi
-
-          # Repoint the PR at rc, then delete the old source branch (non-fatal).
-          if [ -n "$PR" ]; then
-            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
-          fi
-          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
-          echo "Renamed ${FROM} -> rc"
+          php ${MOKO_CLI}/branch_rename.php \
+            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" \
+            --api-base "${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}" \
+            --pr "${{ github.event.pull_request.number }}"
 
       - name: Checkout rc and configure git
         run: |
           git fetch origin rc
           git checkout rc
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogit-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
         run: |
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            --token "${{ secrets.MOKOGIT_TOKEN }}"
 
       - name: Update RC release notes from CHANGELOG.md
         run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Extract [Unreleased] section from changelog
           NOTES=""
@@ -208,15 +180,15 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           fetch-depth: 0
           submodules: recursive
 
       - name: Configure git for bot pushes
         run: |
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogit-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
         run: |
@@ -231,9 +203,9 @@ jobs:
           fi
           echo "No conflict markers found"
 
-      - name: Setup mokocli tools
+      - name: Setup MokoCLI tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
         run: |
@@ -246,7 +218,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -280,7 +252,7 @@ jobs:
           fi
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability stable ${BUMP_FLAG} --branch main \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            --token "${{ secrets.MOKOGIT_TOKEN }}"
 
       - name: "Read published version"
         id: version
@@ -307,8 +279,8 @@ jobs:
           !startsWith(steps.platform.outputs.platform, 'joomla')
         run: |
           VERSION="${{ steps.version.outputs.version }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
           SEMVER_TAG="v${VERSION}"
 
           echo "Creating semver tag: ${SEMVER_TAG}"
@@ -332,8 +304,8 @@ jobs:
 
       - name: Update release notes and promote changelog
         run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Get the stable release info (version and ID)
           RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
@@ -382,7 +354,7 @@ jobs:
           content = open('CHANGELOG.md').read()
           old = '## [Unreleased]'
           new = f'## [Unreleased]\n\n## [{version}] --- {date}'
-          content = content if ('## [' + version + ']') in content else content.replace(old, new, 1)
+          content = content.replace(old, new, 1)
           open('CHANGELOG.md', 'w').write(content)
           " "$VERSION" "$DATE"
             git add CHANGELOG.md
@@ -401,10 +373,10 @@ jobs:
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
           GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/release_mirror.php \
             --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
             --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
             --branch main 2>&1 || true
           echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
@@ -430,8 +402,8 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           # Delete rc branch (ephemeral — created by promote-rc)
           curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
@@ -446,8 +418,8 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           BRANCH_NAME="version/${VERSION}"
           MAIN_SHA=$(git rev-parse HEAD)
@@ -467,9 +439,9 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/version_reset_dev.php \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "${API_BASE}" \
             --branch dev --path . 2>&1 || true
 
       # -- Summary --------------------------------------------------------------
@@ -493,5 +465,5 @@ jobs:
             echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Release | [View](${MOKOGITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${MOKOGIT_URL}/${GIT_ORG}/${GIT_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
           fi

.mokogit/workflows/branch-cleanup.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Universal
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/branch-cleanup.yml
+# PATH: /.mokogit/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
 
@@ -30,14 +30,25 @@ jobs:
 
     steps:
       - name: Delete source branch
+        # SECURITY: the PR head ref is attacker-controllable. Pass it (and the
+        # repo/token) through env so the Actions engine cannot splice it into the
+        # shell source, and validate it to a safe charset before use.
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          REPO: ${{ github.repository }}
+          API_BASE: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
-          BRANCH="${{ github.event.pull_request.head.ref }}"
-          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
+          set -euo pipefail
+          if ! printf '%s' "${BRANCH}" | grep -Eq '^[A-Za-z0-9._/-]+$'; then
+            echo "::error::unsafe branch name; refusing to proceed"; exit 1
+          fi
+          API="${API_BASE}/api/v1/repos/${REPO}/branches"
           # URL-encode the branch name's slashes (no PHP dependency on the runner)
           ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
 
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
-            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+            -H "Authorization: token ${MOKOGIT_TOKEN}" \
             "${API}/${ENCODED}" 2>/dev/null || true)
 
           if [ "$STATUS" = "204" ]; then

.mokogit/workflows/cascade-dev.yml

@@ -0,0 +1,65 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# BRIEF: Reset dev to main after each release (cascade). Moved out of auto-release Step 11.
+#
+# +========================================================================+
+# |                        CASCADE MAIN -> DEV                              |
+# +========================================================================+
+# |  dev mirrors main and is reset on every release.                       |
+# |  delete+recreate cannot run against a protected branch, so this        |
+# |  force-pushes main -> dev. The automation identity is force-push       |
+# |  allowlisted on dev via branch-protection.yml.                         |
+# |  Runs AFTER the release workflow completes, so dev picks up the        |
+# |  fully version-bumped + changelog-promoted main (not the pre-bump      |
+# |  state). Force-push (not merge) => no version-file conflicts.          |
+# +========================================================================+
+
+name: "Cascade Main -> Dev"
+
+on:
+  workflow_run:
+    workflows: ["Universal: Build & Release"]
+    types: [completed]
+  workflow_dispatch:
+
+concurrency:
+  group: cascade-dev-${{ github.repository }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  cascade:
+    name: Reset dev to main
+    if: >-
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (github.event_name == 'workflow_dispatch' ||
+       github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Force dev to main
+        env:
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          git init -q sync && cd sync
+          git config user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config user.name  "mokogit-actions[bot]"
+          git remote add origin "https://x-access-token:${TOKEN}@${SERVER#https://}/${REPO}.git"
+          git fetch -q --depth=1 origin main
+
+          if git ls-remote --exit-code --heads origin dev >/dev/null 2>&1; then
+            # dev exists -> force it to match main (dev is a mirror of main)
+            git push --force origin FETCH_HEAD:refs/heads/dev
+            echo "dev reset to main" >> "$GITHUB_STEP_SUMMARY"
+          else
+            # dev missing (e.g. renamed to rc mid-cycle) -> recreate from main
+            git push origin FETCH_HEAD:refs/heads/dev
+            echo "dev created from main" >> "$GITHUB_STEP_SUMMARY"
+          fi

.mokogit/workflows/ci-generic.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.CI
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-generic.yml
+# PATH: /.mokogit/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
 
@@ -131,11 +131,10 @@ jobs:
   test:
     name: Tests
     runs-on: ubuntu-latest
-    # Independent job (no `needs: lint`): the Gitea Actions scheduler does not
-    # offer the dependent 2nd job of a needs-chain to runners, so it stalls in
-    # "waiting" and is reaped by ABANDONED_JOB_TIMEOUT. Guard template repos
-    # directly (same condition lint uses) instead of gating on lint's result.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
+    needs: lint
+    # Run only when lint succeeded; always() forces evaluation so a skipped
+    # lint (e.g. template repos) skips this job cleanly instead of hanging.
+    if: ${{ always() && needs.lint.result == 'success' }}
 
     steps:
       - name: Checkout

.mokogit/workflows/ci-issue-reporter.yml

@@ -3,12 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-issue-reporter.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
+# BRIEF: Reusable workflow — creates/updates a MokoGIT issue when a CI gate fails.
 #        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
 
 name: "Universal: CI Issue Reporter"
@@ -35,7 +35,7 @@ on:
         type: string
         default: ""
     secrets:
-      MOKOGITEA_TOKEN:
+      MOKOGIT_TOKEN:
         required: true
 
 env:
@@ -49,16 +49,16 @@ jobs:
     steps:
       - name: Clone MokoCLI
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+          MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 --filter=blob:none --sparse "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
           cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
 
       - name: Report CI failure
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
           /tmp/mokocli/cli/ci_issue_reporter.sh \

.mokogit/workflows/cleanup.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/cleanup.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
 
@@ -21,7 +21,7 @@ permissions:
   contents: write
 
 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   cleanup:
@@ -33,17 +33,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
 
       - name: Delete merged branches
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           echo "=== Merged Branch Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
 
           # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
             "${API}/branches?limit=50" | jq -r '.[].name')
 
           DELETED=0
@@ -56,7 +56,7 @@ jobs:
             # Check if branch is merged into main
             if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
               echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${MOKOGIT_TOKEN}" \
                 "${API}/branches/${BRANCH}" 2>/dev/null || true
               DELETED=$((DELETED + 1))
             fi
@@ -66,20 +66,20 @@ jobs:
 
       - name: Clean old workflow runs
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           echo "=== Workflow Run Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
           CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
 
           # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
             "${API}/actions/runs?status=completed&limit=50" | \
             jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
 
           DELETED=0
           for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${MOKOGIT_TOKEN}" \
               "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
             DELETED=$((DELETED + 1))
           done

.mokogit/workflows/gitleaks.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /.mokogitea/workflows/gitleaks.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/gitleaks.yml.template
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #
@@ -34,7 +34,7 @@ permissions:
 
 env:
   NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'git-security' }}
 
 jobs:
   gitleaks:

.mokogit/workflows/issue-branch.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Automation
-# VERSION: 02.59.00
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Automation
+# VERSION: 02.65.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"
@@ -19,7 +19,7 @@ permissions:
   issues: write
 
 env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   create-branch:
@@ -27,14 +27,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create branch and comment
+        # SECURITY: never interpolate github.event.* into a run: script — the
+        # Actions engine splices the raw value into the shell source (command
+        # injection via a crafted issue title). Pass everything through env so
+        # the values arrive as ordinary shell variables that are not re-parsed.
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUM: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
         run: |
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
-          ISSUE_NUM="${{ github.event.issue.number }}"
-          ISSUE_TITLE="${{ github.event.issue.title }}"
+          TOKEN="${MOKOGIT_TOKEN}"
+          API="${MOKOGIT_URL}/api/v1/repos/${REPO}"
 
-          # Build slug from title: lowercase, replace non-alnum with dash, trim
-          SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+          # Build slug from title: lowercase, replace non-alnum with dash, trim.
+          # printf (not echo) so a title beginning with "-" is not read as flags.
+          SLUG=$(printf '%s' "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
           BRANCH="feature/${ISSUE_NUM}-${SLUG}"
 
           # Check dev branch exists
@@ -58,7 +66,7 @@ jobs:
             echo "Created branch: ${BRANCH}"
 
             # Comment on issue with branch link
-            REPO_URL="${MOKOGITEA_URL}/${{ github.repository }}"
+            REPO_URL="${MOKOGIT_URL}/${REPO}"
             BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
 
             curl -sf -X POST \

.mokogit/workflows/notify.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/notify.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
 
@@ -26,7 +26,7 @@ permissions:
 
 env:
   NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-releases' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'git-releases' }}
 
 jobs:
   notify:

.mokogit/workflows/pr-check.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.CI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/pr-check.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.CI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge
 
@@ -47,15 +47,15 @@ jobs:
               fi
               ;;
             fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ]; then
                 ALLOWED=false
-                REASON="Fix branches must target 'dev' or 'main', not '${BASE}'"
+                REASON="Fix branches must target 'dev', not '${BASE}'"
               fi
               ;;
             patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
                 ALLOWED=false
-                REASON="Patch branches must target 'dev', 'rc', or 'main', not '${BASE}'"
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
               fi
               ;;
             hotfix/*)
@@ -86,8 +86,7 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
             echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`patch/*\` → \`dev\`, \`rc\`, or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
@@ -97,80 +96,6 @@ jobs:
           echo "Branch policy: OK (${HEAD} → ${BASE})"
           echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
 
-  # ── Docs Update Gate (main PRs) ─────────────────────────────────────────
-  require-docs:
-    name: Require Docs Update
-    runs-on: ubuntu-latest
-    # Enforce only on PRs merging into main: README.md + CHANGELOG.md must both be updated.
-    if: ${{ github.base_ref == 'main' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Require README.md and CHANGELOG.md in the PR diff
-        run: |
-          BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-          CHANGED="$(git diff --name-only "$BASE" "$HEAD" 2>/dev/null || true)"
-          if [ -z "$CHANGED" ]; then
-            git fetch -q origin "${{ github.base_ref }}" 2>/dev/null || true
-            CHANGED="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" 2>/dev/null || true)"
-          fi
-          echo "Changed files in PR:"
-          echo "$CHANGED"
-          MISSING=""
-          echo "$CHANGED" | grep -qxE 'README\.md' || MISSING="README.md"
-          echo "$CHANGED" | grep -qxE 'CHANGELOG\.md' || MISSING="${MISSING:+$MISSING, }CHANGELOG.md"
-          if [ -n "$MISSING" ]; then
-            echo "::error::PRs into main must update: ${MISSING}"
-            {
-              echo "## Docs Update Required"
-              echo ""
-              echo "PRs merging into \`main\` must update both **README.md** and **CHANGELOG.md**."
-              echo ""
-              echo "Not updated in this PR: **${MISSING}**"
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 1
-          fi
-          echo "Docs update present (README.md + CHANGELOG.md)"
-          echo "## Docs Update: Passed" >> "$GITHUB_STEP_SUMMARY"
-
-  # ── Wiki Update Reminder (main PRs, non-blocking) ───────────────────────
-  wiki-reminder:
-    name: Wiki Update Reminder
-    runs-on: ubuntu-latest
-    if: ${{ github.base_ref == 'main' }}
-    steps:
-      - name: Remind to update the wiki
-        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-          REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-        run: |
-          set -uo pipefail
-          {
-            echo "## Wiki Update Reminder"
-            echo ""
-            echo "Docs are **wiki-first** at MokoConsulting. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
-            echo ""
-            echo "- ${SERVER}/${REPO}/wiki"
-            echo ""
-            echo "_Non-blocking reminder._"
-          } >> "$GITHUB_STEP_SUMMARY"
-          # Post a single PR comment (idempotent via hidden marker); best-effort, never fails.
-          API="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
-          if [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; then
-            existing="$(curl -sf -H "Authorization: token ${TOKEN}" "$API" 2>/dev/null | grep -c 'wiki-reminder' || true)"
-            if [ "${existing:-0}" -eq 0 ]; then
-              curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -X POST "$API" \
-                -d '{"body":"<!-- wiki-reminder -->\n\n**Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_"}' >/dev/null 2>&1 || true
-            fi
-          fi
-          echo "Wiki reminder emitted (non-blocking)."
-
   # ── Secret Scanning ──────────────────────────────────────────────────
   gitleaks:
     name: Secret Scan
@@ -210,7 +135,7 @@ jobs:
 
       - name: Check for merge conflict markers
         run: |
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --exclude-dir='.git' --exclude-dir='.mokogitea' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
           if [ -n "$CONFLICTS" ]; then
             echo "::error::Merge conflict markers found in source files"
             echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
@@ -224,7 +149,7 @@ jobs:
       - name: Detect platform
         id: platform
         run: |
-          # Platform comes from the MokoGitea metadata API (public GET); manifest.xml is no longer used.
+          # Platform comes from the MokoGIT metadata API (public GET); manifest.xml is no longer used.
           API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
           PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
           [ -z "$PLATFORM" ] && PLATFORM="generic"
@@ -350,7 +275,7 @@ jobs:
             joomla)
               MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
               if [ -z "$MANIFEST" ]; then
-                echo "::warning::No Joomla manifest found (MokoSuite site)"
+                echo "::warning::No Joomla manifest found (WaaS site)"
                 exit 0
               fi
               echo "Manifest: ${MANIFEST}"
@@ -360,10 +285,10 @@ jobs:
               for ELEMENT in name version description; do
                 grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
               done
-              # Block legacy raw/branch update server URLs on MokoGitea
-              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
+              # Block legacy raw/branch update server URLs on MokoGIT
+              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogit\|git\.mokoconsulting\.tech' || true)
               if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the MokoGitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGIT. Use the MokoGIT Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                 echo "$RAW_URLS"
                 exit 1
               fi
@@ -577,12 +502,12 @@ jobs:
     steps:
       - name: Trigger RC pre-release
         env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.head_ref }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
-          curl -s -X POST             "${MOKOGITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${MOKOGIT_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGIT_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
           echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
           echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
 
@@ -593,7 +518,7 @@ jobs:
     if: >-
       always() &&
       needs.validate.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+    uses: ./.mokogit/workflows/ci-issue-reporter.yml
     with:
       gate: "PR Validation"
       workflow: "PR Check"

.mokogit/workflows/pr-metadata-check.yml

@@ -3,12 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: mokocli.Validation
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Validation
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /templates/workflows/joomla/pr-metadata-check.yml.template
 # VERSION: 01.00.00
-# BRIEF: Validate MokoGitea metadata matches Joomla extension manifest on PRs
+# BRIEF: Validate MokoGIT metadata matches Joomla extension manifest on PRs
 
 name: "Joomla: Metadata Validation"
 
@@ -20,22 +20,24 @@ permissions:
   contents: read
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
 jobs:
   validate-metadata:
     name: "Validate Joomla Metadata"
     runs-on: ubuntu-latest
+    # Skip on template repos (Template-*) — they have no real extension manifest to validate.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup mokocli tools
+      - name: Setup MokoCLI tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           if [ -f /opt/mokocli/cli/joomla_metadata_validate.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
@@ -55,14 +57,14 @@ jobs:
 
       - name: Validate metadata against Joomla manifest
         env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           php ${MOKO_CLI}/joomla_metadata_validate.php \
             --path . \
-            --token "${GITEA_TOKEN}" \
-            --org "${GITEA_ORG}" \
-            --repo "${GITEA_REPO}" \
-            --api-base "${GITEA_URL}/api/v1" \
+            --token "${MOKOGIT_TOKEN}" \
+            --org "${GIT_ORG}" \
+            --repo "${GIT_REPO}" \
+            --api-base "${MOKOGIT_URL}/api/v1" \
             --ci
 
           if [ $? -ne 0 ]; then

.mokogit/workflows/pre-release.yml

@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/pre-release.yml
-# VERSION: 05.02.01
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/universal/pre-release.yml.template
+# VERSION: 05.02.00
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 
 name: "Universal: Pre-Release"
@@ -40,9 +40,9 @@ permissions:
   contents: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
 jobs:
   build:
@@ -61,7 +61,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN }}
           ref: ${{ github.ref_name }}
           submodules: recursive
 
@@ -69,9 +69,9 @@ jobs:
         run: |
           git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
 
-      - name: Setup mokocli tools
+      - name: Setup MokoCLI tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
@@ -84,7 +84,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
@@ -156,30 +156,24 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogit-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {
             git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
-            # Push the bump commit, but do NOT fail the release if the target branch
-            # is protected and the release identity is not on the push allowlist.
-            # The build proceeds from the in-tree bumped version regardless; if the
-            # push is rejected, the next run simply re-bumps from the same base.
-            if ! git push origin HEAD 2>&1; then
-              echo "::warning::Version-bump commit could not be pushed (protected branch?). Building from in-tree version ${VERSION} anyway."
-            fi
+            git push origin HEAD 2>&1
           }
 
