# Feature-to-acceptance checklist

Verified locally on 16 October 2026. “Pass” means the stated checks ran in this environment, not that deployment/legal/external services are approved.

| Behavior | Evidence | Status |
|---|---|---|
| Installation/startup/build without project Git | Distribution scaffolding, no scripts/plugins during initial download; dependency install/build/startup; `.git` absent | Pass; no Git initialization/configuration/commits |
| Editorial public site, mobile menu, synthetic journey, guides/resources | 22 public-route cases, browser sample click/keyboard and menu tests, licensed local assets | Pass |
| Fortify signup, verification, reset, confirmation, MFA and recovery | AuthTest; adult/Terms/passphrase checks; known-compromised rejection and screening-outage test | Pass locally; real SMTP delivery pending |
| Private dashboard/onboarding/tasks/checklist, Undo and accurate completion | ProductTest; 390/768/1440 browser persistence/Undo and empty-state captures | Pass |
| SFI no-date invariant, no identity fields/uploads | Nested/alternate payload rejection, model guard, reminder/calendar/export checks, denied/missing upload endpoints | Pass |
| Private resource policies and narrow collaboration | Owner/cross-user billing/task checks, selected-task permissions, email-bound/single-use/expired invitation tests, revocation | Pass |
| Premium one-time term, expiry, reminder/export sharing gates | BillingTest/ProductTest; activation timing, calendar-month arithmetic, expiry/revocation, Free-data preservation | Pass with simulated processor responses |
| Signed webhook, canonical fulfillment, duplicates/order, price tampering | BillingTest and MySQL multi-process duplicate-checkout/fulfillment checks | Pass locally; actual Stripe sandbox exercise pending credentials |
| Ordinary/late/public purchase withdrawal and truthful refund states | Calendar-edge policy cases; signed logged-out mailbox confirmation preserves receipt time; full/partial/pending/failed/dispute/outage/late-success tests | Pass locally; real bank/processor delivery unverified |
| Settings correction, free export, erasure, sessions and financial separation | AuthTest/ProductTest; cascade/session checks; deletion ledger and restore command | Pass locally; provider deletion and restore rehearsal pending infrastructure |
| Admin MFA, minimal support, source/guide review and versioned templates | EdgeCaseTest/ProductTest; draft-on-edit, HTTPS source allowlist, progress preservation | Pass |
| Public metadata/sitemap, no tracking, private/error noindex/no-store | ProductTest/EdgeCaseTest; truthful WebSite JSON-LD; scripted source credential-pattern scan | Pass |
| Accessibility and responsive visual review | 15 browser flow checks, 11 real screenshots; six landing/dashboard axe scans at three widths, zero reported violations | Pass for tested scope; not a full WCAG conformance audit |
| Production selling/privacy/deployment approval | `swedenstart:launch-check`, owner details and legal/tax/provider gates | Intentionally blocked; not deployed |

See `implementation-status.md` for exact commands, versions and measured results. No real payment/refund, production deployment, provider restore, jurisdiction-wide legal approval or security certification is claimed.