# Validation state — 2026-10-29

## Performed without runtime/build/DB access

- Read the safely redacted master task, especially sections 10.2–10.4, checkpoint definitions C3/C4 and the no-unknown-data-loss rules.
- Read actual v13.4.37 source for all eight removed transformations and v14.3.10 upgrade registry/prerequisite behavior.
- Freeze exact official v13 commit, eight original source files, official license and official module alias definitions.
- Verify all local JSON parses, eight unique attribute IDs, namespace-to-file paths, source hashes and write sites.
- Inspect custom executable source: one whitelisted connection->update call, no schema/cleanup/account/privilege calls, real PrerequisiteInterface classes, no import of historical Wizard classes as prerequisites.
- Inspect DENY/object/invalid-JSON failure paths, no redirect pid=0 fallback, no overwrite of settings, checked source values/target readback and transaction rollback paths.

## Still required; not reported as passed

No PHP CLI binary is installed on this task's host. No container or dependency installation was started. Therefore PHP parsing/lint, converter execution, Symfony/TYPO3 DI compilation and integration behavior are **NOT TESTED**.

Later in the authorized existing PHP-8.4 environment, before activation:

```bash
find /path/to/titk-legacy13-compat/Classes /path/to/titk-legacy13-compat/Tests -name '*.php' -print0 | xargs -0 -n1 php -l
php /path/to/titk-legacy13-compat/Tests/Converters.php
```

The converter test is self-contained: it does not load TYPO3, Composer, a database, network or write any file. It checks normal log arrays, unchanged JSON, malformed serialization, disabled object deserialization, invalid UTF-8/size rejection, reviewed ALLOW preservation and DENY/unknown tuple blocking.

On a disposable, checkpointed database copy, integration cases still need to prove:

1. Disabled/wrong project/wrong host/wrong DB/changed checkpoint cannot write.
2. Missing schema and incomplete history/workspace/site dependencies remain blocked.
3. DENY anywhere prevents every permissions UPDATE, including otherwise valid ALLOW rows.
4. Unknown/wildcard modules do not add or remove access.
5. Missing/changed site config or wrong Site-ID blocks all redirect changes; no fallback to pid=0.
6. A concurrent source edit, non-InnoDB table, target truncation, duplicate settings target and audit I/O failure do not become a successful silent migration.
7. Normal batches preserve original rows, UIDs, source fields and unrelated fields; second inspection/repetition changes no completed value.
8. Template workspace rows remain unmodified and block until the separate visibility decision is resolved.
9. C3 restoration reproduces the original selected-copy state.

The package is reviewable source preparation, not an installed or approved C4 result.