<ul><li><strong>CRITICAL — reservation.controller.php iterate_save_notify() + addReservation() email blocks:</strong> <code>$to_name</code> and <code>$to_email</code> were used before assignment — fetched <code>$receivers</code> array but never iterated it, so first recipient name/email was always blank (undefined), causing PHP notices that could corrupt JSON. Fixed both blocks (recurring path + one-time path) to wrap email send in <code>foreach ($receivers as $receiver)</code>, assigning <code>$to_name = $receiver["display_name"]</code> and <code>$to_email = $receiver["email"]</code> per iteration. Cascade: applies to both notification paths so all approval emails now correctly address each recipient.</li><li><strong>HIGH — reservation.controller.php iterate_save_notify() line 435:</strong> <code>echo "error";exit;</code> — raw non-JSON response on insert failure. Frontend <code>cleanDirtyJSON()</code> + <code>JSON.parse()</code> call would crash on this string. Fixed to <code>json_encode(array("status"=>500,...))</code>.</li><li><strong>HIGH — inc_global.php (catch/inc_global.php):</strong> <code>display_errors=1</code> was active, causing PHP notices/warnings to leak into AJAX JSON responses from the legacy inc files (get.reservation.list, etc.). Fixed to <code>display_errors=0; log_errors=1</code>.</li><li><strong>MEDIUM — reservationInformationController.php:</strong> <code>$now</code> was used on lines 152/210 in the view (<code>$reservation_info["ReservationStartTime"] > $now</code>) but never declared. Added <code>$now = time();</code>. Also added null-coalescing guard on <code>$_POST["reserveid"]</code> and <code>ns_module_is_member_area_reservations</code>.</li><li><strong>LOW — custom_js.php JS typo:</strong> <code>duration.Mibutes</code> (typo) corrected to <code>duration.Minutes</code> in the <code>stringDuration()</code> function — prevented minutes from ever rendering in booking duration strings.</li><li><strong>SPEED — getFacilitiesController.php:</strong> Confirmed N+1 fix from prior session is active — pre-cached category data used for all timeslot×facility cells.</li></ul>