# Series 002 — Independent Core

Requires PHP 8.2+, PDO MySQL, OpenSSL, HTTPS and a dedicated empty MySQL/MariaDB database. No external website code, Node server or Composer runtime is required. PHP runtime and MySQL are not bundled.

1. Upload the whole package outside the public web directory. Point the analytics domain/subdomain document root at public/. If cPanel cannot set a safe document root, use a subdomain that can; do not upload config or storage under a public directory.
2. Give only the PHP process write permission to storage/. Keep config read-only after setup. Disable public error output; protect logs and rotate them through hosting log management.
3. Copy config/example.php to config/local.php. Set the dedicated DSN/user/password, canonical HTTPS URL, site name and valid timezone. Generate a setup secret of at least 32 random characters with a password manager. Do not reuse any password or expose it in a URL.
4. Visit the application over HTTPS. The wizard checks required extensions/storage and creates versioned core tables and an initial administrator. It tests database access through PDO. Use a 12–72-byte password. The database migration marker locks setup after success; clear setup_secret from configuration afterward.
5. Sign in and review System Health. Test logout and sign-in limits before deployment. Configure cPanel cron, replacing both example paths with actual absolute host paths:

```text
15 * * * * /usr/local/bin/php /home/ACCOUNT/mesra-analytics/cron/maintenance.php
```

Maintenance currently prunes login throttle buckets and job history. Tracking rollups and API refresh arrive in later series. No cron schedule is created automatically. Only CLI execution is supported.

For local development only, set require_https=false and run `php -S 127.0.0.1:8080 -t public`. Keep this override out of deployment. Reverse-proxy TLS requires trusted server configuration that sets HTTPS correctly; forwarded headers are not blindly trusted.

The canonical URL is reserved configuration for subsequent integration links. Core navigation and assets are relative and support subdirectory installation. Each deployment has independent cookies scoped to its application path and its own database.

## Recovery and upgrades

This is the first core schema (001_core). Do not run it over unrelated tables. Back up the private config and database securely before changing files. Installation DDL may partially complete because MySQL DDL auto-commits; an authorized retry completes missing tables before transactional admin creation. Existing users without a migration marker require manual investigation; setup will not replace them. Database failures do not silently reset installation.

Later releases must supply explicit versioned upgrade migrations; no production upgrade/rollback tooling is claimed in Series 002. Restore the matched database and application files from a verified backup if rollback is needed. Keep database credentials and setup secrets out of public downloads.