move into sonardesk

integration/PHASE10.md

@@ -0,0 +1,23 @@
+# Phase 10 — Read-only customer licence portal
+
+## Install
+Extract this archive at the ABSDev project root, preserving paths. Merge `IntegratedLicensingServiceProvider.php` if locally customised. Do not replace the production licensing application.
+
+```sh
+composer dump-autoload
+php artisan optimize:clear
+php artisan route:list --path=account/sonardesk -v
+```
+
+Visit `/account/sonardesk` while signed in with a **verified** ABSDev account. Licences are matched to `customer_email` case-insensitively; no cross-application SSO or automatic account linking is claimed.
+
+## Security and scope
+- Authenticated and verified users only, rate-limited.
+- Ownership checked on each licence detail request, returning 404 for non-owners.
+- No subscription cancellation, upgrade, activation changes, key retrieval or checkout.
+- No new migrations, secrets or third-party API calls.
+- Existing Paddle billing, licensing APIs, admin routes and webhooks are untouched.
+- Test with one owner, one unrelated user and an unverified user before release.
+
+## Phase 11
+Downloads, releases and update feeds.

integration/PHASE9.md

@@ -0,0 +1,11 @@
+# Phase 9 — Paddle read-only reconciliation
+
+This is the **first Paddle API integration step**, not a checkout or webhook migration. Existing production billing and webhook endpoints remain untouched.
+
+## Install
+Copy the patch files into the ABSDev project, preserving paths. Configure `SONARDESK_PADDLE_API_KEY` with a read-only Paddle API key and `SONARDESK_PADDLE_ENVIRONMENT=sandbox` (or `production`) in `.env`. **Never copy production credentials into source control.** Run `composer dump-autoload`, `php artisan optimize:clear`, and `php artisan route:list --path=administration/sonardesk -v`.
+
+Open `/administration/sonardesk/paddle-reconciliation`. Page checks up to 20 recent Paddle-linked licence statuses. It is deliberately limited to avoid unbounded API calls and is read-only.
+
+## Not included
+Checkout creation, customer identity linking, payment processing, webhook cutover, subscription mutation, and production deployment. These require migration tests and explicit cutover approval.