# Validation and Acceptance

This release is designed to be validated in two stages: package-level checks before upload and environment/integration checks on the cPanel VPS.

## Package-level checks completed

The source package was checked for:

- PHP syntax across every PHP file under `src`, `bin`, `public`, and `tests`
- Eighteen dependency-free smoke assertions covering encryption, privacy rendering, conflict detection, marker behavior, tentative and pending policies, duplicate suppression, and mirror blocking
- JavaScript syntax for the browser code and Google Apps Script bridge
- Valid JSON in Composer, PHPUnit, and Apps Script manifests
- Absence of a deploy-time `.env` file
- Absence of the private ICS URLs and tokens supplied during planning
- Absence of horizontal-rule markup in the documentation

## Checks that require the VPS

The build environment used to assemble this private release could not retrieve Composer packages. Consequently, dependency installation, the full PHPUnit suite, MariaDB schema execution, live HTTPS ICS retrieval, email delivery, and Google Calendar bridge writes must be exercised on the VPS.

This is expected because the release intentionally does not bundle a `vendor` directory or production credentials. Composer is available on the target VPS.

## VPS acceptance commands

Run all commands with the same EA-PHP 8.2 or 8.3 binary selected for the subdomain. The examples use PHP 8.3.

```bash
cd /home/CPANEL_USER/calendar-control-center
export PHP_BIN=/opt/cpanel/ea-php83/root/usr/bin/php

"$PHP_BIN" bin/preflight.php
"$PHP_BIN" /opt/cpanel/composer/bin/composer validate --strict
"$PHP_BIN" /opt/cpanel/composer/bin/composer install --no-dev --optimize-autoloader
"$PHP_BIN" tests/smoke.php
"$PHP_BIN" bin/console migrate
"$PHP_BIN" bin/console status
```

To run the complete development test suite before removing development packages:

```bash
"$PHP_BIN" /opt/cpanel/composer/bin/composer install
"$PHP_BIN" vendor/bin/phpunit
"$PHP_BIN" /opt/cpanel/composer/bin/composer install --no-dev --optimize-autoloader
```

If the cPanel Composer path differs, use `command -v composer` or the path documented by the hosting environment.

## Functional acceptance sequence

1. Keep application and Google bridge simulation modes enabled.
2. Add one newly rotated ICS feed and use Test Feed before saving.
3. Run a manual source synchronization and inspect the event count and synchronization report.
4. Add a second test source containing a deliberate overlap.
5. Run a conflict scan and verify that the conflict appears without exposing details beyond each source's privacy mode.
6. Send a test notification and verify delivery.
7. Create one Busy-mirror target that excludes the destination account's own source.
8. Run `testConnection()` and `previewChanges()` in Apps Script.
9. Confirm proposed Busy titles contain only the configured category/source wording.
10. Enable live bridge mode only after the simulation report is correct.
11. Create, move, cancel, and restore a disposable source event and confirm that the Busy copy follows each change.
12. Test one recurring event, one exception to a recurring series, one all-day event, one tentative event, and one awaiting-response invitation.

## Production acceptance criteria

The system is ready for continuous use when:

- AutoSSL is valid and HTTP redirects to HTTPS
- The Apache document root points only to `public`
- `.env` is mode `0600` and storage directories are writable only where required
- Cron runs with EA-PHP 8.2 or 8.3 once per minute without overlap errors
- Every source has a recent successful synchronization timestamp
- A test overlap creates one conflict and one deduplicated alert
- Morning, evening, and weekly digests arrive at their configured times
- Simulation reports contain no unexpected Busy creates, updates, or deletes
- Each live Google bridge edits only events carrying the application's private managed property
- Backups complete and can be inspected outside the web root