# WBMCZ — deploy notes · 07 Sep 2026
## Six fixes

**6 files. No database change** — the migration already covers everything here.

    includes/acl.php                     one new permission: users.purge
    includes/pipeline.php                Pending KYC holds free + subscribed
    admin/includes/user_list_engine.php  permanent delete, state/district, frozen pane
    admin/includes/product_engine.php    frozen pane
    admin/activity_task.php              the scrollbar, and the plan badge
    admin/staff.php                      removing staff now soft-deletes

Upload `includes/` first, then `admin/includes/`, then the two `admin/` screens.

---

## 1 · PERMANENT DELETE

A **Delete for ever** button on the blue bar of the Deleted Users page. Tick the
rows, press it, confirm.

Two things about it are deliberate:

* **Only rows already in the bin can be erased.** Anything still live is
  skipped. So it always takes two steps — remove, then erase — and there is no
  single click anywhere that turns a working account into nothing.
* **Their money records are kept.** Orders, wallet history and commission stay
  exactly as they are. Those are the company's record of money that changed
  hands; they should not disappear because somebody tidied up an account. Only
  the account row goes, and the erasure itself is written into the history.

It has its own permission, **`users.purge` — "Erase a deleted account for
good"**. Somebody who may move an account to the bin does not automatically get
to burn it; you have to tick this one on purpose. Nobody holds it until you
grant it.

---

## 2 · REMOVING A STAFF ACCOUNT NOW SHOWS IN DELETED USERS

It was running `DELETE FROM users` — the row was gone. That is why nothing ever
turned up under Deleted Users, and why there was no way back from a mis-click.

It is a soft delete now, exactly like removing a member: the account cannot sign
in and is hidden everywhere, but the row is intact and Deleted Users can restore
it. Their answers on the staff form are kept too, so a restore brings back the
whole account rather than a blank one.

To erase a staff account for good, remove it here and then use **Delete for
ever** on Deleted Users.

---

## 3 · PENDING KYC HOLDS FREE MEMBERS AND SUBSCRIBERS TOGETHER

Anybody who has settled on a plan — marked free, or subscribed — and has sent
nothing in now sits on **Pending KYC**. The work is the same for both: chase the
documents.

Who you are ringing is not the same, though, so **the plan is on the row**:

* a violet **Subscribed** badge, or
* a blue **Free** badge

right beside the outcome, so you can see at a glance which conversation you are
about to have.

On your data this moved 2 members and 1 seller up onto Pending KYC. **Free User
and Subscription now read 0** — that is not a fault: everyone who was on them
has climbed one rung, and the badge says which they were. That is how the ladder
has always worked; Lead empties into Free User the same way.

---

## 4 · A SCROLLBAR ON THE STEP ROW

The row of steps is wider than the screen once a side has eight of them, and the
scrollbar was hidden — so Support and the desks past it were simply invisible,
with nothing on screen to say there was more.

It is a visible bar now, on both the mouse and the trackpad.

---

## 5 · STATE AND DISTRICT ON EVERY USER LIST

Two new boxes on the filter bar of **User, Seller, Employees and Admin** — the
same bar on all four, since they share one engine.

* **State** — only the states that actually appear on that page. No point
  offering Kerala on a list where nobody lives there.
* **District** — narrows to whatever state is chosen, so the second box is never
  a wall of names. With no state picked it says so.

They join the search, the tiles and every other filter, so **Export CSV carries
them too**: filter to *subscribed members in South 24 Parganas* and that is what
lands in the file.

> On your local copy there is one state and one district on file, so the boxes
> will look empty there. The live database has the real spread.

---

## 6 · FROZEN COLUMNS

The tables are far wider than any screen, and once you scrolled right to the
wallet or the action buttons you could no longer see whose row you were on.

The **tick box and the name** now stay put while the rest slides underneath,
with a soft edge so it reads as a pane rather than a join — the way a frozen
pane works in a spreadsheet. The header stays put going down as well as across.

Both engines have it, so it applies to **all eight user lists and all thirteen
catalogue pages** at once.

---

## CHECKED

* all six files pass `php -l`
* 68 admin pages load with no fatal, no warning and no notice
* the purge handler only ever touches rows with `deleted_at` set, and its button
  is behind `ul_can('purge')`
* the hard `DELETE FROM users` is gone from `staff.php`
* the ladder was rebuilt against real data — 2 members and 1 seller on Pending
  KYC, and the rung SQL runs clean
* `users.purge` is in the permission registry

**Needs your eyes**, because it is behind the sign-in:

1. Deleted Users → tick one → **Delete for ever** (try it on a test account).
2. Staff Accounts → remove somebody → they should appear under Deleted Users.
3. Activity & Task → User → **Pending KYC** — check the Free / Subscribed badges.
4. Scroll the step row sideways; the bar should be there.
5. Any user list → pick a state, then a district, then Export CSV.
6. Scroll any wide table sideways and watch the first two columns stay.