           # Auto-detect element via manifest_element.php
           php ${MOKO_CLI}/manifest_element.php \
             --path . --version "$VERSION" --stability "$STABILITY" \
-            --repo "${GITEA_REPO}" --github-output
+            --repo "${GIT_REPO}" --github-output
 
           # Read back element outputs
           EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
           ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
-          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GIT_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
           [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"
 
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
@@ -197,18 +191,18 @@ jobs:
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/release_create.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-            --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GIT_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
       - name: Update release notes from CHANGELOG.md
         if: steps.eligibility.outputs.proceed == 'true'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
 
           # Extract [Unreleased] section from changelog (everything between [Unreleased] and next ## heading)
           if [ -f "CHANGELOG.md" ]; then
@@ -219,7 +213,7 @@ jobs:
           fi
 
           # Update release body via API
-          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
             "${API_BASE}/releases/tags/${TAG}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
 
           if [ -n "$RELEASE_ID" ]; then
@@ -231,7 +225,7 @@ jobs:
               '${API_BASE}/releases/${RELEASE_ID}',
               data=payload, method='PATCH',
               headers={
-                  'Authorization': 'token ${{ secrets.MOKOGITEA_TOKEN }}',
+                  'Authorization': 'token ${{ secrets.MOKOGIT_TOKEN }}',
                   'Content-Type': 'application/json'
               })
           urllib.request.urlopen(req)
@@ -245,21 +239,21 @@ jobs:
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           TAG="${{ steps.meta.outputs.tag }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           php ${MOKO_CLI}/release_package.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-            --repo "${GITEA_REPO}" --output /tmp || true
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GIT_REPO}" --output /tmp || true
 
-      # updates.xml is generated dynamically by MokoGitea license server
+      # updates.xml is generated dynamically by MokoGIT license server
       # No need to build, commit, or sync updates.xml from workflows
 
       - name: "Delete lesser pre-release channels (cascade)"
         if: steps.eligibility.outputs.proceed == 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
 
           php ${MOKO_CLI}/release_cascade.php \
             --stability "${{ steps.meta.outputs.stability }}" \
@@ -280,4 +274,4 @@ jobs:
           echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
           echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
           echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY

.mokogit/workflows/rc-revert.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/rc-revert.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
 
@@ -25,16 +25,15 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'rc/') &&
-      !startsWith(github.event.repository.name, 'Template-')
+      startsWith(github.event.pull_request.head.ref, 'rc/')
 
     steps:
       - name: Rename branch
         env:
           BRANCH: ${{ github.event.pull_request.head.ref }}
           REPO: ${{ github.repository }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           set -euo pipefail
           # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
@@ -43,7 +42,7 @@ jobs:
           fi
           SUFFIX="${BRANCH#rc/}"
           DEV_BRANCH="dev/${SUFFIX}"
-          API="${GITEA_URL}/api/v1/repos/${REPO}/branches"
+          API="${GIT_URL}/api/v1/repos/${REPO}/branches"
 
           # Create dev/ branch from rc/ branch
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \

.mokogit/workflows/repo-health.yml

@@ -6,10 +6,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Validation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/repo-health.yml
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Validation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/joomla/repo_health.yml.template
 # VERSION: 09.23.00
 # BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
 # ============================================================================
@@ -45,7 +45,7 @@ env:
   SCRIPTS_ALLOWED_DIRS: scripts,scripts/fix,scripts/lib,scripts/release,scripts/run,scripts/validate
 
   # Repo health policy
-  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogitea/workflows/
+  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogit/workflows/
   REPO_OPTIONAL_FILES: SECURITY.md,GOVERNANCE.md,.editorconfig,.gitattributes,.gitignore,README.md,docs/
   REPO_DISALLOWED_DIRS:
   REPO_DISALLOWED_FILES: TODO.md,todo.md
@@ -56,7 +56,7 @@ env:
   # File / directory variables
   DOCS_INDEX: docs/docs-index.md
   SCRIPT_DIR: scripts
-  WORKFLOWS_DIR: .mokogitea/workflows
+  WORKFLOWS_DIR: .mokogit/workflows
   SHELLCHECK_PATTERN: '*.sh'
   SPDX_FILE_GLOBS: '*.sh,*.php,*.js,*.ts,*.css,*.xml,*.yml,*.yaml'
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -77,7 +77,7 @@ jobs:
       - name: Check actor permission (admin only)
         id: perm
         env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           ACTOR: ${{ github.actor }}
         run: |
@@ -88,14 +88,14 @@ jobs:
 
           # Hardcoded authorized users — always allowed
           case "$ACTOR" in
-            jmiller|mokogitea-actions[bot])
+            jmiller|mokogit-actions[bot])
               ALLOWED=true
               PERMISSION=admin
               METHOD="hardcoded allowlist"
               ;;
             *)
               # Detect platform and check permissions via API
-              API_BASE="${GITHUB_API_URL:-${GITEA_API_URL:-https://api.github.com}}"
+              API_BASE="${GITHUB_API_URL:-${GIT_API_URL:-https://api.github.com}}"
               RESP=$(curl -sf -H "Authorization: token ${TOKEN}" \
                 "${API_BASE}/repos/${REPO}/collaborators/${ACTOR}/permission" 2>/dev/null || echo '{}')
               PERMISSION=$(echo "$RESP" | grep -oP '"permission"\s*:\s*"\K[^"]+' || echo "unknown")
@@ -605,7 +605,7 @@ jobs:
             printf '%s\n' '| Domain | Status | Notes |'
             printf '%s\n' '|---|---|---|'
             printf '%s\n' '| Access control | OK | Admin-only execution gate |'
-            printf '%s\n' '| Release policy | N/A | Releases handled by MokoGitea |'
+            printf '%s\n' '| Release policy | N/A | Releases handled by MokoGIT |'
             printf '%s\n' '| Scripts governance | OK | Directory policy and advisory reporting |'
             printf '%s\n' '| Repo required artifacts | OK | Required, optional, disallowed enforcement |'
             printf '%s\n' '| Repo content heuristics | OK | Brand, license, changelog structure |'
@@ -677,7 +677,7 @@ jobs:
     if: >-
       always() &&
       needs.scripts_governance.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+    uses: ./.mokogit/workflows/ci-issue-reporter.yml
     with:
       gate: "Scripts Governance"
       workflow: "Repo Health"
@@ -691,7 +691,7 @@ jobs:
     if: >-
       always() &&
       needs.repo_health.result == 'failure'
-    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+    uses: ./.mokogit/workflows/ci-issue-reporter.yml
     with:
       gate: "Repository Health"
       workflow: "Repo Health"

.mokogit/workflows/version-set.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow.Template
-# INGROUP: MokoStandards.CI
+# DEFGROUP: MokoGIT.Workflow.Template
+# INGROUP: MokoCLI.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
-# PATH: /.mokogitea/workflows/version-set.yml
+# PATH: /.mokogit/workflows/version-set.yml
 # VERSION: 01.00.00
 # BRIEF: Set or reset the extension version across all version-bearing files
 
@@ -34,7 +34,6 @@ jobs:
   set-version:
     name: Set Version to ${{ inputs.version }}
     runs-on: ubuntu-latest
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Validate version format
@@ -49,7 +48,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
+          token: ${{ secrets.MOKOGIT_TOKEN || github.token }}
           ref: ${{ inputs.branch || github.ref }}
           fetch-depth: 1
 

.mokogitea/workflows/cascade-dev.yml

@@ -1,106 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Cascade
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/cascade-dev.yml
-# VERSION: 02.00.00
-# BRIEF: Cascade main -> dev via PR; auto-merge only if conflict-free, else notify
-
-name: "Cascade Main -> Dev"
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  # ntfy destination is configured via repo or org variables (org vars are inherited).
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'gitea-releases' }}
-
-jobs:
-  cascade:
-    name: Cascade main -> dev
-    runs-on: ubuntu-latest
-    steps:
-      - name: Open main -> dev PR (auto-merge if clean, else notify)
-        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -uo pipefail
-          API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
-          AUTH="Authorization: token ${TOKEN}"
-          jqnum() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
-
-          # 0. dev must exist
-          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
-            echo "No dev branch - nothing to cascade."; exit 0
-          fi
-
-          # 1. is main ahead of dev?
-          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
-            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
-          if [ "${AHEAD:-0}" -eq 0 ]; then
-            echo "dev already up to date with main."; exit 0
-          fi
-          echo "main is ${AHEAD} commit(s) ahead of dev."
-
-          # 2. reuse an open main->dev PR, else create one
-          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
-            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
-          if [ -z "$PR" ]; then
-            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
-              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges only if conflict-free; otherwise left open for manual resolution."}')
-            PR=$(printf '%s' "$RESP" | jqnum number)
-            if [ -z "$PR" ]; then
-              echo "::warning::Could not open cascade PR: $RESP"; exit 0
-            fi
-            echo "Opened cascade PR #${PR}"
-          else
-            echo "Reusing open cascade PR #${PR}"
-          fi
-
-          # 3. wait for MokoGitea to compute mergeability (conflict detection)
-          MERGEABLE=""
-          for _ in 1 2 3 4 5 6; do
-            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqnum mergeable)
-            case "$MERGEABLE" in True|False) break ;; esac
-            sleep 3
-          done
-          echo "mergeable=${MERGEABLE}"
-
-          notify() {
-            curl -sS \
-              -H "Title: ${REPO}: dev cascade needs manual merge" \
-              -H "Tags: warning,twisted_rightwards_arrows" \
-              -H "Priority: high" \
-              -H "Click: ${MOKOGITEA_URL}/${REPO}/pulls/${PR}" \
-              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
-              "${NTFY_URL}/${NTFY_TOPIC}" || true
-          }
-
-          # 4. auto-merge only if conflict-free; otherwise notify
-          if [ "$MERGEABLE" = "True" ]; then
-            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
-              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
-            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
-              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
-            else
-              echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
-              notify "could not be auto-merged (HTTP ${CODE})."
-            fi
-          else
-            echo "::warning::Cascade PR #${PR} has conflicts (mergeable=${MERGEABLE}); sending notification."
-            notify "has conflicts and cannot be merged automatically."
-          fi

