WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiContentNegotiationAndMediaTypeContractTest::json_accept_header_receives_controlled_api_responses_across_major_domains(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiContentNegotiationAndMediaTypeContractTest::unsupported_accept_headers_do_not_trigger_server_errors(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiContentNegotiationAndMediaTypeContractTest::malformed_content_type_for_mutations_fails_cleanly(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiCrossModuleReferentialWorkflowExpansionTest::wrong_but_existing_ids_across_modules_do_not_silently_cross_link_records(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiFileMediaMetadataSafetyContractTest::upload_routes_reject_misleading_metadata_and_path_names_cleanly(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiFileMediaMetadataSafetyContractTest::download_routes_do_not_accept_path_traversal_identifiers(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiImpersonationDelegationAndActingAsContractTest::impersonation_and_delegation_routes_are_admin_only_and_auditable(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiModelLifecycleInvariantExpansionTest::create_update_show_index_lifecycle_routes_remain_controlled_for_core_resources(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiModelLifecycleInvariantExpansionTest::identity_fields_are_not_overwritten_by_update_payloads(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiNestedPayloadAndArrayAbuseContractTest::mutation_routes_fail_cleanly_for_deeply_nested_payloads(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiNestedPayloadAndArrayAbuseContractTest::mutation_routes_fail_cleanly_for_large_sparse_arrays(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiNotificationPreferenceAndOptOutContractTest::notification_preference_routes_validate_channels_recipients_and_opt_out_flags(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiNotificationPreferenceAndOptOutContractTest::low_privilege_users_cannot_broadcast_notifications_to_everyone(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiOpenApiDocumentationDriftContractTest::api_surface_has_documentation_entry_points_and_route_inventory_remains_machine_readable(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiOpenApiDocumentationDriftContractTest::named_api_routes_use_stable_names_when_names_exist(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiOpenApiDocumentationDriftContractTest::documented_routes_do_not_point_to_missing_actions(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiPolicyAuthorizationDiscoveryContractTest::protected_mutation_routes_are_not_publicly_mutable(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiPolicyAuthorizationDiscoveryContractTest::permission_like_routes_reject_wildcards_from_non_admins(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiPublicPrivateCacheSeparationContractTest::authenticated_private_routes_do_not_emit_public_cache_headers(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiPublicPrivateCacheSeparationContractTest::conditional_cache_headers_do_not_bypass_authorization(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiReportConsistencyAndAggregationExpansionTest::report_routes_handle_date_window_filter_and_group_by_combinations(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiReportConsistencyAndAggregationExpansionTest::parent_and_teacher_report_access_is_scoped_not_global(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiSoftDeleteRestoreArchiveLifecycleContractTest::archive_restore_and_unarchive_routes_are_controlled_and_role_protected(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiSoftDeleteRestoreArchiveLifecycleContractTest::destructive_soft_delete_style_routes_tolerate_repeated_requests(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiSortingFieldSelectionAndIncludeContractTest::list_routes_handle_sort_fields_includes_and_sparse_fieldsets(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiTimezoneCalendarRecurrenceDepthContractTest::calendar_and_schedule_routes_reject_ambiguous_recurrence_and_timezone_inputs_cleanly(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. WARN Metadata found in doc-comment for method Tests\Feature\Api\V1\FullSurface\ApiWebhookReplayAndSignatureDepthContractTest::external_callback_routes_reject_missing_bad_and_replayed_signatures_cleanly(). Metadata in doc-comments is deprecated and will no longer be supported in PHPUnit 12. Update your test code to use attributes instead. PASS Tests\Feature\Api\ApiAttendanceTemplateFeatureTest ✓ attendance comment templates can be managed through current api 0.33s ✓ attendance comment template validation blocks bad ranges 0.02s ✓ legacy attendance template aliases still work 0.02s PASS Tests\Feature\Api\ApiAuthenticationAndAuthorizationTest ✓ api login returns token and user object 0.04s ✓ session login also returns token and user object for spa clients 0.03s ✓ auth me requires authentication 0.02s ✓ auth me returns the current authenticated user 0.02s ✓ admin only routes reject non admin users 0.02s ✓ protected api routes reject anonymous requests before business logi… 0.19s PASS Tests\Feature\Api\ApiPreferencesFeatureTest ✓ authenticated user can create read update and delete preferences 0.02s ✓ non admin cannot list or manage another users preferences 0.02s ✓ admin can list and delete any users preferences 0.02s ✓ preferences validation rejects invalid options 0.02s FAIL Tests\Feature\Api\ApiPublicEndpointsTest ⨯ health endpoint is available 0.02s ✓ public policy endpoints are available 0.02s ✓ public static pages are available 0.01s ✓ public frontend content endpoints do not server error 0.01s ✓ registration captcha endpoint returns captcha payload 0.01s ✓ invalid login payload is rejected cleanly 0.02s FAIL Tests\Feature\Api\ApiRolePermissionFeatureTest ⨯ admin can manage roles permissions and assign roles 0.03s ✓ role permission validation rejects bad payloads 0.02s FAIL Tests\Feature\Api\ApiRouteContractTest ✓ every api route points to an existing controller method 0.01s ✓ api routes do not duplicate method and uri pairs 0.01s ⨯ mutating api routes are protected unless explicitly public 0.06s FAIL Tests\Feature\Api\ApiUseCaseCoverageMatrixTest ⨯ every api route is mapped to an explicit use case domain 0.02s ✓ required use case domains have route coverage 0.01s ✓ every protected api route rejects anonymous requests 0.16s FAIL Tests\Feature\Api\ApiUserManagementFeatureTest ⨯ admin can create list update and delete a user through api 0.34s ✓ user creation validates required payload and unique email 0.02s ✓ user creation rejects nonexistent role id 0.02s PASS Tests\Feature\Api\V1\Admin\AdministratorAbsenceControllerTest ✓ guest cannot access absence index 0.01s ✓ authenticated user can get absence index 0.01s ✓ absence store requires reason 0.01s ✓ absence store requires valid date format 0.02s ✓ absence store calls service and returns success 0.01s PASS Tests\Feature\Api\V1\Administrator\AdministratorDashboardControllerTest ✓ metrics require authentication 0.01s ✓ metrics are forbidden for non admin users 0.03s ✓ metrics return payload for admin 0.02s ✓ user search passes query to service 0.02s PASS Tests\Feature\Api\Administrator\AdministratorEnrollmentControllerTest ✓ guest cannot update enrollment statuses 0.02s ✓ can fetch enrollment withdrawal data 0.01s ✓ can fetch new students 0.01s ✓ update statuses requires valid status values 0.02s ✓ update statuses calls service 0.01s PASS Tests\Feature\Api\V1\Admin\AdministratorEnrollmentQueryApiTest ✓ enrollment withdrawal endpoint returns students classes and years 0.02s ✓ new students endpoint returns transformed rows 0.02s PASS Tests\Feature\Api\Administrator\AdministratorEnrollmentUpdateStatusesApiTest ✓ update statuses requires enrollment status payload 0.02s ✓ update statuses rejects invalid status value 0.01s ✓ update statuses creates new enrollment row 0.02s ✓ update statuses updates existing enrollment row 0.02s ✓ update statuses creates or updates refund when status is refund pen… 0.02s ✓ update statuses returns partial success when some students are inva… 0.02s PASS Tests\Feature\Api\Administrator\AdministratorNotificationControllerTest ✓ can get alerts data 0.02s ✓ save alerts requires subjects payload 0.01s ✓ save alerts calls subject service 0.02s ✓ can get print recipients data 0.01s ✓ save print recipients requires notify payload 0.01s ✓ save print recipients calls service 0.01s PASS Tests\Feature\Api\Administrator\AdministratorTeacherSubmissionControllerTest ✓ can get teacher submission report 0.02s ✓ notify requires notify payload 0.01s ✓ notify calls service 0.02s PASS Tests\Feature\Api\Administrator\AdministratorTeacherSubmissionNotifyApiTest ✓ notify endpoint requires notify payload 0.02s ✓ notify endpoint sends email and creates history row 0.02s ✓ notify endpoint marks failed when teacher email is invalid 0.02s ✓ notify endpoint accepts flat teacher ids from spa payload 0.02s ✓ notify endpoint accepts flat teacher ids when teacher class has no… 0.02s PASS Tests\Feature\Api\Administrator\AdministratorTeacherSubmissionReportApiTest ✓ teacher submission report endpoint returns rows summary and history 0.04s ✓ teacher submission report returns no students status for empty sect… 0.02s ✓ teacher submission report handles teacher class without semester co… 0.02s ✓ teacher submission report limits history to three entries 0.02s ✓ teacher submission report honors school year and semester query fil… 0.02s FAIL Tests\Feature\Api\V1\Administrator\EmergencyContactControllerTest ⨯ index returns grouped contacts 0.02s ⨯ update changes emergency contact 0.01s ⨯ destroy deletes emergency contact 0.01s ⨯ show returns single contact for parent 0.01s ⨯ update requires matching parent id 0.02s ⨯ destroy requires matching parent id 0.01s PASS Tests\Feature\Api\V1\Administrator\TeacherClassAssignmentControllerTest ✓ index returns teachers and classes 0.02s ✓ store and delete assignment 0.02s PASS Tests\Feature\Api\V1\Administrator\TrophyControllerTest ✓ index requires authentication 0.01s ✓ index is forbidden for non admin users 0.02s ✓ index returns projection for admin 0.02s ✓ winners returns data for admin 0.02s ✓ final returns data for admin 0.02s ✓ index validates percentile range 0.02s PASS Tests\Feature\Api\AssignmentApiControllerTest ✓ index returns assignment overview 0.02s ✓ index filters by school year 0.02s ✓ index sorts sections by name 0.02s ✓ index excludes inactive students 0.02s ✓ store creates new assignment 0.02s ✓ store updates existing assignment for same unique keys 0.02s ✓ store validates required fields 0.02s ✓ store validates foreign keys 0.02s ✓ class assignment data returns expected structure 0.02s ✓ class assignment data deduplicates teacher names 0.02s PASS Tests\Feature\Api\AssignmentApiTest ✓ it returns assignment sections json 0.02s ✓ it filters assignments by school year 0.02s ✓ it creates or updates student assignment 0.02s ✓ it validates required fields when storing assignment 0.02s ✓ store is idempotent for same student semester and year 0.02s ✓ guest cannot access assignment api when auth is required 0.01s FAIL Tests\Feature\Api\V1\Attendance\LateSlipLogsControllerTest ⨯ index requires admin 0.02s ⨯ index returns logs 0.01s ⨯ show returns log 0.01s ⨯ destroy deletes log 0.02s ⨯ index validation rejects bad dates 0.01s PASS Tests\Feature\Api\AttendanceCommentTemplateApiTest ✓ can list templates 0.02s ✓ can list templates active only 0.02s ✓ can create template 0.01s ✓ store validation fails when max less than min 0.01s ✓ can show template 0.02s ✓ can update template 0.01s ✓ update validation fails if both scores invalid relation 0.01s ✓ can delete template 0.02s ✓ legacy list data endpoint returns templates key 0.01s PASS Tests\Feature\Api\V1\AttendanceTracking\AttendanceTrackingControllerTest ✓ pending violations returns json response 0.02s ✓ notified violations returns json response 0.02s ✓ student case returns service payload 0.01s ✓ student case returns service status code when not found 0.01s ✓ record validates and returns service response 0.02s ✓ record returns validation errors for bad payload 0.01s ✓ send auto emails returns service response 0.01s ✓ compose returns service response 0.02s ✓ send manual email returns service response 0.01s ✓ send manual email validates payload 0.01s ✓ parents info returns service response 0.02s ✓ save notification note returns service response 0.01s ✓ save notification note validates payload 0.01s FAIL Tests\Feature\Api\V1\Auth\IpBanControllerTest ✓ index requires admin 0.02s ⨯ index returns bans 0.01s ⨯ show returns ban 0.01s ⨯ ban creates block 0.02s ⨯ unban single 0.01s ⨯ unban all 0.01s ✓ ban validation requires ip or id 0.02s PASS Tests\Feature\Api\V1\Auth\RegisterControllerTest ✓ captcha endpoint returns value 0.02s ✓ register creates user 0.33s PASS Tests\Feature\Api\V1\Auth\RegisterPayloadDebugTest ✓ debug payload shows json body 0.02s PASS Tests\Feature\Api\BadgeControllerTest ✓ form data returns success response 0.02s ✓ print status returns success response 0.02s ✓ print status returns 500 when service throws 0.01s ✓ log print returns success response 0.02s ✓ log print returns 500 when service throws 0.01s ✓ generate pdf returns pdf response 0.02s ✓ generate pdf validates required user ids 0.01s ✓ log print validates required user ids 0.02s ✓ endpoints require authentication 0.02s PASS Tests\Feature\Api\V1\BadgeScan\BadgeScanControllerTest ✓ scan is public but validates badge value 0.02s ✓ scan returns 404 for unrecognized badge 0.02s ✓ logs require authentication 0.01s ✓ logs are forbidden for non staff roles 0.02s ✓ logs return data for staff 0.02s PASS Tests\Feature\Api\V1\BroadcastEmail\BroadcastEmailControllerTest ✓ options returns parents and senders 0.02s ✓ send test only dispatches email 0.02s FAIL Tests\Feature\Api\V1\ClassPreparation\ClassPreparationControllerTest ⨯ sticker counts returns payload 0.01s ⨯ students by class returns roster 0.01s FAIL Tests\Feature\Api\V1\ClassProgress\ClassProgressControllerTest ✓ meta returns sections 0.02s ⨯ index returns paginated reports 0.02s ⨯ store creates reports 0.04s ⨯ show returns weekly reports 0.01s ⨯ update modifies report 0.01s ⨯ destroy deletes report 0.01s ⨯ authorization blocks other teachers 0.02s ✓ validation rejects invalid payload 0.02s ⨯ attachment download returns file 0.01s PASS Tests\Feature\Api\V1\Classes\ClassSectionControllerTest ✓ index returns sections 0.02s ✓ store requires admin 0.02s ✓ store creates class section 0.02s ✓ update requires admin 0.02s ✓ show returns section 0.02s ✓ update modifies class section 0.02s ✓ destroy deletes class section 0.02s ✓ attendance returns students 0.01s ✓ seed defaults creates classes 0.02s ✓ validation rejects invalid payload 0.02s FAIL Tests\Feature\Api\V1\Communication\CommunicationControllerTest ✓ options returns students and templates 0.02s ✓ preview returns rendered subject and body 0.02s ⨯ send dispatches email 0.02s FAIL Tests\Feature\Api\V1\CompetitionScores\CompetitionScoresControllerTest ⨯ index returns competitions and counts 0.02s ⨯ edit returns students and scores 0.01s ⨯ save updates scores 0.01s FAIL Tests\Feature\Api\V1\CompetitionWinners\CompetitionWinnersControllerTest ⨯ index returns admin competitions with ids 0.02s ⨯ lock and unlock toggle competition 0.01s ⨯ export quiz creates quiz rows 0.01s FAIL Tests\Feature\Api\V1\Discounts\DiscountControllerTest ⨯ options returns vouchers and parents 0.02s ⨯ apply voucher applies discount 0.01s ✓ store voucher creates row 0.02s ⨯ show voucher returns resource 0.02s ⨯ delete voucher removes row 0.01s PASS Tests\Feature\Api\V1\Email\EmailControllerTest ✓ senders endpoint returns options 0.02s ✓ send endpoint uses dispatch service 0.02s PASS Tests\Feature\Api\V1\Email\EmailExtractorControllerTest ✓ emails endpoint returns users and parents 0.02s ✓ legacy emails endpoint returns top level arrays 0.02s ✓ compare endpoint returns comparison 0.01s FAIL Tests\Feature\Api\V1\Exams\ExamDraftControllerTest ⨯ teacher store creates draft 0.02s ✓ admin review updates status 0.02s FAIL Tests\Feature\Api\V1\Expenses\ExpenseControllerTest ✓ options returns staff and retailors 0.02s ✓ store creates expense 0.03s ⨯ index lists expenses 0.01s ⨯ show returns expense 0.01s ⨯ update status changes status 0.01s FAIL Tests\Feature\Api\V1\ExtraCharges\ExtraChargesControllerTest ⨯ list returns rows 0.01s ⨯ options returns parent options 0.01s ⨯ parent options returns results 0.02s ⨯ invoices for parent returns results 0.01s ⨯ store creates charge and updates invoice 0.01s ⨯ update adjusts charge 0.01s ⨯ void changes status 0.02s ⨯ reverse changes status 0.01s PASS Tests\Feature\Api\V1\Family\FamilyAdminControllerTest ✓ index returns family admin payload 0.02s ✓ search returns items 0.02s ✓ card returns family details 0.02s ✓ compose email returns error on failure 0.02s ✓ requires authentication 0.01s ✓ compose email validation fails 0.02s PASS Tests\Feature\Api\V1\Family\FamilyControllerTest ✓ families by student returns families 0.02s ✓ guardians by family returns guardians 0.02s ✓ bootstrap creates family and links 0.02s ✓ attach second by user links guardian 0.02s ✓ attach second by email creates user and links 0.02s ✓ set primary home updates record 0.02s ✓ set guardian flags updates record 0.02s ✓ set guardian flags requires payload 0.02s ✓ unlink guardian removes record 0.01s ✓ unlink student removes record 0.01s ✓ import legacy second parents links guardian 0.02s ✓ requires authentication 0.01s ✓ attach second by user validation fails 0.01s FAIL Tests\Feature\Api\V1\Finance\ChargeControllerTest ✓ list charges for parent 0.03s ⨯ store extra charge returns 409 on duplicate 0.02s ⨯ store event charge creates row 0.02s ✓ cancel extra charge voids row 0.02s ✓ charges endpoints require authentication 0.02s PASS Tests\Feature\Api\V1\Finance\EventChargeControllerTest ✓ show requires authentication 0.02s ✓ show returns event charge 0.02s ✓ show returns 404 for unknown charge 0.02s ✓ update modifies event charge 0.02s ✓ approve marks charge as charged 0.02s ✓ void clears charged flag 0.02s ✓ destroy voids the charge 0.02s PASS Tests\Feature\Api\V1\Finance\FeeCalculationControllerTest ✓ refund endpoint returns amount 0.03s ✓ tuition breakdown endpoint returns per student detail 0.02s ✓ tuition breakdown endpoint requires authentication 0.02s ✓ tuition breakdown endpoint validates payload 0.01s ✓ family balance endpoint returns account summary 0.02s ✓ family balance endpoint requires authentication 0.02s ✓ tuition total endpoint returns total 0.02s ✓ refund endpoint requires authentication 0.02s ✓ tuition total endpoint requires authentication 0.01s ✓ refund endpoint validates payload 0.01s ✓ tuition total endpoint validates payload 0.02s ✓ refund endpoint handles service failure 0.02s ✓ tuition total endpoint handles service failure 0.02s FAIL Tests\Feature\Api\V1\Finance\FinancialControllerTest ⨯ report returns financial report 0.02s ⨯ summary returns totals 0.01s ⨯ unpaid parents lists balances 0.02s FAIL Tests\Feature\Api\V1\Finance\InvoiceControllerTest ⨯ management returns parent invoice data 0.01s ⨯ generate creates invoice 0.01s ⨯ by parent returns invoices 0.02s PASS Tests\Feature\Api\V1\Finance\PaymentControllerTest ✓ store creates payment plan 0.02s ✓ by parent returns payments 0.02s ✓ update balance updates payment 0.02s FAIL Tests\Feature\Api\V1\Finance\PaymentEventChargesControllerTest ⨯ store creates event charges 0.02s PASS Tests\Feature\Api\V1\Finance\PaymentManualControllerTest ✓ search returns parent data 0.02s ✓ suggest returns items 0.02s PASS Tests\Feature\Api\V1\Finance\PaymentNotificationControllerTest ✓ send creates log 0.02s ✓ index lists logs 0.02s FAIL Tests\Feature\Api\V1\Finance\PaymentTransactionControllerTest ⨯ store creates transaction 0.02s ✓ by payment returns transactions 0.02s ✓ update status updates transaction 0.02s PASS Tests\Feature\Api\V1\Finance\PaypalTransactionsControllerTest ✓ index returns transactions 0.02s ✓ csv download 0.02s PASS Tests\Feature\Api\V1\Finance\PurchaseOrderControllerTest ✓ index returns orders 0.02s ✓ options returns suppliers and supplies 0.02s ✓ store creates purchase order and items 0.02s ✓ receive updates inventory 0.02s ✓ cancel marks purchase order 0.02s FAIL Tests\Feature\Api\V1\Finance\RefundControllerTest ✓ index requires authentication 0.02s ✓ index returns paginated refunds 0.02s ✓ show returns refund 0.02s ⨯ store overpayment creates refund 0.01s ✓ store validates payload 0.01s ✓ update approves refund 0.02s ✓ reject requires reason 0.02s ✓ record payment updates refund 0.04s ⨯ recalculate overpayments creates refund 0.01s ✓ destroy cancels refund 0.02s FAIL Tests\Feature\Api\V1\Finance\ReimbursementControllerTest ✓ create batch creates open batch 0.03s ✓ mark donation updates expense 0.02s ✓ store reimbursement creates record and updates expense 0.02s ⨯ update reimbursement updates fields 0.02s FAIL Tests\Feature\Api\V1\Frontend\FrontendControllerTest ✓ index returns page 0.01s ✓ fetch user requires auth 0.01s ⨯ fetch user returns profile 0.02s FAIL Tests\Feature\Api\V1\Frontend\InfoIconControllerTest ⨯ profile icon returns initials 0.02s FAIL Tests\Feature\Api\V1\Frontend\LandingPageControllerTest ⨯ index returns admin dashboard 0.02s ⨯ teacher dashboard returns summary 0.02s ⨯ parent dashboard returns summary 0.02s PASS Tests\Feature\Api\V1\Frontend\PageControllerTest ✓ privacy returns content 0.01s ✓ help missing returns error 0.02s ✓ submit contact persists 0.01s FAIL Tests\Feature\Api\V1\FullSurface\ApiAcademicAttendanceFullSurfaceContractTest ⨯ academic attendance and grading surfaces have controlled contracts 0.12s PASS Tests\Feature\Api\V1\FullSurface\ApiAccountStatusLifecycleContractTest ✓ suspended disabled and pending status values do not gain access thr… 0.10s FAIL Tests\Feature\Api\V1\FullSurface\ApiAdminOperationsFullSurfaceContractTest ⨯ administrator operational surface responds with controlled contract… 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiAttachmentUploadContentSafetyContractTest ⨯ upload endpoints reject executable or misleading files cleanly 0.04s ✓ download and file response routes do not allow path traversal param… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiAuditLogAndAdministrativeTraceabilityContractTest ⨯ admin mutations return traceable status without exposing internal l… 0.17s ⨯ audit and log routes are not mutable by public or low privilege use… 0.18s PASS Tests\Feature\Api\V1\FullSurface\ApiAuthenticationLifecycleDepthContractTest ✓ authentication lifecycle handles login me refresh logout and invali… 0.05s ✓ password reset and registration like routes do not leak account exi… 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiAuthorizationCacheInvalidationContractTest ⨯ role and permission