Collectible Card Game Headquarters

Describe the Bug:
After tapping Pili-Pala to cast a spell with convoke, it can be activated for mana to pay for that spell.

Worse, you can then cancel the spell, so you can get free mana. Infinite free mana of any color not in the spell's cost, but at least one free mana regardless. Specific example, though it generalizes:

1. Debug a non-summonsick Pili-Pala, two Plains, and five Island's onto the bf, and a Chant of Vitu-Ghazi into your hand.
2. Begin casting the Chant with convoke.
3. Tap Pili-Pala for convoke.
4. Click on Pili-Pala again when you're prompted for real mana, then on two of the Island's to pay its cost, and select anything but white to generate. I'll use red mana in this example for clarity.
5. Cancel before paying the rest of the Chant's cost.
6. You now have an untapped Pili-Pala and two tapped Island's, and in your mana pool.
7. Repeat steps 2-5, using the blue (or red) mana in your pool instead of tapping new lands in step 4.

Which card behaved improperly?
It's really convoke's fault, but it's probably easier to hack Pili-Pala instead.

Which update are you using? (date, name)Which type? (duel, gauntlet, sealed deck)
Dev b98edab.

What exactly should be the correct behavior/interaction?
Modern rules say you can't activate mana abilities after you start paying the spell's cost (which is where convoke happens).

Failing that, they also say that things get rolled back to how they were when you began casting the spell.

Failing that, you should only be able to use Pili-Pala's mana and tap it for convoke if it was tapped to start with.

And failing that, you at least shouldn't be able to get free infinite mana.

Are any other cards possibly affected by this bug?
No. Something to keep in mind if WOTC decides to print an Ashnod's Altar or Infernal Plunge variant that only lets you sac a tapped permanent, I guess.

Another consequence of the same bug: if you have a creature that only has positive toughness because of a Castle or Builder's Blessing or Sword of the Paruns (say, an unequipped germ token from Batterskull, or a Clone that didn't copy anything), begin to cast a convoke spell by tapping the creature, and then activate another mana ability, the creature dies and stays dead even if you cancel casting. So just hacking Pili-Pala by itself isn't sufficient.

I confirm both bugs.