OViq Hotel ERP — Phase 6 release status

IMPLEMENTED AND TESTED IN THIS DEVELOPMENT BUILD
- Native MVC routing, PSR-4 mapping, DI resolution, middleware and named routes.
- Password sign-in, persistent per-email/IP throttle, role checks, inactive-session
  revocation, inactivity expiry, form CSRF, safe response headers and error masking.
- Property-scoped routed resource guards and scoped older-module collection queries.
- Assigned/unassigned room-type capacity checks, clean-room check-in, guarded
  checkout, transactional housekeeping handoff and folio extras.
- Integer minor-unit room/folio/POS/journal monetary arithmetic for two-decimal
  currencies. Inventory valuation uses a four-decimal weighted-average calculation.
- Split-group remaining-balance checks, repeat-payment keys, locked settled orders,
  manual receipt records, room folio posting (part-paid room transfer is rejected).
- Completed-date night audit, business-date uniqueness and refusal to close twice.
- Store/PO/GRN quantities, over-receipt checks, all-store weighted average.
- CRM stage movement, work orders, event venue bookings and advisory pricing rules.
- Closed-night report CSV, local Bootstrap, static-only offline fallback.
- CLI migrations, preflight, backup and optional DBA-installed audit guards.

NOT IMPLEMENTED / NOT CERTIFIED
- Real two-factor verification: accounts marked two_factor_enabled fail CLOSED.
  Do not enable 2FA for live users expecting an operational enrollment workflow.
- Complete dynamic RBAC administration screens, multi-property switching UI,
  translation administration or verified live FX-rate conversion.
- HR/payroll/biometric workflows, public booking engine, channel manager/OTA sync,
  guest QR ordering, passport scanning, key cards, automatic message campaigns.
- Live Stripe, PayPal, M-Pesa, Pesapal, QuickBooks, Xero, WhatsApp or SMS APIs.
  Payment methods label MANUALLY recorded receipts; no gateway charge is sent.
- Learned pricing or occupancy forecasting, chatbot or predictive AI.
- Full AP/AR, refunds, bank reconciliation, fiscal closing or automatic hotel/POS
  revenue-to-GL posting. GL supports manual balanced entries and expense entries.
- Full banquet/catering billing. Current event quotes cover hall rental only.
- Cross-jurisdiction payroll/tax compliance, PCI DSS certification, penetration
  testing, high-load scaling, multi-browser testing or audited data-retention policy.
- Background preventive scheduling; due-work creation is operator-triggered.

KNOWN LIMITATIONS / ACCEPTANCE GATES
- Current ledger forms do not have the same replay keys as payment forms; operators
  must avoid duplicate manual journal/expense submissions and reconcile entries.
- Cancelled/no-show reservations with deposits require manual reconciliation first;
  no automated deposit refund workflow is supplied.
- No early-departure re-rating or credit-note workflow. Stay quotes must be reconciled
  by accounting before closure; checkout will refuse a nonzero credit/debit balance.
- Room-rate overrides are exposed through the rate API; the manual booking form
  still uses the operator-entered nightly rate, not per-night automatic re-pricing.
- Night-audit recognition relies on the current in-house snapshot; backdated audit
  reconstruction after a guest has already checked out is not supported.
- Coarse property locking serializes the protected financial workflows. Older
  ancillary writes are guarded but not all are audit-rich transactional services.
- Raw database access bypasses route guards. Least-privilege runtime grants,
  independent backups and privileged-operator audit replication remain mandatory.
- Deployment examples are templates, not a configured live server.

Do not present this package as a completed, production-certified implementation
of every module in the original specification. Phase 6 hardens the implemented
subset; the items above remain explicit development and acceptance work.