# Verification report

Tested on 26 September 2026 using PHP 8.3.6 and MariaDB 10.11.14 in a disposable local database.

## Passed

- **94 HTTP/database integration assertions**, using real application requests, sessions, SQL writes, and responses.
- PHP syntax validation for every delivered PHP source file.
- Installation creates the schema and optional sample data; repeat installation is locked.
- All management module list, create, and detail screens return successful responses.
- Dashboard, reports, settings, roles, and account screens render their server responses.
- Create, edit, and delete a contact; stored HTML is escaped and exported CSV formulas are neutralized.
- CSRF-forged writes are rejected.
- Duplicate active unit agreements and invalid agreement dates are rejected.
- Occupied units cannot be taken out of service while an active agreement exists.
- Negative amounts and rent overpayments are rejected.
- Partial payment changes the remaining rent balance.
- Voiding a payment restores that balance; an invoice with posted payments cannot be voided.
- Posted financial entries cannot be edited; a voided invoice can be replaced for the same month.
- Duplicate issued invoices for one agreement/month are rejected.
- Tenant accounts cannot access other tenants' agreements, invoices, user administration, or the company financial report.
- Tenant maintenance submissions are limited to their own active units.
- Maintainers see only their assignments and can change permitted status values; injected cost/unit edits are ignored.
- Support ticket creation and management replies work.
- Custom view-only staff roles reject unauthorized writes and settings access.
- The administrator cannot disable their own account.
- Public inquiries persist and appear in management.
- Payment instructions appear in tenant invoices.
- Invoice search matches tenant names.
- Password reset invalidates an existing login session.
- Unknown routes return 404; sign-out requires POST.

## Verification limits

- **Browser visual QA was blocked by the execution environment's browser process/socket restriction.** Desktop/mobile styling is implemented, but no browser-verified screenshots are included. Check the pages at desktop and phone widths after installation.
- MySQL 8 compatibility is targeted by the schema; runtime checks used MariaDB rather than a separate MySQL 8 instance.
- The suite is functional validation, not a security audit, concurrency/load test, or accessibility certification.
- Real payment providers, email delivery, SMS, signatures, and live hosting are not connected.
- Property photo validation and storage are implemented; the automated suite does not cover file uploads or hosting-specific directory permissions.
- Apache/Nginx hosting rules and production TLS must be checked on your server.

Run `tests/integration.py` only against an empty disposable database. It deliberately creates and modifies fictional records. Never run it on live company data.