Development log

Polaris fictional workflow, saved history, and export checks

• After owner agreement acceptance and sign-in, completed a fictional task-refusal scenario on MrLopaze. Recorded two intervention attempts with separate no-change and improvement outcomes, a follow-up, and an explicitly unverified hypothesis.
• The completed session contains eleven chronological events. Its saved record survived a browser reload, reopened normally, and retained both attempts, outcomes, follow-up, hypothesis, and completion event.
• Downloaded and validated the session JSON: fictional-training and completion flags are true, two attempts and eleven events are present, and the recorded notes match. Reviewed the scenario, branches, and future-guidance report previews, including fictional and hypothetical labeling.
• Found a cross-midnight mismatch between the printable report title date range and the dates displayed in the session; correction is pending. Actual PDF saving, encrypted backup/restore, and the immediate-danger start action remain unverified because browser controls timed out. A selected safety option alone is not counted as a passed gate.
• Documentation-only checkpoint with private rollback copies. Existing accounts, app source, safeguards, and saved records were preserved. Wider tester-email delivery remains restricted; no real cadet data or payments enabled.

Supernova fictional history and encrypted backup checks

• Completed the authenticated MrLopaze Supernova workflow after private device-vault creation. Three fictional incidents across two cadet codes were saved. Cadet Logs works from the menu and after saving an incident.
• All-date history returned both incidents for the first code and only the matching incident for the second code. Correcting an observation to the prior day retained its behavior details and follow-up timeline.
• The selected-cadet browser report contained the two matching incidents and follow-up, excluded the other code, and remained marked draft/unsigned with reviewer signature fields.
• Downloaded the encrypted backup and passed read-only decryption and record validation: three incidents, three unique IDs, no photographs, no conflicts, and no import or overwrite.
• This checkpoint changes documentation only. Supernova native PDF saving, vault relock/reopen, new-device restore, photographs, and physical-device coverage remain pending. Polaris still requires owner review of its first-use agreement. Mail delivery for additional tester addresses remains subject to the existing recipient restriction.

Profile sign-in loop resolved and fresh-account beta checks

• Completed the runtime correction: the required /profile.php route and root account aliases now use the same PHP 8.3 runtime and session storage as account pages and apps. Existing root routing and security directives were preserved verbatim, with a private rollback backup.
• Passed 15 PHP syntax checks and 12 server checks across the main and MrLopaze hosts, including session persistence through account, root/profile, apps, and back to account. Anonymous app and profile gates still require sign-in.
• The fresh verified test account signed in, reached required observer-profile setup, saved its existing details, and opened Nebula. A second tab retained sign-in. Supernova opened its new-device vault gate, and Polaris opened its first-use agreement.
• Nebula completed a fictional one-minute Quick Tally observation with one participation event after three taps. Pause/resume and automatic pause after a browser interruption worked. The two-page PDF was downloaded and visually checked; both spreadsheet worksheets include the fictional cadet code, and the JSON backup was downloaded.
• Remaining owner steps: create the private Supernova device vault and review the Polaris agreement before their fresh-account record workflows can be tested. Wider device/recovery tests remain separate. Isolated staging received documentation only.

App runtime alignment and sign-in investigation

• Main and MrLopaze account pages used PHP 8.3 while the shared apps used PHP 7.4 and a different session store. A scoped apps handler now matches PHP 8.3.
• Both hosts passed runtime/storage checks and all six anonymous app redirects preserved the no-replacement-cookie safeguard. A disposable anonymous session persisted from the account route to the exact Nebula route.
• Owner account verification and automatic active access to all three apps passed. Authenticated browser app entry still returned to sign-in; that browser workflow remains under investigation and is not signed off.
• Existing application code, accounts, records, passwords, and security controls were preserved. Isolated staging received documentation only.

Verification email recipient correction

• An owner test address was missing from the restricted SMTP recipient list. One address was added after a private backup; all other mail settings were preserved.
• One verification resend completed without another server mail failure. The owner confirmed receipt, and the account is verified.
• Other new addresses remain subject to the existing recipient restriction. This does not enable unrestricted beta email delivery.

