PRESTIGE BARBER CLUB v4.41.8 - BUILD / DEEP AUDIT REPORT

Audit focus: membership sales not recorded + Pra/Non-Member camera photo input.

ROOT CAUSES CONFIRMED IN SOURCE
1. application_payment used deterministic request_token = SHA256(source:sourceId:payment). If an earlier sale for the same source existed (especially rejected/failed verification), retry could hit the unique request_token and create_membership_sale_v435() returned the OLD sale id instead of inserting a fresh sale. This made a retry appear successful while no new sale row was created.
2. membership_finalize_payment() trusted income_id without validating the referenced income row and created income using CURDATE() on verification. A missing/broken income_id therefore left PAID membership sales absent from income reports; late verification also placed income in the verification date instead of the original sale date.

FIXES
- application_payment now uses a cryptographically random 64-char token for each transaction attempt.
- Business duplicate guard remains: active PAID/PENDING sale per source is still blocked.
- membership_finalize_payment() validates income_id, relinks an existing income by source/reference when possible, and inserts only if no matching income exists.
- Membership income_date now follows DATE(membership_sales.sale_date).
- Upgrade repair scans PAID membership sales, relinks existing income where found, and creates only missing income rows.
- Added pre_members.photo_path and non_member_customers.photo_path.
- Added central setting pre_nonmember_photo_input_mode: flexible/upload/webcam/hp_front/hp_rear.
- Membership sale registration from Pra-Member/Non-Member accepts normal upload, HP capture, or getUserMedia webcam capture and persists the photo to the source record and Member record.

STATIC TESTS
- PHP lint files checked: 208
- PHP syntax errors: 0
- Version: 4.41.8
- Upgrade page uses page_header($pdo,...).

LIMITATION
- No production database/browser/camera hardware is connected in this build environment. SQL/business logic was audited statically; upgrade is idempotent by schema checks and income relink-before-insert logic.