# TOP TECH System Map — Public Export

> Documentation-only mirror prepared on 2026-08-10. It contains architecture, schema names, routes, flows, and code references only. It contains no customer rows, credentials, tokens, private keys, uploaded slips, or runtime configuration.

## Read this map

- [Database schema](DATABASE_SCHEMA.md) — 49 documented tables, keys, important/status/financial fields, relationships, APIs, and frontend pages.
- [API map](API_MAP.md) — the current PHP router surface, including active and explicitly disabled routes.
- [Frontend map](FRONTEND_MAP.md) — public, backoffice, customer, and developer pages.
- [Business flows](BUSINESS_FLOWS.md) — current user action → frontend → API → backend → database → status → next-flow chains.
- [Event map](EVENT_MAP.md) — system-impacting requests, writes, financial actions, verification, uploads, sessions, and navigation.
- [Savings system](SAVINGS_SYSTEM.md) — current savings-account implementation, including explicit gaps.

## Direct answer

TOP TECH is a PHP/MySQL sales, savings-down-payment, contract, installment, payment, promotion, and customer-service system. The browser clients are static HTML/CSS/JavaScript. They call a single PHP entry point, `api/v1/index.php`, which authenticates requests, enforces role/customer scope, runs domain logic, and reads or writes MySQL tables. Payment slips are stored as managed files; only the resulting path is stored in transaction records.

```text
Public / Backoffice / Customer browser pages
  -> fetch() through backoffice.js or customer portal client
  -> api/v1/index.php (authentication + route dispatch + business rules)
  -> PDO transactions and MySQL tables
  -> JSON response
  -> page state, navigation, and status labels
```

## Current inventory

| Area | Current code/map count | Notes |
|---|---:|---|
| Database tables | 49 | Schema metadata from the existing system map, checked against schema/migration references in the repository. |
| API method/route records | 59 | 57 active method/route records and 2 handlers that intentionally return HTTP 410. Three additional legacy handler blocks are unreachable (`if (false)`). |
| Main frontend pages | 14 | 10 backoffice, 2 customer portal, and 2 public marketing surfaces. |
| Existing system-map sections | 23 | The original single-page documentation remains unchanged in `docs/system-map/`. |
| Export HTML pages | 7 | Fully static, meaningful HTML. |
| Export Markdown documents | 7 | Directly readable without JavaScript or authentication. |

## Map/code conflicts

1. **MAP/CODE CONFLICT — API count:** the existing `system-data.js` metadata says 74 APIs, but its `apis` array is empty. Current route inspection identifies 59 method/route records: 57 active and 2 disabled with HTTP 410.
2. **MAP/CODE CONFLICT — savings conversion:** the existing flow inventory marks conversion as `BROKEN`; current code has an active atomic conversion handler and a second legacy handler disabled with `if (false)`. The active handler is documented here.
3. **MAP/CODE CONFLICT — payoff:** the old flow inventory describes direct payoff. Current code disables direct `POST /contracts/:id/payoff` with HTTP 410 and requires a PAYOFF payment intent followed by verification.
4. **MAP/CODE CONFLICT — contract deletion:** the route is present but immediately returns HTTP 410; cancellation is the supported lifecycle action.
5. **MAP/CODE CONFLICT — table aliases:** old flow text sometimes says `payment_intents`, `contract_status_logs`, or `cash_sale_items`; current schema/code uses `contract_payment_intents`, audit logs, and a single-row `cash_sales` record rather than those names.

## Trust and evidence boundary

The current router (`api/v1/index.php`) is the source of truth for route status and behavior. Frontend call sites are the source of truth for current callers. The 49-table system-map metadata, schema SQL, and migration files are the source of truth for documented schema. MySQL was not running during preparation, so this export does not claim a live-database snapshot and includes no row-level checks.

## Security boundary

Included: table/field names, relationships, route patterns, architecture, flow/status names, and code locations.

Excluded: `.env*`, `config.local.php`, passwords or password hashes as values, database credentials, API keys, secrets, access/refresh tokens, JWT secrets, private keys, service-role keys, OAuth secrets, customer rows, phone numbers, ID-card values, bank-account values, and payment-slip files.

## Cloudflare Pages preparation

No deployment was performed. Recommended settings when the repository root is selected:

```text
Project root: repository root
Build command: NONE
Output directory: docs/system-map-public
```

If Cloudflare Pages is configured with `docs/system-map-public` as the project root, use the project root itself as the output (`.` or the provider's blank/no-build output setting). The site has no PHP, Node backend, database, authentication, or protected API dependency.

## HTML entry points

- `/index.html`
- `/database.html`
- `/api.html`
- `/frontend.html`
- `/business-flows.html`
- `/events.html`
- `/savings.html`