.mokogitea/workflows/ci-joomla.yml

@@ -1,903 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# This file is part of a Moko Consulting project.
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow.Template
-# INGROUP: MokoStandards.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
-# PATH: /templates/workflows/joomla/ci-joomla.yml.template
-# VERSION: 04.06.00
-# BRIEF: CI workflow for Joomla extensions — lint, validate, test
-
-name: "Joomla: Extension CI"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - 'dev/**'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: write
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  lint-and-validate:
-    name: Lint & Validate
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-          fi
-          php -v && composer --version
-
-      - name: Setup mokocli tools
-        env:
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.MOKOGITEA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-        run: |
-          if [ -d "/opt/mokocli" ] || [ -d "/tmp/mokocli" ]; then
-            echo "mokocli already available on runner — skipping clone"
-          else
-            git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git" \
-              /tmp/mokocli 2>/dev/null || echo "mokocli clone skipped — continuing without it"
-          fi
-
-      - name: Install dependencies
-        env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || secrets.GA_TOKEN || github.token }}"}}'
-        run: |
-          if [ -f "composer.json" ]; then
-            composer install \
-              --no-interaction \
-              --prefer-dist \
-              --optimize-autoloader
-          else
-            echo "No composer.json found — skipping dependency install"
-          fi
-
-      - name: PHP syntax check
-        run: |
-          ERRORS=0
-          for DIR in src/ htdocs/; do
-            if [ -d "$DIR" ]; then
-              FOUND=1
-              while IFS= read -r -d '' FILE; do
-                OUTPUT=$(php -l "$FILE" 2>&1)
-                if echo "$OUTPUT" | grep -q "Parse error"; then
-                  echo "::error file=${FILE}::${OUTPUT}"
-                  ERRORS=$((ERRORS + 1))
-                fi
-              done < <(find "$DIR" -name "*.php" -print0)
-            fi
-          done
-          echo "### PHP Syntax Check" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} syntax error(s) found.**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "All PHP files passed syntax check." >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: XML manifest validation
-        run: |
-          echo "### XML Manifest Validation" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          # Find the extension manifest (XML with <extension tag)
-          MANIFEST=""
-          for XML_FILE in $(find . -maxdepth 2 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
-            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
-              MANIFEST="$XML_FILE"
-              break
-            fi
-          done
-
-          if [ -z "$MANIFEST" ]; then
-            echo "No Joomla extension manifest found (XML file with \`<extension\` tag)." >> $GITHUB_STEP_SUMMARY
-            ERRORS=$((ERRORS + 1))
-          else
-            echo "Manifest found: \`${MANIFEST}\`" >> $GITHUB_STEP_SUMMARY
-
-            # Validate well-formed XML
-            php -r "
-              \$xml = @simplexml_load_file('$MANIFEST');
-              if (\$xml === false) {
-                echo 'INVALID';
-                exit(1);
-              }
-              echo 'VALID';
-            " > /tmp/xml_result 2>&1
-            XML_RESULT=$(cat /tmp/xml_result)
-            if [ "$XML_RESULT" != "VALID" ]; then
-              echo "Manifest is not well-formed XML." >> $GITHUB_STEP_SUMMARY
-              ERRORS=$((ERRORS + 1))
-            else
-              echo "Manifest is well-formed XML." >> $GITHUB_STEP_SUMMARY
-            fi
-
-            # Check required tags: name, version, author
-            for TAG in name version author; do
-              if ! grep -q "<${TAG}>" "$MANIFEST" 2>/dev/null; then
-                echo "Missing required tag: \`<${TAG}>\`" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              else
-                echo "Found required tag: \`<${TAG}>\`" >> $GITHUB_STEP_SUMMARY
-              fi
-            done
-
-            # Namespace is required for components/plugins but not packages
-            EXT_TYPE=$(grep -oP '<extension[^>]*\btype="\K[^"]+' "$MANIFEST" | head -1)
-            if [ "$EXT_TYPE" != "package" ]; then
-              if ! grep -q "<namespace" "$MANIFEST" 2>/dev/null; then
-                echo "Missing required tag: \`<namespace>\` (required for Joomla 5+ ${EXT_TYPE} extensions)" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              else
-                echo "Found required tag: \`<namespace>\`" >> $GITHUB_STEP_SUMMARY
-              fi
-            else
-              echo "Package extension — \`<namespace>\` not required." >> $GITHUB_STEP_SUMMARY
-            fi
-          fi
-
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**${ERRORS} manifest issue(s) found.**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**Manifest validation passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: Check language files referenced in manifest
-        run: |
-          echo "### Language File Check" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          MANIFEST=""
-          for XML_FILE in $(find . -maxdepth 2 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
-            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
-              MANIFEST="$XML_FILE"
-              break
-            fi
-          done
-
-          if [ -n "$MANIFEST" ]; then
-            # Extract language file references from manifest
-            LANG_FILES=$(grep -oP 'language\s+tag="[^"]*"[^>]*>\K[^<]+' "$MANIFEST" 2>/dev/null || true)
-            if [ -z "$LANG_FILES" ]; then
-              echo "No language file references found in manifest — skipping." >> $GITHUB_STEP_SUMMARY
-            else
-              while IFS= read -r LANG_FILE; do
-                LANG_FILE=$(echo "$LANG_FILE" | xargs)
-                if [ -z "$LANG_FILE" ]; then
-                  continue
-                fi
-                # Check in common locations
-                FOUND=0
-                for BASE in "." "src" "htdocs"; do
-                  if [ -f "${BASE}/${LANG_FILE}" ]; then
-                    FOUND=1
-                    break
-                  fi
-                done
-                if [ "$FOUND" -eq 0 ]; then
-                  echo "Missing language file: \`${LANG_FILE}\`" >> $GITHUB_STEP_SUMMARY
-                  ERRORS=$((ERRORS + 1))
-                else
-                  echo "Language file present: \`${LANG_FILE}\`" >> $GITHUB_STEP_SUMMARY
-                fi
-              done <<< "$LANG_FILES"
-            fi
-          else
-            echo "No manifest found — skipping language check." >> $GITHUB_STEP_SUMMARY
-          fi
-
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**${ERRORS} missing language file(s).**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**Language file check passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: Check index.html files in directories
-        run: |
-          echo "### Index.html Check" >> $GITHUB_STEP_SUMMARY
-          MISSING=0
-          CHECKED=0
-
-          for DIR in src/ htdocs/; do
-            if [ -d "$DIR" ]; then
-              while IFS= read -r -d '' SUBDIR; do
-                CHECKED=$((CHECKED + 1))
-                if [ ! -f "${SUBDIR}/index.html" ]; then
-                  echo "Missing index.html in: \`${SUBDIR}\`" >> $GITHUB_STEP_SUMMARY
-                  MISSING=$((MISSING + 1))
-                fi
-              done < <(find "$DIR" -type d -print0)
-            fi
-          done
-
-          if [ "${CHECKED}" -eq 0 ]; then
-            echo "No src/ or htdocs/ directories found — skipping." >> $GITHUB_STEP_SUMMARY
-          elif [ "${MISSING}" -gt 0 ]; then
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**${MISSING} director(ies) missing index.html out of ${CHECKED} checked.**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "All ${CHECKED} directories contain index.html." >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: Check config.xml and access.xml for components
-        run: |
-          echo "### Component Config & ACL Check" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          # Find all component manifests (XML with type="component")
-          COMP_MANIFESTS=$(find . -maxdepth 4 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*" -exec grep -l '<extension[^>]*type="component"' {} ; 2>/dev/null || true)
-
-          if [ -z "$COMP_MANIFESTS" ]; then
-            echo "No component extensions found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            for MANIFEST in $COMP_MANIFESTS; do
-              COMP_DIR=$(dirname "$MANIFEST")
-              COMP_NAME=$(basename "$COMP_DIR")
-              echo "Component: `${COMP_NAME}` (manifest: `${MANIFEST}`)" >> $GITHUB_STEP_SUMMARY
-
-              # Check access.xml exists
-              ACCESS_FILE=$(find "$COMP_DIR" -name "access.xml" -not -path "./.git/*" 2>/dev/null | head -1)
-              if [ -z "$ACCESS_FILE" ]; then
-                echo "- Missing `access.xml` — ACL permissions will not work." >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              else
-                if command -v php &> /dev/null; then
-                  if ! php -r "@simplexml_load_file('$ACCESS_FILE') ?: exit(1);" 2>/dev/null; then
-                    echo "- `access.xml` is not well-formed XML." >> $GITHUB_STEP_SUMMARY
-                    ERRORS=$((ERRORS + 1))
-                  else
-                    for ACTION in core.admin core.manage; do
-                      if ! grep -q "name=\"${ACTION}\"" "$ACCESS_FILE" 2>/dev/null; then
-                        echo "- `access.xml` missing required action: `${ACTION}`" >> $GITHUB_STEP_SUMMARY
-                        ERRORS=$((ERRORS + 1))
-                      fi
-                    done
-                    echo "- `access.xml`: valid" >> $GITHUB_STEP_SUMMARY
-                  fi
-                fi
-              fi
-
-              # Check config.xml exists
-              CONFIG_FILE=$(find "$COMP_DIR" -name "config.xml" -not -path "./.git/*" 2>/dev/null | head -1)
-              if [ -z "$CONFIG_FILE" ]; then
-                echo "- Missing `config.xml` — component Options page will be empty." >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              else
-                if command -v php &> /dev/null; then
-                  if ! php -r "@simplexml_load_file('$CONFIG_FILE') ?: exit(1);" 2>/dev/null; then
-                    echo "- `config.xml` is not well-formed XML." >> $GITHUB_STEP_SUMMARY
-                    ERRORS=$((ERRORS + 1))
-                  else
-                    echo "- `config.xml`: valid" >> $GITHUB_STEP_SUMMARY
-                  fi
-                fi
-              fi
-            done
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} config/ACL issue(s) found.**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Component config & ACL check passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: SQL schema validation
-        run: |
-          echo "### SQL Schema Validation" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          # Find SQL files in source/htdocs
-          SQL_FILES=$(find . -name "*.sql" -path "*/sql/*" -not -path "./.git/*" -not -path "./vendor/*" 2>/dev/null)
-          if [ -z "$SQL_FILES" ]; then
-            echo "No SQL files found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "Found $(echo "$SQL_FILES" | wc -l) SQL file(s)" >> $GITHUB_STEP_SUMMARY
-
-            for FILE in $SQL_FILES; do
-              # Basic syntax check: balanced parentheses, no empty files
-              SIZE=$(wc -c < "$FILE" | tr -d ' ')
-              if [ "$SIZE" -eq 0 ]; then
-                echo "- Empty SQL file: \`${FILE}\`" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-                continue
-              fi
-
-              # Check for common SQL errors
-              if grep -qP '^\s*$' "$FILE" && [ "$SIZE" -lt 5 ]; then
-                echo "- Whitespace-only SQL file: \`${FILE}\`" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-                continue
-              fi
-
-              echo "- \`${FILE}\`: ${SIZE} bytes" >> $GITHUB_STEP_SUMMARY
-            done
-
-            # Check update SQL files follow version numbering pattern
-            UPDATE_DIR=$(find . -path "*/sql/updates/mysql" -type d -not -path "./.git/*" 2>/dev/null | head -1)
-            if [ -n "$UPDATE_DIR" ]; then
-              BAD_NAMES=0
-              for UFILE in "$UPDATE_DIR"/*.sql; do
-                [ ! -f "$UFILE" ] && continue
-                BASENAME=$(basename "$UFILE" .sql)
-                if ! echo "$BASENAME" | grep -qP '^\d+\.\d+\.\d+'; then
-                  echo "- Update file \`${UFILE}\` does not follow version naming (expected X.Y.Z.sql)" >> $GITHUB_STEP_SUMMARY
-                  BAD_NAMES=$((BAD_NAMES + 1))
-                fi
-              done
-              if [ "$BAD_NAMES" -gt 0 ]; then
-                ERRORS=$((ERRORS + BAD_NAMES))
-              fi
-            fi
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} SQL issue(s) found.**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**SQL schema validation passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: Manifest file references check
-        run: |
-          echo "### Manifest File References" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          MANIFEST=""
-          for XML_FILE in $(find . -maxdepth 2 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
-            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
-              MANIFEST="$XML_FILE"
-              break
-            fi
-          done
-
-          if [ -z "$MANIFEST" ]; then
-            echo "No manifest found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            MANIFEST_DIR=$(dirname "$MANIFEST")
-
-            # Check <filename> references
-            FILENAMES=$(grep -oP '<filename[^>]*>\K[^<]+' "$MANIFEST" 2>/dev/null || true)
-            for F in $FILENAMES; do
-              if [ ! -f "${MANIFEST_DIR}/${F}" ] && [ ! -d "${MANIFEST_DIR}/${F}" ]; then
-                echo "- Missing: \`${F}\` (referenced in manifest)" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              fi
-            done
-
-            # Check <folder> references
-            FOLDERS=$(grep -oP '<folder[^>]*>\K[^<]+' "$MANIFEST" 2>/dev/null || true)
-            for F in $FOLDERS; do
-              if [ ! -d "${MANIFEST_DIR}/${F}" ]; then
-                echo "- Missing folder: \`${F}\` (referenced in manifest)" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              fi
-            done
-
-            # Check <file> references in package manifests (ZIP files won't exist in source)
-            EXT_TYPE=$(grep -oP '<extension[^>]*\btype="\K[^"]+' "$MANIFEST" | head -1)
-            if [ "$EXT_TYPE" != "package" ]; then
-              FILES=$(grep -oP '<file[^>]*>\K[^<]+' "$MANIFEST" 2>/dev/null || true)
-              for F in $FILES; do
-                if [ ! -f "${MANIFEST_DIR}/${F}" ]; then
-                  echo "- Missing file: \`${F}\` (referenced in manifest)" >> $GITHUB_STEP_SUMMARY
-                  ERRORS=$((ERRORS + 1))
-                fi
-              done
-            fi
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} missing file reference(s).**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Manifest file references check passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: Form XML validation
-        run: |
-          echo "### Form XML Validation" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          FORM_FILES=$(find . -name "*.xml" -path "*/forms/*" -not -path "./.git/*" -not -path "./vendor/*" 2>/dev/null)
-          if [ -z "$FORM_FILES" ]; then
-            echo "No form XML files found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "Found $(echo "$FORM_FILES" | wc -l) form file(s)" >> $GITHUB_STEP_SUMMARY
-            for FILE in $FORM_FILES; do
-              if command -v php &> /dev/null; then
-                if ! php -r "@simplexml_load_file('$FILE') ?: exit(1);" 2>/dev/null; then
-                  echo "- \`${FILE}\`: malformed XML" >> $GITHUB_STEP_SUMMARY
-                  ERRORS=$((ERRORS + 1))
-                else
-                  # Check for valid Joomla form structure
-                  if ! grep -qE '<form|<field|<fieldset' "$FILE" 2>/dev/null; then
-                    echo "- \`${FILE}\`: no \`<form>\`, \`<field>\`, or \`<fieldset>\` elements found" >> $GITHUB_STEP_SUMMARY
-                    ERRORS=$((ERRORS + 1))
-                  else
-                    echo "- \`${FILE}\`: valid" >> $GITHUB_STEP_SUMMARY
-                  fi
-                fi
-              fi
-            done
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} form XML issue(s).**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Form XML validation passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: Deprecated Joomla API check
-        continue-on-error: true
-        run: |
-          echo "### Deprecated Joomla API Check" >> $GITHUB_STEP_SUMMARY
-          WARNINGS=0
-
-          SRC_DIR=""
-          for DIR in source/ src/ htdocs/; do
-            [ -d "$DIR" ] && SRC_DIR="$DIR" && break
-          done
-
-          if [ -z "$SRC_DIR" ]; then
-            echo "No source directory found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            # Joomla 3/4 deprecated patterns that break in Joomla 6
-            PATTERNS=(
-              'JFactory::'
-              'JText::'
-              'JHtml::'
-              'JRoute::'
-              'JUri::'
-              'JLog::'
-              'JTable::'
-              'JInput'
-              'CMSFactory::\$application'
-              'JApplicationCms'
-            )
-
-            for PATTERN in "${PATTERNS[@]}"; do
-              HITS=$(grep -rnl "$PATTERN" "$SRC_DIR" --include="*.php" 2>/dev/null || true)
-              if [ -n "$HITS" ]; then
-                COUNT=$(echo "$HITS" | wc -l)
-                echo "- \`${PATTERN}\` found in ${COUNT} file(s)" >> $GITHUB_STEP_SUMMARY
-                WARNINGS=$((WARNINGS + COUNT))
-              fi
-            done
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-            if [ "$WARNINGS" -gt 0 ]; then
-              echo "**${WARNINGS} deprecated API usage(s) found.** These will break in Joomla 6." >> $GITHUB_STEP_SUMMARY
-            else
-              echo "**No deprecated APIs found.**" >> $GITHUB_STEP_SUMMARY
-            fi
-          fi
-
-      - name: Template output escaping check
-        continue-on-error: true
-        run: |
-          echo "### Template Output Escaping" >> $GITHUB_STEP_SUMMARY
-          WARNINGS=0
-
-          TMPL_FILES=$(find . -name "*.php" -path "*/tmpl/*" -not -path "./.git/*" -not -path "./vendor/*" 2>/dev/null)
-          if [ -z "$TMPL_FILES" ]; then
-            echo "No template files found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "Found $(echo "$TMPL_FILES" | wc -l) template file(s)" >> $GITHUB_STEP_SUMMARY
-
-            for FILE in $TMPL_FILES; do
-              # Check for unescaped output: <?= $var ?> or echo $var without escape()
-              UNESCAPED=$(grep -nP '<\?=\s*\$(?!this->escape)' "$FILE" 2>/dev/null || true)
-              if [ -n "$UNESCAPED" ]; then
-                HITS=$(echo "$UNESCAPED" | wc -l)
-                echo "- \`${FILE}\`: ${HITS} unescaped \`<?= \$var ?>\` output(s) — use \`<?= \$this->escape(\$var) ?>\`" >> $GITHUB_STEP_SUMMARY
-                WARNINGS=$((WARNINGS + HITS))
-              fi
-
-              # Check for echo without escaping in template context
-              RAW_ECHO=$(grep -nP '^\s*echo\s+\$(?!this->escape)' "$FILE" 2>/dev/null || true)
-              if [ -n "$RAW_ECHO" ]; then
-                HITS=$(echo "$RAW_ECHO" | wc -l)
-                echo "- \`${FILE}\`: ${HITS} raw \`echo \$var\` — consider \`echo \$this->escape(\$var)\`" >> $GITHUB_STEP_SUMMARY
-                WARNINGS=$((WARNINGS + HITS))
-              fi
-            done
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-            if [ "$WARNINGS" -gt 0 ]; then
-              echo "**${WARNINGS} potential XSS risk(s) in templates.** Review unescaped output." >> $GITHUB_STEP_SUMMARY
-            else
-              echo "**All template output appears properly escaped.**" >> $GITHUB_STEP_SUMMARY
-            fi
-          fi
-
-      - name: Namespace consistency check
-        run: |
-          echo "### Namespace Consistency" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          # Find component/plugin manifests with <namespace> tags
-          MANIFESTS=$(find . -maxdepth 4 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*" -exec grep -l '<namespace' {} \; 2>/dev/null || true)
-
-          if [ -z "$MANIFESTS" ]; then
-            echo "No manifests with \`<namespace>\` found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            for MANIFEST in $MANIFESTS; do
-              NS_PATH=$(grep -oP '<namespace[^>]*>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1)
-              [ -z "$NS_PATH" ] && continue
-              MANIFEST_DIR=$(dirname "$MANIFEST")
-
-              echo "Manifest: \`${MANIFEST}\` → namespace \`${NS_PATH}\`" >> $GITHUB_STEP_SUMMARY
-
-              # Check PHP files have matching namespace
-              while IFS= read -r -d '' PHP_FILE; do
-                FILE_NS=$(grep -oP '^\s*namespace\s+\K[^;]+' "$PHP_FILE" 2>/dev/null | head -1)
-                [ -z "$FILE_NS" ] && continue
-
-                # Namespace should start with the manifest namespace path
-                if ! echo "$FILE_NS" | grep -qF "${NS_PATH}"; then
-                  echo "- \`${PHP_FILE}\`: namespace \`${FILE_NS}\` doesn't match manifest \`${NS_PATH}\`" >> $GITHUB_STEP_SUMMARY
-                  ERRORS=$((ERRORS + 1))
-                fi
-              done < <(find "$MANIFEST_DIR" -name "*.php" -path "*/src/*" -not -path "./vendor/*" -print0 2>/dev/null)
-            done
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} namespace mismatch(es).**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Namespace consistency check passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: SPDX license header check
-        continue-on-error: true
-        run: |
-          echo "### SPDX License Headers" >> $GITHUB_STEP_SUMMARY
-          MISSING=0
-
-          SRC_DIR=""
-          for DIR in source/ src/ htdocs/; do
-            [ -d "$DIR" ] && SRC_DIR="$DIR" && break
-          done
-
-          if [ -z "$SRC_DIR" ]; then
-            echo "No source directory found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            TOTAL=0
-            while IFS= read -r -d '' FILE; do
-              TOTAL=$((TOTAL + 1))
-              if ! head -10 "$FILE" | grep -qi "SPDX"; then
-                echo "- Missing SPDX header: \`${FILE}\`" >> $GITHUB_STEP_SUMMARY
-                MISSING=$((MISSING + 1))
-              fi
-            done < <(find "$SRC_DIR" -name "*.php" -not -path "./vendor/*" -print0)
-
-            echo "" >> $GITHUB_STEP_SUMMARY
-            if [ "$MISSING" -gt 0 ]; then
-              echo "**${MISSING}/${TOTAL} PHP file(s) missing SPDX license header.**" >> $GITHUB_STEP_SUMMARY
-            else
-              echo "**All ${TOTAL} PHP files have SPDX headers.**" >> $GITHUB_STEP_SUMMARY
-            fi
-          fi
-
-      - name: Service provider check
-        run: |
-          echo "### Service Provider Check" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          PROVIDERS=$(find . -name "provider.php" -path "*/services/*" -not -path "./.git/*" -not -path "./vendor/*" 2>/dev/null)
-          if [ -z "$PROVIDERS" ]; then
-            echo "No service providers found — skipping." >> $GITHUB_STEP_SUMMARY
-          else
-            for FILE in $PROVIDERS; do
-              # Must return a ServiceProviderInterface
-              if ! grep -qP 'ServiceProviderInterface|ComponentInterface|MVCFactoryInterface|DispatcherInterface' "$FILE" 2>/dev/null; then
-                echo "- \`${FILE}\`: does not reference ServiceProviderInterface or component interfaces" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              else
-                echo "- \`${FILE}\`: valid service provider" >> $GITHUB_STEP_SUMMARY
-              fi
-
-              # Must have return statement
-              if ! grep -qP '^\s*return\s+new\s+' "$FILE" 2>/dev/null; then
-                echo "- \`${FILE}\`: missing \`return new ...\` statement" >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              fi
-            done
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} service provider issue(s).**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Service provider check passed.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-  release-readiness:
-    name: Release Readiness Check
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && github.base_ref == 'main'
-    continue-on-error: true
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Validate release readiness
-        run: |
-          echo "## Release Readiness" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          ERRORS=0
-
-          # Extract version from README.md
-          README_VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' README.md | head -1)
-          if [ -z "$README_VERSION" ]; then
-            echo "No VERSION found in README.md FILE INFORMATION block." >> $GITHUB_STEP_SUMMARY
-            ERRORS=$((ERRORS + 1))
-          else
-            echo "README version: \`${README_VERSION}\`" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # Find the extension manifest
-          MANIFEST=""
-          for XML_FILE in $(find . -maxdepth 2 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
-            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
-              MANIFEST="$XML_FILE"
-              break
-            fi
-          done
-
-          if [ -z "$MANIFEST" ]; then
-            echo "No Joomla extension manifest found." >> $GITHUB_STEP_SUMMARY
-            ERRORS=$((ERRORS + 1))
-          else
-            echo "Manifest: \`${MANIFEST}\`" >> $GITHUB_STEP_SUMMARY
-
-            # Check <version> matches README VERSION
-            MANIFEST_VERSION=$(grep -oP '<version>\K[^<]+' "$MANIFEST" | head -1)
-            if [ -z "$MANIFEST_VERSION" ]; then
-              echo "No \`<version>\` tag in manifest." >> $GITHUB_STEP_SUMMARY
-              ERRORS=$((ERRORS + 1))
-            elif [ -n "$README_VERSION" ] && [ "$MANIFEST_VERSION" != "$README_VERSION" ]; then
-              echo "Manifest version \`${MANIFEST_VERSION}\` does not match README \`${README_VERSION}\`." >> $GITHUB_STEP_SUMMARY
-              ERRORS=$((ERRORS + 1))
-            else
-              echo "Manifest version: \`${MANIFEST_VERSION}\`" >> $GITHUB_STEP_SUMMARY
-            fi
-
-            # Check extension type, element, client attributes
-            EXT_TYPE=$(grep -oP '<extension[^>]*\btype="\K[^"]+' "$MANIFEST" | head -1)
-            if [ -z "$EXT_TYPE" ]; then
-              echo "Missing \`type\` attribute on \`<extension>\` tag." >> $GITHUB_STEP_SUMMARY
-              ERRORS=$((ERRORS + 1))
-            else
-              echo "Extension type: \`${EXT_TYPE}\`" >> $GITHUB_STEP_SUMMARY
-            fi
-
-            # Element check (component/module/plugin name)
-            HAS_ELEMENT=$(grep -cP '<(element|name)>' "$MANIFEST" 2>/dev/null || echo "0")
-            if [ "$HAS_ELEMENT" -eq 0 ]; then
-              echo "Missing \`<element>\` or \`<name>\` in manifest." >> $GITHUB_STEP_SUMMARY
-              ERRORS=$((ERRORS + 1))
-            fi
-
-            # Client attribute for site/admin modules and plugins
-            if echo "$EXT_TYPE" | grep -qP "^(module|plugin)$"; then
-              HAS_CLIENT=$(grep -cP '<extension[^>]*\bclient=' "$MANIFEST" 2>/dev/null || echo "0")
-              if [ "$HAS_CLIENT" -eq 0 ]; then
-                echo "Missing \`client\` attribute for ${EXT_TYPE} extension." >> $GITHUB_STEP_SUMMARY
-                ERRORS=$((ERRORS + 1))
-              fi
-            fi
-          fi
-
-          # Check updates.xml exists
-          if [ -f "updates.xml" ] || [ -f "updates.xml" ]; then
-            echo "Update XML present." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "No updates.xml found." >> $GITHUB_STEP_SUMMARY
-            ERRORS=$((ERRORS + 1))
-          fi
-
-          # Check CHANGELOG.md exists
-          if [ -f "CHANGELOG.md" ]; then
-            echo "CHANGELOG.md present." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "No CHANGELOG.md found." >> $GITHUB_STEP_SUMMARY
-            ERRORS=$((ERRORS + 1))
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ $ERRORS -gt 0 ]; then
-            echo "**${ERRORS} issue(s) must be resolved before release.**" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Extension is ready for release.**" >> $GITHUB_STEP_SUMMARY
-          fi
-
-  test:
-    name: Tests (PHP ${{ matrix.php }})
-    runs-on: ubuntu-latest
-    needs: lint-and-validate
-
-    strategy:
-      fail-fast: false
-      matrix:
-        php: ['8.2', '8.3']
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup PHP ${{ matrix.php }}
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-          fi
-          php -v && composer --version
-
-      - name: Install dependencies
-        env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || secrets.GA_TOKEN || github.token }}"}}'
-        run: |
-          if [ -f "composer.json" ]; then
-            composer install \
-              --no-interaction \
-              --prefer-dist \
-              --optimize-autoloader
-          else
-            echo "No composer.json found — skipping dependency install"
-          fi
-
-      - name: Run tests
-        run: |
-          echo "### Test Results (PHP ${{ matrix.php }})" >> $GITHUB_STEP_SUMMARY
-          if [ -f "phpunit.xml" ] || [ -f "phpunit.xml.dist" ]; then
-            vendor/bin/phpunit --testdox 2>&1 | tee /tmp/test-output.log
-            EXIT=${PIPESTATUS[0]}
-            if [ $EXIT -eq 0 ]; then
-              echo "All tests passed." >> $GITHUB_STEP_SUMMARY
-            else
-              echo "Test failures detected — see log." >> $GITHUB_STEP_SUMMARY
-              echo '```' >> $GITHUB_STEP_SUMMARY
-              cat /tmp/test-output.log >> $GITHUB_STEP_SUMMARY
-              echo '```' >> $GITHUB_STEP_SUMMARY
-            fi
-            exit $EXIT
-          else
-            echo "No phpunit.xml found — skipping tests." >> $GITHUB_STEP_SUMMARY
-          fi
-
-  static-analysis:
-    name: PHPStan Analysis
-    runs-on: ubuntu-latest
-    needs: lint-and-validate
-    continue-on-error: true
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-          fi
-          php -v && composer --version
-
-      - name: Install dependencies
-        env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || secrets.GA_TOKEN || github.token }}"}}'
-        run: |
-          if [ -f "composer.json" ]; then
-            composer install --no-interaction --prefer-dist --optimize-autoloader
-          fi
-
-      - name: Install PHPStan
-        run: |
-          if ! command -v vendor/bin/phpstan &> /dev/null; then
-            composer require --dev phpstan/phpstan --no-interaction 2>/dev/null || \
-              composer global require phpstan/phpstan --no-interaction
-          fi
-
-      - name: Run PHPStan
-        run: |
-          echo "### PHPStan Static Analysis" >> $GITHUB_STEP_SUMMARY
-          PHPSTAN="vendor/bin/phpstan"
-          if [ ! -f "$PHPSTAN" ]; then
-            PHPSTAN=$(composer global config bin-dir --absolute 2>/dev/null)/phpstan
-          fi
-
-          # Determine source directory
-          SRC_DIR=""
-          for DIR in src/ htdocs/ lib/; do
-            if [ -d "$DIR" ]; then
-              SRC_DIR="$DIR"
-              break
-            fi
-          done
-
-          if [ -z "$SRC_DIR" ]; then
-            echo "No source directory found (src/, htdocs/, lib/) — skipping." >> $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-
-          # Use repo phpstan.neon if present, otherwise use baseline config
-          ARGS="analyse ${SRC_DIR} --memory-limit=512M --no-progress --error-format=table"
-          if [ -f "phpstan.neon" ] || [ -f "phpstan.neon.dist" ]; then
-            echo "Using project PHPStan config." >> $GITHUB_STEP_SUMMARY
-          else
-            ARGS="$ARGS --level=3"
-            echo "No phpstan.neon found — using level 3 (type inference)." >> $GITHUB_STEP_SUMMARY
-          fi
-
-          $PHPSTAN $ARGS 2>&1 | tee /tmp/phpstan-output.txt
-          EXIT=${PIPESTATUS[0]}
-
-          if [ $EXIT -eq 0 ]; then
-            echo "**No errors found.**" >> $GITHUB_STEP_SUMMARY
-          else
-            ERRORS=$(grep -c "ERROR" /tmp/phpstan-output.txt 2>/dev/null || echo "some")
-            echo "**${ERRORS} error(s) found.** Review output above." >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            tail -30 /tmp/phpstan-output.txt >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-          fi
-          exit $EXIT
-
-  pre-release:
-    name: Build RC Pre-Release
-    runs-on: ubuntu-latest
-    needs: [lint-and-validate, test]
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Trigger pre-release build
-        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
-          REPO: ${{ github.repository }}
-          BRANCH: ${{ github.head_ref }}
-        run: |
-          curl -s -X POST \
-            "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches" \
-            -H "Authorization: token ${GA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
-          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
-          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY

