# DSH cPanel Staging Runbook

## 1. Prepare a staging copy

1. Create a staging subdomain with the same PHP version and extensions as production.
2. Create a separate staging database and database user. Never point staging at production.
3. Back up files and export the production database before copying sanitized data to staging.
4. Store database credentials outside `public_html` as described in `docs/SECURE_DATABASE_SETUP.md`.

## 2. Run read-only database preflight

Import or execute `database/preflight_sprint4_read_only.sql` in the staging database. Review every returned row. Do not automatically delete or merge duplicate financial records.

Expected result: every query returns zero rows. Any result is a blocker requiring a documented reconciliation decision.

## 3. Apply migrations

Apply these files in order:

1. `install/migrations/001_core_financial_schema.sql`
2. `install/migrations/002_content_and_booking_schema.sql`

Export a new post-migration backup immediately after both succeed.

## 4. Run release audit

From cPanel Terminal, inside the DSH directory:

```bash
bash tools/release_audit.sh
```

Do not continue unless it prints `DSH RELEASE AUDIT: PASS`.

## 5. Smoke-test matrix

Test with separate Superadmin, tenant admin, merchant, buyer, and affiliate accounts.

- Authentication: login, logout, role restrictions, session regeneration, and password reset.
- Tenant isolation: users, products, orders, points, redemption, uploads, and settings from Tenant A must never appear in Tenant B.
- Commerce: add/update cart, checkout, stock deduction, retry, and insufficient-stock rollback.
- Rewards: point credit, concurrent conversion requests, reject refund, redemption submit/approve/reject/fulfill, and low-stock retry.
- Subscription: invoice, proof upload, approval, duplicate approval retry, lifecycle expiration, and suspension.
- Affiliate: referral activation, one commission per source/cycle, wallet balance, payout reservation, reject, approve, and paid.
- Bookings: simultaneous reservation attempts for one strategy slot; only one may succeed.
- Uploads: valid image/PDF, oversized file, fake MIME, executable extension, and direct execution attempt.
- Email/cron: reset email, booking email, SMTP failure logging, and protected lifecycle execution.

## 6. Rollback rehearsal

1. Put staging in maintenance mode.
2. Restore the pre-migration database backup.
3. Restore the pre-deployment file backup.
4. Clear PHP OPcache through cPanel or restart the configured PHP handler when available.
5. Confirm login and read-only pages operate on the restored version.

## 7. Production gate

Production is GO only when the preflight is clean, migrations succeed, the release audit passes, the entire smoke-test matrix passes, and rollback has been rehearsed successfully.
