Every target-host fact remains Unverified.
Local: PHP 8.3.6 vendor build executed; not a currency audit
Proposed: Maintained, fully patched PHP >=8.3; record provider patch/backport policy
Host: Actual version/build/support unknown
Verify: Capture private PHP diagnostic + provider patch statement; remove diagnostic
Local: Current release tested on MariaDB10.11.14. MySQL8.0.46 was tested in earlier packages only; repeat the final application on the selected maintained host branch.
Proposed: Maintained InnoDB/utf8mb4 branch; MySQL8.0 is not a production recommendation
Host: Selected engine/version unknown
Verify: Run same tests on selected maintained branch; record sql_mode/collation/transaction behaviour
Local: Verified in actual tests; runtime CREATE denied
Proposed: pdo_mysql and DML-only runtime user; temporary separate migration credential
Host: Host grants unknown
Verify: SHOW GRANTS privately; attempt harmless CREATE in disposable staging, confirm denial
Local: mbstring/fileinfo/GD JPEG PNG WebP/ZipArchive/XMLWriter/DOM/Sodium present locally
Proposed: All required extensions; WebP decode capability-aware
Host: Host extension build unknown
Verify: diagnose plus real upload/export/encrypted restore, not extension names alone
Local: Local upload10MiB/post12MiB;20MP/6000px app bounds exercised
Proposed: Proposed256MiB memory; post limit above multipart upload ceiling; max_input_vars >=4000
Host: Memory/request/time/disk/inodes unknown
Verify: Measure largest typed CMS edit, image decode,10000-row cap/backup at representative size
Local: Current run used isolated PHP HTTP with HttpOnly/SameSite cookies. Earlier Nginx/FPM HTTPS evidence retained separately; no fresh target HTTPS test.
Proposed: Valid public TLS, canonical origin, trusted proxy mapping set by provider
Host: Actual certificate/proxy mapping unknown
Verify: Check real Set-Cookie and redirects; do not trust visitor X-Forwarded-Proto
Local: Private paths denied in local HTTP/TLS tests; private app outside root
Proposed: Only public_html contents web-accessible; private code/config/storage outside root
Host: Actual account root/ownership unknown
Verify: HTTP probes for config/backups/dotfiles + actual file-manager permission evidence; no0777
Local: Dev-router and Nginx front-controller behaviour executed
Proposed: Prefer supplied Apache/LiteSpeed .htaccess if provider supports it
Host: Actual Apache/LiteSpeed/.htaccess not executed
Verify: Host staging real301/404, private denial,sitemap.xml,robots; syntax inspection is insufficient
Local: Local directory entries/sitemap alias executed; Step6 standalone-wrapper evidence retained
Proposed: directory_wrappers only with narrowly controlled route writes or manual routes command
Host: Provider entry/index/ErrorDocument/write policy unknown
Verify: Test new template route,retirement,symlink denial; manual sync if writes restricted
Local: Default setup closed; local owner/session/recovery tests executed
Proposed: One-time private setup; immediately close setup and drop migration grants
Host: Real custodian/tool access unknown
Verify: Host private install rehearsal, closed/setup/ probe, owner no-SSH recovery rehearsal
Local: Encrypted integrity,failed write,failed restore,later deletions,note suppression and concurrency executed
Proposed: Independent restricted backup + current ledger + separate key; agreed RPO/RTO
Host: Provider backup location/scope/key custody unknown
Verify: Restore to separate staging with current ledger,verify revoked users/deletions; measure elapsed time
Local: Bounded100-row batches/manual owner actions executed
Proposed: Cron optional; agreed protected manual maintenance schedule if unavailable
Host: Scheduler and responsible operator unknown
Verify: Dry run + apply twice + simultaneous invocation; record timestamps and responsibilities
Local: No SMTP/Node/Composer/SSH/cron/root required by application
Proposed: Use file manager/phpMyAdmin/private setup alternatives
Host: Deployment restrictions unknown
Verify: Confirm PHP execution,DB import,private write paths and ZIP/XML/GD availability without assuming shell access
Local: Application logs redact payloads; no real host logs inspected
Proposed: Describe actual provider logs/processors/locations/retention; restrict diagnostics
Host: Unknown
Verify: Review provider access/error/backup logging and personal-site policy before receiving
Local: 12 new tests with loopback synthetic SMTP; rejection/lost acknowledgement/retry/concurrency/restore covered. No real email sent.
Proposed: Authenticated SMTP over TLS/SSL with verified sender, valid CA trust and privately held credentials; owner recipient amitoshksharma@outlook.com. No SMTP from Outlook is assumed.
Host: Unverified
Verify: Verify outbound port/service limits and OpenSSL/CA support; privately configure approved sender; check SPF/DKIM/DMARC; send owner-approved synthetic staging message and verify Outlook inbox/junk plus service delivery/bounce records. Record policy/processor/mailbox retention; then enable only after release gates.