# Backend deployment status: blocked

This source has been isolated from old-domain fallbacks and now includes a
secret-free new-domain environment template. It is **not ready to boot or
deploy** yet.

## Required before build or test

1. Supply the licensed `Modules/Gateways`, `Modules/Rental`, and
   `Modules/Controller` sources, or perform a reviewed removal of every direct
   dependency. They are marked enabled but absent from this snapshot.
2. Create a separate empty database and least-privilege user. Never point this
   source at either known old database.
3. Copy `.env.new-domain.example` to `.env`, replace all placeholders, generate
   a unique `APP_KEY`, and verify new frontend/backend origins.
4. Import the old dump into the **new** database only. Before first app boot,
   sanitize the new copy: disable live payment, courier, mail/SMS, Firebase
   push, Meta/analytics sync and cron; replace all callbacks and credentials
   with sandbox/new-domain values.
5. Generate new Passport keys and clients. Do not copy old
   `storage/oauth-*.key` files or imported access tokens.
6. Restore media into `storage/app/public` as a separate protected data step,
   then create a new `public/storage` link. Do not package the duplicate
   existing `public/storage` directory.
7. Point the backend domain at `backend/public`, never the project root.

Do not run Composer scripts, Artisan, migrations, schedulers, queues, or tests
until the new `.env` has been mechanically checked against the new database.
`EXTERNAL_SCHEDULER_ENABLED` must remain `false` throughout the test phase.