Versiones

Brand

• The mark (Rj's A4, 31 Aug draw) wired as favicon.ico / icon.png / apple-icon.png via the App Router file conventions, plus public/brand/* derivatives and a 1200×630 default share card.
• /api/og/site marked SUPERSEDED, not deleted: it read its copy from the live landing catalog so the card could not drift from the page. The upgrade that keeps both is written at the top of it.

Launch QA sweep (docs/launch-qa-2026-09-05.md)

• Q2 — providers.tsx returned a different ROOT ELEMENT TYPE once PostHog's async loaded callback fired, so React tore down and rebuilt the entire app once per cold load. That was the dropped first click. Second half: disabled in the SSR HTML, spinner CSS-delayed 150 ms.
• Q6 · Q7 — branded, localized 404 on both public hosts; the site host's miss rewrites inside its own layout with an explicit status: 404. Deny surfaces keep their anonymous plain 404 on purpose.
• Q3 · Q4 — /plan gates its public-mode chrome on the state it already resolved, and the editor seeds from the champion instead of the hardcoded warrior default (which is exactly 4 rules — the number that disagreed with /lab).
• C7 · C8 — the public case prints one heading and labels the rating; the first-win banner's predicate now carries recency (an append-only step flag never could).
• C4 · C5 — English reaching ES players, the two reported and the class behind them.
• M2 · M3 · M4 — champion name in store previews; abandoned purchases as a DERIVED display state with zero writes; skin previews (the art existed — loading="lazy" + an inset glow on an empty wrapper was the dark blurred square).

Auth — isAuthenticated() REDIRECTS on an expired token and the SDK's validator checks the signature only, never exp. Replaced with getUser() + an explicit expiry check that fails CLOSED. tests/setup.ts lacked getAccessTokenRaw, so the entire route suite had been exercising the fail-open branch and never the expiry check.

Hosts — dev is *.dev.duelsmith.com (Rj, 6 sep); *.develop.fibonaxis.dev retired. The sweep found four hardcoded fallbacks naming the retired host, two of them on the Stripe return URLs and on every link in every email we send.

Gates — check:no-native-select refused an exemption written the way its own header describes; the i18n key gate could not read a dotted namespace; a new purchases-abandoned copy anchor.

Built to the approved mockup — docs/mockups/2026-09-04-public-champion-page.html, sha256[:16] 53195a3520b30b0e, Rj's «ESTÁ PRECIOSO». The file is committed, and the digest was verified on arrival: the approval attaches to those bytes, not to a later edit of them.

• Hero: the account's equipped background as the arena (the defender's-arena thesis made literal — a visitor arrives here), the champion's real gear-variant sprite on the player-left, idle-looping via the existing EquippedSpritePreview (which is already the "showcase mode" the design asked for: reduced-motion aware, and it falls back to the procedural crest rather than a broken image). Frame, name colour, aura chip, then Rating and Récord large.
• Build: attribute bars filled against the soft cap — where a build's returns actually bend, so the shape reads before the digits. Skills as cards with investment pips and the branch skill set apart. Equipment with the real curated icons, rarity colour, forge level and gem chips; an empty socket renders as a hollow chip, because it is a fact a scout acts on.
• Vitrina strip: the account's medals, earned in colour and sealed in silhouette — the grammar the game already teaches — with the heading linking back to the case that owns them.
• The sealed plan panel, approved words verbatim, presented as a seal rather than an apology.

⛔ The attack CTA in the mockup is deliberately NOT built. Attacking charges stamina, and putting a charging action on a brand-new public surface is a money-path change: it goes through money-path-review with its own concurrency probe, not into the same pass as a layout.

⚠️ Skill icons are CSS glyphs for now — there are none in the tree (24 missing, censused in docs/champion-page-icon-census.md) and generating them is a separate paid step. The glyph holds the same 32px box, so nothing shifts when the art lands. Item icons are real from day one: 114/114 already existed.

⭐ `lib/item-icon.ts` exists because the same filename convention was mis-derived twice in one day, in opposite directions — a census turned the apostrophe into a dash and reported 13 icons missing that were all present (nearly justifying a paid regeneration); this page then stripped the space entirely and would have rendered 114 broken images. Neither is visible by reading the code, so the rule lives in one helper with a test that walks the whole catalog against the real directory. Both mistakes run red against it.

⛔ AND THE SPRITE RENDERED 0×0 — the feature's named ask, invisible. Found by Cowork on the live page, not by a test, because nothing about it fails: the image loaded, the src was right, there was no console error. EquippedSpritePreview sets only height on its own box and positions every child absolutely, so its intrinsic width is 0 — width is the CALLER's job, and the hero wrapper gave it none. Fixed with an explicit w-[248px]. ⚠️ Not fixed by defaulting a width inside the component: the leaderboard row depends on its current zero-width behaviour in a flex row, and widening it there would move the board's layout.

⚠️ On the variant pick, since it looked wrong: this champion resolves to the base sylphar-rogue sheet, and that is correct and shared with the fight stage — the page calls the same traceVariant. sylphar-rogue has 11 authored variants, all dagger + leather; a rogue carrying a Runed Longsword in Warlord's Mail has no authored variant, so both surfaces fall back identically. That is art coverage, not a resolution bug.

⚠️ The i18n gate caught a real one before the tag: the page's translation handles were destructured out of a Promise.all, which is correct at runtime but hides the handle→namespace pairing from the gate — and that gate exists because next-intl does not throw on a missing key, it renders the key path at a player. Rewritten as one await per handle so the check keeps working.

Found on the live page during the v0.116.0 read-back, minutes after the tag. The champion page resolved the race through RACES[...].name; the roster on /u/<accountId> did not.

⭐ The gate could not have caught it, and that is the part worth keeping. The rendered-output gate written the same day bans identifier-SHAPED tokens: ^[a-z][a-z0-9]*([-_][a-z0-9]+)+$. That matches ruby_epic and w-runed-longsword and is blind to `tharum` — a bare lowercase word is indistinguishable from prose by shape alone. The heuristic was doing exactly what it was written to do and the defect walked past it.

So the gate stopped guessing where it can enumerate. Race and class keys are closed sets in the domain, so they are now checked by name — every key in RACES and CLASSES is asserted absent from the rendered output of both public pages. The roster page was also not covered by that gate at all; it is now.

Mutation-verified against the exact live defect on both surfaces.

The ruling this implements. Rj, 3 sep 2026: «si hice click en un campeón, debería poder ver el campeón o la build de la otra persona» — and its limit, «No plan táctico». The build is public because it is the thesis: the skill is theorycraft, and Duels (2008) showed you the rival's build. The plan is the hidden half — hand it over and every duel against that champion is a solved problem, with no read and no risk. Full entry: decisions.md.

Shipped

• `/u/<accountId>/c/<charId>` — the public champion page, and the full roster on /u/<accountId> with every champion clickable. Reachable from the leaderboard's scout modal and from the owner's own profile.
• `server/public-champion.ts` — ONE read model, so the narrowing is a property of the READ and not of each renderer. It never lifts plan out of the document. Scoped to BOTH ids, so /u/<A>/c/<B's champion> is a 404 and not one account's champion under another's identity.
• Slices A/C/D of public-profile-v2-brief.md: the equipped name colour on its own solid plate (colour and backdrop are both player-chosen and could otherwise combine into something unreadable); the vitrina unchanged and still first; the equipped background as a blurred, scrimmed backdrop — it is 640×300 fight-stage art, so the scrim is what keeps contrast a constant.

Fixed before this shipped, all three found by a live read-back

• Raw ids were reaching players — w-runed-longsword, ruby_epic, «quickcut 9» — while the scout modal beside them resolved every one. Now resolved through the same catalogs, plus a new skillDisplayName covering the subclass 5th skill and both branches, because a champion can hold points in a branch it later switched away from. Gated against rendered output, banning the id SHAPE rather than the three reported examples.
• The record contradicted the leaderboard — «733V · 4D» beside «65–4». Now ranked PvP by the board's own filter, with the all-modes count on its own labelled line. ⚠️ It inherits the board's draw-as-loss rule deliberately; that quirk is filed as its own item rather than fixed on one surface only.
• The aura is published — it was already public in replays and on the scout card, so withholding it on one page was inconsistency, not privacy. Build, not plan.

The `/roadmap` card (rivalBuild, shipped lane): «Mira la build de tu rival» — the title is Rj's «Aprobado» of 4 sep, approved by repetition of the exact text after Cowork's PASS on register, claim and length. Its desc is `champion.plan.body` verbatim, asserted byte-identical to the catalog before the commit, so the card states both halves of the ruling and only five words of it are new Spanish. Both are anchored (gloss.card.rivalBuild, es f645db4e7e66d917 · en 26b2c0351822ea35) — ⚠️ deliberately alongside the champion digests, so that editing the plan block without the card fails both rows rather than letting the two surfaces drift apart quietly.

⛔ The card is why this release waited. No approved fragment said what the shipped lane exists to say — what you can now do. «El plan táctico no se muestra» is the limitation; using it as the title would have been 100% approved text making a claim the approval never made, by emphasis. So the tag held for one five-word title.

Guards: no-plan-on-public-routes (structural, incl. the read model) · scout-omits-plan (behavioural) · public-champion (10) · no-raw-ids-on-public-champion (rendered output). Twelve mutations run red and restored across them.

The disclosure. GET /api/leaderboard/[characterId] — anonymous scouting, no auth of any kind — returned build.plan: the champion's full tactical rule tree. Measured live on `app.develop` with no cookie and no header: three readable rules and the aura of a real player's champion.

It was never rendered. CombatantSheetCard calls snapshotToActor only to read actor.skills; no surface has ever displayed a plan. So the rule tree was serialized to every browser that clicked a leaderboard row and shown to nobody.

Rj's ruling, the same day (`decisions.md` — the public profile shows the BUILD, never the tactical PLAN): «No plan táctico». The build is public because it is the thesis — the skill is theorycraft, and Duels (2008) showed you the rival's build. The plan is the hidden half: hand it over and every duel against that champion is a solved problem, with no read and no risk.

The fix is at the route boundary, by omission. const { plan: _plan, ...build } = … — the key is absent rather than emptied, because plan: [] is a claim ("no rules") where absence is the honest shape. ⚠️ Not in dbSnapshotToBuild: that build is the fight input and the engine requires the plan. ScoutedBuild now types the client side, because the wire narrowed and tsc had nothing to say about it.

Census, five surfaces: the replay loader already stripped the plan for a public viewer before the ruling (it is what the ruling generalizes); /api/duels/[id]/log returns events only; /api/challenges/* resolves builds server-side and returns none; /api/simulator takes builds as input. One leak, now closed.

Guards, both mutation-proven against the exact shipped line and two plausible wrong fixes: tests/routes/no-plan-on-public-routes.test.ts (structural) and tests/routes/scout-omits-plan.test.ts (behavioural — it plants a real three-rule plan, because a fixture with an empty plan passes against the broken route).

⭐ And the scope gap that hid it: no-auth-name-on-public-routes — the privacy gate written days earlier — listed src/app/(cockpit)/u, site and api/og as "routes a stranger can open" and did not list api/leaderboard. It meant public pages while saying public surfaces. Added.

The leak (shipped fixed in v0.115.2, live since). /u/[accountId] rendered User.displayName — the Kinde/Google account name — as the page heading, in the <title>, and in the shared-link preview, on an anonymous-readable URL.

The fix is at the query, not at the mapper. displayName left PUBLIC_FIELDS, the explicit allowlist the owner document is read with, so the field is no longer loaded and no later edit can render it by accident. The public identity is publicIdentity() — the account's oldest champion's name, oldest rather than highest-rated so a shared link's title does not change when a player levels a second champion. No champion → the neutral heading, a real state and not a 404.

Why this tag exists. v0.115.2's notes titled the Spanish section «ES (Discord)». The release Action extracts the Discord post with /^##\s+Para jugadores/m and fails the run without it — so 15/15 gates were green, the deploy succeeded, the fix went live, and the announcement never fired. A contract enforced only by its consumer is enforced after the tag, which is after the last moment it is cheap to fix. check:notes-vs-code now asserts that exact H2, at §2d, before the tag exists. Mutation-tested both ways; the last 15 notes files all carry it, so the gate encodes the real convention rather than inventing one.

Also live, no player surface: the admin champion-detail page and the two links that pointed at the wrong objects (docs/gaps-and-risks.md §107), and check:notes-vs-code gaining lacks — because a privacy release's central claim is an ABSENCE — plus a hard failure on any verify: line it cannot parse, because the first lacks line ever written was silently dropped while the summary reported two assertions for a file holding three.

The leak. /u/[accountId] rendered User.displayName — the Kinde/Google account name — as the page heading, in the <title>, and in the shared-link preview, on an anonymous-readable URL.

The fix is at the query, not at the mapper. displayName was removed from PUBLIC_FIELDS, the explicit allowlist the owner document is read with, so the field is no longer loaded and no later edit can render it by accident. The public identity is now publicIdentity() — the account's oldest champion's name (oldest rather than highest-rated, so a shared link's title does not change when a player levels a second champion). An account with no champion gets the neutral heading, which is a real state and not a 404.

Guard: tests/routes/no-auth-name-on-public-routes.test.ts — it asserts the absence across the public routes, not just this one, and fails if displayName re-enters a public read model.

Also in this tag, no player surface:

• The admin champion-detail page and the two links that pointed at the wrong objects — docs/gaps-and-risks.md §107.
• `check:notes-vs-code` gained `lacks`, because a privacy release's central claim is an ABSENCE and the gate could only express presence — and it now FAILS on a `verify:` line it cannot parse, because the first lacks line ever written was silently dropped while the summary reported two assertions for a file holding three.

The deploy that skipped itself

scripts/vercel-ignore-build.mjs decided whether to build from git diff --name-only HEAD^ HEAD — one commit. The v0.115.0 release pushed two: the notes, roadmap card and copy anchors, then a docs-only commit (pnpm test appends to docs/test-runs.jsonl). The tip was docs-only, so the whole push was skipped, the content never deployed, and the release workflow correctly refused to publish against a sha with no READY deploy.

That file's own header says "a needless build costs money; a wrongly skipped one ships a lie about what is deployed." The header was right; the implementation only ever looked at one commit.

• It now diffs from `VERCEL_GIT_PREVIOUS_SHA` — the commit the last deployment on this branch actually built, which is the honest baseline for what would this deploy publish.
• Every uncertainty still fails toward building: an unknown sha (shallow clone, force-push), a git error, and now an empty range, so a redeploy is never a silent no-op.

Two gates, so it cannot recur

• `pnpm check:release-commit-shape` (§2r) — the commit about to be tagged must itself contain the version bump and its notes file, not an ancestor. Enforces the ritual rule: stage the release by explicit path, never git add -A, and never run pnpm test between staging and committing.
• `tests/routes/source-reads-go-through-the-helper.test.ts` — a test that reads src/ or scripts/ must go through stripComments. ⚠️ A source assertion against the raw file passes on a comment: twice in one session a check measured prose while the code said the opposite, and the mutation stayed green. 25 existing tests are grandfathered as a shrinking ratchet, with the sweep filed at gaps-and-risks.md §105.

⚠️ docs/test-runs.jsonl stays tracked — it is an append-only record keyed by sha, not a regenerable artifact. The discipline is the fix, not untracking a history.

The bell

New NotificationKind `cosmetic_restored`, two variants on one kind — re-equipped vs slot taken, chosen by a reEquipped flag. ⚠️ A missing flag falls to the slot-taken wording, which is the safe direction: it says where to find the thing rather than claiming it is already on the player's profile.

⛔ Added to the TS union and the mongoose enum — the F3 lesson. A kind in the union alone type-checks and is rejected at runtime, and notify is best-effort, so the bell would be silently dead. Locked by a test that writes one through the real route.

A restore returns the equip state (Rj, 3 sep 2026)

Revoking a cosmetic triggers the lazy auto-unequip, so a restore that only cleared revokedAt gave ownership back and left the profile blank. Now it re-equips when the slot is still free, as a compare-and-swap on the slot being null — so a choice the player made in the meantime is never overwritten — and reports slotTakenBy when it is not. item_skin is deliberately not a slot: its look returns by itself.

Admin slice (b) — Usuarios and the ten user-detail tabs

Internal surface. /users on DataTable with paging in the URL and an honest total (count-or-say-why); /users/[id] with the Acciones toolbar pinned above a ten-tab strip; Actividad as the default tab — one stream over six sources via a k-way merge with per-source cursors, which names any source it could not read rather than looking complete.

Every tab states what it cannot show: the Ledger is incomplete by construction (the forge writes no ledger row), Reportes lists reports MADE and explains why "received" cannot be listed truthfully, Auditoría matches the typed targetUserId only.

Entitlements, and the typed revoker

• `Entitlement.revokedBy: 'dispute' | 'admin' | null` — the typed discriminator; null means UNKNOWN and is unrestorable. Backfill derives dispute from the legacy note and never infers admin.
• ⛔ A chargeback revoke can no longer be undone by hand — found by money-path review on the new restore door, which revived them on every kind but bp_grant. It was a class in five places; a structural gate now scans for a sixth.
• Two buttons per row, derived visibility, disabled-with-reason, and a client↔route refusal-map weld.

Gates

check:glossary (§2q, per-locale) · check:blocker-parity (§2p) · check:notes-approval · user-tabs-complete · dispute-revoke-durability. And the voided-ledger allowlist is now scoped: a file may be excused for the constructs it names, not wholesale.

One name per concept, PER LOCALE

Rj's ruling, and it is a locale rule rather than a spelling preference: «stamina en inglés y estamina en español». ES says «estamina»; EN says "stamina"; «vigor» is retired everywhere.

• 15 strings across 6 ES catalogs, machine-applied from the reviewed table (docs/glossary-batch-tables.json) — nothing retyped between the review and the tree.
• The booster has one Spanish name: «Potenciador de estamina», SKU name included. «Refuerzo de vigor» and «Booster de estamina» retire.
• ⛔ Two strings said "Sin energía" while MEANING stamina — and «energía» is the Rogue's actual RESOURCE. A player out of stamina was told they were out of the thing their Rogue spends in a fight. The other five «energía» strings ARE the resource and are untouched.
• `pnpm check:glossary` (release gate §2q) enforces both halves going forward, mutation-tested four ways — including that the Rogue's «energía» correctly does NOT trip it. A guard forbidding a live mechanic's name would be worse than the drift it prevents. It also refuses a locale directory with no rule set, so a future locale cannot read as clean by being unscanned.

How the approval reached the tree

scripts/apply-glossary-batch.mjs <A|B> writes exactly the reviewed rows and re-asserts three invariants at apply time: placeholder lists unchanged, capitalisation unchanged, and the on-disk value equal to what was reviewed — if a string had moved since the draft, the Aprobado would not cover it and the script stops rather than forcing.

⚠️ Two defects the tooling caught in the batch itself, both banked: the first transform renamed the ICU placeholder {stamina} → {estamina} (compiles; breaks interpolation at runtime), and check:glossary found a row the change table had missed — a string that was right about the stat and wrong about the booster name.

The booster is now per-purchase

stamina_boost moved from one shared row with a hand-written `expiresAt` to per-purchase `contributions[]` with a DERIVED expiry, under the signed law FREEZE CONSUMED TIME (Rj «Confirmo» + Fable, 2 sep): a revoked contribution keeps exactly the days it already delivered, its unconsumed days vanish, and later contributions run from their own grantedAt — never re-attributed.

• `src/server/booster.ts` is the ONE WRITER of a booster's expiresAt and contributions, enforced structurally (booster-single-writer.test.ts). src/domain/booster-replay.ts is the pure replay.
• A named partial unique index (one_stamina_boost_row_per_account) makes one row per account a database invariant. Measured before it: 15 concurrent grants produced 14 rows; after, on the live DB: 1 row.
• The `stamina_boost` chargeback carve-out and the admin route's hand-built day subtraction are gone — the semantics are per-purchase by construction rather than by a comment nobody enforces.
• `POST /api/admin/restore-entitlement` (Rj: «admin revokes are NOT permanent»), source-scoped: it revives an admin revoke and never a dispute revoke.
• Moderation survives any purchase (ruled 3 sep): a moderated player who buys again gets the new days; the moderated contributions stay dead, and a structural gate now fails the build on any writer that clears revokedBy: 'admin' outside the admin restore door.
• The admin Revoke button was dead on every booster — the client sent entitlementId + boosterDays while the route required contributionId. Fixed, with a contract test that drives the real route using the client's own request builder.
• `entitlement_expired` had become once-per-account-forever (the reused row kept its stamp); re-armed on any write that leaves the booster active.
• The `warning_closed` dispute restore is now transactional — the third leg of the F6 defect, and the common path.

Ops

• `pnpm audit:boosters` — a read-only auditor, deliberately independent of the migration.
• `pnpm backfill:booster-contributions` — RUN on ddro_dev 3 sep (Rj: «Autorizo»); closes sk_live blocker 3k. Read back independently: index present/unique/partial, 0 duplicate accounts, 0 drifted rows, 0 accounts whose effective days moved.
• `pnpm check:blocker-parity` — release gate §2p; found blocker 3h missing from the ledger for thirteen days on its first run.
• `pnpm check:notes-approval` — re-hashes approved copy so an Aprobado cannot drift.

How it was reviewed

Three adversarial money-path passes against the working tree before the push: 19 findings, 4 exploit-gravity. Three of those were found only because each pass reviewed the previous pass's fixes — two over-grants and one laundering path were introduced by fixes, not present in the original defects. Full account: docs/gaps-and-risks.md §101–102.

The raw-key defect. Four $5.00 cards printed store.cosmeticType.background and store.cosmeticBlurb.<key> live. localizeStoreCards builds keys DYNAMICALLY, so check:i18n-hardcoded had no literal to scan for — and the ES/EN catalogs agreed with each other perfectly while BOTH were missing the same eight entries. Key parity is agreement, not coverage. The new guard asserts RESOLUTION, derived from the catalog, and rejects a blurb that is its own key path.

Backgrounds were sellable and not equippable. The profile panel hand-listed three slots — the FIFTH stale copy of one list in this arc. All of them now derive from lib/cosmetic-slots.ts. ⚠️ That spec is in lib/, not server/: a 'use client' import of the server module pulled mongoose into the client bundle, with typecheck GREEN and build RED.

Lore. Eight fragments on the background slot, parsed from the approved doc. Guarded, including a canon test that fails if El Velo's declined "crossing" is ever reintroduced.

Fight backgrounds. Eight pieces: four sold at a signed $5.00 (Rj + Fable, 2 sep), three earned per race on S1 completion (neverSold, defended by promise-guard's new homelands noun AND by a key-derived test that walks every sale rail), and La Arena as the free floor. Stripe TEST prices created and read back; item_skin_* byte-unchanged.

⚠️ The render half had shipped DEAD: background was on the EquippedCosmetics interface but never in the mongoose schema, so every write was silently discarded and no API accepted an equip. typecheck green, five test files green — all of them over pure functions.

Chargebacks. charge.dispute.created / .closed / charge.refunded. The invariant: restore == clawback, never restore == grant. Atomic claim keyed to the dispute id, a BP debit clamped in the database, stamina_boost excluded from the revoke (its row is shared), and an admin route to lift a block. Three adversarial review rounds; each found money defects in the previous round's fixes.

Duplicate charges. One defect across five sale rails. Nothing ever charged real money (Stripe is sk_test), so these were sk_live blockers, not losses.

Deferred: the theme packs (Pack Ember / Pack Frost) wait post-launch on the item picker — the $5.99 price is signed and preserved. See decisions.md (theme packs deferred).

F2 — `_landing.tsx` `REPLAY.winnerTick` 20 → 18. The last open item from the 1 sep claim audit. Re-measured at seed 20260815 with this page's own affinity casting (warrior=tharum vs rogue=sylphar). The winner is unchanged and always was; only the tick had gone stale through the rebalances.

> ⚠️ The audit had reported the WINNER as wrong too, and it was not. It re-ran the duel with the > default race casting — a different matchup, which does produce a different winner. Verified > across all three plausible castings before changing anything. The comment now on the constant says > to re-measure with AFFINITY_RACE, never with the defaults. > An instrument that does not reproduce the product's own configuration measures a different product.

Release Action — the deploy wait no longer manufactures false failures. On v0.112.1 it timed out after 10 minutes while the build was healthily BUILDING; the deploy went READY five minutes later and a plain re-run was green. A verification step that expires before a normal build completes reports a broken release when nothing is broken — and that is how a real failure gets ignored later. Now: a 30-minute ceiling, and when VERCEL_TOKEN is present it polls Vercel's own state (READY / ERROR / CANCELED) rather than the GitHub deployment record. ⛔ `VERCEL_TOKEN` is not set (the repo has only BETAHUB_* and DISCORD_RELEASES_WEBHOOK_URL) — adding it is Rj's call, it is his Vercel account. Until then the step degrades to the GitHub-record poll with the fixed ceiling, which alone would have made v0.112.1 pass. The moment the secret exists the better instrument turns on with no further diff. Why it is better: Vercel reported BUILDING from 07:43 while the GitHub record appeared only at 07:58 — at completion — so the record cannot tell "not started" from "building", nor fail fast on ERROR.

A guard for the `Windrun` boundary. Windrun is a real, different mechanic — the Windrunner legendary's evade-haste status (engine.ts, uniques.json, common.json) — and the landing had been giving its name to the Sylphar passive. A grep for Windrun still hits the live EN pages legitimately, so a future reader could "fix" the legendary's own label. The new test pins exactly that boundary: passives must use race.ts's names (Stoneskin / Lightstep / Communion) and must never be called Windrun; the legendary's label is none of its business. Mutation-verified.

Gates: roadmap-drift ✓ (n/a — patch) · es-register ✓ · no-server-actions ✓ · no-native-select ✓ · copy-anchor ✓ · typecheck ✓ · workflow YAML parses + bash -n clean.

Six corrections from the 1 sep catalog-wide claim audit (41c037c2), which diffed every roadmap card, store description and landing claim against the code behind it. /roadmap is publicly reachable (HTTP 200, no auth, measured), so these were published, not internal.

F3/F4 described a rule abolished on 20 ago (ENHANCE_FAILURE = 'demote'; the route hard-codes destroyed: false). F4 sat on a `shipped` card and was contradicted by items.nothingBreaks on the same rendered page; F3 was contradicted 31 lines later in its own file. F6 is privacy-adjacent — a claim about what we record about the player — and the old line understated it (material-pack-grants.ts:107 writes a row for the unpaid endless-path fill). F7 follows the rule that the site says what the game shows: the in-game picker renders Pasiva · {name} interpolated from race.ts, so a Spanish player already sees Stoneskin. Five of six strings disagreed with the game. ⚠️ Windrun was also a name collision — it is the Windrunner legendary's evade-haste status, a different real mechanic.

