# Acceptance and verification

## Executed in the implementation environment

- Python API tests: 21 passing, including strict validation, inheritance, optimistic revisions, authorization boundaries, cookie-origin checks, session rotation, persistence, code expiry, reward caps, idempotency and concurrent submission.
- Swift PolicyCore tests: 10 passing under Swift 6.2.1 on Linux, including day/DST boundaries, bedtime, zero allowances, monotonic usage observations, cap truncation and exhaustive reachable-bonus threshold coverage.
- JavaScript syntax check; Swift source syntax parsing; YAML/plist/source-path validation.
- Swift networking source type-check against Linux Foundation with a platform import and local error stub. This is not an Apple SDK build.
- Chromium DOM + real backend smoke via an in-process ASGI bridge: login, two children, shared policy, individual override, pairing, graded credit, refreshed dashboard and logout. It does not test deployed browser cookies, TLS or a physical iPhone. Parent session/origin behavior is separately covered by API tests.

Not executed here: XcodeGen project generation, Xcode compile/link/archive/sign/install, Docker build/run, Screen Time authorization, shield appearance/action on hardware, or real DeviceActivity scheduling/counting. Do not mark these as passed based on pure Swift tests.

## First build-server pass

- [ ] `make bootstrap && make test` succeeds on the build server.
- [ ] `make ios-project` generates the four-target project.
- [ ] Xcode builds with the selected SDK; check all target bundle IDs and App Group entitlements.
- [ ] Archive/sign/install using owner-supplied profiles. Verify all extensions are embedded.
- [ ] Docker starts with a generated secret and persistent volume; restart retains profiles and awards.
- [ ] HTTPS and exact `APC_ORIGIN` work from parent browser and child phone; no plaintext fallback.

## Physical iPhone matrix

Use a dedicated test entertainment app. Start with a small base quota and the minimum five-minute reward, not essential communication apps. Record target OS version and observed callback times; the implementation intentionally does not fake sub-minute accuracy.

- [ ] Child Family Sharing account: approve `.child` authorization, then cancel and retry authorization.
- [ ] Pair once; code reuse/expired code fails. Reopening the app does not expose unrestricted selection editing.
- [ ] Parent-selected app is actually shielded outside allowed hours. Close on the shield exits correctly.
- [ ] Base cumulative usage reaches its threshold and shields the app with Family Quests backgrounded.
- [ ] Five correct answers record one credit and unlock further **usage** time. Wrong answers earn none.
- [ ] Putting the phone down does not consume a wall-clock reward; reaching the next usage threshold re-shields.
- [ ] Repeated Sync, foreground transitions, retrying submission, duplicate/late callbacks, and relaunches do not refund usage.
- [ ] Earning the last partial reward hits the exact cap. Another challenge cannot earn more that day.
- [ ] Earn a bonus before base time is exhausted; cumulative accounting remains correct.
- [ ] Bedtime shields despite unused/earned allowance. Bonus expires at the family-day boundary.
- [ ] Keep the main app closed overnight: the next allowed window restores base only, not yesterday's bonus. Repeat over two offline days.
- [ ] Force quit, reboot, lock/unlock and first unlock after reboot: no unexpected clearing or permanent accidental unlock.
- [ ] Change policy mid-day (raise/lower base, reward size, cap and allowed hours); prior usage is not incorrectly refunded and obsolete callbacks do not win.
- [ ] Change selected apps with a fresh parent code. Verify removed/new apps and cumulative historical usage; selection changes are a known accounting risk.
- [ ] Fail monitoring registration / corrupt or make shared state unavailable in a test build: error is visible, no unconditional `clearAllSettings` recovery.
- [ ] Offline backend, connection timeout, low-power mode and stale snapshots: cached limits remain; no unverified credit is minted.
- [ ] Change device timezone and clock; verify configured family timezone and check the five-minute foreground skew guard. Offline clock tampering remains a known limitation.
- [ ] Two children inherit a shared edit; only the child with an override retains its different value. Pending/error/last-reported status is truthful.
- [ ] Parent code expires and loses validity on leaving the setup session. A child cannot point an already-paired app at a replacement server to authorize selection changes.
- [ ] Revoke a device: API access stops, cached restrictions remain. Test same-server re-pairing with a new parent-issued code.
- [ ] A stricter native Apple App Limit still wins. Do not interpret that as a successful override of Apple's native limit.

## Stop conditions

Treat early/late/missing threshold callbacks, double-counted usage, unexpected unlocks, deadlocks during monitor replacement, storage races, inaccessible essential apps or a guardian recovery failure as blockers to real use. Capture diagnostic logs with test profiles rather than real family data. Do not hide these failures behind a green `applied` label.