Guided beta checklist and private feedback

• Published /beta/ with five fictional tasks covering account setup, Nebula, Supernova, Polaris, and saving/recovery. Checkmarks stay in the current browser; guidance explains where vault records, reports, and backups live.
• Added Start beta testing and Report a problem links to the live homepage, help index, and shared app menus. Main and MrLopaze addresses share this installation; staging has its own equivalent page and feedback storage.
• Feedback accepts a selected app, type, device, browser, and a short fictional description. Successful submission returns a reference. Save a copy downloads a text draft; repeated clicks are suppressed. No email, screenshot upload, account details, or app records are included automatically.
• Reports are stored privately and readable only through existing administrator access, available from Administration → Beta feedback. CSRF and same-origin protections, input limits, private file modes, bounded storage, and session/network submission limits apply. No new administrator grants were made.
• Eleven staging HTTP/security checks passed, including Unicode length, foreign-origin and missing-token rejection, invalid input, anonymous inbox denial, and rate limiting. Browser verified persistent checklist marks, downloaded-copy content, a saved staging receipt, and duplicate-click prevention. A live MrLopaze fictional report also produced a matching private receipt.
• Twelve live page/inbox checks and six anonymous app-entry checks passed. PHP/JavaScript syntax and backups verified. Shared app gateway changes are menu links only; app recording code, credentials, account database, and existing device records were preserved.
• Fresh account signup/inbox verification, password recovery, authorized administrator inbox rendering, signed-in app workflows, and physical-device/recovery checks remain pending private owner steps. These have not been marked passed.

MrLopaze private-beta release

• Use behaviorcosmos.mrlopaze.com as the tester-facing address. It shares its live installation and account service with behaviorcosmos.com, so both addresses receive this compatible release.
• Promoted the tested anonymous-navigation session guard from R081 and the R087 Nebula spreadsheet correction: cadet code is included on both worksheets. Existing authentication checks, inline scripts, record formats, and other report content were preserved.
• Adapted 14 help pages to the live account flow: new verified accounts include all three apps, Show password and replacement-verification instructions remain available, and fictional cadet examples are required for this private beta. Existing links and scripts were preserved. Homepage now carries the fictional-data notice.
• Backed up and hash-verified all affected files before installation. PHP/JavaScript syntax and targeted export regressions passed. Both hosts passed three anonymous app redirects without replacement session cookies and four public/account/help HTTP checks. Browser reviewed the mirror homepage, signup guide, and settled sign-in page.
• 57 protected account/configuration/Supernova/Polaris files remained unchanged. No database, account, credential, payment, or device-record change was made. The staging-only account checklist and consent modules were not copied into production.
• This checkpoint is a selective release, not a fresh full authenticated test of every live app. Mirror sign-in-to-record workflows, current Supernova recovery/attachments/saved PDF, and wider physical-device testing remain separate checks. Earlier staging results retain their stated scope.

Resend missing or expired verification email

• Deployed the owner-approved verification recovery update to the main COSMOS site and MrLopaze COSMOS mirror after staging validation. The sign-in page now offers Missing or expired verification email? and a Resend verification email form.
• Passed 13 staging checks covering generic responses, CSRF protection, request limits, token replacement, old-link rejection, and unchanged verified/disabled accounts. Recovery does not verify an account or grant app access. Fictional fixtures were disabled.
• Verified the live forms on both sites with nonexistent fictional addresses, plus ten live page, asset, and request-protection checks. These checks did not send email to a real recipient or repeat an inbox-delivery test.
• Fresh private rollback backup saved; all six deployed file hashes and PHP syntax verified. Existing accounts, app approval policy, profile requirements, local cadet records, and encryption remain unchanged. No purchases or real cadet data enabled.

Clearer account creation and Show password controls

• Updated account creation on the main site, MrLopaze COSMOS mirror, and staging. The form now clearly includes all three apps and no longer asks users to select app-access boxes. Signup submits all three app names.
• Added accessible Show password / Hide password controls to sign-in, create-account, and new-password fields. Passwords remain hidden initially and are hidden again on submission or leaving the page. The control changes visibility locally and does not save or send password values.
• Verified the controls in the live browser on all three sites and completed a fictional signup through the updated staging form. The new account remained unverified with zero active app grants and was disabled after testing. Checked 15 page and asset requests across the three origins.
• Preserved automatic three-app access after verification, profile requirements, existing first-use requirements, account safeguards, and existing records. Retained private rollback backups. No rate limits or passwords were reset.