Byte anchors (Rj's Aprobado, 1 sep 2026)

What did NOT ship

F2 (the landing's hardcoded duel result) is deliberately excluded — it is a code constant, not copy, and the audit's severity claim was wrong: re-measured with the page's own affinity casting the winner is still correct, only the tick is stale (18, not 20). It is a two-line fix on its own. Five claims remain unresolved and ride with launch blockers 3i/3j — chiefly "Everything else in the store is bought with BP", which understates the money path and needs Rj + Cowork, not a code verdict. The passive-language question — the game shows English proper nouns to Spanish players, which is now consistent but not necessarily right — is parked with Rj.

Gates: roadmap-drift ✓ (n/a — patch) · es-register ✓ · no-server-actions ✓ · no-native-select ✓ · copy-anchor ✓ · typecheck ✓ · suite 2960 passed + components 305 (2 pre-existing "RED BY DESIGN").

The only player-visible change is the roadmap card. itemSkins moves from the building lane to shipped at v0.112.0. The feature itself shipped in v0.57.0 (2 Aug 2026) and its flags (item-skins 241562, forge-on-demand 241563, forge-real-generation 251817) have been ACTIVE since 2 Aug — read back from PostHog on 1 sep, not assumed.

Card copy is UNCHANGED and already approved — items.itemSkins in messages/{es,en}/roadmap.json. A lane move adds only the version tag, so no new player-facing string enters the catalogs. The ES above is release-notes copy, which is why it still needs the Aprobado.

Why now, and the rule worth keeping

Rj's ruling, 1 sep 2026, overruling a recommendation to wait for sk_live: there is no `sk_live` world yet. Everything is develop; this page's audience today is the cohort in a test-money world; and in that world «ya está» is true. The real-money standard applies at the cutover, where the launch-copy audit (PRO-150) re-reads the cards.

> General rule (standing): a pre-launch surface is judged against the cohort world it serves, > not against a production world that does not exist yet — the «aún no estamos en producción» rule, > applied to copy.

⚠️ One gap closed in the same diff. The cutover checklist re-read "every `horizon` and `building` roadmap card" — shipped was only trimmed, not re-verified. Graduating a card would therefore have moved it out of the audited set. production-launch-plan.md now carries an explicit item: every shipped card re-read against the real-money world at the cutover, naming itemSkins and its 3i kinship, so a graduation cannot be a way out of the audit.

Gates: roadmap-drift ✓ (minor is on the shipped lane) · es-register ✓ · no-server-actions ✓ · no-native-select ✓ · copy-anchor ✓ · typecheck ✓ · suite 2960 passed (2 pre-existing "RED BY DESIGN").

pickVariantKey's last-resort fallback returned sorted[0], and -comun sorts before -magico. So any armor whose subtype has no generated sprite states fell all the way to a común look — including legendaries — while traceVariant reported reason: 'variant', i.e. success.

Measured on mail, which has zero generated states while the catalog carries 10 mail armors, two of them legendary: a-warlords-mail requested a-mail-magico and rendered w-sword-comun_a-plate-comun. It now renders w-sword-comun_a-plate-magico.

The material substitution is by design — the catalogs assign one armor look per class — and is unchanged. Only the tier collapse is fixed. Determinism is preserved: the tier-matching subset is filtered from the same sorted list.

Authorized by Rj («Si y si», 1 sep 2026) — rendering is a signed surface.

Not affected: armor whose subtype does have states (plate/leather/cloth) already matched exactly and is byte-identical. With no armor equipped there is no requested tier, so the old sorted-first pick is unchanged.

Before/after: docs/screenshots/2026-09-01-tier-collapse-before-after.png. Full measurement: docs/gaps-and-risks.md (LIVE VISUAL GAP — mail armor).

The endgame modes — two new surfaces, no money leg

• The Gauntlet (/gauntlet, opens at the level cap). One ruleset a week, the same for everyone, applied to both fighters. Five stages, consecutive: clear one to face the next, lose and the run ends where it stands. The board orders by depth, then ticks, then who finished first — a comparator that mirrors the compound index exactly, and is driven through the DB in tests rather than through the function alone.
• The Daily Duel (/daily-duel, opens at the Arena gate). Everyone fights the same provided kit against the same opponent, so the only variable left is the plan. The puzzle is a pure function of the day key — same day, identical for every player, re-derivable forever.
• Both are visible while sealed, per the newbie-shield doctrine: below the gate you can read the rule, the board and the medals, and only the fight is withheld. The seal is cosmetic; the server re-verifies the level on every call.
• The two gates are deliberately different numbers — the Gauntlet is max-level-only by design (Rj: «lo que la gente va a jugar estando en la cima»), the Daily Duel opens at 5.
• Rulesets are gate-bound. A ruleset enters the weekly pool only after it measures inside the signed bound; the admission gate is wired, not aspirational. The rotation is a pure function of the week key over an append-only ledger, so pool growth cannot rewrite which rule any past week ran under.
• Medals are per-ruleset, and the pool cannot admit a ruleset without one. They are identity, never power — they change nothing about any fight. Shown on /profile and on the public medal case at /u/[accountId].
• Settlement is lazy, and reading a due week settles it — which is exactly why the pages now refuse anonymous readers (below).

Champion identity — a name is yours

• Champion names are globally unique, folded case-, accent- and whitespace-insensitively (characters.nameKey, a PARTIAL unique index — the partialness is what prevents a fail-open index build over rows missing the field). Backfill applied and the index read back live.
• The 84 ladder-roster names are reserved, derived from the roster rather than copied, so the list cannot drift from the ladder it protects.
• The fold sees through invisible characters and homoglyphs — a zero-width joiner or a Cyrillic о no longer buys a second champion wearing someone else's name.
• Every rename writes a `ChampionRename` row inside the rename transaction. The forensic census that found the exploit could only return a bounded zero because renames were audited nowhere; closing that evidence gap became this arc rather than a footnote.
• Security: a winner is an IDENTITY, never a display name. A player could rename themselves to their opponent and have a loss credited as a win, forging story BP. Fixed at the class, not at the sites a review named.
• NAME_RESERVED was widened after Cowork's review to cover every opponent, not just the ladder roster.

Fixes and plumbing

• Eight native `<select>` elements migrated to the house `Select` (black-market board filters and post form, plus the admin entitlement-SKU picker). They anchor, flip and shift over the page and work under touch and keyboard typeahead. Mechanized as pnpm check:no-native-select — the Floating UI convention had been prose-only for a month and decayed. The gate carries a written-reason escape hatch, because three admin filters are <form method="GET"> server components that genuinely cannot use a client-only controlled primitive.
• The endgame gate constants are welded by the type system. GAUNTLET_GATE_LEVEL and ARENA_GATE_LEVEL each existed twice under a comment calling the duplication uncollapsable — reasoning that weighed only the two files importing each other, never a third module pure for both, which both already imported. Now one definition each in domain/progression.ts.
• Three browser tests had been permanently red and were asserting nothing. /gauntlet and /daily-duel gained an auth redirect (an anonymous GET was settling due weeks and granting medals), so those tests stopped reaching the page. They now drive a dev harness with the gate level imported from the domain. Full browser suite: 129 passed, 0 failed.
• The entrant count is the count of entrants shown (F5, found alive at a second site after the first fix), and five further ultrareview defects on the endgame modes closed (F2–F6).
• A typed flag registry whose census finally matches PostHog, and the i18n barrel generator the barrel claimed to have — it was described in a docblock and had never been written.
• `pnpm check:copy-anchor` re-computes a digest of every Rj-approved copy block and fails the tag if one moved. It replaces a hand-rolled shell loop that printed ✓ for every block while the hasher was crashing.

Process

• A push is a publish. Every copy gate fired at the tag, but develop is bound to the cohort domain and the no-per-feature-flag norm made the release the switch — so the publishing event had quietly moved to the push, ahead of every gate. Six wave-2 strings were live before their Aprobado. Recorded with dates in docs/es-batch-endgame-wave2.md; the rule is now stated in release-process.md.
• Release-process section letters de-collided (claude-version §2l · draft-freshness §2m · accepted-reds §2n).

Accepted reds carried into this release

Both are RED BY DESIGN, named, dated and re-signed in docs/accepted-reds.md:

• no cast may overdraw a resource below zero — owner Fable (the swing redesign).
• the essence anchor — every BP route, not just the one that was modelled — owner Rj + Fable.

• `cta_clicked` on every registration CTA. The frozen baseline had a hole between landing pageview and account_created: "did strangers click, or did they never arrive?" was unanswerable, and those are completely different problems that look identical in the numbers.
• Four CTAs, four distinct `location`s — hero · closing · forge · kit. An undifferentiated event would answer "did anyone click" while hiding which argument did the work, which is the only actionable thing a landing funnel tells you.
• `signup_started` was considered and REJECTED. The CTA points straight at Kinde's hosted register, so there is no in-app moment between the click and leaving — a "start" event would fire on the same interaction under a second name. Drop-off inside Kinde's pages is invisible to us either way. One honest event is the maximum this flow supports, and inventing granularity the flow does not have would have put a second unreliable number in the funnel.
• Guarded so the step cannot be lost again. A test fails on any registration URL rendered from a bare anchor, on two CTAs sharing a location, and on the event name drifting from the one the baseline recorded as missing. Mutation-proven by reverting one CTA to a plain link.

• The EN landing is now a second original, not a mirror. DEFAULT_LOCALE stays 'en' (Rj: «Dejar inglés»), and a scraper and an anonymous visitor both carry no locale — so English is the text strangers actually read, and until now they met a faithful translation of the voice §1 calls the asset, rather than the voice itself.
• The finding was one habit, not eighteen decisions: the EN never contracted. «do not», «It is already playable», «You are looking at». Contractions are English's tuteo — the Spanish addresses one person and the English was addressing a room. Most of the pass is that; the rest is four genuine calques, the clearest being "Four ways to argue" for «Cuatro maneras de discutir» — playful in Spanish, merely odd in English. Now "Four ways to settle it."
• Claims mirrored exactly; only phrasing moved. Two calls worth naming, both endorsed in review: «merezca» → "earns" rather than "deserves" (earn is this project's own vocabulary — relics are earned, rank is earned), and about.p2 restored to "the one tempering the steel", because the ES names people and the EN had named a process.
• The byte-guarded promise sentences were never touched — value.power.title, value.power.body, faq.store.a. Verified programmatically before the draft was written, and store-promise.test.ts is green.
• What shipped is what was reviewed. The wiring script parsed the approved strings out of the reviewed document rather than retyping them — retyping ships a copy of a review, not the review.
• ES is untouched and remains the original of record for the cohort.

• The landing shows the fight instead of describing it. The replay excerpt was a REAL run (seed 20260815) rendered as prose; the two fighters now trade the blows those ticks describe, on a loop, above the same seed line. Not a browser-side replay — running the engine on a marketing page for three ticks of motion would drag the cockpit renderer onto it. The loop animates the run the excerpt already documents, and the seed beneath keeps the claim checkable, which is the only reason showing it is worth anything.
• Motion is opt-out-able TWICE, and both are tested. The OS media query and the app's own persisted preference (data-reduced-motion on <html>). A hero honouring only the media query ignores the setting a player actually changed inside the product. A control test asserts it does animate by default — otherwise both opt-out tests would pass over a hero that never moves.
• The site OG card now carries the CANONICAL host, and the fix was measured, not guessed. Next's file-based opengraph-image.tsx convention ignores `metadataBase` and emitted the raw Vercel preview host into every shared link. Proven by contrast on the same deployment: the replay card builds a relative URL and resolves correctly — so NEXT_PUBLIC_APP_URL and metadataBase were both fine all along. The card moved to /api/og/site, referenced relatively.
• The site card reads ENGLISH, matching the page a stranger opens (Rj: «Dejar inglés»). The replay card stays Spanish. It still authors no copy — every line is read from the live landing catalog, so rewording the page rewords the card.
• A sibling browser spec located a sprite page-wide and went ambiguous when the hero added a second one. Re-anchored to the race section it is actually about.

• A quiet «Iniciar sesión» in the site header. The only login path was a small link buried mid-page, so a returning player landing on the public site had to hunt for the door (Rj's catch). ⚠️ _landing.tsx carries a comment saying the chrome already owns Login and a second one would be a bug — true of routes that render CockpitChrome, and this layout deliberately imports none, so there was nothing to collide with. The comment read as a reason not to fix it.
• The site-wide OG card exists. ⚠️ The defect was not "no card": the root already served og:title, og:description, og:site_name, og:type and `twitter:card = summary_large_image` — with no image at all. It declared a large-image card and supplied nothing, which unfurls worse than having no tags.
• The card authors no copy. A tagline on the site card is brand copy, and brand copy is held on Rj's words — so every line is read from the live landing catalog. Reword the landing and the card follows; it cannot become a second place brand copy is written.
• Spanish, by the same ruling as the replay card. A scraper is always unauthenticated, so it resolves the en default. Read from the ES catalog directly, because getTranslations({ locale }) is a no-op here — i18n/request.ts resolves its own and ignores the argument. That trap already cost the replay card one release.

• A duel now SURVIVES a participant's account deletion. It used to deleteMany every duel the leaver had fought — including the opponent's half — so a player who stayed lost their own record of a fight they fought, and the replay URL they had shared died because someone else left. A duel is a two-party receipt, the same reasoning that already keeps a settled Trade. The leaver's handle goes; the fight stays.
• Why it was never argued before: Duel is invisible to deletion-completeness, which detects collections by a userId schema field — a duel references Character. It was neither purged with a reason nor listed as retained. It is now, and so is Snapshot.
• Snapshots referenced by a surviving duel are kept too, scrubbed. Without that the retention is theatre: the replay needs both builds, so deleting them leaves a URL that is "kept" and 404s. Unreferenced snapshots are still deleted — retention scoped, not blanket.
• ⚠️ The scrub introduced a defect, caught mid-build. The outcome is read from winnerCharacterId — a handle — so clearing it makes every erased duel answer "the attacker lost". A fight the leaver won would have rendered backwards to the player who stayed. Retention that changes the result is worse than deletion. The duel now stores winnerSide.
• The OG card is revived (Rj lifted his own 8-Aug gate, judged on today's image). Replay pages get generateMetadata; the shared duel link is the only URL players actually paste. The card renders in Spanish — a link scraper is always unauthenticated, so it resolved the en default and every shared card was English for a Spanish-speaking cohort.
• `/api/og/` left the i18n allowlist. That exemption was correct while the card was dormant and stale the moment it unfurls; the gate now watches the card like any other player surface.

• Board search, on BOTH sides of every listing. Filter by kind, by a specific equipment def or gem, and by a rarity floor. A listing matches if the thing is on the offer side or the seek side — searching for an Iron Hatchet finds who is giving one away and who is asking for one. Matching only the offer half would answer half the question while looking like it answered all of it.
• Infinite scroll on a KEYSET cursor `(createdAt, _id)`, not an offset — and the test proves why. The board mutates under the reader: it settles two page-one listings between the two fetches. Swapping the cursor for .skip() turns that test red with a genuine skip — the listing that just became more interesting because the board thinned. _id is the tiebreaker because createdAt is not unique.
• The obvious index was wrong, and `explain` said so. {status, expiresAt, createdAt, _id} came back SORT → FETCH → IXSCAN on the old index: expiresAt is a range, and every key after a range is unordered, so the index cannot serve the sort. Dropping it makes status an equality match and the sort comes off the index — LIMIT → FETCH → IXSCAN, no SORT stage.
• Two empty states with different words. "Nothing is on the board" and "nothing matches your search" look identical as blank space and mean opposite things — one says come back later, the other says change your search. A malformed filter is a named 400, never an empty board.
• `server/board-labels.ts` — the client authors no strings, but scrolled-in rows arrive through the route, not the page. Both render labels through one builder rather than two.
• The escrow badge. An item backing an open listing sat in the stash silently un-millable, un-equippable and un-reforgeable, with nothing saying why. It now says «En trueque» — its own prop, because locked on that card already means "not owned".

• Asynchronous P2P barter. Post a listing offering up to 5 items and 5 gem stacks, asking for a kind of thing — never another player's particular instance, because you cannot see their stash and the board never reveals it. Someone holding a match takes it; the goods swap inside one transaction. 3 open listings, 72-hour expiry, level 10 to trade.
• Barter only — no currency leg, no fees, no bidding, no prices. The market sells nothing and charges nothing: there is no path from a wallet to an outcome here, because there is no wallet here. Stated at that scope deliberately — not as "the promise survives intact". The money-path review re-worded the store surfaces precisely because the unqualified absolute did not hold across accounts, which is why the guarantee now reads «el rango y las recompensas de temporada no se venden ni se trocan». The notes must not resurrect the sentence the review retired.
• Equipment and gems, and nothing else (TRADEABLE_KINDS). The absences are signed decisions, each with its reason recorded: catalysts (content-bound supply is what keeps the +9/+10 band honest), essence (the climb eats it — 77/month of transferable headroom before the signed 6-month forge floor breaks), BP (it is sold for real money; a currency leg would end pure barter and put money into the market in one move), plus dust, punches, blueprints, recipes and entitlements.
• Escrow, so a listing cannot promise what it no longer has. Offered items carry reservedByTradeId and are refused by every path that consumes or moves an item; offered gems are debited at post and refunded on cancel or expiry. Two mechanisms because an item is an instance and a gem is a count.
• The advertisement is FROZEN at post (offer.itemSnapshots) — defId, rarity, forge level, socket contents, affixes. So the board needs no cross-user inventory read, and a settle refuses outright if the goods are no longer what was advertised.
• Transfers RE-MINT. A traded item is not re-owned: a new instance is created and the source deleted in the same transaction. A fresh _id breaks every join from the old instance — including into collections that do not exist yet.
• Fixed phrases, no free text. Eight of them, and the key is stored, never the sentence — so the wording can be rewritten tomorrow without touching a posted listing. This dissolved a pre-wiring blocker rather than managing it: player-authored text reaching every other player, with no report path, on a surface no moderation pipeline covers.
• Seven adversarial money-path rounds before any UI existed, then a delta review over everything writer-side since. The delta found two real defects, both fixed: the fulfil picker denied an item the settle accepts (a 60-row cap applied before the rarity floor), and the escrow diagnostic blamed the wrong precondition on a multi-item offer, reading a reservation its own aborting transaction had just written.
• A lie older than the feature, fixed. locked shipped with UX-11 and never got a backfill, so items minted before it have no such field — and {locked: false} does not match a missing one. Anyone with a pre-UX-11 item was told "no longer yours" when posting it and "you do not have it" when fulfilling with it. Reachability unmeasured; no production query was run.
• Guards: 22 rejection reasons each with copy in both languages, welded so a new one fails the build; N-concurrent probes on post, fulfil and cancel; read-boundary key sweeps on both projections; every guard mutation-proven red — including one for the picker defect that was flaky twice before it was made deterministic.

• Vercel "Ignored Build Step" wired (vercel.json → ignoreCommand). 20+ docs-only commits landed on `develop` in a single day, each triggering a full production build. Commits that touch only docs/ · .claude/ · README.md · CLAUDE.md now skip it.
• ⚠️ `docs/` IS NOT UNIFORMLY SAFE, and the first draft of this rule was wrong. next.config.mjs bundles docs/release-notes/** and docs/legal/** via outputFileTracingIncludes; the public /site/releases, /site/privacy and /site/terms pages fs-read them at request time. A naive "skip all docs" rule would have silently stopped publishing release notes to the public site — the page would look fine and simply stop updating. Both paths are carved out.
• Fails toward BUILDING. No SHA, shallow clone, git error, unrecognised path → build. A needless build costs money; a wrongly skipped one ships a lie about what is deployed.
• ⚠️ Vercel's exit codes are inverted (0 = skip, 1 = build) and the script says so at the top, because reading it backwards silently stops deploying.
• 10 tests, three mutations red — including a weld asserting that every docs path next.config.mjs bundles is carved out of the skip rule. Neither file can enforce that alone.

• The forge queue runs ON DEMAND (Rj: "¿no podemos hacer que se apague el cron y se prenda on demand y se apague cuando termine?"). Creating a forge job kicks its own worker; each worker that finds work kicks the next; the chain stops by itself when the queue is empty. /api/cron/forge goes */5 * * * * → *`0 ` and is demoted to the orphan backstop. 288 → 24 scheduled invocations/day, and a forge starts immediately* instead of waiting up to five minutes for the next tick.
• Why a chain of invocations and not a loop. A real forge measures ~22 min against a 5-minute function, so "drain until empty" cannot be one while loop inside one request — each link is a fresh invocation resuming the same job through job.stateId + the write-ahead spend ledger. Worth naming: an hourly cron with a self-contained drain would have advanced a 22-minute forge one tick per hour — ~22 hours. The chain is what makes the hourly cron safe, not a refinement on top of it.
• ⚠️ The concurrency fix this REQUIRED. processForgeQueue used to find() the lease-free jobs and lease them later, inside processForgeJob — a read-then-write gap. Survivable while the only caller was a serial cron; not survivable when any player click can start a worker. Two workers on one fresh real job means the loser of the write-ahead state claim throws, and that throw marks the job failed + flagForRj — killing the winner's paid, in-flight forge and paging Rj about a forge that was going fine. The claim is now ONE atomic findOneAndUpdate. Mutation-proven: under the old code, five racing drains all claim the same job.
• The inner write-ahead claims (animAttempts, stateAttempt) are untouched — they are the layer that survives this one being wrong.
• Removed: the request route's delayed, mock-only processForgeQueue(). Its whole reason for existing was that nothing else would advance a mock job for up to five minutes; leaving it in beside the kick would have put two workers on one job. Inert in production either way — forge-real-generation reads back at 100%, so cohort forges are real, not mock.
• Stale comments corrected against a read-back, not from memory: forge-on-demand was described in code as "Rj-only". PostHog says otherwise — ACTIVE, 100%, no property filters, since 2 ago; forge-real-generation likewise since 16 ago. Every cohort player forges, and forges for real. session-memory.md's "forges drain by hand / the worker is the last pre-sk_live item" line was stale too, and contradicted by the launch plan's own §3a (5 of 5 CLOSED, 17 ago).
• The accepted trade, stated so nobody rediscovers it as a bug: an invocation killed without reaching a checkpoint breaks its own chain, and recovery then waits for the hourly cron — ≤1 h instead of ≤5 min. A tick's budget (4 min) sits deliberately under the platform ceiling (5 min) so it exits by choosing to, and a chosen exit releases the lease and kicks the next link, so the broken chain is the exception rather than the rhythm. Chain depth capped at 16.

The guard that guards the cost decision

tests/routes/forge-kick.test.ts (10 cases) covers the atomic claim, the chain lighting itself and putting itself out, the depth cap, inertness without APP_URL/CRON_SECRET, and enqueue-kicks-but- subscribe-does-not. It also welds `vercel.json`: restoring a short forge tick reddens the suite instead of silently re-buying the 288 invocations/day this removed. Kicks are disabled suite-wide in tests/setup.ts and in scripts/forge-one.ts — an HTTP self-call fired from a test run or a laptop with real env would be a second worker on a real job.

• ⚠️ v0.106.3's `plan_peek` milestone rendered NOTHING, and had done since it shipped. FirstRunHint's milestone activation was a ternary chain ending in a fall-through default: l5_unlocks ? … : first_pack ? … : auraActive. When plan_peek became the fourth milestone it silently inherited auraActive — so the beat that release exists for never rendered, and would have rendered on the aura milestone instead. The character sheet's outer gate was correct (fr.planActive); the bubble returned null underneath it.
• Fixed exhaustively, not by adding a branch: a Record<FirstRunMilestone, boolean> keyed by the union, so the next milestone is a compile error rather than a silent default.
• ⭐ Found by the browser gate within minutes of that gate existing — the debt four human walk-throughs had been paying. Mutation-verified: re-introduce the fall-through, two specs go red.

The gate (pre-invite item (d))

tests/browser/first-run-beats.spec.ts + /dev/first-run-check — a real Chromium over every beat: each renders only when current, no other beat renders alongside it, each advances via its own control, the terminal beat ends the sequence, and the milestone is independent of the chain.

⚠️ Its limits are written into the harness header: no auth, no persistence, no real page layout. Route tests prove the writes; this proves the renders. Neither claims the other's ground.

72 browser specs green.

• ⚠️ The terminal beat was UNRESUMABLE. The victory card rendered from last — React component state on /ladder, set by the fight that had just resolved. Navigate away and it was gone forever, so a player who won and then went to look at their champion (the natural move) never saw it and never completed the sequence. Walk #3 lost it exactly that way.
• Now derived from SERVER state: the beat shows when it is current and the account has won a PvE fight — just now (last, for the player still on the page) or ever (pve_win, for the one who left and came back). The win check stays, because first_fight resolves when a fight starts: a victory card after a loss would be worse than none.
• ⚠️ `viewed` reporting, and it found a SECOND instance. The victory block never reported that it rendered, so "no events" meant two different things and we resolved the ambiguity by having a human walk the flow — three times. Now instrumented via a shared useBeatViewed hook — and the gate written alongside it immediately caught `gift_reveal` doing the same thing. Both fixed.
• The gate (tests/routes/first-run-beat-observability.test.ts): every beat's render condition derives from server state, and every beat reports that it rendered. ⚠️ It records what it does NOT cover — the authenticated browser walk is still owed, and the note is asserted so the gap is a decision rather than an oversight.
• The defeat note deliberately stays in-the-moment and the gate pins that asymmetry: "you lost, try again" is only true right after a loss. A first version of the guard banned the pattern outright, reddened on that note, and would have forced a wrong fix.
• Four mutations red.

Two guards that were wrong before they were right

The first version of the resumability assertion matched its own explanatory comment — the sentence describing the old shape reddened the guard forbidding it. The second banned a pattern that is correct on the defeat path. Both are noted in the test, because forbid the code, not the mention of it is the reusable half.

