# Panda Parcel courier test results

## Automated run
`bunx vitest run`: 4 test files passed, **23 tests passed** (10 existing regression tests + 13 new courier safety tests).

New tests verify all five adapters block rate, shipment, waybill and tracking operations without invoking fetch; production is blocked for every provider/operation; every capability remains disabled; request validation rejects production, invalid request keys, missing fields, unsupported ZTO requests and unexpected secret/recipient fields; structured logs exclude sensitive fixture values.

Mocks and fixtures are locally authored safety-test inputs, **not official courier response examples**. Disabled adapters return a shared normalized error, never fake provider success.

## Not executed — blocked
For SF, STO, YTO, Yunda and JD Logistics, no authorized sandbox credentials or complete account-specific protocol specification has been provided. Therefore these provider-specific checks are **not tested**:
- Credential authentication, signing test vectors and token refresh
- Timestamp units/tolerance and exact request encoding
- Service-specific required fields and real response normalization
- Provider duplicate-request semantics and create reconciliation
- Provider rate limits, timeout/retry behavior and error mapping
- Waybill rendering and callback signatures, replay checks and acknowledgments
- Real sandbox quotes, shipments, tracking or callbacks

No courier HTTP request, real shipment, charge or deployment occurred.

## Account / persistence verification
Cloud connection and schema application succeeded. All three shipping tables were read back from the hosted catalogue with row-level security enabled. The database linter reports one informational finding: callback-event storage has no user policy by design and is inaccessible to ordinary users; future verified callbacks use privileged server processing.

Account settings tool confirmed email/password, Google and Lovable sign-in enabled; email confirmation remains on. No auth users were present, so session minting could not run. **Authenticated UI readiness-save/readback, duplicate-key behavior against the hosted database, and cross-user isolation remain unverified end-to-end.** Sign in or create/confirm an account in the courier workspace to allow those checks next. This is not a courier-access approval.

## Safety limitations
This delivery is the secure, disabled integration foundation, not five completed live API connections. No signing or retry transport is implemented against unknown contracts. No callback is publicly active. Pending provider specifications and permissions are listed in the setup guide and courier page.

## Browser verification
Verified `/couriers` with five disabled readiness controls, five official-portal links, all three downloadable documents returning HTTP 200, sign-in/sign-up/reset control states, preserved `view=orders` navigation, and mobile layout without horizontal overflow at 414px. The public account-recovery page rendered correctly. Playwright reported no page errors. Screenshots confirmed the desktop and mobile courier page. No credentials were entered and no courier requests were dispatched.