# Release verification

## Authentication

- Login returns to the exact registered callback and exchanges the code once.
- Refresh restores the session after closing and reopening the browser and supports the expected 30-day session window.
- Logout removes local state; a token for another site is rejected.

## AI tasks and points

- Models and point prices come from Star APIs, not constants.
- One click creates one UUID v4 idempotency key; a network retry reuses it.
- Pending, succeeded, failed, and cancelled states render correctly.
- A successful image/video/audio opens from a `task.starhk.uk` URL after the upstream URL expires.
- Successful and failed jobs produce the expected debit/refund, with no frontend point mutation.

## Analytics

- Exactly one request is accepted on initial load and one on each real SPA navigation.
- Refresh does not create a new visitor ID; private/incognito storage may do so.
- Auth callback and duplicate URL events are not counted.
- Today/month PV and UV appear for the correct site in Star Admin.

## Security and compatibility

- Browser bundles contain no admin, site, or upstream provider secret.
- CORS works only from registered origins.
- Existing routes, saved creations, pricing display, and mobile layout still work.
- Failure of analytics or an upstream provider does not break login or the rest of the page.