# Manual testing plan

Milestone 1: verify team login, password reset, email verification, remember-me, logout, and rate limiting; verify a disabled account is refused; visit every internal and portal placeholder as the appropriate role; confirm keyboard focus is visible and navigation is responsive.

Security: try a client-A URL as client B, a designer URL for an unrelated project, an expired/revoked invitation, and a direct private-file URL. Each must deny access without leaking record data. Production: verify `/up`, SMTP, HTTPS, secure-cookie behavior, cron output, and a deployment rollback from backup.