# Consolidated verification — 10 November 2026

This package continues the exact uploaded ZIP; it is not a restart. **163 original files are retained, 63 unchanged and 100 modified. No original file was removed.** Source hashes and file names are in SOURCE-PRESERVATION.json.

This is **not a verified 142/142 production release**. The audit has {'IMPLEMENTED BUT UNVERIFIED': 47, 'PARTIAL': 12, 'IMPLEMENTED AND TESTED': 81, 'MISSING': 2}.

## Actual environment and results

CodeIgniter App Starter/framework **4.7.6**, PHP **8.4.27**, MariaDB **11.8.6** via MySQLi, Python 3 standard-library HTTP clients. All data used was disposable acceptance-fixture data.

| Suite | Passing assertions | Scope |
|---|---:|---|
| http-results | 89/89 | Real HTTP requests or CI4/database service calls; inspect JSON evidence for names |
| admin-customer-results | 75/75 | Real HTTP requests or CI4/database service calls; inspect JSON evidence for names |
| warehouse-results | 42/42 | Real HTTP requests or CI4/database service calls; inspect JSON evidence for names |
| media-results | 8/8 | Real HTTP requests or CI4/database service calls; inspect JSON evidence for names |
| service-results | 23/23 | Real HTTP requests or CI4/database service calls; inspect JSON evidence for names |

- **24 migrations** executed on a newly selected disposable database, rolled back to batch 0, and reinstalled successfully. This tests an empty install and schema rollback; it does not certify arbitrary dirty legacy databases.
- **175 PHP files** syntax checked successfully. Every standalone application JavaScript file passed `node --check`.
- All existing standalone unit/structural tests and the added HTML sanitizer tests pass. Structural route audit resolves **140 registered controller actions**; it is not 138 functional tests.
- The service suite starts two independent CLI workers to reserve one last unit. Exactly one wins; available inventory remains zero.
- Composer's runtime-only audit of the tested framework installation reported no known advisories at execution time. This does not certify application security or every future dependency version.
- Chromium was attempted but could not create its UNIX process socket in the execution sandbox. **No browser E2E, screenshot, responsive visual or pixel-exact pass is claimed.**
- Oracle MySQL, production hosting, real merchant/courier APIs, bank payments and live delivery were not tested.

## The 14 critical areas

| Area | Evidence and remaining limit |
|---|---|
| 1 COD checkout | Guest and signed-in orders, private tracking, discounts, cancellation and duplicate guards pass over HTTP/MariaDB. |
| 2 Variant stock | Variant checkout, receiving, QC buckets and stock/bucket equality pass; concurrent last-unit reservation passes. |
| 3 Creator pricing | Cart/checkout overrides, global/creator band fallback and discounted order totals pass. |
| 4 Commissions | Unit math, settlement gate, return window, release, reversal and duplicate reversal assertions pass. Both commission-release CLI names use the same service. |
| 5 Manual payout/finance | Approved/paid state changes, required manual references, balance checks, ledger uniqueness and duplicate processing pass. Actual bank transfer is outside this application. |
| 6 Returns/refunds/RTO | Whole-order restock, damaged RTO, refund recording and duplicate rejection pass. Partial-item exchanges are not supplied. |
| 7 Dispatch/settlement | Pick/QC-gated packing, tracking, dispatch, delivery/failure/RTO and one-time manual settlement pass. No real courier booking tested. |
| 8 Visual builder | Controlled rich CMS, typed sections, appearance controls, templates and isolated custom blocks exist; unrestricted full-site DOM editing and browser acceptance remain incomplete/unverified. |
| 9 Locked visuals | Palette/structural elements retained or completed; original exact photography/layout and pixel matching are not proven. |
| 10 Staff/authentication | Fresh active-role checks, grant/revoke examples, anonymous denial, granular module denial and explicit index.php-path protection pass. |
| 11 Security | Focused remediation and targeted payload/upload/permission/idempotency tests pass. Independent complete security audit remains outstanding. |
| 12 Database | 24 migration install/rollback/reinstall and FK rejection pass on MariaDB. Oracle MySQL remains unverified. |
| 13 Automated testing | HTTP, service, concurrency, upload, math, encryption, syntax and structural suites pass. Browser suite could not launch. |
| 14 Deployment | Production example configuration, webroot restrictions, instructions and doctor command included. No hosting deployment performed. |

## Material gaps and external dependencies

The numbered audit is authoritative. Exact design reproduction and unrestricted complete visual editing remain partial. Provider contracts/configuration exist, but **provider-specific network adapters are not implemented or verified**; credentials alone will not turn them on. Owner-authored contact/policy content and photographs are needed. Oracle MySQL and real hosting still require acceptance testing. Do not treat these as already completed simply because the consolidated ZIP is available.

## Browser installer addition

The consolidated package now also includes a first-install browser wizard. All 14 installer HTTP checks pass, plus an existing-store refusal check (HTTP 409). The previously tested core HTTP suite was rerun after the installer/configuration change: 89/89 checks pass. No Terminal/SSH commands are executed by this wizard. See BROWSER-INSTALLER.md and START-HERE.txt. The framework/vendor files, HTTPS/public webroot and cPanel database/user are still required; this is not a framework downloader.

## Central URL handling correction

Root + explicit index.php, nested folder + explicit index.php, and nested folder + clean routing were tested locally: 66/66 HTTP assertions pass. Client-side URL construction: 20/20 assertions pass. Deployment needs its actual public app.baseURL; explicit index.php avoids rewrite dependence. No production host was accessed. See PERMANENT-URL-SETUP.md.