• ⚠️ `plan_peek` gated the entire back half of the first-run flow for every player since 22 July, and the funnel proves it: 2 `viewed`, ZERO resolutions, ever. The chain is strictly ordered, so steps 6 (first_fight) and 7 (victory) were unreachable — nobody has ever seen the victory beat. Two full walk-throughs isolated it to this one step.
• Why it could not resolve: it was the only beat whose resolution was delegated to a foreign, optional control — the dock's "Prepare defense" button. A player who did the natural thing (go and fight) got nothing: the ladder beat only renders when it is current, so they won, the sequence did not move, and they returned to the same hint.
• RECLASSIFIED to a post-victory MILESTONE (Cowork ruling) on the existing independent-milestone machinery. The chain is now 7 steps ending at `victory`, where completion fires. The plan is the game's thesis surface, and the teaching now lands where the motivation exists — after a win.
• The beat carries its own CTA, added to FirstRunHint as a reusable cta prop: the button opens the editor and reports done, so the two can never come apart again.
• Stranded accounts advance free, with no data migration. The reclassification shifts the indices: stored step: 5 was plan_peek and is first_fight. Tested explicitly against the live array, for both stranded shapes.
• Three mutations red (put it back in the chain · CTA stops resolving · milestone never flips its flag). ⚠️ A fourth guard was written, found to be both wrong and useless, and replaced — see below.

The guard that could not see the bug it was written for

A first attempt asserted "every beat resolves at its own render site". It false-flagged `gift_reveal` (whose resolve passes the action as a variable) and — worse — would have passed the old `plan_peek`, whose resolver lived in the same file, just inside a listener for an event the player had no reason to fire. The real invariant is about player motivation and is not expressible in source. It was replaced with the two things that are checkable, and the rule now lives in hint.tsx's cta docblock. A weak guard that passes while the defect recurs is worse than none.

Two pre-existing test files re-typed the 8-step chain as a literal; both now derive from FIRST_RUN_SEQUENCE, so the next reclassification cannot leave them describing a product that does not exist.

• ⚠️ The step-4 stall, found by walking it. The starter kit is inserted already equipped, but only POST /characters/[id]/equip marked the equip_item onboarding step — and the starter grant writes equippedByCharacterId directly. So the checklist row "Equipa tu kit inicial" sat unchecked over a fully-equipped champion, and a new player had no natural way to clear it: the kit is already on, and better weapons are level-gated at 5/8. The only exit was swapping gear for no reason. Now the auto-equip completes the step, gated on gift.itemsInserted > 0 so the mark is honest rather than merely convenient, and written inside the create transaction.
• The row's "IR →" pointed at `/characters` — the page the checklist renders on. That link had nowhere to send anyone because there was nothing to do, which was the tell. It now resolves to the champion's equipment panel; /api/me/onboarding sends the active champion id, because only the server knows it.
• Both mutation-verified: revert the mark → 3 tests red; stop sending the id → the link test red.

• ⚠️ A FOURTH hardcoded-EN leak, on the most-reached first-run milestone. The l5_unlocks hint was a raw English literal in copy=, so every ES player who hit level 5 read one English sentence on an otherwise fully localized surface. Routed through t(), ES added.
• `copy` added to `check:i18n-hardcoded`'s `HUMAN_ATTRS` — the gate could not see it. The gate was built after the third leak so there would not be a fourth; its attribute list enumerated the leaks we had already had. Mutation-verified: plant the literal back and the gate reddens.
• A false promise deleted from the first sentence of the first-run flow. The class hint told every new player to "hover any card for its kit" / "pasa el mouse por cualquier carta para ver su kit". No such affordance exists — the class card's only hover: is a border colour. It now describes what the card actually shows: resource, health and speed.
• Step 4's guided tour follows the page again. The chain was authored 8 Jul as equipment → get gear → skills; the panel reorder that put Get gear above Equipment shipped 17 Jul and the chain was never reconciled, so the first bubble landed on the lower panel and the highlight then jumped up. Now toured top-down. Guarded by a source-order test — the order lived in a comment in one file and in tourIdx literals in another, and neither could see the other.
• An orphaned coach-mark reference removed (first_pack deduped a packs mark that no component renders — all 12 mounts use literal ids and none is that one). ⚠️ An existing test was asserting that dead write; it described the code rather than the product, and is corrected here.
• First-run arming (Rj «C+B») — shipped in this patch: { arm: true } from /create keeps a sequence alive for an account that creates a champion before ever loading /characters. Defence-in-depth: the hole has zero observed victims.

• The endless goals loop. Past the cantos track's final rung, every 80 deeds fills the loop again and pays a material pack. A second client of the deeds ledger — which was built as a reusable substrate with the relicario as "client #1, not its owner" — so it is additive, with no migration. Price and start are derived from `CANTOS`, never transcribed.
• [ECON] double-signed, TWO named items (Rj «Firmo ambas.» + Fable/Cowork, 25 ago): ITEM 1 the contents row — 2 draws, dust 1–2 @0.85 · gem 1 @0.15, essence 0, catalyst 0, measured at 12.6% of BP income at every farming rate; ITEM 2 the 25% dust bar — the loop's dust must not exceed 25% of a profile's monthly dust sink, at every profile's own rate and at the structural cap. Signed in its own right rather than smuggled inside the row.
• Catalyst weight is 0, and asserted directly — iron-condition.test.ts walks packsYieldingCatalysts(), so a zero-weight pack is invisible to it. Any nonzero weight would make catalyst supply time-bound instead of content-bound, the one thing no rate can fix.
• A separate cap lane (Rj «Aparte»): the loop does not consume DAILY_MATERIAL_PACK_CAP, which fight_spoils already saturates for every measured profile. It is still bounded — DAILY_FIGHT_DEED_CAP / the price gives ~1.125 fills/day on average (2 on a boundary day). ⚠️ That coupling is load-bearing: lifting the fight-deed cap would unbound the lane and re-open paid acceleration through it.
• All three anti-farm guards intact — "todo cuenta" means no source is excluded, nothing more.
• A new instrument, and it refuted a claim we had been repeating. pnpm econsim gained PUNCH BALANCE and GEM BALANCE bars; it had modelled the dust a socket gamble eats and never the punch. Measured: the punch runs a 9.6×/6.5×/5.8× surplus, so it is not "the binding constraint on socketing" that four places claimed. Marked superseded in all four.
• Retroactive: accounts already past the final rung are paid the fills they had earned, off a census taken at the flip.
• Guards: 29 tests (16 domain + 13 real-DB, incl. an N-concurrent probe) and 10 of 10 mutations red — one of which, "a capped fight settles nothing", was found vacuous and fixed.

• R1 · early mastery — the caster arc's first and only shipped repair ([ECON] double-signed, Rj + Fable, 24 ago). A tapering damage rider on caster damage skills: +X% × (LEVEL_CAP − level) / LEVEL_CAP, pre-mitigation, dmgType === 'mag' only. X = 0.30 at L1 → exactly 0.00 at L20. Band-gated by arithmetic, not by a level check — there is no cliff to tune.
• `Actor.level` added as its vehicle. Both construction paths already had it in scope and SnapshotBuild already persisted it, so no snapshot migration and no re-mint.
• Measured (ruling grade, N=150 × 4 seed families, both populations): L11 ladder spread 24.3 → 5.2 (4.4 verified live) · L11 field −8.5 · L14 field −14.1 · L20 exactly unchanged on both populations. L17 field (−5.4 vs ±8.7 noise) is unclaimed.
• Fork B confirmed (Rj, 25 ago): charge and swing stay held for the pre-launch design arc. R2 and R4a were dropped with their evidence; B+ (a rogue ceiling shave) was withdrawn at ruling grade after it rotated the L14 ladder.
• Named dependency, shared not new: R1 moves the mid-band ladder (+8.1pp L14 · +6.2pp L17), so it inherits the committed pre-launch ladder re-tune.

• Itemization pass (conversion round, Rj + Fable signed). Five caster items trade their dead resourceMax / resourceRegen / SPR affixes for armor (12–27), budget-neutral by the prices recovered from the catalog itself (R² = 0.871). Two rogue leathers trade evasion for armor (a-shadowweave 40→33 +25 armor; a-windrunner 46→38 +18 armor).
• New item `a-warded-mail` — L11, armor 75 · resist 45 · INT 4, budget 385, no stat requirement. Closes a one-level window where every caster-legal armor piece with real armor cost more than the gear heuristic's L11 share.
• Engine: effective mitigation floors at zero. armor/(armor+K) returned a NEGATIVE percentage for negative armor, which dmg *= 1 - mitPct turned into a damage bonus (×1.25 at the −20 the catalog ships). Now a subtraction is a subtraction.
• Balance, re-measured (endgame-balance --uniques, T7 L20, N=100/cell/order): OFF 16.3pp · PINNED 26.0pp · UMAX-live 38.0pp, superseding 33.3 / 26.7 / 42.7.
• Ops: the pre-wire NPC gear+stats dump is now a release-process ritual; check:es-register scans ES batch drafts and untracked files; reseed:npc-snapshots gained a gear-identity staleness test; the drift audit now re-TAKES the balance block.

Twelve authored default builds (domain/default-builds.ts) replace a harness heuristic that had been allocating skill points by plan order — 10 to the first skill a plan named, the remainder to the second. That was never a design decision, and it had left the Mage and Channeler holding zero points in their own axis skills at L20. The orders are derived from measured cast shares by a stated rule, expressed as a priority order so they define every level rather than just the cap. They are the single largest balance change here: with no conditions lit at all they move the class spread at L14 +0 from 53.3pp to 44.4pp and at L17 +0 from 38.2pp to 29.9pp.

Two axes ship. pain (Warrior) and sequence (Rogue) are lit; their skills now read engine state instead of paying flat. `charge` and `swing` are held for Season 2 with their redesign briefed against four measured constraints (skills-redesign-spec.md §8).

Aimed default plans for the Warrior and Rogue only (CONDITIONS.aimFor). The aim was measured costing the Mage 9.0pp and the Channeler 7.1pp at the level cap while costing the Warrior and Rogue ±0.5pp — and both weak classes' axes measured positive under today's plans. The axes never needed the aim; the aim was taxing them.

Four cap rows (CAP_ROWS) at a new higher breakpoint node. Eight points in a branch skill is first legal at exactly L18 — the SP economy gates them with no new level check. Built, verified firing, and reachable only on branches whose axis is lit, so two of the four wait for Season 2.

Result, against the live game: L14 +0 −21.5pp · L14 +10 −11.3pp · L17 +0 −26.8pp · L17 +10 −14.5pp. Costs: L11 +0 +11.2pp, L20 +0 +1.2pp. Every figure is the mean of at least four independent seed families; the cap cells, eight.

Every spend now leaves a durable row. LedgerRow records the date, the route, the direction, the currency and amount, and what the movement was on (ref: { kind, id }) — written inside the charge's own transaction, so a row cannot exist for a charge that rolled back, nor a charge without its row. Fourteen currency-moving routes write one: forge enhance and reforge, socket-open, craft, experiment, buy-reagent, market exchange, mill, pack open, respec (both routes that charge it), the dormant challenge stakes, and the library-apply charge behind them.

The ten grant paths deliberately do not. Duel rewards, daily quests, seasons, the starter grant, onboarding, material-pack grants, entitlements and dev credit are the game paying the player, where the case for a durable row is weaker. tests/routes/ledger-enumeration.test.ts pins the LIST rather than asserting universal coverage — a knowingly-red test is one people learn to ignore. A route that starts moving currency reddens it until someone classifies it, so the next one is born with a decision about its trail instead of being discovered twenty days later.

Why it exists. AuditLog was already built and already in use — for admin/*, for Stripe, for me/delete. We audited what an ADMINISTRATOR does and what STRIPE does, and not what the PLAYER spends. The tool existed and was pointed at the side that needed it least. Of four defects investigated on 21 ago, the two whose routes wrote a row closed in minutes; the reforge, which wrote nothing, left a window that can never be closed.

The admin ledger (/admin/ledger) reads it back: filters, the lines, and a CSV export. The nav offered the link before the proxy allowed it — a dead link on a fresh operator surface — now fixed.

Erasure anonymises rather than keeps or drops. On account deletion, LedgerRow, ForgeAudit and ForgeJob survive with their identity replaced by one random token per account, minted inside the deletion transaction — not per row, because a per-row token would destroy the ability to tell "one person did these twelve things" from "twelve people did one thing each", and that shape is not personal data. ForgeAudit previously survived carrying full identity; it no longer does. tests/routes/deletion-completeness.test.ts still requires every userId-scoped collection to be purged or listed as RETAINED with a written reason, and now also verifies that a reason claiming anonymisation is actually honoured.

Known gap, not shipped here: docs/legal/privacy-policy.md §6 and the in-app deletion copy (settings.dangerZone.desc) both enumerate what deletion removes and name the tombstone hash as the thing retained. Neither mentions anonymised spend/forge records. This gap PRE-DATES the arc (the retained financial record was already unlisted) and is widened by it. Legal-adjacent — flagged for Rj, ships with the ToS v2 pass (docs/legal-tos-v2-rewrite.md), not silently here.

The store promise was false and is now derived. Three of the five nouns it swore off were being sold. The live sentence was corrected on every surface (store footer, landing, roadmap), and promise-guard.ts now derives what BP can reach from the live catalog and fails in BOTH directions — a noun migrating INTO the never-sold set is as red as one migrating out.

The exchange rate 30 → 90 was live before it was announced, visible on the supplies screen to the cohort. 15 holders were credited the essence their balance lost (bp / 45, rounded in their favour), with an audit row each, idempotently. Published limitation: a player who SPENT BP between the change and the credit is under-credited and we cannot detect it, because spends leave no record.

The material pack is randomized and its price is anchored. It paid 22.880 essence for 1,800 BP — 78.67 BP/essence against an exchange charging 90 — so the cheapest essence in the game was the product. Essence leaves the weighted table and stays as the guaranteed 20, making 1800 = 20 × 90 true BY CONSTRUCTION. Measured from the code: grinder months to +10 go 5.91 → 6.15, so the signed floor of 6.1 is RESTORED, not preserved. Table (3 draws, weights summing to exactly 1.000): punch 0.470, dust 20–40 at 0.450, a bonus gem 0.051, catalyst 0.029 unchanged. Floor: 20 essence, 60 dust, and two SEPARATE gem objects so the route rolls a rarity per gem.

The ungated route punch is withdrawn, and announced as a withdrawal with its number: 14.9% of packs now bring none, and a pack averages 1.41 instead of 2.50. Reported and not blocked: bar 5 sits at 4.18× (its signature bought 9×), and the punch is now the binding constraint on socketing at every profile, with a 40 BP valve.

> ⚠️ ANNOTATION, 25 ago 2026 — the last clause was wrong and the note is left as published. > "The binding constraint on socketing at every profile" generalised a measurement scoped to the > material pack. Counting the guaranteed equipment-pack punch and fight_spoils, the punch runs a > 9.6×/6.5×/5.8× SURPLUS (pnpm econsim, PUNCH BALANCE bar). Nothing player-facing depended on it — > this paragraph is the internal section — but the claim was later cited to justify a design ruling. > See decisions.md ("The punch was never the binding constraint").

The card's five lines are derived from the live table. The message catalogs contain no digits at all, and a test asserts it. The FORM of each line is derived too — disclosureBreaches() reddens if a percentage-only claim acquires a guaranteed floor, or a guarantee loses one. That guard is what would have caught "87.5% un punzón" sitting live over a punch every pack already paid.

Accepted reds: one, unchanged — the equipment-pack-into-the-mill route is cheaper than the exchange (docs/accepted-reds.md, owner Rj + Fable, open by Rj's decision). The material-pack red this release was measured against went GREEN and left the register with its reason recorded. A red seen once and not reproduced is logged in the new docs/red-watchlist.md as a hypothesis, not a fix.

The ladder faucet was built, tested, and called by nobody

materialPackFor had exactly ONE caller — story-progress.ts, twice, both story_beat. ladder_win and ladder_tier_clear appeared zero times in the duels route, so fight_spoils and ladder_tier_cache shipped complete and unreachable: the same "built but wired to nothing" class as the roll engine before v0.97.0.

The arithmetic that made it urgent — the entire S1 material-pack faucet, once ever, across all seven story beats, against the signed forge costs:

Not a faucet — a one-time delivery smaller than a single purchase, and story is finite so it never refills.

Wired

An ordinary ladder win now grants fight_spoils. PvE only, never story (which has its own richer cache), and never PvP — a material faucet on PvP pays for farming a rival. The grey-decay gate is untouched: a fight the curve has already written off still drops nothing.

One application path serves both sources. Two copies of that loop is how a punch lands at crafting.punches on one path and crafting.reagents.engravePunch on the other — a phantom field that cost us once already.

The landing had no door for people who already play

Register, and nothing else. The returning player is the one most likely to be reading the game's best pitch, and we were sending them back to the top of the page. The login entry goes through the URL module, so it crosses to the app host by construction rather than by remembering to.

A static guard of ours, hardened

Mutating the new grant into a comment left its test green — grepping raw source cannot tell code from a comment, which is precisely the "built, mentioned, not called" state the file exists to forbid. Comments are stripped before matching now.

Flagged for the store packet (post-reset)

The dust-equilibrium finding (faucet 180/306/456 against sinks 170/300/430) was measured while the pack faucet was not flowing. With fight_spoils live the material economy has a new income line — re-check that equilibrium before pricing buyable material packs on top of it.

The landing gains a forge section (section 03, after razas)

Six blocks: hero · rarity strip with real PixelLab sprites · the three ladder bands · the example biography · gems and sockets · the iron promise and CTA.

Every number derives from the domain — odds, costs, socket counts, gem affixes and the example biography all come from the modules the engine pays with, so the section self-updates on every future re-sign and cannot quote a figure the game disagrees with. Welds assert the rendered text against the FUNCTIONS, scoped per band so a block wired to the wrong level is caught.

The example biography is generated at a pinned seed, never written. Seed 15 earns its rows: ordinary levels, a thin +4, a fall at +5 followed by a better +5 on the re-climb, and the perfect level at +8 where the odds are worst. A drift test fails if a re-sign stops it telling that story.

Falls render as EVENTS, not ledger rows. A demotion pops its entry, so the item genuinely does not remember falling — the page replays the climb rather than inventing a memory. (This is where the parked "cicatrices" idea came from; see open-questions.md.)

Three fixes from Rj's read of the screens

• The CTA crossed to the wrong host. The landing is served from www, which has no auth session and no Kinde routes, so a host-relative /api/auth/register would have 404'd for every visitor. The sweep exonerated the siblings and indicted the new file: _landing.tsx already had the pattern and a comment explaining the trap. Cross-host urls now come from ONE module, gated against relative links, against a component building the url itself, and against the app-host env silently degrading every link back to relative.
• "hasta N pasos por línea" struck from the Home. At this distance rarity depth is flavor; the numbers stay in-app where the forge UI teaches them. The welds moved with them, and the test now asserts the line's ABSENCE — a struck line with no guard comes back.
• The gems became subjects. "No aparecen las gemas, solamente los stats" — a list of effects is a spec sheet; named things with effects beneath them is a catalog. Seven families, each with a family-coloured dot, plus a derived sockets line (común 0 → legendario 3).

Two truth bugs found by building this

• affixText rounded percentages to whole numbers — right for item affixes at 5–30%, a lie once the forge granted 0.15% per level. The biography rendered "Daño físico +0%", a false zero for a real gain. All 284 catalog affixes verified byte-identical before shipping.
• The rarity strip briefly used next/image, the only one in site/. Four optimizer round-trips meant the landing never reached networkidle and three browser specs timed out. The house pattern is a plain <img> for pixel sprites.

Known gap, stated rather than hidden

Gem names are localized in the SHARED vocabulary (common.gemFamily), but the cube still shows "Ruby (Common)". Localizing it there is its own surface and its own approval; it is queued rather than dragged along.

Tests

1783 route + 271 component + 59 browser. New guards mutation-verified. One flaky test of our own fixed: a helper could return a floor demotion — where v0.98.1 correctly pops nothing — while its callers asserted an entry was popped.

A failure at the floor took a level of history it never took a level for

v0.98.0's demotion popped a ledger entry unconditionally, while correctly clamping the RANK at the riskless floor. So a failed +5 attempt from +4 left the item at rank 4 with only three ledger entries — and because an item's power is SUMMED from its ledger, the player silently lost a level's stats while keeping the level. Permanently: the next success appends +5, never the missing +4.

The comment directly above that code said "there is nothing there to take back" from its first version. The comment was right and the code did not do it. The pop is now conditional on the rank actually dropping.

Both sides are tested, so the fix is narrow rather than a disable: a floor failure keeps all four entries; an above-floor failure still pops exactly one. Mutation-verified.

Nobody was affected, and the census stays anyway

pnpm audit:ledger-gaps (read-only, --apply to repair) — 8 forged items, 0 damaged. The mechanic had been live about an hour and no player reached the floor-failure path.

The script ships regardless: it is the query that finds this damage if it ever appears, and writing the query down beats remembering the shape of the bug. Its repair path re-rolls the missing level and marks it legacy, never roll — a reconstructed level must not claim to have been witnessed.

A probe of ours, corrected in passing

The seed search that generated the example biography hand-rolled an LCG. In JS that overflows 2⁵³ on its first step and the stream degenerates: it reported zero demotions across 20,000 seeds, which is impossible at 0.90/0.86/0.82/0.78 (~63% should fall). Two suspiciously round numbers were the tell. Switched to makeRNG — the seeded RNG the engine itself pays with — and the rate came back at 63.7%.

Destruction is abolished

• A failed forge at +5..+10 DEMOTES one level and pops that level's ledger entry — the player loses exactly what that level rolled, never the item. ENHANCE_FAILURE = 'demote'.
• Hard band at +5..+8 (0.90/0.86/0.82/0.78); the summit keeps 0.75/0.30. Risk now spans the whole above-floor ladder instead of concentrating at +9/+10.
• Protection returns at +5..+8, re-priced to 30/50/65/90 and now TOTAL cover: it prevents the demotion outright. §2.4's ⅓ deductible is void with the partial cover that justified it. Priced as a sentiment product — above the measured actuarial value (15/15/15/21), monotonic, never sold as +EV.
• The floor is bought: +1..+4 costs 10/20/40/70 dust. Riskless never meant costless.
• The summit ritual: +150 essence per +9/+10 attempt — the anchor's lever, and the reason first-+10 still lands at 9.3 months unprotected / 10.7 protected.

The catalyst gate was unreachable, and the fix is a guarantee

Setting the drop rate from the measurement surfaced a blocker the rate could not solve. Reaching +9 costs exactly one catalyst, S1 has 7 first-clearable story beats, and at the live 3% weight 65% of players would have finished the entire story without ever seeing one — unable to forge the summit that season's own copy promises. No weight removes that: even at 60% (a pack that is mostly catalysts) 0.1% are still locked out. So the boss first-clear now grants one catalyst deterministically, and the stage weight rises 0.03 → 0.12 for the multi-season +10 path.

packsYieldingCatalysts() — the function the iron-condition audit walks — read only the weighted table, so a deterministic grant would have yielded the ritual currency while being invisible to the audit that proves it cannot be bought. Fixed in the same commit.

Disclosure

• The forge tab quoted ENHANCE_ATTEMPT_ESSENCE (60) while the route billed 210 at the summit. Both sides now derive from attemptEssenceFor, welded by a test.
• The dust charge was withheld until its copy shipped — charging under a sentence that said "gratis" would have been BetaHub #16 with money attached, on the feature born from #16.
• The destruction plainly copy tripwire is inverted: it now forbids ASSERTING destruction while requiring the approved denial ("El objeto no se destruye") to survive. A blunt word-ban reddened on the reassurance itself.

Tests

1778 route + 262 component + 59 browser. Every new guard mutation-verified in both directions.

The forge rolls, and the item remembers

• `POST /api/cube/enhance` rolls every level it creates. The floor jump writes FOUR ledger entries — one per level, not one per action — appended inside the same level-guarded write as the counter, so a level and its history cannot diverge. Pity is law: no level records nothing while headroom exists.
• An item's forged power is SUMMED FROM ITS LEDGER (ledgerMods). The flat +2/level formula survives only as the fallback for instances with no history. The ledger parameter on enhancementMods is required, so tsc enumerated every reader — item resolver, PvP snapshot, the diminishing-returns figure on the forge tab — instead of letting them quietly keep quoting the retired number.
• Ledger rows are machine-readable (target/op/tag) as well as human-readable. A history the resolver cannot read is a diary; and rendering the stored engineering label (primary (class stat), dmg%(fire)) would ship raw English into a Spanish surface while check:i18n-hardcoded stayed green — a leak in a data costume.
• Refuse before charging. An exhausted item (§6.bis F1) or an unresolvable defId is declined. Advancing without recording would leave a partial ledger, and because power is summed from history, that DELETES the unrecorded levels' stats rather than falling back to the formula.
• `ForgeBiography` renders the history, localized through affixText — the same resolver the item cards speak. Levels reconstructed by the migration are marked as such: the forge does not claim to remember what it deduced after the fact.
• Migration: the 8 live forged items were repaired (migrate-forge-ledger --apply, idempotent) and read back — each derives exactly what the old formula granted. Continuity proven, not assumed. The read-back now prints derived power and exits non-zero on a mismatch; the previous one counted entries and reported ✓ on eight broken rows.

Premium reforge is additive — Issue #16, fixed by design

• No affix ever falls. Premium spends a per-affix budget applied onto the item's CURRENT values, matched by Mod identity rather than array index. Base tier is unchanged and still rerolls from the catalog value: the cheap gamble stays a gamble, and each tier now states its own rule at the button.
• The ceiling refuses honestly (reforge_exhausted → real copy, not a raw identifier), and forging the item higher raises that ceiling.
• Six live strings that described the retired mechanic were replaced, including the v0.96.1 interim hedges. The tripwire that ordered their deletion was itself measuring the wrong thing — it asked whether server/reforge.ts still mentions reforgeAffixes, which the BASE tier will always make true — so it is inverted and re-aimed at the premium path in the route.

Tests

1759 route + 254 component + 59 browser, all green. tests/routes/forge-ledger-wiring.test.ts drives both routes against a real database (13 tests); every new guard is mutation-verified, and two failed that verification on the first attempt — a derivation test that could not observe the resolver, and a "refused before charged" assertion the transaction rollback made vacuous. Both are recorded at their call sites.

A player spent 30 essence on a premium reforge and got fewer stats, then quoted our own sentence back at us: "nunca empeora el objeto". They were right.

What was actually happening

Premium reforge rerolls from the catalog baseline (def.baseAffixes), so the roll is memoryless: B × U[1.05, 1.30] every time, regardless of what you were holding. It is always an improvement on the baseline — and can be well below a good current roll.