All three apps for new verified accounts

• Owner-approved automatic standard access to Nebula, Supernova, and Polaris is enabled for new registrations on the main COSMOS site, MrLopaze COSMOS mirror, and isolated staging. No individual app approval or invitation is needed for these new accounts.
• Email verification remains mandatory. Shared profile completion and existing first-use requirements remain in place. No admin rights, case-manager activation, aide seats, or paid billing are granted automatically.
• The new-registration marker prevents retroactive activation of older accounts. Disabled accounts, revoked invitations, and suspended or cancelled subscriptions remain blocked by the approval policy.
• Verified 34 transactional policy checks, with fixtures rolled back. Actual fictional signups on all three website origins received no active access before verification and all three apps after verification; test accounts were then disabled. Test verification tokens were seeded privately and do not constitute new inbox-delivery tests.
• Aligned signup defaults and messaging with three-app access. Verification email now sends after the main-site registration transaction commits, matching staging behavior; email failure does not undo an account or verify it.
• Private rollback backups and release evidence retained. Existing accounts and local cadet records were not migrated or changed. Fictional beta data only remains the testing requirement.

Latest COSMOS interfaces and development history

• The main COSMOS website and MrLopaze COSMOS mirror share the maintained application files. Cadet Logs navigation is available on both.
• Supernova now includes Cadet Logs in the menu, a prominent link after saving, and a cadet selector showing every saved incident for that code across all dates, newest first. Reports follow the selected cadet.
• Supernova incident records remain encrypted in the local browser vault. Printing or emailing a report does not delete them. Different devices, browsers, and website origins keep separate records; encrypted backup and merge are available.
• The private beta runs in an isolated staging environment with separate accounts and an empty schema-only database at setup. Existing live accounts and databases were preserved. Invitations, email verification, completed profiles, acknowledgment, and app access remain enforced.
• Verified 77 fictional-account HTTP checks, 43 additional app and report logic checks, and 13 Cadet Logs checks. These are automated checks within their stated scope, not a claim that every physical device or browser has been tested.
• Verified staging SMTP delivery and user-confirmed inbox receipt. The user also confirmed phone use and PDF email delivery. The reported disappearing inbox message remains unexplained.
• Backed up files and database before beta deployment, checked installed file hashes, and retained private rollback backups. Cadet Logs uses the existing vault format and unchanged encryption and storage implementation.
• Refreshed the exact approved Supernova script hash in the content security policy on both shared hosting paths and isolated staging; no broad inline-script exception was added.
• Soho now includes a current-app hub and launch links in the original tools, while preserving those tools and their local records. Development history is also mirrored on Soho.
• The staging beta access changes remain on staging. This checkpoint does not enable real cadet data, paid subscriptions, case-manager seats, or additional privileges.

Same-host account and application navigation

Public sign-in, app entries, console launches, profile navigation and Help links now use internal routes. The main website and MrLopaze mirror each keep their own address while using the existing account database and app permissions. Verification and reset links use the approved address where requested. Existing browser-local records are not moved between origins.

MrLopaze subdomain website

Connected behaviorcosmos.mrlopaze.com to the same maintained public website files, including Help Center pages. Added HTTPS redirection for the new address. Sign-in and all three application links continue to use the existing secure shared account and applications; device-local records remain on their original browser origin.

Secure connections and primary domain

Public pages use behaviorcosmos.com. The old public domain and www addresses forward to its HTTPS address, preserving paths and queries. App and account entry addresses upgrade HTTP to HTTPS without moving device-local records. Certificate renewal challenge paths remain available. District filtering approval remains separate.

Behavior COSMOS — option B branding

Approved horizontal wordmark with the COSMOS expansion in two rows and six cyan initials. Homepage and account pages use the full layout; shared app navigation uses a compact matching wordmark. Responsive typography preserves room for observation and incident controls.

Behavior COSMOS is the public-facing name

Updated the homepage wordmark, page titles, navigation labels, account pages and shared app branding to Behavior COSMOS. Nebula, Supernova and Polaris keep their names. Existing working URLs and account services remain in place while behaviorcosmos.com awaits activation. The COSMOS acronym remains Comprehensive Observation System for Monitoring Outcomes and Support.

Behavior COSMOS domain forwarding prepared

Added behaviorcosmos.com to the existing hosting account with a separate redirect directory. A permanent redirect sends the new domain, with or without www, to https://cosmosbehavior.com/ and preserves page paths. Public availability still depends on registrar activation, DNS and certificate issuance.

Clear account-session loading state

The account page now shows Checking sign-in while it restores the existing session, rather than briefly displaying the login form. Navigation controls wait for that check to finish. Anonymous users still receive the sign-in form; service errors receive a separate message. Authentication, cookie restrictions and expiry limits are unchanged.

Bottom email action opens the recipient form

The Nebula Email report button expands its collapsed recipient section before scrolling and focusing the address field. Recipient review and confirmation remain required.

