# R7 validation — activation sequence and failure reports

Tests are local; they do not establish the live deployment's readiness.

## Before the change

The unmodified r6 repair suite ran: **199 Python tests passed**. Two additional
regressions then demonstrated behavior absent from that suite:

1. Under native Apache/mod_php HTTPS, an immediate activation start after a
   prerequisite check returned HTTP 429 `ACTIVATION_RATE_LIMIT` because the
   actions shared one timestamp. The fixture lacked a private production
   environment; the backend correctly reported that separate blocker.
2. In the actual packaged JavaScript with a synthetic DOM, a rejected start
   left the downloadable result equal to `preflight_passed`. The new regression
   expected the failed request and failed against r6.

Reproduction records are included as R6-ACTIVATION-REPRODUCTION.json and
R6-CLIENT-REPRODUCTION.txt. They do not identify the cause of the live 404.

## R7 suites

Executed on the release source, then repeated against the extracted final ZIP:

| Suite | Passed |
|---|---:|
| Packaged repair/root/host/activation suite | 203 Python tests |
| Owned-root integration | 20 Python tests |
| Receipt publisher | 39 Python tests |
| Private environment loader | 31 Python tests |
| **Python total** | **293** |
| PHP diagnostic, CSRF and activation functions | **75 assertions** |
| Status, diagnostic and activation JavaScript contracts | **106 assertions** |

The Python count includes 34 native Apache/PHP HTTPS tests and seven native
Apache boundary tests. Four HTTPS tests, nine PHP assertions and ten JavaScript
failure-report cases were added in r7. The external validation file records
final extracted-archive checks. No skipped tests are counted as passed.

New coverage checks independent check/start admission, repeat-request rejection
and Retry-After, rejected cross-origin requests, redaction, replaced stale
reports, network uncertainty, non-JSON errors, and saved-job refresh without
starting an extra installation. All prior authentication, CSRF, receipt,
workflow, access-boundary and rollback tests remain enabled.

## Limitations

The native HTTPS tests run Apache/mod_php on localhost. They deliberately do
not possess production environment values. An accepted start launches the real
packaged backend, which must fail preflight before routing/cron/network changes.
Successful installer transactions are tested with simulated host operations,
not actual Passenger or LiteSpeed. MySQL production access and all 22 live
workflow outcomes remain unobserved. JavaScript tests are synthetic DOM tests;
no new real-browser navigation was performed. Archive hashes identify file
bytes, not loaded-code attestation or source provenance. No production changes
or ready/verified receipt are included.