mutations do not make low privilege actor admin… 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch11RouteRegressionNetTest ✓ every api family has at least one negative contract probe in batch… 0.03s ⨯ batch 11 high risk routes return controlled responses under combine… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12AcademicGradeBoundaryContractTest ⨯ grade and score routes reject out of range and wrong student contex… 0.16s ⨯ locked or finalized grade routes do not accept low privilege overri… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12AttachmentLifecycleContractTest ✓ attachment upload routes handle multiple file shapes cleanly 0.04s ⨯ file download routes reject path and storage driver probing 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12AttendanceCorrectionAuditContractTest ✓ attendance corrections require valid actor date status and reason 0.17s ⨯ parent and student cannot correct attendance records 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12BulkMutationBoundaryContractTest ⨯ bulk mutation routes reject empty and cross domain targets cleanly 0.09s ⨯ bulk routes do not accept unbounded target lists 0.10s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12CombinedRegressionSweepTest ⨯ batch 12 combined security business rule and contract probe 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12ConsistencyUnderPartialPayloadContractTest ⨯ patch routes do not null identity or ownership when optional fields… 0.02s ⨯ post routes handle sparse payloads as validation not crashes 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12CrossActorDataLeakageContractTest ⨯ parent teacher and student scoped reads do not leak admin only fiel… 0.02s ⨯ actor cannot select a different owner scope with query parameters 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12FinancialLedgerIntegrityContractTest ⨯ financial mutations reject ledger breaking amounts and cross invoic… 0.38s ✓ parent cannot force finance scope to all families 0.29s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch12GuardianDelegationExpirationContractTest ✓ guardian and authorized user routes validate expiration relationshi… 0.06s ✓ student cannot manage guardians or authorized users 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12LongRunningExportJobContractTest ⨯ export report and generation routes handle async parameters without… 0.06s ⨯ low privilege users cannot request full school exports 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12MaintenanceModeAndOperationalControlContractTest ⨯ operational control routes are admin only and controlled 0.04s ✓ public requests cannot toggle system state 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12RouteMetadataRiskRegisterTest ✓ high risk route families exist in the contract risk register 0.03s ⨯ mutating high risk routes have specific route names when available 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch12SearchEnumerationResistanceContractTest ✓ search autocomplete and lookup routes resist identifier enumeration 0.34s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch12SensitiveConfigurationExposureContractTest ⨯ configuration and bootstrap responses do not expose secrets 0.03s ⨯ low privilege users cannot read sensitive configuration domains 0.04s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch12WebhookProviderMatrixContractTest ✓ provider callbacks reject missing mismatched and replayed signature… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13AccountRecoveryCredentialChangeContractTest ✓ password reset and credential routes do not leak user existence or… 0.03s ⨯ low privilege users cannot change other users credentials 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13ApiPaginationPerformanceGuardContractTest ⨯ list routes cap unbounded pagination and include requests 0.03s ✓ search routes handle unicode and extreme terms without leaking sql 0.09s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13ContactMessagingAbuseModerationContractTest ⨯ message and contact routes handle spam headers and html payloads 0.09s ⨯ broadcast routes remain admin only under channel spoofing 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13DiscountVoucherScholarshipAbuseContractTest ✓ discount and voucher routes reject abusive amounts and scope overri… 0.04s ⨯ parent cannot self grant discounts or scholarships 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13FullSurfaceRegressionSuperSweepTest ⨯ batch13 super sweep keeps major route families under controlled fai… 0.04s ✓ batch13 major mutation families are represented 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13InventoryProcurementReceivingIntegrityContractTest ✓ inventory receiving routes reject negative or impossible stock move… 0.05s ⨯ non admins cannot adjust inventory or procurement state 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13LocaleCalendarReligiousDateContractTest ✓ calendar and event routes handle locale specific dates cleanly 0.09s ⨯ attendance and academic routes reject out of term religious calenda… 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13MobileOfflineSyncConflictContractTest ⨯ offline sync headers do not override authorization or state 0.09s ✓ duplicate offline submissions have controlled outcome 0.18s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13ObservableErrorCorrelationContractTest ⨯ malformed requests preserve safe error correlation without reflecti… 0.04s ⨯ error responses do not disclose controller or model stack details 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13ParentPortalInvoicePrivacyContractTest ⨯ parent finance queries cannot request all families or other parent… 0.04s ⨯ parent cannot mark invoice paid or refunded directly 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13PaymentProviderLedgerReconciliationContractTest ⨯ payment provider payloads do not bypass ledger validation 0.06s ✓ duplicate provider reference is controlled across payment routes 0.21s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13ReportCardTranscriptCertificateForgeryContractTest ✓ document generation rejects forged finalization and signer payloads 0.20s ⨯ students and parents cannot generate admin documents for other stud… 0.06s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch13RolePermissionMutationRaceContractTest ✓ permission mutations reject wildcards and recursive assignments 0.04s ✓ non admin cannot gain permission by replaying role payload 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13StaffHrPayrollBoundaryContractTest ✓ staff and payroll routes redact sensitive personnel fields 0.08s ⨯ low privilege users cannot mutate staff or payroll routes 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13StudentEnrollmentLifecycleIntegrityContractTest ✓ enrollment routes reject cross family and cross class payloads clea… 0.05s ⨯ parent cannot self enroll or move student into arbitrary class 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch13TeacherRosterAndAssignmentBoundaryContractTest ⨯ teacher roster routes ignore forced teacher and class scope overrid… 0.02s ⨯ unassigned teacher mutations are denied or validated 0.09s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch14AcademicPromotionRollbackIntegrityContractTest ✓ promotion and school year routes reject unsafe rollback payloads 0.10s ✓ low privilege actors cannot close reopen or promote school years 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14AccountEnumerationAndIdentityPrivacyContractTest ✓ identity recovery routes do not reveal whether user exists 0.02s ⨯ identity payloads do not leak internal auth fields 0.04s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch14AdminDelegationApprovalWorkflowContractTest ✓ approval and delegation routes reject forged approval metadata 0.06s ✓ low privilege users cannot self approve or delegate privileges 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14ApiConsumerContractCompatibilityTest ⨯ core identity contracts remain compatible for web mobile and api cl… 0.04s ✓ successful login like responses keep token and user contract when p… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14AttendanceDeviceAndKioskAbuseContractTest ⨯ kiosk scanner and attendance routes reject forged device identity 0.02s ✓ student and parent cannot self mark attendance through device paylo… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14AuditTrailTamperResistanceContractTest ✓ audit and log routes reject client supplied actor and timestamp fie… 0.05s ⨯ non admin users cannot clear or rewrite audit history 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch14BulkAssignmentCollisionContractTest ✓ bulk assignment routes handle duplicate and conflicting ids cleanly 0.05s ✓ parent and student cannot force bulk assignment scope 0.05s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch14CrossModuleInvariantRiskRegisterTest ✓ batch14 route families have cross module risk coverage 0.02s ✓ batch14 high risk mutation families exist 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14DataLifecycleArchivePurgeContractTest ✓ archive purge and retention routes require safe controlled requests 0.03s ⨯ non admin users cannot purge or restore global records 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14FinanceReconciliationAndRefundAbuseContractTest ✓ finance reconciliation routes reject mismatched invoice parent and… 0.10s ⨯ parent cannot self refund or self reconcile 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14NotificationTemplateInjectionContractTest ✓ notification and template routes reject template injection payloads 0.06s ⨯ non admin users cannot broadcast by template override 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14PrintExportTamperingContractTest ⨯ print export and document generation routes reject tampered scope f… 0.05s ✓ low privilege users cannot generate full school exports 0.09s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14RegressionMegaSweepTest ⨯ batch14 mega sweep keeps new risk payloads under controlled failure 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14RelationshipOwnershipMatrixExpansionTest ✓ relationship owner override fields are not trusted across route fam… 0.07s ⨯ student user cannot read or write other relationship graphs 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch14SessionCookieCsrfBoundaryContractTest ⨯ api auth routes do not depend on browser session cookies 0.03s ⨯ browser only session headers do not grant api privileges 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch14StoragePathAndSignedUrlContractTest ✓ file and signed url routes reject path and disk overrides 0.06s ✓ public file routes do not honor expired or forged signature paramet… 0.04s WARN Tests\Feature\Api\V1\FullSurface\ApiBatch15AdminImpersonationSessionBoundaryContractTest ! batch15 impersonation and acting as routes require real admin conte… 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15AuthTokenRotationAndRevocationContractTest ⨯ batch15 token rotation revocation and identity routes do not accept… 0.04s ✓ batch15 repeat logout and refresh replay are controlled 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15BackgroundCommandAndSchedulerContractTest ✓ batch15 command scheduler and job trigger routes are admin only and… 0.06s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15ConsentPrivacyAndDataSubjectRightsContractTest ✓ batch15 privacy consent erasure and export routes are admin or owne… 0.02s ✓ batch15 student actor cannot request family wide or school wide pri… 0.06s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15CrossSchoolIdentityCollisionContractTest ✓ batch15 duplicate external identifiers and cross school aliases fai… 0.04s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15DataResidencyBackupAndRestoreContractTest ✓ batch15 backup restore residency and snapshot routes do not expose… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15DomainEventOutboxAndNotificationConsistencyContractTest ✓ batch15 event outbox and notification trigger routes reject forged… 0.08s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15FeatureFlagExperimentAndRolloutContractTest ✓ batch15 feature flag and rollout routes reject low privilege overri… 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15FormRequestAuthorizationCoverageContractTest ⨯ batch15 mutating routes do not allow public or low privilege form r… 0.04s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15GlobalSearchAndDirectoryEnumerationContractTest ✓ batch15 global search directory and lookup routes resist enumeratio… 0.17s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch15LocalizationContentDirectionAndEncodingContractTest ✓ batch15 rtl unicode and encoding payloads remain controlled across… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15MetadataFilteringAndSparseFieldsetSecurityContractTest ⨯ batch15 sparse fieldsets metadata and embeds do not reveal sensitiv… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15RateLimitAndAbusePatternContractTest ⨯ batch15 repeated sensitive requests return controlled responses wit… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15RegressionUltraSweepTest ⨯ batch15 ultra sweep keeps cross domain hostile payloads under contr… 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15ReportDrilldownAndAggregatePrivacyContractTest ⨯ batch15 report drilldown filters do not allow scope escape or sensi… 0.11s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15RouteParameterPoisoningExpansionTest ⨯ batch15 route parameters reject encoded path script and type confus… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch15StudentSafetyIncidentEscalationContractTest ⨯ batch15 safety incident escalation routes are not mutable by parent… 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch16AccessibilityAndClientHintsContractTest ✓ batch16 client hints accessibility headers and locale variants do n… 0.11s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16AdaptivePublicEndpointAbuseContractTest ⨯ batch16 public endpoints ignore identity spoofing and privileged qu… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16DeviceTrustAndScannerReplayContractTest ⨯ batch16 kiosk scanner and device routes do not trust client asserte… 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16EmergencyContactAndPickupSafetyContractTest ⨯ batch16 pickup guardian and emergency contact routes reject wrong f… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16EventualConsistencyAndRetryContractTest ⨯ batch16 retry headers and client operation ids are scoped per actor… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16ImportPreviewCommitSeparationContractTest ⨯ batch16 import preview payloads cannot force commit or skip validat… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch16MoneyPrecisionCurrencyContractTest ✓ batch16 money routes reject precision currency and rounding abuse c… 0.33s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16MultiStepWorkflowCompensationContractTest ⨯ batch16 multi step school operations fail safely when later steps a… 0.03s ⨯ batch16 compensation flags cannot be user supplied by low privilege… 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16NotificationDeliverySuppressionContractTest ⨯ batch16 notification suppression and delivery flags cannot be overr… 0.07s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch16OptimisticLockingAndVersionFieldContractTest ✓ batch16 version and lock fields cannot be forged to override newer… 0.05s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch16PermissionDriftDetectionContractTest ✓ batch16 permission names and route families do not drift into ungua… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16ReadModelProjectionConsistencyContractTest ⨯ batch16 summary dashboard and projection routes resist privileged i… 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16RegressionHyperSweepTest ⨯ batch16 hyper sweep applies cross cutting hostile payloads to high… 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch16RouteGraphInvariantRegisterTest ✓ batch16 route graph has contract pressure for new risk families 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16SchemaEvolutionDeprecationContractTest ⨯ batch16 deprecated aliases remain controlled and do not return inco… 0.03s ⨯ batch16 removed or deprecated fields are not required for current c… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch16TemporalConsistencyAndClockSkewContractTest ⨯ batch16 clock skew and temporal boundaries do not bypass business r… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17AcademicPrerequisiteAndDependencyContractTest ⨯ academic actions do not skip required prerequisites or locks 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17ApiContractDiffAndCriticalKeyRegisterTest ⨯ critical identity finance attendance and academic payloads keep con… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch17AttendanceTamperWindowContractTest ✓ attendance cutoff backdate future and reason requirements are contr… 0.13s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17CommunicationRecipientExpansionContractTest ⨯ message broadcast and notification recipient scope cannot be expand… 0.07s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch17DataLineageAndSourceAttributionContractTest ✓ client supplied lineage and audit source fields are not authoritati… 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17ExportColumnLevelSecurityContractTest ⨯ export field selection cannot request secrets or cross scope column… 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17ExternalIdAndNaturalKeyCollisionContractTest ⨯ external ids student numbers and emails are not cross domain author… 0.06s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch17FinancialPeriodCloseAndAdjustmentContractTest ✓ closed period adjustments writeoffs and credit transfers are guarde… 0.08s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch17InventoryAssetCustodyContractTest ✓ inventory asset custody transfers and disposal are not client autho… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17MultiGuardBoundaryContractTest ⨯ api guard boundaries are not crossed by session or web identity 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17PartialFailureErrorDetailRedactionContractTest ⨯ bulk partial failure details are actionable without leaking databas… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17PerResourceRateLimitIdentityContractTest ⨯ repeated sensitive actions are scoped by actor resource and operati… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17RegressionOmegaSweepTest ⨯ batch17 omega sweep combines headers payloads queries and route par… 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch17SearchRankingAndPermissionFilterContractTest ✓ search autocomplete and lookup do not bypass permission filters 0.18s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch17StudentIdentityMergeSplitContractTest ✓ merge split and duplicate student identity routes reject unsafe pay… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch17ZeroTrustInternalHeaderContractTest ⨯ internal proxy and service headers do not grant privilege 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18ApiKeyServiceAccountAndMachineIdentityContractTest ⨯ batch18 apikeyserviceaccountandmachineidentity stays controlled 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18CanonicalIdentifierImmutabilityContractTest ⨯ batch18 canonicalidentifierimmutability stays controlled 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch18ClassCapacityWaitlistAndScheduleConflictContractTest ✓ batch18 classcapacitywaitlistandscheduleconflict stays controlled 0.15s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18ConsentRevocationAndCommunicationComplianceContractTest ⨯ batch18 consentrevocationandcommunicationcompliance stays controlle… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18CrossModuleBusinessInvariantRegisterTest ⨯ batch18 business invariant route families remain present 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18ExportWatermarkAndAuditabilityContractTest ⨯ batch18 exportwatermarkandauditability stays controlled 0.09s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch18FeatureEntitlementAndLicenseBoundaryContractTest ✓ batch18 featureentitlementandlicenseboundary stays controlled 0.15s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch18FileVirusScanAndQuarantineContractTest ✓ batch18 filevirusscanandquarantine stays controlled 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18FinanceChargebackDisputeContractTest ⨯ batch18 financechargebackdispute stays controlled 0.08s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch18OrphanedRecordAndCascadeBoundaryContractTest ✓ batch18 orphanedrecordandcascadeboundary stays controlled 0.19s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18PrivilegeBoundaryAfterRoleMutationContractTest ⨯ batch18 privilegeboundaryafterrolemutation stays controlled 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18RegressionFinalitySweepTest ⨯ batch18 combined hostile payload sweep stays controlled 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18ReportDrillthroughAndRowLevelSecurityContractTest ⨯ batch18 reportdrillthroughandrowlevelsecurity stays controlled 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18StudentMedicalAndSafetyDataMinimizationContractTest ⨯ batch18 studentmedicalandsafetydataminimization stays controlled 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18TemporalAuditAndTimezoneForgeryContractTest ⨯ batch18 temporalauditandtimezoneforgery stays controlled 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch18TwoPersonApprovalAndSegregationContractTest ✓ batch18 twopersonapprovalandsegregation stays controlled 0.11s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch18WebhookOrderingAndOutOfSequenceContractTest ⨯ batch18 webhookorderingandoutofsequence stays controlled 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19AggregateDashboardScopeContractTest ⨯ batch19 aggregate dashboard scope stays controlled 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch19AppendOnlyAuditLedgerContractTest ✓ batch19 append only audit ledger stays controlled 0.17s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19AttendanceExcuseDocumentLifecycleContractTest ⨯ batch19 attendance excuse document lifecycle stays controlled 0.18s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19AttributeBasedAccessConditionContractTest ⨯ batch19 attribute based access condition stays controlled 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch19BackupRestoreIsolationContractTest ✓ batch19 backup restore isolation stays controlled 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19ClassTransferTranscriptContinuityContractTest ⨯ batch19 class transfer transcript continuity stays controlled 0.14s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19CommunicationBounceAndSuppressionWebhookContractTest ⨯ batch19 communication bounce and suppression webhook stays controll… 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19CustodyRestrictionPickupAuthorizationContractTest ⨯ batch19 custody restriction pickup authorization stays controlled 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19NestedRelationshipRedactionContractTest ⨯ batch19 nested relationship redaction stays controlled 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch19OperationalAndPrivacyInvariantRegisterTest ✓ batch19 operational and privacy route families remain present 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch19PaymentAllocationAndBalanceContractTest ✓ batch19 payment allocation and balance stays controlled 0.15s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19RefundMethodAndSettlementBoundaryContractTest ⨯ batch19 refund method and settlement boundary stays controlled 0.22s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19RegressionContinuitySweepTest ⨯ batch19 continuity and privacy sweep stays controlled 0.18s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19ReportCacheInvalidationContractTest ⨯ batch19 report cache invalidation stays controlled 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19RevokedDeletedUserTokenBoundaryContractTest ⨯ batch19 revoked deleted user token boundary stays controlled 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19TeacherSubstitutionCoverageContractTest ⨯ batch19 teacher substitution coverage stays controlled 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch19TemporaryUrlExpirationRevocationContractTest ✓ batch19 temporary url expiration revocation stays controlled 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch19ThirdPartySyncCanonicalizationContractTest ⨯ batch19 third party sync canonicalization stays controlled 0.09s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20AdminAuditExportRedactionContractTest ⨯ batch20 admin audit export redaction stays controlled 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20ApiSunsetDeprecationAndCompatibilityContractTest ⨯ batch20 api sunset deprecation and compatibility stays controlled 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20AttendanceGeofenceAndDeviceTrustContractTest ⨯ batch20 attendance geofence and device trust stays controlled 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20CashDrawerManualPaymentIntegrityContractTest ⨯ batch20 cash drawer manual payment integrity stays controlled 0.17s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch20ClassCapacityLotteryAndWaitlistContractTest ✓ batch20 class capacity lottery and waitlist stays controlled 0.31s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20ContinuityComplianceRiskRegisterTest ⨯ batch20 continuity and compliance route families remain visible 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20DataWarehouseAnalyticsExportContractTest ⨯ batch20 data warehouse analytics export stays controlled 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20EmergencyClosureBroadcastContractTest ⨯ batch20 emergency closure broadcast stays controlled 0.09s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20GradebookLockAndAmendmentContractTest ⨯ batch20 gradebook lock and amendment stays controlled 0.13s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20LegalHoldRetentionAndPurgeConflictContractTest ⨯ batch20 legal hold retention and purge conflict stays controlled 0.09s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch20MultilingualContentAndTranslationContractTest ✓ batch20 multilingual content and translation stays controlled 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20NotificationDeadLetterAndRetryContractTest ⨯ batch20 notification dead letter and retry stays controlled 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20ParentDisputeAndCustodyReviewContractTest ⨯ batch20 parent dispute and custody review stays controlled 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20ReceiptNumberingAndTaxDocumentIntegrityContractTest ⨯ batch20 receipt numbering and tax document integrity stays controll… 0.16s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20RegressionContinuityComplianceSweepTest ⨯ batch20 continuity compliance and export sweep stays controlled 0.18s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20ScholarshipRenewalAndEligibilityContractTest ⨯ batch20 scholarship renewal and eligibility stays controlled 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20SiblingFamilyDiscountAbuseContractTest ⨯ batch20 sibling family discount abuse stays controlled 0.09s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20SyntheticMonitoringAndHealthProbeContractTest ⨯ batch20 synthetic monitoring and health probe stays controlled 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiBatch20TransportationPickupRouteSafetyContractTest ✓ batch20 transportation pickup route safety stays controlled 0.09s FAIL Tests\Feature\Api\V1\FullSurface\ApiBatch20WebhookSecretRotationContractTest ⨯ batch20 webhook secret rotation stays controlled 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBulkImportExportAndPartialFailureExpansionTest ⨯ bulk routes handle mixed valid and invalid ids cleanly 0.06s ✓ import routes reject wrong file types with validation not crashes 0.02s ⨯ export download routes do not return mutating statuses 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiBusinessRuleEdgeCaseContractTest ⨯ school year semester and class mismatch payloads fail without crash… 0.13s ⨯ financial amount rules reject zero negative and precision abuse cle… 0.30s ✓ attendance status and time edge cases are controlled 0.31s PASS Tests\Feature\Api\V1\FullSurface\ApiCacheFreshnessAndConditionalRequestContractTest ✓ private authenticated resources are not publicly cacheable 0.14s ✓ conditional headers do not bypass authorization or return wrong use… 0.05s PASS Tests\Feature\Api\V1\FullSurface\ApiCalendarScheduleConflictContractTest ✓ calendar event and school schedule routes handle conflicts and inva… 0.05s ✓ calendar list routes tolerate window queries and do not leak unscop… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiClientCompatibilityVersioningContractTest ⨯ publicly registered api routes remain versioned or explicitly legac… 0.03s ✓ route names are unique enough for client generation 0.02s ✓ legacy and current auth contracts return compatible failure shapes 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiConcurrencyAndStaleWriteContractTest ⨯ duplicate update payloads remain controlled and do not throw server… 0.18s ⨯ stale if match headers do not force successful mutations 0.18s FAIL Tests\Feature\Api\V1\FullSurface\ApiContentNegotiationAndMediaTypeContractTest ⨯ json accept header receives controlled api responses across major d… 0.03s ⨯ unsupported accept headers do not trigger server errors 0.05s ⨯ malformed content type for mutations fails cleanly 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiContractCoverageHeatmapExpansionTest ✓ every major route family has a meaningful contract probe bucket 0.03s ⨯ mutating route surface is not accidentally unowned by contract suit… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiContractSnapshotSeedTest ✓ core success payloads keep contract keys when available 0.04s ✓ auth identity payload never drops user identity when successful 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiCrossModuleReferentialWorkflowExpansionTest ⨯ wrong but existing ids across modules do not silently cross link re… 0.04s PASS Tests\Feature\Api\V1\FullSurface\ApiCrossVersionRouteCompatibilityMatrixTest ✓ v1 and unversioned auth routes keep failure contract compatible 0.04s ✓ legacy routes do not expand beyond documented aliases silently 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiCsvExcelFormulaInjectionContractTest ⨯ exportable and importable text fields handle excel formula payloads 0.31s FAIL Tests\Feature\Api\V1\FullSurface\ApiDataExportLeastPrivilegeContractTest ✓ export and download routes do not grant low privilege bulk access 0.13s ⨯ export filters respect actor scope parameters 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiDataMinimizationByRoleContractTest ⨯ parent and student responses do not expose back office finance or a… 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiDataShapeBackwardCompatibilityContractTest ⨯ collection endpoints keep backward compatible envelope keys 0.03s ⨯ successful detail endpoints keep identifier or data keys 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiDatabaseTransactionRollbackContractTest ⨯ multi step mutations do not leave obvious partial records after val… 0.16s ✓ delete failures do not remove parent or student fixtures 0.19s FAIL Tests\Feature\Api\V1\FullSurface\ApiDateMoneyAndTimezoneBoundaryContractTest ⨯ date accepting endpoints reject impossible or ambiguous dates clean… 0.03s ⨯ money accepting endpoints reject negative nan and overflow amounts… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepAuthorizationIsolationMatrixTest ⨯ role isolation matrix blocks cross portal access for sensitive surf… 0.05s ✓ owner scoped parent routes do not expose another family student 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepDocumentationAndRouteParityContractTest ⨯ every named api route has a stable route name or explicit public ex… 0.02s ✓ openapi or docs catalog endpoint is reachable and route table remai… 0.03s ✓ route use case catalog covers new deep contract domains 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepFileImportExportAndPrintableContractTest ⨯ export download and printable routes are controlled for authenticat… 0.09s ✓ import upload routes accept test files or return validation without… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepIdempotencyAndDuplicateSubmissionContractTest ✓ duplicate sensitive mutations do not create uncontrolled server err… 0.17s ⨯ repeat delete or archive requests are safe to retry or fail cleanly 0.12s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepPaginationSearchAndFilterContractTest ⨯ list endpoints tolerate pagination search sort and filter parameter… 0.43s ⨯ date range filters fail cleanly when dates are invalid 0.14s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepResponseShapeAndEnvelopeContractTest ⨯ successful json api responses use parseable json envelopes across m… 0.18s ⨯ collection endpoints expose list like payloads or explicit empty st… 0.44s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepStateTransitionInvariantContractTest ⨯ school year close reopen and promotion transition routes preserve c… 0.04s ⨯ finance transition routes do not allow negative balance crashes or… 0.03s ✓ attendance transition routes keep single day student context contro… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiDeepValidationFailureContractTest ⨯ mutating routes return controlled validation or authorization for h… 0.60s ✓ required field validation uses machine readable error shape when va… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiDestructiveActionSafeguardContractTest ✓ delete routes handle missing and foreign ids without crashing 0.06s ⨯ bulk delete style routes require explicit targets 