# SkateSpots QA matrix

Last updated: 2026-11-02  
App release under test: **1.7.87** (versionCode 10787)

This is a best-effort test record, not a certification. “PASS” means the named
check was actually run in this environment. Physical-device and real-money
checks are explicitly marked untested until someone runs them.

## Automated / web

| Area | Check | Result | Evidence |
| --- | --- | --- | --- |
| Build gate | `npm test` (install, app/server typechecks, ESLint, i18n, 172 Vitest tests, production Vite build) | PASS | 2026-11-02 |
| Production boot | `node scripts/smoke-test.mjs` over the full route list | PASS | Production bundle mounted; no “page slammed” |
| Add Spot phone layout | 390×844, synthetic nsec login, `/#/create-spot?lat=48.8566&lng=2.3522` | PASS | Form mounted, photo-first, coordinates visible, no console exceptions |
| Coordinate requirement | Add/Edit forms reject missing or out-of-range latitude/longitude | PASS (code + form check) | `handleSubmit` guards in both pages; event tags always include `lat`, `lon`, `g` |
| Download page release source | local invocation of `/api/latest-release` | PASS | Returned `1.7.86`, correct APK URL, `7890f290…` checksum |
| PWA/static assets | production leaflet/manifest assets served | PASS (smoke) | Build and route boot |

## Release channels

| Channel | Version | Result | Notes |
| --- | --- | --- | --- |
| Web | 1.7.87 | PASS | Production deploy after release commit |
| Zapstore | 1.7.87 | PASS | Release event + current icon on relay |
| Forgejo | 1.7.87 | PASS | APK + `.sha256` assets |
| F-Droid self-hosted repo | 1.7.86 → 1.7.87 | PASS | `index-v2.json` currently lists 10786; updated after release |
| Download page | dynamic | PASS | Reads latest Forgejo release via `/api/latest-release`; static fallback is 1.7.87 |

## Still requires a real device

Mark the following only after testing on actual hardware. They are not web tests.

- [ ] Stock Android: install over 1.7.85, launch, add a spot, edit it, coordinates required.
- [ ] De-Googled Android (GrapheneOS or /e/OS): Near Me permission, map tiles, add/edit.
- [ ] Amber sign-in, signed publish, reject/cancel flow.
- [ ] Bunker signer and nsec sign-in.
- [ ] Android hardware Back, deep links, app links.
- [ ] Offline map/tiles and offline publish queue.
- [ ] Local notifications and background delivery (standard/fast).
- [ ] Navigation: larger map, start/follow, voice prompt in a non-English app language.
- [ ] Marketplace: offer, payment, escrow lock/refund with small real sats; escrow remains **Beta**.
- [ ] Ownership: claim, transfer, rejected/expired claim.
- [ ] F-Droid client: add repo, install/update over the existing signature.

## Known gaps / risks

- The self-hosted F-Droid repo now has 1.7.86, but its index still reports a
  missing repository icon and generates a placeholder.
- No formal external security audit has been completed.
- Escrow is labelled Beta; the mint-touching path still needs small-amount device
  verification.
- Translation speed/memory on low-end phones is not verified.
- Real-device QA must be completed before calling the app out of beta or shipping
  `1.0.0`.