Hilsa-Technical-Institution-Consultancy — FINAL QA / HANDOVER NOTES

APPROVED DESIGN: V2 from the latest previously delivered preview ZIP. No V1/V3 chooser, no unrelated redesign.

PRODUCTION IMPLEMENTATION:
- 12 PHP page routes using approved V2 HTML/CSS/JS templates; original layout, imagery, logos, header, footer and navigation retained.
- Protected admin at /admin/ with pre-created bcrypt-hashed account; CSRF, session cookie protections, login throttling, no public registration.
- 87 editable original image slots across all V2 pages. Upload/replace, ALT text, focal point, gallery removal/restore, custom image add/delete and optional mobile hero image.
- Upload MIME/size/resolution validation. Default photos have local responsive WebP variants. Admin uploads create responsive WebP derivatives when PHP GD is available; otherwise uploads continue with verified original format (performance limitation).
- Image wrappers retain their approved fixed dimensions and object-fit cropping rules.
- Central contact settings propagate to public contact/footer/WhatsApp and JSON-LD.
- Editable page H1/lead/CTA copy, per-page SEO metadata, logo settings and manual tracking IDs.

EXECUTED LOCAL TEST RESULTS:
PASS: All 12 public V2 PHP routes returned HTTP 200.
PASS: 502 local .html hyperlinks were checked and found corresponding PHP routes.
PASS: 0 missing locally referenced image paths in all rendered pages.
PASS: All referenced V2 CSS background image assets exist.
PASS: 18 end-to-end admin tests: login, upload/replace hero, public image persistence, restore, ALT-only, built-in gallery removal, new gallery add/delete, contact/WhatsApp updates, logo replacement/size, background replacement, page content, SEO, small-image rejection, CSRF rejection, and password change.
PASS: PHP source syntax and JavaScript syntax checks.
PASS: Public /private/ path blocked in the local test router.

NOT CERTIFIED IN THIS ENVIRONMENT:
- Chromium graphical rendering stalled. Seven-breakpoint visual QA on the new PHP installation remains required after cPanel upload (360,375,390,430,768,1024,1440px). The preserved V2 static layout was previously reviewed; new dynamic admin changes were tested by HTTP/HTML assertions, not fresh screenshots.
- Real cPanel hosting deployment, Apache mod_rewrite and site HTTPS not tested on the customer's actual domain.
- Central Tarjeeh Google OAuth/Search Console/GA4/GTM automatic connection is NOT operational or verified here. It needs separately authorized central server configuration; available manual GA4, GTM and verification fields do not mean Google's APIs are connected.
- PHP GD is not available in this local test environment. It should be enabled on the target cPanel account for production upload derivatives.

SECURITY HANDOVER:
Only the inner CPANEL ZIP is extracted into public_html. The temporary password appears in the separate PRIVATE ADMIN-CREDENTIALS file, never plaintext inside the deployable files. Private JSON configuration and bcrypt credential hashes live in /private/ blocked by Apache; verify access is denied after deployment. Change the admin password at first login.

HOSTING REQUIREMENTS: Apache/cPanel with mod_rewrite; PHP 8.0+ (8.2+ recommended), fileinfo and JSON. Enable GD for responsive post-upload WebP generation. Writable private/ and uploads/media/ directories (usually owner-writable 755/644).

All default business/contact facts match the client-provided original Hilsa business brief. New sample statistics, addresses, phone numbers, testimonials and project claims have not been added.
