AEGIS v3.9 QUICK TEST CHECKLIST
================================

BEFORE TESTING
[ ] Back up users_data/ and config/.
[ ] Confirm Apache mod_rewrite is enabled.
[ ] Confirm HTTPS works on the public domain.
[ ] In Admin, click Install Email Route.
[ ] Confirm the Admin route status displays Route Ready.
[ ] Save the IP2Location API key from Admin.
[ ] Add the public IP of your trusted VPN/RDP to the Admin whitelist.
[ ] Select Balanced and confirm the default thresholds are populated.

USER DASHBOARD
[ ] Save a valid Destination URL.
[ ] Save the Public Domain URL.
[ ] Confirm Root Routing shows Ready.
[ ] Confirm the saved public URL contains no installation folder.

ROOT FLOW
[ ] Confirm https://domain.com/ still opens the original website.
[ ] Open https://domain.com/email in a private browser window.
[ ] Create two users with different public paths and save the same Public Domain URL on both dashboards.
[ ] Confirm each main path opens only its own destination.
[ ] Confirm each token link remains bound to its own user path.
[ ] Confirm the no-logo loading page appears.
[ ] Confirm Continue appears only after five seconds.
[ ] Confirm Continue reaches the configured destination.
[ ] Confirm refreshing/reusing the POST cannot reuse the nonce.
[ ] Confirm the final release ticket expires after 30 seconds and cannot be reused.

OPTIONAL ALIASES
[ ] Select 5 characters and confirm one 5-character token link is generated.
[ ] Select 10 characters and confirm one 10-character token link is generated.
[ ] Open a generated /email/TOKEN link and confirm it uses the same flow/destination.
[ ] Revoke one alias and confirm it returns unavailable.
[ ] Confirm an invented alias returns unavailable.

RATE AND DIRECT ACCESS
[ ] Direct GET to engine/root_go.php returns Method Not Allowed.
[ ] Direct POST without a valid session/nonce fails.
[ ] Repeated excessive requests receive HTTP 429.

LOGS
[ ] Root visits are recorded with token ROOT.
[ ] Alias visits show their alias.
[ ] Successful Continue actions show CONFIRMED.
[ ] Failed verification attempts show BLOCK / Verification Failed.
[ ] City, ISP, ASN and Type populate when the Admin API key is valid.
[ ] DCH/VPN/proxy test traffic records CHALLENGE and a proof result.
[ ] Trusted IP traffic records trusted_ip.
[ ] Confirmed TOR/botnet/bogon traffic records DENIED.
[ ] Successful release records ALLOWED.
[ ] Fourth release from one IP within 10 minutes is denied under Balanced.
[ ] Third verification failure applies the configured penalty under Balanced.
[ ] Token traffic above the configured per-minute limit triggers cooldown.