# Production QA report - MPC Companion Sales Landing V1.0

## Automated results

- Package unit tests: **PASS**
- End-to-end mock PayPal create/capture flow: **PASS**
- Server-side amount, currency and SKU checks: **PASS**
- Protected PDF delivery: **PASS**
- First download: **PASS**
- Second download blocked with 410: **PASS**
- Visitor-facing route smoke test: **PASS**
- Unknown visitor route returns branded page with HTTP 200: **PASS**
- Static asset reference audit: **PASS - zero missing assets**
- Companion PDF included privately: **PASS - approximately 9.8 MB**

## Routes tested

- `/`
- `/success`
- `/privacy`
- `/terms`
- `/refunds`
- `/health`
- `/robots.txt`
- `/sitemap.xml`
- unknown visitor route
- `/api/paypal/create-order`
- `/api/paypal/capture-order`
- `/claim/:token`
- `/download/:token`

## PayPal implementation

- Orders v2 REST create and capture endpoints
- Server-side OAuth 2.0 access tokens
- PayPal idempotency request IDs
- Digital-goods `NO_SHIPPING` preference
- Verified `COMPLETED` capture status
- Verified US$14.99 amount, USD currency and product SKU
- Webhook signature verification endpoint
- Webhook event deduplication
- Refund, denial and reversal invalidate unused entitlements

## External launch gate

Live PayPal credentials, the Live Webhook ID, and the final HTTPS domain are private owner-controlled values and are not available in this build environment. The package includes an interactive setup wizard so these values are entered without editing any file or script.