# WBMCZ — deploy notes · 06 Sep 2026 (fifth pass)
## "Please fill in: Full Name, Mobile Number, Email Address, Login Password."

One file. No database change.

    admin/staff.php

---

## WHAT WAS HAPPENING

You filled every box, pressed save, and the page told you all four required
boxes were empty. They were not empty on your screen — they were empty in what
the browser actually sent.

**The Add Staff form draws one block of boxes per level.** You are a Super
Admin, so you get an Employee block *and* an Admin block, both in the page at
the same time, and both using the same input names:

    sf_name   sf_mobile   sf_email   sf_password
    sf_address   sf_whatsapp   sf_gender   sf_designation

Eight duplicated names — including all four required ones.

The blocks are shown and hidden with Alpine's `x-show`, and **`x-show` only sets
`display: none`.** A hidden input is still part of the form and is still
submitted. So every one of those names went to the server twice: once with what
you typed, once empty from the block you were not looking at.

PHP keeps the **last** value when a name arrives twice. The empty one came last.
Hence four required fields reported as blank while you were looking at them
filled in.

The same fault meant you could never create an Admin at all, whichever block you
typed into — one of the two copies was always empty.

## THE FIX

Each level's block is now a `<fieldset>` that is **disabled** whenever it is not
the level you picked:

```html
<fieldset x-show="c.level === 'admin'"
          x-bind:disabled="c.level !== 'admin'">
```

A disabled fieldset is not merely hidden. Its controls are left out of the
submission altogether, and out of the browser's own required-field check. Only
the level you actually chose is ever sent, so there is nothing left to overwrite
what you typed.

### And a guard behind it

The server now reads each field through a small helper that, if a value ever
arrives more than once, takes the **first non-empty** one rather than the last.
The form no longer sends duplicates, so this should never fire — but a stray
empty copy can no longer blank a real answer if it ever does.

## THE EDIT FORM WAS ALREADY FINE

The Edit Staff modal de-duplicates its field keys before drawing them, so it
renders each name once. Only the Add form had the fault.

## CHECKED

* `php -l` passes
* the duplicate names were confirmed against the live form definition — 8 of
  them, across employee and admin
* the fieldset, its closing tag and the server-side guard are all present in the
  deployed file, and the old `<div x-show>` wrapper is gone
* every admin page still loads with no fatal, no warning and no notice

**Try it now:** Staff Accounts → Add Staff → pick **Admin**, fill it in, save.
