# Official source review

Content reviewed on **16 October 2026**, by Codex (automated editorial review). This records a real reading of the public source pages and preparation of short original summaries. It is not immigration, medical, or legal advice, a professional legal review, or a claim of compliance. The source registry is `config/resources.php`. Each published record describes only the scope actually reviewed. A successful page retrieval does not certify every outbound link or the continuing accuracy of the page.

## Scope and editorial boundaries

| Topic | Official source and reviewed conclusion | Product consequence |
| --- | --- | --- |
| Route selection | [Migrationsverket application hub](https://www.migrationsverket.se/en/you-want-to-apply.html) and [EU/EEA/Nordic guidance](https://www.migrationsverket.se/en/you-want-to-apply/citizens-of-the-eu-eea-or-nordic-countries.html) distinguish migration routes. EU/EEA right of residence differs from a residence-permit application. | Ask for broad route only; do not mark a residence permit universally necessary. Unsupported situations link to the agency. No eligibility promises or automatic appeals guidance. |
| Population registration | [Skatteverket moving guidance](https://www.skatteverket.se/servicelankar/otherlanguages/englishengelska/individualsandemployees/movingtosweden.4.7be5268414bea064694c40c.html) generally associates population registration with a move intended to last at least a year. First registration assigns personnummer. Applicability depends on the person's circumstances. | Keep move notification/registration separate from permit approval. Only track receipt status; never collect the actual identifier. Avoid predicting processing time. |
| ID card | [Skatteverket ID-card application](https://www.skatteverket.se/servicelankar/otherlanguages/englishengelska/individualsandemployees/livinginsweden/swedishtaxagencyidentitycards/howtoapplyfororrenewidcard.4.3810a01c150939e893f1e20d.html) requires population registration, personnummer, identity proof, and a paid application fee. | A separate task can explain those requirements and link to current booking/payment instructions. SwedenStart never receives the documents or ID number. No fixed fee or processing-time promise is copied into the app. |
| Social insurance | [Försäkringskassan moving guidance](https://www.forsakringskassan.se/english/moving-to-working-studying-or-newly-arrived-in-sweden/move-to-sweden) describes its assessment of social-insurance coverage. Its general moving page excludes posted workers and people here to study. | Do not treat benefits as automatic or require the same form for everyone. Refer users to the applicable guidance. |
| Healthcare | [1177 English information](https://www.1177.se/en/other-languages/other-languages/) directs readers to their region; [care for people from another country](https://www.1177.se/en/sa-fungerar-varden/vard-om-du-kommer-fran-ett-annat-land/vard-av-personer-fran-annat-land/) distinguishes care access and costs by circumstances. Emergency care is available; costs can vary. Försäkringskassan's moving page separately explains standard patient fees for population-registered residents. | Never lock healthcare guidance behind a Försäkringskassan decision or imply care is always free. Link to regional and individual guidance instead of determining entitlement. |
| Learning Swedish | [Skolverket SFI responsibility guidance](https://www.skolverket.se/styrning-och-ansvar/regler-och-ansvar/ansvar-i-skolfragor/ratt-till-sfi) explains the municipality's role. [Stockholm](https://vuxenutbildning.stockholm/en/learn-swedish/svenska-for-invandrare-sfi/), [Gothenburg](https://goteborg.se/wps/portal/start/forskola-och-utbildning/vuxenutbildning/sok-utbildning-pa-komvux/svenska-for-invandrare-sfi/swedish-for-immigrants-sfi), and [Malmö](https://malmo.se/Komvux-Malmo/Sfi---svenska-for-invandrare.html) provide official local information. | Retain only link, title, municipality and original general summary. Do not copy study dates, schedules, course durations, application windows, study-period limits or countdowns. Do not gate links on personnummer. |
| Settlement | [Informationsverige](https://www.informationsverige.se/en/hem.html) is run by the County Administrative Boards and provides newcomer and society information. | Use as an additional official starting point, with route-specific applicability checked by the reader. |

## Link retrieval versus content review

The listed registry pages were opened and read during this review. `reviewed_at` is the editorial-review date, not a fabricated government review date. The reviewer is explicitly automated; no human or authority endorsement is implied. Store future link-check status separately from content-review metadata and do not update `reviewed_at` merely because an HTTP request succeeds.

The brief's `https://www.1177.se/en/` returned HTTP 404 in the research tool. It is not published. The working English hub was found through Försäkringskassan's official healthcare link. Gothenburg's search result redirected to the canonical municipal path recorded above. No authenticated services, agency APIs, municipal application portals or SFI schedules were scraped or imported. All municipal summaries are date-free, including no study limits. Review audit dates are metadata, not study dates, and must not become an SFI schedule.

External resource links must use an app-wide `Referrer-Policy: no-referrer`, public HTTPS destinations, and `rel="noopener noreferrer"` when opening a new tab. Never append user/profile/journey information. A future server-side checker needs an explicit host allowlist, public-address checks and redirect validation; it must not fetch arbitrary user URLs.

## Swedish withdrawal calendar research

This is implementation research for SwedenStart's proposed consumer offer. Supported territories, classification of the service, contract wording, formation event, delivery of information and business-specific rules still require professional review before selling.

