# Bootstrap and routing migration

This is the next patch after the confirmed working partials migration. Apply it to the existing student-cycle project. Database credentials and SMTP settings supplied by the owner are preserved. No database schema or stored data is changed.

## Install, in this order

1. Back up the current project outside htdocs. Keep a full copy for rollback.
2. Extract the ZIP into a temporary directory. Copy its app, bootstrap, config, functions, resources, routes and docs folders into C:\xampp\htdocs\student-cycle, merging folders and replacing only matching files. Copy root init.php too. Do not delete unrelated files.
3. config/app.local.php is intentionally new and selects development with http://student-cycle.test. Preserve this file on XAMPP; omit it from live deployment. No .env changes are needed. This patch uses explicit PHP configuration, not a new .env parser. composer.json is unchanged, so its replacement is optional; preserve your composer.lock and vendor.
4. Ensure C:\xampp\private_student_cycle\logs exists and is writable by your local Apache account. If unavailable, errors stay in Apache/PHP's existing configured log.
5. Copy public/index.php and public/.htaccess LAST, replacing the current files in C:\xampp\htdocs\student-cycle\public. Do not put the other application directories under public.
6. Add these entries to your existing .gitignore if absent (do not replace the rest of it):

       /config/app.local.php
       /config/database.php
       /config/student-cycle-site-config.php

   The latter two currently retain your supplied secrets. Ignore rules do not remove previously tracked files from Git.

No Apache virtual-host or hosts-file changes are needed. The public vhost must retain Options -Indexes -MultiViews +FollowSymLinks. The new .htaccess does not repeat Options directives.

## New ownership

| Responsibility | Location |
| --- | --- |
| Public entry point | public/index.php |
| Startup | bootstrap/app.php |
| Default live configuration | config/app.php |
| XAMPP overrides | config/app.local.php |
| Database settings | config/database.php |
| Database singleton | app/Support/Database.php |
| Route collection | routes/app.php |
| Public route definitions | routes/web.php |
| Homepage controller | app/Http/Controllers/Website/HomeController.php |
| Homepage markup and legacy queries | resources/views/pages/home/index.php |
| Error renderer | app/Exceptions/ErrorHandler.php |
| Simple error template | resources/views/errors/http.php |

The homepage markup and its existing queries are preserved together for now. Query extraction into a repository is a later feature migration. Root init.php, config/student-cycle-database.php and functions/database/connections.php are compatibility loaders. Keep the previous shared-template forwarding files too. The existing image helper stays under functions/helpers until reviewed.

Only homepage and homepage aliases are enabled. Unknown paths return a real 404 without querying the database. Inner pages, download verification, file delivery and admin routes are not activated by this patch. We have not inspected their processing or authorisation code yet. Merely registering all their filenames would be unsafe and would retain broken includes. Old error pages are retained but not used by this router; the new error template is deliberately independent of database and shared-layout dependencies.

## Validation on XAMPP

In Command Prompt:

    C:\xampp\php\php.exe -l C:\xampp\htdocs\student-cycle\public\index.php
    for /R C:\xampp\htdocs\student-cycle\bootstrap %F in (*.php) do @C:\xampp\php\php.exe -l "%F"
    for /R C:\xampp\htdocs\student-cycle\app %F in (*.php) do @C:\xampp\php\php.exe -l "%F"
    for %F in (C:\xampp\htdocs\student-cycle\config\app.php C:\xampp\htdocs\student-cycle\config\app.local.php C:\xampp\htdocs\student-cycle\config\database.php C:\xampp\htdocs\student-cycle\routes\app.php C:\xampp\htdocs\student-cycle\routes\web.php C:\xampp\htdocs\student-cycle\resources\views\pages\home\index.php C:\xampp\htdocs\student-cycle\resources\views\errors\http.php) do @C:\xampp\php\php.exe -l "%F"

Use %%F instead of %F if saving these loops in a batch file.

Then run the database-independent smoke test:

    C:\xampp\php\php.exe C:\xampp\htdocs\student-cycle\tests\bootstrap-smoke.php

Expect PASS. This checks route selection, method rejection, error bodies, invalid-path handling and URL helpers without connecting to MySQL.

Refresh http://student-cycle.test/ with Ctrl+F5. Check the homepage, header and footer, then run:

    curl.exe -I http://student-cycle.test/
    curl.exe -I http://student-cycle.test/page-that-does-not-exist
    curl.exe -I http://student-cycle.test/config/database.php
    curl.exe -I http://localhost/student-cycle/
    curl.exe -i -X POST http://student-cycle.test/

Expected statuses: 200, 404, 403, 403, 405. POST / must include Allow: GET, HEAD. Visit the missing page in the browser to see the error template. Error responses should not show file paths, SQL, credentials or stack traces. Open DevTools to confirm HEAD responses have no body and existing CSS/JS are served normally. No actual email, upload or download actions are involved.

If an error occurs, inspect C:\xampp\private_student_cycle\logs\php-errors.log first, then the Student Cycle Apache error log. Read relevant entries locally and redact secrets before sharing: database exception logs can include connection details. Do not disable access restrictions to repair a PHP include error.

## Live mapping, for the deployment stage

Public contents -> /home/ACCOUNT/public_html; application -> /home/ACCOUNT/student-cycle; private files -> /home/ACCOUNT/private_student_cycle. The public entry checks these two supported layouts. Omit config/app.local.php on live. Configure public directory options, HTTPS and caching in the live server before deploying. This local patch is not a complete production deployment configuration.

## Rollback

Restore public/index.php, public/.htaccess, root init.php, config/student-cycle-site-config.php, config/student-cycle-database.php and functions/database/connections.php from the backup. Restore prior route files as well. New unused application files can remain outside public during rollback. No database rollback is needed because no data or schema was modified.

## Verification limits

Package path consistency, credential equality, route registration and archive integrity were checked during creation. A PHP/Apache runtime was not available to execute this package here. Use the XAMPP checks above before proceeding. The patch does not certify unreviewed authentication, CSRF, uploads, admin handlers or legacy helper code.

References: https://httpd.apache.org/docs/2.4/rewrite/flags.html and https://www.php.net/manual/en/function.set-exception-handler.php