# Phase A+B Test-ready Fix Report

- Corrected subfolder-aware CSRF URL.
- Added missing `csrf_token()` and token rotation helpers.
- Added automatic CSRF guard to `_core.php` state-changing requests.
- Added safe same-origin compatibility fallback for older UI pages.
- Added global fetch wrapper that automatically supplies the CSRF header.
- Disabled IP-mismatch forced logout for mobile stability.
- Changed test cookie to host-only scope.
- Added direct `config/` protection through root and folder `.htaccess`.
- Added a valid constant-time dummy password hash.
- Added login response token header capture support.
