# MEGA™ staging data reset (v1.4)

## Upgrade
Back up the files and MySQL database. On an existing Afrihost installation, **replace `public/index.php` only** with the one in this release. All configuration files, including `app/config.php`, are preserved byte-for-byte. No schema migration or installer run is required.

## Enable on STAGING only
In cPanel File Manager create an **empty** file named `ALLOW_TEST_RESET` under the protected `app` directory. `app/.htaccess` must be enforced by Apache (`Require all denied`); never expose the app folder publicly. Do not create this file on a production instance.

Log in as an administrator, then open `?p=setup` → **Reset test data (staging only)**. Select:
- **Workshop/risk activity:** Deletes votes, voting rounds, action update history, effectiveness reviews, evidence DB records, actions, consolidation snapshot items/snapshots, risks, workshops; leaves planning data intact.
- **Planning only:** Deletes department–objective mapping tables, objectives and departments, but *only if there are no risks or workshops*.
- **All test data:** Both of the above.

Confirm backup, type `DELETE TEST DATA`, re-enter your administrator password and accept the browser confirmation. This operation is irreversible.

Afterward **delete `app/ALLOW_TEST_RESET`** immediately. The reset control remains disabled in its absence.

## Preserved
User accounts (including administrator), municipality, taxonomy, database credentials/configuration, scoring methodology and audit log history. Historical audit entries can refer to deleted IDs and are intentionally retained for accountability.

## Notes
The deletion statements run within a DB transaction. Evidence files are deleted only after successful database commit. If a filesystem deletion fails, a warning is shown; remove the orphaned evidence file from protected storage using File Manager. Back up both database and evidence directory before resetting.

## Verification
- PHP CLI syntax checks and existing arithmetic/taxonomy checks passed.
- The original `app/config.php` SHA-256 is unchanged.
- Live MySQL deletion, filesystem cleanup and Afrihost UI end-to-end tests cannot be performed in this environment and require validation on staging.