AiBiz widget — smoke page

Not a customer-facing page. This is the pre-deploy gate (W13): it loads the real loader from this same deployment and exercises the host-page contract, so a broken build is caught here rather than on someone else's site.

What this proves

• /v1/loader.js is served and parses.
• The loader finds its own <script> tag and reads its site key.
• It mounts the iframe and completes the ready → init handshake.
• window.aibizWidget("open" | "close") reaches the frame.
• On first open the loader calls GET /bootstrap and the mint, and posts the result back into the frame.

Handshake log

open close

The site key below is a placeholder, so the mint is expected to fail. That is the point: an unknown site key returns an inert 404, and the frame log should show session-error unavailable rather than a hang or a thrown error. Turnstile also will not solve here, so the request carries the turnstile_unavailable marker — the same path a customer gets when their CSP omits challenges.cloudflare.com.