# Phase 3 Completion Checklist

## Database
- [x] carts
- [x] cart items and add-ons
- [x] unified orders table
- [x] order item snapshots
- [x] order add-on snapshots
- [x] order courses
- [x] order status history
- [x] idempotency keys
- [x] table-session / room-session / customer-session relationships
- [x] indexes and foreign keys

## Customer ordering
- [x] table QR → menu → cart → order
- [x] room QR → room-service menu → cart → order
- [x] independent carts per customer/device session
- [x] all dine-in orders linked to the shared table session
- [x] quantity
- [x] variant / size
- [x] flavour
- [x] add-ons and constraints
- [x] special instructions
- [x] requested course
- [x] requested item serving time
- [x] room-service ASAP
- [x] room-service schedule for later

## Validation and pricing
- [x] re-read menu prices server-side
- [x] re-read VAT/tax server-side
- [x] revalidate item status
- [x] revalidate category status
- [x] revalidate availability rules at checkout
- [x] revalidate selected variant/flavour
- [x] revalidate add-on constraints
- [x] configurable tax-inclusive/tax-exclusive menu pricing
- [x] totals calculated on the server
- [x] historical price/tax/name snapshots

## Idempotency
- [x] order submission requires idempotency key
- [x] key uniqueness enforced in MySQL
- [x] network retry returns original committed order
- [x] same key with different request parameters is rejected
- [x] active cart marked ordered in the same transaction

## Customer order experience
- [x] order confirmation
- [x] order number
- [x] current status
- [x] estimated ready time foundation
- [x] item receipt
- [x] subtotal/tax/total
- [x] order history
- [x] order-status API
- [x] guest cancellation while order is still RECEIVED

## Admin
- [x] orders list
- [x] filter by status
- [x] order detail
- [x] table/room location display
- [x] order item snapshots
- [x] status history
- [x] database-driven `orders.view` / `orders.manage` permissions
- [x] dashboard open/new-order counts

## API security
- [x] CSRF required for cookie-authenticated mutations
- [x] session/cart endpoints expose CSRF token
- [x] opaque public IDs for guest resources
- [x] internal MySQL IDs filtered from guest API output
- [x] customer may retrieve only its own orders
- [x] browser prices and totals ignored

## Deferred to Phase 4+
- [ ] kitchen orders / kitchen order items
- [ ] KDS screens
- [ ] kitchen station routing execution
- [ ] ACCEPTED / PREPARING / READY / SERVED controls
- [ ] delay notifications
- [ ] room-service delivery dispatch and live ETA (Phase 5)
- [ ] reservations and holds (Phase 6)
- [ ] bills / split bills / payments / room charge (Phase 7)