Public checkout and credits are now server-authoritative. New installs receive a 20-credit trial from the production service. Renders reserve credits atomically, commit only after valid output, and return reservations on cancellation or failure. Balanced + Natural is now the neutral 2x default; model and scale combinations are native-safe; color, sharpening, interpolation, and forced final sizing are opt-in. Billing secrets and the legacy recovery signing fallback are not included in customer builds. Includes regression tests and an anonymous-diagnostics opt-out documented in the README.