website: the local stack now runs PHP 8.4.27

README.md

@@ -56,8 +56,9 @@ by adding rows to the seed SQL in `apphost.cs` (e.g. bob = `2222…`).
 
 ### website
 
-`altered-website` is plain PHP 7.4 + Apache with its own MariaDB — no framework, no
-build step. The site reads plain `define()` constants from `config.local.php` (it
+`altered-website` is plain PHP 8.4 + Apache with its own MariaDB — no framework, no
+build step. Its image is built from the `Dockerfile` of your website checkout, so the
+PHP version follows the branch checked out there (8.4.27 since the PHP 8.4 migration). The site reads plain `define()` constants from `config.local.php` (it
 has no env-var support), so the dev-environment **owns** that file: a dev copy lives
 at [website/config.local.php](website/config.local.php) and is bind-mounted over the
 website checkout's own copy. That one file is where the wiring lives:

apphost.cs

@@ -388,7 +388,7 @@
 }
 
 // ===========================================================================
-// website — alteredcore-website (local). Plain PHP 7.4 + Apache, MariaDB, no
+// website — alteredcore-website (local). Plain PHP 8.4 + Apache, MariaDB, no
 // build step. Wired to local Keycloak (the "main-site" client) and the local
 // decks-api; cards/cdn/collection stay on prod (not local yet). The site reads
 // plain define() constants from config.local.php (no env support), so the
@@ -421,7 +421,7 @@
             isReadOnly: true)
         .WithDataVolume("altered-website-db-data");
 
-    // website container — built from the repo Dockerfile (php:7.4-apache), source
+    // website container — built from the repo Dockerfile (php:8.4.27-apache), source
     // bind-mounted like the compose. config.local.php is bind-mounted from the
     // AppHost-managed dev config (overrides the user's checkout copy), which wires
     // DB + local Keycloak + local decks-api. Needs the same Keycloak host-gateway

website/config.local.php

@@ -71,6 +71,10 @@
 define('CARDS_API_URL',     'https://cards.alteredcore.org');
 // Uniques search API (rust-cards-api / uniques-search-api). Browser-direct fetch,
 // like CARDS_API_URL (not server-proxied) — the Aspire endpoint published at :8005.
+// Requires the "uniques" service enabled. Without this define, card-search.js hides
+// the All Uniques/Frontier format toggle and falls back to the CARDS_API_URL search.
+// Defined once only: PHP 8 warns on a redefined constant, and on screen that warning
+// is sent before the headers, which breaks every session_*() call of the page.
 define('UNIQUES_API_URL',   'http://localhost:8005');
 define('DECKS_API_URL',     'http://altered-decks-api:80');
 define('CDN_URL',           'https://cdn.alteredcore.org');
@@ -83,12 +87,6 @@
 define('OWNERSHIP_WEB_URL', 'http://ownership.altered.local.gd:8003');
 define('COLLECTION_API_URL', 'http://altered-collection-api:80');
 define('COLLECTION_USE_API', true);
-// Browser-facing uniques search API (uniques-search-api, host port 8005). The Uniques
-// tab's card-search widget calls this straight from the browser (CORS is permissive),
-// same pattern as OWNERSHIP_WEB_URL above. Requires the "uniques" service enabled.
-// Without this define, card-search.js hides the All Uniques/Frontier format toggle
-// and falls back to the old CARDS_API_URL search path.
-define('UNIQUES_API_URL', 'https://search.altered.re');
 
 // ─── Deployment ───────────────────────────────────────────────────────────────
 define('BASE_URL', '');