Access Control (Tests\Feature\AccessControl)
 [x] Guests are sent to login
 [x] Public pages render with security headers
 [x] Customer sees own dashboard but not back office
 [x] Unverified customer must verify first
 [x] Staff without two factor are sent to security
 [x] Frozen accounts are signed out
 [x] Customers cannot open other customers records

Allotment Allocation (Tests\Unit\AllotmentAllocation)
 [x] Undersubscribed everyone gets their request
 [x] First come fills in order with partial last
 [x] Pro rata splits proportionally and hands leftovers to largest remainders
 [x] Pro rata ties go to earliest application
 [x] Never allots more than available or requested
 [x] Lottery uses the shuffled order
 [x] Nothing available

Formatting (Tests\Unit\Formatting)
 [x] Money uses south asian grouping and sign
 [x] Percent and change indicator never rely on colour alone
 [x] Status tone mapping

Ledger And Holdings (Tests\Database\LedgerAndHoldings)
 [x] Ledgers are append only
 [x] Holdings are derived from the ledger
 [x] Locked shares cannot be transferred
 [x] Open requests reserve shares
 [x] Value series has points for every period
 [x] Sensitive columns are encrypted at rest
 [x] Changes are audited

Marketplace (Tests\Database\Marketplace)
 [x] Application rules
 [x] First come cannot be oversold
 [x] Forged callback changes nothing and genuine one still settles
 [x] Pro rata allotment refunds and lots
 [x] Payment after close is refunded automatically
 [x] Processing refund posts to cash ledger

Payment Gateway (Tests\Unit\PaymentGateway)
 [x] Form fields are signed in declared order
 [x] Authentic completed payment is accepted
 [x] Tampered or foreign callbacks are not authentic
 [x] Redirect alone is not enough when status api disagrees or is down
 [x] Cancelled payment is authentic failure only when esewa confirms
 [x] Esewa refuses to start without credentials
 [x] Demo gateway signature is required

Security Hardening (Tests\Feature\SecurityHardening)
 [x] Totp code cannot be replayed
 [x] The code used to turn on 2fa cannot be reused at login
 [x] Two factor failures lock the user across sessions
 [x] Sensitive outbox messages are wiped after delivery
 [x] Payment pages require the two factor challenge
 [x] Changing payout bank needs the current password
 [x] A payment can only be settled once

Totp Service (Tests\Unit\TotpService)
 [x] Matches rfc 6238 reference values
 [x] Verify accepts one step of clock drift only
 [x] Generated secret round trips
 [x] Recovery codes work once each

Transfers And Corporate Actions (Tests\Database\TransfersAndCorporateActions)
 [x] Locked lot cannot be sold
 [x] Cannot request someone elses lot
 [x] Sale lifecycle posts ledger and proceeds
 [x] Cash dividend with tax and bonus issue
 [x] Bonus lots inherit lock in
 [x] Future record date cannot be applied

Two Factor Policy (Tests\Feature\TwoFactorPolicy)
 [x] Customers without 2fa must set it up first
 [x] Required 2fa cannot be turned off
 [x] Ticking trust this device stores a hashed token
 [x] A trusted device skips the code
 [x] Expired or foreign trust is ignored
 [x] Staff never skip the code
 [x] Changing password forgets other trusted devices
 [x] Forget all removes every trusted device