# Testing Rules

## Testing Strategy
Current baseline is manual smoke and regression testing. Add automated checks over time, but every PR must pass the manual baseline below.

## Mandatory Pre-PR Checks
1. Open each affected page directly by URL.
2. Open each affected page via AJAX navigation.
3. Verify back/forward browser navigation behavior.
4. Verify responsive behavior at desktop, tablet, mobile widths.
5. Check browser console for errors on changed flows.

## Functional Rules
1. New routes must resolve correctly and safely.
2. Unknown routes must fail gracefully.
3. Active nav and breadcrumb must match current page.
4. Toast, spinner, and progress indicators must not get stuck.

## Security Rules
1. Attempt invalid page key inputs and verify safe handling.
2. Validate escaped output for any new dynamic fields.
3. Confirm no secrets or sensitive internals are rendered.
4. Confirm error views do not reveal local paths or internals.

## Accessibility Rules
1. Keyboard navigation should reach all actionable controls.
2. Buttons and controls should have meaningful labels.
3. Color contrast should remain usable for core text and controls.
4. Focus visibility must remain intact after style changes.

## Performance Rules
1. Avoid adding heavy dependencies without justification.
2. Keep fragment loads responsive under normal local conditions.
3. Ensure repeat navigation does not duplicate event listeners or crash chart widgets.

## Regression Matrix
1. Dashboard route and analytics route.
2. Sidebar toggle desktop and mobile.
3. Fullscreen button behavior and icon state.
4. Scroll arrow visibility and actions.
5. Footer links and basic toasts.

## Release Candidate Gate
1. All mandatory checks completed.
2. All high-severity defects fixed or explicitly waived.
3. Docs updated for behavior/configuration changes.
4. Reviewer sign-off recorded.