Prestige Barbershop Professional v4.36.0
Deep Audit Build Report
============================================================

FITUR BARU / PERBAIKAN

1. PAYMENT BEFORE MEMBER APPROVAL
- Pengajuan Member/Pra-Member tidak menampilkan tombol Approve sebelum pembayaran membership terkait berstatus PAID.
- Pembayaran dibuat dari menu Penjualan Member.
- Metode: Cash, QRIS, Transfer, E-Wallet, Debit/Card, Lainnya.
- QRIS/Transfer/E-Wallet: bukti pembayaran + verifikasi sebelum PAID.
- Cash: divalidasi nominal diterima dan dapat langsung PAID.
- Server-side approval guard tetap menolak request manipulatif jika pembayaran belum PAID.
- Member placeholder tidak diaktifkan saat pembayaran; aktivasi hanya terjadi pada approval final.
- Relasi: member_registrations/pre_members -> membership_sales melalui membership_sale_id.
- Pembayaran ditolak dapat dibuat ulang tanpa mengaktifkan member.
- Tombol Bayar di halaman Approval membuka Penjualan Member dengan pengajuan otomatis terpilih.

2. ATTENDANCE PHOTO GPS + TIME
- attendance.php dan staff_portal.php menggunakan Geolocation API untuk foto manual/selfie.
- Metadata check-in dan check-out disimpan terpisah:
  * photo_taken_at
  * latitude
  * longitude
  * gps_accuracy
- Tampilan menunjukkan hari, tanggal, jam (WIB), koordinat, akurasi GPS, dan tombol Lihat Lokasi (Google Maps).
- Jika GPS tidak didukung/izin ditolak, foto dan waktu tetap disimpan; lokasi ditandai tidak tersedia.
- Waktu transaksi absensi server (check_in/check_out) tetap disimpan seperti sebelumnya.

3. DATABASE / UPGRADE
- Fresh database.sql diperbarui ke schema_release 4.36.0.
- upgrade_v4_36_0.php: jalur upgrade utama, idempotent.
- upgrade_v4_36_0.sql: fallback manual via information_schema/PREPARE.
- Tidak ada statement CREATE DATABASE.
- Tidak ada statement USE database.
- Data lama tidak dihapus.

AUDIT FINAL
- PHP files checked: 177
- PHP syntax errors: 0
- Fresh DB tables: 77
- Foreign keys checked: 147
- Foreign key missing/order issues: 0
- Duplicate columns in fresh schema: 0
- Missing include/require targets: 0
- Missing local PHP href/action targets: 0
- POST forms checked: 192
- Operational POST forms without CSRF: 0
- Prepared statement pairs checked on changed files: 54
- Placeholder/value mismatches: 0
- Base v4.35.1 files preserved: 280 / 280
- Missing old files: 0

KEY ASSERTIONS
PASS - Approve hidden before PAID on Member Approval.
PASS - Approve hidden before PAID on Pra-Member Approval.
PASS - Server-side payment gate.
PASS - Payment does not activate applicant before approval.
PASS - Registration payment is inside Penjualan Member.
PASS - QRIS/Transfer/E-Wallet require verification in pre-approval flow.
PASS - Rejected payment can be retried.
PASS - Admin/manual attendance GPS capture.
PASS - Staff portal selfie GPS capture.
PASS - Check-in/out GPS metadata stored separately.
PASS - Google Maps location link.
PASS - Fresh schema includes GPS/time columns.
PASS - Upgrade includes GPS/time columns.
PASS - Fresh/upgrade include applicant-membership relations.
PASS - No CREATE DATABASE statement.
PASS - No USE statement.
PASS - schema_release 4.36.0.

DEPLOYMENT
Production v4.35.1:
1. Backup database and application.
2. Preserve config/database.local.php and uploads/.
3. Upload patch contents preserving directories and overwrite.
4. Login Super Admin.
5. Run upgrade_v4_36_0.php.
6. Test Penjualan Member -> Pembayaran Pengajuan Member.
7. Test Member Approval before/after payment.
8. Test Pra-Member Approval before/after payment.
9. Test attendance manual/selfie from an HTTPS page on a phone and allow location permission.
10. Run System Audit.

Do not import database.sql into an existing production database.
Use upgrade_v4_36_0.sql only if PHP upgrade cannot be run.