ChatGPT's update to harden software and run db updates.

CLUB-MODALS-2026-10-20.md

@@ -0,0 +1,51 @@
+# Club summary action dialogs
+
+Club add/edit forms now open in Bootstrap modals. The summary shows club details,
+tables, history and action buttons; it no longer displays editing fields inline.
+
+Dialogs cover club editing/archiving, membership edits, existing-account
+assignment, invitations, invitation revocation, new seasons, recording dues and
+payments, dues corrections and payment reversals. The Invite members header
+action opens its dialog directly. Existing-record dialogs identify the selected
+member, dues or payment row. Separate club creation and ticket pages retain their
+existing workflows.
+
+`classes/ClubFormModals.php` transforms only the club forms the server has already
+authorized for the viewer. It moves dialogs outside the tables, supplies unique
+IDs, labelled headings, close and cancel controls, and scrollable phone-friendly
+layouts. Members receive no administrator forms or action dialogs.
+
+`js/club-modals.js` submits these forms through the existing protected club
+controller. Validation and permission errors appear inside the dialog without
+clearing entered values. Saving disables action buttons and prevents dismissal
+until the response returns; existing financial request keys are retained.
+Successful saves reload the club summary and display its success notice. Cancel,
+close and Escape dismiss an idle dialog without submitting changes. Bootstrap
+provides focus containment and returns focus to the opening action.
+
+`classes/Roster.php` renders the dialog layout and returns a JSON success result
+only for the modal's explicitly marked AJAX requests. Existing ordinary POST
+flows retain their redirects. All existing CSRF, tenant access, recent MFA,
+validation, audit and financial safeguards continue to run on the server.
+
+Browser regressions exercise the real dialogs rather than hidden forms,
+including cancellation, validation failures, membership changes, invitation
+delivery feedback, seasons, dues, payments, corrections and reversals. Release
+packaging checks require both new files. No new dependency or database migration
+is required.
+
+Validation passed 262 targeted checks: 99 project HTTP, 19 onboarding HTTP,
+33 general browser, 19 tenant browser, 16 deployment tooling, 24 MFA/session HTTP,
+41 security/capacity service and 11 paging/export HTTP checks. Source validation
+passed for 66 PHP files, 58 JavaScript files and 39 XSL stylesheets. Browser tests
+also verify club edits, cancellation of invitation revocation, phone dialog
+width, first-field focus and focus restoration after Escape.
+
+The three application files were deployed to development and their hashes
+verified. A protected temporary runtime check confirmed server-side dialog
+rendering, and the new script was fetched successfully; the probe was removed.
+Prior files were saved under
+`.tools/deployment-backups/club-modals-07cbd8d9f91242e19f5501609489e35a`.
+No existing development database records were changed. Tests used disposable
+local databases and generated accounts with external email disabled; the local
+test database server was stopped after cleanup.