# FoodWise manual smoke-check checklist

## Fresh install
- [ ] Import database/install.sql into a new test database.
- [ ] Configure config/.env.php with test database credentials and HTTPS base URL.
- [ ] Visit the site without PHP warnings, SQL details, or exposed credentials.
- [ ] Register a household and confirm login/logout works.
- [ ] Verify sign-in throttles repeated invalid login attempts.
- [ ] Configure test mail delivery and verify the password reset link expires and can be used once.

## Household privacy
- [ ] Create household A and household B with separate accounts.
- [ ] Invite a second account to household A using its invite code.
- [ ] Confirm A's members see shared plans, shopping, and finance records.
- [ ] Confirm household B cannot see household A data by changing request IDs.
- [ ] Confirm a normal account receives access denied at /admin.
- [ ] Confirm state-changing forms reject a missing or invalid CSRF token.
- [ ] Delete one of two household members and confirm shared records remain; delete the last member and confirm the household is removed only after password and typed confirmation.

## Food and planning
- [ ] Search recipes by title and meal type; open recipe details.
- [ ] Save and unsave a favourite.
- [ ] Add and remove a meal in the correct week; navigate to the previous and next weeks.
- [ ] Copy a recipe's ingredients to shopping and check quantities/units.
- [ ] Add a manual item with and without an estimated price; toggle purchased and remove.
- [ ] Confirm shopping estimates and planned meals do not change finance totals.

## Finance
- [ ] Record income, actual expenses, and planned expenses.
- [ ] Edit and delete a transaction; confirm only the selected household's row is affected.
- [ ] Set daily, weekly, monthly, and yearly budgets and inspect period spend.
- [ ] Compare dashboard month totals with the Finances page for the same dates.
- [ ] Check decimal values such as 1234.56 and reject malformed/negative values.
- [ ] Export CSV for a selected period and check it contains actual expenses only.

## Mobile and operations
- [ ] Check navigation, forms, tables, and meal planning at phone width.
- [ ] Check PWA manifest and service worker over HTTPS.
- [ ] Check Install app opens the browser prompt or accurate device instructions; confirm an installed app hides the button.
- [ ] Confirm only static assets work offline; finance and other private pages remain network-only.
- [ ] Review PHP and web server error logs after the check.
- [ ] Back up the database and test restoring to a separate test database.