vibtools · MdNurnobi-Dev · Aug 21, 2026 · Aug 21, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -134,18 +134,18 @@ jobs:
         run: |
           short_sha="${GITHUB_SHA:0:12}"
           mkdir -p release
-          bash scripts/package-release.sh v5.6.1 "$GITHUB_SHA" "release/Licora-5.6.1-ci-${short_sha}.zip"
-          cp "release/Licora-5.6.1-ci-${short_sha}.zip" "release/Licora-5.6.1.zip"
-          python3 scripts/build-update-manifest.py --version 5.6.1 --ref "$GITHUB_SHA" --package "release/Licora-5.6.1.zip" --output release/licora-update-manifest.json
-          rm "release/Licora-5.6.1.zip"
+          bash scripts/package-release.sh v5.7.1 "$GITHUB_SHA" "release/Licora-5.7.1-ci-${short_sha}.zip"
+          cp "release/Licora-5.7.1-ci-${short_sha}.zip" "release/Licora-5.7.1.zip"
+          python3 scripts/build-update-manifest.py --version 5.7.1 --ref "$GITHUB_SHA" --package "release/Licora-5.7.1.zip" --output release/licora-update-manifest.json
+          rm "release/Licora-5.7.1.zip"
 
       - name: Upload CI release-candidate artifact
         uses: actions/upload-artifact@v6
         with:
-          name: Licora-5.6.1-${{ github.sha }}
+          name: Licora-5.7.1-${{ github.sha }}
           path: |
-            release/Licora-5.6.1-ci-*.zip
-            release/Licora-5.6.1-ci-*.zip.sha256
+            release/Licora-5.7.1-ci-*.zip
+            release/Licora-5.7.1-ci-*.zip.sha256
             release/licora-update-manifest.json
           if-no-files-found: error
           retention-days: 14
diff --git a/BASELINE_v5.7.0.md b/BASELINE_v5.7.0.md
@@ -0,0 +1,53 @@
+# Licora v5.7.0 — Phase 2 Source Candidate Freeze
+
+## Parent Authority
+
+- Official parent baseline: `Licora-5.6.1.zip`
+- Parent version/tag: `v5.6.1`
+- Parent Git commit: `4b430b77ccc303aebeadc2852bebd3f11f67452a`
+- Parent release ZIP SHA-256: `0ca0ad76b5c0091912aa441fcac4c033a54bac630d6c1a7255ac5b2b75db5493`
+- Parent release manifest source: `v5.6.1`
+
+The parent baseline is immutable. v5.7.0 is produced in an isolated work copy and does not rewrite the v5.6.1 freeze.
+
+## Candidate Identity
+
+- Target version: `5.7.0`
+- Scope: Dashboard Phase 2 only
+- Database migration: `NONE`
+- Deleted files: `NONE`
+- External API contract change: `NONE`
+- Dashboard backend/read-model contract change: `NONE`
+- License/device enforcement change: `NONE`
+- Authentication/role change: `NONE`
+- Cron mutation change: `NONE`
+- Updater protocol/state-machine change: `NONE`
+- Shared sidebar/topbar redesign: `NONE`
+
+## Phase 2 Runtime Scope
+
+1. compact Dashboard operations composition;
+2. measured system-status strip;
+3. four primary truthful KPI cards;
+4. dedicated `admin/assets/js/dashboard.js` browser controller;
+5. authenticated 30-second AJAX refresh through the existing Phase 1 endpoint;
+6. manual refresh and last-updated feedback;
+7. in-place Chart.js/KPI/activity/top-license updates;
+8. request-overlap protection;
+9. stale-data preservation/Retry state and auth-expiry polling shutdown;
+10. responsive/accessibility behavior and dedicated Phase 2 tests.
+
+## Acceptance State
+
+Current source-candidate evidence:
+
+- full local verifier: `PASS`;
+- targeted Phase 2 contract/browser-runtime tests: `PASS`;
+
+The candidate must not be treated as a published baseline until the remaining required gates have evidence:
+
+- required remote CI/MySQL matrix after an authorized push;
+- manual desktop/tablet/mobile production/staging smoke;
+- authorized merge/tag/release workflow.
+
+The exact v5.7.0 commit SHA does not exist until the user commits the reviewed delta.
diff --git a/BASELINE_v5.7.1.md b/BASELINE_v5.7.1.md
@@ -0,0 +1,51 @@
+# Licora v5.7.1 — Dashboard Phase 2 Corrective Source Freeze
+
+## Parent Authority
+
+- Official parent baseline: `Licora_v5.7.0_Baseline.zip`
+- Parent baseline SHA-256: `e198fda3a90f38ef0d15faeab3f0b2797b92ba98b542cb7f22ac8f01b3bda022`
+- Parent embedded Git HEAD: `4b430b77ccc303aebeadc2852bebd3f11f67452a`
+- Parent source version: `5.7.0`
+- Parent GitHub tag status at audit time: `NOT PUBLISHED`
+- Parent Phase 2 state: source implemented + locally verified; remote/live acceptance pending
+
+The uploaded v5.7.0 archive is immutable forensic authority. v5.7.1 is produced only in an isolated work copy.
+
+## Corrective Scope Lock
+
+Only the latest Phase 2 verification/fix scope is changed:
+
+1. preserve `Retry` after failed-refresh cleanup;
+2. preserve the 401/session-expiry refresh lock and `Refresh paused` UI;
+3. capture synchronous request transport failures in the normal stale/error lifecycle;
+4. advance `lastSuccessAt` only after successful render completion;
+5. extend Dashboard browser/runtime tests for those four cases;
+6. align current source/release/docs identity to `5.7.1`.
+
+## Frozen / Unchanged
+
+- Dashboard read model and authenticated JSON endpoint
+- database schema and migration set
+- API v1/v2 request/response/auth/crypto contracts
+- license/device state/enforcement
+- authentication/roles/session policy
+- Cron mutation behavior
+- updater protocol/signing/rollback/state machine
+- shared sidebar/topbar and non-Dashboard admin UI
+- Phase 2 layout, KPI definitions, chart semantics, polling cadence and existing navigation routes
+
+## Chrome/Browser Finding
+
+No Chrome launcher/downloader implementation exists in the v5.7.0 baseline application runtime. No browser-specific downloader is introduced in v5.7.1.
+
+## Acceptance State
+
+The full `python3 scripts/verify-local.py` gate passed after corrective source/tests/version/documentation alignment. Remote CI/MySQL and manual live/staging UI smoke remain required before Phase 2 is marked final `COMPLETE + VERIFIED`.
+
+## Release Compatibility
+
+The v5.7.1 signed update specification accepts `5.6.1` and `5.7.0`, with no migrations and no delete list. This allows direct upgrade from the published v5.6.1 release while also supporting installations where the v5.7.0 source baseline was already applied.
+
+## Source Freeze Packaging
+
+The v5.7.1 source baseline freeze is packaged from the verified work tree with repository `.git` metadata excluded. This avoids treating an uncommitted local Git object database as product source. The external baseline ZIP SHA-256 is recorded alongside the delivered artifact; the authoritative Git commit SHA will be established only after the user performs the reviewed commit/push flow.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,7 +6,36 @@ All notable public-release changes are recorded here. Historical project notes r
 