.mokogitea/workflows/sync-on-merge.yml

@@ -1,32 +0,0 @@
-name: Sync Workflows to Repos
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - '.mokogitea/workflows/**'
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    if: ${{ startsWith(github.event.repository.name, 'Template-') }}
-    steps:
-      - name: Checkout mokocli
-        uses: actions/checkout@v4
-        with:
-          repository: MokoConsulting/MokoCLI
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Setup PHP
-        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
-        with:
-          php-version: '8.1'
-
-      - name: Install dependencies
-        run: composer install --no-dev --no-interaction
-
-      - name: Sync workflows to generic repos
-        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -1,82 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
-# VERSION: 01.01.00
-# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
-
-name: "Universal: Workflow Sync Trigger"
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  sync:
-    name: Sync workflows to live repos
-    runs-on: ubuntu-latest
-    if: >-
-      startsWith(github.event.repository.name, 'Template-') &&
-      (github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]')))
-
-    steps:
-      - name: Determine platform from repo name
-        id: platform
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          case "$REPO" in
-            Template-Joomla)   PLATFORM="joomla" ;;
-            Template-Dolibarr) PLATFORM="dolibarr" ;;
-            Template-Go)       PLATFORM="go" ;;
-            Template-MCP)      PLATFORM="mcp" ;;
-            Template-Generic)  PLATFORM="" ;;
-            *)                 PLATFORM="" ;;
-          esac
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          echo "Platform: ${PLATFORM:-all}"
-
-      - name: Clone mokocli
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
-
-      - name: Install PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
-          fi
-
-      - name: Install dependencies
-        run: |
-          cd /tmp/mokocli
-          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-
-      - name: Run workflow sync
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          ARGS="--token ${MOKOGITEA_TOKEN}"
-          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
-          ARGS="${ARGS} --phase repos"
-
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [ -n "$PLATFORM" ]; then
-            ARGS="${ARGS} --platform-filter ${PLATFORM}"
-          fi
-
-          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

CHANGELOG.md

@@ -1,68 +1,28 @@
 # Changelog
 ## [Unreleased]
 
+## [02.65.00] --- 2026-07-16
 
-## [02.59.00] --- 2026-07-12
-
-### Fixed
-- Pre-update backup on the **Joomla Update** page is now **seamless** (Akeeba-style): after the full-screen backup runs, the plugin auto-ticks Joomla's "I have taken a backup" checkbox and clicks Install, so the update continues automatically instead of stopping for a second manual click.
-- Pre-update full-screen backup now actually fires on the **Joomla Update** page. The "Install the update" button posts to `option=com_joomlaupdate&layout=update` (Joomla's confirm/updating page) — carrying **only `layout=update`**, no `view`/`task` — so the previous match on `view=update`/`update.install` never triggered. The plugin now intercepts `layout=update` (as well as `view=update` and the legacy `update.install`) and returns the browser there flagged `is_backed_up=1`.
+## [02.65.00] --- 2026-07-16
 
 ### Added
-- **Snapshot transfer + master→slave injection (#237):** download a content snapshot as a portable **`.msbsnap`** file (zip of `manifest.json` + `snapshot.json` + a sha256 integrity check); **import** one on another site via a new Import button on the Snapshots page (materialises a local snapshot record you can then restore); and a **direct injection API** — `POST /api/index.php/v1/mokosuitebackup/snapshot/inject` — so a **master** site can push a snapshot straight into a **slave**'s Web Services API. Two conflict modes ship now: **overwrite** (replace matching items by ID — master wins) and **create** (skip existing, add only new), selectable per inject call or defaulted in **Options → Snapshot Transfer**. A receiving site must opt in via the new *Allow Snapshot Injection* setting. A third **duplicate** mode inserts everything as brand-new records with **remapped IDs** (articles, categories, modules — plus their tags, custom-field values and featured flags) using Joomla's Table API so assets/UCM/nested-sets stay valid; each item is inserted defensively (a bad item is skipped and logged, never fatal).
-- Full-screen backup now also fronts **extension updates and uninstalls** (Extensions → Update / Manage), not just core Joomla updates. Because `com_installer`'s `update.update` / `manage.remove` are POST actions (CSRF token + a checked `cid[]` list) that a server-side redirect can't cleanly resume, this is done client-side: the toolbar Update/Uninstall click is intercepted, the selection is captured, the full-screen backup runs, and on return the original selection is restored and the real POST form is re-submitted. Gated by `backup_before_update` / `backup_before_uninstall`, super-user only, and skipped if a backup already ran this session.
-- Manual **"Backup Now"** completion now offers a **View backup record** button (links straight to the record that was just created). It appears only for manual backups — the pre-update / pre-uninstall flow hands control back to Joomla instead.
-- **Full-screen backup screen** (`view=runbackup`) for both pre-update and manual backups, modelled on Akeeba's Backup-on-Update — replaces the earlier popup-modal approach. Clicking Joomla's **Install the update** now redirects (server-side, Akeeba-style) to a dedicated full-page backup screen that runs the stepped backup with a real progress bar and then **automatically continues the update** via a validated `returnurl` (flagged `is_backed_up=1` so the backup isn't repeated). Crucially, **no backup runs synchronously inside the update request** — which is what white-screened large sites. The dashboard **Backup Now** now opens the same full-screen screen instead of an inline modal. (#196)
-- Retention now prunes **remote** copies too: when a backup is pruned by age/count, its archive is deleted from every enabled remote destination (SFTP / FTP / S3 / Google Drive), not just the local copy. Each uploader gained an idempotent `delete()` method (already-absent file = success), and removal is best-effort — a failing destination is logged but never blocks local pruning. The shared standalone `restore.php` is intentionally left in place (every backup overwrites it, so newer backups still depend on it). (#229)
+- Backup- and restore-progress modals (backups view) now have the same controls as the full-screen runbackup screen: an "automatically return to the list when finished" checkbox, a Cancel button (double-confirmed) while running, and terminal action buttons. Backup: View backup record / Back to backups on success, Retry / Back on failure. Restore matches, with a stronger cancel warning (a restore cannot be rolled back mid-flight) and no record link.
+
+### Fixed
+- ntfy default server URL now points to `ntfy.mokoconsulting.tech` (was the public `ntfy.sh`) in the profile form default/hint, `NotificationSender` fallbacks, the `ntfy_server` column default, and the field description. (#166)
+- Non-stepped restore (`RestoreEngine`) now surfaces database-import failures instead of always reporting a clean success: it checks `DatabaseImporter::hasErrors()`, logs the failed statements, and returns a `warning` with a "database may be incomplete" message. `DatabaseImporter`'s statement splitter is also now quote-aware (a `;`/newline inside a value no longer splits a statement) with comments only skipped between statements. (#188)
+- Restore Cancel no longer orphans server-side state. The stepped-restore modal's Cancel button now calls a new `ajax.restoreCancel` action that deletes the restore staging directory and session/state files, and `SteppedSession::cleanupOldSessions()` gained a backstop that reaps orphaned `mokosuitebackup-restore-*` staging dirs (for restores abandoned by closing the browser). Previously a cancelled/abandoned restore left the extracted staging dir behind indefinitely.
+- Stepped restore no longer reports a partial database import as a clean "Restore complete". `SteppedRestoreEngine::stepDatabase()` now counts failed statements and surfaces the total (the completion message warns and the modal keeps the result on-screen instead of auto-returning). The statement splitter is also quote-aware — a `;` or newline inside a string value no longer splits a statement mid-value — and comment lines are only skipped between statements. (Sibling of #188 for the stepped/standalone paths; see #291.)
+- Database view "One Problem" on MokoSuiteBackup: reconciled the `#__mokosuitebackup_profiles` schema-checker output with the update-file history. Corrected the stale `TINYINT` definition in `01.01.01.sql` to the final `VARCHAR(20)` type, fixed the `MODIFY COLUMN` parser trip-up in `01.39.00.sql`, and rewrote the retired `sftp_*` `ADD COLUMN` statements in `01.35.00.sql`/`01.36.00.sql` as bare `ADD` so Joomla's checker no longer demands columns that `02.52.25` and the postflight purge deliberately remove. Joomla's schema checker now reports no problems.
 
 ### Changed
-- Consolidated backup plumbing into shared helpers (#230):
-  - New `RemoteUploaderFactory` replaces the `createUploaderFromParams()` copy that was duplicated in `BackupEngine` and `SteppedBackupEngine`.
-  - `RetentionManager` is now the single retention authority — it takes the global `max_age_days`/`max_backups` fallback and gained `pruneOrphans()`; the system plugin's hourly cleanup delegates to it and its duplicate `deleteBackupRecord()` logic is removed.
-  - The backend controller, Web Services API controller, and legacy `cli/mokosuitebackup.php` now run backups through the shared `BackupRunner` (gaining the normalized complete/warning/fail status) instead of instantiating `BackupEngine` directly.
+- Backup/restore progress modals in the backups view now use the same full-screen black, big-text, animated Atum-coloured progress-bar theme as the `runbackup` screen, so all backup progress surfaces match. New `media/css/backup-progress.css` scopes the black to the modal (the list page is unaffected until a modal opens).
+- Standalone MokoRestore wizard (generated `restore.php`) re-branded to the full-black MokoSuite theme — black background, big header, dark panels/forms, and MokoSuite accent colours — so the restore experience matches the rest of the system instead of the old light blue "Joomla-styled" look.
 
-### Fixed
-- Package installer is now **honest about success**: the postflight no longer prints "installed successfully" / next-steps when the install actually failed or only partially completed. Joomla logs a failed child extension but still runs the package postflight, so the postflight now (a) verifies every bundled child declared in the manifest actually registered in `#__extensions` (matched by element + type, and folder/group for plugins) and (b) verifies the component's schema tables — derived dynamically from the installed `install.mysql.sql` — actually exist. If anything is missing it enqueues an error listing what's missing and stops before the success message. Fail-open: any manifest/DB/IO glitch is treated as "nothing missing" so a transient error never turns a good install into a false failure. Unconditional housekeeping (e.g. download-key restore) still runs regardless.
-- Pre-update full-screen backup screen now actually triggers on **Joomla 6** (and 4/5). The redirect matched only the legacy `update.install` task, which Joomla 4/5/6 don't use — they server-side-redirect to the **updating page `view=update`**, which then extracts the downloaded package from JavaScript. The plugin now intercepts the `view=update` page **load** (the last point before any files change) and returns the browser there flagged `is_backed_up=1` so the extraction proceeds after the backup. (`update.finalise` is intentionally not intercepted — by then the files are already extracted.)
-- Pre-update/uninstall backup no longer **white-screens** the update on large sites. The synchronous backup that runs inside the extension update/uninstall request now raises `max_execution_time`/`memory_limit` (and `ignore_user_abort`) like the web-cron path, so it can't exhaust the request's default limits mid-backup. (Core Joomla updates additionally get a full-screen backup screen — see below.)
-- Archive names for **CLI/console-triggered backups** no longer come out as `joomla.invalid_…`. The `[HOST]` placeholder took `$_SERVER['HTTP_HOST']` verbatim, but Joomla's console fills that with the reserved sentinel host `joomla.invalid`; the resolver now treats that (like empty/`localhost`) as unusable and falls back to the configured `live_site` host, then the system hostname. (Set the site's *live_site* to get the exact domain in CLI-built names.)
-- Standalone restore script generation no longer aborts backups with `str_replace() expects at least 3 arguments, 2 given`. `MokoRestore::generateStandaloneScript()` had a `str_replace()` call (the "Backup Archive" pre-check rewrite) that was missing its `$php` subject argument, so **every** standalone-mode backup fatally errored while "Generating standalone restore.php…" — the archive still finalized and uploaded, but no `restore.php` was ever produced (the true root cause behind #226). (#226)
-- Remote upload: the standalone restore script upload is no longer silent — its result is now checked and logged, and a failed restore-script upload marks the backup as `warning` (previously the result was discarded, so a missing restore script on the remote went unreported while the archive still showed success). (#226)
+## [02.64.00] --- 2026-07-14
 
-## [02.58.00] --- 2026-07-06
+## [02.64.00] --- 2026-07-14
 
-### Added
-- SFTP destinations: **upload an SSH private key file** in the Add/Edit Destination modal instead of pasting it (reads the file into the key field client-side; pasting still works).
+## [02.63.00] --- 2026-07-13
 
-### Changed
-- Add/Edit Destination modal: wrap the content in a Bootstrap `.container-fluid` and give it a 1rem padding frame via the WAM stylesheet (Bootstrap's `.modal-content` has no padding of its own).
-
-### Fixed
-- Pre-update backup now shows an admin notification on **every** outcome (success / warning / failure) — previously a *successful* pre-update backup fired nothing, so it looked like the notification wasn't working. (#192)
-
-### Changed
-- Component admin CSS now loads via the Joomla **Web Asset Manager** (`media/com_mokosuitebackup/` + `joomla.asset.json`) instead of an inline `<style>` block.
-- "Keep local copy" is configured **per remote destination** (in the Add/Edit Destination modal); the redundant profile-level field and its "Remote" tab are removed.
-- Add/Edit Destination modal: cleaned up the cramped padding/margins.
-
-### Fixed
-- Admin menu / duplicate-component fallout: (a) the orphaned `com_component-mokosuitebackup` is now removed in **preflight** too, so its "Backup" menu no longer collides on install ("The alias backup is already being used"); (b) `ensureSubmenuItems()` **recreates the top-level "Backup" menu** if it was deleted, instead of giving up — so Backup no longer disappears from the admin menu (and the cPanel module / MokoSuiteClient can find it again); (c) the component menu label now uses the short constant `COM_MOKOJOOMBACKUP_SHORT`. (#213 fallout)
-- Installer no longer aborts on MySQL 8 with "This command is not supported in the prepared statement protocol yet" (error 1295). The legacy remote-column purge migration (`02.56.01.sql`) used `PREPARE`/`EXECUTE`/`DEALLOCATE`, which Joomla's installer rejects; the drop now runs in the package installer script via an INFORMATION_SCHEMA-gated plain `ALTER` (portable across MariaDB and MySQL 8). (#213 update path)
-
-## [02.57.00] --- 2026-07-05
-
-### Added
-- `BackupRunner` service — a single synchronous entry point for backups that unifies final status and notification gating across the pre-update, web-cron, pre-install, scheduled-task and CLI triggers (delegates to `BackupEngine`; no double-notify). Returns a normalized result including the real complete/warning/fail status. Dashboard "Backup Now" (AJAX) unchanged; installer progress popup deferred to #196. (#214)
-
-### Fixed
-- Release automation: the changelog-promote step is now idempotent — it only inserts a `## [version]` header when that version isn't already present, preventing the empty, duplicated version headers that repeated/same-version builds were producing. (workflow)
-
-## [02.56.11] --- 2026-07-05
-
-### Fixed
-- Package `postflight` now removes the orphaned `com_component-mokosuitebackup` registration (stray extension record, admin menu items, schema rows, and `administrator/` folder) left behind by the old "Type - Name" component `<name>` — self-healing on update so affected sites reconcile to the real `com_mokosuitebackup`. (#213 follow-up)
-
-## [02.56.08] --- 2026-07-05
-
-### Fixed
-- Component manifest `<name>` reverted to the element-safe `MokoSuiteBackup`. The "Type - Name" convention derived element `com_component-mokosuitebackup`, registering a duplicate component and leaving the real `com_mokosuitebackup` orphaned on the old version. (#213)
+## [02.62.00] --- 2026-07-13

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thank you for your interest in contributing to MokoSuiteBackup.
 
