schema.sql + seed.sql, theme/app CSS and app.js, with .htaccess deny rules on app/config/database/storageColumnMapper, DateParser and storage permissionsA custom MVC-style app with no framework: declare(strict_types=1), route resolution via MIS\Router, and both pretty URLs and a query-string fallback so it runs on any shared host. The import pipeline, analytics, recommendation engine and report/PDF services are all in place.
Uploaded files use the YYYYMMDD_HHMMSS_<hash>.<ext> pattern, confirming the pipeline stored them correctly. The first imports required column mapping and mixed-date parsing before later uploads succeeded.
install.php and auth/install.php are still reachable and should be disabled after setup; the test uploads remain in storage/uploads/; and the app has no local mirror for drift checks.