# Verification
**What can be checked without the developer, and what genuinely needs his eyes.**
The phase review hands over a list of what could not be verified — see
[WORKFLOW.md](WORKFLOW.md#3-phase-review). The point of this document is to keep that list short and honest:
everything in the first three sections is measurable, so "I could not check it" is only a legitimate answer
for the last two.
## Pick the cheapest method that proves the change
**Pick the cheapest method that proves the change, and stop there.** Escalate only when it does not.
A wording change is proved by reading the message file, not by rendering the page. A new validation rule is
proved by a test, not by fetching a form. Rough order, cheapest first:
> read the file → assert in a test → `curl` the response → crawl → ask the developer to look
**Over-verifying is not diligence, it is the developer waiting.** The same principle picks the gates — see
[Which gates run](WORKFLOW.md#which-gates-run).
## The gates
```shell
docker exec -ti raktar24-php-fpm composer test # PHPUnit over the curated surface — see TESTING.md
./bin/wiki-stale # which wiki pages the code has outgrown
```
`composer test` also runs from the **`pre-push` hook** (`bin/hooks/pre-push`, installed by
`bin/install-hooks`).
## Behaviour
The dev vhost is and `curl` reaches it. Most of what a change does to a page is
visible in the response body — a page is HTML before it is a layout.
| To check | How |
|---|---|
| A route responds, redirects, 404s | `curl -s -o /dev/null -w '%{http_code}' http://raktar24.dev.hu/` |
| Rendered markup — a field, a class, an error message, a hidden input | `curl` the URL and read the HTML |
| ``: title, description, canonical, hreflang, og tags, JSON-LD | same response, same request |
| Whether the content is there without JavaScript | same — if it is not in the response, no crawler sees it either |
| Status codes across the whole site | crawl the sitemap before and after, diff the non-200s (below) |
| Mail: whether it was sent, to whom, in which language | MailHog's API — `curl -s 'http://raktar24.dev.hu:33001/api/v2/messages?limit=5'` |
| A console command's output and exit code | `docker exec -ti raktar24-php-fpm ./yii ` |
| Wording, a label, a translation | read `messages//*.php`; do not render a page for this |
| Pure logic — helpers, status vocabularies, the calculator | a test under `tests/unit/` — see [TESTING.md](TESTING.md) |
| Schema, columns, indexes | the model owns it; `./yii migrate` against the dev database |
**Crawling.** `sitemap.xml` lists one child sitemap per language; the Hungarian one carries every generated
URL (548 at the time of writing), which is the whole point — it covers the URLs you did not think of. 404s
are not logged (see [wiki/GOTCHAS.md](wiki/GOTCHAS.md)), so this is the only way to see them at all.
```shell
curl -s 'http://raktar24.dev.hu/sitemap.xml?lang=hu' \
| grep -oE '[^<]+' | sed 's|<[^>]*>||g' \
| while read -r u; do printf '%s %s\n' "$( curl -s -o /dev/null -w '%{http_code}' "$u" )" "$u"; done \
| grep -v '^200 '
```
## Pages in a browser — not available here
Verified on 2026-08-08, not assumed:
- the **Chrome DevTools MCP** connects and lists pages, but navigating to the dev vhost fails with
`net::ERR_BLOCKED_BY_CLIENT`;
- the **Chrome binary** under `~/.cache/puppeteer/chrome/` does not start — `libnspr4.so` is missing;
- **jsdom is not an npm dependency**, so the built bundle cannot be exercised headlessly either.
So there are **no screenshots, no viewport checks, no console-error listing, no Lighthouse, and no way to run
the page's JavaScript**. Anything that only exists once a browser renders and executes is the developer's to
check, and the review has to say which part that is. An unavailable method is not an excuse to skip
verification — it moves the item into the list below.
If this changes — a working Chrome, a network allowlist — fix this section rather than leaving it to be
rediscovered.
## What genuinely needs his eyes
- **Whether it looks right.** Proportion, spacing, rhythm, weight. Layout at every breakpoint.
- **Anything the browser produces:** hover and focus states, JavaScript behaviour, console errors,
performance.
- **Copy.** Whether the Hungarian is natural and the tone fits — the front end uses informal address.
- **Product judgement.** Whether the flow is the one the client wants, whether a step is missing.
When something falls in this list, the phase review names it explicitly. When something is *not* in this
list, "could not verify" means "did not check".