 ## Getting Started
 
-1. Fork the repository on MokoGitea
+1. Fork the repository on MokoGIT
 2. Create a feature branch from `dev` (`feature/your-feature`)
 3. Make your changes following the coding standards below
 4. Submit a pull request targeting `dev`

SECURITY.md

@@ -23,7 +23,7 @@ DEFGROUP: Template-Joomla
 INGROUP: Template-Joomla.Documentation
 REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 PATH: /SECURITY.md
-VERSION: 02.59.00
+VERSION: 02.65.00
 BRIEF: Security vulnerability reporting and handling policy
 -->
 

composer.json

@@ -12,7 +12,7 @@
 		}
 	],
 	"require": {
-		"php": ">=8.1",
+		"php": ">=8.3",
 		"ext-zip": "*",
 		"ext-pdo": "*",
 		"ext-pdo_mysql": "*",

source/packages/com_mokosuitebackup/config.xml

@@ -162,6 +162,17 @@
 			<option value="1">JYES</option>
 			<option value="0">JNO</option>
 		</field>
+		<field
+			name="lock_admin_during_backup"
+			type="radio"
+			label="COM_MOKOJOOMBACKUP_CONFIG_LOCK_ADMIN"
+			description="COM_MOKOJOOMBACKUP_CONFIG_LOCK_ADMIN_DESC"
+			default="1"
+			class="btn-group"
+		>
+			<option value="1">JYES</option>
+			<option value="0">JNO</option>
+		</field>
 	</fieldset>
 
 	<fieldset name="cleanup" label="COM_MOKOJOOMBACKUP_CONFIG_CLEANUP">

source/packages/com_mokosuitebackup/forms/profile.xml

@@ -292,8 +292,8 @@
 			label="COM_MOKOJOOMBACKUP_FIELD_NTFY_SERVER"
 			description="COM_MOKOJOOMBACKUP_FIELD_NTFY_SERVER_DESC"
 			maxlength="512"
-			default="https://ntfy.sh"
-			hint="https://ntfy.sh"
+			default="https://ntfy.mokoconsulting.tech"
+			hint="https://ntfy.mokoconsulting.tech"
 		/>
 		<field
 			name="ntfy_token"

source/packages/com_mokosuitebackup/language/en-GB/com_mokosuitebackup.ini

@@ -259,7 +259,7 @@ COM_MOKOJOOMBACKUP_FIELD_NTFY_SPACER_DESC="<strong>Push Notifications (ntfy)</st
 COM_MOKOJOOMBACKUP_FIELD_NTFY_TOPIC="ntfy Topic"
 COM_MOKOJOOMBACKUP_FIELD_NTFY_TOPIC_DESC="The ntfy topic to publish notifications to. Leave blank to disable push notifications."
 COM_MOKOJOOMBACKUP_FIELD_NTFY_SERVER="ntfy Server"
-COM_MOKOJOOMBACKUP_FIELD_NTFY_SERVER_DESC="URL of the ntfy server. Default is the public ntfy.sh service. Use your own server URL for self-hosted instances."
+COM_MOKOJOOMBACKUP_FIELD_NTFY_SERVER_DESC="URL of the ntfy server. Default is the Moko Consulting ntfy server (ntfy.mokoconsulting.tech). Use your own server URL for self-hosted instances, or https://ntfy.sh for the public service."
 COM_MOKOJOOMBACKUP_FIELD_NTFY_TOKEN="Access Token"
 COM_MOKOJOOMBACKUP_FIELD_NTFY_TOKEN_DESC="Optional access token for private ntfy topics. Leave blank for public topics."
 
@@ -335,6 +335,8 @@ COM_MOKOJOOMBACKUP_CONFIG_PREUPDATE_AUTO_INTERCEPT="Auto-run on Update click"
 COM_MOKOJOOMBACKUP_CONFIG_PREUPDATE_AUTO_INTERCEPT_DESC="When enabled, clicking the Update button on the Joomla Update or Extensions update page first pops the backup progress modal, runs the pre-update backup, then automatically continues the update. When disabled, a notice with a manual 'Back up now' button is shown instead."
 COM_MOKOJOOMBACKUP_CONFIG_BACKUP_BEFORE_UNINSTALL="Backup Before Extension Uninstall"
 COM_MOKOJOOMBACKUP_CONFIG_BACKUP_BEFORE_UNINSTALL_DESC="Automatically run a full backup before any extension is uninstalled. Uses the default profile. Throttled to once per 10 minutes."
+COM_MOKOJOOMBACKUP_CONFIG_LOCK_ADMIN="Lock admin during backup"
+COM_MOKOJOOMBACKUP_CONFIG_LOCK_ADMIN_DESC="While a backup is actively running, show a \"backup in progress\" screen on all other admin pages until it finishes, so nothing changes mid-backup. The backup screen itself and the login page stay accessible. Auto-releases if a backup stops responding."
 
 ; Full-screen backup progress view (runbackup)
 COM_MOKOJOOMBACKUP_RUNBACKUP_TITLE="Backing Up"
@@ -349,6 +351,15 @@ COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_ANYWAY="Continue without backup"
 COM_MOKOJOOMBACKUP_RUNBACKUP_BACK_TO_DASHBOARD="Back to dashboard"
 COM_MOKOJOOMBACKUP_RUNBACKUP_VIEW_RECORD="View backup record"
 COM_MOKOJOOMBACKUP_RUNBACKUP_LEAVE_WARNING="A backup is in progress. Leaving now will cancel it."
+COM_MOKOJOOMBACKUP_RUNBACKUP_AUTOCONTINUE="Automatically continue the update when the backup finishes"
+COM_MOKOJOOMBACKUP_RUNBACKUP_DONT_CLOSE="Please do not close this window or switch to another window until the backup finishes."
+COM_MOKOJOOMBACKUP_RUNBACKUP_UPDATE_RUNNING="Backup complete. The update is now running — please wait and do not close this window…"
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCEL="Cancel backup"
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCEL_CONFIRM1="Cancel the backup that is in progress?"
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCEL_CONFIRM2="Are you sure? The backup will be stopped and the update will NOT continue."
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCELLING="Cancelling…"
+COM_MOKOJOOMBACKUP_RUNBACKUP_FAILED_NO_UPDATE="Backup failed — the update was not started. Retry the backup, or go back without updating."
+COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_UPDATE="Continue the update"
 
 COM_MOKOJOOMBACKUP_CONFIG_CLEANUP="Cleanup Defaults"
 COM_MOKOJOOMBACKUP_CONFIG_MAX_AGE="Max Backup Age (days)"

source/packages/com_mokosuitebackup/language/en-US/com_mokosuitebackup.ini

@@ -57,6 +57,8 @@ COM_MOKOJOOMBACKUP_CONFIG_PREUPDATE_AUTO_INTERCEPT="Auto-run on Update click"
 COM_MOKOJOOMBACKUP_CONFIG_PREUPDATE_AUTO_INTERCEPT_DESC="When enabled, clicking the Update button on the Joomla Update or Extensions update page first pops the backup progress modal, runs the pre-update backup, then automatically continues the update. When disabled, a notice with a manual 'Back up now' button is shown instead."
 COM_MOKOJOOMBACKUP_CONFIG_BACKUP_BEFORE_UNINSTALL="Backup Before Extension Uninstall"
 COM_MOKOJOOMBACKUP_CONFIG_BACKUP_BEFORE_UNINSTALL_DESC="Automatically run a full backup before any extension is uninstalled. Uses the default profile. Throttled to once per 10 minutes."
+COM_MOKOJOOMBACKUP_CONFIG_LOCK_ADMIN="Lock admin during backup"
+COM_MOKOJOOMBACKUP_CONFIG_LOCK_ADMIN_DESC="While a backup is actively running, show a \"backup in progress\" screen on all other admin pages until it finishes, so nothing changes mid-backup. The backup screen itself and the login page stay accessible. Auto-releases if a backup stops responding."
 
 ; Full-screen backup progress view (runbackup)
 COM_MOKOJOOMBACKUP_RUNBACKUP_TITLE="Backing Up"
@@ -71,6 +73,15 @@ COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_ANYWAY="Continue without backup"
 COM_MOKOJOOMBACKUP_RUNBACKUP_BACK_TO_DASHBOARD="Back to dashboard"
 COM_MOKOJOOMBACKUP_RUNBACKUP_VIEW_RECORD="View backup record"
 COM_MOKOJOOMBACKUP_RUNBACKUP_LEAVE_WARNING="A backup is in progress. Leaving now will cancel it."
+COM_MOKOJOOMBACKUP_RUNBACKUP_AUTOCONTINUE="Automatically continue the update when the backup finishes"
+COM_MOKOJOOMBACKUP_RUNBACKUP_DONT_CLOSE="Please do not close this window or switch to another window until the backup finishes."
+COM_MOKOJOOMBACKUP_RUNBACKUP_UPDATE_RUNNING="Backup complete. The update is now running — please wait and do not close this window…"
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCEL="Cancel backup"
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCEL_CONFIRM1="Cancel the backup that is in progress?"
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCEL_CONFIRM2="Are you sure? The backup will be stopped and the update will NOT continue."
+COM_MOKOJOOMBACKUP_RUNBACKUP_CANCELLING="Cancelling…"
+COM_MOKOJOOMBACKUP_RUNBACKUP_FAILED_NO_UPDATE="Backup failed — the update was not started. Retry the backup, or go back without updating."
+COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_UPDATE="Continue the update"
 
 COM_MOKOJOOMBACKUP_CONFIG_CLEANUP="Cleanup Defaults"
 COM_MOKOJOOMBACKUP_CONFIG_MAX_AGE="Max Backup Age (days)"

source/packages/com_mokosuitebackup/media/css/backup-progress.css

@@ -0,0 +1,173 @@
+/*
+ * @package     MokoSuiteBackup
+ * @subpackage  com_mokosuitebackup
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * Full-screen backup/restore progress modals (backups view). Gives the stepped
+ * backup and restore modals the same full-black, big-text, Atum-coloured
+ * progress-bar treatment as the runbackup screen (media/css/runbackup.css), so
+ * all backup progress surfaces share one look. The black is scoped to the modal
+ * (via .msb-progress-modal) rather than html/body, so the list page behind it is
+ * unaffected until the modal opens.
+ */
+
+/* Accent colours pulled from the Atum admin template's own custom properties,
+   with Bootstrap and then a literal as progressive fallbacks — identical to the
+   runbackup screen so the two match whatever theme the site runs. */
+.msb-progress-modal {
+	--msb-accent: var(--template-link-color, var(--bs-link-color, #2a69b8));
+	--msb-accent2: var(--template-special-color, var(--msb-accent));
+	--msb-success: var(--template-success-color, var(--bs-success, #2f7d32));
+	--msb-danger: var(--template-danger-color, var(--bs-danger, #c52128));
+	--msb-track: var(--template-bg-light, var(--bs-gray-200, #edf0f5));
+}
+
+/* Full-screen black takeover, mirroring the runbackup page. */
+.msb-progress-modal .modal-dialog {
+	max-width: 100%;
+	width: 100%;
+	min-height: 100%;
+	margin: 0;
+}
+
+.msb-progress-modal .modal-content {
+	min-height: 100vh;
+	border: 0;
+	border-radius: 0;
+	background-color: #000;
+	color: #fff;
+	display: flex;
+	flex-direction: column;
+	justify-content: center;
+	align-items: center;
+	padding: 1.5rem;
+}
+
+.msb-progress-modal .modal-header {
+	border: 0;
+	padding: 0 0 1.5rem;
+	justify-content: center;
+	text-align: center;
+}
+
+/* Big heading, like the runbackup title. */
+.msb-progress-modal .modal-title {
+	color: #fff;
+	font-size: clamp(1.75rem, 4vw, 2.75rem);
+	font-weight: 700;
+	letter-spacing: .01em;
+}
+
+.msb-progress-modal .modal-body {
+	width: 100%;
+	max-width: 680px;
+	padding: 0;
+	text-align: center;
+}
+
+.msb-progress-modal .msb-pm-status {
+	color: #fff;
+	font-size: 1.25rem;
+	margin: 1rem 0 .25rem;
+}
+
+.msb-progress-modal .msb-pm-phase {
+	color: rgba(255, 255, 255, .6);
+	font-size: .95rem;
+	margin: 0;
+}
+
+/* Auto-continue opt-out, matching the runbackup screen's checkbox. */
+.msb-progress-modal .msb-pm-autocontinue {
+	margin-top: 1.5rem;
+	color: rgba(255, 255, 255, .85);
+	font-size: 1rem;
+}
+
+.msb-progress-modal .msb-pm-autocontinue label {
+	display: inline-flex;
+	align-items: center;
+	gap: .5rem;
+	cursor: pointer;
+}
+
+.msb-progress-modal .msb-pm-autocontinue input {
+	width: 1.1rem;
+	height: 1.1rem;
+}
+
+/* Terminal-state action buttons and the running-state cancel button. */
+.msb-progress-modal .msb-pm-actions,
+.msb-progress-modal .msb-pm-cancel {
+	margin-top: 1.5rem;
+	display: flex;
+	gap: .75rem;
+	justify-content: center;
+	flex-wrap: wrap;
+}
+
+.msb-progress-modal .msb-pm-actions .btn,
+.msb-progress-modal .msb-pm-cancel .btn {
+	min-width: 10rem;
+}
+
+.msb-progress-modal .msb-pm-warn {
+	color: #ffd23f;
+	font-weight: 600;
+	font-size: 1rem;
+	margin-bottom: 1.25rem;
+}
+
+/* Progress bar — mirrors runbackup.css .msb-rb-progress/.msb-rb-bar. */
+.msb-progress-modal .msb-rb-progress {
+	height: 2.75rem;
+	background: var(--msb-track);
+	border-radius: .35rem;
+	overflow: hidden;
+}
+
+.msb-progress-modal .msb-rb-bar {
+	position: relative;
+	height: 100%;
+	width: 0;
+	display: flex;
+	align-items: center;
+	justify-content: center;
+	color: #fff;
+	font-weight: 600;
+	font-size: 1rem;
+	white-space: nowrap;
+	background-color: var(--msb-accent);
+	background-image: linear-gradient(90deg, var(--msb-accent), var(--msb-accent2));
+	transition: width .35s ease;
+}
+
+.msb-progress-modal .msb-rb-bar.is-animated::after {
+	content: "";
+	position: absolute;
+	inset: 0;
+	background-image: linear-gradient(45deg, rgba(255, 255, 255, .18) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, .18) 50%, rgba(255, 255, 255, .18) 75%, transparent 75%, transparent);
+	background-size: 1rem 1rem;
+	animation: msb-pm-stripes 1s linear infinite;
+}
+
+.msb-progress-modal .msb-rb-bar.is-success {
+	background-image: none;
+	background-color: var(--msb-success);
+}
+
+.msb-progress-modal .msb-rb-bar.is-danger {
+	background-image: none;
+	background-color: var(--msb-danger);
+}
+
+@keyframes msb-pm-stripes {
+	from {
+		background-position: 1rem 0;
+	}
+
+	to {
+		background-position: 0 0;
+	}
+}

source/packages/com_mokosuitebackup/media/css/runbackup.css

@@ -0,0 +1,86 @@
+/*
+ * @package     MokoSuiteBackup
+ * @subpackage  com_mokosuitebackup
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * Full-screen backup progress screen (view=runbackup). Loaded via the Joomla
+ * Web Asset Manager (asset com_mokosuitebackup.runbackup).
+ */
+
+/* Full-screen backup runs on a black backdrop. */
+html,
+body {
+	background-color: #000 !important;
+}
+
+/* Colours are pulled from the Atum admin template's own CSS custom properties
+   so the screen matches whatever theme the site runs, with Bootstrap and then
+   a literal as progressive fallbacks. */
+.msb-runbackup {
+	--msb-accent: var(--template-link-color, var(--bs-link-color, #2a69b8));
+	--msb-accent2: var(--template-special-color, var(--msb-accent));
+	--msb-success: var(--template-success-color, var(--bs-success, #2f7d32));
+	--msb-danger: var(--template-danger-color, var(--bs-danger, #c52128));
+	--msb-track: var(--template-bg-light, var(--bs-gray-200, #edf0f5));
+
+	padding: 0 1rem;
+}
+
+/* overflow:hidden clips the full-bleed bar to the card's rounded corners.
+   The card's gray background comes from a Bootstrap utility class on the
+   element itself (see the template), not a rule here. */
+.msb-runbackup .card {
+	overflow: hidden;
+}
+
+.msb-rb-progress {
+	height: 2.5rem;
+	background: var(--msb-track);
+	overflow: hidden;
+}
+
+.msb-rb-bar {
+	position: relative;
+	height: 100%;
+	width: 0;
+	display: flex;
+	align-items: center;
+	justify-content: center;
+	color: #fff;
+	font-weight: 600;
+	font-size: .95rem;
+	white-space: nowrap;
+	background-color: var(--msb-accent);
+	background-image: linear-gradient(90deg, var(--msb-accent), var(--msb-accent2));
+	transition: width .35s ease;
+}
+
+.msb-rb-bar.is-animated::after {
+	content: "";
+	position: absolute;
+	inset: 0;
+	background-image: linear-gradient(45deg, rgba(255, 255, 255, .18) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, .18) 50%, rgba(255, 255, 255, .18) 75%, transparent 75%, transparent);
+	background-size: 1rem 1rem;
+	animation: msb-rb-stripes 1s linear infinite;
+}
+
+.msb-rb-bar.is-success {
+	background-image: none;
+	background-color: var(--msb-success);
+}
+
+.msb-rb-bar.is-danger {
+	background-image: none;
+	background-color: var(--msb-danger);
+}
+
+@keyframes msb-rb-stripes {
+	from {
+		background-position: 1rem 0;
+	}
+
+	to {
+		background-position: 0 0;
+	}
+}

source/packages/com_mokosuitebackup/media/joomla.asset.json

@@ -9,6 +9,16 @@
 			"name": "com_mokosuitebackup.admin",
 			"type": "style",
 			"uri": "com_mokosuitebackup/css/admin.css"
+		},
+		{
+			"name": "com_mokosuitebackup.runbackup",
+			"type": "style",
+			"uri": "com_mokosuitebackup/css/runbackup.css"
+		},
+		{
+			"name": "com_mokosuitebackup.backup-progress",
+			"type": "style",
+			"uri": "com_mokosuitebackup/css/backup-progress.css"
 		}
 	]
 }

source/packages/com_mokosuitebackup/mokosuitebackup.xml

@@ -17,7 +17,7 @@
 		display label there.
 	-->
 	<name>MokoSuiteBackup</name>
-	<version>02.59.00</version>
+	<version>02.65.00</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/com_mokosuitebackup/sql/install.mysql.sql

