Verification

Automated provider-fake tests

php artisan test --compact
vendor/bin/pint --dirty --format agent
npm run build
npm --prefix docs-site run build

The normal suite blocks stray HTTP requests. It covers decimal pricing and precedence, five-minute/one-use quotes, vendor API isolation, token rotation, idempotency, rolling counts, midnight carryover, verified releases, gross reversal accounting, all five product families, adjusted cost/benefit checks, separate dispatch claims, timeout recovery, pauses, limit reductions, balance incidents and encrypted fulfilment. Dashboard tests cover administrator, support and vendor access.

PostgreSQL concurrency

Use a disposable database whose name ends with _test. The concurrency tests run migrations and start four independent PHP processes against the same database. Never point this command at a production or shared development database.

DB_CONNECTION=pgsql DB_HOST=127.0.0.1 DB_PORT=5432 \
DB_DATABASE=dtone_gateway_test DB_USERNAME=dtone_test DB_PASSWORD=... \
php artisan test --compact tests/Feature/PostgresConcurrencyTest.php

They prove that simultaneous admissions cannot overspend one vendor's allowance and that simultaneous identical requests create one reservation. Run the ordinary gateway tests against PostgreSQL too for database-specific compatibility.

Live provider read-only contracts

php artisan dtone:provider-check uses the live account credentials to read the complete catalogue and balance. It validates pagination and product/balance shape without submitting purchases. The provider URL is fixed to https://dvs-api.dtone.com/v1; no sandbox setting is needed.

The separate contract suite also performs live read-only requests and is not part of the normal provider-fake suite:

php artisan test --configuration=phpunit.contract.xml

Provide live credentials through environment configuration. Missing credentials skip the external test rather than being described as a pass. Run these checks deliberately; they contact the real provider. Purchase and fulfilment acceptance require separate controlled live verification. Retain original references and never replay unknown submissions.

Local implementation evidence — 20 September 2026

The PostgreSQL 18 run passed 101 tests / 504 assertions using PHP 8.4.23, including independent-process concurrency. The sandbox-readiness regressions cover definite rejection classification, ambiguous submissions, late confirmation cancellation, fixed-benefit checks, lower and tolerated costs, late reversal callback recovery, callback races, manual no-debit resolution, shared FX and legacy bulk pricing, atomic catalogue snapshots, shrink rejection and Johannesburg reporting dates. Provider HTTP was faked in those tests. Laravel Pint, application assets, route/view compilation and the VitePress production build passed. The original login, overview, operations, pricing draft form and light/dark appearance were inspected in Brave. The new manual-resolution and bulk-pricing actions were exercised through Livewire tests.

The external sandbox contract test was skipped because credentials were not configured. No DT One purchase was made. The local readiness command correctly reports missing account configuration and keeps production purchasing disabled. The checks above are historical evidence only. Current deployment requires account acceptance, callback/mail delivery and controlled live purchase verification.

The docs toolchain pins Vite 6.4.3 or newer within major 6 to avoid the older Vite/esbuild advisories in VitePress 1's default dependency range. Its production build and dependency audit pass with that override.

Account acceptance after the review fixes

Use the provider-fake suite for rejection, timeout and reversal scenarios. Any live purchase verification must use explicit positive limits and a controlled release. Verify the documented create-rejection error bodies for invalid input, insufficient funds and unavailable products. A duplicate external ID must retain the original reservation until reconciliation finds its outcome. Measure provider_cost_checked event counts, nonzero deltas and rejected comparisons across fixed/ranged families before changing the 0.01 account-currency tolerance. Never widen a vendor limit to hide rounding failures.

Verify cancellation after the confirmation deadline, delayed completion, PIN/eSIM retrieval, and an authenticated callback after the ordinary reversal watch. Local fakes prove gateway handling; only account-specific provider responses can confirm DT One's live contracts. Manual resolution tests prove permission, evidence requirements and accounting, but cannot prove that a staff-entered provider evidence reference is true.