# Production launch checklist

## Application

- Set `APP_ENV=production`, `APP_DEBUG=false`, and an HTTPS `APP_URL`.
- Set `SESSION_SECURE_COOKIE=true` and keep cookies HTTP-only.
- Deploy optimized Composer dependencies and the generated `public/build` directory.
- Run `php artisan migrate --force`, `php artisan optimize`, then `php artisan app:production-check`.
- Confirm `/up` and `/ready` return HTTP 200.

## Background services

- Run `php artisan queue:work --tries=3 --timeout=120` using a persistent process.
- Run `php artisan schedule:run` every minute through cron or the hosting scheduler.
- Monitor failed jobs, logs, disk usage, queue age, and HTTP 5xx responses.

## Backups

- Schedule encrypted PostgreSQL and uploaded-file backups outside the web root.
- Retain daily, weekly, and monthly copies in a separate location.
- Restore the newest backup into staging and record the result.

## Acceptance

- Test owner and restricted roles for every module.
- Test purchases, sales, transfers, returns, payments, payroll, vouchers, and reports.
- Test simultaneous sales and transfers of the same SKU.
- Verify email, MFA, HTTPS redirects, cookies, audit logs, queues, and schedules.
- Keep a rollback package and maintenance-mode procedure ready.
