PASS: PHP syntax: install.php
PASS: PHP syntax: public/install.php
PASS: PHP syntax: installer/Setup.php
PASS: original CLI browser guard reproduces 404
PASS: root CLI installer explains document-root correction
PASS: root CLI HTTP methods guarded
PASS: root web requests do not write setup files
PASS: subdirectory URL has cPanel guidance and no install form
PASS: CLI activation remains available
PASS: HTTP shows HTTPS guidance and does not collect installation credentials
PASS: ready HTTPS fixture renders installation form
PASS: installation session cookie is Secure
PASS: installation session cookie is HttpOnly
PASS: installer styles are embedded in response
PASS: local Vazirmatn font is served
PASS: incorrect activation token rejected
PASS: array-shaped authentication inputs safely rejected
PASS: incorrect CSRF rejected with valid activation token
PASS: valid authorization cannot bypass missing dependencies
PASS: rejected requests never write application configuration
PASS: malformed activation file cannot enable installation
PASS: completed installation remains locked and file stays intact
PASS: CLI cannot reopen a completed installation
Scope: local PHP 8.3 HTTP fixtures; TLS flag simulated for form tests. No production database installation, remote-host access, SMS or payment test performed.
PASS: offline helper produces a random 48-hex token and matching SHA-256 download
PASS: regenerated token updates download and revokes old object URL
Scope: helper JavaScript tested in Node WebCrypto with DOM stubs; no browser layout test.