# Complete-root release validation — 2026-09-27 r4

## Executed against the consolidated application tree

| Suite | Result |
| --- | --- |
| Repair, unattended-verifier, installer and full-root regressions | 150 Python tests passed |
| Actual root-application/owned-runtime integration | 20 Python tests passed |
| Receipt publisher and evidence validation | 39 Python tests passed |
| Protected private-environment handling | 31 Python tests passed |
| **Python regression total** | **240 passed** |
| Synthetic browser-status contract | 78 assertions passed |
| Local PHP locked-diagnostic functions | 19 assertions passed |
| Python syntax compilation | 604 files passed |
| PHP syntax lint | 393 files passed |

Seven native local Apache checks are included within the Python regression count. They exercise public-file access, protection of private routes, generated hosting rules, document-root readback and permissions. No Passenger module was installed in that Apache test server.

## Full-root-specific checks

The new cases verify that the explicit root marker prevents a stale `public/` directory from becoming the active public root; legacy marker-free layout selection still behaves as before; invalid/symlinked layout markers fail closed; every required public documentation file exists; all 22 mandatory workflow gates remain present; and every internal activation payload equals the already-installed root copy.

The complete-file preflight rejects missing files, wrong hashes, duplicate manifest paths, traversal, symlinks, private state in the release manifest and unexpected leftover runtime source. It preserves the actual host `.htaccess` and mutable runtime state. The archive does not contain the static status placeholder or stored acceptance receipts.

An initial assembly test detected an omitted public verification-marker file from the original site. It was restored, and all root integration tests passed on the corrected tree. No failing test was disabled to make the release pass.

## Local WSGI smoke test

Using the actual packaged WSGI entry point without a production private environment:

| Route | Result |
| --- | --- |
| `/api/concresca/readiness` | HTTP 200, actual `concresca-root-network` JSON; `productionReady: false` |
| `/status/current.json` | HTTP 200, actual `concresca-root-network` JSON; `productionReady: false` |
| `/autonomyz` | HTTP 503, as required when unverified |
| `/concresca-repair/activate.py` | HTTP 404; source not exposed |
| `/concresca-release.json` | HTTP 200, static release ID; no readiness claim |

This establishes that the consolidated application implements the routes and does not fake passing readiness. It does not establish that the live hosting dispatcher forwards requests into this application.

## Locked diagnostics

Local PHP assertions cover server-generated code format, code storage outside the document root, owner-only permissions, code retention, session expiration, wrong-code rejection, origin checks, refusal to trust a client-controlled HTTPS-forwarding header, fixed probe/step lists, placeholder interpretation, full-root revision recognition and exclusion of code/absolute host paths from the projected report.

These are PHP function tests, not a new production authentication test or a live server deployment.

## Limits

Workflow tests use real application handlers with an isolated SQLite adapter. They are not native MySQL/MariaDB persistence, InnoDB concurrency or restart evidence. Scheduler changes, Passenger process changes and parts of installation recovery are simulated in the installer/workflow tests. Browser tests run synthetic JavaScript fixtures, not a live production browser session.

No production deployment or production mutation occurred in this session. Native production PHP, Passenger, LiteSpeed, private environment, cron execution and complete autonomous acceptance remain to be observed on the actual host. A file-integrity pass and a passing test suite are not a passing production receipt.

The final archive is additionally extracted and its checks rerun before delivery; the accompanying external validation record records those archive checks and the final ZIP digest without embedding a self-referential ZIP digest in the package.