# Series 002 — Test and Delivery Report

Date: 2026-11-06 (Asia/Kuala_Lumpur)
Version: 1.0.0-dev.002

## Developed

Independent core: configuration, setup authorization/locking, first schema, admin login/logout, idle session expiry, CSRF, output escaping, login rate limiting, health checks, responsive dashboard, light/dark theme control and CLI cleanup with job records. Counter animations use requestAnimationFrame, easing, a 1.35-second duration, IntersectionObserver, final-value formatting, revision tracking and reduced-motion support. A demonstration line chart has progressive entrance reveal.

## Files and database changes

Source is grouped under app/, config/, database/migrations/, public/assets/, cron/, docs/ and tests/. README.md, VERSION, CHANGELOG.md, package.json and .gitignore provide delivery metadata. The release includes a SHA-256 file manifest.

Migration 001_core creates five InnoDB tables: schema_migrations, users, settings, login_limits and cron_runs. Only the isolated test database was created and populated. No production database or existing website was accessed or changed. Activity tables are not introduced until Series 003.

## Actual verification

- PHP 8.2.26: all six PHP source/test files passed syntax checking.
- Four PHP core checks passed: HTML escaping, CSRF token stability, MySQL-only DSN enforcement and password hash verification.
- Six Node animation tests passed: exact formatting, viewport start and no scroll restart, data revisions, reduced motion, off-screen/teardown cancellation and unavailable/error behavior.
- Sixteen isolated MariaDB 11.5.2 plus PHP HTTP checks passed. Covered fresh install, bad setup secret, CSRF rejection, migration/admin creation exactly once, installer lock, unauthenticated health denial, login/session rotation, demo/unavailable separation, security headers, authenticated health, logout/CSRF, login throttling, successful CLI maintenance and sanitized database-outage response.
- Chrome headless static-preview checks passed at 1440px desktop and 390px mobile widths. Verified no document horizontal overflow and no corrupted UTF-8 text; rendered screenshots were visually inspected.

Initial integration testing exposed PHP session initialization replacing the explicit cache policy; session cache-limiter behavior was corrected and all sixteen checks passed on a fresh isolated run. Preview inspection caught corrupted punctuation; source/preview text was normalized and browser encoding checks passed afterward.

The local PHP and MariaDB runtimes were discovered under C:/wamp64 after PATH checks had initially found neither. Database initialization and all HTTP tests used separate temporary files/ports under storage/qa-*. Both test server processes were stopped after testing. Private QA artifacts and browser profiles are excluded from the release archive.

## Reproducing checks

```text
node --test tests/animation.test.js
php tests/core.test.php
php -l public/index.php
python tests/integration.py
node tests/visual.mjs
```

Integration harness defaults to the locally discovered Windows runtimes; MESRA_TEST_PHP and MESRA_TEST_MARIADB override those paths. It initializes a new local test database and starts temporary loopback servers. Python, Node and Chrome are development-test tools, not production dependencies. Visual testing requires a captured docs/preview/index.html and local Chrome at the path in visual.mjs.

## Limits and manual configuration

Configure the dedicated database, canonical URL, timezone, site name and random setup secret in private config/local.php before installing. Configure HTTPS, permissions, log rotation and cPanel cron on the actual host. Clear setup_secret after successful installation. Hosting-provider installation and shared-hosting resource limits remain untested.

The installer currently takes deployment configuration from the private configuration file rather than collecting database secrets through the browser. Full profile/retention settings screens are pending. Provider credentials are not configured; no live provider integration is claimed. Full bar/pie/doughnut/area animations, refreshed-chart transitions, date-filtered real data and mobile performance profiling remain pending with their modules. Browser screenshots cover static layout only; they do not establish live chart or theme behavior.

Security regression tests cover the listed core cases, not a completed security audit. Backup/restore, migration portability, production upgrades and final acceptance remain later-series work. Do not deploy this development foundation as a completed production analytics product.