# Coaster World — Production Readiness (v1.99)

This document is the final deployment checklist before the v2.0 public release.

## 1. Never work without a verified backup

From a Laragon terminal:

```bat
tools\backup_database_windows.bat
```

Or manually:

```bat
php artisan cw:backup:database
php artisan cw:backup:verify
```

Backups are written to `storage/app/backups/` with a `.sha256` sidecar and metadata JSON. The backup command is read-only for the application database.

A real restore rehearsal is also available on Laragon:

```bat
tools\restore_backup_test_windows.bat
```

It creates a uniquely named `cw_restore_test_*` database, imports the latest verified dump, checks critical tables, then drops only that temporary database. It never replaces the configured Coaster World database.

## 2. Local / release-candidate gate

Run:

```bat
tools\final_release_check_windows.bat
```

It performs a verified SQL backup, runtime diagnostics, QA preflight, PHPUnit, scheduler inspection, route caching and Blade compilation.

## 3. Production `.env`

Start from `.env.production.example`, never from a copied secret-filled `.env`.

At minimum configure:

- `APP_ENV=production`
- `APP_DEBUG=false`
- a real `APP_KEY`
- public `https://` `APP_URL`
- MySQL/MariaDB credentials using `utf8mb4`
- `SESSION_SECURE_COOKIE=true`
- `SESSION_ENCRYPT=true`
- a real SMTP/API mail transport
- `LOG_STACK=daily` and a non-debug log level

Never commit or distribute the real `.env`.

## 4. Scheduler

On the current Laragon/Windows hosting setup:

```bat
tools\install_scheduler_windows.bat
```

Then confirm the heartbeat in Administration > Diagnostics or:

```bat
php artisan cw:diagnose
```

## 5. Media storage

Since v1.104.0, Coaster World uses one canonical physical media directory:

```text
storage/app/public/media
```

`public/storage` is no longer required. Public media are streamed by Laravel through `/storage/media/...`, while protected collectible-card artwork stays behind signed routes.

After upgrading an existing installation, run once:

```bat
tools\consolidate_media_storage_windows.bat
```

Do not run `php artisan storage:link` for Coaster World media after this migration.

## 6. Migrations

Always use:

```bat
php artisan migrate --force
```

Never use `migrate:fresh` on an existing Coaster World database.

## 7. Strict production gate

On the final host, after HTTPS, mail, scheduler and public storage are configured:

```bat
tools\production_readiness_windows.bat
```

or:

```bat
php artisan cw:release:final-check --production
```

Production mode blocks the release when a critical requirement is missing.

## 8. Manual multi-account QA

Complete the checklist in:

`Administration > QA pre-release`

Use at least two normal users and one administrator. Export the QA JSON when all scenarios are validated.

## 9. Public launch

Only move to v2.0 when:

- automated QA has no blocking failures;
- runtime diagnostics has no DOWN state;
- strict production readiness is READY (or every remaining warning has been deliberately accepted);
- the verified backup is recent;
- the manual multi-account checklist has no unresolved failure.