Measured, holding a max roll: P(worse) = 100%. At the top of the range every premium reforge is a guaranteed downgrade, for 30 essence. The better the item, the more certain the loss.

The existing test asserted "premium never rolls below the baseline" — true, and never the promise the copy made. The tests encoded the same assumption as the code, so they were never independent evidence of intent.

What changed here

Rj's ruling: the MECHANIC changes, not the copy. That redesign is [ECON]-gated and unsigned, so this patch does the two things that could not wait:

• The copy stops overpromising. Five strings in each language now name what the guarantee is actually against, and say plainly that this is being changed.
• A tripwire (tests/domain/reforge-promise-weld.test.ts) fails if an unconditional "never worse" claim reappears while the mechanic still rerolls from the baseline — and fails the OTHER way once the redesign lands, to say "now go delete the interim hedges", so the apology copy cannot outlive the bug.

Make-whole

30 essence returned to the reporter, with a bell that says what actually went wrong. The existing essence_refund copy describes a different 1-Aug incident ("anuló algunas mejoras que pagaste"), which is not what happened here — so the reason discriminates and this incident gets its own honest sentence rather than an apology that misdescribes itself.

The grant is idempotent by construction (gated on the absence of its own notification, in one transaction) and was verified by re-running it: the second pass refused to pay.

One feature, and the thing it is evidence for: the numbers we show are the numbers the engine pays.

The ladder

SkillLadder answers what the skill card does not — what does the next point buy? One component in two modes: with player context on the character sheet (the ▼ TÚ marker, the distance to the breakpoint, the what-ifs) and without on /plan and /kit.

Nothing on the surface is authored. buildSkillLadder(skillKey, actorAt, cap) takes a function returning a real build at N points, so every rung is produced by the same path the engine pays with; the ladder never fabricates a context of its own. It re-reads the skill def from each actor, because toActor applies the node-5 breakpoint and may hand back an edited clone.

Rows arrive collapsed at every mount (Rj, pre-tag) — the player opens them. Pinned by a mount-level guard and a real-browser first-paint assertion, both mutation-verified.

Three things the approved mock implied, deliberately not built

The spec's own rule is if a value cannot be derived, the element is omitted, not approximated. It ended up killing its author's illustration:

• The axis is POINTS, not STR. A breakpoint fires at 5 points invested; on a STR axis it has no position, and drawing it somewhere would be inventing its location on the one surface built to prove numbers are not invented.
• There is no resource axis. Nothing scales a skill's damage with its resource — the only resource-conditioned damage anywhere is the channel unique, a threshold at 80% pool. "Scales with STR + FURIA" would have put a mechanic on screen that the game does not have.
• Heal and shield name no driver. They bypass effectMagnitude, so no tagged primary multiplies them.

Because every element is derived rather than authored, this costs nothing later: if resource scaling ever ships, the chip appears by itself.

Under it

The tag→primary fact now has ONE carrier (PRIMARY_DAMAGE_DRIVERS) that resolveStats emits from and the chip derives from, so the sentence and the maths cannot disagree.

A live defect was fixed on the way: the character sheet's ◆ tooltip rendered the raw blurb template, so players would have read a literal {pct} — and that surface had been hardcoded English before that. The field was renamed blurb → blurbTemplate so the compiler enumerated every reader.

Two defects found by looking, not by testing

Every bar rendered invisible — InspectTip's trigger is an inline span, so the bar's w-full resolved against a shrink-wrapped box and the chart drew at zero width. Thirteen component tests passed before and after the fix; a screenshot caught it. Hence a dimensional browser gate that measures boxes.

And an honest zero baseline made eleven rungs spanning 155→201 look identical. Fixed by changing what is encoded, not the axis: each bar is the shared uninvested base plus the gain on top.

Tests: skill-ladder weld (27 — expectations computed independently via effectMagnitude, never transcribed), component (13), browser (7). Every guard mutation-verified; one surviving mutant was killed with a real test rather than documented as safe.

A forged skin could never reach a fight

Both fight surfaces fetched the forged sprite overlay by the server-resolved variant key — the best look already in the code manifest. But a forge exists precisely because the wanted combo is not in the manifest; that is what "miss" means.

So the lookup asked for a key a forged row can never carry. It returned nothing every time, and no forged sprite could ever render. Measured: the ember axe forged to w-axe-ember_a-mail-comun while both surfaces asked for w-axe-magico_a-plate-comun.

The design was right and the wiring was inverted — forged variants carry their own key, mergeForgedOverlay folds them into the manifest, and the resolver finds them, but only if the fetch asks for the wanted key. Now fixed in one shared helper used by /battle and /replay, with the resolved key still queried so any legacy row stays addressable.

The lesson this cost a day to learn: "the frames serve" was never evidence that anything renders. The frames were generated, served and addressable — and unreachable. The launch item was closed on frames-serving with the render explicitly recorded as unverified, and that caveat is the only reason this was found rather than sitting behind a green check.

The pack reveal can no longer be skipped mid-open

The reveal's two exits are links, so clicking one during an in-flight 10-pack navigated away while the open completed anyway: BP debited, items granted, and the reveal never shown. Nothing was lost — the items are in the stash — but earned things are always announced, and this was a way to silently skip the announcement of a paid open. The exits now go inert for the seconds the open takes.

Six items with one thread: stop making the player do the game's bookkeeping.

A completed quest survives midnight (UX-39b)

An unclaimed daily used to be erased by the day roll — the reward evaporated because the player was asleep. It now carries forward and stays claimable. Not auto-claimed: that would have deleted the claim moment for anyone who wasn't looking.

Built on the lazy day-roll, so no scheduler. Two properties are pinned separately because both are silent when broken: claim-once (a conditional write filtered on carry membership, with a 10-concurrent probe) and no bonus contamination — a carried claim never enters today's claimed set, because the all-three bonus is for three quests today and one carried claim could otherwise complete it alone.

The warning above the panel was corrected with it: it used to say unclaimed rewards are lost at reset, which is no longer true. It now names what genuinely expires — the bonus.

Theorycraft tools are free (UX-27)

Loadouts and the build library were gated on a SKU the store never sold: dark for every player, including anyone who'd have paid. Not broken — unreachable. The monetization slot is surrendered deliberately, because a paid QoL unlock nobody can buy earns nothing while costing a permanently confusing surface, and theorycrafting is what the game is.

The gate seam survives (re-gating is one line) and the SKU is retired rather than deleted, so entitlements already granted keep resolving.

The mill speaks the same language as everything else (UX-20b)

/mill was the one item surface with its own filter grammar. It now uses the shared picker — name search, chips, sort — wrapped around the virtual grid, so windowing survives a stash of thousands.

Select several, mill them at once (UX-20c)

The mill's deep link always accepted a list; nothing ever sent one. Now the stash can. It's a mode (an ordinary tap still opens the inspector), it refuses protected items at pick time rather than downstream, and it links rather than posts — staging is not destruction, so the mill's own confirm stays ahead of the player.

Two links that now land on the answer (UX-21, UX-02)

The catalog's "Se obtiene:" line opens that recipe instead of the cube's front door — and only one the player already knows, because a URL must never unwrap a silhouette. The pack reveal's equip exit opens that item's slot picker instead of scrolling to an anchor.

The mission was named for something it does not count

A player could fight through the Duelos panel, watch the counter sit still, and reasonably conclude the relic mission was broken. Nothing was: that panel produces stake-0 challenges, and the mission counts ranked duels. Each behaviour is correct on its own — the names promised the same thing and the code did not.

Rj's ruling: rename the mission, leave the counting alone. It now reads "duelos clasificados" (ranked duels), which promises exactly what it counts.

Why not the other direction: making challenges count would put an uncapped, self-selected, zero-stake path into the relic ledger — you choose your opponent and risk nothing. That is the precise farming shape the 90/day cap and the rating band exist to prevent, both of which were closed earlier the same day. A rename costs one string; changing the counting reopens a hole.

A separate direct-duels mission with its own cap stays a future option if the data ever shows demand — recorded in the plan so the door is visibly open rather than lost.

Tests pin both halves: the label says "ranked" in both locales, and pvpDuels is still in the capped fight family — because a rename that quietly moved the metric out from under the daily cap would be the exact hole the ruling refused to open.

Twelve items across three approved batches, and one theme runs through all of them: a screen that stops you should offer the next step. Every fix here turns a dead end into an action.

Batch C — the PvP loop

• UX-14 — "Buscar oponente" now arms before it fires. One tap used to resolve a ranked fight; it now states the cost and the stakes and waits for a confirm. This reduces exposure rather than adding friction: the tap that spends is now the second one.
• UX-17 — direct duels get a rematch, honestly capped. It posts a stake-0 challenge, never /api/duels, so a button labelled "Revancha" cannot mint a ranked fight; the 1/pair/day cap is read from the same constant the 429 enforces with.
• UX-19 — the leaderboard scout modal offers the fight instead of describing it, with the five refusal reasons named. The cooldown states remaining time, a deliberate departure from the spec's "time since" — remaining time is what a player plans around.

Batch D — the lab gets real

• UX-42 — the bench targets the real roster instead of invented placeholders.
• UX-43 — the /plan sandbox round-trips with the active champion, so a build you tried is a build you can keep.

Batch E/F — stash and account

• UX-02 — the pack reveal gets non-gacha exits ("to the stash", "equip on {champion}").
• UX-20a — a sort control on /items and /catalog.
• UX-21 — the catalog says how an item is obtained, derived from data rather than prose.
• UX-32 — champion delete gets the house modal and honest copy. The gear release was then reordered and transacted (see below), because the copy promises the stash gets it back.
• UX-35 — the language switcher lives with the other preferences.
• UX-38 — the avatar lockout names an exit. Channel = mailto, and it ships dark: a mailto: pointing at a mailbox that does not exist yet is worse than offering nothing, so it waits on PRO-112 #1 behind an env var, with a test that fails if it is switched on early.

And the rules the review found

• The rating band is a RULE, not a filter. It was enforced only where candidates are served, so a direct POST could attack hundreds of rating out of band and move both ratings. Now enforced at the mutation, with server-derived exemptions for a rival or nemesis — earned relationships the route re-derives from duel history, never a context the client claims.
• *Champion delete releases gear before deleting, in one transaction. The old order could strand items on a champion that no longer exists: visible, unmillable, unequippable, and unrecoverable by retry. A repair query for already-damaged rows ran against the live database: 0 affected*.

Four fixes with one theme: a session should tell you what it costs, what it pays, and when it has stopped paying — before you spend, not after.

UX-22 — the reward is stated before the charge

Ladder rows, story stages and the /battle card now quote the XP and BP a win pays, from the same functions the payout uses. A real accuracy bug surfaced on the way and was fixed with it.

The invariant is now welded from both ends: a test resolves a real fight and asserts the paid amounts equal the quoted ones. The previous test read only the quoting side — so doubling the XP inside the paying route left it green while every row lied by half.

UX-24 — 0 stamina names a destination

Running out used to close the loop with nothing to do. It now points somewhere.

UX-37 — onboarding says what the step costs

Step 5 states its BP shortfall instead of letting the player discover it by failing.

UX-41 / 41b — the daily relic cap signals, and stops eating the bookkeeping

The 90/day cap is now visible on every fight surface, including the auto ladder — the path players actually grind, and so the one most likely to reach it. A limit you only learn about by hitting it is not one you can plan around.

And a capped fight still arms: the cap gates the SPEND, not the bookkeeping. Arming and self-healing are free, metrics stay frozen, and nothing grants. The end-card line was corrected to say both things, because a player who watches a mission go live on the fight the card called inert has caught the game being inaccurate — on the feature whose whole value is being trustworthy about numbers. The grant block is now covered by a test that fails when it is removed; it previously was not.

The cube could cost you an item without telling you what you were risking, without letting you protect anything, and without showing you what you lost. Five fixes, one theme: say the risk before, show the outcome after, and let the player put a lock on it.

The item lock (UX-11)

locked on the item + a toggle in the inspector. Four enforcement points — mill, craft, experiment and the forge — each refusing with its own reason and the offending id, never a false "not owned". The consumption paths were enumerated from the code, not from memory, because the failure mode here is a guard that covers two doors of three.

The forge was a late reversal: enhance isn't consumption, so the first pass allowed it. But above +4 an attempt destroys the item, and "pero estaba bloqueado" after a +9 breaks is the worst ticket this feature could produce. An overpromising reassurance is the sentence players quote back at you, so the word means the absolute: locked = indestructible while it lasts. The cost is one deliberate tap, and unlocking in order to gamble is the ritual.

The break modal (UX-04)

An unprotected attempt at +5 and above now goes through a modal naming the item and its real odds. A protected attempt keeps the inline flow (the item is safe); the free floor stays one click. Friction proportional to loss.

At the unprotectable +9/+10 tier it adds the cumulative line — ≈0.33% from +4 to +10 — derived from the odds table, never transcribed. A test fails if that literal reappears in the component, because a hardcoded percentage stops being true the first time the odds are tuned.

Gear DR at the point of spend (UX-10)

Enhancement grants flat primaries, which compress past the knee: a step can be worth half its label. The sheet showed this after the fact; the forge, where it changes a decision, was silent.

It only speaks when it can prove it. The knee applies to the summed equipped stack and the cube holds only unequipped items, so a true figure isn't computable there. The item's own contribution is a lower bound: when the item alone crosses the knee, compression is certain and we say so — otherwise we stay quiet rather than promise the full nominal. A false negative is survivable; a confident wrong number at an irreversible spend is not.

The reforge diff (UX-07)

A reforge rerolls from the catalog baseline, so a base reforge can wipe a premium roll — and the result was a bare "Reforjado" toast. The previous affixes cease to exist the instant the reroll saves, so this screen is the only place that roll can ever be seen. Before → after now renders in the same grammar the inspector speaks, paired by stat rather than by index, and the baseline rule moved out of distant prose to sit next to the button.

The recommender learned about the forge (UX-12)

Below +4 the forge is free and guaranteed, which makes it the best advice the cube can give — and the recommender couldn't see forge level at all, so its top suggestion was routinely worse than something a tab away for nothing. The same blindness called an untouched +0 item "perfected". A ceiling claim that isn't the ceiling costs trust in every other claim, so it now requires the forge past the free stretch.

The apply deep-link could do nothing at all

Buying a skin does not require owning the item: checkout validates the template (exists, epic/legendary, carries a look token), because the unlock is account-level — milling an instance never touches it. So a player can legitimately hold ember × w-headsman-axe while owning no axe.

In that case /items?def=… did nothing observable: no drawer, no toast, no line. The buyer followed a CTA that said "aplicar ahora" and the page just sat there — leaving them exactly where the whole feature exists to stop them being: holding a right they cannot find.

Now they get an honest line: no tienes este objeto en el alijo — el aspecto queda guardado para cuando lo consigas. It's reassurance, not an error, because nothing failed: the unlock is safe and account-level, and the only thing missing is something to put it on. Wording it as a failure would manufacture a refund ticket out of a non-problem — which is why a test asserts the copy carries "guardado" and contains no alarm language.

It fires only on a deep link, so a player browsing an empty stash is never told about a skin they never bought.

Buying a right is not receiving a thing

A skin purchase grants (theme × defId) — the right to use a look. The item instance must still be stamped with appliedSkinTheme before anything changes on screen. Nothing was broken, and yet the paid feature was invisible: no skin applied → no render miss → no forge → nothing to see.

The launch blocker's own wording ("purchase → auto-generate → render") hid the step, so the chain was believed to be automatic by everyone, including the docs. The real chain is purchase → APPLY → fight-load → forge → frames → render.

Rj's ruling: bell + email, no auto-apply — the player chooses which item wears it.

• purchase_granted now carries (theme × defId) for item skins, using the same predicate as checkout and the grant.
• The bell offers "Aplicar ahora" → /items?def=…, which opens the inspector on a matching instance, preferring an unequipped copy so the buyer doesn't re-skin the weapon they're fighting with. It never mutates on navigation — a link that applies on load is a link a prefetch can fire, on a paid cosmetic.
• The store now says so before money moves.
• When the item-skins flag is unavailable (flags fail closed), the CTA degrades to the store rather than promising an action the destination can't offer. The bell row itself is never gated — a durable record must not inherit the lifecycle of a toggle.

The forge ledger now reconciles with the bank

The per-tick ledger measures a delta between two balance reads per tick, so spend that settles after the final tick's closing read has no later tick to attribute it. Measured live: the bank said 39, the ledger said 37. A structural, one-directional tail — not noise.

forge_completed now also reports the bank delta, the drift, whether another real forge was seen drawing on the pool, and whether the pool grew mid-run (a refill is an ops action, not a broken instrument). The bank figure is an upper bound and is never written back over the per-job ledger: the pool is global, so doing that would charge one job for another's generations.

A defect this work found in already-shipped code

comboKey names a combo, not a run — forge_jobs keeps every terminal row, because the unique index is partial on active: true. Three writes were comboKey-scoped, including the per-tick ledger shipped in v0.90.3: on any combo that had failed before, spend accumulated onto the corpse while the live job recorded 0 — the exact "gensSpent reads 0" symptom that fix was for. All three now address _id.

The failure write in the catch block deliberately keeps { comboKey, active: true }, and now says why: scoped to _id it would flip an already-delivered forge to failed on a late telemetry error.

Two review rounds

Round 1 was DO-NOT-SHIP. It found that one of the new tests was vacuous — the non-skin case passed no defId, so the guard could be deleted and it still passed. Round 2 caught that widening the concurrency probe to every active status swept in queued jobs, which have never ticked and cannot have spent. Every guard here was mutation-tested red, then restored.

v0.90.1's observability fix was killing real forges

Two defects, the second much worse than the first.

1. `$inc` on a null field throws. A forge job is created without gensSpent, so the schema default makes it null. $inc on null raises "Cannot apply `$inc` to a value of non-numeric type". Every real forge created after v0.90.1 therefore died on its first tick that spent anything.

2. The throw happened inside the `finally`, so it replaced the `ForgeCheckpoint`. A healthy tick exits by throwing that checkpoint — it means "resume next tick". An exception raised in a finally replaces the exception in flight, so the failed ledger write didn't merely lose a number: it destroyed the checkpoint, failed the job, and burned the generations the tick had already paid for.

A live ember forge died exactly this way, 23 generations in.

Why the tests passed

The fixture set gensSpent: 0. The real creation path never produces that — every real row is born null. A fixture that doesn't reproduce a real row cannot see a real bug, and this one reported coverage of the exact line that was broken. The fixture now omits the field, as production does.

The fix

• A `$ifNull` aggregation pipeline instead of $inc — null-safe, and rows already carrying null self-repair on the next natural write, so no migration is needed. (It also needs Mongoose 9's explicit updatePipeline option, which the corrected tests caught before this shipped.)
• The whole ledger block runs in its own `try`/`catch`, reporting through reportRouteError. Accounting is best-effort by construction: the measurement must never be able to kill the thing it measures.
• Both properties are mutation-tested — the fix was removed and each guard watched go red.

One click could open two packs

POST /api/packs/open had no idempotency guard. A network retry or a double-click sent the same intent twice, the player had funds for both, and both legitimately succeeded — two point charges and two packs from one click.

Note what this is not: the debit was already a compare-and-swap, so concurrent opens were safe and stayed safe. This closes the sequential duplicate, which is a different failure and was invisible to the concurrency tests that already existed.

Shape. A client-minted key per intent, claimed by inserting a row whose _id is <userId>:<key> — so the unique _id is the entire guard: no read-then-write, and no index-build window to race. The key is required; a missing one is a 400 IDEMPOTENCY_KEY_REQUIRED. The property the plan actually wanted was "no unprotected path can exist", and that comes from enforcement, not issuance. The client mints per click and holds the key across retries, rotating only on a confirmed success or a changed count.

Three adversarial review rounds, the first two DO-NOT-SHIP

Recorded because each round found something the previous fix introduced or missed:

• R1 — no production caller sent the key. The server was correct and the feature was unreachable, while the suite read green. A guard is not complete until the caller sends the field, verified on surface, in the same diff.
• R2 — the claim release sat in a catch when two exits are returns; and the client minted a key per click without reusing it across retries. A guard that holds on the server and is discarded one layer up is the same bug in a different hat.
• R3 — signed the money property (no double charge, no free pack, no over-grant, no cross-user reach), and found S1, a regression introduced by the R2 fix: an orphaned claim — the process killed between the insert and the finally, which does not run when the process dies — left a permanently dead button for 24 hours, behind copy promising "un momento". Fixed with a staleness takeover, compare-and-set on createdAt so a genuinely concurrent duplicate still loses.

The fix for a money bug introduced an availability bug. Only an adversarial round found it.

Item-skin checkout proven end to end (launch plan 3a)

First full pass of the real money path, every step read back from the database: checkout session → payment → webhook → purchase completed → exactly one entitlement → notification. The grant is stamped with defId rather than boundItemId, confirming the live path writes the current theme-by-defId model. The notification lands 22 ms after the completion — announced after the commit, never inside the transaction, which is what the F7 fix was for.

Notes

PackOpenKey is user-scoped and purged by the account-deletion cascade (the completeness test fails the build otherwise), with a 24h TTL. Every new guard test was mutation-tested red before being believed.

gensSpent read 0 on every real forge

Verified on all three real forges in the develop DB, including the one drawn at the real-generation flip whose true cost was 39 generations (10,000 → 9,961).

Mechanism. generateRealForge computed one balance delta at the end of the function — but a forge spans many ticks, and every tick except the last leaves by throwing `ForgeCheckpoint`. So that line ran only on the final tick, by which point the generations had been spent in earlier ones. The number was not slightly wrong; it was structurally ~0 for any multi-tick forge, which is all of them.

Why it mattered. forge_completed carries this value, so the app's own telemetry reported that every forge cost nothing while the pool visibly drained — an instrument reading clean while the thing is broken. No money was lost or double-spent: the reserve and survival guards read the live balance, never this field. What was lost was observability of spend, at exactly the moment the pool became the on-demand queue's entire budget.

Fix. Accumulate per tick with $inc, inside a finally so a checkpoint counts too. The opening balance is the one processForgeJob already reads for its affordability check, so the only added cost is one closing read per tick. Completion no longer re-sets the field (that overwrite was the bug), and the telemetry event reads the settled total back.

Mutation-verified 4/4: dropping the finally, re-setting on completion, dropping the telemetry read-back, and removing the zero-clamp all turn it red. The clamp needed a source assertion — the arithmetic helper in the test is a model, and it clamped on its own, so a source mutation survived until that was pinned separately.

The forge worker completes a real forge, unattended

Until now every real forge was drained by hand (pnpm forge-one). The serverless worker had never finished one, and the numbers said it couldn't: a 5-minute function against a 22-minute forge, a 6-minute step timeout that could never fire inside it, and a 20-minute lease that outlived the forge it was protecting — so a second worker joined essentially every run and every tick died mid-generation.

Retuned so the four numbers agree: lease 20 → 7 min (function lifetime + margin — it must outlive one invocation and die soon after; at 20 it did neither), a 4-minute tick budget that ends an invocation at a safe point instead of being killed at a random instruction, a 3-minute step ceiling that fits inside it, and a separate 12-minute "presumed lost" threshold — because how long do I wait in one tick and when do I write off a paid generation are different questions, and conflating them is what made a slow-but-alive generation look dead.

A checkpoint is explicitly not a failure: the job keeps its ledger, its state and its progress, the lease releases, the next tick resumes. Without that distinction a perfectly healthy 22-minute forge would mark itself failed and page Rj every five minutes.

The money-leak class, closed: write the record BEFORE the spend

An in-flight animation is invisible on the vendor's sheet (the parser only matches entries that already carry frame URLs), and the worker is killed mid-generation by design. So a kill between the purchase and the animation landing left the spend as the only record that it had happened — and the next resume bought it again.

ForgeJob now carries a write-ahead spend ledger written before the paid call, so a resume can tell never bought from bought, still cooking. On resume the default is to wait; a provably dead generation gets one bounded re-buy, then a hand-forge flag. The same treatment covers create_character_state — the most expensive call — which additionally recovers an orphaned paid state by name via a free lookup rather than buying another.

The mandatory money-path review then found a critical double-buy in the fix: the retry beside the guarded write checked its bound against a value read seconds earlier, so two workers both bought and the counter ran past its own limit. The bound now lives in the write. A concurrency probe that had been deleted as vacuous turned out to be reachable — the mock resolved synchronously, so the workers never interleaved; with one await it catches both bugs.

Proven with real money, not mocks

Driven through the cron path on the deployed build: 20 generations, $0.18, ~28 minutes across ~5 ticks, then a 13-second, $0.00 resume to finish. Zero duplicate purchases — character state ×1 and all ten animations ×1, across five resumes and an overlapping worker.

The run paid for itself immediately: it caught ERR_DLOPEN_FAILED: libvips-cpp.so.8.18.3, where the forge bought everything and died at the measure step — full spend, no artifact — a shape invisible to 1,199 green tests because the suite mocks the image layer. serverExternalPackages was already set and is not sufficient: libvips is opened by dlopen, so nothing statically references it and the file tracer never copies it in.

Money cannot eat the plan

With on-demand forging about to open past Rj, the survival floor stops being a budget policy: a cohort would draw the pool to its floor on every request — "affordable" every time — and the bulk sprite run would quietly become unfundable. A cohort reserve refuses an on-demand forge below 3,000 generations (or $6 credit on an exhausted pool), failing closed on an unreadable balance. Paid skins and Rj's own forges are honoured down to the survival floor: the reserve protects planned work from unplanned work, not people from each other.

Zero balance numbers changed. Suite: 1205 route · 101 UI; typecheck, build and all gates green.

The durable purchase surface (/purchases) — the store-trust wave's M item

The post-purchase receipt polls for ~28 seconds and stops. Stripe retries a failed webhook delivery with backoff over hours. So a legitimately slow purchase left the player looking at "pending", and then at nothing at all, on any surface — the money gone and no page in the app admitting the purchase existed. The purchase_granted bell closed the cheap half of that; this is the half that answers "what did I buy last month?".

It lives in the ACCOUNT group, not Market — deliberately. The Market nav section is fail-closed on the store flag, and receipts that vanish when a flag flips are the same "no surface admits it exists" bug with a different trigger. You can always see what you bought, even when you can no longer buy.

Read-only; the userId filter comes from the session and there is no request parameter that could aim it elsewhere. Mutation-verified 6/6, including dropping that filter.

Three choices worth naming

It shows pending and refunded rows, not just successes. A pending row is precisely the case the receipt abandons — hiding it here would recreate the original bug one layer down.

