production runtime and mock removal

findings.md

@@ -559,6 +559,13 @@
 - Quote-only helpers now allow an unbound session to resolve platform pricing. This does not change charging: `submitImageJob`/`submitVideoJob` still call the strict path, and an unbound real task cannot be submitted or charged.
 - Browser verification of the reported parameter combination (`Image2`, `9:16`, `精细`) now returns `¥1.64`; direct service verification with one reference image resolves the same amount and parameter snapshot.
 
+### Production billing runtime and Mock removal — 2026-08-17
+- The live create UI already debounces `POST /api/billing/quote`, but it clears any non-2xx response or `{ quote: null }` to `—`, hiding whether the backend is unavailable or billing is intentionally bypassed (`components/create-studio.tsx`).
+- After the static frontend refactor, Next has no API routes; the Go application owns `/api/billing/quote` and mounts it through `/api/billing/` (`backend/internal/httpapi/billing.go`, `backend/internal/application/application.go`).
+- `Catalog.Quote` currently returns no quote for `provider == "mock"`. The runtime automatically selects `mock` when credentials are absent or the `*_MOCK` setting is truthy/auto (`backend/internal/billing/catalog.go`, `backend/internal/application/runtime.go`). This is incompatible with the confirmed formal-production requirement to remove Mock mode.
+- `Dockerfile` builds only the static Nginx Web image, while the checked-in `docker-compose.yml` starts that image plus the obsolete Node Worker and routes the Web container's `/api` to an intentional 404. Without a Go API service or reverse proxy, quote requests cannot reach the billing service.
+- Confirmed implementation boundary: production provider targets must never become `mock`; required provider credentials are validated at Go application startup, and quote/creation requests fail with an explicit configuration error if the selected provider is unavailable. The billing catalog and wallet charge/refund flow remain authoritative.
+
 ### Quota guard and super-admin billing exemption — 2026-08-12
 - Confirmed product rule: ordinary platform accounts must not dispatch a real generation task when the shared organization balance cannot cover the frozen quote; the API should return the existing 402 insufficient-balance error so the create page can show it.
 - Confirmed product rule: super-admins still receive a provider-cost quote and successful jobs still write the calculated amount into usage records, but super-admin generation is quota-exempt. It must not require an organization, inspect wallet balance, create charge/refund ledger entries, or block on quota.
@@ -570,6 +577,13 @@
 - `调整倍率` now opens an in-app modal with the current multiplier, standard cost, current customer price, projected customer price, range validation, keyboard focus, and Escape dismissal. The browser `window.prompt` path is removed.
 - Design polish followed the taste-skill direction: compact enterprise information hierarchy, shared alignment grid, restrained motion, and an in-context dialog instead of a browser-owned prompt.
 
+### Production billing runtime and Mock removal — final verification — 2026-08-17
+- Removed the remaining active placeholder-generation path: real provider targets are the only runtime targets, `ImportMock`/the public mock video asset are gone, and missing credentials produce explicit failed/unavailable states.
+- Verified the Go backend with `go test ./...`, `go vet ./...`, and a successful API package build using a temporary official Go toolchain.
+- Verified the frontend with TypeScript (`--incremental false`), 54 Vitest files / 173 tests, and a successful Next production build. ACK manifest assertions, JSON contract parsing, shell syntax, and `git diff --check` also pass.
+- Docker Compose was not started because this host has no Docker CLI/daemon. The Compose topology and Nginx proxy are statically checked; live PostgreSQL/provider credentials and deployment rollout remain deployment-time prerequisites.
+- Historical database rows, usage exclusions, UI labels, and explicit test doubles still recognize `mock` only for compatibility/fixture handling; no new production task can select or execute Mock mode.
+
 ## 2026-08-12 - Alibaba Cloud RDS PostgreSQL Refactor
 
