# MPC v6.82.188 cPanel Deployment Fix Report

## Defect

The v6.82.187 archive packaged a hard-coded CloudLinux Passenger block and deployment tooling that rewrote `PassengerAppRoot` and `PassengerNodejs`. Replacing the application folder could also remove cPanel's managed `.htaccess` and `node_modules` virtual-environment symlink. Those conditions can leave the Node.js Selector unable to save, switch versions, install modules, or restart the application.

## Correction

- Removed the root `.htaccess` from the distributed archive so extraction cannot overwrite cPanel's managed Passenger configuration.
- Moved MPC Apache/LiteSpeed rules to `config/cpanel/mpc-hardening.htaccess`.
- Added `scripts/cpanel-merge-htaccess.js`, which preserves the existing Passenger and CloudLinux environment blocks, backs up `.htaccess`, and idempotently installs MPC hardening.
- Removed dynamic rewriting of `PassengerAppRoot`, `PassengerNodejs`, `PassengerBaseURI`, and `PassengerStartupFile`.
- Added a Node 20/cPanel preflight that validates the application root, startup file, selector-managed `node_modules` symlink, packaged build, and external runtime storage.
- Kept `npm install` for CloudLinux deployment; `npm ci` is intentionally not used on the server because it removes `node_modules` and can destroy the selector-managed symlink.
- Added exact recovery instructions for a stale CloudLinux application lock.

## Verification

- Source verification suite: PASS.
- Production build: PASS.
- Packaged build verification: PASS.
- cPanel Passenger ownership/merge audit: PASS and idempotent.
- Legacy v6.82.186 `.htaccess` migration test: PASS; Passenger paths remained unchanged.
- Public route smoke: 283/283 PASS.
- Rendered asset/download smoke: 633/633 PASS.
- API smoke: 20/20 PASS.
- Production dependency audit: 0 vulnerabilities.
- Liveness/readiness: PASS with build `6.82.188` and environment `staging`.

## Hosting boundary

A generic cPanel red `Error` that remains after recreating the application is a CloudLinux control-plane lock or hosting configuration fault. The application archive cannot terminate a host-owned selector process; the hosting administrator must clear it.