Verified October 26, 2026 using PHP 8.3 with MySQLi and MariaDB 10.11:
All PHP syntax; root-level pages; required signup phone and both consents; registration; sign in; gated search and signup popup; dashboard; saved cars and duplicate save; comparable estimate and history; account settings; unsubscribe; password reset transaction and one-use token; duplicate email; CSRF rejection; configuration and SQL browser access protection.

Chromium desktop (1280px) and mobile (390px): home, signup, signin, insurance, value, privacy, terms, contact, about, 404, forgot password and unsubscribe. Checked overflow, image loading and JavaScript errors. Authenticated dashboard, cars, settings, sell and value checked on mobile. Homepage and account screens visually inspected.

Provider calls were not made with a live Auto.dev key. Local demonstration fixtures were used for account-flow estimates and listing tests. No email or SMS sent. Live provider integration requires hosting configuration. Temporary test configuration and accounts are excluded.

Live inventory update: verified shared MySQL cache hit, expiry refresh, removal of inactive/sample inventory, provider-error retry backoff, and rejection of demo mode on the homepage. The homepage no longer substitutes sample vehicle cards. API request shape and response mapping were checked against Auto.dev v2 documentation. Live HTTPS probe timed out at the build environment proxy; no successful provider response or key entitlement was observed. Existing account and browser regression tests rerun after the change.
