# Phase 1 verification record

Status: 77/77 final local automated assertions passed; no final failed assertions. This is local verification, not production certification. Earlier harness setup failures (local session path and missing fixture fields) and a retry test without its required guest token were corrected before the final passing runs; those were not counted as passes.

| Group | Passed | Failed |
|---|---:|---:|
| http | 40 | 0 |
| service | 24 | 0 |
| concurrency | 3 | 0 |
| gateway | 7 | 0 |
| extra | 3 | 0 |

All 76 original active PHP files and all 13 delivered PHP files pass syntax checks. Delivered PHP bytes match the locally tested site implementation after restoring the real payment transport. No test helper, mock transport, dummy credentials, fixture records or local configuration is in the deployable ZIP folder.

## Performed

- Real local HTTP requests against the patched PHP site with cookie sessions and the supplied MySQL-compatible schema: guest/registered COD checkout, variant stock/price, both shipping rates, duplicate submissions, refresh, account ownership, guest-token rejection and private headers.
- Invalid phone, district/upazila, courier, shipping, coupon, payment method, missing variant and CSRF rejection. Fractional quantities, duplicate-style cart keys, Bangla phone normalization and negative discounts.
- A database trigger deliberately failed reservation insertion after items/stock updates. The entire order, checkout-attempt record and stock changes rolled back; the customer did not see the injected SQL message or a success screen.
- Separate concurrent PHP processes submitted the same attempt and competed for limited stock. One identical attempt produced one order; limited stock did not oversell. PHP browser-session locking was not the only protection in this test.
- Actual staff service functions with the local authenticated staff fixture: confirm → processing → ready to ship, stale revision rejection, cancellation and release-once behavior.
- Payment service tests used the actual verification code with only external HTTP transport replaced by deterministic simulated gateway replies. Wrong transaction, amount, malformed amount, currency, status, missing risk, successful validation, repeated callbacks, late cancelled-order payment, old-attempt payment and provider outage were exercised.
- Actual local checkout/retry/return/IPN routes with simulated provider transport: commit before redirect, browser-success forgery rejected, verified failed transaction retry, pending retry blocked, successful IPN, duplicate IPN, and saved confirmation after gateway initialization failure. External gateway redirects were captured, not followed; no payment was made.
- Missing optional parcel table tolerated by tracking. Confirmation, tracking and summary views did not mutate order count or stock.
- Confirmation and tracking rendered in the in-app browser at 1440, 1024, 768, 390 and 360 widths. Document width was at or below viewport width at each size. Viewport screenshots are included. This is not an assertion that every page in the site is responsive or every touch interaction has passed.

## Not performed / release gates

- Current production HTTP 500 reproduction and live server log review; filesystem ownership, Apache rule enforcement, production PHP 8.3 and hosting-specific settings.
- Real SSLCOMMERZ sandbox/live session, real payment, callback delivery from provider infrastructure, bank/refund/settlement reconciliation or real gateway TLS/network behavior. Simulated replies do not validate the provider's current contract.
- Full online end-to-end browser checkout, courier booking/webhooks, SMS/email notifications, paid AI generation or external supplier import.
- Full customer/admin regression across product editing, uploads, categories, wishlist/account persistence, returns, analytics, SEO, all supported devices and slow networks.
- Automated reservation expiry, broad login abuse testing, penetration testing of the legacy applications or recovery from an ambiguous production COMMIT/network failure.
- Comparison with approved reference designs, because no reference images/designs were supplied.

## Known limitations

- Reservations are not automatically released by this patch. Uncertain/late online payments remain for manual reconciliation. Unknown risk responses conservatively require review.
- Historical malformed workflow values are not rewritten; the supplied historical orders had placed/delivered fulfillment values. If live data differs, inspect it before deployment.
- Older payment attempts do not snapshot their own amount in the supplied schema; changed-order late payments may require manual reconciliation.
- A gateway session is an external operation. Cancellation after the local retry transaction commits can still race with provider initiation; late callbacks are kept from consuming released stock, but provider reconciliation remains required.
- Optional item/parcel/event failures degrade read-only pages rather than prove the missing data exists. Review server-side support references when details are unavailable.
- A patch rollback reintroduces the old bugs. Restoring old files must never erase newer orders or reset stock/database data.

Detailed assertion names and results are in test-results.json. Screenshot measurements are in screenshots/responsive-results.json.