ISHLO HCM V2 -> V3 FIX/QA REPORT
Baseline: test.ishlo.com_FINAL_PATCHED_V2(3).zip
Output: test.ishlo.com_FINAL_PATCHED_V3.zip

FIXES APPLIED
1. DSO termination is restricted to STEM OPT only. Ordinary OPT no longer triggers DSO termination validation/review/email.
2. Supervisor timecard return/reopen/bulk approval paths now enforce server-side employee visibility authorization.
3. DSO UI visibility text/logic is restricted to STEM OPT.

RETESTED / VERIFIED
- ZIP extraction/integrity: PASS
- PHP syntax: 54/54 PASS
- Promotion implementation reviewed: different Role already uses promotion_effective_date via role_task_start_date; same Role preserves the existing sequence. No change was made to this working logic.
- Leave type implementation reviewed: active leave types are exposed to employees; HR add/activate/deactivate workflow exists.
- Bulk task/timecard email grouping implementation reviewed.
- Candidate onboarding/password reset mail construction reviewed.

NOT CLAIMED AS PASS
- Actual candidate mailbox delivery: NOT VERIFIED in this offline execution environment.
- Actual employee password-reset mailbox delivery: NOT VERIFIED in this offline execution environment.
- HR password eye/view: NOT IMPLEMENTED because the stored employee credential is a one-way password hash; exposing an existing password would require a separate secure credential design. No insecure plaintext-password storage was introduced.
- STEM Excel export: NOT IMPLEMENTED in this build because the current project does not contain an existing XLSX writer/export mechanism and adding a new dependency would change the deployment architecture without verification.
- Full browser/live-server button-by-button QA: NOT VERIFIED in this offline execution environment.

IMPORTANT
No Google Drive functionality was added.
No HR passport-expiry email was added.
Existing OPT/STEM onboarding data collection remains unchanged; only DSO termination behavior is STEM OPT-only.

Changed application file:
- ishlo/operations/dashboard.php

This report deliberately distinguishes code-level tests from live delivery/browser tests.