0.03s ✓ archive remove cancel and void routes are idempotent or conflict sa… 0.07s PASS Tests\Feature\Api\V1\FullSurface\ApiEmptyDatasetAndNullStateContractTest ✓ list endpoints return stable empty shapes when filters match nothin… 0.04s ✓ current school year null state is handled without crash 0.04s ✓ empty class roster and attendance context are controlled 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiEnumAndStateMachineContractTest ✓ status fields reject unknown states without defaulting to success 0.32s ⨯ terminal states are not reopened by low privilege users 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiErrorEnvelopeConsistencyContractTest ✓ not found api responses are json or controlled redirects 0.04s ⨯ validation error envelopes have machine readable fields 0.03s ⨯ authorization error envelopes do not leak stack traces 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiEtagConditionalMutationContractTest ⨯ mutating routes do not succeed silently with stale conditional head… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiFailureModeResilienceExpansionTest ⨯ mutation routes fail cleanly when required relationships are null 0.03s ⨯ mutation routes fail cleanly when relationships are strings instead… 0.03s PASS Tests\Feature\Api\V1\FullSurface\ApiFamilyPortalFullSurfaceContractTest ✓ family portal surface has controlled contracts and privacy boundari… 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiFeatureFlagAndConfigurationDriftContractTest ⨯ feature flagged routes fail closed when configuration is missing or… 0.03s ⨯ configuration mutations reject unrecognized or privileged keys from… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiFileMediaMetadataSafetyContractTest ✓ upload routes reject misleading metadata and path names cleanly 0.04s ✓ download routes do not accept path traversal identifiers 0.05s PASS Tests\Feature\Api\V1\FullSurface\ApiFinanceInventoryCommunicationsFullSurfaceContractTest ✓ back office and communications surfaces have controlled contracts 0.12s PASS Tests\Feature\Api\V1\FullSurface\ApiFrontendBackendContractParityTest ✓ frontend identity and api identity do not drift apart 0.04s ✓ login aliases return compatible token and user contracts 0.04s ✓ frontend bootstrap routes do not require admin privilege when they… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiFullSurfaceEndToEndContractTest ⨯ every registered api route has a controlled e2e contract response 0.88s ⨯ all mutating api routes reject empty or malformed payloads without… 0.51s ⨯ portal routes enforce wrong actor boundaries across the full surfac… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiHtmlJavaScriptEscapingContractTest ⨯ text fields accept or reject script payloads without reflecting exe… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiHttpSemanticsAndMethodSafetyContractTest ⨯ get routes do not accept mutating payloads as state changes 0.04s ⨯ wrong methods fail with controlled statuses not framework explosion… 0.04s ✓ delete routes do not require json body to be safe 0.06s FAIL Tests\Feature\Api\V1\FullSurface\ApiIdempotencyScopeAndReplayContractTest ⨯ same idempotency key cannot be replayed across unrelated routes to… 0.04s ⨯ idempotency keys with control characters are rejected or ignored cl… 0.05s WARN Tests\Feature\Api\V1\FullSurface\ApiImpersonationDelegationAndActingAsContractTest ! impersonation and delegation routes are admin only and auditable →… 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiImportTemplateAndCsvContractTest ✓ import routes reject malformed csv rows without server errors 0.04s ⨯ template download routes are not public when templates include priv… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiLegacyCurrentAliasParityExpansionTest ✓ auth aliases return compatible login shapes 0.03s ✓ legacy teacher aliases and current v1 teacher routes have compatibl… 0.04s ✓ legacy non versioned routes do not drift into 5xx 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiLocalizationAndLocaleFallbackContractTest ⨯ supported and unsupported accept language headers stay controlled 0.02s ⨯ timezone parameters do not corrupt attendance or finance queries 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiMassAssignmentAndOverpostingContractTest ⨯ write endpoints ignore or reject privilege escalation fields 0.03s ⨯ parent and teacher cannot overpost owner ids to reassign records 0.08s FAIL Tests\Feature\Api\V1\FullSurface\ApiMigrationSafeDefaultContractTest ✓ core routes survive missing optional configuration rows 0.06s ⨯ routes handle missing optional school year context with controlled… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiMobileClientToleranceContractTest ⨯ api routes handle mobile headers without contract drift 0.04s ⨯ api routes handle offline retry headers without duplicate server er… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiModelLifecycleInvariantExpansionTest ⨯ create update show index lifecycle routes remain controlled for cor… 0.11s ⨯ identity fields are not overwritten by update payloads 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiMutationReadAfterWriteConsistencyContractTest ⨯ created resources return identifier or location to support follow u… 0.06s ⨯ update successes preserve resource identity when identity is presen… 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiNestedPayloadAndArrayAbuseContractTest ⨯ mutation routes fail cleanly for deeply nested payloads 0.04s ⨯ mutation routes fail cleanly for large sparse arrays 0.07s PASS Tests\Feature\Api\V1\FullSurface\ApiNotificationMessagingDeliveryContractTest ✓ message notification and broadcast routes validate recipients and c… 0.07s ✓ read archive star and delete message actions are idempotent 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiNotificationPreferenceAndOptOutContractTest ⨯ notification preference routes validate channels recipients and opt… 0.14s ⨯ low privilege users cannot broadcast notifications to everyone 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiNullBooleanAndTypeCoercionContractTest ⨯ mutation routes handle null false zero and string booleans without… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiObservabilityRequestIdAndLoggingContractTest ⨯ api accepts correlation ids without echoing unsafe values 0.02s ⨯ malformed request ids do not break error handling 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiOpenApiDocumentationDriftContractTest ✓ api surface has documentation entry points and route inventory rema… 0.03s ✓ named api routes use stable names when names exist 0.02s ⨯ documented routes do not point to missing actions 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiOpenRedirectAndReturnUrlContractTest ⨯ login and navigation routes do not accept external return urls 0.03s ⨯ redirect like query parameters do not poison get responses 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiOperationalEndpointExposureContractTest ⨯ operational debug and maintenance routes are not publicly exposed w… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiOperationalResiliencePayloadSizeContractTest ⨯ mutating routes reject huge payloads and deep arrays without memory… 0.06s ⨯ get routes reject abusive include expand and field lists cleanly 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiOwnerBoundaryAndPrivacyExpansionTest ⨯ parent family endpoints do not expose other parent records 0.02s ✓ teacher class endpoints do not expose unassigned class records 0.04s ✓ serialized users do not leak sensitive auth material 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiPaginationCursorAndOffsetAbuseContractTest ⨯ list routes handle cursor offset and per page abuse without crashin… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiPermissionMatrixExhaustiveContractTest ✓ core domain permission matrix is enforced across roles 0.05s ⨯ admin only mutations are not available to lower roles 0.03s ⨯ student role cannot access parent teacher or admin portals 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiPolicyAuthorizationDiscoveryContractTest ⨯ protected mutation routes are not publicly mutable 0.03s ✓ permission like routes reject wildcards from non admins 0.04s PASS Tests\Feature\Api\V1\FullSurface\ApiPolymorphicOwnershipBoundaryContractTest ✓ owner type and owner id fields cannot be overposted by low privileg… 0.06s ✓ cross actor owner queries do not return private data 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiPrivacyRetentionAndErasureContractTest ! erasure archive and privacy routes are never publicly mutable → Thi… 0.03s ⨯ privacy related exports do not leak sensitive user fields 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiPublicAndAuthFullSurfaceContractTest ⨯ public and auth surface has stable contracts 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiPublicPrivateCacheSeparationContractTest ⨯ authenticated private routes do not emit public cache headers 0.02s ⨯ conditional cache headers do not bypass authorization 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiQueryParameterFuzzingContractTest ✓ collection endpoints handle hostile query parameters without 5xx 0.10s ✓ date range endpoints reject inverted or impossible ranges cleanly 0.05s ✓ sorting contract does not allow raw sql fragments 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiQueueJobAndAsyncTriggerContractTest ⨯ async trigger routes are admin or owner scoped and fail cleanly 0.03s ✓ async triggers tolerate duplicate client request ids 0.07s PASS Tests\Feature\Api\V1\FullSurface\ApiRateLimitTokenAndSessionHardeningContractTest ✓ repeated bad login attempts stay controlled and never return a toke… 0.06s ✓ expired or garbage bearer tokens are rejected without fallback iden… 0.08s ✓ logout is safe to repeat and does not leak token state 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiReferentialIntegrityAndForeignKeyContractTest ⨯ mutations with missing foreign keys fail cleanly not with database… 0.04s ✓ delete routes for parent records protect children or fail cleanly 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiRelationshipCardinalityContractTest ⨯ routes expect single ids do not crash when receiving arrays or obje… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiReportConsistencyAndAggregationExpansionTest ⨯ report routes handle date window filter and group by combinations 0.10s ⨯ parent and teacher report access is scoped not global 0.10s FAIL Tests\Feature\Api\V1\FullSurface\ApiReportExportPrivacyAndAggregationContractTest ⨯ teacher and parent report exports are scoped to their assignments 0.08s ⨯ aggregate dashboard numbers do not include other family details for… 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiReportMathAndFinancialInvariantContractTest ✓ financial endpoints reject non decimal and currency confusion input… 0.30s ⨯ report filters do not create negative or impossible aggregation win… 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiRequestHeaderSpoofingContractTest ⨯ forwarded and override headers do not bypass authorization 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiRoleWorkflowNegativeMatrixContractTest ⨯ each non admin actor is blocked from administrative mutations 0.08s ⨯ actor specific read routes do not collapse into admin visible data 0.02s ✓ suspended disabled or unverified users do not gain api access 0.05s FAIL