MYCDIC v1.9.37.5 STATIC QA REPORT
=================================

Build: v1.9.37.5 / runtime V16.0.28.4
Scope: Admin session continuity, Selection Studio schema repair, Candidate Task Studio, canonical member restoration, Rhali deactivation, verified-document super-admin control.

PHP syntax
----------
521 PHP files checked with php -l.
Failures: 0.

JavaScript syntax
-----------------
43 standalone JavaScript files checked with node --check.
Failures: 0.

Administrator authentication static checks
------------------------------------------
- PHP session cookie lifetime is browser-session only (0).
- Server session GC horizon supports the 7-day trusted-device model.
- Remember-this-device TTL: 604800 seconds / 7 days.
- Remember cookie: Secure + HttpOnly + SameSite=Strict + host-only __Host- prefix.
- Remember token uses selector + random validator; protected server registry stores validator SHA-256 only.
- Token is tied to username, password version and browser user-agent hash and rotates after restoration.
- Gateway, password and MFA forms use signed auth-flow CSRF tokens instead of generic session-bound CSRF.
- Protected console canonicalizes apex mycdic.org to www.mycdic.org before admin session use.
- Auth/session device fingerprint no longer includes IP prefix, preventing legitimate IP changes from invalidating gateway -> password -> MFA or an active trusted-device session.

Selection Studio
----------------
- Resilient migration creates 17 Staff/Interview runtime tables when absent.
- Migration contains 153 column-aware prepared repair operations for partially existing tables.
- Interview Operations checks both required tables and critical columns before normal rendering.
- Final migration diagnostic reports selection_missing_columns; expected value: 0.
- Interview Operations remains read-safe and reports exact schema incompleteness rather than blank HTTP 500.

Candidate Task Studio
---------------------
- practical_task_bank_list RPC remains present in deployed HF6.
- practical_task_template_upsert RPC remains present in deployed HF6.
- Existing template edit remains available.
- Duplicate action added to create a new task/version without overwriting the original.
- Active flag remains editable; deactivation preserves historical task auditability.

Member registry
---------------
- Established registry records: 38.
- Legacy photo paths missing from website package: 0.
- Canonical restore inserts/upserts all 38 member records.
- Former assignment records are treated as ended appointments, not ended memberships.
- Expected active canonical memberships after clean restore: 37 (all established records except specifically disabled Rhali Douyeb).
- Rhali Douyeb / M1000006: Inactive, public profile Unpublished, public photo disabled, public profile URL empty, normal search-index entry removed.
- Active Members dashboard supports direct canonical member creation, status control, assignment history, verification reconciliation and Google Sheet mirror sync.
- Google Sheets is mirror-only for membership governance.

Verified document control
-------------------------
- Public controlled PDFs: super-admin replace/re-secure preserves reference/QR route and regenerates SHA-256/HMAC security data.
- Private controlled PDFs: super-admin metadata-only edit for recipient/note/expiry; replacement flow re-secures signed title/category/source and preserves reference/access code.
- Existing file remains until replacement security processing succeeds; replacement is promoted atomically with rollback attempt.

SQL static checks
-----------------
- Single/backtick quote lexical balance: OK.
- CREATE TABLE IF NOT EXISTS statements: 17.
- Prepared column repairs: 153; DEALLOCATE count matches 153.
- INSERT INTO mycdic_members legacy restore statements: 38.
- No executable USE, DROP, DELETE or TRUNCATE statements.
- Migration intentionally requires selecting the actual MYCDIC database in phpMyAdmin before import.

JSON/public registry checks
---------------------------
- data/platform/members.json: 38 valid records.
- data/platform-defaults/members.json: 38 valid records.
- Rhali state matches requested inactive/unpublished configuration in both.
- Rhali removed from data/search-index.json.

Limitations
-----------
Static QA cannot execute the production cPanel/MySQL/Gmail/Google Sheet environment. After deployment, verify the SQL final diagnostics and perform live login, Selection Studio, task-bank, member-restore and sample-document replacement tests.
