EDEN 100.9.10 — Validation Summary

Version and manifest
- VERSION and update.json: 100.9.10
- update.json manifest paths are unique and exist.

Static checks passed
- NextPay token/verify and hosted payment URL use the documented /nx routes, rather than mixing the legacy api.nextpay.org gateway path.
- Missing/legacy NextPay tokens are refreshed before redirect; the payment row is updated safely, with an additional fallback if the token timestamp column cannot be added.
- A v5 wallet migration checks order_id and provider_token_created_at and retries on later requests if it did not complete.
- Coupon routes independently create and verify commerce_coupons, commerce_coupon_sessions and commerce_coupon_redemptions; failures are logged and shown as an actionable message.
- Membership products have a separate optional private HTTPS delivery_url and can edit title, price, link and group/channel target. The link is delivered only after confirmed purchase; public title and description strip raw URLs.
- File/folder products can edit title, price and source file/folder.
- User search button sits immediately above Guides and is permission-gated.

Syntax checks
- PHP CLI version: 8.4.24
- Total PHP files linted: 75
- PHP lint failures: 0

Not tested here
- No live NextPay token/verify call, bank transaction, production server deployment, Telegram API checkout, or live MariaDB migration was performed.
- The exact previously reported trans_id URL returned HTTP 404 when checked. It may be expired or invalid; the new release refreshes tokens for old invoices with no timestamp. If a freshly generated token still receives 404, the actual token API response and the NextPay account/API-key mode must be examined.