It flags a refund it cannot confirm. A row that reads refunded with no refundId is a refund we asked Stripe for and never saw settle. The page says so rather than stating flatly that the money came back — the same honesty rule that stops the receipt claiming a grant it has not seen. (That state is also one of the two reconciliation queries recorded in the launch plan by the F7 work.)

It describes purchases BY KIND, using the receipt's own copy. Per-SKU names were the obvious choice and the wrong one: a coverage test showed 21 purchasable SKUs have no `card.entries` copy, so per-SKU naming would have leaked raw identifiers like stamina_boost_7d for exactly the cosmetics and packs it was meant to name. Kind copy covers all eight kinds. A SKU retired since purchase falls back to its identifier — an ugly receipt beats a missing one.

Drift audit #8 (gate-produced, fifth consecutive)

1 of 7 drifted: gaps-and-risks.md still described F7 as an open defect after it shipped, and the purchase-history page as pending after it was built. Both corrected. The observation worth carrying: depth of work on a defect predicts drift in the docs that describe it — the three-round F7 review consumed the session's attention, and the risk register was the thing that lagged.

F7 — the webhook committed completed before granting (sk_live BLOCKER, launch plan 3f)

The Stripe webhook flipped the Purchase row pending → completed and then granted. That flip is the only idempotency guard the entitlements module has — it says so in its own comments — so a grant that threw for anything not already special-cased (a Mongo blip, a timeout, a deploy mid-flight) left the purchase charged · `completed` · ungranted, and Stripe's retry matched the replay branch and zero-opped. Unrepairable, and invisible: the row claimed success.

The flip and the grant now commit or abort together. A failed grant leaves the row pending, so Stripe's own retry is a clean first attempt.

Repair-on-retry was rejected deliberately. The grant kinds are not idempotent — a booster extends a timer, a bundle re-grants its list — so re-running would have traded a money loss for a money leak. The recovery path (unknown session) had the same defect in its own dialect and got the same treatment: fixing only the primary path would have left the branch that runs when something has already gone wrong as the unsafe half.

Three review rounds, and what each one caught

The mandatory review found a defect in each of the first two fixes, all in the same seam:

1. My recovery-path refund passed null for the purchase id, so the refunded tombstone was never written — a measured re-grant of a refunded charge on redelivery. Money back and the goods. 2. My fix for that wrote no status, so the row was born pending — grantable — for the whole Stripe refund round-trip. The same leak, reintroduced by its own fix. 3. The code was clean and the guard test was vacuous: its concurrency gate was disarmed by its own hook, so the window it existed to hold open never opened.

Also closed in the same pass: an unknown SKU no longer commits a success (it stays pending, alarms with the SKU named, and carries the real amounts so it is findable by query); refunded rows keep their Stripe amount instead of rendering as — in the admin support table; and the patron-gold frame can no longer outlive the transaction that paid for it.

Two reconciliation queries are now written into the launch plan as a pre-sk_live deliverable — the compensating control for a deliberate failure direction (money kept, nothing granted, human-repairable): {status:'refunded', refundId:null} and {status:'pending', amountTotal:{$gt:0}}.

What is measurably true now

A charged purchase can no longer end completed without an entitlement. A refunded charge can no longer be re-granted. A refunded row can no longer be observed in a grantable state. An unknown SKU can no longer claim success. A paid cosmetic can no longer outlive its transaction.

24 tests on this route, every guard mutation-verified red-then-green; 1376 route tests total.

UX-36 — "Saltar" meant two different things

The onboarding checklist's hide logic contradicted itself in both directions. Dismissing while incomplete removed the card with no way to get it back. Dismissing and then finishing all six made the whole card spring back uninvited. So "Saltar" meant either "gone forever" or "see you later", depending on state the player could not observe.

Dismissed now means collapsed, not gone: a one-line row stating where you are, with "mostrar". Nothing is unrecoverable and nothing reappears on its own — but a reward earned while collapsed still surfaces on that row, because silently swallowing something the player earned is the one thing worse than the card returning.

Expanding is session-local; the dismissal is what persists.

UX-23 — the bar now says when

effectiveStamina computed msToFull and the roster endpoint threw it away, so the UI could only say "next charge in N min" — not the question anyone is actually asking. The chip now reads "llena a las 21:40": a wall-clock time you can hold against your evening, rather than arithmetic homework.

It is served, not derived. Both chips come from one server computation, so they cannot disagree — a client-side estimate beside a server-rendered bar is exactly how two numbers start contradicting each other on the same row.

Crossing midnight gets its own line ("llena mañana a las 09:10"), compared by calendar day rather than a 24-hour window: 23:50 → 00:10 is twenty minutes away and still tomorrow, and a bare "09:10" there would read as this morning — a time already past.

Mutation-verified 5/5 across both.

UX-31 — confirming deletion in the language you are reading

Deleting an account required typing delete my account — in English, in a Spanish UI, to confirm the most irreversible action in the product. That is friction pointed at the wrong thing: it tests the player's English, not their intent.

The phrase is now per-locale (eliminar mi cuenta in ES). The typed phrase was never a security control — the actual authorisation is the session — so the route simply accepts both, and keeps accepting the English one forever: a cached bundle or a mid-flow tab must never lose the ability to delete its own account because copy changed.

Copy and validation live in different files, in different languages, edited by different people, so the invariant is mechanical: a test asserts each catalog's phrase is one the server accepts. Without it, a translator polishing that string breaks account deletion, and the failure mode is a button that appears to do nothing on a legally-adjacent path.

Also fixed the mobile cause rather than only tolerating it: the input now sets autoCapitalize="none" (keyboards capitalise the first letter, which made a correctly-typed phrase fail to match), and the comparison trims and case-folds.

UX-33 — a reassurance that was false

/create told players "nada aquí es permanente" — true of points and skills, untrue of class and race, which can never change. And it rendered only inside the first-run cinematic, so the players who most needed it never saw it.

Now shown to everyone, saying both truths: points and skills respec with BP, class and race are forever. A reassurance that overpromises is worse than none — it is the sentence someone quotes back when they find out, and this screen is where the irreversible choice is made.

Mutation-verified 4/4 (deletion) and 2/2 (permanence).

UX-08a — English strings at frustration moments

Every duel-API rejection line was hardcoded English, shown to a Spanish player at the exact moment something had already gone wrong. 21 lines in src/lib/duel-errors.ts, the nav gate tooltip, and two /battle network-failure strings now resolve through the catalogs.

duel-errors.ts stays import-free, which is load-bearing — it is reached from five client surfaces and importing next-intl there would bind a leaf utility to a React context. The translator is injected instead, typed structurally so the file needs no import.

Three rejections that explained nothing

The coverage test written for this item found codes the API emits that were never in the map — so they reached the player as the generic "something went wrong on our side": PVP_LEVEL_WINDOW (the newcomer shield), newcomer_protected, and STAMINA_RACE_LOST. All three predate UX-08a. A generic apology at a frustration moment is the same disease as the wrong language: the player is told nothing at the one moment an explanation is the entire point. They now have real lines.

The gate that should have caught this

check:i18n-hardcoded — mechanized after the third EN leak — passed on all of it. Its JSX-attribute rule tested isStringLiteralLike, which does not match a TemplateExpression, so `title={Unlocks at level ${n} — climb the ladder}` read as "not a string" and passed. The blind spot preferentially hid the strings most worth catching, since interpolation is exactly how a human-facing attribute gets written when it carries a number.

Fixed, and proven by planting the original leak back and watching the gate exit 1 — a gate is believed only when you have seen it fail. Its remaining known limit is recorded in the script: copy modules under src/lib/ that return player strings from plain .ts are still not scanned; this item was found by reading, not by the gate.

Mutation-verified 5/5. One of those mutants exposed a vacuous test of my own — the precedence assertion used the real payload, whose two codes map to the same line, so flipping the precedence in the source left it green. Rewritten with a deliberately disagreeing pair so it can fail.

UX-39a — the loss warning and "Reclamar todo"

Unclaimed dailies are destroyed at rollover, and the only signal was a muted countdown telling you when the day ends — not that something you already earned is about to be taken. The panel now names the loss and lets one tap collect everything.

The warning renders only when something claimable is genuinely at risk, which is the same canon as the abandon guard: a warning that fires when nothing is at stake is one people learn to scroll past. That condition is what the component tests assert, not the markup.

New route POST /api/me/daily/claim-all. It has no body to trust — the claimable set is derived server-side from the projection — and it loops claimDaily sequentially. claimDaily remains the authority on every guard.

The defect found underneath it

The all-three bonus was decided from a fast-path read and applied under a filter guarded only by claimed $ne questId. Two concurrent claims of the final two quests therefore each read the other as unclaimed, neither granted the bonus, and it became unreachable for that day — once every quest is claimed, no later claim passes the $ne guard. A reward the player had earned, gone silently.

It had been logged by the route-census draft as a "known edge, deliberately not asserted". It was a defect, not a policy — and UX-39a would have promoted it from a fast-double-click race to a one-tap one, so it was a prerequisite rather than scope creep.

The bonus now has its own atomic write, decided by the database instead of by a stale read: claimed $all [the three quests] AND $ne BONUS_ID. Exactly one writer can match it. It is also attempted on every claim request, including rejected ones, which makes it self-repairing — accounts already left short by the old race are repaired by their next claim, with no migration.

Proven test-first: the race test was red against the old code (5 essence credited where 8 was earned) before the fix existed. Mutation-verified 4/4 on the bonus guard, 4/4 on the warning conditions, 3/3 on the route. Two surviving mutants were confirmed equivalent and documented in-code rather than papered over with a test that would only restate the implementation: the route's claimable filter (claimDaily re-validates regardless) and its sequential loop (the bonus fix made parallel genuinely safe).

Also, while in the file: the per-row claim button moves to <Button pending> per the mutation-pending house rule — it was a hand-rolled disabled-only variant, the exact thing that rule forbids.

The purchase confirmation (UX-01)

Money left the account and the app said nothing — Stripe returned the player to /characters and nothing read the param. The roster simply re-rendered. Now a receipt panel states what was bought and what it granted.

The param is a trigger, never the content. It carries no sku, and must not: a receipt that named the purchase from a query string would let anyone render "you bought the 30-day booster" by typing a URL. Everything the panel claims is read from /api/me/purchases/latest — own-purchases-only, the userId filter from the session and never from the request.

A receipt, not a ceremony: house Panel, mono-caps label, no amber, no rune. The ceremony budget belongs to relics; dressing up a payment confirmation would both spend that budget and read as a sales pitch at the moment the player has already paid.

What the probe found (Rj's "prueba", live, end-to-end)

Real test-mode checkout on app.develop, paid by Rj. All four observables confirmed: the panel read confirmed with the interpolated effect line Refuerzo de vigor · 7 días, the store footer flipped POTENCIADOR NINGUNO → 1.5× ACTIVO, the header showed ⚡1.5× · quedan 6d 23h, and a purchase_granted bell row arrived unread.

The F5 `session_id` selector turned out to be load-bearing, proven by accident. The Purchase row was created at 10:00:11Z and paid 62 minutes later. createdAt is stamped at session creation, so the 15-minute fallback returned null for a genuinely just-completed purchase — the panel rendered only because success_url carries session_id. Without F5 the probe would have shown the player nothing after a successful payment.

Also verified live and worth naming, because it is the failure this feature could have introduced: typing /characters?checkout=success with no purchase renders nothing at all, held past the full poll window. The page never announces a payment that did not happen.

UX-26, second half — instrumented, not built

Fable's ruling (Rj veto open): accept + instrument. manual_fight_abandoned_in_app now fires when the battle client unmounts while a fight is live — which is exactly what an in-app client-side navigation does, with the page still alive so PostHog can flush.

Guarded on both sides: it fires only if the fight was live (liveRef) and the page is not unloading (unloadingRef, set by the existing beforeunload handler). A reload or tab-close is already covered by the v0.85.3 dialog; counting it here would inflate the very number the build/don't-build decision rests on. Empty dep array, so the cleanup runs on real unmount only — with deps it would count renders as abandonments.

Why the guard itself was not built

App Router has no supported navigation-block API. Intercepting every anchor click, or patching the router, is a fragile global hook that breaks silently on a framework upgrade — worse than a known gap. And an in-app exit is a deliberate visible click, not the silent loss a reload was.

A review trigger is recorded in ux-fix-plan-propuesta.md: build the shared useUnsavedGuard primitive only if cohort data shows a real loss; if the rate is negligible, close UX-26 as complete-by-decision. An accepted gap without a trigger quietly becomes a permanent one.

Four mutants killed: dropping the unloading guard, renaming the event, adding deps to the unmount effect, and removing the beforeunload flag write.

The full-page fight let you leave without asking

Leaving mid-fight spends the attempt and its stamina charge. The fight modal has asked before letting you go for a while; the full-page route ran the same client with the modal hook as a no-op — so the identical action, at the identical cost, simply happened. Reload the tab and the charge was gone.

It now registers a beforeunload guard, and only where it belongs: unhosted and mid-fight. Hosted keeps the modal's nicer confirm, and a finished fight never nags — a guard that fires when nothing is at stake trains people to click through the one that matters.

Shipped partial, and labelled partial

beforeunload covers the browser-level exits: reload, tab close, back out of the app. It does not cover in-app navigation — clicking a sidebar link still leaves without asking. App Router has no supported navigation-block API, and the workarounds (intercepting every anchor click, or patching the router) are the kind of fragile global hook that breaks silently on a framework upgrade.

The browser-level exits were the ones that lost an attempt with no interface at all, and those are closed. The remaining half is recorded in the plan as an open decision rather than quietly counted as done — a worklist that marks a half-fix complete is how the other half never gets built.

Zero balance numbers changed. Suite: 1311 route · 101 UI · 52 browser; all gates green.

The deletion screen invited the behaviour the system penalises

The danger-zone copy ended with "cierra sesión y regístrate de nuevo si quieres empezar otra vez" — an invitation to do exactly the thing that costs you something. Deleting writes a tombstone, and a re-login inside 30 days re-provisions the account without the starter gift, with the onboarding reward pre-marked as granted. Nothing disclosed that.

It states it now, in both locales. Same doctrine as the relicario's daily cap, applied to an exit: a penalty the player cannot see is a trap; one they can see is a rule. Nobody is going to be talked out of leaving by a line of copy — but they should know what leaving and returning actually costs.

The window interpolates from the constant, so it cannot drift from what the code enforces, and a test asserts the premise too: if the cooldown is ever removed, the copy becomes a warning about a penalty that no longer exists, which is its own dishonesty.

One trap while fixing it, worth recording

Interpolating that number meant importing it into a client component — and server/tombstone.ts imports node:crypto and a mongoose model. `pnpm typecheck` passed; `pnpm build` failed, exactly the two banked lessons (check module purity before a server import; typecheck misses client/server poisoning). The constant now lives in a pure module both sides import, with one definition.

Zero balance numbers changed. Suite: 1308 route · 101 UI · 52 browser; all gates green.

The battle bar promised a payout the end card contradicted

It read the literal string "+10 BP · +10 XP" — correct only for a tier-1 fight with no grey decay. Measured against the function that actually pays out: a T7 fight pays +34, and a grey-decayed T1 fight pays +3. The bar understated by ~3.4× at endgame and overstated by ~3.3× on decayed fights, while the end card paid the true number — so a player saw two different answers for one fight, and the wrong one came first.

It now calls the same pveRewards(tier, playerLevel, npcLevel) the server pays with, so a balance change moves the promise and the payout together. Casual PvP pays no BP or XP, so the row is now absent there rather than quietly showing a PvE number.

A test locks the binding — reverting to a constant turns it red — and also asserts the premise: that tier still scales the payout and grey decay still reduces it. If either stops being true, the test says so instead of passing forever over a fix that no longer means anything.

Zero balance numbers changed. Suite: 1304 route · 101 UI · 52 browser; all gates green.

The landing shows the game, not a description of it

Race cards carry the real fighter sprite. There are no standalone race sprites — the atlas holds twelve race×class fighters — so this is deliberate affinity casting (Tharûm→warrior, Sylphar→rogue, Aeshtar→mage: the canonical stat pairing), rendered from the idle frame with image-rendering: pixelated at an honest size. The caption names the class, so the image never quietly universalises "this is what a Tharûm looks like".

Class cards open the expediente. A visible VER KIT → affordance opens a Modal on desktop and the house bottom-sheet Drawer on mobile — same content, two presentations, with the Modal a11y contract inherited rather than re-solved. A card that silently happens to be clickable is a secret, so the affordance is written on it.

Inside: the class sprite, its stat line, the creation screen's own prose, the full kit in unlock order, the two subclass branches, an aura teaser, and a conversion CTA.

Not one number in it is typed by hand

Skill names and order come from the class kit; unlock levels from skillUnlockLevelByKey — the same function the allocation cap uses; branch identities from SUBCLASS_KITS; and 10 / 16 / 20 from SUBCLASS_UNLOCK_LEVEL, AURA_UNLOCK_LEVEL, LEVEL_CAP. A balance pass moves this page without anyone remembering it exists.

The kit quotes each skill's flavour line, not its description: four descriptions carry live balance figures ("+10% de daño por 6 ticks"), and putting those on a marketing page would age them the moment a coefficient moves. All twenty-four flavour lines are numberless in both locales — checked, not assumed — and the browser spec asserts the dialog contains no % at all.

The bug that hid behind a 200

The first version passed a function across the server/client boundary. React cannot serialise that, and the failure is silent: the route hung on its loading skeleton and returned HTTP 200 with a full-size body — indistinguishable from a slow dev compile. Two server restarts and a cache-bust later, the markup said Loading Duelsmith…, which would have named it on the first read. Everything now crosses as plain data, which also keeps the domain modules out of the client bundle.

Gated in a real browser (tests/browser/landing-class-kit.spec.ts), which compares levels against the domain constants rather than numbers typed in the spec — hardcoding 10 there would be exactly the drift this page's acceptance forbids — and checks each sprite's naturalWidth, because a broken <img> is still "visible" to a test runner.

Zero balance numbers changed. Suite: 1300 route · 101 UI · 52 browser; typecheck, build and all gates green.

The random-gem odds were shown nowhere

A gamble with no published odds, on the surface whose entire pitch is visible math — the public landing says it in Spanish, to strangers: "cada probabilidad: a la vista, antes de pelear." The odds now print beside the button.

The part that matters is where the numbers come from: the roll's own constant, exported for this purpose. Restating them as prose would let the page keep advertising odds the roll no longer uses, and a test asserts the binding — hardcoding the percentages turns it red.

Destroying a socketed gem took one click

Unsocketing destroys the gem, and it sat behind a single tap of a danger button — an irreversible loss with no confirmation. It is two taps now, arming first with the loss named, reusing the mill's confirm pattern (the PRD calls it the model the rest should copy). Arming clears when the selected item changes, so an armed socket can never be confirmed against a different item.

The success toast also printed the raw gem id at the player; it names the gem now.

Zero balance numbers changed. Suite: 1300 route · 101 UI · 52 browser; all gates green.

/pvp advertised a mechanic that does not exist

Stakes are parked behind STAKES_ENABLED (false), yet the direct-challenge panel shipped the stakes blurb live — "apuesta BP y el ganador se lleva el pozo" — and rendered a working 25/50 BP stake picker. An affordance, with real numbers, for a mechanic that isn't there.

Worth noting how it happened: the flag was already imported in that very file. The parking was half-done — the send path respected it, the copy and the picker did not. Both now read the single source, so they return by themselves the day the constant flips, with no copy archaeology. A test asserts that reading, and would have caught the original state.

A successful purchase now rings the bell

Until now the only purchase notifications were bp_refund and skin_refund — the two failure cases. A successful grant was silent everywhere except a receipt that expires in seconds, while Stripe retries deliveries with backoff over hours: a late webhook left the player with no surface at all admitting the purchase happened. Same shape as the blank forge notification. Silent success is a bug.

It also surfaced a live trap: Notification.ts declares each kind twice — a TypeScript union and a runtime mongoose enum. Adding one to the union alone typechecks, then fails validation at write time silently, because notifications are deliberately best-effort so a bell can never fail a grant that already happened. A three-way agreement test (union / enum / bell copy) now covers it, and its second assertion would have caught the blank forge row before it shipped.

Zero balance numbers changed. Suite: 1294 route · 101 UI · 52 browser; all gates green.

The forge's payoff notification was a blank row

The forge emits forge_ready with { comboKey, variantKey } and the model accepts it — but the bell's kind union and copy switch had no case for it. So the payoff moment of a paid flow, after a wait measured in tens of minutes, arrived as an empty row in the notification list.

Added end to end: the kind, the copy in both locales, and an action link straight to the surface where the new look is worn. A notification whose whole job is to say "the thing you paid for is ready" now says it.

UX-03 disconfirmed — no fix shipped

The plan listed flag-off store 404s reachable from live CTAs. Enumerated every inbound link and the premise does not hold: pack-mill.tsx, inventory-panel.tsx (×3) and the odds page all point at `/pack`, which has no flag gate at all. The only gated route is /pack/odds, whose sole inbound link lives inside the store — itself flag-gated, so unreachable while the flag is off. Pack opening costs BP, not money, so it was never in the store flag's scope. Recorded in the plan as disconfirmed rather than "fixed", because shipping a change here would have been motion without a defect.

Zero balance numbers changed. Suite: 1279 route · 101 UI · 52 browser; all gates green.

The rematch chip did nothing

onRematch called router.push('/battle?npc=<id>') — the URL the player was already on. Next correctly treats that as a no-op, so the chip rendered, responded to the cursor, and did nothing. It is the fifth entry in the rematch saga, which is why it ships with a test rather than a note.

The fix is two halves, and either alone leaves the chip dead: the push now carries a changing nonce so it is a real navigation, and the page keys the battle view on that nonce so the tree actually remounts. The remount is the point — it re-runs the start flow, which is correct, because a rematch is a new fight and must take a new start token and a new stamina charge rather than silently reusing the finished one.

The nonce is a routing device and nothing more; a test asserts the loader never branches on it, because a client-supplied value reaching fightability logic would be a trust boundary rather than a cache-buster.

Zero balance numbers changed. Suite: 1279 route · 101 UI · 52 browser; all gates green.

www is the door, app is the application

Rj's ruling: "app es la aplicación, www es el acceso público para este sentido." The landing now serves the www root and is the public front door. The app root reverted to application behaviour — signed in, the roster; signed out, a redirect to the landing. No marketing surface at the app root any more, so the two can never drift into two different pitches.

The old www root — the "La Gran Obra" pitch — was not deleted. It moved to `/world` and is linked from the landing footer and from the cockpit's new MUNDO section. Moved, not lost. /releases is unchanged and linked too.

The landing itself

A full sectioned page: anchor-chip nav, a hero whose product visual is a real replay, three value props, 01 clases · 02 razas · 03 el taller · 04 preguntas, and a closing CTA. Every anti-drift clause holds by construction, not by anyone remembering:

• No colour constants. Every value resolves to a globals.css token; ceremony reuses rarity-legendary, the amber the relicario already renders.
• Class and race cards read the domain — the same CLASSES/RACES the creation screen uses, so a balance pass moves the landing. The prose is read from the creation screen's own catalog rather than copied: marketing that quotes a screen should quote the screen, or it drifts and starts lying about the game.
• The replay is a real run — seed 20260815, printed on the card, with the reproduce command in the source. Deterministic by seed means anyone can check it.
• The roadmap block renders the real shipped lane, versions included.
• Race passives are named without numbers, so balance cannot age the page.

Nav: the Relicario was unreachable

/relicario had no nav entry at all — not gated, not renamed, simply never added when it shipped in v0.83.0. It had been live for days and read as missing, because the only way in was typing the URL. Its own doctrine decided the fix: undiscovered relics are shown sealed rather than hidden, and that applies to navigation too, so the entry is always visible — including at zero relics. It sits in a new MUNDO section beside "El mundo", which moved out of the account dropdown (that menu is for account, session and settings; the world is game content).

The first attempt appended MUNDO last, where it rendered perfectly and stayed invisible below the rail's internal scroll — the same bug in a quieter costume. Reachability is now a release-checklist line (release-process.md §2g-bis), along with: verify navigation with a screenshot, not a selector.

Three things only the deployed build could tell us

• Next turns an external `redirect()` into a 1-second `<meta refresh>` served with HTTP 200. A logged-out visitor got a blank second; a crawler got a 200 where a redirect belongs. It is a real 307 at the proxy now, with the page's own redirect kept as the authority.
• A raw i18n key was live in the footer — LANDING.NAV.WORLD, in front of every visitor. next-intl does not throw on a missing key; it renders the key path, so every gate stayed green. Caught by looking at a screenshot, which works exactly as long as someone looks — hence tests/routes/i18n-keys-exist.test.ts, which walks every literal t() key in src/app and asserts it exists in both catalogs.
• A guard test failed correctly when /world joined SITE_REWRITES: it asserted "exactly the four public site paths". That is what an explicit allow-list is for, so the assertion was updated deliberately, with the reason written at the line.

Zero balance numbers changed. Suite: 1276 route · 101 UI · 49 browser; typecheck, build and all gates green.

The landing spec followed the landing

When the landing moved to the WWW host, tests/browser/landing-nav.spec.ts kept navigating to the app root — which now correctly 307s away. Three specs went red. They point at site.localhost:3000 now (the zero-setup local site host: the .localhost fallbacks resolve to 127.0.0.1 over plain http, unlike the HSTS-preloaded .dev names).

Process note, recorded on purpose

v0.83.5 was tagged with those three specs red. The browser suite is a mandatory pre-tag gate; it was run, it printed 46 passed and exited non-zero, and the tag command was chained behind it in the same shell — so the failure scrolled past and the tag went out anyway. The gate did its job; the person watching did not.

The lesson is not "look harder". It is that a gate chained ahead of an irreversible step must stop that step — && between a test run and git tag only works if you read the exit code, and reading 46 passed in a wall of output is exactly the reading that fails. Written into the checklist rather than into anyone's memory: release-process.md §3 now says the browser suite is run as its own command, its exit code confirmed, before the tag command is typed at all.

Nothing shipped broken — the specs were stale, not the code — but a tag past a red gate is worth one patch and one paragraph, because the next one might not be.

Zero balance numbers changed. Suite: 1208 route · 101 UI · 49 browser; all gates green.

Three more of the same bug, found by looking for it on purpose

session.withTransaction re-runs its callback on a write conflict. Anything the previous attempt left in memory is still there — so a callback that accumulates with +=, or that saves a hydrated document whose dirty paths the aborted attempt already cleared, is not idempotent. That single shape has now produced one fight eating two stamina charges, a legitimate fight 500ing, and the three below. A census run against the whole codebase found 20 instances; these are the three worst, each verified by reading the code before anything was changed.