@@ -26,7 +26,7 @@ CREATE TABLE IF NOT EXISTS `#__mokosuitebackup_profiles` (
 	`retention_days`       INT(11) NOT NULL DEFAULT 0 COMMENT 'Delete backups older than N days; 0 = unlimited',
 	`retention_count`      INT(11) NOT NULL DEFAULT 0 COMMENT 'Keep newest N backups; 0 = unlimited',
 	`ntfy_topic`           VARCHAR(255) NOT NULL DEFAULT '' COMMENT 'ntfy topic name',
-	`ntfy_server`          VARCHAR(512) NOT NULL DEFAULT 'https://ntfy.sh' COMMENT 'ntfy server URL',
+	`ntfy_server`          VARCHAR(512) NOT NULL DEFAULT 'https://ntfy.mokoconsulting.tech' COMMENT 'ntfy server URL',
 	`ntfy_token`           VARCHAR(255) NOT NULL DEFAULT '' COMMENT 'ntfy access token (optional)',
 	`published`         TINYINT(1) NOT NULL DEFAULT 1,
 	`created`           DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',

source/packages/com_mokosuitebackup/sql/updates/mysql/01.01.01.sql

@@ -1 +1,5 @@
-ALTER TABLE `#__mokosuitebackup_profiles` CHANGE `include_kickstart` `include_mokorestore` TINYINT(1) NOT NULL DEFAULT 0 COMMENT 'Include MokoRestore standalone restore script in archive';
+-- Renames include_kickstart -> include_mokorestore. Declared VARCHAR(20) here to
+-- match the final column type (widened from TINYINT in 01.39.00). Joomla's schema
+-- checker does no cross-file supersession, so an earlier TINYINT definition would
+-- be flagged forever against the now-VARCHAR column.
+ALTER TABLE `#__mokosuitebackup_profiles` CHANGE `include_kickstart` `include_mokorestore` VARCHAR(20) NOT NULL DEFAULT '0' COMMENT 'Include MokoRestore standalone restore script in archive';

source/packages/com_mokosuitebackup/sql/updates/mysql/01.35.00.sql

@@ -1,10 +1,16 @@
 -- MokoSuiteBackup 01.35.00 — SFTP support with key file storage
-
+--
+-- These columns are legacy: 01.41.00 migrates them into #__mokosuitebackup_remotes
+-- and 02.52.25 + the postflight dropLegacyRemoteColumns() purge them, so they do not
+-- exist at rest. Written as bare `ADD` (not `ADD COLUMN`) on purpose: MySQL treats
+-- the two identically, but Joomla's schema checker only builds an ADD-COLUMN check
+-- for the `ADD COLUMN` form. Bare `ADD` is skipped by the checker, so it no longer
+-- reports these retired columns as "missing" while the upgrade still adds them.
 ALTER TABLE `#__mokosuitebackup_profiles`
-    ADD COLUMN `sftp_host` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ftp_ssl`,
-    ADD COLUMN `sftp_port` INT(5) UNSIGNED NOT NULL DEFAULT 22 AFTER `sftp_host`,
-    ADD COLUMN `sftp_username` VARCHAR(255) NOT NULL DEFAULT '' AFTER `sftp_port`,
-    ADD COLUMN `sftp_password` VARCHAR(255) NOT NULL DEFAULT '' AFTER `sftp_username`,
-    ADD COLUMN `sftp_key_data` MEDIUMTEXT AFTER `sftp_password`,
-    ADD COLUMN `sftp_passphrase` VARCHAR(255) NOT NULL DEFAULT '' AFTER `sftp_key_data`,
-    ADD COLUMN `sftp_path` VARCHAR(512) NOT NULL DEFAULT '/backups' AFTER `sftp_passphrase`;
+    ADD `sftp_host` VARCHAR(255) NOT NULL DEFAULT '' AFTER `ftp_ssl`,
+    ADD `sftp_port` INT(5) UNSIGNED NOT NULL DEFAULT 22 AFTER `sftp_host`,
+    ADD `sftp_username` VARCHAR(255) NOT NULL DEFAULT '' AFTER `sftp_port`,
+    ADD `sftp_password` VARCHAR(255) NOT NULL DEFAULT '' AFTER `sftp_username`,
+    ADD `sftp_key_data` MEDIUMTEXT AFTER `sftp_password`,
+    ADD `sftp_passphrase` VARCHAR(255) NOT NULL DEFAULT '' AFTER `sftp_key_data`,
+    ADD `sftp_path` VARCHAR(512) NOT NULL DEFAULT '/backups' AFTER `sftp_passphrase`;

source/packages/com_mokosuitebackup/sql/updates/mysql/01.36.00.sql

@@ -1,4 +1,6 @@
 -- MokoSuiteBackup 01.36.00 — SFTP auth type column
-
+--
+-- Legacy column (see 01.35.00). Bare `ADD` so Joomla's schema checker skips it —
+-- the column is purged by 02.52.25 + postflight and must not exist at rest.
 ALTER TABLE `#__mokosuitebackup_profiles`
-    ADD COLUMN `sftp_auth_type` VARCHAR(20) NOT NULL DEFAULT 'key' AFTER `sftp_username`;
+    ADD `sftp_auth_type` VARCHAR(20) NOT NULL DEFAULT 'key' AFTER `sftp_username`;

source/packages/com_mokosuitebackup/sql/updates/mysql/01.39.00.sql

@@ -1,5 +1,8 @@
 -- MokoSuiteBackup 01.39.00 — Change include_mokorestore from TINYINT to VARCHAR
 -- Needed to support 'standalone' value alongside 0/1
 
+-- NB: MySQL syntax is `MODIFY <col>`, not `MODIFY COLUMN <col>`. Joomla's schema
+-- checker parses `MODIFY COLUMN x` as column-name="COLUMN", type="x", producing a
+-- bogus "wrong type for column 'COLUMN'" problem. Keep it as bare MODIFY.
 ALTER TABLE `#__mokosuitebackup_profiles`
-    MODIFY COLUMN `include_mokorestore` VARCHAR(20) NOT NULL DEFAULT '0';
+    MODIFY `include_mokorestore` VARCHAR(20) NOT NULL DEFAULT '0';

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.01.sql

@@ -0,0 +1 @@
+/* 02.59.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.02.sql

@@ -0,0 +1 @@
+/* 02.59.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.03.sql

@@ -0,0 +1 @@
+/* 02.59.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.04.sql

@@ -0,0 +1 @@
+/* 02.59.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.05.sql

@@ -0,0 +1 @@
+/* 02.59.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.06.sql

@@ -0,0 +1 @@
+/* 02.59.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.07.sql

@@ -0,0 +1 @@
+/* 02.59.07 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.08.sql

@@ -0,0 +1 @@
+/* 02.59.08 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.09.sql

@@ -0,0 +1 @@
+/* 02.59.09 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.00.sql

@@ -0,0 +1 @@
+/* 02.60.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.01.sql

@@ -0,0 +1 @@
+/* 02.60.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.02.sql

@@ -0,0 +1 @@
+/* 02.60.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.03.sql

@@ -0,0 +1 @@
+/* 02.60.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.04.sql

@@ -0,0 +1 @@
+/* 02.60.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.05.sql

@@ -0,0 +1 @@
+/* 02.60.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.06.sql

@@ -0,0 +1 @@
+/* 02.60.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.00.sql

@@ -0,0 +1 @@
+/* 02.61.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.01.sql

@@ -0,0 +1 @@
+/* 02.61.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.04.sql

@@ -0,0 +1 @@
+/* 02.61.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.05.sql

@@ -0,0 +1 @@
+/* 02.61.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.06.sql

@@ -0,0 +1 @@
+/* 02.61.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.00.sql

@@ -0,0 +1 @@
+/* 02.62.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.01.sql

@@ -0,0 +1 @@
+/* 02.62.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.02.sql

@@ -0,0 +1 @@
+/* 02.62.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.03.sql

@@ -0,0 +1 @@
+/* 02.62.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.04.sql

@@ -0,0 +1 @@
+/* 02.62.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.05.sql

@@ -0,0 +1 @@
+/* 02.62.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.00.sql

@@ -0,0 +1 @@
+/* 02.63.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.01.sql

@@ -0,0 +1 @@
+/* 02.63.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.02.sql

@@ -0,0 +1 @@
+/* 02.63.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.05.sql

@@ -0,0 +1 @@
+/* 02.63.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.06.sql

@@ -0,0 +1 @@
+/* 02.63.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.07.sql

@@ -0,0 +1 @@
+/* 02.63.07 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.09.sql

@@ -0,0 +1 @@
+/* 02.63.09 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.10.sql

@@ -0,0 +1 @@
+/* 02.63.10 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.11.sql

@@ -0,0 +1 @@
+/* 02.63.11 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.00.sql

@@ -0,0 +1 @@
+/* 02.64.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.01.sql

@@ -0,0 +1 @@
+/* 02.64.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.02.sql

@@ -0,0 +1 @@
+/* 02.64.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.03.sql

@@ -0,0 +1 @@
+/* 02.64.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.04.sql

@@ -0,0 +1 @@
+/* 02.64.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.05.sql

@@ -0,0 +1,6 @@
+-- MokoSuiteBackup 02.64.05 — Schema-checker reconciliation for #__mokosuitebackup_profiles
+-- Ensures include_mokorestore is VARCHAR(20) on any install (idempotent; no-op if
+-- already VARCHAR). Paired with retro-fixes to 01.01.01/01.39.00 and the legacy
+-- sftp_* columns restored to install.mysql.sql so the Database view reports no problems.
+ALTER TABLE `#__mokosuitebackup_profiles`
+    MODIFY `include_mokorestore` VARCHAR(20) NOT NULL DEFAULT '0';

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.06.sql

@@ -0,0 +1 @@
+/* 02.64.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.09.sql

@@ -0,0 +1 @@
+/* 02.64.09 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.10.sql

@@ -0,0 +1 @@
+/* 02.64.10 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.11.sql

@@ -0,0 +1 @@
+/* 02.64.11 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.12.sql

@@ -0,0 +1 @@
+/* 02.64.12 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.64.13.sql

@@ -0,0 +1 @@
+/* 02.64.13 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.65.00.sql

@@ -0,0 +1 @@
+/* 02.65.00 — no schema changes */

source/packages/com_mokosuitebackup/src/Controller/AjaxController.php

@@ -89,11 +89,11 @@ class AjaxController extends BaseController
 	 *
 	 * Called by the full-screen backup screen after a successful backup so the
 	 * imminent server-side onExtensionBeforeUpdate / onExtensionBeforeUninstall
-	 * backup is skipped — it arms the same 10-minute throttle keys the system
-	 * plugin checks, preventing a duplicate backup when the update / uninstall
-	 * then proceeds. Arms BOTH keys so a single ack covers whichever action the
-	 * full-screen backup was fronting.
-	 * POST: task=ajax.preupdateAck
+	 * backup is skipped once — it sets a ONE-SHOT skip flag (keyed by the
+	 * `action` the backup was fronting) that plg_system_mokosuitebackup
+	 * consumes on the re-fired update/uninstall request, so exactly that one
+	 * action is not double-backed-up while later, distinct actions still are.
+	 * POST: task=ajax.preupdateAck&action=update|uninstall
 	 */
 	public function preupdateAck(): void
 	{
@@ -109,11 +109,21 @@ class AjaxController extends BaseController
 			return;
 		}
 
-		// Same keys + semantics as plg_system_mokosuitebackup::runPreActionBackup().
+		/* Set a ONE-SHOT skip flag for the specific action the full-screen backup
+		   was fronting. runPreActionBackup() consumes it on the re-fired
+		   update/uninstall request (once), so the synchronous backup is skipped
+		   that one time but the NEXT distinct action still backs up. Keyed by
+		   action so an update ack never suppresses a later, unrelated uninstall.
+		   For a core Joomla update (no action) neither flag is set — a core
+		   update doesn't fire onExtensionBefore(Update|Uninstall). */
+		$action  = $this->app->getInput()->getCmd('action', '');
 		$session = Factory::getSession();
-		$now     = time();
-		$session->set('mokosuitebackup.preaction_backup_before_update', $now);
-		$session->set('mokosuitebackup.preaction_backup_before_uninstall', $now);
+
+		if ($action === 'update') {
+			$session->set('mokosuitebackup.skip_preaction_backup_before_update', true);
+		} elseif ($action === 'uninstall') {
+			$session->set('mokosuitebackup.skip_preaction_backup_before_uninstall', true);
+		}
 
 		$this->sendJson(['error' => false, 'message' => 'Pre-action backup acknowledged']);
 	}
@@ -499,6 +509,39 @@ class AjaxController extends BaseController
 		$this->sendJson($result);
 	}
 
+	/**
+	 * Cancel an in-progress stepped restore and clean up its staging directory
+	 * and session/state files (prevents orphaned artefacts on a client cancel).
+	 * POST: task=ajax.restoreCancel&session_id=mb_...
+	 */
+	public function restoreCancel(): void
+	{
+		if (!Session::checkToken('get') && !Session::checkToken('post')) {
+			$this->sendJson(['error' => true, 'message' => 'Invalid token'], 403);
+
+			return;
+		}
+
+		if (!$this->app->getIdentity()->authorise('mokosuitebackup.backup.restore', 'com_mokosuitebackup')) {
+			$this->sendJson(['error' => true, 'message' => 'Access denied'], 403);
+
+			return;
+		}
+
+		$sessionId = $this->input->getString('session_id', '');
+
+		if (empty($sessionId)) {
+			$this->sendJson(['error' => true, 'message' => 'Missing session_id']);
+
+			return;
+		}
+
+		$engine = new SteppedRestoreEngine();
+		$result = $engine->cancel($sessionId);
+
+		$this->sendJson($result);
+	}
+
 	/**
 	 * Browse archive contents without extracting.
 	 * POST: task=ajax.browseArchive&id=123

source/packages/com_mokosuitebackup/src/Engine/DatabaseImporter.php

@@ -61,34 +61,37 @@ class DatabaseImporter
 			while (($line = fgets($handle)) !== false) {
 				$trimmed = trim($line);
 
-				// Skip empty lines
-				if ($trimmed === '') {
-					continue;
-				}
-
-				// Skip single-line comments
-				if (str_starts_with($trimmed, '--') || str_starts_with($trimmed, '#')) {
-					continue;
-				}
-
-				// Handle multi-line comments
-				if (str_starts_with($trimmed, '/*')) {
-					$inMultiLineComment = true;
-				}
-
-				if ($inMultiLineComment) {
-					if (str_contains($trimmed, '*/')) {
-						$inMultiLineComment = false;
+				// Comment/blank skipping applies only BETWEEN statements — never
+				// inside an accumulating statement, where a line may be part of a
+				// multi-line string value that happens to start with --, # or /*.
+				if ($currentStatement === '') {
+					if ($trimmed === '') {
+						continue;
 					}
 
-					continue;
+					if (str_starts_with($trimmed, '--') || str_starts_with($trimmed, '#')) {
+						continue;
+					}
+
+					if (str_starts_with($trimmed, '/*')) {
+						$inMultiLineComment = true;
+					}
+
+					if ($inMultiLineComment) {
+						if (str_contains($trimmed, '*/')) {
+							$inMultiLineComment = false;
+						}
+
+						continue;
+					}
 				}
 
 				// Accumulate the statement
 				$currentStatement .= $line;
 
-				// Check if statement is complete (ends with semicolon)
-				if (str_ends_with($trimmed, ';')) {
+				// A statement ends at a ';' that is NOT inside a quoted string
+				// literal, so a ';' or newline in a value does not split it early.
+				if ($this->isCompleteStatement($currentStatement)) {
 					$statement = trim($currentStatement);
 					$currentStatement = '';
 
@@ -136,6 +139,52 @@ class DatabaseImporter
 		return $statementsExecuted;
 	}
 
+	/**
+	 * Whether an accumulated SQL string is a complete statement: it ends with
+	 * ';' that is NOT inside a quoted string literal. Tracks single/double/
+	 * backtick quoting (with backslash escapes; MySQL '' doubling falls out of
+	 * the toggle naturally) so a ';' or newline inside a value does not
+	 * terminate the statement early.
+	 */
+	private function isCompleteStatement(string $sql): bool
+	{
+		$len        = \strlen($sql);
+		$inSingle   = false;
+		$inDouble   = false;
+		$inBacktick = false;
+
+		for ($i = 0; $i < $len; $i++) {
+			$ch = $sql[$i];
+
+			if ($inSingle) {
+				if ($ch === '\\') { $i++; continue; }
+				if ($ch === "'")  { $inSingle = false; }
+				continue;
+			}
+
+			if ($inDouble) {
+				if ($ch === '\\') { $i++; continue; }
+				if ($ch === '"')  { $inDouble = false; }
+				continue;
+			}
+
+			if ($inBacktick) {
+				if ($ch === '`') { $inBacktick = false; }
+				continue;
+			}
+
+			if ($ch === "'") { $inSingle = true; }
+			elseif ($ch === '"') { $inDouble = true; }
+			elseif ($ch === '`') { $inBacktick = true; }
+		}
+
+		if ($inSingle || $inDouble || $inBacktick) {
+			return false;
+		}
+
+		return str_ends_with(rtrim($sql), ';');
+	}
+
 	/**
 	 * Non-fatal errors from the last import(), if any. A non-empty result
 	 * means the restore completed with problems and should be treated as a

source/packages/com_mokosuitebackup/src/Engine/MokoRestore.php

@@ -232,13 +232,13 @@ REPL,
 
             if (backups.length === 0) {
                 var alert = document.createElement('div');
-                alert.style.cssText = 'padding:12px;background:#fef2f2;border:1px solid #fecaca;border-radius:6px;color:#dc2626;';
+                alert.style.cssText = 'padding:12px;background:rgba(224,49,49,0.12);border:1px solid rgba(224,49,49,0.4);border-radius:6px;color:#ff8787;';
                 alert.textContent = 'No ZIP files found in this directory. Upload a backup archive first.';
                 list.appendChild(alert);
             } else if (backups.length === 1) {
                 hiddenInput.value = backups[0].name;
                 var found = document.createElement('div');
-                found.style.cssText = 'padding:12px;background:#dcfce7;border:1px solid #bbf7d0;border-radius:6px;color:#16a34a;';
+                found.style.cssText = 'padding:12px;background:rgba(47,158,68,0.15);border:1px solid rgba(47,158,68,0.35);border-radius:6px;color:#69db7c;';
                 var strong = document.createElement('strong');
                 strong.textContent = backups[0].name;
                 found.appendChild(document.createTextNode('Found: '));
@@ -247,13 +247,13 @@ REPL,
                 list.appendChild(found);
             } else {
                 var hint = document.createElement('div');
-                hint.style.cssText = 'padding:8px 12px;background:#eff6ff;border:1px solid #bfdbfe;border-radius:6px;color:#1d4ed8;margin-bottom:8px;font-size:0.9em;';
+                hint.style.cssText = 'padding:8px 12px;background:rgba(42,105,184,0.12);border:1px solid rgba(42,105,184,0.35);border-radius:6px;color:#a5d8ff;margin-bottom:8px;font-size:0.9em;';
                 hint.textContent = 'Multiple backup archives found \u2014 select which one to restore:';
                 list.appendChild(hint);
                 backups.forEach(function(b, i) {
                     var label = document.createElement('label');
-                    label.style.cssText = 'display:flex;align-items:center;padding:10px 12px;margin:4px 0;border:1px solid #e2e8f0;border-radius:6px;cursor:pointer;transition:background 0.15s;';
-                    label.onmouseover = function() { this.style.background = '#f8fafc'; };
+                    label.style.cssText = 'display:flex;align-items:center;padding:10px 12px;margin:4px 0;border:1px solid #2a2f37;border-radius:6px;cursor:pointer;transition:background 0.15s;';
+                    label.onmouseover = function() { this.style.background = '#1e2229'; };
                     label.onmouseout = function() { this.style.background = ''; };
                     var radio = document.createElement('input');
                     radio.type = 'radio';
@@ -268,7 +268,7 @@ REPL,
                     nameStrong.textContent = b.name;
                     info.appendChild(nameStrong);
                     var meta = document.createElement('div');
-                    meta.style.cssText = 'font-size:0.85em;color:#64748b;margin-top:2px;';
+                    meta.style.cssText = 'font-size:0.85em;color:#9aa4b2;margin-top:2px;';
                     meta.textContent = (b.size / 1048576).toFixed(1) + ' MB \u2014 ' + b.date;
                     info.appendChild(meta);
                     label.appendChild(info);
@@ -480,8 +480,8 @@ function actionPreflight(): array
     $checks[] = [
         'label' => 'PHP Version',
         'value' => PHP_VERSION,
-        'ok'    => version_compare(PHP_VERSION, '8.1', '>='),
-        'hint'  => 'Joomla 4/5 requires PHP 8.1+',
+        'ok'    => version_compare(PHP_VERSION, '8.3', '>='),
+        'hint'  => 'Joomla 6 requires PHP 8.3+',
     ];
 