Clear observation status and report downloads

• Renamed the missing-observation response to Could not observe. It remains distinct from None observed.
• Observation screens grow naturally so status feedback stays below the behavior buttons.
• Added Print report, Save PDF and Email report actions below the Nebula report. Email keeps recipient review and confirmation.
• Nebula observation exports and Polaris documents now include observer surname and record date range. Supernova backup, transfer and receipt downloads follow the same naming pattern while retaining their document type. Existing Supernova report names are retained.

Editable observation grids and signing footers

• Added typed or handwritten note space for every observed minute and timestamped entry.
• Added editable HTML report copies and Excel-compatible XML worksheets for later annotation. Original observation entries are retained separately from notes.
• PDF downloads and emailed PDFs use landscape report tables with signature/date footers on every page. Browser-print and spreadsheet reports also include unsigned review/signature sections.
• Reports remain in the current tab until downloaded. No new server storage or automatic synchronization.

Cadet-code save reminder

• Added a visible reminder above cadet codes: select a code, behavior and severity before saving; photos are optional.
• Kept save requirements and recording logic unchanged.

One COSMOS Behavior sign-in

• Public sign-in and membership links now use the same branded COSMOS sign-in entry, forwarding to the existing shared account service.
• Updated account-page branding and clarified that one account is used for all three approved apps.
• Distinguished the separate device-vault unlock from COSMOS account sign-in. Existing accounts, passwords, verification, permissions and local encryption remain unchanged.

Supernova header aligned with COSMOS

• Replaced the legacy app artwork with the homepage-style cyan orbit mark, navy header and clear Supernova wordmark.
• Removed the legacy decorative banner. Kept a small by COSMOS Behavior label and homepage link.
• Preserved vault locking, account navigation and incident-recording logic.

Automatic report filenames

• Report titles now suggest SupernovaReport, the report-generating observer profile surname, and the earliest through latest included incident dates in MM-DD-YY format.
• Original observers remain identified individually inside mixed-observer reports. Browser Save controls still choose the destination and may override the suggested name.
• Existing security policy hash updated with the report code; private backups retained.

Responsive incident screens and readable controls

• Added spaced behavior and severity grids, larger labels, high-contrast colors and clear selected states.
• Added responsive phone, tablet and desktop layouts, larger cadet-code controls, legible saved logs and numbered photo previews.
• Added Logs and reports shortcuts beside incident entry and in the app menu, plus a persistent bottom navigation.
• Preserved recording, encryption, backup, observer and report logic. Live device verification remains required.

Simpler checks for the unlocked vault

• Check a backup first tries the key of the vault already unlocked in this browser.
• Backups from another vault still request their own passphrase. Checks stay read-only and do not import or change records.
• Removed the repeated native passphrase prompt for a matching backup. Functional regression checks passed; live verification awaits the updated app reload.

Clearer recovery controls and focused Logs

• Improved contrast of compact action buttons, including Backup & recovery in the app menu.
• Hid the guided incident editor in Logs view and cleared old status messages when opening recovery.
• Recorded successful live incident, photo, follow-up, browser-report and encrypted-backup checks. Verification of these visual fixes awaits the next app reload; PDF and physical-device recovery checks remain pending.

Checks and test history

• Added a Checks & tests text link on this page, with sequential test entries and no displayed dates or times.
• Recorded 16 passing isolated checks against the deployed Supernova code for incident creation, two photos, two follow-ups, report rendering, backup validation, recovery and failure handling.
• Retained earlier recorded checks with their original scope. Live browser interaction, an actual saved PDF and physical cross-device recovery remain pending.

Quick incident follow-ups

• Added Add follow-up after saving an incident and beside saved incidents. The compact form shows attempted response and observed outcome, with optional fields under More details.
• Retained the original incident and earlier follow-ups. Added a chronological timeline with each follow-up observer and separate observed and recorded times.
• Included timelines in reports, encrypted incident transfers, backup validation, and conflict checks. Incident corrections retain existing follow-ups. Full phone and cross-device testing remains pending.

Compact backup and recovery

• Added one compact Backup & recovery panel with Save, Check, and Restore actions.
• Kept detailed recovery tools and device guidance collapsed. Existing encryption, duplicate detection, conflict checks, and merge confirmation remain in place.
• Made backup results visible inside the panel and close it when the vault locks. Full phone and cross-device restore testing remains a separate follow-up.

