# Test results

Run date: 2026-10-12. Build environment: Node v22.22.2, Python 3.12 + OpenCV, **no PHP interpreter, no MySQL, no network**.
Re-run the static part any time with `sh tests/run-static.sh`.

## Executed here and PASSING

```
== JS unit tests
# tests 12
# pass 12
# fail 0
== JS static checks
icons referenced: 37
static checks passed
== JS import/export check
19 modules checked, 0 problem(s)
== QR decode (OpenCV)
decoded OK: 18  failed: 0  (of 18)
decoded OK: 420  failed: 0  (of 420)
== PHP static lint

checked 99 PHP files, 83 classes: 0 error(s), 1 warning(s)
== SQL placeholder check
sql calls checked: 120, skipped (dynamic): 29, problems: 0
== Schema consistency
21 tables, 23 baseline statements, 2 seed statements: 0 problem(s)
```

What these cover:

* **JS unit tests (12/12)**: money formatting of all five package pairs ($15 -> $100 ... $100 -> $1,000), client token normalisation identical to the server
  rules, recipient validation, countdown/ref helpers, every payment/funding/token status has an icon **and** a text label (never colour alone), QR structure
  (finder/timing patterns, determinism, too-long payload throws).
* **QR decode (438/438)**: every QR matrix produced by `qr.js` (payment URIs, TRON/ETH/BTC addresses, 1 to 210 byte payloads, levels L and M, UTF-8) was
  rasterised and decoded with two independent OpenCV decoders and compared with the input string. The QR on the payment screen therefore matches the displayed address/URI.
* **JS static checks**: all modules parse; no `innerHTML`/`eval`/web-storage; **no hard-coded colours outside `variables.css`** and the palette tokens equal the brief
  (`#192C38 #1FFF20 #FFFFFF #A7B6BF #213744 #162630 #344B57 #FFC857 #FF5C70 #6CCBFF`); nothing executable or secret in `public/` except `index.php`.
* **JS import/export check**: every `import { x }` names a real export; all paths resolve.
* **PHP static lint (99 files, 83 classes)**: brackets balance, `strict_types`, namespace/path/class-name agreement, every `use`/static call/constant resolves to a
  real definition, every `->method()` exists somewhere in the project. The checker itself was mutation-tested: planted typos, a missing brace and a wrong namespace were all caught.
  The one warning is a built-in PHP class (`FilesystemIterator`) used in a test.
* **SQL placeholder check**: 120 literal `Database::*` calls have exactly as many parameters as `?`; INSERT column/value counts match (29 dynamic ones skipped). Mutation-tested.
* **Schema consistency**: 21 tables, all InnoDB, primary keys, FK targets exist and are created first, no FLOAT/DOUBLE, every column written by an INSERT/UPDATE
  in PHP exists, seed and trigger statements reference real tables/columns.
* **Security assertions** from `tests/security/*` were dry-run in Python against the real files (route CSRF/admin coverage: 8 state-changing visitor routes, 22 admin routes;
  no dangerous functions; unique constraints; DECIMAL money; no plaintext token/credential columns; five seeded packages; CSP without `unsafe-inline`): 0 problems.
* **TOTP vectors** used by `TotpTest` (RFC 6238) and the decimal examples in `DecimalTest` were verified independently in Python.

## Written but NOT executed (needs PHP / MySQL)

| Suite | Files | What it asserts |
|---|---|---|
| `tests/unit` (no DB) | Validator, Crypto, Decimal, Totp, PaymentStateMachine, LoggerRedaction, RouterAndCsrf, GatewayInterpret, FundingFormatting, AdminPermissions, TokenFormat, Config | token/credential/address/txid rules; CSPRNG alphabet and uniqueness; HMAC purpose separation; encrypt/tamper; exact decimal rounding; confirmed never moves backward; redaction; CSRF/origin; provider status mapping (200 without "completed" is not success; 409/429/5xx unknown); required toast text; RBAC matrix |
| `tests/security` (no DB) | StaticSecurityTest, SchemaIntegrityTest | route middleware coverage, hardened cookies/CSP, no dangerous functions, no secrets in web root, unique keys that prevent double spend/credit, DECIMAL money, append-only triggers |
| `tests/integration` (needs MySQL) | PaymentFlowTest, FundingFlowTest, RecoveryAndIsolationTest | quote/unique amounts, unconfirmed never activates, exactly one token, replay/duplicate webhook safe, underpaid + top-up, tolerance, overpaid, wrong contract ignored, late payment review + on-chain-verified approval, refund; token validation, server-side amount, success only after provider confirmation, failure releases token, **timeout = uncertain then reconciled without a second send**, idempotency, parallel intents, DB refuses a second live funding per token, manual resolution rules, visitor isolation, recovery keys, rate-limit lockouts, audit sanitising and immutability |

Run them with:
```
php -l <each file>                       # syntax
php tests/run.php                        # unit + security
TEST_DB_NAME=csf_test TEST_DB_USER=root TEST_DB_PASSWORD=... php tests/run.php --suite=all
```
(`TEST_DB_NAME` must end in `_test`: its tables are truncated.) **Treat any failure there as a real finding**: these suites have not run yet.

## Not tested at all
Real browser rendering (layout, animation, screen readers), live chain providers, the real CrowdSourc API, live exchange-rate API, email/Apache/nginx configs, load/concurrency beyond the DB-level guarantees above.