 ### Confirmed facts
@@ -600,3 +614,18 @@
 - ACK templates now keep Web at one replica until storage is externalized, separate Web/Worker/DB secrets, isolate the public internal-worker prefix through a selectorless Service, mount the RDS CA, disable service-account token mounts, and split liveness from database/schema readiness.
 - The first final Sol review returned FAIL and uncovered additional production risks. All reported code findings were addressed before re-review: wallet idempotency is organization-scoped and binds immutable account/job/kind/amount/currency fields while treating description/metadata as mutable audit detail; destructive usage deduplication became a fail-safe preflight; app grants are explicit with no future-object defaults; readiness covers all runtime tables; password changes use a row-lock transaction; server-only imports are enforced; and npm/pnpm resolve the same pinned Next/React toolchain.
 - Main-thread final verification passed 31 test files / 119 tests, TypeScript, the Next production build, all 8 ACK manifest assertions, frozen lockfile validation, script syntax, diff hygiene, and documentation drift. The final independent Sol review returned `PASS`; live RDS/ACK/Docker verification remains explicitly outside the available environment.
+
+### Image generation completion mismatch — 2026-08-17
+- Initial report: the platform can show an image task as completed even though no generated image is available; the user suspects the post-refactor frontend/backend contracts no longer align.
+- Initial code search shows the frontend create flow still requests `/api/generations/image`, `/api/generations/video`, and `/api/assets`, while the Go backend also exposes a newer orchestration/public API surface. The exact completion path and payload contract remain under inspection.
+- The Go backend still mounts compatibility routes for `/api/generations/image`, `/api/generations/video`, and `/api/assets`; these routes return the same `jobs`/`assets` collection keys the frontend reads. The Go output-registration processor is intended to reject a succeeded job when provider output URLs cannot be resolved, so a false `succeeded` state may be caused by the running worker/deployment or by a read/write scope mismatch rather than only the route names.
+- Deployment inspection confirms a concrete boundary break: the root `Dockerfile` serves static Nginx and deliberately returns 404 for `/api`, `/uploads`, and `/generated-results`; `docker-compose.yml` starts that Web image plus the legacy Node Worker, but does not start the Go API image. The Node Worker calls `/api/internal/worker/tick` on the static Web service, so the migrated Go job/asset pipeline is not actually wired into the shipped Compose topology.
+- The Go provider path includes a Mock fallback when credentials are absent; Mock reports `succeeded` and creates a generated placeholder asset, but that relative result path is also hidden by the static Web 404 boundary. This can surface as a completed task with no visible image in the current deployment.
+- The worktree contains substantial pre-existing edits in `runtime.go`, `application.go`, `catalog.go`, `ledger.go`, `settings/service.go`, `create-studio.tsx`, and CSS; they are being preserved. The current runtime source has already removed the Mock provider fallback, while `runtime_test.go` still asserts the old Mock behavior; this is a partially applied refactor that must be compiled/tested in an environment with Go before claiming end-to-end success.
+
+### Current implementation correction — 2026-08-17
+- The deployment bullets immediately above describe the pre-fix state found during inspection. The current worktree now has `zhinian-go-api` built from `backend/Dockerfile.alpine`, `zhinian-web` serving the static export, and `deploy/nginx-compose.conf` forwarding `/api`, `/uploads`, and `/generated-results` to the Go API; the Go process owns the embedded WorkerLoop.
+- The current runtime no longer registers or selects `mock`; PostgreSQL production startup validates the real Volcengine, EvoLink, Bailian, and Seedance credentials, and billing maps a removed/unavailable provider to an explicit service-unavailable response.
+- `ProviderProcessor` now rejects a provider-reported success without an output URL before terminal finalization. The create page and result-asset task view also treat a succeeded job without a resolvable output asset as `结果同步中`, so neither frontend surface presents a false `已完成` state to the user.
+- `docs/API.md` and deployment/README guidance now describe the Go API + embedded Worker topology. The old `scripts/worker.mjs` remains only as legacy source and is no longer part of the checked-in Compose or package-script path.
+- Verification is limited by the host environment: `git diff --check` passes; Go, frontend dependency/typecheck/build, and Docker Compose execution still require a deployment/CI environment with those toolchains.