F1 — a whole season could pay out twice (money). The season roll-up ended with season.status = 'closed'; await season.save({ session }) on a hydrated document. Mongoose clears a document's dirty paths once save() has issued its update, so when the transaction then aborts — and this is the largest transaction in the codebase, every participant plus every rated character, so conflict-driven retries are the expected case — the in-memory document still believes it is clean. The retry's save() writes nothing, the season stays closing, and the claim loop picks it up on the next run and pays BP and essence to every participant again. Now an explicit updateOne, which always issues the write.

F2 — the mill could credit dust and essence twice (money). Its dust/essence accumulators live outside the callback because the response needs them, but the += runs inside it. A retry kept counting from the aborted attempt's total. They reset at the top of every attempt now.

F8 — the same snapshot fix, missing from the manual route (reliability). The auto duel route was fixed today to read a snapshot id captured before the transaction; the manual route was still reading the live field, so the identical 500 (SNAPSHOT_MISSING on a legitimate fight) was one level-up away. Ported — and both routes are now pinned together by a test, because a fix applied to one of two twins is a fix with a countdown on it.

The guard, and why it is structural

Triggering a real write-conflict retry needs fault injection Mongo offers no test hook for: a behavioural test would either never retry (proving nothing) or hang on a race that passes most runs. So tests/routes/retry-idempotence.test.ts asserts the shape that makes each bug impossible, and all three were verified by reverting the fix and watching the test go red. Its first version failed against the fixed code — it was matching the fix's own explanatory comment, the same meta-text trap the Spanish-register gate hit — so it compares code with comments stripped.

Zero balance numbers changed. Suite: 1208 route · 101 UI; typecheck, build and all gates green.

The sealed card adopts ◈ (Rj: "la runa")

The relicario's sealed card and codex divider used a generic sparkle icon, while the brand spec committed the same day defines ◈ as the brand glyph — and describes it as "the same glyph as the relicario's sealed cards". The document and the product disagreed. Rj ruled for the rune, so the product converges on the document; docs/brand.md/the spec stand unchanged and no supersession is owed.

Shipped as one shared `RelicRune` component, not four inline spans. A brand glyph copy-pasted into every consumer is a glyph that drifts — one call site eventually gets a different size or weight and nobody notices, because there is nothing to compare against. Sizes mirror the icon dimensions they replace, so no layout shifts; it is aria-hidden in every use because it always sits beside real text ("reliquia sellada", the set name) and announcing "black diamond containing white diamond" would be noise.

Swept every surface, enumerated: the reveal ceremony (3 call sites), the codex rail (1), and the /dev/relicario-preview harness (4). The harness matters as much as the product here — it is the surface used for the visual read-back, so leaving it stale would have made the verification itself misleading. Verified in a real browser at both sizes, not inferred from a green build.

Version chip wiring (groundwork, invisible today)

NEXT_PUBLIC_APP_VERSION is now inlined at build time from package.json, beside the existing build sha. The upcoming dev-landing redesign specifies a version chip that is "always truthful"; a client component cannot read package.json at runtime, and a hand-typed version string rots silently. The constant exists before the redesign starts so the build has nothing to invent.

Zero balance numbers changed. Suite: 1205 route · 101 UI · 46 browser; typecheck, build and all gates green.

14 banned regionalisms removed from live copy

Rj's signed ES voice is tuteo MX — no acá, no al toque, no voseo, and costo over the peninsular coste. Twelve instances of acá had been sitting in shipped catalogs across nine namespaces (characters, common, create, cube, hallOfFame, library, packs, plan, pvp).

The sweep then missed two of its own targets — a capitalized "Acá viven tus campeones" on the roster and "Coste" as the cube's cost label — because both the fix and the "0 remaining" verification were case-sensitive. Caught by the new full scan immediately after, which is the only reason this note says 14 and not 12.

Root cause closed: the gate was structurally blind to its own past

check:es-register greps the ADDED lines of a diff. That is right for catching a new violation at tag time, and it means a green result only ever meant "no NEW violation" — it could never see anything committed before the gate existed. Twelve instances lived through weeks of green runs.

New `pnpm check:es-register:all` scans the full current content of live copy (messages/es), the lore, and the UNRELEASED queue. Shipped release notes are deliberately excluded: they are an archive, and history stays as written.

And an explicit escape for meta-text: documentation about this lint has to be able to quote what it bans — the gate flagged its own changelog entry and a lore design doc. A line marked es-register-ok is skipped. Greppable on purpose, so it cannot quietly become an escape hatch for real copy.

Two gates fixed themselves on the way out

Both were caught by the release bar, on this release, which is the point of mechanizing them:

• The drift-audit gate fired for the first time and blocked this tag at exactly 5 releases since v0.81.0. Audit #4 ran because the build refused, not because anyone remembered — the guard was built four days ago precisely because guard #4 had lapsed 19 releases unnoticed. One item had drifted (two banked lessons unmirrored in docs/lessons.md); fixed. It then rejected my own audit entry for naming v0.83.3 as the next baseline — a tag that does not exist yet.
• The browser suite was flaky, not broken. The pre-tag run reported 8 failures across three fight-surface specs; each passed in isolation and all 46 passed at --workers=2. The whole suite drives one next dev server, so Playwright's core-count default was starving it. workers is now pinned at 2: a MANDATORY gate's red must mean broken, never busy, because a gate that cries wolf is one that gets waved through — which is how these specs rotted unseen once already.

No balance numbers changed. Suite: 1189 route · 101 UI · 46 browser; typecheck + build clean; both register modes green.

Two collections survived account deletion. They don't now.

The account-deletion cascade did not purge `BuildSnapshot` (the build library, PRO-58) or `PlanPreset` (saved tactical presets) — both player-authored, both userId-scoped, both surviving a deletion whose tombstone states "no personal data survives".

Both were pre-existing, and both were surfaced by the deletion-completeness gate on its very first run — the structural test added days earlier precisely so a forgotten collection fails the build instead of a memory. It found these within a minute of existing.

Straight purges, no anonymisation. The anonymise-not-purge option was considered and withdrawn on verification: nothing outside the owner references either (Duel does not touch BuildSnapshot; presets are owner-scoped), so there is no third party to preserve a reference for.

One trap recorded in the code, because it reads like a prohibition: BuildSnapshot's model header says docs are "NEVER deleted". That governs entitlement revocation making the library read-only — it is not a deletion exemption. Conflating the two would retain a deleted user's data forever on a technicality.

Both purges run inside the existing transaction and appear in the response counts. Locked by tests, and mutation-tested: removing either purge fails two tests — the purge spec and the completeness gate independently, since a removed purge leaves the model neither purged nor explicitly retained.

No balance numbers changed. Suite: 1189 route · 101 UI; typecheck + build clean.

Concurrent duels no longer 500

Firing several duels at once could return 500 `SNAPSHOT_MISSING` on perfectly legitimate fights — probed at 6 of 8. Two independent causes, and the probe-first order is what separated them.

Cause 1 — the attacker's snapshot, and it is the "one fight ate 2 charges" family again. buildAndSaveSnapshot mutates character.activeSnapshotId in memory on level-up, inside the duel transaction. When withTransaction retries its callback (a write conflict, which is exactly what concurrent duels produce), that field pointed at a snapshot the abort had rolled back — so the retry read null and threw. The read now uses an id captured before the transaction: in-memory state mutated inside a retried callback is not idempotent; constants captured beforehand are.

Cause 2 — the NPC snapshot mint. getOrCreateNpcSnapshot was a read-then-create inside the caller's transaction, so N simultaneous duels against a cold NPC all read "nothing there" and raced to mint version 1. It is now an atomic, duplicate-tolerant upsert performed outside the caller's transaction — deliberate, because an NPC snapshot is a shared, immutable, content-derived resource, not part of any one duel's atomic unit. Making a duel abort over a doc it merely wanted to read was the design error.

Method note

The N-concurrent probe was written before the fix, per the checklist rule mechanized this week — and it earned that rule immediately: the obvious hypothesis (the NPC mint) was not the main cause, and a fix shipped on that guess would have left 6-of-8 failing. Both halves are mutation-tested: reverting either one turns the probe red.

No balance numbers changed. Suite: 1188 route · 101 UI · 46 browser; typecheck + build clean.

The relicario — relics you earn by fighting (PRO-122)

The 30 canon lore fragments had no vehicle. They have one now, and it is earned, deterministic and never sold.

• A DEEDS LEDGER, per account: total fights, wins, PvP duels, ladder fights — an extensible enum designed as a reusable substrate (achievements and season goals are the obvious next clients; the relicario is client #1, not the owner).
• Each canto binds to a MISSION over that ledger, chained: rung N+1 arms only when rung N is opened. Set 1's payoff — the ten Cantos read in sequence revealing that the Anvil-Peace was signed by shared fear rather than won — is preserved by construction, not by convention.
• The reveal ceremony: a sealed-rune card the player opens. Never a silent list insert, never a "+1" toast. It shows the mission that opens it and the progress toward it — the mystery is the content, never the condition.
• The codex wing (/relicario): entries framed by set and ordinal with ornament, undiscovered ones shown sealed rather than hidden so the shape of what's missing is visible, and "read in order" as a first-class affordance.

Money: the ledger cannot be bought — 0×, and it is a cap, not a promise

Stamina is per-character and purchasable (champion slots, regen booster) while the ledger is per-account, so paid throughput could reach ~2.5× free. Closed at the source with a visible account-level cap of 90 fight-deeds/day — exactly the free post-flip ceiling (3 champions × 30 regen-limited charges). Since the cap equals what a non-paying account already reaches, buying champions or a booster moves the ledger by nothing. Declared in the codex UI, because a cap you can't see is a trap and one you can see is a rule. A guard test derives the number from FREE_CHAMPION_CAP / STAMINA_CAP / the regen interval, so the guarantee fails the build rather than drifting.

Deliberate design calls

Zero backfill — deeds count from launch; a veteran starts level with a newcomer, because a backfilled relic is a gifted relic wearing a counter's clothes. Losses count — a collection that only advances on wins punishes the player who needs a reason to continue. No per-day farm cap beyond the ledger cap — it would punish engaged players to stop a farmer the opponent-level floor already handles.

On the process (worth stating)

Five adversarial review rounds. They found a live exploit outside this feature (shipped as v0.82.1), a ledger that had never recorded a deed in any environment, a bypassable ceremony, a permanently un-healable stall, and an account-deletion gap. Four times, a round's fix carried the next defect. The durable outcome is mechanical: a real-DB route test is now required before review for any state-mutating route, every such route gets an N-concurrent probe, and a test that imports nothing real is not a test — all three earned, all three now in the checklist.

Zero balance numbers changed. Suite: 1184 route · 101 UI; typecheck, build and all gates green.

R1 — the stamina debit is now race-safe (exploit fix)

POST /api/duels read stamina before its transaction and wrote an absolute post-value inside it, with no conditional filter. N simultaneous requests all read the same charge, all wrote the same post-value, and N duels resolved for one charge — each paying full XP, BP, loot and rating. Reproducible from a browser console with no await between fetches. Live on the deployed cohort surface; found by the money-path review of the relicario, which depended on stamina being a real ceiling and discovered it wasn't.

Why the obvious fix was wrong. A relative $inc is race-safe but not retry-idempotent — withTransaction retries its callback, so the decrement applies twice. That is precisely the "one fight ate 2 charges" bug (12 Jul 2026) the absolute $set was written to prevent. The two failure modes are opposites; swapping one for the other only trades which bug you have.

Compare-and-swap satisfies both. The update filter pins the exact values the debit was computed from, so inside the transaction a retry still matches (pre-commit read) while a concurrent loser matches nothing and rejects cleanly with 409 `STAMINA_RACE_LOST`, having spent nothing.

Locked by `tests/routes/duels-stamina-concurrency.test.ts`, which asserts both halves — N concurrent duels spend N charges, and a single duel still spends exactly one — because fixing either alone regresses the other, which is how this class survives review.

R8 — a 500 on the same route was invisible to Sentry

The SNAPSHOT_MISSING branch returned before reportRouteError, in direct violation of the observability rule. It was the dominant failure mode under the reviewer's concurrency probes, so an attacker bursting the route generated a storm of 500s nobody could see. Reports first now.

Also found, NOT fixed here

Writing the concurrency spec surfaced a second pre-existing race: getOrCreateNpcSnapshot under a cold-NPC burst 500s most requests with SNAPSHOT_MISSING. Same TOCTOU class, different resource. Reported and awaiting a ruling; the new test warms the snapshot so it isolates the stamina invariant.

Process, mechanized

money-path-review gains two mandatory checklist items: every state-mutating route in a diff gets an N-concurrent probe test, and a guard test that imports nothing real is not a test (a cap guard in the same arc asserted 90 === 90 from two local literals and could not fail). Both banked to docs/lessons.md.

No balance numbers changed. Suite: 1169 route · 101 UI; typecheck, build and all gates green.

The S1 story chapter has a voice (PRO-114 Phase B)

The Season 1 chain shipped as six stages and a boss with one-line blurbs. The rebellion behind it — why 84 duelists' worth of Ladder discipline produced a mutiny, and why its founder refused the 85th pedestal — lived only in docs/lore/. It's now in the game.

• Six stage intros. Each stage introduces the deserter you're about to fight as a person: who they were on the Ladder and what made them walk out. The arc is a conviction ladder — the newest blade (nine days out, chalk still on her hands) → the twenty-year shield-wall holder who was told to bend one time too many → the drillmaster who asked what happened to the ones she handed over → the right hand who was there when Khargrim said no → the wordless oath → the last door. Each one is a deeper reason someone left.
• Khargrim speaks before his duel. Five lines, ending in the sentence historia.md §3 is built on: "My Echo obeys me — not the Peace." It rhymes with his shipped card line without repeating it.
• A closing beat on beating him — FIRST CLEAR ONLY. Khargrim doesn't kneel; he nods once, the nod one smith gives another's work. You won; the question didn't lose. Then, on the walk back, a single grey feather knotted in silk waits on your gear — courtly work, no message. Deliberately once: replayed on every rematch farm, the uncomfortable truth becomes wallpaper and the feather stops reading as an event.

How it works (and why story bosses were mute until now)

The pre-fight voice (v0.78.0) composes a race clause + a class×tier line from 31 fragments to cover 84 ladder NPCs. Story NPCs are tier 0, so that lookup could never match them — the mute wasn't a policy, it was a structural gap. Story NPCs now take a parallel path keyed on their npcKey (story-{storyKey}-s{n} / -boss), which covers the six intros and Khargrim through one code path. It stays `.has`-guarded, so the tier-0 mute lifts per authored key, never wholesale — a future season with no prose written stays silent by construction. No race clause on this path: the accent fragments exist to texture generic NPCs; a named character speaks as itself.

Stage blurbs are localized

The six stage blurbs + the boss line were English literals in server/stories.ts, so Spanish players saw English on the stage cards. They now resolve from story.stageBlurb.* — the English text is unchanged (the lore rule: shipped blurbs are not rewritten, the intros are additive) with Spanish added, .has-guarded against the server literal so the domain and CLI keep their own copy.

Also

• Fixed a banned regionalism in the story catalog (the non-MX "here", now aquí) — the ES-register gate only inspects added diff lines, so copy committed before the gate existed was never swept. (Written without quoting the offending form: the gate lints its own release notes, so a changelog that names the word fails the tag that ships the fix.)
• The battle preview harness captioned every stage's beat with Khargrim's name; it now maps the real S1 cast, so review screens can't misattribute a line.

Zero balance numbers changed. Suite: 1148 route · 101 UI; typecheck, build, i18n + ES register clean.

The passive/unique line renders on EVERY card variant (Rj override)

v0.80.0 gave every passive an honest kind chip + real number + Spanish. But v0.64.0 had dropped that block from the compact card, so on the two surfaces where you actually compare items — /items and /catalog — the passive was invisible until you opened the inspector. That inverts the "no hidden math" thesis one release later: a passive is a reason to pick the item. Rj's ruling: it renders on every variant, every surface. Abbreviated where space demands; never absent.

Grep-enumerated roster (the "enumerate broad nouns" lesson — every card variant, not a guess):

Deliberately out of scope (not item cards): opponent-card / champion-card (champions carry no items), ItemPicker (a filter wrapper), improve-item-panel (a recommendation), /playtest.

The best-value side effect: the `/catalog` locked card. An item you don't own yet already rendered its real name + stats through the desaturated treatment — it now states its passive too. You can read what Earthshaker does (Quake · [ACTIVE] · "heavy hits ≥ 23% max HP stun, twice per fight") before you ever get one. Same for scouting: a rival's Regicide/Quake is no longer invisible while you decide whether to attack.

One primitive, three densities

New components/game/unique-line.tsx: useUniqueDisplay() (the localized/numbered resolution, lifted verbatim out of item-card) + <UniqueLine variant="full" | "compact" | "row"> + an <ItemUniqueLine defId> convenience. One resolution means the wording, the kind chip and the numbers cannot drift between surfaces. data-unique-state / data-unique-kind ride every variant, so a DOM probe can verify any surface. No new copy — it reuses the uniques namespace shipped in v0.80.0.

Fixed: three dev harnesses were blind to the unique block (and to legendary lore)

All 8 seeds in /dev/items-preview + /dev/catalog-preview carried invented defIds (runed-longsword instead of w-runed-longsword), and /dev/battle-preview's snapshot equipped[] had no `defId` at all — so uniqueViewByDefId() resolved to nothing and the unique block and the legendary lore quote had never once rendered there. The store-ia-catalog browser spec was green throughout (it asserted on affix lists and the invented names). Seeds now use real catalog ids chosen to exercise all three states: wired (Runebite/Quake), flavor (Unyielding), and a no-unique control (Bronze Sword). Banked as a lesson — a blind harness makes every visual gate built on it blind in the same place.

Locked by

tests/components/unique-line-variants.test.tsx — a render assertion per variant (name + chip + the real 23%), a no-unique-renders-nothing case, a compact-ItemCard regression, plus a grep-enumeration guard: every file in the card-variant roster must import the shared module, so a new item card that forgets the line fails the suite. The browser gate additionally asserts the line on the live compact tile and on the locked catalog card.

Zero balance numbers changed. Full suite green: 1148 route · 94 UI · 46 browser; typecheck + pnpm build clean; check:i18n-hardcoded / check:no-server-actions / check:es-register pass.

Chips → Badge: one label grammar (audit batch B3-opt)

• Nine ad-hoc chip labels (store Active · N left / Includes owned items / skin-theme tints, champion-creation class-blurb + lineage markers + the first-run gift chip, the profile avatar under review tag, the nav-rail NEW badge) now render through the shared `Badge` primitive instead of hand-rolled spans.
• Badge gained one principled dense size — `size="sm"` (9px) — which replaces the grab-bag of ad-hoc text-[9px] px-1.5/px-1 one-offs. The chips also drop their random deviations (tracking 0.14/0.18/0.22 → the Badge 0.16, off-shade border opacities → the variant's, px-1/px-[7px] → the scale). The visible effect is a consistent label look across those surfaces (the nav NEW grows 8→9px; the avatar under review gains the variant's subtle fill).
• Four genuinely non-label chips are left bespoke by design (the patron badge, the unspent-points counter, the opponent level chip, an admin tag).
• No behavior change, no money-path touched, no new player strings. typecheck + UI (84) + route (1148) + build (133/133) + gates green; Rj verified the look on device.

Cube item-card grids → one per row on mobile (B6, completed)

• B6 fixed the gem/material chips but the cube item-card grids — the "Buscar objetos…" pickers that choose a socket / improve / reforge target — still rendered 2-up and squashed on mobile (the surface Rj's earlier Aegis screenshot showed). All three now render one card per row on mobile (grid-cols-1), so the compact card breathes; sm+ keeps 3-up (unchanged).
• Swept the cube: every other grid there was already grid-cols-1 on mobile, so this closes the half-applied fix whole.
• Lesson banked (docs/lessons.md): on a broad-noun directive ("items"), grep every list the word could mean before scoping — a half-applied fix is the cost of guessing.

No new player strings. Typecheck + UI (76) + build (133/133) green.

C9 · PvP consolidates to one tabbed panel on mobile

• On mobile the whole PvP page becomes one tabbed panel — DefenseActivityPanel now folds in the DUELS section as two more tabs: Defensa / Actividad / Duelos / Resultados.
• Its tab nav uses the house mobile-nav pattern — a "[current] ▾" button that opens a bottom-sheet `Drawer` listing the tabs (icons + active marker; a row switches + closes), the same pattern as the C10 bell and the D12 store nav. (Not a horizontal strip — the correction Rj caught; banked as a lesson.)
• Desktop is unchanged: the 2-tab panel + the standalone 2-column DUELS section below the band. useIsDesktop() gates the two so nothing double-mounts (no redundant fetches).
• The one tradeoff: on desktop the first paint is the mobile layout, then it hydrates to desktop (a one-time layout shift). Accepted as the lesser-harm fallback; logged as cosmetic-perf in gaps-and-risks.md (the flash-killer refactor — lifting the duels data-fetching up — is not bought).

New key client.tabSheetTitle + client.tabResults (en/es). Full suite green (1148 route + 76 UI); gates green.

Button-overflow disease → the ButtonRow primitive + sweep

• Three confirmed instances (pack-open Gear CTAs, supplies "Comprar" pair) meant this was primitive disease, not instances (Rj). New shared `ButtonRow` (components/ui/button.tsx): a paired-CTA row that stacks full-width column below `sm` and goes side-by-side at `sm+`, with direct children full-width on mobile — so a price CTA can never overflow its container or wrap mid-value (the Button base is already whitespace-nowrap).
• Applied: the pack-open bulk row (×5 / ×10) and the supplies Comprar 1 / Comprar 5 row. The pack primary `PremiumCta` gets whitespace-nowrap + tighter padding/text/tracking below sm, so "· 100 BP" fits on one line without wrapping ("100 / BP") or clipping its corner accents.
• 360px grep-sweep (the enumeration lesson — not waiting for Rj to find the fourth): the only other non-wrapping button-pair rows are a false positive (items inspector — a ternary, one button renders), the create station (owned by the D11 carousel rework), and the plan-rule header (short "Duplicar / Borrar" labels + a flex-1 spacer). ButtonRow is now the standing guard for any new pair.

No new player strings. Typecheck + UI (76) + i18n gate + es-register + build (133/133) green.

D12 · Store section nav is a Drawer on mobile (Rj's Option B)

• The horizontal section strip (with the v0.78.4 fade) wasn't enough on mobile per Rj's eye. Now, below lg, the nav is a "[current section] ▾" button that opens the house `Drawer` listing every section — Packs · Gear · Supplies · BP · Cosmetics · Skins · QoL — each with an icon; tapping a row jumps to it and closes the Drawer. The current section is marked.
• Desktop keeps the strip (hidden lg:flex for the TabsList vs an lg:hidden button). A single SECTIONS list drives both presentations, and it reuses the Drawer pattern landed by C10.

New string page.sectionsTitle (en/es). Typecheck + UI (76) + i18n gate + es-register + parity + build (133/133) green.

C10 · Notification bell opens the house Drawer on mobile

• On mobile (< lg) the bell now opens the shared house `Drawer` (bottom sheet — backdrop, focus-trap, drag-handle, scroll-lock, reduced-motion safe) instead of a cramped w-80 absolute dropdown that clipped on narrow screens. Desktop keeps the anchored dropdown — same content, gated by useIsDesktop().
• The panel content is shared between both presentations; the inline header shows only in the desktop dropdown (the Drawer supplies its own title), and the outside-click listener is gated to desktop so the mobile Drawer's own backdrop owns close (it would otherwise fire on the portaled Drawer content and close instantly).
• This lands the Drawer pattern that D12 (store section nav, Option B) reuses next.

Typecheck + UI (76) + build (133/133) green. No new player strings. Structural change to a live component — verify the mobile bell on-device.

Panel header stacks on mobile (cube-header collision class)

• Rj's Gems-tab shot showed the header "GEMAS · engarzar / desengarzar" jammed against the "Desengarzar destruye la gema" meta on one row with no visual distinction — the same bug class as the A5 recipes header, on another tab.
• Pattern-level fix: the shared PanelHeader primitive now stacks the label over the meta on mobile (label line, meta line below) instead of forcing them onto one row; side-by-side is restored at sm+, so desktop is untouched. This resolves the collision for every panel with a header + meta, cube-wide (and app-wide) in one change.
• Swept the cube tabs: improve + forge have short labels (their long "pick an item" meta now wraps cleanly on its own line); gems rides the stack; recipes keeps its v0.80.4 A5 decomposition.
• Gems warn treatment: "Desengarzar destruye la gema" is a destructive-action note — it's now styled with the warn color so it reads as a caution, not a neutral meta.

Mobile only. Typecheck + UI (76) + i18n gate + es-register + build (133/133) green.

A5 close-loop (recipes, mobile only) + a tray bug

• Recipe tiles stack on mobile — [rarity chip] / full recipe name (wraps, never truncated) / [view]. The old one-line chip+name+CTA crushed the name to ~8 chars ("Forge th…" ×3). display:contents on mobile promotes the chip + name to their own rows; sm+ restores the exact one-line desktop layout.
• Recipes header — on mobile the panel header is just RECETAS; the modes (craftear / aprender / experimentar) move to a clean line below, and the "Forja de prestigio" meta hides < sm so it no longer competes on the header row. Desktop unchanged (the full label + meta ride hidden sm:inline).
• Bug fix — random-gem tray overflow (Rj screenshot): the 3 chosen-gem chips overflowed the tray's right edge (the third broke out). The chip row now flex-wraps — chips drop to the next line and the sticky tray grows with the wrapped height.

The EN recipe names ("Forge the Runed Longsword"…) remain tracked in docs/i18n-hardcoded-backlog.md (naming-rule follow-up). Typecheck + UI (76) + i18n gate + es-register + parity + build (133/133) green.

Mobile polish — batch B (cube UX)

• B6 · Gem chips one per row on mobile — the owned-gems strip and the random-gem picker were a squashed chip wall below sm; both now stack one per row (wrap into chips again at sm+).
• B7 · Fusion discoverable — a hint ("same-family gems fuse up a rarity →") shows when any gem can fuse, and the one-per-row layout gives each gem's FUSIONAR ×N button its own visible spot (it was a clipped inline button most players never found). Fusion is a per-gem action (no multi-gem staging), so it gets the discoverability treatment rather than a staging tray.
• B8 · Random-gem floating tray (Rj's idea) — the 3 pick slots + the craft CTA are now sticky-pinned to the bottom of the viewport while the gem picker scrolls above, so the selection never scrolls out of view. All 3 slots always render (empty ones as placeholders) so "3 filling" is legible at a glance.

