# Phase 2 Completion Checklist

## Database
- [x] `categories`
- [x] `menu_items`
- [x] `menu_item_variants`
- [x] `menu_item_flavours`
- [x] `addons`
- [x] `menu_item_addons`
- [x] `ingredients`
- [x] `menu_item_ingredients`
- [x] `allergens`
- [x] `menu_item_allergens`
- [x] `menu_item_images`
- [x] `availability_rules`
- [x] `kitchen_routing`
- [x] indexes, foreign keys and ownership relationships

## Admin
- [x] category create/edit/disable
- [x] menu item create/edit/delete/disable
- [x] price and VAT assignment
- [x] calories, prep time and serving time
- [x] variants / sizes
- [x] flavours
- [x] add-ons with quantity constraints
- [x] ingredients
- [x] allergens
- [x] availability rules
- [x] kitchen/station assignment
- [x] image upload, remove and primary image
- [x] database-driven menu permissions

## Customer
- [x] mobile menu browsing
- [x] table QR → menu
- [x] room QR → In-Room Dining menu
- [x] category sections
- [x] price
- [x] calories
- [x] preparation estimate
- [x] variants and flavours display
- [x] allergen display
- [x] current availability enforcement
- [x] ordering deliberately deferred to Phase 3

## API
- [x] `GET /api/v1/menu`
- [x] `GET /api/v1/menu/categories`
- [x] `GET /api/v1/menu/items`
- [x] `GET /api/v1/menu/items/{publicId}`
- [x] public opaque IDs rather than customer-visible database IDs

## Security
- [x] hotel/restaurant ownership checks on admin writes
- [x] CSRF on all admin mutations
- [x] RBAC permissions
- [x] file MIME verification with `finfo`
- [x] image dimension verification
- [x] file-size limit
- [x] generated upload filenames
- [x] PHP/executable blocking in upload directory
- [x] no SVG menu uploads
- [x] output escaping in templates

## Seed
- [x] categories from the supplied specification
- [x] sample menu items from the supplied specification
- [x] variants/flavours examples
- [x] sample add-ons
- [x] sample ingredients/allergens
- [x] breakfast availability example
- [x] default item kitchen routes
- [x] repeat-safe seed strategy
- [x] explicit demo-data disclaimer

## Deferred to Phase 3+
- [ ] cart
- [ ] place order
- [ ] order snapshots
- [ ] order courses
- [ ] requested serving time
- [ ] kitchen tickets / KDS workflow
- [ ] room-service delivery workflow
- [ ] reservations
- [ ] billing / payments