PRESTIGE BARBERSHOP PROFESSIONAL v4.33.0
DEEP FUNCTIONAL + DATABASE AUDIT REPORT
=============================================

BASE: v4.32.0
TARGET: v4.33.0

ROOT CAUSE MEMBER CARD PNG
- QR can be disabled by card customization. In that state #qrcode is not rendered.
- Previous renderer still called qrBox.querySelector(...), causing TypeError.
- Both normal and safe rendering could therefore fail and cardBlob returned null.
- v4.33.0 adds null guards for QR access and removes direct canvas roundRect dependency.
- Member logo/photo/background are proxied as same-origin local assets for canvas rendering.
- Safe render remains available when an asset cannot be rendered.

WHATSAPP BROADCAST
- Sources: Member, Pra-Member, Non-Member.
- Template management: Super Admin/Manager.
- Campaign creation: Super Admin/Manager/Cashier.
- Personalized placeholders and per-recipient message snapshot.
- Queue/open tracking without storing WhatsApp credentials.

DATABASE
- New tables: whatsapp_templates, whatsapp_broadcasts, whatsapp_broadcast_recipients.
- PHP idempotent upgrade: upgrade_v4_33_0.php.
- Manual phpMyAdmin fallback: upgrade_v4_33_0.sql.
- Fresh database.sql updated to schema_release 4.33.0.

AUDIT RESULTS
- PHP files checked: 157
- PHP syntax errors: 0
- Fresh DB tables: 68
- Foreign keys checked: 124
- Foreign key definition errors: 0
- Foreign key table-order errors: 0
- Changed/new INSERT statements checked against fresh schema: 91
- Changed/new UPDATE statements checked against fresh schema: 24
- Changed/new SQL column errors: 0
- Missing local include/require targets: 0
- Missing local PHP links/actions: 0
- POST forms checked: 164
- POST forms without CSRF found: setup.php
  setup.php is the first-run bootstrap installer and is excluded from authenticated operational CSRF requirements.
- Files in v4.32 base: 246
- Files in v4.33 package: 251
- Missing v4.32 files: 0

ASSERTIONS
- QR null guard: PASS
- No direct canvas roundRect: PASS
- Canvas safe render: PASS
- Canvas same-origin asset proxy: PASS
- PNG Blob/ObjectURL: PASS
- WA sources Member/Pra/Non: PASS
- WA POST CSRF: PASS
- WA database helper: PASS
- Upgrade PHP: PASS
- Upgrade SQL fallback: PASS
- Fresh schema WA tables: PASS
- No CREATE DATABASE: PASS
- No USE database: PASS
- All v4.32 files preserved: PASS

CHANGED/NEW FILES
- README.md
- VERSION.txt
- config/config.php
- database.sql
- member_card.php
- member_card_asset.php
- members.php
- non_members.php
- partials.php
- pre_members.php
- system_audit.php
- upgrade_v4_33_0.php
- upgrade_v4_33_0.sql
- whatsapp_broadcast.php
- whatsapp_broadcast_open.php

DEPLOYMENT
1. Backup DB + files.
2. Preserve config/database.local.php and uploads.
3. Upload patch/full package.
4. Run upgrade_v4_33_0.php as Super Admin.
5. Only if PHP upgrade cannot create tables because of hosting permissions, run upgrade_v4_33_0.sql once via phpMyAdmin, then revisit upgrade_v4_33_0.php.
6. Do NOT import database.sql into production.
7. Do NOT run upgrade_v3_6.sql for an already-upgraded v4.x database.
8. Run System Audit and test card PNG + WA campaigns from all three sources.