 ### Planned
 
-- Continue the reviewed Dashboard production program with Phase 2: compact UI and reload-free refresh.
+- No additional Dashboard scope is approved beyond the v5.7.1 Phase 2 corrective release candidate.
+
+## [5.7.1] - 2026-08-20
+
+### Fixed
+- Preserved the Dashboard `Retry` label after failed-refresh loading cleanup instead of resetting it to `Refresh`.
+- Preserved the `401 AUTH_REQUIRED` refresh lock and `Refresh paused` state after request cleanup.
+- Routed synchronous Dashboard request-transport exceptions through the normal stale/error lifecycle so the in-flight lock and loading state are always released.
+- Advanced the Dashboard last-success timestamp only after a snapshot completes rendering successfully.
+- Expanded Dashboard browser/runtime regression coverage for the corrected stale/auth/transport/render lifecycle.
+
+### Compatibility
+- No database migration, file deletion, backend Dashboard contract change, external API change, license/device enforcement change, authentication/role change, Cron mutation change, updater protocol change, shared shell change or new browser dependency.
+- Signed update compatibility accepts both published `v5.6.1` and an already-applied `v5.7.0` source baseline.
+
+## [5.7.0] - 2026-08-20 (source baseline; superseded by 5.7.1 corrective)
+
+### Changed
+- Rebuilt the Dashboard as a compact operations view while preserving the existing Licora light shell, sidebar, topbar and other admin pages.
+- Replaced the 30-second full-page Dashboard reload with authenticated 30-second AJAX polling against the existing read-only `admin/ajax/dashboard-data.php` contract.
+- Added manual refresh, last-updated feedback, stale-data handling, session-expiry handling and request-overlap protection without changing backend business truth.
+- Updated API and expiration charts in place, combined source-labelled API v1/v2 recent activity, and converted Quick Actions to compact links over existing routes.
+
+### Added
+- Added `admin/assets/js/dashboard.js` as the dedicated Dashboard refresh/controller layer.
+- Added Phase 2 source/DOM contract and browser-runtime tests covering polling, manual refresh, overlap prevention, stale behavior and auth expiry.
+
+### Compatibility
+- No database migration, file deletion, external API contract change, license/device enforcement change, authentication/role change, Cron mutation change, updater protocol change, installer schema change, sidebar/topbar redesign or shared application architecture change.
+- Signed update compatibility starts from the frozen official `v5.6.1` baseline.
 
