<ul><li><strong>CRITICAL — reservation.controller.php line 948 (approveReservation):</strong> <code>$_Activation_Desc</code> double-underscore typo — always returned null, so every approved reservation stored blank Activation_Desc instead of the admin reason. Fixed to <code>$Activation_Desc</code>.</li><li><strong>HIGH — reservation.controller.php updateReservation() line 775:</strong> <code>$categData</code> used before it was fetched when <code>$request[recurring] == 1</code>. Fixed by fetching <code>getDataCateg($category)</code> immediately before the access, with null-coalescing guard.</li><li><strong>HIGH — reservationInformationController.php:</strong> <code>if(isset($_SESSION[SiteLinkId]))</code> used wrong session key (SiteLinkId vs YPSiteLinkID) — <code>$GLOBAL_IS_SETTINGS_ADMIN</code> and <code>$GLOBAL_IS_POWER_USER</code> were never defined, causing undefined variable warnings on every modal open. Fixed by removing the broken condition and always defining both variables.</li><li><strong>MEDIUM — reservation.controller.php lines 6-8:</strong> <code>display_errors=1</code> and <code>display_startup_errors=1</code> in the AJAX controller caused PHP notices/warnings to be prepended to JSON responses, breaking <code>JSON.parse()</code> in the frontend. Fixed to <code>display_errors=0</code> (errors remain logged to file).</li><li><strong>PERF — getFacilitiesController.php:</strong> <code>Sdba::table(domain_tbl_reservation_category)</code> was called once per cell inside the double-loop (time-slot x facility). Pre-cached all category data into <code>$category_meta_cache</code> keyed array before the loop — eliminates N*M DB calls per availability table load.</li><li>Backups: reservation.controller-bk-v5.php, reservationInformationController-bk-v1.php, getFacilitiesController-bk-v1.php. All files pass PHP syntax check. Apache error log shows 0 PHP errors from this module.</li></ul>