fix(data-export): name index.php in S3 completion redirects

web/export.php

@@ -497,7 +497,15 @@ function sbpp_export_run_s3_mode(Manifest $manifest, EntityExporter $entities, i
  */
 function sbpp_export_redirect_success(string $bundleId): never
 {
-    header('Location: ?p=admin&c=export&result=success&bid=' . rawurlencode($bundleId));
+    // NOTE: the path is explicit (`index.php`), NOT a bare `?p=...`
+    // query-only reference. This redirect fires from `web/export.php`,
+    // so a query-only `Location` would resolve against THIS script's
+    // path (RFC 3986 §5.2: an empty-path reference keeps the base
+    // path) and bounce the browser to `export.php?p=admin&c=export...`
+    // as a GET — straight into the POST-only method gate above
+    // ("POST required."). The admin page handler lives behind
+    // `index.php`, so the router entry point has to be named.
+    header('Location: index.php?p=admin&c=export&result=success&bid=' . rawurlencode($bundleId));
     exit;
 }
 
@@ -514,6 +522,9 @@ function sbpp_export_redirect_success(string $bundleId): never
  */
 function sbpp_export_redirect_failure(string $code, string $context = ''): never
 {
-    header('Location: ?p=admin&c=export&result=error&code=' . rawurlencode($code));
+    // Explicit `index.php` path — see the note in
+    // sbpp_export_redirect_success() for why a bare `?p=...`
+    // query-only reference would re-enter export.php's POST gate.
+    header('Location: index.php?p=admin&c=export&result=error&code=' . rawurlencode($code));
     exit;
 }

web/tests/integration/AdminExportPermissionTest.php

@@ -186,6 +186,46 @@ public function testEntryPointLogsNonOwnerAttempt(): void
         );
     }
 
+    /**
+     * The S3-mode completion redirects (success + failure) must
+     * target `index.php?p=admin&c=export`, NOT a bare query-only
+     * `?p=admin&c=export`. This redirect fires from
+     * `web/export.php`, so a `Location: ?p=...` reference resolves
+     * against THIS script's path per RFC 3986 §5.2 (an empty-path
+     * reference keeps the base path) — the browser would follow it
+     * to `export.php?p=admin&c=export...` as a GET and hit the
+     * POST-only method gate ("POST required."). The ZIP mode
+     * streams its body and never redirects, so the bug only ever
+     * surfaced on the S3 path — the operator saw "POST required."
+     * after the upload actually ran. The admin page handler lives
+     * behind `index.php`, so the router entry point MUST be named
+     * explicitly. Regression guard for the S3 "POST required." report.
+     */
+    public function testEntryPointRedirectsNameIndexPhpNotBareQuery(): void
+    {
+        $src = $this->entryPointSource();
+
+        // A bare `Location: ?p=...` query-only reference re-enters
+        // export.php's POST gate. It must never appear.
+        $this->assertDoesNotMatchRegularExpression(
+            "/Location:\s*\?p=/",
+            $src,
+            'export.php must NOT emit a bare `Location: ?p=...` query-only redirect. It fires from export.php, so a query-only reference keeps the base path (/export.php) and bounces the browser back into the POST-only gate ("POST required."). Name index.php explicitly.',
+        );
+
+        // Both completion arms must name index.php explicitly.
+        $this->assertMatchesRegularExpression(
+            "/Location: index\.php\?p=admin&c=export&result=success/",
+            $src,
+            'export.php S3 success redirect must target index.php?p=admin&c=export&result=success (the router entry point), not export.php itself.',
+        );
+        $this->assertMatchesRegularExpression(
+            "/Location: index\.php\?p=admin&c=export&result=error/",
+            $src,
+            'export.php S3 failure redirect must target index.php?p=admin&c=export&result=error (the router entry point), not export.php itself.',
+        );
+    }
+
     /**
      * Defence-in-depth: the page handler must re-check the
      * permission via `CheckAdminAccess(ADMIN_OWNER)` even though