 ## [5.6.1] - 2026-08-20
 

diff --git a/DASHBOARD_PRODUCTION_UPDATE_INDEX.md b/DASHBOARD_PRODUCTION_UPDATE_INDEX.md
@@ -2,18 +2,17 @@
 
 ## Authority
 
-এই documentation program v5.5.1 থেকে শুরু হয়েছিল; বর্তমান corrective source authority হলো uploaded **Licora v5.6.0 Official Baseline Freeze**।
+এই documentation program v5.5.1 থেকে শুরু হয়েছিল; বর্তমান immutable source authority হলো uploaded **Licora v5.7.0 Official Baseline Freeze**।
 
-- Current baseline ZIP SHA-256: `ba99c6e4fd74c2b59d392c3010b3aefe493390b3b0b0c94bd3c211218f14d597`
-- Current baseline Git commit: `5c685636e955422bc70e3bf07694f55d9c7fb1dc`
-- Current baseline Git tree: `848801c1785ebba0b2523a34afcf6af3ee05d5d6`
-- Current baseline version: `5.6.0`
+- Current baseline ZIP SHA-256: `e198fda3a90f38ef0d15faeab3f0b2797b92ba98b542cb7f22ac8f01b3bda022`
+- Current baseline embedded Git HEAD: `4b430b77ccc303aebeadc2852bebd3f11f67452a`
+- Current baseline version: `5.7.0`
 - Original Phase-program baseline: `v5.5.1 / 2f48ef569e6c532ab0de974a418c644e4ea8423f`
-- Development implementation status: **v5.6.1 Phase 1 COMPLETE + VERIFIED — PR #8 Actions run 32423210356 PASS**
+- Development implementation status: **v5.7.1 Phase 2 corrective source + local verification PASS — remote CI/live acceptance gates pending**
 - Planned update phases: **2**
-- Current corrective target: **v5.6.1 — Phase 1 verified baseline; Phase 2 NOT STARTED**
+- Current target: **v5.7.1 — Phase 2 verification corrective candidate**
 
-এই document set Phase 1 runtime implementation এবং v5.6.1 corrective verification state record করে। v5.6.1 কোনো database migration, external API contract change, license/device enforcement change, Cron mutation change, updater protocol change বা Phase 2 polling/UI feature যোগ করে না।
+এই document set Phase 1 verified foundation, v5.7.0 Phase 2 source baseline এবং v5.7.1 corrective verification candidate record করে। Phase 2 Dashboard presentation/browser behavior পরিবর্তন করে, কিন্তু database schema, external API contracts, license/device enforcement, authentication/roles, Cron mutation behavior, updater protocol এবং shared sidebar/topbar architecture অপরিবর্তিত রাখে।
 
