# Phase 2: route-contract baseline (not a runtime migration)

This iteration adds a repeatable **static** route inventory (`sonardesk-route-inventory.json`), its regeneration script (`php scripts/integration/audit_routes.php`) and host-level marketing route tests.

## Production blockers

1. Extract legacy API routes from module route providers and compare the **runtime** `php artisan route:list --json` outputs of both original applications. Static regex is not a substitute for runtime route enumeration.
2. Port licensing models, migrations, services, controllers and commands with namespace isolation. Do not run legacy migrations against the ABSDev database until table/schema conflicts have been reviewed.
3. Reconcile Fortify/Spatie auth with legacy users, permissions, sessions and licence ownership.
4. Integrate Paddle/Lemon Squeezy webhook signature verification and idempotency, preserve existing endpoints and secrets outside source control.
5. Port downloads, appcast, support and release-management views/controllers into Stylist's SonarDesk theme.
6. Test with a staging database copy and synthetic payment events; only then switch DNS.

No legacy licensing endpoints have been activated by this change. The archived legacy source remains isolated.