> Historical note from the supplied ZIP. Current findings: `142-REQUIREMENT-AUDIT.md` and `CONSOLIDATED-VERIFICATION.md`.

# Babu Jewellery — release status (2026-11-10)

This package is a CodeIgniter 4 application overlay, not a standalone framework or a certified production release. Install the supported CI4 framework separately, copy `app/` and `public/assets/`, configure a MySQL database, then run migrations using `php spark migrate`. Use a staging domain and HTTPS; keep the web root pointed to CI4's `public/` folder, not the project root. Set `CI_ENVIRONMENT=production` only after completing staging acceptance checks. Ensure framework CSRF is enabled for all state-changing forms, and configure secure session cookies, a private writable directory and unique production secrets.

**Payments:** COD is the only payment method used by checkout code. Easypaisa and JazzCash credentials can be entered later; provider adapters are not live. Leopards is configuration-only; use manual courier tracking until API integration is verified.

## Fixes in this package
- Serialize creator withdrawal requests using a creator row lock, transaction, two-decimal input validation and available-balance check.
- Enforce a creator's product selection before applying creator pricing, and validate the creator's price is above base price and within configured bounds.
- Exclude orders with unresolved return requests from commission release selection.
- Add checkout email validation and maximum quantity check.
- Add a dependency-free structural test runner: `php tests/release_checks.php`.

## Required external acceptance checks — NOT PERFORMED
1. Install CI4 and execute every migration on a clean MySQL 8 database and on a copy of a pre-existing database.
2. Run guest and logged-in COD checkout; confirm duplicate request, coupon, variant, stock-out and failed-transaction behavior.
3. Verify every stock mutation, RTO, return and refund against product/variant inventory ledgers.
4. Verify creator pricing, commission release timing, pending returns, concurrent withdrawals and payout transitions.
5. Verify role access, CSRF, session cookies, upload hardening, XSS, error handling and audit completeness.
6. Run browser E2E tests on mobile and desktop, compare actual reference design pixel by pixel.
7. Run deployment smoke tests, backup/restore drills and monitor order/stock/payment reconciliation.

**Status:** These fixes do not complete the 14 outstanding areas or establish production readiness. No real MySQL, browser, hosting or courier/payment API tests were performed in this environment.