[Konsumentverket's distance-contract guidance](https://www.konsumentverket.se/lagar/lagen-om-distansavtal-och-avtal-utanfor-affarslokaler-konsument/) explains that, for services, day one is the day after the agreement. Count calendar dates; if the last date is Saturday, Sunday or a public holiday, extend through the next weekday. The product implementation should retain a timezone snapshot and use the end of the qualifying Swedish calendar date, not a 336-hour elapsed-time cutoff. This timezone treatment is an implementation choice to be reviewed for other supported markets.

[The Swedish statutory-time calculation act, section 2](https://data.riksdagen.se/dokument/sfs-1930-173.html) also names Midsummer Eve, Christmas Eve and New Year's Eve as dates that move a statutory deadline to the next weekday. Both displayed versions of section 2 contain this rule; a future amendment shown in the source concerns an unrelated criminal-justice exception. [The public-holiday act](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-1989253-om-allmanna-helgdagar_sfs-1989-253/) supplies the holiday calendar: Sundays; New Year's Day, Epiphany, May Day, National Day, Christmas Day, Boxing Day; Good Friday, Easter Monday, Ascension, Midsummer Day and All Saints' Day. Test consecutive excluded dates and DST transitions.

[Distance-contract law, chapter 2 sections 10–12 and 14](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-200559-om-distansavtal-och-avtal-utanfor_sfs-2005-59/) supports these separate requirements: withdrawal information can affect when the period begins and missing information can extend rights until a year after ordinary expiry; a timely properly sent notice remains valid despite delivery problems; an online withdrawal function must remain accessible during the period and send a durable receipt with receipt time; repayment is without undue delay, normally within 14 days of notice. The online-function amendment entered into force on 19 June 2026. These observations concern nonfinancial service contracts, not the law's separate financial-services chapter.

Implementation decisions from that review:

- Store formation, withdrawal-information delivery, notice receipt, activation, payment and refund times separately. Preserve the policy/version and timezone snapshot.
- If the information-delivery timestamp is absent, mismatched or unsupported, retain the notice for review; do not reject solely on an ordinary deadline. Allow an audited extension or late-dispatch evidence without requiring the web form to be the exclusive notice channel.
- The owner's full-refund-after-use policy is more generous than a possible statutory proportional service charge. The app must deduct no usage, administrative or Stripe fees from an eligible full refund.
- Treat refund initiation and processor success as separate states. Keep an actionable financial exception if repayment is pending or failed; processor timing does not erase the notice.
- Do not extend a merchant repayment deadline in a way that delays consumers merely because the app extends consumer submission deadlines. Operationally initiate refunds promptly, using the conservative ordinary due date and monitoring exceptions.
- Other-market rules, faulty-service claims and individually extended rights remain reviewable after the ordinary window; no absolute post-window refusal.

## Review maintenance

When facts or source URLs change, review the original guide text and any affected journey templates, record the real reviewer/date, and preserve user progress. Unchecked sources stay draft with `reviewed_at = null`. The starter registry contains no waiting-time forecast, external school recommendation, SFI study schedule or purported legal approval.

## Framework, privacy and accessibility references checked by the implementation owner

Reviewed 16 October 2026:

- [Laravel 13 release requirements](https://laravel.com/framework/docs/13.x/releases): supported PHP series includes the installed PHP 8.5. [Official starter documentation](https://laravel.com/framework/docs/13.x/starter-kits) identifies the Livewire/Fortify foundation. Composer's `create-project --help` and the actual downloaded manifest/scripts were inspected before installation.
- [Tailwind with Vite](https://tailwindcss.com/docs/installation/using-vite): used the Tailwind 4 Vite plugin. The project uses Blade and small external vanilla JavaScript; it does not load a Livewire/Alpine script that would require weaker CSP allowances.
- [IMY individual rights](https://www.imy.se/en/organisations/data-protection/this-applies-accordning-to-gdpr/the-data-subjects-rights/): verified information, correction, erasure/recipients and portability distinctions. The exact case-handling deadlines require the operator to consult applicable GDPR Article 12 and current guidance; the brief's ordinary one-month period is an operational review requirement, not a claim that this overview page spells it out.
- [IMY personal-data breaches](https://www.imy.se/en/organisations/data-protection/this-applies-accordning-to-gdpr/personal-data-breaches/): risk assessment determines reportability; generally 72 hours from awareness when reportable, with a separate high-risk threshold for informing individuals. The page was updated 29 September 2026.
- [PTS cookies](https://pts.se/internet-och-telefoni/kakor-cookies/): necessary-cookie exception, clear inventory/retention information and active, equally accessible consent choices for optional cookies. Actual deployed third-party behavior still needs review.
- [WCAG 2.2](https://www.w3.org/TR/WCAG22/): keyboard/focus, names/labels, contrast, validation and responsive behavior guided implementation. Automated axe scans cover a subset of conformance requirements.
- [Official MySQL 8.4 download listing](https://dev.mysql.com/downloads/mysql/8.4.html): selected the observed macOS ARM archive, version 8.4.11, and matched Oracle's published archive checksum. The isolated runtime was used for actual migrations, feature tests and row-lock concurrency tests; it is not a production database installation.

The ordinary one-month rights-response period was additionally cross-checked against the current official European Commission search result for [Information for individuals](https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en), which states the response deadline. Direct retrieval was rate-limited (HTTP 429), so this is recorded as a search-result cross-check, not a full-page content review. The operator must apply Article 12 to the actual request and any lawful extension.