# Release verification

## Authentication

- Login returns to the exact registered callback and exchanges the code once.
- Refresh restores the session after closing and reopening the browser and supports the expected 30-day session window.
- Logout removes local state; a token for another site is rejected.

## AI tasks and points

- Models and point prices come from Star APIs, not constants.
- The displayed catalog equals the intersection of the current site-scoped runtime response and the site's own display-ID configuration; stale, disabled, absent, or non-callable modes are never reintroduced from local data.
- The UI renders one product entry per `products[]` item, then submits the selected mode's exact `task_model` and `task_type`; it does not construct child aliases from suffixes.
- Product logos render from Star Task's runtime field (`products[].icon`, or `models[].logo_url` only for the legacy flat view); no model/vendor logo map, bundled brand asset, or constructed `/applogo` URL remains in frontend code.
- A product with mixed mode availability keeps unavailable modes disabled and explains the runtime `unavailable_reason` without hiding callable sibling modes.
- One click creates one UUID v4 idempotency key; a network retry reuses it.
- A multi-image set creates one task collection instead of a browser-side loop of independent tasks.
- Collection refresh/login recovery restores per-image status and all regeneration versions.
- Collection stop/resume never recreates a successful image; an insufficient-points resume pauses without losing completed results.
- Pending, succeeded, failed, and cancelled states render correctly.
- A successful image/video/audio opens from a `task.starhk.uk` URL after the upstream URL expires.
- Audio/music controls come only from runtime `form_schema`; unavailable or unpriced catalog models cannot be submitted.
- Text and image capabilities, modes, controls, and material limits come only from runtime catalog metadata; no model-name fallback is present.
- Audio detail views expose playback/download plus Star/upstream task IDs, completion time, actual points, and failure reason.
- Successful and failed jobs produce the expected debit/refund, with no frontend point mutation.

## Reusable AI tools

- Tool names, categories, form fields, constraints, versions, and prices come from `/v1/tools`.
- Text generation works without an image; image-understanding rejects missing or excess images before charging.
- The frontend renders normalized `text`, optional structured `data`, and ordinary media outputs.
- Changing a tool in Star Admin affects new tasks without a frontend release; an idempotent retry does not create or charge twice.

## Payments

- Checkout uses only the current six public payment product IDs, or a site-selected subset of them.
- The product catalog is filtered through the site's explicit allowlist; hidden products cannot be submitted from the purchase UI.
- Payment methods come from `listPaymentMethods()` and the visible set is the intersection of runtime capabilities, the site's scenario-specific selection, and the product's supported mode.
- Country detection and page locale influence defaults or labels only; they do not locally invent capabilities or act as authorization rules.
- One-time Airwallex checkout submits either one selected runtime `payment_method`, or an ordered `payment_methods` array for an aggregated Hosted Payment Page picker, plus an explicit ISO country hint. The two fields are never sent together; subscriptions expose only methods whose runtime `modes` include `subscription`.
- An aggregated mainland-China picker uses `payment_methods: ['alipaycn', 'wechatpay']` when Alipay should appear first/default and WeChat Pay below it; every entry is present in the latest runtime capability response.
- The production CSP `script-src` allows both `https://static.airwallex.com` and the runtime bundle host `https://checkout.airwallex.com`; the browser console has no blocked Airwallex scripts, frames, or connections.
- FPS is not displayed or submitted. Every registered enabled site can use configured Airwallex capabilities without a frontend-site allowlist.
- Logged-in checkout redirects once, and logged-out checkout resumes once after OAuth before the normal return-path redirect.
- The purchase control is disabled during Checkout Session creation; an ambiguous POST failure is not retried automatically.
- Success, cancellation, and provider-pending returns are distinct. Success refreshes overview and site-scoped orders with a bounded wait for Webhook fulfillment.
- A delayed or failed Webhook never causes the frontend to grant points or change a plan locally.
- Orders and receipts belong to the authenticated user and current site; disabling payments does not break the account page.
- Local-currency Checkout records both the USD package amount and the customer's actual amount/currency without mixing the two.
- Cancel renewal calls `POST /api/v1/orders/:id/subscription/cancel`, makes no refund or local entitlement change, and displays the returned `current_period_end` as Unix seconds in the user's timezone.
- A pending cancellation renders “已取消续订，将于 YYYY-MM-DD 到期” and offers resume; `POST /api/v1/orders/:id/subscription/resume` restores automatic renewal before the subscription ends.
- One-time, unpaid, refunded, and ended orders show no renewal controls. Request buttons are locked while pending, and failed requests retain the previous state.
- Cancel renewal and immediate refund are described and implemented as separate operations; the frontend never calls an admin refund route.
- Browser bundles contain no payment-provider, site, admin, or fulfillment secret.

## Analytics

- Exactly one request is accepted on initial load and one on each real SPA navigation.
- Refresh does not create a new visitor ID; private/incognito storage may do so.
- Auth callback and duplicate URL events are not counted.
- Today/month PV and UV appear for the correct site in Star Admin.

## Security and compatibility

- Browser bundles contain no admin, site, or upstream provider secret.
- CORS works only from registered origins.
- Existing routes, saved creations, pricing display, and mobile layout still work.
- Only models returned for the assigned `site_id` can be shown or called. A UI-only display subset does not require a server allowlist; when an administrator does change the optional allowlist, the new `model_policy_version` replaces stale cached entries.
- Inherited and custom site prices match `/v1/pricing/quote` and the task creation response; no request submits a client-controlled price.
- Failure of analytics or an upstream provider does not break login or the rest of the page.


## Optional delegated pricing

- A dedicated token is stored only in the site's trusted backend; its management endpoint authenticates site administrators.
- Preview does not mutate prices; publication uses the etag reviewed by the administrator.
- 1K/2K/4K and multi-image quotes match the configured values; other sites remain unchanged.
- Stale writes return 409; read-only, expired and revoked credentials cannot publish.
- Inheritance and same-site rollback work; the frontend refreshes cached catalog/rules after publication.