Development log

• Added this log through a small text link in the public homepage footer.
• Listed changes newest first using sequential revision numbers instead of displayed dates or times.
• Documented app improvements, fixes, validation, and current limitations without including account or incident data.

Focused screens across COSMOS

• Replaced repeated navigation with one compact app menu and simplified the homepage, account, profile, and visitor report screens.
• Kept main recording and save controls visible while grouping optional notes, detailed guidance, transfers, backups, and advanced tools into expandable sections.
• Simplified Polaris scenario setup and kept its training-only notice and safety check visible. Kept the full agreement unchanged.
• Made Nebula review options and full-report preview expandable while preserving the report's print structure. Checked navigation, critical control presence, and fictional observation recording.

Profile setup before app entry

• Made a shared observer profile mandatory before entering any of the three apps, once per account.
• Nebula automatically supplies the observer name. Supernova copies the shared observer details into its encrypted device vault after unlock, before recording starts.
• Kept prior incident observer snapshots unchanged and added profile settings links. Contact email is separate from sign-in identity.

Compact photo attachments

• Replaced large inline incident photos with numbered Photo 1, Photo 2, and Photo 3 controls in entry and saved logs.
• Added a screen-constrained preview with a Close photo control; locking the vault closes an open preview.
• Checked large fictional photos, preview opening/closing, removal, renumbering, and stable form width. Preserved encrypted photo data and printed photo pages.

Private visitor counts

• Added daily aggregate counts for public pages, the account page, and opens of each app.
• Added an owner-only visitor dashboard with a daily breakdown. Refreshes and internal tests count; totals do not represent unique people.
• The counter stores no analytics cookies, visitor identifiers, IP addresses, names, contact details, device details, referrers, or query strings. It respects Do Not Track and Global Privacy Control; hosting logs are separate.

Phone signup and app approval

• Verified a separate phone tester's registration, email confirmation, and sign-in.
• Confirmed all three app requests initially remained pending.
• Approved staging app access with recorded approval entries so phone testing could continue.

Registration and access checks

• Completed validation and account-lifecycle checks covering anonymous access denial, invalid registrations, form security, and pending permissions.
• Verified one-time verification/reset tokens, password changes, previous-session invalidation, and logout using isolated fictional accounts.
• Kept email-driven registration and inbox delivery distinct from privately prepared integration-test tokens.

Public homepage connected to accounts

• Connected the public COSMOS homepage and its legacy sign-in link to the shared staging account service.
• Updated membership and responsible-use information to reflect app approval, local record storage, and inactive billing.
• Kept the MrLopaze Academy site separate and linked from the homepage.

Polaris training and connected navigation

• Added the separate Polaris fictional behavior scenario lab with its first-use agreement.
• Verified intervention steps, recorded attempts, simulated outcomes, timelines, report previews, and saved-record persistence.
• Connected the account dashboard and cross-app navigation to all three protected applications. Polaris remains fictional training with unencrypted live browser records and optional encrypted backups.

Consistent cadet terminology

• Changed user-facing student wording to cadet across the COSMOS staging interface, messages, guidance, and report/export text.
• Preserved internal storage keys and identifiers for compatibility with existing records.

Supernova encrypted incident records

• Integrated incident entry, logs, observer details, photos, and reporting behind COSMOS access checks.
• Kept incident records in an encrypted local device vault, separate from COSMOS account credentials and the original website's vault.
• Updated privacy guidance and verified fictional incident saving and encrypted backup generation. Cross-device recovery remains a separate test.

Nebula observation workflow

• Integrated the original behavior observation tool into COSMOS while preserving the original site.
• Retained timed observations, three taps per entry, quick tally, pause/resume, running counts, and missing-minute distinctions.
• Verified a fictional observation, readable PDF output, and confirmed-recipient report email submission.

Protected app hosting

• Connected the three app subdomains to their protected staging applications over HTTPS.
• Required verified, enabled accounts and active app permission before serving application pages or files.
• Reviewed uploaded application packages before deployment and kept private configuration outside public pages.

Account email and form reliability

• Configured staging verification and password-reset email delivery for permitted test recipients.
• Fixed stale form-security tokens by refreshing them before submissions and retrying the specific expired-token response once.
• Kept reset links single-use and time-limited, with request and sign-in protections.

Shared COSMOS accounts

• Added one shared account service for Nebula, Supernova, and Polaris.
• Registration lets users request any combination of the three apps; verification and approval are required before access.
• Added sign-in, sign-out, password recovery, session checks, and application access records. Paid subscriptions remain inactive.