OViq Hotel ERP — Phase 10 — localization foundation and translation administration

IMPLEMENTED IN THIS BATCH (WITH AUTOMATED TEST COVERAGE)
- Source-controlled UTF-8 catalogues: 75 registered keys each in English, French, Kiswahili and Arabic; English fallback and escaped parameter interpolation.
- Language selector on sign-in/challenge and authenticated shell; saved user preference reuses the existing users.locale column; sign-in loads that preference; switching properties retains the UI language.
- Localized sidebar, shared theme controls, sign-in/challenge labels, dashboard and translation administration. HTML lang/dir and Content-Language response metadata; Arabic RTL shell and mobile toggle support.
- Property-scoped override editor gated by settings.manage and current password/fresh enrolled factor; search, 20-key pagination, registered locale/key validation and plain-text output.
- Versioned override create/update/remove, monotonic inactive tombstones, payload/actor-bound request keys, audit-atomic writes and competing-writer tests.
- Active-property JSON export; no global/foreign override leakage; legacy global translations preserved and intentionally inactive.
- French display-number formatting on dashboard revenue only; storage, API/input numbers, ISO work dates, currency, money calculations and permissions remain unchanged.
- Static PWA cache version advanced so clients fetch localization styling; private language/translation state stays network-only.

PHASE 9 PROPERTY ACCESS FEATURES (RETAINED)
- Explicit additional-property memberships; unchanged implicit home access; no automatic operational Super Admin access to unrelated properties.
- Property cards, active-property badge, session/form-token rotation and stale-tab AJAX context conflicts; active property controls operational scopes, timezone and currency.
- Home-context system Super Admin central provisioning: property creation, branch-home system-role staff creation, additional membership grant/revoke for home-owned accounts. Sensitive actions require current password and fresh enrolled factor.
- Membership optimistic versions, payload/user-bound replay keys, full target-user session revocation on grant/revoke and property/audit/request transaction rollback.
- Custom roles remain property-local; system-role assignment changes revoke additional memberships pending reapproval; account/role administration remains in the actor's home context.
- Mandatory target-property 2FA check; any assigned property can prevent disabling account 2FA; security policy controls update the selected property's policy.
- Tenant writes revalidate current session version and membership under row locks after the property mutex.
- Non-destructive Phase9 migration; no existing user homes, roles, salaries, reservations or ownership rows are reassigned.

PHASE 8 HR/PAYROLL FEATURES (RETAINED)
- Property-scoped employee directory, optional linked login, contract salary and overtime rate; compensation controls excluded from HR-only screens.
- Property-owned shifts and 14-day roster register with overnight intervals, unpaid breaks, overlap rejection and saved schedule snapshots.
- Manual attendance, open/closed records, approval and reason-required correction; UTC storage with property-local display and DST ambiguity rejection.
- Calendar-day monthly base proration, allowances, configured percentage/fixed deductions and approved-attendance overtime using integer money arithmetic.
- Versioned payroll drafts, source fingerprints and exception checks; completed-month approval with password/fresh enrolled-factor confirmation; manual external payment references.
- Frozen printable payslips, protected approved/paid roster and attendance months, user/payload-bound request keys, transactional auditing and concurrency tests.
- Fresh schema, metadata-resumable Phase8 migration and legacy HR provenance readiness checks.

PHASE 7 IDENTITY/ACCESS FEATURES (RETAINED)
- Password plus TOTP challenge, local enrollment QR, replay-counter enforcement,
  encrypted seeds and one-use hashed recovery codes.
- Recovery-code replacement, confirmed disable, property-required enrollment,
  session-version revocation and password/factor reauthentication for admin writes.
- Property-owned custom roles, permission editing, staff creation/disable/password
  replacement, stale-edit rejection, privilege delegation limits and protected
  system roles. No cross-property user or custom-role administration.
- Manual journal/expense request keys with payload binding and retry-safe results.
- Application key provisioning and audited DBA-only emergency account recovery.

OTHER IMPLEMENTED FEATURES FROM EARLIER BATCHES
- Native MVC routing, PSR-4 mapping, DI resolution, middleware and named routes.
- Password sign-in, persistent per-email/IP throttle, role checks, inactive-session
  revocation, inactivity expiry, form CSRF, safe response headers and error masking.
- Property-scoped routed resource guards and scoped older-module collection queries.
- Assigned/unassigned room-type capacity checks, clean-room check-in, guarded
  checkout, transactional housekeeping handoff and folio extras.
- Integer minor-unit room/folio/POS/journal monetary arithmetic for two-decimal
  currencies. Inventory valuation uses a four-decimal weighted-average calculation.
- Split-group remaining-balance checks, repeat-payment keys, locked settled orders,
  manual receipt records, room folio posting (part-paid room transfer is rejected).
- Completed-date night audit, business-date uniqueness and refusal to close twice.
- Store/PO/GRN quantities, over-receipt checks, all-store weighted average.
- CRM stage movement, work orders, event venue bookings and advisory pricing rules.
- Closed-night report CSV, local Bootstrap, static-only offline fallback.
- CLI migrations, preflight, backup and optional DBA-installed audit guards.

