# R6 activation-from-page validation

## Executed suites

| Suite | Passed |
|---|---:|
| Repair/root/host/activation tests | 199 Python tests |
| Owned runtime root integration | 20 Python tests |
| Receipt publisher/evidence validation | 39 Python tests |
| Private environment loader | 31 Python tests |
| **Python total** | **289 tests** |
| Status client | 78 synthetic JavaScript assertions |
| Diagnostic client | 8 synthetic JavaScript assertions |
| Activation client | 10 synthetic JavaScript assertions |
| Diagnostic PHP functions | 20 assertions |
| CSRF/access-error PHP functions | 26 assertions |
| Activation PHP functions | 20 assertions |

Thirty new Python tests cover activation preflight, redaction, safe paths,
private state, symlink/hardlink rejection, environment selection, non-resurrection
of success after an interrupted job, duplicate-job exclusion, detached job
completion, and native PHP/HTTPS authorization boundaries.

Eleven of these new tests execute the packaged page/backend under real local
Apache/mod_php with HTTPS. They cover locked/unauthenticated access, visible
write-action consent, foreign-origin rejection, rejected arbitrary command
fields, real backend preflight, a real detached start and saved result,
owner-only state, and integration into the normal diagnostic export. The
fixture deliberately has no private production environment. The backend must
stop with `private_environment_missing_or_ambiguous` before changing `.htaccess`,
contacting public APIs or installing any scheduler entry. No host success is
inferred from that blocked-fixture result.

The successful job lifecycle is tested with a simulated installer. The existing
installer's preserved tests exercise exact-write rollback, public permissions,
root selection, cron handling, and restart/readback behavior. The combined
suite includes 30 native Apache/PHP HTTPS tests (19 retained + 11 new) and seven
native local Apache boundary/permission checks. These are not LiteSpeed or
Passenger execution tests.

## Browser limitation

A real Chromium navigation attempt to the loopback HTTPS fixture was blocked by
the browser environment with `ERR_BLOCKED_BY_ADMINISTRATOR`, before the page
loaded. It was not bypassed. No successful full browser-navigation test or
screenshot is claimed. The generated scripts passed syntax and synthetic DOM
contract checks; HTTPS form tests supplied their request headers explicitly.

## What is not established

No activation was run on concresca.com's production account. Native LiteSpeed,
Passenger, production MySQL, effective vhost configuration, account cron execution
and all 22 production workflow outcomes remain to be observed on that host.
The archive does not contain a passing receipt or bypass any acceptance gate.

Archive extraction, whole-release hashes, byte equality of installer payloads,
source compilation and PHP syntax checks are recorded in the accompanying
external validation file. Passing these checks does not certify loaded code,
source provenance, host activation or autonomous readiness.