 ## Document Map
 

diff --git a/README.md b/README.md
@@ -29,6 +29,7 @@ Licora is maintained by **Vib Tools**. Vib Tools is a professional tools and dig
 - Device registration, activity tracking, revocation, blacklist handling, and risk indicators.
 - Role-aware admin panel for super administrators, managers, and viewers.
 - Audit trail, operational logs, CSV exports, SQL backup generation, and health checks.
+- Reload-free operational Dashboard with truthful license/device/API/expiration metrics, manual refresh, stale-data feedback, and source-separated API activity.
 - CSRF tokens for admin mutations, prepared SQL statements, password hashing, rate limiting, and session hardening.
 - Scheduled cleanup and expiring-license reporting through CLI cron scripts.
 - Super-Admin-only Secure Update Center with signed GitHub release manifests, preflight, staged installation, persistent live logs, migration tracking, and rollback protection.
@@ -124,7 +125,7 @@ The application accepts deployment-specific values through environment variables
 | Database password | `LICENSE_DB_PASS` | empty |
 | Application name | `APP_NAME` | `Licora` |
 | Application URL | `APP_URL` | `http://localhost` |
-| Application version | `APP_VERSION` | `5.6.1` |
+| Application version | `APP_VERSION` | `5.7.1` |
 | Environment | `APP_ENV` | `production` |
 | Encryption key | `LICENSE_ENCRYPTION_KEY` | empty fallback |
 | API limit | `API_RATE_LIMIT` | `1000` |
@@ -155,6 +156,8 @@ The validation script checks PHP syntax, security behavior, compatibility invari
 - [Secure in-app updater](docs/UPDATER.md)
 - [UI design system](docs/UI_DESIGN_SYSTEM.md)
 - [Troubleshooting](docs/TROUBLESHOOTING.md)
+- [v5.7.1 release notes](RELEASE_NOTES_v5.7.1.md)
+- [v5.7.0 release notes](RELEASE_NOTES_v5.7.0.md)
 - [v5.6.1 release notes](RELEASE_NOTES_v5.6.1.md)
 - [v5.6.0 release notes](RELEASE_NOTES_v5.6.0.md)
 - [v5.5.1 release notes](RELEASE_NOTES_v5.5.1.md)
@@ -173,9 +176,17 @@ The validation script checks PHP syntax, security behavior, compatibility invari
 - [Dependency review](audit/DEPENDENCY_REPORT.md)
 
 
+## Dashboard Phase 2 verification corrective candidate (v5.7.1)
+
+Licora v5.7.1 corrects the client-side refresh lifecycle found during forensic review of the v5.7.0 Phase 2 source baseline: stale refresh keeps `Retry`, `401 AUTH_REQUIRED` keeps refresh paused/disabled, synchronous transport errors are captured without leaving the request lock stuck, and the last-success timestamp advances only after a successful render. Phase 2 layout/data semantics, backend contracts, database schema, APIs, licensing/device enforcement, authentication, Cron behavior, updater protocol and shared shell remain unchanged.
+
+## Dashboard Phase 2 source baseline (v5.7.0)
+
+Licora v5.7.0 builds on the frozen/published v5.6.1 Phase 1 baseline. The Dashboard keeps its server-rendered initial snapshot but replaces the former full-page 30-second reload with authenticated 30-second AJAX refresh, manual Refresh, last-updated/stale/session feedback, request-overlap protection and in-place chart/KPI/activity updates. Phase 1 backend data semantics, database schema, APIs, license/device enforcement, authentication/roles, Cron mutation behavior and updater protocol remain unchanged.
+
 ## Phase 1 verification corrective update (v5.6.1)
 
-Licora v5.6.1 is a no-migration corrective update over the applied v5.6.0 Phase 1 source baseline; v5.6.0 was not published as a GitHub tag/release and is superseded by v5.6.1. It fixes the MySQL integration-test foreign-key cleanup exposed by PR #8 CI, aligns the authenticated Dashboard JSON envelope with its documented top-level `recent_activity` field, and makes the Dashboard API v2 `Ready` status depend on a verified matching server signing key pair rather than the public key alone. Licora remains a browser-based PHP application and contains no Google Chrome installer/downloader dependency. Phase 2 reload-free polling/UI work remains unimplemented.
+Licora v5.6.1 is a no-migration corrective update over the applied v5.6.0 Phase 1 source baseline; v5.6.0 was not published as a GitHub tag/release and is superseded by v5.6.1. It fixes the MySQL integration-test foreign-key cleanup exposed by PR #8 CI, aligns the authenticated Dashboard JSON envelope with its documented top-level `recent_activity` field, and makes the Dashboard API v2 `Ready` status depend on a verified matching server signing key pair rather than the public key alone. Licora remains a browser-based PHP application and contains no Google Chrome installer/downloader dependency. At the v5.6.1 baseline, Phase 2 had not yet been implemented; the separately scoped v5.7.0 source baseline added that browser refresh layer without changing the Phase 1 backend contract.
 
