MYCDIC v1.9.37.5 DEPLOYMENT STEPS
=================================

1) Back up public_html and the MYCDIC runtime database.
2) Upload/extract MYCDIC_v1.9.37.5_ADMIN_SESSION_MEMBER_RESTORE_DOC_CONTROL_PATCH_ONLY.zip over the currently deployed v1.9.37.4 website.
3) In phpMyAdmin CLICK THE REAL MYCDIC RUNTIME DATABASE first. Do not import from information_schema.
4) Import ONLY: MYCDIC_v1.9.37.5_RUNTIME_REPAIR_MEMBER_RESTORE.sql
5) At the end verify:
   - selection_missing_columns = 0
   - canonical_members >= 38 (plus any previously activated members)
   - result = MYCDIC v1.9.37.5 resilient repair complete
6) Do NOT reinstall Applicant Google Apps Script. HF6 remains compatible and already completed successfully.
7) Log out once after deploying this patch to clear the previous v1.9.37.4 administrator session.
8) Open the private administrator URL. Login normally.
9) Test without Remember me: explicit logout must require login again; closing the browser removes the PHP session cookie.
10) Test with Remember this device for 7 days: after MFA, close/reopen the browser and the trusted device should restore the admin session. Explicit logout, password change, account deactivation, expiry, or device mismatch invalidates it.
11) While logged in, open the private administrator URL in another tab. It must go directly to /institutional-admin/ without restarting the gateway/password/MFA flow.
12) Open Interview Operations. The Selection Studio repair warning should be gone after the migration. If it remains, copy the final missing_column rows from phpMyAdmin.
13) Open Candidate Task Studio. Edit an existing template and test Duplicate. Historical templates should normally be deactivated, not deleted.
14) Open Active Members. The established 38 records should be canonicalized; 37 are active memberships and Rhali Douyeb M1000006 is inactive/unpublished. Create all future members from the dashboard; Google Sheets is a mirror only.
15) In Document Integrity (super-admin only), test replacement of a sample public verified PDF. The reference/QR remains stable while hashes/signature are regenerated.
16) In Private Controlled Documents, test metadata-only editing and replacement/re-security on a sample private PDF. Edit/replace controls are super-admin only.

No Google Apps Script change is required by v1.9.37.5.
