PASS invalid credentials are rejected and audited PASS repeated login attempts are throttled PASS disabled users cannot log in PASS successful login regenerates session and creates persisted session PASS dashboard shell loads for an authorized user PASS remember-me validators are hashed and rotated PASS form method override and CSRF middleware work PASS unauthorized routes and service operations return 403 PASS service-level permission permits user creation and creates audit log PASS password reset changes hash, revokes sessions and writes audit PASS airport CRUD, filtering, status history and audit logging work PASS aircraft type CRUD validates specifications and audits changes PASS route CRUD prevents duplicate sectors and validates times PASS fleet CRUD, inactive-base protection, lease validation and histories work PASS flight templates generate UTC schedules and prevent duplicate dated flights PASS flight conflicts, assignments, bulk status and histories are server enforced PASS flight schedule and template views render through protected routes PASS dispatch release requires every mandatory checklist item PASS operational times, diversion and completion update aircraft location histories PASS cancellation records approval and creates status history PASS operational flight profile renders all required tabs PASS fleet utilization derives completed flight actuals and only approved records PASS fleet board, availability and reports expose operational records PASS maintenance programs, whichever-first tasks and due requirements are calculated PASS critical defects and overdue mandatory maintenance block backend scheduling FAIL work-order completion, immutable approval and return-to-service workflow: Eligible aircraft was not restored to Available. PASS maintenance schedules, alerts, work orders and defects render through protected routes PASS purchasing receipts create immutable stock balances and enforce available quantity PASS work-order reservations, consumption, returns and actual parts cost stay reconciled PASS serialized component movements preserve installation and life history PASS inventory dashboards and all requested reports render through protected routes PASS expense validation rejects duplicate invoices and enforces receipt thresholds PASS multi-level approvals enforce role, limit, immutable history and edit restrictions PASS payments and controlled revisions preserve approved expense records PASS expense dashboards, payables and allocation reports render through protected routes PASS revenue entries reconcile invoices, payments, refunds and fixed-scale currency values PASS budgets refresh approved actuals and preserve immutable approved lines PASS financial KPIs and profitability snapshots use completed operations and allocated costs PASS financial dashboard, revenue, budgets and estimated profitability routes render PASS fuel planning, uplift approval, consumption and finance posting are controlled FAIL fuel dashboard and all requested fuel reports render: SQLSTATE[HY000]: General error: 1 no such function: SUBSTRING PASS crew profiles, qualifications, rosters and configurable rest guidance work PASS crew assignments detect blocking conflicts and retain non-certified rest guidance PASS crew directory, profile, roster views and all requested reports render PASS central documents preserve immutable versions, approvals, links and audit history PASS alert synchronization deduplicates sources and delivers in-app notifications PASS notification preferences and Phase 13 protected views work FAIL central reporting catalog applies reusable filters across every report: SQLSTATE[HY000]: General error: 1 no such function: SUBSTRING FAIL report exports and executive cached analytics are permission controlled: SQLSTATE[HY000]: General error: 1 no such function: SUBSTRING PASS REST API enforces tokens, scopes, JSON requests and idempotency PASS webhooks sign, retry, fail, replay and deduplicate deliveries PASS integration providers keep credentials encrypted and render protected administration PASS system settings validate, persist tenant values and drive runtime policy PASS demo data administration requires permission, CSRF routing and typed confirmation PASS number sequences issue unique values and reject duplicate number configurations FAIL administration health, logs, sessions, audit, cache and exports are protected: System health did not report runtime or migrations. PASS phase 17 response, header and logging hardening rejects unsafe data PASS phase 17 cache, batching and background job abstractions are deterministic PASS phase 17 migration enforces tenant indexes, active-record uniqueness and decimal money PASS unit validation and timezone conversion handle boundaries and daylight offsets PASS completed operational flights cannot regress through schedule editing PASS role permission matrix enforces administrator, operational and read-only boundaries PASS cross-airline records are invisible through services and listings PASS server pagination remains stable with large audit datasets PASS master-data delete operations use soft deletion and history PASS 404 and protected error pages render with CSP PASS escaping and backend validation remain active FAIL installed system returns 404 from installer: Existing lock found. PASS installer session cookie follows root and subdirectory deployment paths 63 passed, 6 failed.