     $checks[] = [
@@ -1507,92 +1507,107 @@ PHP_BACKEND;
 <title>MokoRestore — Site Installer</title>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
-body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;background:#f0f4f8;color:#333;line-height:1.6}
-.mr-header{background:linear-gradient(135deg,#1a3c5e 0%,#2d6a9f 100%);color:#fff;padding:1.5rem 2rem;text-align:center}
-.mr-header h1{font-size:1.6rem;font-weight:700;margin-bottom:0.2rem}
-.mr-header p{font-size:0.9rem;opacity:0.85}
+/* Full-black MokoSuite theme, matching the runbackup / backup-progress screens. */
+:root{
+	--mr-bg:#000;
+	--mr-panel:#15181d;
+	--mr-input:#1e2229;
+	--mr-border:#2a2f37;
+	--mr-text:#f1f3f5;
+	--mr-muted:#9aa4b2;
+	--mr-accent:#2a69b8;
+	--mr-accent2:#3b82f6;
+	--mr-success:#2f9e44;
+	--mr-danger:#e03131;
+	--mr-warn:#f0b429;
+}
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;background:var(--mr-bg);color:var(--mr-text);line-height:1.6}
+.mr-header{background:#000;color:#fff;padding:2.25rem 2rem;text-align:center;border-bottom:1px solid var(--mr-border)}
+.mr-header h1{font-size:2.5rem;font-weight:700;letter-spacing:.01em;margin-bottom:0.25rem}
+.mr-header p{font-size:1rem;color:var(--mr-muted)}
 .mr-container{max-width:800px;margin:1.5rem auto;padding:0 1rem}
 
 /* Step progress bar */
 .mr-steps{display:flex;justify-content:center;margin-bottom:1.5rem;gap:0;flex-wrap:wrap}
-.mr-step{display:flex;align-items:center;gap:0.5rem;padding:0.5rem 1rem;font-size:0.8rem;color:#94a3b8;cursor:default;position:relative}
-.mr-step .mr-num{width:28px;height:28px;border-radius:50%;border:2px solid #cbd5e1;display:flex;align-items:center;justify-content:center;font-weight:700;font-size:0.75rem;background:#fff;flex-shrink:0}
-.mr-step.active{color:#1e40af;font-weight:600}
-.mr-step.active .mr-num{border-color:#2563eb;background:#2563eb;color:#fff}
-.mr-step.done{color:#16a34a}
-.mr-step.done .mr-num{border-color:#16a34a;background:#16a34a;color:#fff}
-.mr-step::after{content:'';width:24px;height:2px;background:#cbd5e1;margin-left:0.5rem}
+.mr-step{display:flex;align-items:center;gap:0.5rem;padding:0.5rem 1rem;font-size:0.8rem;color:var(--mr-muted);cursor:default;position:relative}
+.mr-step .mr-num{width:28px;height:28px;border-radius:50%;border:2px solid var(--mr-border);display:flex;align-items:center;justify-content:center;font-weight:700;font-size:0.75rem;background:var(--mr-input);color:var(--mr-muted);flex-shrink:0}
+.mr-step.active{color:#fff;font-weight:600}
+.mr-step.active .mr-num{border-color:var(--mr-accent);background:var(--mr-accent);color:#fff}
+.mr-step.done{color:var(--mr-success)}
+.mr-step.done .mr-num{border-color:var(--mr-success);background:var(--mr-success);color:#fff}
+.mr-step::after{content:'';width:24px;height:2px;background:var(--mr-border);margin-left:0.5rem}
 .mr-step:last-child::after{display:none}
-.mr-step.done::after{background:#16a34a}
+.mr-step.done::after{background:var(--mr-success)}
 
 /* Panels */
-.mr-panel{display:none;background:#fff;border-radius:12px;box-shadow:0 1px 3px rgba(0,0,0,0.1);padding:2rem;margin-bottom:1rem}
+.mr-panel{display:none;background:var(--mr-panel);border:1px solid var(--mr-border);border-radius:12px;box-shadow:0 1px 3px rgba(0,0,0,0.5);padding:2rem;margin-bottom:1rem}
 .mr-panel.visible{display:block}
-.mr-panel h2{font-size:1.2rem;color:#1e293b;margin-bottom:0.25rem}
-.mr-panel .mr-desc{color:#64748b;font-size:0.9rem;margin-bottom:1.5rem}
+.mr-panel h2{font-size:1.4rem;color:#fff;margin-bottom:0.25rem}
+.mr-panel .mr-desc{color:var(--mr-muted);font-size:0.9rem;margin-bottom:1.5rem}
 
 /* Form elements */
 .mr-field{margin-bottom:1rem}
-.mr-field label{display:block;font-weight:600;font-size:0.85rem;color:#475569;margin-bottom:0.3rem}
-.mr-field input,.mr-field select{width:100%;padding:0.6rem 0.75rem;border:1px solid #d1d5db;border-radius:6px;font-size:0.9rem;color:#1e293b;background:#fff;transition:border-color 0.2s}
-.mr-field input:focus,.mr-field select:focus{outline:none;border-color:#2563eb;box-shadow:0 0 0 3px rgba(37,99,235,0.1)}
-.mr-field .mr-hint{font-size:0.8rem;color:#94a3b8;margin-top:0.2rem}
+.mr-field label{display:block;font-weight:600;font-size:0.85rem;color:#cfd6df;margin-bottom:0.3rem}
+.mr-field input,.mr-field select{width:100%;padding:0.6rem 0.75rem;border:1px solid var(--mr-border);border-radius:6px;font-size:0.9rem;color:var(--mr-text);background:var(--mr-input);transition:border-color 0.2s}
+.mr-field input::placeholder{color:#69707c}
+.mr-field input:focus,.mr-field select:focus{outline:none;border-color:var(--mr-accent);box-shadow:0 0 0 3px rgba(42,105,184,0.25)}
+.mr-field .mr-hint{font-size:0.8rem;color:var(--mr-muted);margin-top:0.2rem}
 .mr-row{display:flex;gap:1rem}
 .mr-row .mr-field{flex:1}
 
 /* Buttons */
 .mr-btn{display:inline-flex;align-items:center;gap:0.4rem;padding:0.65rem 1.5rem;border:none;border-radius:6px;font-size:0.9rem;font-weight:600;cursor:pointer;transition:all 0.2s}
 .mr-btn:disabled{opacity:0.5;cursor:not-allowed}
-.mr-btn-primary{background:#2563eb;color:#fff}
-.mr-btn-primary:hover:not(:disabled){background:#1d4ed8}
-.mr-btn-success{background:#16a34a;color:#fff}
-.mr-btn-success:hover:not(:disabled){background:#15803d}
-.mr-btn-danger{background:#dc2626;color:#fff}
-.mr-btn-danger:hover:not(:disabled){background:#b91c1c}
-.mr-btn-outline{background:transparent;color:#2563eb;border:1px solid #2563eb}
-.mr-btn-outline:hover:not(:disabled){background:#eff6ff}
-.mr-actions{display:flex;justify-content:space-between;align-items:center;margin-top:1.5rem;padding-top:1rem;border-top:1px solid #e2e8f0}
+.mr-btn-primary{background:var(--mr-accent);color:#fff}
+.mr-btn-primary:hover:not(:disabled){filter:brightness(1.15)}
+.mr-btn-success{background:var(--mr-success);color:#fff}
+.mr-btn-success:hover:not(:disabled){filter:brightness(1.15)}
+.mr-btn-danger{background:var(--mr-danger);color:#fff}
+.mr-btn-danger:hover:not(:disabled){filter:brightness(1.15)}
+.mr-btn-outline{background:transparent;color:#74c0fc;border:1px solid var(--mr-accent)}
+.mr-btn-outline:hover:not(:disabled){background:rgba(42,105,184,0.15)}
+.mr-actions{display:flex;justify-content:space-between;align-items:center;margin-top:1.5rem;padding-top:1rem;border-top:1px solid var(--mr-border)}
 
 /* Check list */
 .mr-checks{list-style:none;margin:0;padding:0}
-.mr-checks li{display:flex;align-items:center;gap:0.75rem;padding:0.5rem 0;border-bottom:1px solid #f1f5f9;font-size:0.9rem}
+.mr-checks li{display:flex;align-items:center;gap:0.75rem;padding:0.5rem 0;border-bottom:1px solid var(--mr-border);font-size:0.9rem}
 .mr-checks li:last-child{border-bottom:none}
 .mr-check-icon{width:24px;height:24px;border-radius:50%;display:flex;align-items:center;justify-content:center;font-size:0.75rem;font-weight:700;flex-shrink:0}
-.mr-check-ok{background:#dcfce7;color:#16a34a}
-.mr-check-warn{background:#fef9c3;color:#a16207}
-.mr-check-fail{background:#fef2f2;color:#dc2626}
-.mr-check-info{background:#e0f2fe;color:#0284c7}
-.mr-check-label{flex:1;font-weight:500}
-.mr-check-value{color:#64748b;font-size:0.85rem}
-.mr-check-hint{font-size:0.8rem;color:#94a3b8}
+.mr-check-ok{background:rgba(47,158,68,0.18);color:#69db7c}
+.mr-check-warn{background:rgba(240,180,41,0.18);color:#ffd43b}
+.mr-check-fail{background:rgba(224,49,49,0.18);color:#ff8787}
+.mr-check-info{background:rgba(42,105,184,0.18);color:#74c0fc}
+.mr-check-label{flex:1;font-weight:500;color:var(--mr-text)}
+.mr-check-value{color:var(--mr-muted);font-size:0.85rem}
+.mr-check-hint{font-size:0.8rem;color:var(--mr-muted)}
 
 /* Alert */
 .mr-alert{padding:0.75rem 1rem;border-radius:6px;font-size:0.9rem;margin-bottom:1rem;display:flex;align-items:flex-start;gap:0.5rem}
-.mr-alert-warn{background:#fef3c7;color:#92400e;border:1px solid #fde68a}
-.mr-alert-danger{background:#fef2f2;color:#991b1b;border:1px solid #fecaca}
-.mr-alert-success{background:#f0fdf4;color:#166534;border:1px solid #bbf7d0}
-.mr-alert-info{background:#eff6ff;color:#1e40af;border:1px solid #bfdbfe}
+.mr-alert-warn{background:rgba(240,180,41,0.12);color:#ffe08a;border:1px solid rgba(240,180,41,0.35)}
+.mr-alert-danger{background:rgba(224,49,49,0.12);color:#ffc9c9;border:1px solid rgba(224,49,49,0.4)}
+.mr-alert-success{background:rgba(47,158,68,0.12);color:#b2f2bb;border:1px solid rgba(47,158,68,0.35)}
+.mr-alert-info{background:rgba(42,105,184,0.12);color:#a5d8ff;border:1px solid rgba(42,105,184,0.35)}
 
 /* Progress */
-.mr-progress{background:#e2e8f0;border-radius:8px;overflow:hidden;height:8px;margin:1rem 0}
-.mr-progress-bar{height:100%;background:linear-gradient(90deg,#2563eb,#3b82f6);transition:width 0.4s;border-radius:8px}
-.mr-status{font-size:0.85rem;color:#64748b;min-height:1.2rem}
+.mr-progress{background:var(--mr-input);border-radius:8px;overflow:hidden;height:8px;margin:1rem 0}
+.mr-progress-bar{height:100%;background:linear-gradient(90deg,var(--mr-accent),var(--mr-accent2));transition:width 0.4s;border-radius:8px}
+.mr-status{font-size:0.85rem;color:var(--mr-muted);min-height:1.2rem}
 
 /* Provisioning checkboxes */
 .mr-provision-list{list-style:none;padding:0;margin:0}
-.mr-provision-list li{display:flex;align-items:center;gap:0.75rem;padding:0.6rem 0.5rem;border-bottom:1px solid #f1f5f9;font-size:0.9rem;cursor:pointer;border-radius:4px}
-.mr-provision-list li:hover{background:#f8fafc}
+.mr-provision-list li{display:flex;align-items:center;gap:0.75rem;padding:0.6rem 0.5rem;border-bottom:1px solid var(--mr-border);font-size:0.9rem;cursor:pointer;border-radius:4px}
+.mr-provision-list li:hover{background:var(--mr-input)}
 .mr-provision-list li:last-child{border-bottom:none}
-.mr-provision-list input[type=checkbox]{width:18px;height:18px;accent-color:#2563eb}
-.mr-provision-desc{font-size:0.8rem;color:#94a3b8;margin-left:auto}
+.mr-provision-list input[type=checkbox]{width:18px;height:18px;accent-color:var(--mr-accent)}
+.mr-provision-desc{font-size:0.8rem;color:var(--mr-muted);margin-left:auto}
 
 /* Log */
-.mr-log{background:#1e293b;color:#94a3b8;border-radius:8px;padding:1rem;font-family:'SF Mono',SFMono-Regular,Consolas,monospace;font-size:0.8rem;max-height:200px;overflow-y:auto;white-space:pre-wrap;word-break:break-word;margin-top:1rem;display:none}
+.mr-log{background:#0d0f12;color:var(--mr-muted);border:1px solid var(--mr-border);border-radius:8px;padding:1rem;font-family:'SF Mono',SFMono-Regular,Consolas,monospace;font-size:0.8rem;max-height:200px;overflow-y:auto;white-space:pre-wrap;word-break:break-word;margin-top:1rem;display:none}
 .mr-log.visible{display:block}
 
 /* Footer */
-.mr-footer{text-align:center;padding:1.5rem;color:#94a3b8;font-size:0.8rem}
-.mr-footer a{color:#2563eb;text-decoration:none}
+.mr-footer{text-align:center;padding:1.5rem;color:var(--mr-muted);font-size:0.8rem}
+.mr-footer a{color:#74c0fc;text-decoration:none}
 
 /* Spinner */
 .mr-spinner{display:inline-block;width:16px;height:16px;border:2px solid rgba(255,255,255,0.3);border-radius:50%;border-top-color:#fff;animation:spin 0.6s linear infinite}
@@ -1629,11 +1644,11 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica N
     <div class="mr-panel <?php echo $securityVerified ? '' : 'visible'; ?>" id="panel0">
         <h2>Security Verification</h2>
         <p class="mr-desc">To prevent unauthorized access, enter the security code from the file <code>mokorestore-security.php</code> in your site root.</p>
-        <div style="border:1px solid #e2e8f0;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#f8fafc">
-            <div style="font-weight:600;font-size:0.9rem;color:#334155;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
+        <div style="border:1px solid #2a2f37;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#1e2229">
+            <div style="font-weight:600;font-size:0.9rem;color:#cfd6df;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
                 <span style="font-size:1.1rem">&#128274;</span> How to find the code
             </div>
-            <ol style="margin:0;padding-left:1.25rem;color:#475569;font-size:0.9rem;line-height:1.6">
+            <ol style="margin:0;padding-left:1.25rem;color:#9aa4b2;font-size:0.9rem;line-height:1.6">
                 <li>Connect to your server via FTP, SSH, or file manager</li>
                 <li>Open <code>mokorestore-security.php</code> in the site root directory</li>
                 <li>Copy the 8-character code and enter it below</li>
@@ -1666,7 +1681,7 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica N
         <h2>Extract Backup</h2>
         <p class="mr-desc">Extract site-backup.zip into the current directory.</p>
         <div class="mr-field">
-            <label>Archive Password <span style="font-weight:normal;color:#94a3b8">(leave blank if not encrypted)</span></label>
+            <label>Archive Password <span style="font-weight:normal;color:#9aa4b2">(leave blank if not encrypted)</span></label>
             <input type="password" id="archivePassword" placeholder="Optional decryption password">
         </div>
         <div class="mr-progress"><div class="mr-progress-bar" id="extractProgress" style="width:0%"></div></div>
@@ -1694,8 +1709,8 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica N
             <strong>Merge</strong> = keep existing table, INSERT IGNORE new rows.
             <strong>Data Only</strong> = keep schema, INSERT data as-is (assumes matching structure).
         </div>
-        <div id="tableResolutionList" style="max-height:400px;overflow-y:auto;border:1px solid #e2e8f0;border-radius:8px;margin-top:1rem">
-            <div style="padding:1rem;color:#94a3b8;text-align:center">Scanning tables...</div>
+        <div id="tableResolutionList" style="max-height:400px;overflow-y:auto;border:1px solid #2a2f37;border-radius:8px;margin-top:1rem">
+            <div style="padding:1rem;color:#9aa4b2;text-align:center">Scanning tables...</div>
         </div>
         <input type="hidden" id="tableResolutions" value="{}">
         <div class="mr-status" id="tableScanStatus"></div>
@@ -1735,21 +1750,21 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica N
         <h2>Site Configuration</h2>
         <p class="mr-desc">Configure your site settings. Credentials were removed from the backup for security &mdash; enter the correct values for this server.</p>
 