 ## Dashboard data truth and read model (v5.6.0)
 

diff --git a/RELEASE_COMMANDS_v5.7.0.md b/RELEASE_COMMANDS_v5.7.0.md
@@ -0,0 +1,68 @@
+# Licora v5.7.0 — Phase 2 Review / Publication Commands
+
+This file records the reviewed Windows/CMD sequence for the v5.7.0 Dashboard Phase 2 delta. It does not authorize GitHub writes by itself.
+
+## Preconditions
+
+- Official parent baseline: published `v5.6.1`
+- Parent commit: `4b430b77ccc303aebeadc2852bebd3f11f67452a`
+- Parent release ZIP SHA-256: `0ca0ad76b5c0091912aa441fcac4c033a54bac630d6c1a7255ac5b2b75db5493`
+- Apply the replace-ready delta only to a clean checkout of the reviewed parent baseline/main.
+- Stop on any unexpected file, error, failed check or merge conflict.
+
+## Create the Phase 2 branch
+
+```cmd
+git switch main
+git pull --ff-only origin main
+git status --short --branch
+git switch -c feature/v5.7.0-dashboard-phase2
+```
+
+After extracting the reviewed delta into the repository root:
+
+```cmd
+git diff --check
+git status --short
+```
+
+Only the reviewed v5.7.0 delta paths should appear.
+
+## Exact staging command
+
+Never use `git add -A`, `git add .` or `git add --all` for this release.
+
+```cmd
+git add -- .github/workflows/ci.yml BASELINE_v5.7.0.md CHANGELOG.md DASHBOARD_PRODUCTION_UPDATE_INDEX.md README.md RELEASE_COMMANDS_v5.7.0.md RELEASE_NOTES_v5.7.0.md REPOSITORY_METADATA.md ROADMAP.md admin/assets/css/admin-ui.css admin/assets/js/dashboard.js admin/index.php audit/V5.7.0_DASHBOARD_PHASE2_AUDIT.md audit/V5.7.0_DELTA_MANIFEST.md audit/V5.7.0_DELTA_SHA256SUMS.txt config.sample.php docs/ACTUAL_IMPLEMENTATION_LEDGER.md docs/ARCHITECTURE.md docs/CONFIGURATION.md docs/DASHBOARD_CHANGE_CONTROL.md docs/DASHBOARD_DATA_CONTRACT.md docs/DASHBOARD_PRODUCTION_VALIDATION_GATES.md docs/DASHBOARD_UPDATE_PHASE_LOG.md docs/ERROR_HANDLING_BASELINE_AND_TARGET.md docs/FEATURE_MATRIX.md docs/INSTALLATION.md docs/RELEASE.md docs/UI_DESIGN_SYSTEM.md docs/UPGRADE_GUIDE.md includes/config.php includes/installation.php install.php scripts/verify-local.py tests/compatibility_regression.php tests/dashboard_browser_runtime.js tests/dashboard_data_contract.php tests/dashboard_phase2_contract.php tests/installer_smoke.php tests/release_readiness.php tests/updater_state_machine.php update/release-spec.json
+```
+
+Then inspect exactly what is staged:
+
+```cmd
+git diff --cached --check
+git diff --cached --name-status
+git status
+```
+
+## Commit / push — only after explicit GitHub-write authorization
+
+```cmd
+git commit -m "feat: add reload-free compact Dashboard in Licora v5.7.0"
+git push -u origin feature/v5.7.0-dashboard-phase2
+```
+
+Create/review a PR targeting `main`, then run the required CI once. Do not merge on a failing/pending gate.
+
+## Tag / release — only after Phase 2 final acceptance and explicit authorization
+
+Do not tag until the PR is merged, `main` is clean/synchronized, remote CI is green, and the required manual production/staging Dashboard smoke is accepted.
+
+```cmd
+git switch main
+git pull --ff-only origin main
+git status --short --branch
+git tag -a v5.7.0 -m "Licora v5.7.0 - Compact Dashboard and Reload-Free Refresh"
+git push origin v5.7.0
+```
+
+The tag-triggered release workflow must then build/verify the exact-tag ZIP, run the required database gates, build/sign the update manifest and publish the GitHub Release.