# Phase 9 Checklist — Reports, Analytics & Audit

## Database
- [x] `013_reporting_analytics.sql`
- [x] `order_item_reporting_dimensions`
- [x] category backfill for existing order items
- [x] category snapshot for new order items
- [x] `report_daily_metrics`
- [x] reporting/audit permissions

## Reports
- [x] Daily sales
- [x] Restaurant sales
- [x] Menu item sales
- [x] Category sales
- [x] Table sales
- [x] Room-service sales
- [x] Reservation report
- [x] Kitchen performance
- [x] Average preparation time
- [x] Delayed orders
- [x] Cancelled orders
- [x] Payment report
- [x] Room charges
- [x] VAT report
- [x] Restaurant/date filters
- [x] bounded report range

## Exports
- [x] CSV export
- [x] `reports.export` authorization
- [x] UTF-8 BOM for spreadsheet compatibility
- [x] CSV formula-injection protection
- [x] report-export audit event

## Analytics
- [x] Live central-dashboard KPIs
- [x] daily metrics snapshot
- [x] 30-day trend UI
- [x] throttled cPanel cron refresh
- [x] standalone refresh command
- [x] authoritative reports remain live-query based

## Audit
- [x] Date filtering
- [x] Actor filtering
- [x] Action filtering
- [x] Entity filtering
- [x] IP filtering
- [x] Before/after values
- [x] `audit.view` permission

## API
- [x] `GET /api/v1/reports/{report}`
- [x] `GET /api/v1/audit`
- [x] authenticated / hotel scoped

## Verification
- [x] PHP syntax lint
- [x] Phase 9 smoke tests
- [x] Composer JSON validation
- [x] migration/table/FK structural checks
- [x] route duplicate check
- [x] HTTP front-controller boot check
- [x] secret/private-key scan
- [x] ZIP integrity check