-        <div style="border:1px solid #e2e8f0;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#f8fafc">
-            <div style="font-weight:600;font-size:0.9rem;color:#334155;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
+        <div style="border:1px solid #2a2f37;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#1e2229">
+            <div style="font-weight:600;font-size:0.9rem;color:#cfd6df;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
                 <span style="font-size:1.1rem">&#127760;</span> General
             </div>
             <div class="mr-field"><label>Site Name</label><input type="text" id="siteName" value="Joomla Site"></div>
             <div class="mr-field">
-                <label>Live Site URL <span style="font-weight:normal;color:#94a3b8">(optional)</span></label>
+                <label>Live Site URL <span style="font-weight:normal;color:#9aa4b2">(optional)</span></label>
                 <input type="text" id="liveSite" placeholder="https://example.com">
                 <div class="mr-hint">Leave blank to auto-detect. Set this if using a reverse proxy or custom domain.</div>
             </div>
         </div>
 
-        <div style="border:1px solid #e2e8f0;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#f8fafc">
-            <div style="font-weight:600;font-size:0.9rem;color:#334155;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
-                <span style="font-size:1.1rem">&#9993;</span> Mail / SMTP <span style="font-weight:normal;font-size:0.8rem;color:#94a3b8">&mdash; leave blank if using PHP mail()</span>
+        <div style="border:1px solid #2a2f37;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#1e2229">
+            <div style="font-weight:600;font-size:0.9rem;color:#cfd6df;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
+                <span style="font-size:1.1rem">&#9993;</span> Mail / SMTP <span style="font-weight:normal;font-size:0.8rem;color:#9aa4b2">&mdash; leave blank if using PHP mail()</span>
             </div>
             <div class="mr-field"><label>SMTP Host</label><input type="text" id="smtpHost" placeholder="smtp.example.com"></div>
             <div class="mr-row">
@@ -1758,8 +1773,8 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica N
             </div>
         </div>
 
-        <div style="border:1px solid #e2e8f0;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#f8fafc">
-            <div style="font-weight:600;font-size:0.9rem;color:#334155;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
+        <div style="border:1px solid #2a2f37;border-radius:8px;padding:1.25rem;margin-bottom:1.25rem;background:#1e2229">
+            <div style="font-weight:600;font-size:0.9rem;color:#cfd6df;margin-bottom:1rem;display:flex;align-items:center;gap:0.5rem">
                 <span style="font-size:1.1rem">&#128736;</span> Server
             </div>
             <div class="mr-field" style="display:flex;align-items:center;gap:0.5rem">
@@ -2031,7 +2046,7 @@ async function runPreflight() {
             li.appendChild(val);
             if (c.warn && c.hint) {
                 var hint = document.createElement('div');
-                hint.style.cssText = 'font-size:0.85em;color:#a16207;margin-top:4px;padding:4px 8px;background:#fef9c3;border-radius:4px;';
+                hint.style.cssText = 'font-size:0.85em;color:#ffd43b;margin-top:4px;padding:4px 8px;background:rgba(240,180,41,0.12);border-radius:4px;';
                 hint.textContent = c.hint;
                 li.appendChild(hint);
             }
@@ -2113,7 +2128,7 @@ async function scanTables() {
     const r = await post('scanTables');
 
     if (!r.success || !r.tables || r.tables.length === 0) {
-        container.innerHTML = '<div style="padding:1rem;color:#94a3b8;text-align:center">No tables found in database.sql (or file not present). You can skip this step.</div>';
+        container.innerHTML = '<div style="padding:1rem;color:#9aa4b2;text-align:center">No tables found in database.sql (or file not present). You can skip this step.</div>';
         setStatus('tableScanStatus', r.tables ? 'No tables found' : (r.message || 'Scan failed'), r.success ? '' : 'error');
         log(r.message || 'No tables found');
         return;
@@ -2134,16 +2149,16 @@ function renderTableList() {
 
     tableList.forEach(function(name) {
         var row = document.createElement('div');
-        row.style.cssText = 'display:flex;align-items:center;justify-content:space-between;padding:0.5rem 0.75rem;border-bottom:1px solid #f1f5f9;font-size:0.85rem;';
+        row.style.cssText = 'display:flex;align-items:center;justify-content:space-between;padding:0.5rem 0.75rem;border-bottom:1px solid #2a2f37;font-size:0.85rem;';
 
         var label = document.createElement('span');
-        label.style.cssText = 'font-family:monospace;color:#334155;word-break:break-all;flex:1;margin-right:0.75rem;';
+        label.style.cssText = 'font-family:monospace;color:#cfd6df;word-break:break-all;flex:1;margin-right:0.75rem;';
         label.textContent = name;
 
         var sel = document.createElement('select');
         sel.dataset.table = name;
         sel.className = 'table-mode-select';
-        sel.style.cssText = 'padding:0.3rem 0.5rem;border:1px solid #d1d5db;border-radius:4px;font-size:0.8rem;min-width:120px;background:#fff;';
+        sel.style.cssText = 'padding:0.3rem 0.5rem;border:1px solid #2a2f37;border-radius:4px;font-size:0.8rem;min-width:120px;background:var(--mr-input);';
 
         var modes = [
             ['replace', 'Replace'],

source/packages/com_mokosuitebackup/src/Engine/NotificationSender.php

@@ -153,7 +153,7 @@ class NotificationSender
 	private static function sendNtfy(object $profile, object $record, bool $success): bool
 	{
 		$topic  = trim($profile->ntfy_topic ?? '');
-		$server = trim($profile->ntfy_server ?? 'https://ntfy.sh');
+		$server = trim($profile->ntfy_server ?? 'https://ntfy.mokoconsulting.tech');
 		$token  = trim($profile->ntfy_token ?? '');
 
 		if ($topic === '') {
@@ -428,7 +428,7 @@ class NotificationSender
 	private static function sendRestoreNtfy(object $profile, string $type, array $details): bool
 	{
 		$topic  = trim($profile->ntfy_topic ?? '');
-		$server = trim($profile->ntfy_server ?? 'https://ntfy.sh');
+		$server = trim($profile->ntfy_server ?? 'https://ntfy.mokoconsulting.tech');
 		$token  = trim($profile->ntfy_token ?? '');
 
 		if ($topic === '') {

source/packages/com_mokosuitebackup/src/Engine/RestoreEngine.php

@@ -122,6 +122,8 @@ class RestoreEngine
 			}
 
 			// Step 4: Import database
+			$dbErrorCount = 0;
+
 			if ($restoreDb) {
 				$sqlFile = $this->stagingDir . '/database.sql';
 
@@ -130,6 +132,16 @@ class RestoreEngine
 					$importer    = new DatabaseImporter();
 					$tableCount  = $importer->import($sqlFile);
 					$this->log('Database imported: ' . $tableCount . ' statements executed');
+
+					if ($importer->hasErrors()) {
+						$dbErrors     = $importer->getErrors();
+						$dbErrorCount = count($dbErrors);
+						$this->log('WARNING: ' . $dbErrorCount . ' database statement(s) FAILED during import — the database may be incomplete:');
+
+						foreach (array_slice($dbErrors, 0, 5) as $err) {
+							$this->log('  - ' . substr($err, 0, 200));
+						}
+					}
 				} else {
 					$this->log('No database.sql found in archive — skipping database restore');
 				}
@@ -172,7 +184,10 @@ class RestoreEngine
 
 			return [
 				'success' => true,
-				'message' => 'Restore complete from: ' . basename($archivePath),
+				'warning' => $dbErrorCount > 0,
+				'message' => $dbErrorCount > 0
+					? 'Restore finished, but ' . $dbErrorCount . ' database statement(s) failed — the database may be incomplete. Check the log.'
+					: 'Restore complete from: ' . basename($archivePath),
 				'log'     => implode("\n", $this->log),
 			];
 		} catch (\Throwable $e) {

source/packages/com_mokosuitebackup/src/Engine/SteppedRestoreEngine.php

@@ -185,15 +185,25 @@ class SteppedRestoreEngine
 					break;
 
 				case 'complete':
+					$sqlErrors = (int) ($restoreState['sql_errors'] ?? 0);
+
 					$this->destroyRestoreState($sessionId);
 					$session->destroy();
 
+					$completeMsg = 'Restore complete: ' . $session->archiveName;
+
+					if ($sqlErrors > 0) {
+						$completeMsg .= ' — WARNING: ' . $sqlErrors
+							. ' database statement(s) failed during import; the restored database may be incomplete. Check the site log.';
+					}
+
 					return [
 						'session_id' => $sessionId,
 						'phase'      => 'complete',
 						'progress'   => 100,
-						'message'    => 'Restore complete: ' . $session->archiveName,
+						'message'    => $completeMsg,
 						'done'       => true,
+						'sql_errors' => $sqlErrors,
 					];
 			}
 
@@ -230,6 +240,39 @@ class SteppedRestoreEngine
 		}
 	}
 
+	/**
+	 * Cancel an in-progress restore: delete the staging directory and the
+	 * session/state files so a client-side cancel does not leave orphaned
+	 * artefacts (staging dir + *.restore.json) behind. Best-effort — a missing
+	 * or already-finished session is treated as success.
+	 *
+	 * @param   string  $sessionId  The stepped-restore session id
+	 *
+	 * @return  array   ['error' => bool, 'message' => string]
+	 */
+	public function cancel(string $sessionId): array
+	{
+		$restoreState = $this->loadRestoreState($sessionId);
+
+		if ($restoreState !== null) {
+			$stagingDir = $restoreState['staging_dir'] ?? '';
+
+			if (!empty($stagingDir) && is_dir($stagingDir)) {
+				$this->recursiveDelete($stagingDir);
+			}
+		}
+
+		$this->destroyRestoreState($sessionId);
+
+		$session = SteppedSession::load($sessionId);
+
+		if ($session) {
+			$session->destroy();
+		}
+
+		return ['error' => false, 'message' => 'Restore cancelled'];
+	}
+
 	/**
 	 * Extract phase: extract archive to staging directory.
 	 */
@@ -480,34 +523,37 @@ class SteppedRestoreEngine
 		while (($line = fgets($handle)) !== false) {
 			$trimmed = trim($line);
 
-			// Skip empty lines
-			if ($trimmed === '') {
-				continue;
-			}
-
-			// Skip single-line comments
-			if (str_starts_with($trimmed, '--') || str_starts_with($trimmed, '#')) {
-				continue;
-			}
-
-			// Handle multi-line comments
-			if (str_starts_with($trimmed, '/*')) {
-				$inMultiLineComment = true;
-			}
-
-			if ($inMultiLineComment) {
-				if (str_contains($trimmed, '*/')) {
-					$inMultiLineComment = false;
+			// Comment/blank skipping applies only BETWEEN statements — never inside
+			// an accumulating statement, where a line may be part of a multi-line
+			// string value that happens to start with --, # or /*.
+			if ($currentStatement === '') {
+				if ($trimmed === '') {
+					continue;
 				}
 
-				continue;
+				if (str_starts_with($trimmed, '--') || str_starts_with($trimmed, '#')) {
+					continue;
+				}
+
+				if (str_starts_with($trimmed, '/*')) {
+					$inMultiLineComment = true;
+				}
+
+				if ($inMultiLineComment) {
+					if (str_contains($trimmed, '*/')) {
+						$inMultiLineComment = false;
+					}
+
+					continue;
+				}
 			}
 
 			// Accumulate the statement
 			$currentStatement .= $line;
 
-			// Check if statement is complete (ends with semicolon)
-			if (str_ends_with($trimmed, ';')) {
+			// A statement ends at a ';' that is NOT inside a quoted string literal,
+			// so a ';' or newline embedded in a value does not split it prematurely.
+			if ($this->isCompleteStatement($currentStatement)) {
 				$statement = trim($currentStatement);
 				$currentStatement = '';
 
@@ -522,7 +568,7 @@ class SteppedRestoreEngine
 					$db->setQuery($statement);
 					$db->execute();
 				} catch (\Exception $e) {
-					error_log('MokoSuiteBackup SQL import warning: ' . $e->getMessage());
+					$this->recordSqlError($state, $e->getMessage());
 				}
 
 				$statementsExecuted++;
@@ -553,7 +599,7 @@ class SteppedRestoreEngine
 				$db->execute();
 				$state['sql_executed']++;
 			} catch (\Exception $e) {
-				error_log('MokoSuiteBackup SQL import warning (final): ' . $e->getMessage());
+				$this->recordSqlError($state, $e->getMessage());
 			}
 		}
 
@@ -562,8 +608,78 @@ class SteppedRestoreEngine
 		$state['sql_done'] = true;
 		$session->currentStep++;
 		$session->phase = 'config';
-		$session->statusMessage = 'Database import complete: ' . $state['sql_executed'] . ' statements';
-		$session->log('Database import complete: ' . $state['sql_executed'] . ' statements executed');
+
+		$sqlErrors = (int) ($state['sql_errors'] ?? 0);
+		$doneMsg   = 'Database import complete: ' . $state['sql_executed'] . ' statements'
+			. ($sqlErrors > 0 ? ' (' . $sqlErrors . ' statement(s) FAILED — see log)' : '');
+		$session->statusMessage = $doneMsg;
+		$session->log($doneMsg);
+	}
+
+	/**
+	 * Determine whether an accumulated SQL string is a complete statement: it
+	 * ends with ';' that is NOT inside a quoted string literal. Tracks single,
+	 * double and backtick quoting (with backslash escapes; MySQL '' doubling
+	 * falls out of the toggle naturally) so a ';' or newline inside a value does
+	 * not terminate the statement early.
+	 */
+	private function isCompleteStatement(string $sql): bool
+	{
+		$len       = \strlen($sql);
+		$inSingle  = false;
+		$inDouble  = false;
+		$inBacktick = false;
+
+		for ($i = 0; $i < $len; $i++) {
+			$ch = $sql[$i];
+
+			if ($inSingle) {
+				if ($ch === '\\') { $i++; continue; }
+				if ($ch === "'")  { $inSingle = false; }
+				continue;
+			}
+
+			if ($inDouble) {
+				if ($ch === '\\') { $i++; continue; }
+				if ($ch === '"')  { $inDouble = false; }
+				continue;
+			}
+
+			if ($inBacktick) {
+				if ($ch === '`') { $inBacktick = false; }
+				continue;
+			}
+
+			if ($ch === "'") { $inSingle = true; }
+			elseif ($ch === '"') { $inDouble = true; }
+			elseif ($ch === '`') { $inBacktick = true; }
+		}
+
+		// If we ended inside a string literal, the statement is not finished yet.
+		if ($inSingle || $inDouble || $inBacktick) {
+			return false;
+		}
+
+		return str_ends_with(rtrim($sql), ';');
+	}
+
+	/**
+	 * Record a failed SQL statement in the restore state (count + first few
+	 * messages) so a partial import is surfaced instead of silently passing.
+	 */
+	private function recordSqlError(array &$state, string $message): void
+	{
+		$state['sql_errors'] = (int) ($state['sql_errors'] ?? 0) + 1;
+
+		if (!isset($state['sql_error_list']) || !\is_array($state['sql_error_list'])) {
+			$state['sql_error_list'] = [];
+		}
+
+		if (\count($state['sql_error_list']) < 5) {
+			$state['sql_error_list'][] = substr($message, 0, 200);
+		}
+
+		error_log('MokoSuiteBackup SQL import error: ' . $message);
 	}
 
 	/**

source/packages/com_mokosuitebackup/src/Engine/SteppedSession.php

@@ -171,6 +171,11 @@ class SteppedSession
 
 	/**
 	 * Clean up old session files (older than 24 hours).
+	 *
+	 * Reaps backup + restore session state (mb_*.json covers both the
+	 * `<id>.json` and `<id>.restore.json` files) and, as a backstop for
+	 * restores abandoned without a cancel (e.g. the browser was just closed),
+	 * any orphaned restore staging directories left in the tmp folder.
 	 */
 	public static function cleanupOldSessions(): void
 	{
@@ -182,10 +187,42 @@ class SteppedSession
 
 		$cutoff = time() - 86400;
 
-		foreach (glob($dir . '/mb_*.json') as $file) {
+		foreach (glob($dir . '/mb_*.json') ?: [] as $file) {
 			if (filemtime($file) < $cutoff) {
 				@unlink($file);
 			}
 		}
+
+		// Orphaned restore staging directories (mokosuitebackup-restore-<tag>-<id>).
+		foreach (glob(JPATH_ROOT . '/tmp/mokosuitebackup-restore-*', GLOB_ONLYDIR) ?: [] as $stagingDir) {
+			if (@filemtime($stagingDir) < $cutoff) {
+				self::recursiveDelete($stagingDir);
+			}
+		}
+	}
+
+	/**
+	 * Recursively delete a directory (used to reap orphaned restore staging dirs).
+	 */
+	private static function recursiveDelete(string $dir): void
+	{
+		if ($dir === '' || !is_dir($dir)) {
+			return;
+		}
+
+		$items = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ($items as $item) {
+			if ($item->isDir()) {
+				@rmdir($item->getPathname());
+			} else {
+				@unlink($item->getPathname());
+			}
+		}
+
+		@rmdir($dir);
 	}
 }

source/packages/com_mokosuitebackup/src/Model/DashboardModel.php

@@ -104,7 +104,7 @@ class DashboardModel extends BaseDatabaseModel
 		// PHP version
 		$checks[] = (object) [
 			'label'  => 'PHP Version',
-			'status' => version_compare(PHP_VERSION, '8.1.0', '>='),
+			'status' => version_compare(PHP_VERSION, '8.3.0', '>='),
 			'detail' => PHP_VERSION,
 		];
 

source/packages/com_mokosuitebackup/src/View/Runbackup/HtmlView.php

@@ -40,6 +40,9 @@ class HtmlView extends BaseHtmlView
 
 	public bool $autostart = true;
 
+	/** Which action the backup fronts ('update' | 'uninstall' | ''); drives the completion ack skip flag. */
+	public string $action = '';
+
 	public function display($tpl = null): void
 	{
 		$input = Factory::getApplication()->getInput();
@@ -48,6 +51,7 @@ class HtmlView extends BaseHtmlView
 		$this->description  = $input->getString('description', '');
 		$this->returnUrl    = $input->getRaw('returnurl', '');
 		$this->autostart    = (bool) $input->getInt('autostart', 1);
+		$this->action       = $input->getCmd('msb_action', '');
 
 		if ($this->profileId <= 0) {
 			$this->profileId = 1;