# Verification

This report describes validation of the delivered Housa Studio application on 20 October 2026.

## Automated checks

| Suite | Result | Coverage |
| --- | --- | --- |
| `php tests/backend.php` | 113 passed | Database initialization, setup, authentication, authorization, content validation, page management, version conflicts, backup/restore behavior, and account safeguards. Uses an isolated temporary database. |
| `php tests/renderer.php` | 98 passed | Existing property collection tab filters, filtering before limits, public rendering, and escaped footer tagline content. Uses an isolated temporary database. |
| `php tests/design.php` | 124 passed | Appearance schema and nested validation, responsive values, authorization, preview services, draft/published design data, media references, and backup/restore compatibility. Uses an isolated temporary database. |
| `php tests/appearance-renderer.php` | 269 passed | All 30 layouts and 158 original section identities; independent region/section styles; responsive inheritance and template resets; backgrounds and media; section/spacer ordering and visibility; logo fallback; RTL; generated record details; matching public/preview CSS; and previews that perform no database writes. Uses isolated temporary storage. |
| `CMS_TEST_URL=http://127.0.0.1:4173 python3 tests/integration.py` | 116 passed, 0 failures, 0 skips | Real HTTP requests for setup/login, CSRF, settings, property CRUD, draft isolation, publication, version conflicts, uploads, roles, inquiries, private-path protection, authenticated Appearance endpoints, design persistence, and backup/restore with styles. Run against a fresh disposable development installation. |

**720 automated checks passed across the five suites:** 113 backend + 98 existing renderer + 124 design services + 269 Appearance renderer + 116 real HTTP checks. The HTTP suite reported **0 failures and 0 skips**. The development environment used PHP 8.3 with SQLite and the required extensions.

Additional rendering inspection covered all 23 public template pages and the 12 seeded property/article detail routes. Checks included unresolved template placeholders, local asset paths, section hiding/reordering, unpublished-record isolation, footer branding, and RTL output. The source import contains 30 layouts in total; seven original account/dashboard examples are protected reference templates.

JavaScript syntax was checked for both the administration app and website integration script. PHP syntax and the development shell command were checked. Imported property prices were compared directly with the supplied HTML; repeated source examples are deduplicated using the first occurrence.

## Interface review

Browser inspection covered the sign-in screen, dashboard overview, page list and content editor, appearance controls, property editor, image picker selection, and desktop/mobile website preview. The review found and corrected narrow text fields and counters that remained at zero in the responsive preview.

The updated Appearance studio was also reviewed in the browser for live per-section color changes, independent header/footer styling, distinct base/mobile values, section order changes, and style copy/paste. Pointer dragging the hero section `s01` below `s02` produced the order `s02, s01, s03` in both the section navigator and the actual preview iframe DOM. The designer preview was inspected after the move to confirm header clearance and the hero's adjusted spacing.

Administration screens were reviewed in an **internal, read-only synthetic UI harness**. The harness supplied a synthetic signed-in state; it did not authenticate with the server or permit persistent writes. **Actual authentication, permissions, and persistent save/publish/restore behavior were verified by the real HTTP suite.** The browser review is not a fully automated authenticated test of every dashboard workflow.

The synthetic harness, temporary development runtime, test database, setup key, sessions, and test uploads are excluded from the delivered project. A fresh installation starts with starter website content and no administrator credentials.

## Practical limits

- Production hosting, domain routing, TLS, file ownership, and host-specific PHP settings still require installation verification on the chosen host.
- Email and SMS notification delivery are not configured; inquiries are stored in the dashboard.
- The JSON backup restores website content. It does not include uploaded image bytes, user accounts, or inquiry records.
- The original template's vendor scripts and external resources remain subject to their own availability and browser behavior.
- Shared collection bindings and page-specific promotional layouts are distinct, as described in the README. Test coverage does not imply arbitrary visual layout generation or a public customer account/payment system.

Run the test scripts only against development data. The HTTP suite can create a test administrator on a fresh installation; never copy that test database to production.


## v1.6 media-slot validation

The Image/Video Media Slot update was syntax-checked across all PHP files and the three changed JavaScript runtimes (`cms-public.js`, `admin.js`, `appearance.js`). The media mapping regression test confirms **551 image fields and 14 background-image fields** remain annotated after the video extension. Additional assertions cover video media type/source/poster/playback-option validation and responsive Image ↔ Video overrides.

The current packaging environment exposes PDO but not PDO SQLite, so the full database-backed integration suites were not rerun for v1.6 in this environment. The previous v1.5 baseline remains documented above; v1.6 validation here focuses on the changed media layer, renderer annotations, static syntax, and backward-compatible field mapping.