Eligibility engine (§2–4)  PASS Delhi no-helmet challan is actionable  PASS Actionable challan is selectable  PASS Decision carries the rule id for audit  PASS Decision carries the rule version for audit  PASS Drunk driving in Delhi requires court presence  PASS Court-presence challan cannot be selected for purchase  PASS physical_presence flag is set  PASS Expert CTA is offered on a court-presence challan  PASS State default and offence-specific rule are different rules  PASS court_pending forces court presence even when the rule would allow online closure  PASS Unknown state fails closed to manual review  PASS Unknown state is not purchasable  PASS A non-serviceable state is not purchasable  PASS No active rule falls back to manual review  PASS Every decision carries a customer-facing message Pricing (§14)  PASS Government payable equals the challan amount when there is no verified discount  PASS Service fee comes from settings  PASS Item total is government amount plus fee  PASS An unverified discount is priced at zero  PASS Unverified discount does not reduce the government amount  PASS The reported discount is still surfaced to the customer  PASS A verified discount is honoured  PASS Verified discount reduces the government amount  PASS A discount cannot drive the government amount below zero  PASS Cart sums the government amounts  PASS Cart sums the service fees  PASS Cart total is correct  PASS A coupon is capped at the service fee  PASS A 100% coupon still collects the full government amount  PASS Coupon allocation across items sums exactly to the discount  PASS Odd coupon amounts still sum exactly (remainder to the last item)  PASS A one-paisa coupon is not lost to rounding  PASS Tax is charged on the service fee only (18% of ₹500)  PASS Tax adds to the total Coupons (§15)  PASS A valid coupon validates  PASS Fixed coupon returns its face value  PASS Unknown coupon is rejected  PASS An expired coupon is rejected  PASS A state-scoped coupon works in its state  PASS A state-scoped coupon is rejected when the cart includes another state  PASS A percentage coupon respects its maximum discount cap  PASS Minimum order value is enforced OTP (§6, §41)  PASS An OTP request succeeds  PASS A six-digit code was sent  PASS The plaintext code is never stored in the database  PASS The plaintext mobile number is never stored in the OTP log  PASS A wrong code is rejected  PASS The correct code verifies  PASS A code cannot be replayed after use  PASS A code issued for one purpose does not work for another  PASS After too many wrong attempts even the correct code is refused  PASS An expired code is refused  PASS Repeated OTP requests to one mobile are throttled Challan fetch and caching (§8)  PASS A provider refresh succeeds  PASS Fetched challans are written to the cache  PASS Every provider call is logged  PASS Refreshing again upserts rather than duplicating  PASS A provider timeout is reported as unavailable  PASS A provider failure is never worded as "no challans found"  PASS A failed refresh does not wipe the cache  PASS Manual refresh is rate limited  PASS No restricted challan appears in the selectable list  PASS No selectable challan is hidden in the restricted list Orders (§13, §16)  PASS An order is created for an eligible challan  PASS A new order awaits payment  PASS Order total is government amount plus service fee  PASS The order item snapshots the government amount  PASS The order item snapshots the service fee  PASS The order item records which rule permitted the sale  PASS A court-presence challan cannot be purchased even by calling the service directly  PASS Changing the fee does not reprice an existing order  PASS A new order uses the new fee  PASS The same challan cannot be bought twice  PASS Another user cannot load this order  PASS The owner can load their own order Payment and webhooks (§16)  PASS Payment initiation returns a gateway order id  PASS The gateway is asked for the server-side amount, not a client-supplied one  PASS A forged checkout signature is rejected  PASS A forged signature leaves the order unpaid  PASS A valid checkout signature is accepted and the payment is marked paid  PASS A verified payment marks the order paid  PASS A signed webhook is accepted  PASS An accepted webhook returns 200 so the gateway stops retrying  PASS A replayed webhook is ignored rather than double-processing  PASS A duplicate webhook still returns 200  PASS Only one webhook event row exists after a replay  PASS A wrongly signed webhook is refused  PASS An unsigned webhook is refused  PASS An unsigned webhook returns 400  PASS A webhook claiming the wrong amount is rejected as a mismatch  PASS An amount-mismatched webhook leaves the order unpaid Documents (§17–18)  PASS A valid document uploads  PASS The stored file is retrievable from storage  PASS The bytes on disk are ciphertext, not the original file  PASS A storage id is recorded  PASS The owner can decrypt and read their own document byte-for-byte  PASS Another customer cannot read the document  PASS Both the allowed read and the denied read are logged  PASS A PHP file is rejected  PASS A PHP payload renamed to .png is rejected on magic bytes  PASS A PNG with PHP appended (polyglot) is rejected  PASS An oversized file is rejected Data protection (§17, §45)  PASS Encryption does not leak the plaintext  PASS Round-trip decryption works  PASS Tampered ciphertext fails authentication rather than decrypting  PASS A blind index is deterministic  PASS A blind index differs per value  PASS A stored secret is never shown in full  PASS The credential is flagged as a secret  PASS A secret setting is encrypted at rest in the database  PASS The application can still read the secret back Audit and logging (§46)  PASS The audit log redacts passwords  PASS The audit log redacts one-time codes  PASS The audit log keeps non-sensitive fields ------------------------------------------------------------ 114 passed, 0 failed, 114 total