# QA & Test Report — YYYY-MM-DD

Run at a **build milestone** (per CLAUDE.md §9). Be honest about what was and was **not** done —
never imply coverage that wasn't run. Copy this file to `test-report-<date>.md` and fill it in.

## Method & coverage by test type
| Type | Done? | How | Result |
|---|---|---|---|
| Static (L0) | | linter + type-checker | |
| Unit + property (L1) | | | |
| Integration (L2) | | disposable DB | |
| Browser regression (L3) | | Playwright/Cypress | |
| Security — deps/secrets (L4b) | | audit + secret scan | |
| Security — penetration | | manual probes: unauth read/write, auth bypass, IDOR, injection, CORS | |
| Load | | to expected peak *and* to failure, prod-like config | |
| Scenario / data-flow | | enter → propagate → reset → verify fresh | |
| Responsive | | phone/tablet/desktop widths | |
| Accessibility (WCAG AA) | | axe / keyboard / contrast / ARIA | |
| UX heuristic + task-flow | | Nielsen pass; top journeys | |
| UI / visual regression | | pixel-diff baseline | |
| Cross-browser | | Chromium + Firefox + WebKit | |

## Findings
> One block per finding. `SEVERITY-n — title · FIXED/OPEN`, the probe/inputs that showed it, and the fix.

## Production-readiness assessment
**Verdict:** <!-- READY / NOT READY for <exposure level>, and why. -->

| Criterion | Status ✅/⚠️/❌ |
|---|---|
| Correctness (invariants, tests) | |
| AuthN/AuthZ enforced (tested against a real exposed config) | |
| Login hardening (rate-limit, lockout, session policy) | |
| Transport security (HTTPS, HttpOnly cookies) | |
| Secrets management | |
| Backups + tested restore | |
| Data-migration integrity | |
| Accessibility | |
| Cross-browser | |
| Load headroom | |
| Observability (logs/metrics/health) | |
| Real penetration test | |

**Blockers before deploy:** <!-- ordered list -->