NOT IMPLEMENTED / NOT CERTIFIED
- Full business-module and error-message localization, extra/regional languages, pluralization rules, translation import/bulk editing, public property-specific branding, verified live FX, per-property role overrides, consolidated reporting and inter-property accounting.
- Biometric device integration, statutory payroll/tax tables, payroll bank transfers,
  approved-payroll corrections/reversals, employee self-service payslips,
  public booking engine, channel manager/OTA sync,
  guest QR ordering, passport scanning, key cards, automatic message campaigns.
- Live Stripe, PayPal, M-Pesa, Pesapal, QuickBooks, Xero, WhatsApp or SMS APIs.
  Payment methods label MANUALLY recorded receipts; no gateway charge is sent.
- Learned pricing or occupancy forecasting, chatbot or predictive AI.
- Full AP/AR, refunds, bank reconciliation, fiscal closing or automatic hotel/POS
  revenue-to-GL posting. GL supports manual balanced entries and expense entries.
- Full banquet/catering billing. Current event quotes cover hall rental only.
- Cross-jurisdiction payroll/tax compliance, PCI DSS certification, penetration
  testing, high-load scaling, multi-browser testing or audited data-retention policy.
- Background preventive scheduling; due-work creation is operator-triggered.

KNOWN LIMITATIONS / ACCEPTANCE GATES
- Cancelled/no-show reservations with deposits require manual reconciliation first;
  no automated deposit refund workflow is supplied.
- No early-departure re-rating or credit-note workflow. Stay quotes must be reconciled
  by accounting before closure; checkout will refuse a nonzero credit/debit balance.
- Room-rate overrides are exposed through the rate API; the manual booking form
  still uses the operator-entered nightly rate, not per-night automatic re-pricing.
- Night-audit recognition relies on the current in-house snapshot; backdated audit
  reconstruction after a guest has already checked out is not supported.
- Coarse property locking serializes the protected financial workflows. Older
  ancillary writes are guarded but not all are audit-rich transactional services.
- Raw database access bypasses route guards. Least-privilege runtime grants,
  independent backups and privileged-operator audit replication remain mandatory.
- Deployment examples are templates, not a configured live server.

Do not present this package as a completed, production-certified implementation
of every module in the original specification. The current build extends the implemented
subset; the items above remain explicit development and acceptance work.

NEXT SELF-CONTAINED DEVELOPMENT BATCH
Full business-module label/error localization remains pending. Public booking, OTA/provider connections and expanded accounting workflows remain candidates for subsequent batches.
Statutory payroll rules and biometric integration still require jurisdiction/provider
inputs before any compliance or integration claim can be made.

IDENTITY LIMITATIONS AND RESPONSIBILITIES
- TOTP is a shared-secret second factor, not phishing-resistant WebAuthn/passkeys.
- Web-based forgotten-password email delivery and email verification are pending.
- Admin-created/reset passwords must be transferred through a secure independent
  channel; no invitation email or forced-first-login password-change screen exists.
- The database and app-key backups must be protected independently. Losing the key
  prevents TOTP decryption. Recovery codes can still authenticate; operator-guided
  disable/re-enrollment or break-glass reset requires identity verification.
- Custom roles are property-owned. Global system templates stay read-only in UI;
  create a custom role rather than editing permissions shared by other properties.
- Secret QR pages, recovery codes and second-factor challenge responses remain
  network-only/no-store. No authenticator synchronization or external QR API is used.
- A verified TOTP cannot be reused even for the next administration action. Wait
  for a fresh code, or use a different unused recovery code.

