1 files changed, 52 insertions, 0 deletions

diff --git a/docs/TESTING.md b/docs/TESTING.md
new file mode 100644
index 0000000..6cac6fa
--- /dev/null
+++ b/docs/TESTING.md
@@ -0,0 +1,52 @@
+# Testing
+
+## Automated suite
+
+```sh
+cargo test
+```
+
+The suite is deterministic and headless: no network, no PTY, no sleeps, no
+shared global database. Each test owns its state.
+
+| File | Covers |
+| --- | --- |
+| `tests/client_core.rs` | Client command/game flows via a headless screen applying logical effects. |
+| `tests/client_ui.rs` | Help, history, completion, bet parsing, display width, cursor math. |
+| `tests/protocol.rs` | Newline buffering and timeout/error classification. |
+| `tests/server_core.rs` | Handler, bcrypt migration, SQL injection, transaction rollback, `plays` audit, sessions. |
+| `tests/slots.rs` | Server slots payout rules and overflow handling. |
+| `tests/storage.rs` | Client/server SQLite storage helpers. |
+| `tests/tofu.rs` | SPKI fingerprint and TOFU decisions. |
+
+`tests/tofu.rs` shells out to `openssl`, so run it on a machine where the
+`openssl` CLI is available.
+
+## Manual TUI checklist
+
+There is no CI. Run this on Linux and on a Windows VM before a release.
+Use an 80-column terminal because several output lines are width-sensitive.
+
+1. Start the server with a valid `identity.p12`, then start the client.
+2. First contact prints three lines and the 64-character fingerprint does not
+   wrap at 80 columns. `Connected to ...` shows a one-decimal ping.
+3. `register` / `login`: backspace removes one `*` per key, Esc cancels the
+   prompt, Ctrl+C exits and restores the terminal.
+4. `help` fits 80 columns. Tab completion wraps within 76 columns and the
+   cursor stays visible.
+5. `play slots 50` shows `Bet: 50 PLN` and the fetched balance.
+6. Space shows `Spinning...`, then the reels, win text, and new balance inside
+   the same 7-line board. The controls line is never overwritten.
+7. `+` / `-` after a spin changes only the bet; no stale result lines appear.
+8. `q` clears the board. Ctrl+C in a game clears the board and exits.
+9. `info`, `ping`, `send hello`, and `hosts` print readable output; the host
+   fingerprint fits 80 columns.
+10. Windows: repeat 2-9 and confirm keys are not duplicated or printed twice.
+
+## Manual server checks
+
+- Register, log out, log in again (bcrypt path).
+- Log in with a pre-0.3 user row (legacy SHA-256) and confirm it still works;
+  the row is upgraded to bcrypt.
+- Spin several times and confirm `plays` grows by one row per spin while
+  `users.balance` changes by `winnings - bet`.