CARE4U SELF-HOSTED EDITION — VALIDATION 8 OCTOBER 2026

Completed locally with Node.js 24.19.0:
- TypeScript check of the frontend: passed.
- Vite production frontend build: passed.
- Backend integration tests: 8 groups passed, 0 failed.
  * Setup locked after first administrator; wrong setup key rejected.
  * Anonymous records/files blocked; write Origin and CSRF guards enforced.
  * Application source, private register and database paths not publicly served.
  * Original register imported: 145 workers, 166 CoS history rows.
  * Re-import into nonempty database rejected.
  * Staff accounts use individual passwords; first-change requirement enforced.
  * Viewer write/upload/import rejected; editor admin operations rejected.
  * Worker save/readback, stale edit conflict, invalid date and SMS evidence validation.
  * Upload type/signature validation, private download, evidence review and audit.
  * Disabled accounts and expired sessions rejected.
  * Worker/action/evidence/audit/JSON exports generated.
  * Full backup and restoration preserve document bytes and all 145 workers.
  * Restoring invalidates sessions; login attempt throttling persists in SQLite.
- Public bundle scan: no source-worker names, passport values or CoS values.

Not completed:
- Browser end-to-end and visual testing. The Playwright browser executable was
  unavailable and the attempted browser download did not produce a usable file.
  tests/browser.cjs is supplied for a developer to run after installing Playwright
  and Chromium; it is not part of the default npm test command and has not passed.
- Care4U's real hosting, TLS, cPanel/Passenger setup or domain/DNS.
- Independent security review, load testing or real-user acceptance testing.

Before production use, complete the installation/hosting acceptance checks in
INSTALL.html, including role restrictions in a real browser, persistence after
restart and a restore to a separate private data directory. Keep test data out
of the production register. The current hosted Care4U Site was not changed.
