<ul><li>CRITICAL: Fixed destroy.php outputting PHP warnings before JSON response — lines 6-8 read $_SESSION[uid/YPSiteLinkID/activeacctid] without null coalescing before spl_autoload_register.php include (which enables display_errors=1). Subsequent calls after logout hit undefined session keys causing PHP warnings to be prepended to JSON, breaking JSON.parse in sessionout() in every open platform tab.</li><li>Added ob_start() at top of destroy.php + ob_end_clean() before json_encode to guarantee clean JSON output regardless of PHP error state.</li><li>Fixed additional undefined session key accesses in destroy.php: $_SESSION[userinfo_array][acct_idkey] (line 45), $_SESSION[Domain_live] (line 54), and $_COOKIE[_islogged] (line 66) — all now use ?? null coalescing.</li><li>Fixed logic error in destroy.php cookie check: !isset() && != was wrong (both conditions cant be true simultaneously); changed to !isset() || ! which correctly clears cookie when missing or falsy.</li><li>CRITICAL: Fixed checkUserStatus in auth.controller.php returning isLogged:0 for ALL platform admin sessions — function only checked $_SESSION[_account][logged] (set only for website visitor logins) not $_SESSION[uid] (set for platform admins). Result: sessionout fired every 60s for every platform admin page. Previously harmless only because destroy.php JSON parse failure prevented the redirect — after destroy.php fix this would have force-logged admins out every 60 seconds. Fixed by adding $_SESSION[uid] as fallback check.</li><li>Backed up both files before modification.</li></ul>