# Validation report

Tested locally on 13 September 2026. The hosting account, domain/DNS and real Gemini credentials were not supplied, so this report does not claim a live deployment or a successful real-provider AI call.

## Passed

- PHP syntax checks and JavaScript syntax checks.
- 21 core checks: canonical answer IDs, four distinct options, scientific signs/decimals, required explanations, source page/line bounds, exact quote matching, explicit printed-page mapping, duplicate stems, cross-year PYQ occurrences, shuffled option IDs, hidden answer keys, scoring, idempotent submission, safe source URLs and quotas.
- 44 HTTP integration checks against disposable SQLite storage.
- The same 44 HTTP integration checks against an isolated MariaDB 10.4.32 instance using the MySQL PDO driver.
- Chrome browser: login, dashboard, local PDF.js upload and extraction, saved page text, PYQ selection, answer autosave, refresh/resume, submission/results, missing-AI configuration error, admin review dialog, mobile width at 390px, and zero uncaught JavaScript errors in the tested flow.
- Desktop and mobile screenshots visually inspected for clipping and layout errors.

The integration datasets were explicit synthetic test fixtures. They are not bundled into the application's question bank or marked as real historical questions in the deliverable.

## Not established by these tests

- Real OpenAI/Gemini generation, scan OCR, chat quality, account-specific model availability, quotas or billing. A real key/model is required for that final connection test. Missing-key behavior was tested.
- Completeness or scientific accuracy of any 1990–present PYQ corpus. No historical corpus is bundled.
- Semantic correctness of every AI answer. Citation matching alone cannot establish that.
- Layout and reading order for every Bengali book, scan, equation or multi-column PDF. The user can inspect extracted lines; unreadable pages are reported.
- Production load, the user's cPanel configuration, PHP 8.2+ on the actual host, SSL/DNS, backups, or hosting-provider timeouts.

## Re-running

Run `php tests/core-test.php` from an unpacked package for isolated core tests. It creates a disposable SQLite test database in the system temporary directory.

`tests/http-test.py` must target a dedicated empty test deployment with its own config/database. Never point it at production: it creates accounts, test PYQs and exams and changes test deadlines. See its header for invocation. MySQL testing additionally uses the guarded CLI helper `tests/expire-test.php` and explicit test environment variables.

Do not upload tests or tools into public_html. A cPanel database backup plus private/uploads and private/collections is the full-data backup; the in-app JSON export is only a question-bank export.

## Version 2 validation — 2026-09-13

- 41 isolated PHP checks passed (21 existing core + 20 collector/OpenAI checks): URL validation, robots matching, deduplication, inactive source defaults, disabled collection, request conversion and incomplete/refused response handling.
- Browser: admin collection navigation, five-source seeding, source addition, disabled collector error, 390px mobile layout, and zero uncaught JavaScript exceptions passed.
- No live OpenAI key, Telegram bot token, hosting cron, or complete historical corpus was available. Network ingestion, real extraction quality and production scheduling are not established by local tests.

- V2 HTTP: 10 checks passed for admin/student access, CSRF, POST requirements, year validation, and missing credentials. MariaDB 10.4 collector schema creation, state upsert and source deduplication passed. All PHP and application JavaScript syntax checks passed.

## Version 3 recheck
45 core/collector/provider checks and 10 collection HTTP checks passed. Full browser regression passed: PDF extraction, exam autosave/resume, submission/results, missing-key chat handling, admin review and mobile layout. Gemini credentials were not used in a live request. Grounding parser/default configuration tested locally; real Google search and OCR quality remain unverified.