# Stage 4 Cleanup Report

Completed: 2026-08-15

## Deleted directories

- `.cache` (a local rclone/VFS cache) and the 50.1 MiB `.cache.zip` snapshot.
- Empty root directories: `sefcard`, `sefcard-updates`, `output`, and `cgi-bin`.
- Unreferenced frontend directories: `public/frontend/assets/js`, `public/frontend/assets/owl-carousel`, and `public/frontend/assets/bootstrap/js`.
- `public/backend/assets/scss` (205 unreferenced Sass source files; production uses the compiled CSS).
- Generated delivery artifacts after verification: `node_modules` and `public/build`.

## Deleted files

- Root-level debug/demo/duplicate delivery files: `check_admin.php`, `an tinke`, `index.html`, root `sitemap.xml`, root `robots.txt`, `public/kint.php`, and `public/test-asset-check.txt`.
- 54 public source maps, nine `.DS_Store` files, root/config PHP error logs, 14 generated application logs, and PHPUnit's result cache.
- Unreferenced legacy CSS and Slick assets: `app.css`, `ion.rangeSlider.min.css`, `menu.css`, `menu.min.css`, `slick.css`, and `slick.min.js`.
- Default Laravel example tests and the unused `welcome.blade.php` view.

## Deleted dead PHP code

- Removed the non-loadable backup controller/component copies with `(1)` or `(2)` suffixes.
- Removed Debugbar configuration and its `_debugbar` middleware exception.
- Removed the obsolete Debugbar log-viewer exclusion after the package was removed.

## Deleted duplicate implementations

- Removed the legacy sitemap generation methods from `Backend\\SeoController`, their routes, sidebar link, and Blade page.
- Kept the active `SitemapService`/`SeoSuiteController` implementation and its `technical-seo.sitemap` routes as the single sitemap-management path.
- Removed duplicate Blade copies for product editing, cart, cart summary, category, and product-details views.

## Deleted frontend assets

- Removed 54 source maps (4.1 MiB) and 205 Sass sources (0.7 MiB) that were not used by the production runtime or Vite build.
- Removed unreferenced legacy JavaScript/Owl Carousel/bootstrap JS bundles and unused CSS. The active legacy authentication CSS files remain.
- Trimmed the Vite inputs to the two CSS files actually used by the legacy authentication layout.

## Composer dependencies removed

- Removed `barryvdh/laravel-debugbar` and its `maximebf/debugbar` dependency from Composer's lock file and installed vendor tree.
- Moved `laravel/tinker` from runtime `require` to `require-dev`; the production `--no-dev` dry run confirms it is excluded.

## NPM dependencies removed

- Removed `axios` from `package.json`, `package-lock.json`, and the local dependency tree. No application import referenced it.

## SEO cleanup performed

- Removed conflicting root sitemap/robots files so the canonical `public/sitemap.xml` and `public/robots.txt` are served.
- Consolidated the admin sitemap action under `GET /admin/technical-seo/xml-sitemap-update` and `POST /admin/technical-seo/xml-sitemap-update/run`.
- Updated the SEO dashboard label and action to the consolidated route.

## Public directory cleanup performed

- Removed backup, test, debug, source-map, Sass, and unused legacy assets from `public`.
- Preserved production storefront, administrator, authentication, upload, validation, and ACME assets.
- Confirmed the active administrator CSS endpoint returns `200 text/css`.

## Approximate repository-size reduction

At least **72 MiB** was removed from the working/delivery footprint, before counting the small duplicated PHP/Blade and legacy-asset files. The largest confirmed contributors were the 50.1 MiB cache ZIP, local cache, 15.3 MiB `node_modules`, 4.6 MiB of maps/Sass, and generated build/cache/log files. Customer uploads and `vendor` were not included in this estimate.

## Test commands run

- `composer validate --no-check-publish`
- `composer install --no-dev --optimize-autoloader --dry-run --no-interaction`
- `php -l` for every changed PHP/config/routes file
- `php artisan test`
- `npm.cmd run build`
- `php artisan route:list --path=sitemap`
- Local HTTP checks with `curl.exe` for storefront, auth, cart, checkout, admin, sitemap, robots, and CSS endpoints
- `php artisan optimize:clear` before delivery cleanup

## Test results

- Composer JSON/lock validation passed. Composer reports the pre-existing advisory that `jenssegers/agent` uses an unbounded `*` constraint.
- Production Composer dry run passed and lists Tinker among the development-only packages removed by `--no-dev`.
- All changed PHP files passed syntax linting.
- Laravel tests passed: **4 tests, 11 assertions**.
- Vite production build passed with two CSS entry points.
- The only sitemap routes are the two `technical-seo.sitemap` routes; no Debugbar routes remain.
- HTTP checks: storefront, shop, product, login, register, cart, sitemap, robots, and required CSS endpoints returned `200`; checkout and admin correctly returned `302` to login for an anonymous session.

## Files deliberately kept because usage cannot be conclusively ruled out

- `public/uploads/**`, including the zero-byte `uploads/all/setting-lib.php`: upload/media names can be database-backed, so no customer-content path was removed without a conclusive reference check.
- `.well-known/**` validation files and both `.htaccess` files: they can affect live certificate validation and routing.
- Active backend assets, `opcodesio/log-viewer`, Laravel Pulse, analytics, and the legacy authentication CSS because routes/templates still use them.
- `storage/app/performance/**`, which contains this and earlier optimization audit reports.

## Remaining tasks for Stage 5

- No Stage 5 work was started. If authorized separately, use this cleaned baseline for final deployment packaging, production configuration review, and any release-specific cache/build strategy.
