Extract the CodeCanyon ZIP into a verified Laravel root, capture vendor docs, back up a pristine copy, then inspect and classify any author edits inside vendor/ — preserving real patches, stripping license-injection backdoors, and proving a clean tree boots — before a single feature is touched.