PASS: safe_hex normalizes valid colors
PASS: safe_hex rejects invalid colors
PASS: URLs without a scheme normalize to HTTPS
PASS: Non-HTTP URL schemes are rejected
PASS: Human-readable custom slugs are normalized
PASS: Too-short custom slugs are rejected
PASS: Public slug validation accepts human-readable slugs
PASS: UTM parameters append to existing destination queries
PASS: vCard commas and semicolons are escaped
PASS: vCard organization characters are escaped
PASS: QR pattern persists from POST
PASS: QR eyes persist from POST
PASS: QR frame persists from POST
PASS: Expanded contact template persists from POST
PASS: Font family persists from POST
PASS: Expanded Step 3 styles persist from POST
PASS: QR gradient settings persist from POST
PASS: Advanced frame settings persist from POST
PASS: Logo scale persists and is normalized
PASS: Invalid QR pattern falls back safely
PASS: Invalid QR eye falls back safely
PASS: Invalid QR frame falls back safely
PASS: Invalid template falls back safely
PASS: Invalid font falls back safely
PASS: There is one authoritative template field
PASS: Step 1 renders UI-only template radios from one loop
PASS: Step 1 includes the expanded template set
PASS: Edit mode initializes Step 1 from the saved template
PASS: Live QR preview sends the complete builder state
PASS: Preview and save paths share the production QR renderer
PASS: Create and edit controllers delegate writes to QrCodeService
PASS: Dashboard and analytics controllers use repository/service layers
PASS: Controllers no longer embed direct database queries
PASS: Uploaded images are re-encoded and thumbnails are generated
PASS: Phase 2 migration creates audit, rate-limit, and rollup tables
PASS: Rate limiter has a safe fallback before migrations are applied
PASS: Account rate limits protect preview and save endpoints
PASS: Scan retention job rolls older raw events into daily summaries
PASS: Analytics repository combines raw scans and rollups
PASS: Dashboard scan counts include retained rollups
PASS: Public profiles use generated thumbnails when available
PASS: Database credentials are not hard-coded
PASS: Dashboard deletion is not performed by GET
PASS: Landing page does not depend on a third-party QR image service
PASS: Profile placeholders do not leak contact names to an avatar service
PASS: Live preview markup contains no leaked CSS-variable text
PASS: Step 3 includes expanded pattern, eye, and frame libraries
PASS: Step 3 includes expanded ready-made QR templates
PASS: Production QR renderer supports gradients, expanded frames, and logo sizing
PASS: Phone preview scrollbar is removed and motion polish is included
PASS: Builder exposes the expanded QR solution selector and solution-specific fields
PASS: QR solution module supports hosted, direct, and static payload types
PASS: QR service persists solution assets and renders static solution payloads
PASS: PHPUnit MySQL integration tests are included
PASS: Playwright builder-state regression test is included
PASS: Versioned migration runner is included
PASS: User audit history UI is included
PASS: Phase 3 migration creates brand, folder, and slug-alias storage
PASS: Phase 3 migration adds dynamic access and UTM controls
PASS: Builder exposes custom slugs and campaign folders
PASS: Builder exposes password, expiration, and UTM controls
PASS: Builder can apply and save reusable brand designs
PASS: QR clone workflow is implemented
PASS: PNG, SVG, PDF, and EPS export routes are implemented
PASS: CSV bulk generation with ZIP output is implemented
PASS: Dynamic QR password and expiration enforcement is implemented
PASS: Slug renames retain backwards-compatible aliases
PASS: Richer analytics capture unique visitors, browsers, OS, referrers, and CSV export
PASS: Design-library and folder management UIs are included
PASS: Reusable Windows updater continues to apply future migrations
PASS: Phase 4 migration creates API, webhook, queue, and custom-domain storage
PASS: Webhook queue payloads avoid plaintext signing secrets
PASS: Phase 4 migration tolerates partially applied additive columns
PASS: REST API rejects malformed optional destination URLs
PASS: Phase 4 migration adds smart-routing and pause controls
PASS: Builder exposes smart device routing and pause controls
PASS: Public QR resolver queues scan webhooks and applies device routing
PASS: Scoped REST API keys and API authentication are implemented
PASS: Webhook setup validates endpoints and deliveries are HMAC signed
PASS: Webhook delivery includes SSRF hardening and disables redirects
PASS: DB-backed asynchronous queue worker is included
PASS: DNS-verified custom domain workflow is included
PASS: Production readiness, backup, worker, and daily maintenance commands are included
PASS: Updater creates a pre-migration backup by default
PASS: Production checklist and Apache deployment examples are included
PASS: Task Scheduler helper separates frequent worker and daily maintenance jobs
PASS: Step 3 pattern and eye selectors use local visual assets
PASS: Step 3 frames and presets include local preview artwork
PASS: Builder renders asset-backed Step 3 selector thumbnails
PASS: Phone preview uses premium device chrome with a non-scrollable screen
PASS: Builder includes interactive gloss and motion polish

All 91 checks passed.