Typecheck + UI (76) + i18n gate + es-register + en/es parity + build (133/133) green.

Mobile polish — batch A (quick fixes, no design gate)

• A1 · Equip slot — CAMBIAR / DESEQUIPAR become icon buttons on mobile (⇄ / unlink), each with an aria-label + a longpress InspectTip that reveals the action name; a tap still fires the action. Labels return at sm+.
• A2 · Catalog header — the count + "solo lectura" chip left-aligns on mobile (it wrapped below the title still right-aligned + ragged); right-aligned again at sm+; the long chip wraps cleanly.
• A3 · PvP — the "Actualizar" button is icon-only below `sm` (both instances), aria-label kept.
• A4 · Story boss card — on mobile the content stacks over the action buttons instead of cramming side-by-side, so the "repetición: +20 BP" reward line no longer collides with the long action labels.
• A5 · Recipes — the recipe tile name truncates so a long name doesn't crush the "ver" CTA on mobile. The EN recipe names ("Forge the Runed Longsword", …) are logged in docs/i18n-hardcoded-backlog.md — localizing them is a naming-rule follow-up (verb translates, item name stays EN) + ES gate. The header restructure awaits Rj's exact screenshot.

Typecheck + UI (76) + i18n gate + es-register + build (133/133) green. No new player-facing strings.

Blueprint dedupe — confiscation (a) + TOCTOU guard (b)

• (a) Confiscation (Rj-signed player-data mutation): a one-time cleanup removed known-recipe blueprints — legacy pre-v0.64.3 pack drops of recipes the owner already knows, which had no use (learning consumed the copy; no re-learn path). 10 stacks / 31 copies across 5 of 17 accounts, per-account before/after read back (all → empty); knownRecipes untouched. Logged in decisions.md.
• (b) TOCTOU guard: the exclude set (known/held → never drops) is built from a pre-transaction read, so two concurrent opens could both mint the same unheld blueprint and each $inc it → count 2. The mint is now written idempotently — $set = 1, not $inc — inside the same atomic, points-guarded findOneAndUpdate, so concurrent mints converge to 1 and "one blueprint per recipe" becomes a structural invariant. Points/gems/punch writes unchanged (disjoint fields).
• Security-reviewed CORRECT + SAFE (mandatory money-path review): closes the race, enforces the invariant, doesn't weaken the points guard, no destructive regression. New route test (case 6) locks the $set/$inc coexistence (blueprint → 1 and points deducted in one txn). Post-fix census: 0 blueprint counts ≥ 2 anywhere. Full suite green.

#2 · Uniques & passives — kind chip + real number + localized

• Every unique/passive line now shows an honest kind chip — Active (engine mechanic), Passive (always-on stat), Dormant (not yet wired) — its real number, and Spanish.
• Wired (12) pull their numbers from UNIQUE_PARAMS as ICU args (single source — a balance edit updates the text): Quake → "heavy hits ≥23% max HP stun". Flavor (13) pull from the item's identity affix: Unyielding → Passive · "flat damage reduction: 5%" (was "minor"). Dormant (2) → Dormant.
• New uniques i18n namespace (en/es parity). Unique names are translated (Rj: mechanic/effect names are world-concepts → ES; item/race/brand names stay EN): Quake→Temblor, Unyielding→Inquebrantable, Windrun→Paso del Viento, +24 more. UniqueView gains key/params/flavorAffix (single source).

Auras — numbered + localized + translated names

• The 8 stance blurbs state their real magnitudes (Carnage → "+26% physical damage") and are localized; stance names translated (Carnage→Carnicería, Ironhide→Piel de Hierro, …). A drift-guard test locks every blurb's numbers to its mods. The scouting sheet shows the aura name + kind (localized).

Centerpiece — the gear soft-cap, made visible (nominal → effective)

• The gear diminishing-returns knee (crit >15% ×0.5, evasion >30 ×0.5, critDmg) is correct and unchanged — but it was invisible ("why does my crit only move a fraction?"). The resolver now exposes the nominal (pre-knee) gear sum (ResolvedStats.gearNominal) as the single source.
• Scouting sheet: a diminished crit/evasion reads "19% (de 24%)" + an InspectTip explaining the cap.
• Equip delta chips: swapping gear whose crit/evasion crosses the knee shows the effective delta (headline) + the muted nominal + a tip — the "why only a fraction?" moment at gear-choice time.
• gearDrEffective / gearDrEffectiveDelta read the SAME GEAR_DR/gearStackDR the engine uses. The account-level cube socket flow is intentionally not wired (needs a character build context).

#3 · The last vague numbers

• Enhance intro now states "+2 stat/level on a weapon, +1 on a ring, +12 max HP on armor"; the shieldbash breakpoint states "about once every 12 ticks". (Item affixes + gems were already fully numeric.)

Zero balance numbers changed. Full suite green (1147 route + 76 UI). i18n en/es parity; new gates hold.

Forge +N — surface #3 (roster/profile gear) + the last builders (transparency #4)

• DB truth first: the equipped Worldbreaker is enhanceLevel=10 both live and frozen in the active snapshot — so the +10 is real, and any surface showing the bare name is a genuine bug.
• Root cause of surface #3 (the roster/profile ChampionCard gear thumbnail + its hover ItemCard — the surface Rj screenshotted): NOT the render. rosterEquippedItems() in src/server/leaderboard.ts (the server DTO that feeds ChampionCard's slot items) dropped enhanceLevel from its .select(), its RosterSlotItem type, and the built object — so the slot title + hover card showed the bare name. Now carried end-to-end.
• The exhaustive grep (server DTO builders included this time, not just render sites) also caught the mill grid (MillItem + its page DTO) and the test-bench gear panel (BenchEquipSlot + its page DTO). All 12 item-name render/builder sites now carry enhanceLevel; the rest are non-items or catalog defs (+0) or fresh pack drops (+0).
• New cross-surface fixture test walks the shared ItemCard render and the ChampionCard slot title with an enhanced fixture — the "everywhere" claim is now test-locked, not asserted. Full suite green (1131 route + 81 UI).

Forge +N — the full grep sweep (transparency #4, closed)

• v0.79.1 fixed the three surfaces from the report; the full grep sweep then found four more item-name renders still showing the bare name: the store "eligible gear" skin-target card (_skin-targets.tsx + SkinTargetItem/eligibleSkinTargets now carry enhanceLevel), the Forge/Improve panel header (ImproveItem gains enhanceLevel, cube passes it), the /items inspector drawer header (its content was already wired — only the title bar wasn't), and the cube caller that builds the Improve panel.
• All nine item-name render sites now go through itemDisplayName(). The remaining .name renders are non-items (class / race / recipe / champion / cosmetic) or catalog defs (templates, always +0). The "everywhere" claim is now grep-backed, not memory-enumerated — the sweep is the gate, and it now precedes the tag.

Forge +N — the surfaces v0.79.0 missed (transparency #4, completed)

• v0.79.0 announced the +N as item identity but the "everywhere" claim was enumerated from memory, not a grep sweep — so three surfaces still rendered the bare name: the character equip-slot panel (the exact screenshot Rj sent — "Worldbreaker" with no +10), the /items grid card, and the cube titles. The shared ItemCard render was correct; the bug was upstream DTO mappers dropping `enhanceLevel` before it reached the card (surface/DTO gap).
• Fix threads enhanceLevel through every mapper: the character page inventory DTO → InventoryCard → toCardItem; the /items ItemEntry → card; the cube already carried it on CubeItem, and its five item-title renders now go through itemDisplayName(). Recipe titles are left alone (a recipe is not an item).
• New test (item-card-enhance.test.tsx) locks the single source (itemDisplayName) and the shared render with an enhanced fixture, so a forged item reads "Worldbreaker +10" wherever its name appears. Full suite green (1131 route + 79 UI). Process: surface enumeration is by grep, never by memory (banked lesson).

Leaderboard — per-account AND per-champion (PRO alts semantics, Rj signed)

• The board now offers both views via a By account / By champion toggle. rankedChampions() lists every PvP-ready champion its own row (alts included, same activeSnapshotId gate — no NPCs/stubs), beside the existing rankedAccounts() (top champion per owner). ?mode=champion + mode-aware subtitle/bottom-bar ("Champions ranked"). Shared resolveOwners(); the viewer pin resolves their top champion in champion mode. i18n en/es (parity, tuteo).

Forge +N is visible — item identity (transparency #4)

• A forged item now shows its level in its name — "Worldbreaker +10" — on the item card, champion card, combatant sheet, and inspector, via a single itemDisplayName() source (supersedes the card-only "+N" badge). The snapshot freezes enhanceLevel (presentation only, like defId; the engine reads the frozen affixes) so replays/scouting show it too — determinism byte-identical (34/34). Old snapshots degrade gracefully to the plain name.

• Catalog level requirement is now a chip. It read as plain grey text while rarity, slot and "not owned" were all badges — now it matches, as a muted chip.

• Disabled buttons now look disabled. A greyed, flat treatment replaces the old dimmed-blue, so an unavailable action (the mill "MILL" with nothing selected, an unaffordable "Comprar") no longer reads as a live button. Loading (pending) buttons keep their color + spinner — only genuine disabled greys.
• BP packs in Spanish: the purchasable Battle-Point packs now read "300 / 800 / 1400 Puntos de batalla" (the "BP" abbreviation stays elsewhere).

• ES glossary consistency. In Spanish, the store + supplies screens showed English resource names (Punch/Dust/Essence/Engrave Punch/Battle Points) while the cube/mill used the real glossary (Polvo/Esencia/Punzón) — a contradiction on the same money-adjacent screen. Store/supplies now use Polvo / Esencia / Punzón / Puntos de batalla consistently. The "BP" abbreviation is unchanged.
• pvp "seen across champions" used a literal (es) plural hack → now a proper plural ("4 campeones" / "1 campeón").
• Profile / Settings tabs were hardcoded English → now translate (Perfil / Ajustes).

• Scroll affordance on the store tabs + the cube/materials bar. Both already scrolled sideways on mobile (7 store tabs, the 6 material counters), but with no hint — so a trailing item ("Battle Points" tab, a "PUNCH 772" count) looked hard-cut instead of swipeable. Added the right-edge fade the code always intended, so it now reads as "swipe for more →". Desktop unchanged (everything fits).

• The whole game stopped fitting on phones (root cause). Every logged-in page could be swiped sideways, and iOS reacted by zooming the layout out (content floated in the top, a dead right gutter). Cause: the top bar's active-champion pod showed its booster detail ("1.5× · 15d 23h left") on mobile — the widest piece — and the bar couldn't shrink, pushing past the screen. Fixed: the booster detail now hides on narrow screens (still one tap away in the popover), and the app frame clips any stray horizontal overflow as a safety net. Pages fit; no more sideways swipe.

• Leaderboard: names now read ~10 characters on narrow phones. The gear-sprite thumbnail (pure decoration on a ranking) is hidden below sm, giving the name cell back ~44px; the player's avatar-badge and every column stay, and the sprite returns on wider screens.

• Leaderboard (P0): player names no longer vanish on narrow phones. At 360px the fixed rating/record/streak columns + gaps overflowed the row, starving the name cell to zero width. Now the gap/padding tighten and those columns narrow below sm, so the name always keeps ~10 readable characters (truncating gracefully); desktop is unchanged.
• Cube (trust): removed a dev-hint block from the cube header that leaked an internal endpoint into player copy ("read state via /api/cube") and was redundant.

Pre-fight NPC voices (PRO-103)

• Ladder opponents now greet you with a voice before the fight — on the /battle "preparing fight" beat: a race clause (Ironpaw / Shadewing / Starborn) handing off to a class×tier line that fits the opponent's kind and how far up the Ladder they've climbed (T1 green → T7 legend).
• New i18n namespace `voices` (messages/{en,es}/voices.json, 31/31 parity): 3 race clauses + 28 class×tier lines → 84 composed voices, mirroring the npc-snapshots.ts name formula — add a race or class later and it's 3 or 7 new fragments, not 84.
• Component `components/game/foe-voice.tsx` (FoeVoice) — race clause (accent) + line (italic), [data-npc-voice] probe hook, extracted so it's unit-tested without the heavy battle client.
• Ladder-NPC only (guarded twice): the call site gates on mode==='pve' && opponentTier>=1, and the component .has-guards both keys — story bosses (tier 0) and casual-PvP humans stay voiceless.
• Surface = B+C (Rj's verdict on the mockup): the ladder card stays lean; the full voice lives only on the pre-fight beat, where a whole taunt lands (the clamp truncated the T7 payoffs on a card).

• Poison Blade (Rogue) now scales with magic, not physical — the DoT re-tags ['physical'] → ['magic'] (base 4, spMult off). For the typical DEX rogue (≈0 %magic gear) this is a small, measured, tank-safe trim: the poison lands a flatter ~4/tick instead of scaling up off physical power. The direct hit is unchanged. See docs/pro-110-econ-table.md.
• Bleed's skill-point multiplier (spMult) was measured and deferred — it re-opens the tank-melt and needs its own mitigation pass; not shipped here.
• Determinism contract intact (496 domain tests green; same seed → byte-identical duel).

Legendary flavor lines (PRO-102)

• All 30 named legendaries now show a one-line flavor quote on their card — a subtle italic line at the bottom of the full card, below the mechanical unique block. It says a little of the world (the Greatwork, the First Casting, the Anvil-Peace, the three races) and makes no mechanic claim — the stats and the unique effect are unchanged.
• New i18n namespace `itemLore` (messages/{en,es}/itemLore.json, 30/30 key parity), keyed by defId; the ItemCard resolves the line in the active locale via [data-item-lore].
• Names stay English (proper nouns); the flavor prose is localized, world-concept nouns following the signed naming rule (la Gran Obra, la Primera Colada, el Eco, lo Sin Templar…).
• Compact tiles (/items, /catalog grids) drop the line — it's inspector-depth flavor; the full card (/mill, /cube, /kit, pack-open) shows it.
• Co-signed Rj + Fable (all 30, incl. the 7 canon-inference lines + race-neutral Heartseeker).

Public site + world-lore localized to Spanish (PRO-109)

• The /site landing and its world-lore section (the Greatwork, the three races, Cube/Forge/Ladder, the Guardians, Khargrim) now render in Spanish for Spanish visitors — via next-intl (a new site message namespace, EN+ES, 51/51 key parity). English stays canonical.
• Locale on the site host: the proxy now sets NEXT_LOCALE in the site branch too (from ?lang= or a Spanish-top Accept-Language), so the first render is already ES — no en→es flash. The site host has no auth cookie, so this is the only locale source there.
• The /site, /releases, /privacy, /terms pages dropped force-static → per-locale dynamic (still SSR + crawlable; outputFileTracingIncludes bundles the fs-read release/legal markdown).
• SEO: hreflang alternates (?lang=en / ?lang=es / x-default) + per-locale <html lang>.
• The hero CTA is now localized: "Jugar la beta" / "Volver al juego" (the ?from=game logic unchanged).
• Proper nouns: Duelsmith, race names, Guardian names (Thrunn, Ghuram), Khargrim stay English in both locales. World-concept nouns follow the Rj-signed ES prose (la Gran Obra, el Cubo, la Forja, la Escalera, la Paz del Yunque, el Eco…).

UX: the world/lore is reachable from the cockpit

• Added an "El mundo" item to the cockpit avatar menu → the public site's world/lore section (the app host 404s /site, so it crosses to the WWW host). It carries ?from=game.
• The /site hero CTA now reads that flag: a logged-in visitor (arriving from the game) sees "Volver al juego" → back to the app; an organic/logged-out visitor still sees "Play the beta". Done client-side because the WWW host has no session cookie (app-host-only) — no cross-host auth needed.
• /site + the landing remain public for both auth states; /roadmap + /leaderboard stay cockpit pages (unchanged). Browser-gated both states.

DDRO → Duelsmith — the name flip

• The game is now Duelsmith. Every living surface flipped: the landing + /site wordmark & titles, the in-game header/loading wordmark, admin header, the roadmap, all player-facing i18n copy (EN + ES), email/notification sender name, the Discord release post ("Duelsmith vX"), package.json, README, and the project docs' current-state text. OG/meta titles now read Duelsmith.
• Deliberately NOT flipped (yet): the domain (*.fibonaxis.dev, the ddro.io email host) and Kinde/OAuth callback URLs — those ride the domain cutover, not this rename (renaming a display string ≠ changing a URL). And stable internal identifiers stay: the PRO- ticket prefix + DDRO-DEV-* incident ids. History (past release notes, decisions, transcripts) is preserved as written.
• Executed ahead of the production cutover (supersedes "the rename rides the cutover as one beat"). Census: ~497 repo-wide "DDRO" hits, ~271 historical-keep. typecheck + build green.

DoT stat-scaling (PRO-85)

• Poisons and bleeds now scale with your build instead of a flat number that decayed to nothing at high levels. A DoT's per-tick damage runs through the same effectMagnitude tag pipeline as direct damage, frozen at the moment it lands (deterministic, mirrors the Runebite unique), so more %physical on your build → a bigger poison/bleed. Early game is unchanged; endgame poison goes 5→7/t, bleed 6→8/t.
• Kept simple + honest: DoT ticks are true damage (they bypass armor — the anti-tank identity) and never crit (crit is burst; DoT is attrition). Signed coefficients are balance-neutral (a +1–3pp field shift) — this restores the DoT pillar without power-creep. Runebite stays on its own hit-fraction model.
• Determinism preserved (34/34 — builds without a scaled DoT are byte-identical). The skill card already reads the scaled numbers. Full measurement + sign-off: docs/pro-85-econ-table.md.

The world arrives (PRO-106 — first lore ship)

• Character create — lore, not just numbers. The class and race cards now lead with flavor written from the lore bible (EN + ES) instead of a functional one-liner: who the Tharûm/Sylphar/ Aeshtar are and how they fight, and what each class feels like — while the mechanical chips (affinity, passive, HP/speed) stay. The selected class also previews its Level 10 branches (e.g. Juggernaut / Warden) so the "the build deepens later" promise shows at creation.
• Public site — a world to read. The /site landing gains a lore section: the Greatwork and the Anvil-Peace, the three races, the Cube / Forge / Ladder as institutions, the Gallery of the 84 and its Guardians (as legend), and the Season 1 boss Khargrim, the Unbent. SEO-aware (semantic headings + updated metadata around "RPG of builds / asynchronous PvP"). EN-only for now — the whole site isn't localized yet (ES site is a follow-up).
• Canon notes: the Guardians are site legend, not fightable NPCs (a real per-tier gatekeeper mode is preserved as a future proposal). The game name stays DDRO here — the Duelsmith rename flips at the production cutover, not in this build.

Desktop section landings reworked (PRO-88)

• Composition (Tier 1). The Arena/Stash/Lab landing cards no longer stretch across a wide 3-column row (chevron stranded far right, empty trailing cells). Desktop now caps them to a 2-column column (`max-w-3xl`) — tighter cards, chevrons close, Stash/Arena empty cells gone. Mobile and tablet are untouched (the change is lg-only).
• Live stat strips (Tier 2). Each landing gains a desktop-only stat strip under the header, giving the page a reason to exist beside the sidebar and filling the space that used to be empty: - Arena — ladder rank + rating (active champion / account placement) - Stash — dust + essence + owned item count - Lab — unspent skill points + configured plan rules Strips are fail-soft (no session / no champion / any error → the strip simply doesn't render).
• Market IA. With Packs + Supplies folded into the Store tabs, the Market landing was a dead page. /market now redirects — store flag on → the unified store, off → the roster home. The empty landing is gone; Market needs no stat strip.
• Bug fix (shipped early in v0.71.2). The Stash landing's Catalog card showed a raw i18n key; added the missing description + removed two orphan keys.

Stash landing: Catalog description (PRO-88 bug)

• The Stash section landing showed the raw key `shell.sections.desc.catalog` under the Catalog card — the entry was added to the section but its description string never was, in either locale. Added it (EN "Browse every item in the game." / ES "Explora todos los objetos del juego.") and removed two orphan sections.desc keys (packs, supplies) left dead when the Store IA folded them into the Store tabs. Messages-only; no code touched. The desktop composition rework (2-col + live stat strips, PRO-88) ships next as a minor.

Combatant scouting card shows item names (STEP 4 · PRO-56)

• The battle/replay scouting card (hover a combatant on /battle, or tap its ⓘ) used to label each gear row with the slot ("Weapon", "Chest"). It now shows the item's name, resolved from the snapshot's frozen equipped[].defId (present since 24 Jul) via defById. Legacy snapshots without a defId keep the slot label as a fallback, so nothing regresses.
• Data-only change — same layout, same affix line beneath. No new copy (item names are English proper nouns). Retires the PRO-56 "combatant-sheet item names are impossible" note, which went stale when the snapshot gained defId.

Store catalog EUR → USD (STEP 1)

• All 26 EUR SKUs migrated to USD at the same numeric amount (€1.99→$1.99, etc.) — a same-number unification with the BP bundles (already USD), not an FX conversion. Mechanism: a new USD Stripe price + transfer_lookup_key per SKU (the app resolves prices by lookup_key at runtime, so no app change was needed). Ran stripe:seed --apply on the test sandbox; read-back confirms all 29 ddro_<sku> resolve to USD. Real pricing tuning stays PRO-44.
• Fixed two hardcoded €1.99 copy strings — the skin Unlock CTA now shows the real Stripe price; currency is sourced from the price (USD), never the locale. Security-reviewed clean (guard un-bypassable, lookup_key transfer atomic, checkout resolves live server-side).

🎲 Random name on character-create (PRO-90 / FR11a)

• A dice button beside the champion-name field fills a race-flavored generated name — Tharûm reads heavy/guttural, Sylphar flowing, Aeshtar vowel-rich (neutral fallback when no race). Click to re-roll.
• Every candidate is pre-screened through the exact create allow-list (screenName + non-empty + ≤24 chars), so a re-roll can never propose a name the create form would reject. Pure client, no engine, no assets. A domain test locks the invariant (20k generations, 0 rejected).

i18n Phase C — the remaining English-in-both-locales surfaces (PRO-76)

• Localized: the unauth landing splash (new landing namespace, Rj's es voice), the notification-bell rows/actions/header/empty state (found still-hardcoded despite a stale "already done" note), the always-on chrome fringe (gear-nudge, nav-active-champion, champions-rail titles), the store content layer (CARD_COPY/COMBO_COPY/PACK_COPY/booster disclosure + cosmetic blurbs), slot/rarity labels, and status names + composed chips (BP/essence/daily-reward). 133 new keys, en/es 100% key + ICU-placeholder parity.
• Bug fixed: formatPrice hardcoded Intl.NumberFormat('en', …) → now locale-aware (ES shows 2,99 €, not €2.99). Engine ids stay English; only rendered labels localize via label maps.
• Out of scope (unchanged, by design): /kit (Spanish-on-purpose norm); essence_refund/skin_refund notification rows (pre-approved Spanish-direct). Fast follow-ups noted: item.subtype labels + the 'MAX' XP-bar string.

Analytics hygiene (player-invisible, rides along)

• PRO-65: server-side $feature_flag_called now carries the env super-property (was landing in env = unset, unfilterable). PRO-66: rivalry events unified to the rivalry_ prefix (nemesis_detected/rival_overtake_notified renamed) — an analytics break (historical events keep old names; insights filtering the old names need updating).

Per-character avatars (v1)

• Upload a custom face per champion (JPG/PNG/WebP, ≤2 MB) from the character page. The server sniff-validates the bytes (never trusts the client MIME), re-encodes + strips EXIF/GPS, caps input pixels, and routes it through the pre-moderation queue (3-strike lockout, upload rate-limit). Once a moderator approves it, it renders on character surfaces + PvP opponent rows + replay headers; with no image, the champion keeps its procedural crest (the fallback). A wear toggle switches crest ↔ custom per champion.
• Coexists with the account avatar (unchanged, still on profile + top-bar). Character avatar wins on character surfaces; the account avatar is the player's identity, not an intermediate fallback.
• character_avatar report kind (defender-side on PvP/replay); admin takedown reverts to the crest + strikes the account. Leaderboard rows keep the equipped-gear sprite (the gear/skin showcase).
• Determinism untouched (presentation + routes only). Backend + the live-route security hardening (sharp lazy, limitInputPixels, upload rate-limit) shipped ahead of this; a partial-unique index closes the one-pending-per-champion race.

Opponent cards, redesigned (ladder + PvP)

• Names never truncate — they wrap to a full second line (card grows, the grid absorbs it); a single over-long token steps the font down one notch rather than ellipsizing.
• Level at a glance — the old level band folds into one LV chip with a 4-step color-coded delta symbol (▼▼ much-lower / ▼ lower / ● even / ▲ higher) + the exact level, words in the tooltip.
• Rival = gold border + corner ⚔. Report = a quiet ⚑ icon (on PvP player cards; ladder NPCs have no reportable target). Shared primitives (opponent-card.tsx) applied to all three render sites — ladder tier grid, PvP ranked matrix, PvP direct-duel roster.

New cube station — Forge (item enhancement +1..+10)

• Enhance an item from +1 to +10. +1..+4 is one free, guaranteed action; +5..+10 each attempt rolls on the locked success/break table (85/70/55/40/25/10% success) — an unprotected break permanently destroys the item. Protect a +5..+8 attempt with essence (30/75/150/300) so a break leaves the item at its current level instead; +9/+10 are unprotectable.
• Power (SIGNED C-flat): weapon +2·N flat archetype primary (STR/DEX/INT by reqStat), armor +12·N flat maxHP, ring +1·N flat primary — all gear:true (doubly-curbed via GEAR_PRIMARY_DR + soft-cap), additive, derived at resolve from a single enhanceLevel, never baked into frozen affixes. Measured full-field @+10 compresses the T7 lane (30.1→26.0pp) — no class climbs past its lane.
• PvP integrity: enhanceLevel is captured in the async-PvP snapshot at freeze time (no post-snapshot drift). runDuel determinism unchanged (level 0 → no mods; Math.random for the roll, never the engine RNG).
• Unequipped-only, mirroring reforge/socket/mill (a break can't yank equipped gear out of a build).
• Consent-safe: an expectedFrom optimistic-concurrency guard means a request only ever executes the action it was authored against — a double-submit/retry on the free "+4" can never silently escalate into a destructive +5 (security review HIGH, fixed + re-reviewed clean). Every attempt writes a ForgeAudit row.