Tests\Feature\Api\V1\FullSurface\ApiRouteNamingVersioningAndHygieneTest ✓ api routes do not use debug or temporary names 0.02s ⨯ versioned api routes stay inside v1 or documented legacy aliases 0.02s ✓ duplicate uri method pairs do not exist 0.03s ✓ route placeholders use consistent identifier names 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiRouteParameterAbuseContractTest ⨯ parameterized routes reject path traversal and script values cleanl… 0.04s ⨯ parameterized routes fail cleanly for overflowing integer ids 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiRouteUseCaseCatalogCompletenessTest ⨯ every api route is owned by an explicit user journey 0.03s ✓ each declared journey has at least one registered route 0.01s FAIL Tests\Feature\Api\V1\FullSurface\ApiSchemaKeyStabilityExpansionContractTest ⨯ core resource success payloads keep identity and display keys 0.05s ⨯ error payloads keep client actionable fields 0.30s FAIL Tests\Feature\Api\V1\FullSurface\ApiSchoolCalendarAcademicBoundaryExpansionTest ⨯ academic routes reject dates outside school year without server err… 0.03s ⨯ semester and term values are not free form privilege channels 0.02s FAIL Tests\Feature\Api\V1\FullSurface\ApiSchoolOperationsRegressionBackstopTest ⨯ administrator can probe core school operations without route level… 0.04s ⨯ user facing portals have at least one reachable read contract per a… 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiSearchIndexAndAutocompleteContractTest ✓ search autocomplete and lookup routes handle empty short and hostil… 0.06s ✓ cross domain search does not bypass role scope 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiSecurityAndTransportContractTest ⨯ authenticated api routes do not accept plain browser session assump… 0.04s ⨯ state changing api routes reject wrong http method cleanly 0.03s ✓ options preflight for major domains is controlled 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiSerializationSensitiveDataRedactionContractTest ✓ successful api responses never serialize sensitive user or payment… 0.16s ⨯ error responses do not echo credentials or uploaded file contents 0.06s PASS Tests\Feature\Api\V1\FullSurface\ApiSoftDeleteRestoreArchiveLifecycleContractTest ✓ archive restore and unarchive routes are controlled and role protec… 0.04s ✓ destructive soft delete style routes tolerate repeated requests 0.04s FAIL Tests\Feature\Api\V1\FullSurface\ApiSortingFieldSelectionAndIncludeContractTest ⨯ list routes handle sort fields includes and sparse fieldsets 0.07s FAIL Tests\Feature\Api\V1\FullSurface\ApiTenantSchoolYearAndSemesterIsolationContractTest ⨯ school year scoped routes reject foreign or closed school year cont… 0.02s ⨯ cross school year filters do not return unscoped private data 0.02s PASS Tests\Feature\Api\V1\FullSurface\ApiTimezoneCalendarRecurrenceDepthContractTest ✓ calendar and schedule routes reject ambiguous recurrence and timezo… 0.28s FAIL Tests\Feature\Api\V1\FullSurface\ApiUnicodeNormalizationAndInputContractTest ⨯ text inputs accept or reject unicode cleanly without corrupting jso… 0.04s ⨯ emails and phone fields reject visually confusable values cleanly 0.05s PASS Tests\Feature\Api\V1\FullSurface\ApiUrlFetchSsrfAndCallbackSafetyContractTest ✓ url accepting routes reject internal network targets cleanly 0.12s PASS Tests\Feature\Api\V1\FullSurface\ApiWebhookExternalProviderAndCallbackContractTest ✓ external callback routes reject unsigned or malformed payloads 0.02s ✓ external provider status routes never expose provider secrets 0.05s PASS Tests\Feature\Api\V1\FullSurface\ApiWebhookReplayAndSignatureDepthContractTest ✓ external callback routes reject missing bad and replayed signatures… 0.03s FAIL Tests\Feature\Api\V1\FullSurface\ApiWriteAuditAndTimestampContractTest ⨯ successful create responses expose identifier or resource envelope 0.11s ⨯ successful write responses do not emit broken timestamp fields 0.03s ⨯ audit like routes are not publicly mutable 0.04s FAIL Tests\Feature\Api\V1\Grading\GradingControllerTest ⨯ overview returns grading data 0.01s ⨯ toggle lock locks section 0.01s FAIL Tests\Feature\Api\V1\Grading\HomeworkTrackingControllerTest ⨯ index returns tracking payload 0.02s FAIL Tests\Feature\Api\V1\Incidents\IncidentControllerTest ⨯ current returns incidents and grades 0.01s ⨯ store and close moves incident to history 0.01s PASS Tests\Feature\Api\V1\Inventory\InventoryCategoriesControllerTest ✓ index returns categories 0.03s ✓ store creates category 0.02s ✓ update changes category 0.02s ✓ destroy deletes category 0.03s ✓ validation fails 0.02s FAIL Tests\Feature\Api\V1\Inventory\InventoryItemsControllerTest ✓ index returns items 0.03s ✓ show returns item 0.02s ✓ store creates item 0.02s ✓ update changes item 0.03s ✓ destroy deletes item 0.02s ✓ audit updates classroom item 0.02s ✓ adjust creates movement 0.03s ✓ summary returns aggregates 0.02s ✓ summary all returns rows 0.03s ⨯ teacher distribution endpoints 0.02s ✓ validation fails for store 0.02s ✓ requires authentication 0.01s PASS Tests\Feature\Api\V1\Inventory\InventoryMovementsControllerTest ✓ index returns movements 0.02s ✓ store creates movement 0.02s ✓ update changes movement 0.03s ✓ destroy deletes movement 0.02s ✓ bulk delete removes movements 0.02s PASS Tests\Feature\Api\V1\Inventory\SuppliersControllerTest ✓ index returns suppliers 0.03s ✓ store creates supplier 0.02s ✓ update changes supplier 0.01s ✓ destroy deletes supplier 0.02s PASS Tests\Feature\Api\V1\Inventory\SupplyCategoriesControllerTest ✓ index returns categories 0.02s ✓ store creates category 0.03s ✓ update changes category 0.02s ✓ destroy deletes category 0.02s PASS Tests\Feature\Api\V1\Messaging\MessagesControllerTest ✓ inbox requires auth 0.03s ✓ store creates message 0.02s ✓ show marks read 0.02s ✓ update changes status 0.03s ✓ destroy marks trashed 0.02s ✓ recipients teacher returns list 0.01s ✓ validation rejects missing subject 0.03s ✓ show forbidden for other users 0.02s FAIL Tests\Feature\Api\V1\Notifications\NotificationControllerTest ✓ index requires authentication 0.03s ✓ index returns notifications 0.02s ✓ show returns notification 0.02s ⨯ store creates notification 0.02s ✓ store validates payload 0.02s ✓ store handles service exception 0.02s ✓ mark read updates user notification 0.03s ✓ active and deleted lists 0.02s ✓ update and delete notification 0.02s ✓ restore notification 0.03s FAIL Tests\Feature\Api\V1\Parents\AuthorizedUsersControllerTest ✓ index requires authentication 0.02s ✓ index is forbidden for non parent users 0.03s ⨯ index returns only the parents own authorized users 0.02s ✓ show returns 404 for unknown authorized user 0.02s ⨯ show returns 404 for another parents authorized user 0.03s ⨯ destroy deletes the parents authorized user 0.02s ⨯ parent cannot delete another parents authorized user 0.02s FAIL Tests\Feature\Api\V1\Parents\ParentAttendanceReportControllerTest ⨯ form returns students and sundays 0.03s ⨯ submit creates report and attendance 0.02s ⨯ check existing returns rows 0.02s ⨯ update report updates reason 0.03s FAIL Tests\Feature\Api\V1\Parents\ParentControllerTest ⨯ attendance returns rows 0.02s ⨯ registration creates student and contact 0.03s PASS Tests\Feature\Api\V1\PrintRequests\PrintRequestsWorkflowTest ✓ teacher can create hand copy request and admin can advance statuses 0.02s ✓ admin status rejects invalid transition 0.02s ✓ teacher routes reject non teacher roles and admin routes reject tea… 0.03s ✓ teacher cannot update delete or download another teachers request 0.02s ✓ teacher cannot delete request after processing has started 0.01s ✓ upload requires valid file and page selection format 0.03s ✓ teacher can upload and download own file and admin can download any… 0.02s FAIL Tests\Feature\Api\V1\Promotions\ParentPromotionControllerTest ⨯ overview returns actionable records for parent 0.02s ⨯ parent completes full enrollment flow 0.03s ⨯ parent cannot view other parents promotion 0.02s ✓ unauthenticated request is unauthorized 0.01s PASS Tests\Feature\Api\V1\Public\PublicWinnersControllerTest ✓ competition index is public and returns published competitions 0.03s ✓ competition index returns empty collection when none published 0.01s ✓ competition show returns payload for published competition 0.01s ✓ competition show returns 404 for unknown competition 0.02s ✓ competition show returns 404 for unpublished competition 0.01s PASS Tests\Feature\Api\V1\Reports\FilesControllerTest ✓ receipt meta returns file payload 0.02s ✓ exam draft teacher streams with download name 0.03s FAIL Tests\Feature\Api\V1\Reports\ReportCardsControllerTest ⨯ meta returns expected payload 0.02s ⨯ completeness returns summary and students 0.03s ⨯ acknowledgement returns record 0.01s ⨯ student report returns pdf 0.01s ⨯ class report returns pdf 0.01s ⨯ student report returns error when missing scores 0.03s ✓ completeness requires class section id 0.02s ✓ acknowledgement requires student id 0.03s ✓ requires authentication 0.01s PASS Tests\Feature\Api\V1\Reports\SlipPrinterControllerTest ✓ preview returns text 0.02s ✓ print creates log and returns pdf 0.08s ✓ logs returns rows 0.02s FAIL Tests\Feature\Api\V1\Reports\StickersControllerTest ⨯ form data returns classes students and presets 0.03s ⨯ students by class returns students 0.01s ⨯ print returns pdf 0.01s ✓ print validation rejects missing selection 0.03s ✓ requires authentication 0.01s FAIL Tests\Feature\Api\V1\Roles\RolePermissionControllerTest ✓ roles index returns roles 0.03s ✓ store role creates role 0.02s ✓ update role updates role 0.02s ✓ delete role removes role 0.01s ✓ users index returns users with roles 0.03s ✓ assign roles updates user roles 0.02s ✓ permissions crud 0.03s ✓ role permissions update 0.02s ✓ validation rejects invalid role payload 0.02s ⨯ store role returns error on service exception 0.02s ✓ requires authentication 0.03s PASS Tests\Feature\Api\V1\Roles\RoleSwitcherControllerTest ✓ index returns roles 0.02s ✓ switch sets role 0.03s ✓ requires authentication 0.01s ✓ switch rejects role that user does not have 0.02s ✓ switch validates empty role payload 0.03s ✓ index returns not found when authenticated user has no roles 0.01s PASS Tests\Feature\Api\V1\ScannerControllerTest ✓ process requires a badge code 0.03s ✓ process returns 404 for unknown badge 0.01s ✓ process accepts alternative badge field names 0.01s PASS Tests\Feature\Api\V1\SchoolYears\SchoolYearControllerTest ✓ preview close returns promotion and balance preview 0.03s ✓ admin can create draft school year via api 0.02s ✓ admin can update draft school year via api 0.02s ✓ close school year creates new active year enrollment and balance tr… 0.04s ✓ closed school year blocks legacy invoice generation 0.03s PASS Tests\Feature\Api\V1\Scores\FinalControllerTest ✓ index returns final scores 0.03s PASS Tests\Feature\Api\V1\Scores\HomeworkControllerTest ✓ index returns homework scores 0.02s PASS Tests\Feature\Api\V1\Scores\MidtermControllerTest ✓ index returns midterm scores 0.03s PASS Tests\Feature\Api\V1\Scores\ParticipationControllerTest ✓ index returns participation scores 0.02s PASS Tests\Feature\Api\V1\Scores\ProjectControllerTest ✓ index returns project scores 0.03s PASS Tests\Feature\Api\V1\Scores\QuizControllerTest ✓ index returns quiz scores 0.02s PASS Tests\Feature\Api\V1\Scores\ScoreCommentControllerTest ✓ store rejects short comment 0.03s ✓ index returns comments 0.02s PASS Tests\Feature\Api\V1\Scores\ScoreControllerTest ✓ overview returns students 0.03s ✓ lock creates grading lock 0.02s FAIL Tests\Feature\Api\V1\Scores\ScorePredictorControllerTest ⨯ index returns predictions 0.03s PASS Tests\Feature\Api\V1\Settings\ConfigurationControllerTest ✓ index returns configs 0.02s ✓ store creates config 0.03s FAIL Tests\Feature\Api\V1\Settings\EventControllerTest ✓ index requires authentication 0.02s ✓ index returns events 0.03s ⨯ store creates event 0.02s ✓ store requires authentication 0.01s ✓ store validates payload 0.03s ✓ store handles service exception 0.02s ✓ update updates event 0.02s ⨯ destroy deletes event 0.03s ⨯ charges list returns data 0.01s ⨯ update charges updates participation 0.02s ⨯ students with charges returns students 0.03s PASS Tests\Feature\Api\V1\Settings\PolicyControllerTest ✓ school policy endpoint returns payload 0.02s ✓ picture policy endpoint returns payload 0.01s FAIL Tests\Feature\Api\V1\Settings\PreferencesControllerTest ⨯ show returns defaults 0.03s ⨯ store creates preferences 0.01s ⨯ list requires admin 0.01s ⨯ list returns rows for admin 0.03s ⨯ update for user by admin 0.02s ⨯ destroy requires admin 0.01s ⨯ destroy deletes preferences 0.03s ⨯ store validates payload 0.01s FAIL Tests\Feature\Api\V1\Settings\SchoolCalendarControllerTest ✓ options returns event types and defaults 0.02s ✓ index returns events and meetings 0.03s ✓ show returns event 0.02s ✓ store creates event 0.03s ⨯ update updates event 0.02s ✓ destroy deletes event 0.01s ✓ store validation rejects invalid payload 0.01s ⨯ store returns error on service exception 0.03s ✓ requires authentication 0.01s PASS Tests\Feature\Api\V1\Settings\SettingsControllerTest ✓ index requires admin 0.03s ✓ index returns settings 0.02s ✓ update validation rejects bad email 0.01s ✓ update persists settings 0.03s PASS Tests\Feature\Api\V1\Staff\StaffControllerTest ✓ index requires admin 0.02s ✓ index returns staff 0.03s ✓ store creates staff 0.02s ✓ store validation 0.01s ✓ update modifies staff 0.02s ✓ destroy deletes staff 0.03s FAIL Tests\Feature\Api\V1\Students\StudentControllerTest ✓ assign and remove class 0.02s ⨯ score card returns rows 0.01s ✓ store creates emergency contact for first parent 0.03s ✓ index returns students without parent filter 0.02s PASS Tests\Feature\Api\V1\Subjects\SubjectCurriculumControllerTest ✓ index returns entries 0.03s ✓ store creates entry 0.02s PASS Tests\Feature\Api\V1\Support\ContactControllerTest ✓ send requires valid payload 0.03s ✓ send returns success 0.01s PASS Tests\Feature\Api\V1\Support\SupportControllerTest ✓ index requires auth 0.01s ✓ index returns requests 0.03s ✓ store validation 0.02s ✓ store creates request 0.02s PASS Tests\Feature\Api\V1\System\DashboardControllerTest ✓ route requires authentication 0.03s ✓ route returns dashboard for role 0.01s PASS Tests\Feature\Api\V1\System\DatabaseHealthControllerTest ✓ db check returns ok 0.03s FAIL Tests\Feature\Api\V1\System\HealthControllerTest ⨯ health returns payload 0.01s FAIL Tests\Feature\Api\V1\System\NavBuilderControllerTest ✓ menu returns items for roles 0.02s ✓ data requires admin 0.03s ✓ store creates nav item 0.02s ⨯ delete removes nav item 0.02s ⨯ reorder updates items 0.03s FAIL Tests\Feature\Api\V1\System\SchoolIdControllerTest ✓ generate student returns id 0.02s ✓ generate user returns id 0.03s ⨯ assign sets user school id 0.01s FAIL Tests\Feature\Api\V1\System\SemesterRangeControllerTest ⨯ school year range uses config dates 0.03s ⨯ resolve returns semester for date 0.01s PASS Tests\Feature\Api\V1\System\StatsControllerTest ✓ stats require authentication 0.01s ✓ stats index returns rows for authenticated user 0.03s ✓ stats index returns empty array when no stats 0.01s FAIL Tests\Feature\Api\V1\Teachers\TeacherControllerTest ⨯ classes returns students and assignments 0.03s ⨯ switch class returns active id 0.01s ✓ absence submit creates staff attendance 0.02s PASS Tests\Feature\Api\V1\Ui\UiControllerTest ✓ style requires auth 0.03s ✓ style updates preferences 0.01s PASS Tests\Feature\Api\V1\Users\UserControllerTest ✓ user list returns users with roles 0.03s ✓ create user creates user and role 0.33s ✓ login activity returns paginated results 0.02s PASS Tests\Feature\Api\V1\Utilities\PhoneFormatterControllerTest ✓ format returns formatted phone 0.03s ✓ format rejects invalid number 0.01s ✓ format validates payload 0.02s PASS Tests\Feature\Api\V1\Utilities\ProofreadControllerTest ✓ proofread requires authentication 0.03s ✓ proofread rejects empty text 0.01s ✓ proofread rejects text that is too long 0.01s ✓ proofread proxies languagetool and returns result 0.05s ✓ proofread returns 502 when upstream fails 0.01s FAIL Tests\Feature\Api\V1\Whatsapp\WhatsappInviteControllerTest ⨯ parent contacts endpoint returns contacts 0.02s ⨯ parent contacts by class endpoint returns sections 0.03s ⨯ send invites returns success when listener registered 0.01s ⨯ send invites returns error when no listener 0.01s ⨯ membership update saves record 0.03s ✓ send invites validation rejects payload 0.01s PASS Tests\Feature\Api\V1\Whatsapp\WhatsappLinkControllerTest ✓ index returns paginated links 0.03s ✓ show returns single link 0.02s ✓ store creates link 0.02s ✓ update updates link 0.01s ✓ destroy deletes link 0.03s ✓ store validation rejects invalid payload 0.02s ✓ requires authentication 0.01s FAIL Tests\Feature\Api\V1\Workflows\ScenarioAFamilyEnrollmentTest ⨯ admin onboards family through active enrollment 0.36s ⨯ parent cannot update unrelated student 0.02s PASS Tests\Feature\Api\V1\Workflows\ScenarioBSundaySchoolDayTest ✓ teacher submits attendance and parent views report 0.04s ✓ teacher cannot submit attendance for unassigned class 0.02s ✓ admin views daily attendance summary 0.04s PASS Tests\Feature\Api\V1\Workflows\ScenarioCAcademicTermTest ✓ teacher enters scores admin locks grading and report card is genera… 0.03s ✓ teacher invalid homework score is rejected 0.04s FAIL Tests\Feature\Api\V1\Workflows\ScenarioDFamilyBillingTest ⨯ admin runs invoice discount payment and reporting workflow 0.03s PASS Tests\Feature\Api\V1\Workflows\ScenarioEFinanceEdgeTest ✓ admin carries forward balance and manages installments 0.05s PASS Tests\Feature\Api\V1\Workflows\ScenarioFTeacherSubmissionTest ✓ admin detects missing submission and notifies teacher 0.04s ✓ duplicate notify requires valid payload 0.02s PASS Tests\Feature\Api\V1\Workflows\ScenarioGPrintBadgeTest ✓ print request badge log and scan workflow 0.04s PASS Tests\Feature\Api\V1\Workflows\ScenarioHSecurityUnauthorizedAccessTest ✓ cross role and anonymous access is blocked 0.05s FAIL Tests\Feature\Api\V1\Workflows\ScenarioIPublicAuthAndSystemUseCaseTest ⨯ guest can use public content contact and health endpoints without a… 0.01s ✓ user can login read current profile and logout through api 0.04s ✓ invalid inactive and suspended login paths fail safely 0.02s PASS Tests\Feature\Api\V1\Workflows\ScenarioJCrossModuleApiUseCaseSmokeTest ✓ admin can reach core operational dashboards without server errors 0.06s ✓ major mutating use cases validate bad payloads instead of crashing 0.04s FAIL Tests\Feature\Api\V1\Workflows\ScenarioKParentSelfServiceAndPrivacyTest ✓ parent reviews household data and updates contact details 0.05s ⨯ parent cannot mutate another family student or emergency contact 0.02s FAIL Tests\Feature\Api\V1\Workflows\ScenarioLTeacherAcademicOperationsTest ⨯ teacher manages class progress and homework scores end to end 0.04s ✓ unassigned teacher cannot view or update another teachers progress… 0.04s FAIL Tests\Feature\Api\V1\Workflows\ScenarioMAdministratorEnrollmentAndClassOperationsTest ⨯ admin builds classroom roster from parent registration to teacher a… 0.33s ✓ admin can reverse roster and teacher assignments without orphaning… 0.34s FAIL Tests\Feature\Api\V1\Workflows\ScenarioNCommunicationsAndSupportLifecycleTest ⨯ parent and teacher exchange message and read state is preserved 0.04s ⨯ public contact support ticket and admin support queue are connected 0.02s PASS Tests\Feature\Api\V1\Workflows\ScenarioOInventoryFinanceAndAuditControlsTest ✓ admin tracks inventory item from creation to adjustment and summary 0.04s ✓ finance followup records notes promises and resolution for unpaid p… 0.03s FAIL Tests\Feature\Api\V1\Workflows\ScenarioPSettingsConfigurationAndCalendarGovernanceTest ✓ admin manages calendar event configuration and notification lifecyc… 0.04s ⨯ configuration admin crud keeps school year context explicit 0.03s PASS Tests\Feature\Api\V1\Workflows\ScenarioQSchoolYearPromotionClosureLifecycleTest ✓ admin and parent work through promotion before year close 0.03s ✓ admin previews closes and reopens school year with balance transfer… 0.03s FAIL Tests\Feature\Api\V1\Workflows\ScenarioRAttendanceOperationsAndExceptionHandlingTest ✓ teacher admin and staff handle attendance day end to end 0.05s ⨯ early dismissal late slip and violation tracking are connected 0.03s ⨯ attendance comment templates support create update delete and legac… 0.03s FAIL Tests\Feature\Api\V1\Workflows\ScenarioSScoringGradingAndReportCardLifecycleTest ⨯ teacher records every score type and admin reviews grading outputs 0.05s ⨯ grading locks and below sixty intervention are visible and mutable 0.04s FAIL Tests\Feature\Api\V1\Workflows\ScenarioTDocumentsPrintBadgesAndCertificatesLifecycleTest ⨯ teacher print request moves from upload to admin status and file ac… 0.04s ⨯ badges stickers slips and certificates are generated or validated w… 0.02s FAIL Tests\Feature\Api\V1\Workflows\ScenarioUFinanceBillingPaymentRefundAndInstallmentLifecycleTest ⨯ admin generates invoice records payment transaction and receipt not… 0.04s ⨯ admin creates installment plan refund and balance carryforward deci… 0.02s PASS Tests\Feature\Api\V1\Workflows\ScenarioVProcurementReimbursementAndSupplyLifecycleTest ✓ admin manages suppliers supply categories purchase order and receip… 0.04s ✓ reimbursement request batch lock export and mark donation flow 0.02s FAIL Tests\Feature\Api\V1\Workflows\ScenarioWAccessControlRolesNavigationAndPreferencesTest ⨯ admin creates role permission assigns user and builds navigation 0.04s ⨯ user preferences and role switcher preserve selected context 0.02s ✓ non admin cannot manage role permissions or admin nav builder 0.03s FAIL Tests\Feature\Api\V1\Workflows\ScenarioXPublicKioskScannerAndVerificationLifecycleTest ⨯ public content documentation and policy endpoints are reachable wit… 0.02s ⨯ badge scan and scanner process known and unknown codes safely 0.03s ⨯ public verification and invite tokens fail closed for invalid value… 0.01s FAIL Tests\Feature\Api\V1\Workflows\ScenarioYFamilyGuardianAuthorizedUserAndWhatsappLifecycleTest ✓ admin builds family links and manages guardian flags 0.04s ⨯ parent authorized user invite and household privacy flow 0.02s FAIL Tests\Feature\Api\V1\Workflows\ScenarioZLegacyAliasesValidationAndCompatibilityTest ✓ legacy teacher aliases match modern teacher and score surfaces 0.08s ✓ legacy post aliases validate payloads without 500s 0.04s ⨯ validation errors are structured for representative public and auth… 0.02s ✓ legacy redirects and non versioned auth aliases remain available 0.03s FAIL Tests\Feature\Api\V1\Workflows\StudentEnrollmentWorkflowTest ✓ admin creates account adds student and enrolls them 0.34s ⨯ admin can withdraw an enrolled student 0.35s ✓ creating a user requires a valid role 0.02s ✓ student registration requires first child contact details 0.35s