# Totohost release gates

Status: **staging candidate; not deployed or approved for a classroom launch**.
The existing website and the browser-only ZIP have not been replaced.

## Verified locally, 2026-10-08?09

- PHP 8.4.26 / Laravel 13.35.0 with real MySQL 8.4.11 and separate disposable databases.
- PHP account/API tests: invitation role boundaries, new and existing accounts, expiry, cancellation, single use, encrypted bounded mail queue, password reset expiry/replay, persistent throttling, revocation, owner checks, duplicate saves, stale revisions, five JavaScript-generated snapshot fixtures and object/array preservation.
- Final MySQL suite: 21 tests / 250 assertions. Thirty distinct recovery requests and invitation tokens can share a classroom IP without throttling each other; per-identity limits remain enforced. Administrator restoration settings retain version history, reject stale writes and deny students.
- Teaching transcript parity, complete assignment/submission/published feedback/revision cycle, immutable reports, private assets and unrelated student/mentor denial.
- Existing restoration/geometry/camera suite: 129 tests passed. Root and client TypeScript checks passed. Vite production bundle built.
- Original Next.js production build also passed after the shared adapter changes. Lint has no errors; warnings remain for an unrelated workbook variable and Next's image advice on the deliberate native-image Vite adapter.
- Chromium: login, real HTTP CSRF rejection, direct links, all five workshop canvases, mobile timeline width, browser-save import retaining its source. Screenshots in the development workspace under `test-results/totohost/`.
- All five desktop workshops passed keyboard measurement, lighting and fullscreen checks. Mobile touch selected two points in compact/fullscreen Dräger views and displayed their distance. Login rejects a backslash-based external callback URL.
- Thirty concurrent Laravel HTTP-kernel processes completed 30 submissions and 150 acknowledged restoration revisions, with duplicate retries. No lost acknowledged saves or unhandled errors. 870 timed requests: median 104 ms, p95 1,040 ms, maximum 1,681 ms. Save fixture 367,123 bytes. Normal worker peak 46 MiB. This measures the local application and database, not Totohost HTTP/FPM/SMTP limits.
- Ten simultaneous writes to one initial revision: exactly one success and nine 409 conflicts.
- Exactly 32 MiB restoration request, including maximally fragmented packed work: saved/read successfully; peak 264 MiB under a 512 MiB cap. A larger body was rejected with 413. Allocation-budget guards reject oversized JSON trees before decoding.
- Maximum UTF-8 request repeated after preventing Unicode escaping expansion: saved/read successfully, peak 296 MiB; over-limit request rejected with 413.
- SQL backup restored to a new MySQL database. Accounts, restoration JSON, submitted reports and private assets compared exactly. Encrypted private ZIP decrypted and compared. No production data used.
- Extracted ZIP tested with production Composer dependencies and an empty local MySQL database: preflight, install, permanent installer lock, administrator login, invitation creation, bounded cron, upgrade preserving the account/invitation and seven daily recovery points passed. Mail used a capture transport; actual SMTP delivery and Apache rules still require staging.
- A previous three-migration package was upgraded to the four-migration schema, retaining its administrator and invitation. The pre-migration backup tolerates tables introduced by the new release.
- Browser role checks passed for administrator settings, mentor catalogue/assignments/students/submissions, and a student starting a teaching attempt and viewing an authenticated private image.

## Still required on Totohost

- [ ] Confirm cPanel access, separate staging domain/database/user, web PHP 8.4 extensions, MySQL 8, packet/body/memory/runtime/CPU/process limits, disk/inode allowance.
- [ ] Upload final ZIP; verify checksum and public/private document-root arrangement, installer preflight, initial admin and permanent installer lock.
- [ ] Verify HTTPS and cookies, direct-link rewrites and public denial of configuration, logs, backups, private teaching material and installer after setup.
- [ ] Confirm actual SMTP allowance, inbox delivery, expiry/resend/cancel and recovery mail. Confirm cron execution and operational status.
- [ ] Repeat classroom workload on hosting. Require zero lost acknowledged saves, zero unhandled errors and acceptable normal-request latency (use local p95 about 1 s as a reference; agree a hosting threshold before the pilot).
- [ ] Desktop and mobile/touch/keyboard/fullscreen acceptance, offline interruption/recovery, explicit conflict choice, account-switch and existing-browser-save import.
- [ ] Confirm seven daily recovery points and Totohost's independent/off-account backups. Restore staging from a hosting-produced backup and compare records.
- [ ] Exercise package upgrade on staging while retaining .env, APP_KEY, storage, accounts and submissions. Verify previous release rollback compatibility.
- [ ] Run one mentor/two student pilot through the whole teaching and feedback cycle, then enable full-class invitations.

The browser automation connection could not initialize in this session. No cPanel configuration, DNS, mailbox, database, upload or production launch was performed. Those checks cannot be inferred from localhost tests.