PHASE 8 POLICY LIMITS:
This is monthly-contract payroll, not a statutory payroll compliance engine. Base salary is prorated only by calendar days in employment; absent/leave statuses do not automatically reduce salary. Overtime is approved paid minutes above roster-snapshot paid minutes for the same work date; attendance without a roster earns no automatic overtime. No weekly/holiday multipliers, hour-based base wage, benefits accrual, multiple tax bands, pensions or employer contributions are inferred. The configured percentage is a manual deduction of prorated base, not a verified tax calculation. Completed payroll months only may be approved. Local payroll review is mandatory.
A payment marker is a MANUAL record of an external transfer, not a gateway transfer and not automatic GL posting. One employee/work-date attendance row; maximum recorded attendance interval 24h; operational shift limit 16h. Work date is local check-in date; an overnight interval belongs wholly to that payroll month, with no midnight/month-end splitting. Roster editing is row-by-row, not bulk drag/drop scheduling. Hire date is fixed after creation. Ending employment does not disable the linked login: use Users & Roles separately.
Approved/paid payroll has no application reversal or adjustment workflow yet. Legacy inactive staff without end dates, unowned/shared shifts, unresolved roster snapshots and historical settled slips without provenance must be reconciled manually before production. Raw database access can bypass application workflow locks; least-privilege database grants and external backups remain required. Coarse property mutex and no pagination in employee register remain scaling limits.

PHASE 9 TRUST MODEL AND LIMITS
One installation is one centrally trusted hotel-group administration domain, NOT a SaaS multi-organization isolation boundary. A system Super Admin at its active home can see all active property names/codes and provision staff or additional grants centrally. Its operational PMS/POS/HR access still requires explicit membership. Membership management is restricted to users owned by that administrator's home property; it cannot take over another property's accounts. Branch-owned staff can be provisioned centrally with a non-Super-Admin system role. No new Super Admin can be minted through that form.
Home access is implicit and cannot be revoked here; home reassignment is unsupported. Additional membership retains the user's one existing system role, not a per-property role. A role change through Users & Roles revokes active additional memberships. Custom property-owned roles cannot cross branches. Employee, technician, staff and user ownership remain local, so shared employees are not automatically copied between properties. Personnel assignment selectors still use home-owned local staff.
Property creation starts empty; no room/outlet/stock/opening balance seeding or branch cloning. Supported create currencies are USD/EUR/GBP/KES/AED/INR with the application's existing two-decimal arithmetic; no live FX. No property profile/currency edits, activation/deactivation UI, archived-property recovery, pagination, consolidated reports, cross-branch stock transfer or intercompany settlement in this batch. Raw database edits bypass application state rules and require manual reconciliation.
Session-wide context means switching one browser tab changes every tab sharing that session. Native old forms fail CSRF; the shared AJAX helper sends its original page context and receives a refresh-required conflict. Separate browser sessions can choose separate properties. Standard authentication blocks inactive accounts/homes; a revoked/invalid explicit context never silently falls back to a different property. Reauthentication clears the old selection and returns to home. Any required target factor must already be enrolled and verified before switching; use Account Security at home first.

PHASE 10 LOCALIZATION LIMITS
Only 75 registered source keys are localized in this batch. PMS/POS, HR/payroll, inventory, CRM, maintenance, events, most security/property administration content, many errors and browser/CLI/offline fallback messages still use English. Role names, property names, user content, CSV headers, bank references and historical payroll snapshots are not translated. The source dictionaries are initial supplied translations, not professional legal/accounting translation certification. Review terminology with native-speaking operators before use. No external machine translation service or live provider is called.
Preference is per-user and persisted; each existing session retains its current choice until changed or a fresh login reloads the saved preference. Guest choice is session-only; logout clears it. No Accept-Language negotiation or persistent guest cookie was introduced. Supported locale identifiers are exactly en/fr/sw/ar; regional/unknown stored values fall back to English without silently rewriting the stored value. User sign-in preference overrides prior guest selection. Switching branch retains the user's selected language.
Overrides are active-property plain text, never HTML templates, URLs, permissions or transaction rules. A translator with settings.manage can change trusted labels within its active property. Dynamic source placeholders must be retained with the same multiplicity. Markup is displayed literally, not executed. Inactive tombstones preserve monotonic versions and stay out of runtime/export results. JSON export is supported; import and rollback/bulk review are not implemented. Request/audit/tombstone history needs an operator retention policy before high-volume use.
Unauthenticated sign-in uses built-in catalogue text only, because no tenant context exists. Property overrides for auth.* keys are retained as scoped data but are not applied to the public sign-in page. Legacy global translations have no trustworthy property ownership and are not auto-promoted; a DBA/operator must review them and re-enter appropriate registered text through the scoped editor. No existing legacy row or saved locale is deleted by migration.
French revenue display uses a decimal comma and narrow-space grouping; other supported languages keep Latin-digit display. Form/API/CSV/DB formats remain canonical dot-decimal and ISO dates. No exchange conversion, localized input parsing, plural rules, date-format conversion, calendars or translated legal documents are supplied. RTL is verified for shared shell, sign-in, dashboard and translation screens only; full module grids/dialogs still need further RTL work. PWA static offline fallback remains English; authenticated pages are never cached.