New cube recipe — Random gem

• Feed 3 gems (any family, any rarity — legendary is not accepted as input) and get back 1 random gem: 65% common / 30% magic / 5% epic, never legendary. Fusion stays the only path to a legendary, so this recipe can't shortcut it. Multi-select input on the Gems tab; the craft debits atomically and the result lands in the cube.
• Hardening: lookupGem now uses an own-property check so prototype keys (__proto__, …) resolve to null across every cube route (security review). The random-gem route's post-commit telemetry tail (track + quest tick) is wrapped so a telemetry hiccup can never 500 an already-committed craft.

Blueprints no longer drop as duplicates

• A blueprint for a recipe you already know (or already hold a copy of) will never drop again. When a pack's blueprint slot lands, it rerolls to a blueprint you don't have; once you own them all, the slot yields nothing (as if blueprints weren't in the pool). The pack's item slots and the 3% blueprint chance are unchanged — item rarity is untouched (measured: no skew). Existing duplicate blueprints are kept (still millable; the ×N badge keeps them tidy) — no confiscation.

Ladder + PvP — compact opponent cards

• The ladder and PvP opponent cards adopt the compact "short card" treatment: smaller crest (48→40) and a denser grid (ladder 3-up on desktop; PvP 3-up on wide screens), so more opponents fit per row with less scrolling. Same info, less width.

Cube — blueprint count badge

• Duplicate blueprints in the cube's recipes tab now show a proper ×N count badge (hidden at a single copy) instead of inline text — the owned-duplicate grouping already existed; this surfaces it cleanly.

Fix — bound skins no longer strand on item destruction

• Milling or crafting away an item that had a skin bound to it used to leave the skin orphaned (a dangling reference — a "paid content burns" doctrine violation). Now the skin auto-unbinds back to you as a free, unbound unit in the same transaction, before the item is destroyed (the item-specific custom name dies with the item, as designed). Wired into mill, cube-craft, and cube-experiment via a shared unbindSkinsForDeletedItems helper, with an item_skin_auto_unbound audit event so a support ticket is answerable with evidence. Security-reviewed (no leak, cross-user unbind impossible, transaction rolls the unbind back if the destroy aborts); locked by a 7-test suite.

Shareable replays (public read-only)

• Every fight replay now has a Share button that copies a public link — anyone can watch it logged-out, no account needed (each shared fight is an ad for the game). A public viewer sees only the two builds, the reel, names and cosmetics — a neutral "<name> wins", and a "make your own" CTA. All owner-only data (your rating/points, opponent ids, report/rematch) is stripped, and the tactical plan is redacted for non-participants (the reel's played-out actions are all a spectator sees — the hidden strategy stays yours). Hardening: the deterministic reel is memoized per duel id and the anonymous surfaces are per-IP rate-limited, so public-by-id can't be walked as a compute amplifier.

No more spoilers

• Fight-result toasts that announced Victory/Defeat before the replay played are gone. The reel's end seal is now the only reveal.

Ladder — history sidebar

• The single-slot "Last engagement" panel is replaced by a History drawer: recent PvE engagements (opponent, result, replay link, rematch) in one place. The ladder roster is now a clean single column.

Items & Catalog — compact cards

• /items and /catalog adopt the compact card + a denser 3–4-up grid (more per row, less scrolling). Full item detail (sockets, unique, budget) is one tap away in the inspector. The filter bar is unchanged.

Balance — Quake re-tune (Earthshaker), SIGNED

• Quake now stuns only on a genuinely heavy hit — damage ≥ 23% of the target's max HP — instead of on any crit. It was overtuned on tank builds (long attrition fights amplify a skipped action): measured +12pp on the tank bearer vs its intended ~+3–5pp. Now mid-band (+4–5pp), and capped per fight so it can never stun-lock. Crits still help indirectly (bigger hits clear the threshold). The Earthshaker + Sentinel tank compound drops from +14pp to +6–7pp. Deterministic; seeded replays stay byte-identical for non-unique gear. _(Sentinel + Scaled Hide re-measured on the same pass — both hold in the +4–6 band.)_

Fix — catalog unowned treatment

• Unowned items in the Catalog now show the real card — icon, name and stats — greyed out with a "Not owned" badge, instead of a ??? silhouette. Owned items stay full-color. You can see exactly what each item does before you have it; search and filters work the same on every card.

Fix / UX — store + items IA

• One store, tabs: Packs (€), Gear (open packs with BP), Supplies (BP reagents + exchange), Battle Points, Cosmetics and Item skins are now tabs in the store. Every card shows its currency — a BP chip vs a € price. /pack and /market/supplies redirect into the tabs.
• Pack opening in a modal: open 1 / 5 / 10 at once — 1× keeps the beat reveal, 5×/10× show a consolidated summary grid ordered by rarity. Atomic all-or-nothing charge (no partial opens); odds unchanged.
• Items in two pages: Your items (owned) and Catalog (every item in the game — unowned shown as darkened silhouettes, a collection to complete). Both use the same filter bar as the cube.

Balance — dormant uniques, Batch 3 (SIGNED)

• Grimoire of the Abyss — Abyssal: spells execute harder once the foe is at low HP (+4.0pp, mage).
• Dragonscale — Scaled Hide: reduces incoming fire damage (tight, +3.5pp warrior).
• Held for redesign (not shipped): Reaver (Bloodthirst) + Staff of the Deep (Deep Well) — their on-kill effect is inert in 1v1, so their cards stay dormant until a redesigned mechanic is signed (honesty contract).

Balance — dormant uniques, Batch 2 (SIGNED)

• Windrunner — Windrun: each successful dodge stacks attack speed; chain evades to hit faster (+5.4pp, rogue).
• Archmage Robe — Archmage: spell skills cost 20% less resource — sustain the rotation (+4.4pp, mage).
• Sentinel Mail — Sentinel (Bulwark ramp): incoming damage falls the longer the fight runs (tight, +2.9pp warrior — warrior-adjacent starts conservative).
• All deterministic (seeded replays stay byte-identical for non-unique gear); cards auto-flip latent→live.

Fix — control alignment

• Buttons and chips that share a row now share height and baseline. Fixed at the primitive level (a shared control-chip height): the replay playback controls (▶ Play / ⟳ Reset) now match the Rematch / speed chips beside them, and the cube reagent strip (Dust / Essence / Punch / BP + "Buy 1 punch") lines up. Browser-gated so mixed-height rows can't creep back.

Balance — dormant uniques, Batch 1 (SIGNED, Fable)

• Void Rod — Void Surge is now live: every 3rd landed spell erupts with +12% bonus fire damage on that hit (own breakdown line). Caster lever; +5.6pp for the mage in the harness panel (mid-band, in line with the existing wired uniques).
• Earthshaker — Quake is now live: a heavy hit (a crit, or damage ≥ 18% of the target's max HP) staggers the foe — they skip their next action. ICD-gated (can't stun-lock). Deliberately the tightest warrior legendary in the set (+3.4pp) — the warrior field already dominates, so the numbers start conservative.
• Both are deterministic (seeded replays stay byte-identical for non-unique gear) and their item cards flip from "latent" to live automatically.

_Signed condition (Fable): the field harness doesn't equip these player-only levers, so the true compound warrior effect is re-measured under PRO-95 (~5 Aug) with Batch-1 live — that gates any warrior-adjacent Batch-2 numbers (Sentinel especially)._

Fix — fight-end actions (the replay surface)

• Rematch now sits in the playback controls on the REPLAY screen as well, beside ▶ Replay / ⟳ Reset — not in a separate bar below the fight. The last three fixes only touched the manual battle screen; the async replay screen rendered its own separate rematch bar, so on the screen Rj was actually testing nothing had moved. Both screens now use one shared component, and the browser gate loads BOTH so this can't split again.

Fix — fight-end actions placement

• Rematch now lives in the fight's playback control row, right beside ▶ Replay / ⟳ Reset (same chip size), with Choose another as the secondary next to it. Replaces the sticky footer from v0.59.2 — the actions render in exactly one place now, in both the fight modal and the full-page fight. The browser gate asserts Rematch sits adjacent to the Reset control.

Fix — fight-end actions

• Rematch / Choose-another are now pinned in a sticky footer at the bottom of the fight modal, always inside the viewport at fight end — no scrolling on any screen. The previous fix placed them atop the result card, but the card scrolls with the modal body, so on shorter viewports they still fell below the fold. A new browser gate asserts the button's box is fully in view after scrolling the body to the bottom (desktop + phone), and is proven to fail on the old layout — so this can't regress silently a third time.

Fix — art gap

• 10 wave-1 items now show their own icon instead of the generic glyph: the bows (Shortbow, Hunting Bow, Hawkeye Longbow), the legendaries Nightsedge and Oathkeeper, plus Censer of Calm, Initiate's Shawl, Gambler's Loop, Executioner's Band, and Spirit Loop. (Curated icon set 103 → 113.) A CI guard now fails the build if any future item ships without an icon, so this can't silently recur.

Gem fusion (signed, Rj 2 Aug)

• Fuse duplicate gems up a rarity. 3 common → 1 magic, 6 magic → 1 epic, 9 epic → 1 legendary — same family in/out. No cost. A per-gem "Fuse ×N" action appears in the cube Gems tab when you hold enough of a family. The epic-dupe sink that was missing; harness-validated as a slow lane (fused legendaries ~1/95 packs vs dropped ~1/103), not a faucet. Atomic (conditional-debit guarantee, concurrency-tested).

Store — skins section v2

• The store now lists every skin look. Instead of just two theme cards, each theme (Ember, Frost) shows all its looks by item type (Weapons / Armor), so you can see what your epic & legendary gear could wear. Buying is unchanged: one purchase per theme, bind it to an item. (The QoL store tab is now labeled "Quality of Life".)

Store — sectioned redesign

• The store is now sectioned (tabs: Packs · Battle Points · Cosmetics · Item skins · QoL) instead of one long scroll — Packs as hero cards, everything else as compact grids. Purely presentational; no pricing/SKU/checkout change. (ES QoL tab = "Extras".)

Mill — fast again

• The mill loads in ~1.8s instead of hanging. A full stash (measured 3,519 items) used to render every card at once with framer-motion layout animations → the page jammed the main thread and "took ages" (never reached idle). Fixed in three layers: dropped the layout/stagger animation, lazy-load item icons (80+ eager requests → the visible few), and window-virtualized the grid (83,745 DOM nodes → ~960). Smooth scroll now.

Fights — smoother close + prominent end actions

• Closing a fight/replay no longer feels like a page reload. The modal close was doing an unconditional refresh that intermittently forced a full hard navigation; now it's a soft dismiss (state preserved), refreshing the underlying page only when a fight actually resolved.
• Rematch is front-and-centre at fight end. The end actions (Rematch · Choose another) now sit at the top of the result card, at the victory/defeat moment — always in view, no scrolling.

Packs — a better reveal

• Gems, recipes, and materials are part of the reveal now, not dumped at the end. A pack opens as building beats: gear worst→best (the best piece lands last), then a reagents beat (engrave punch + gems), then the recipe blueprint as the finale. The summary matches the reveal order. Odds unchanged.

Fix (P0)

• `/items`, `/replay/[id]`, and the battle modal 500'd on the live deploy after v0.57.0. The on-demand forge's image-measurement used sharp (native libvips), and it was statically reachable from those page loaders (server/forge.ts → skinForgeState / forgedOverlayForKeys), so Vercel's linux-x64 runtime failed to load the native binary and the pages errored. Fixed: sharp is now a lazy import used only on the forge generation path (cron/manual), and Next is told to load it natively (serverExternalPackages). Added a regression guard that fails CI if sharp ever re-enters a request-reachable import chain (same class as client/server bundle poisoning).

Item skins — "Aspectos" (new, player-visible)

• Apply a cosmetic Aspect to an epic or legendary item. Two themes at launch — Ember (molten) and Frost (icy) — restyle a weapon or armor piece's look in battle. Pure cosmetic: zero stats. One aspect per item; bind-only and never in packs (the published pack odds are untouched). Priced €1.99 in the catalog; the store is TEST MODE at launch (test cards only, no real charge) — real-money pricing arrives with sk_live.
• On-demand sprite forge (real generation). A skinned look with no pre-baked sheet is generated on demand: the item card shows "estamos afinando tu aspecto" while it forges, then the real frost/ember sprite renders in fights. First-time generation takes a few minutes; after that it's instant and shared by everyone on that race+class+combo.
• Eligibility is honest: only epic + legendary items can wear an aspect (no upsell nag on commons/magics), and the aspect is removed cleanly if the entitlement is ever revoked.

Internal (no player line)

• Real forge generator (Stage 2). The on-demand forge now calls PixelLab for real (create a gear/skin STATE off the race×class base character → animate the weapon-aware plan → measure → public content-hashed Blob → ForgedVariant), replacing the Stage-1 mock. Resumable, credit-floor gated, auto-accept + post-hoc review. Behind the forge-on-demand flag.
• Atomic forge daily cap (security: closes a concurrent over-spend before real generation pays) and a credit-fallback budget floor (an exhausted subscription pool falls back to the USD wallet instead of halting).

Fix — manual-battle modal scroll

• The manual pilot opened in a modal that didn't scroll on mobile. v0.56.5's layout flex-filled its bounded parent on every viewport; inside the fight modal (a fixed 92vh bottom-sheet) the fight + pinned skill bar overflowed the modal body invisibly, leaving the bottom controls unreachable.
• Fix: the fight column fills only on desktop (where the bounded parent gives it a viewport and only the log scrolls); on mobile the content is natural-height, so the container scrolls (page <main> or the modal body) with the skill bar pinned to the bottom. Verified in the harness: desktop scrollHeight == clientHeight (fills), mobile scrollHeight > clientHeight (scrolls) with the skill bar reachable.

UX — manual-battle layout rebuild

• The fight is now always on screen while you choose a skill. Previously the visual sat below the fold while the skill bar was up — you couldn't see the fight you were steering. - Desktop: a fixed left skill rail beside an always-visible fight viewport (combatants + HP/resource bars + the sprite stage). Only the log scrolls — no page scroll to act. - Mobile: the fight on top, the skill bar pinned to the bottom, the log scrolling between.
• No more Log | Visual tab. The sprite stage renders unconditionally — the same shared paper-doll pipeline the replay uses, so equipped gear shows today and skins render automatically when the skins flag ships (the flag gates buying, not seeing). The vestigial fight-sprites seeing-gate is retired; the dead tab component + presentation pref are removed.
• Gated both viewports in a real browser (Playwright: the sprite stage and a focused skill button are proven on-screen together), with before/after screenshots on the record.

UX — cube Recipes tab

• Known recipes now open in a Drawer. Recipes render as compact tiles; tapping one opens a Drawer with the full detail + craft (ingredients, cost, Craft button) — matching /items, Improve, and Gems. Locked recipes stay as inline silhouette hints.

Fix — cube Gems tab

• Selecting an item in the Gems tab now opens a Drawer with its sockets (socket a gem, open a socket, remove a gem), matching /items and Improve. It used to render the socket panel inline — which read as "the drawer doesn't open." Browser-gated (Playwright, desktop + touch).

Fix — PRO-94 landed on the wrong surface

• Rematch now lives inside the fight modal. The "Rematch / Pick another" buttons rendered on the ladder page behind the intercepted fight/replay modal, so you had to close the modal to re-fight. They now sit at the end of the fight in the modal: Rematch re-runs a fight vs the same opponent right there (every gate — stamina/start-token — re-checks server-side), and Pick another closes back to the opponent list. Applies to ladder NPC fights and ranked PvP attacks (the shared replay modal). Browser-gated (Playwright, desktop + touch).

UX — cube tab collapse

• The cube is now three tabs: Improve · Gems · Recipes. The Sockets and Reforge tabs are gone — every per-item action they offered (open a socket with its odds, reforge base/premium with their costs, socket a gem) already surfaces in the Improve drawer via the recommender, each with its cost and odds up front. Nothing was lost, only consolidated. Fewer tabs also means the tab strip can no longer clip on mobile. (Stale ?tab=sockets/reforge links fall back to Improve.)

Content + balance — items-lane wave 1 (signed)

• 10 new item defs — crit-damage rings + Nightsedge · a bow ramp (Shortbow / Hunting Bow / Hawkeye) · an SPR ramp for channelers · Oathkeeper. More ways to build.
• The crit-DAMAGE axis is now real. New Onyx gem family grants critDmg, and crit damage + accuracy are now itemized with proper stat labels — closing the "crit was half-fictional" gap (PRO-92: chance was fixed v0.54.1, damage was un-buildable until now).
• `GEAR_DR.critDmg` knee (K1, signed) — the crit-damage gear-stacking diminisher, mirroring the evasion/crit soft-cap philosophy so the new axis can't spiral.
• Warhammer / Chainmail rebudget + a Chainmail dose tweak (Rj re-signed; no L5 dominance).
• Odds unchanged (on record): this wave does NOT touch pack odds — roll constants untouched, skins are never in packs. The published odds-promise holds with no page edit.

UX — drawer everywhere (Rj override)

• /items inspector opens in a Drawer on desktop AND mobile (the docked panel is gone; the item grid gets the full width).
• Cube "Improve" actions open in a Drawer over the chosen item. (Both use the house Drawer primitive — slide-over on desktop, bottom sheet on mobile.)

Internal (no player line)

• Sprite coverage = generic-fallback flow (Rj call). An item without a bespoke fight-sprite now renders the generic subtype silhouette tinted by rarity (painterFor already resolves LEGENDARY ?? FAMILY(subtype) ?? sword) — unrenderable items are structurally impossible. The weapon-sprites test became "every item resolves to SOME painter" + a bespoke-art debt report (currently: w-nightsedge, w-oathkeeper on the fallback). Bespoke painters are an items-lane upgrade on Rj's visual review; the on-demand forge flow replaces fallbacks with real sprites later.

Fix (combat — manual/auto parity)

• Manual mode no longer blocks a net-neutral skill at low resource. The manual legality gate used the GROSS cost, while the engine resolves an act as res -= cost; res += genOnAct — so a channeler's net-neutral basic (dualstrike: cost 12, genOnAct 12 → net 0) was un-castable manually at low Balance even though the auto-battler cast it. The gate now uses the engine's net cost (affordable = res >= cost - genOnAct, engine.ts legalSkillsFor). Manual/suggestion gate ONLY (runDuel/chooseSkill never touch it) → ranked determinism byte-identical; RELAXES legality only → every stored replay stays valid. Signed Rj + Fable (Option A).

Fixes (bug lane, batches 1–4)

• Ladder no longer dies silently on a gateway hiccup. A duel POST that came back with an empty body (a 5xx/gateway error) used to throw on r.json() and leave the page stuck; it now surfaces a clear error toast (lib/safe-json.ts readJsonSafe; ~23 client mutation handlers hardened).
• Socketed gem damage now shows on the SkillCard too. A residual of the earlier gem-display fix missed the skill card's actor; the sheet build is centralized (lib/sheet-build.ts sheetItemFromCard) so all three sheet surfaces agree.
• Action buttons across the app report server errors instead of failing silently. Observability hardening: rate-limit fail-open, notifications, leaderboard, and the cron digest now report through reportRouteError (PII-free, throttled) instead of swallowing.

No engine/balance change.

Feature — mobile inspection & socketing (UX panel audit, Scope A)

• New Drawer primitive (components/ui/drawer.tsx): right slide-over on desktop, bottom sheet with a drag handle on mobile — one component, same content. Inherits the Modal a11y contract (Escape / backdrop / focus-trap / focus-restore / scroll-lock); prefers-reduced-motion → instant. Browser-gated (Playwright, incl. touch first-tap).
• /items inspector now DOCKS on desktop and opens as a bottom sheet on mobile — instead of rendering below the entire item grid (the worst finding of the mobile audit).
• Socket/gem flagship: tap an empty socket in the cube → a Drawer of your applicable gems opens, each showing what it grants inline → tap to socket, with a set animation; it stays open on the next empty socket. Replaces the old inline gem buttons.

Drag-and-drop onto a socket remains a desktop-only proposal — not in this build.

Fixes (mobile/touch — from the UX panel audit)

• PvP "Report" buttons work on touch. They were opacity-0 + group-hover — invisible and un-tappable on phones (only appeared on mouse hover). Now visible by default; the subtle hover-reveal is kept only on hover-capable (desktop) devices. A static test guards against any future invisible-on-touch reveal.
• Cube tab strip no longer clips "Recipes." The 5 tabs overflowed one mobile row and cut "Recipes" off the edge; they now wrap so every tab stays visible. The shared tab primitive also gained horizontal-scroll as a universal no-clip safety net.

No engine/balance change. (These are standalone touch fixes; the larger drawer/inspector rework from the audit is a separate, un-started decision.)

Feature

• Ladder fight-end actions (PRO-94). After a ladder duel, the result panel now offers Rematch (re-fight the same opponent — one tap, with a pending spinner while it runs) and Pick another (explicit exit back to the opponent list). The replay link stays. Cohort-requested (suggestion #12).

Make-good

• Premium reforge refund (the v0.54.2 reforge bug). Players who paid essence for the premium "guaranteed improvement" tier while it could zero a crit/DR affix were refunded. Quantified to exactly 2 players, 60 essence each (120 total); applied via scripts/refund-premium-reforge.ts with per-grant audit rows + a bell notification, balances read back. One of the two is the operator's own account — flagged in the audit for transparency.

Fixes

• Crit shown = crit paid. The scouting card showed an unclamped crit chance while combat clamps at 95% (CRIT_CAP). Both now use the same constant — the card can't promise crit the engine won't pay.
• Block stats hidden until wired. blockChance/blockPct are removed from the sheet until the block mechanic actually exists — showing a defense that never triggers is worse than showing nothing.

No engine/balance change.

Fixes

• Socketed gems now show in champion stats. The live character sheet resolved stats from the raw item affixes and never expanded sockets, so a socketed gem FOUGHT (it's baked into the snapshot) but was INVISIBLE on the Build summary / StatBar. Both paths now share one gemAffixesFromSockets expansion — the sheet reflects your gems immediately. (Compounded by the v0.54.1 Diamond zeroing.)
• Reforging no longer destroys crit / damage-reduction. reforgeAffixes rounded every flat affix to a whole number, zeroing fractional rates (critChance 0.06, drPct 0.04) on ~28% of items — INCLUDING the premium "guaranteed improvement" tier. Rounding now routes through the shared roundAffixValue; a catalog-wide invariant test guards the whole class.

No balance or design change — both are value-destruction bug fixes (the stat was always supposed to be there).

Fix

• Diamond gems granted +0% crit (all rarities). roundAffix rounded every flat affix to a whole number; Diamond's critChance is a fractional flat (0.09 = 9%), so it rounded to 0 — dead crit in the tooltip AND in stat resolution (not cosmetic). Fractional flats (|v| < 1) now keep 2 decimals. Diamond crit restored: 5/7/9/12% by rarity. (gem-catalog.ts; shared affixText was already correct — 0.09 → "+9%".) Regression tests added.

Correction (v0.54.0)

• v0.54.0's notes announced a class-field BALANCE PASS (Path B) that never shipped. Its levers (caster accuracy, hit-floor, warrior endgame curb) were uncommitted working-tree edits; the tagged build carried the OLD balance. The balance section of v0.54.0 is retracted, its smootherPlay roadmap line corrected, and Path B discarded (empirical cohort data showed it was mis-tuned — its warrior curb would worsen the real PvE endgame fall-off). A revised, data-driven balance pass is in progress (docs/field-balance-empirical-2026-08.md).
• Root cause + guardrail: new notes-vs-code gate (pnpm check:notes-vs-code) verifies a release's code claims exist in the committed source before tagging.

No engine/balance change in this patch beyond restoring Diamond crit (a bug fix — the gem was supposed to grant crit all along).

> CORRECTION (1 Aug 2026). This release's notes originally announced a class-field > balance pass (Path B: caster accuracy · hit-floor · warrior endgame curb). That > pass never shipped — its levers were uncommitted working-tree edits; the tagged/ > deployed build carries the OLD balance (WARRIOR_EG_DMG −0.7, DEX-only caster accuracy, > no hit-floor). The balance section is retracted. Empirical cohort data (docs/ > field-balance-empirical-2026-08.md) since showed the drafted pass was mis-tuned anyway > (its warrior curb would worsen the real PvE endgame fall-off), so it was discarded for > a revised, data-driven pass. Everything else below did ship. (Root cause + the new > notes-vs-code gate: pnpm check:notes-vs-code.)

No balance/engine change in this release — the items below are fixes, store, and roadmap.

Fixes

• Replay breakdown tooltips work on touch again (P0 #4). Tapping a combat-log breakdown row opens its resolution card on the first tap — a focus/click double-fire had made the first tap dead on mobile. Locked behind a real-browser Playwright gate.
• New-version nudge. When a new build deploys while you have the game open, a small non-blocking toast offers a one-tap reload — no more silently-stale tabs.

Store / doctrine

• Weekly BP cap now refunds instead of overcharging. If a purchase would cross your weekly Battle-Points cap (the "money never buys past a dedicated player's earn" line), it's rejected and fully refunded, with a notice telling you when you can buy again — now concurrency-safe (enforced atomically at the payment webhook).

Roadmap (public lanes)

• Added Temporada 2 (horizon) and split "más kits y razas" into Nuevas clases + Nuevas razas — aspirational, no dates.

Internal / ops (no player-facing surface)

• Security hardening minor: BP-cap TOCTOU fix (above) · /api/simulator iteration cap + rate limit · durable rate-limit primitive · Next 16.2.12 (security release) · sharp 0.35.3 (libvips CVEs) · unsubscribe-token secret decoupled from CRON_SECRET.
• Ops safety: PixelLab balance alerts (Resend + admin health indicator) · untagged- release-drift detector (pnpm check:release-drift) · real-browser interaction gate.

• Native `<select>` → Floating UI, app-wide (item 7). Rewrote components/ui/select.tsx on @floating-ui/react (the house positioning primitive — first real consumer): anchored + flip/shift + collision-aware, keyboard (arrows/home/end/enter/typeahead), touch, full listbox ARIA, portaled at z-[90] so it paints above the plan modal (z-[60]). Same <option>-children API; only onChange now hands back the value directly (type-honest, no faked event). Migrated all 18 selects across 9 consumers (mill/items filters, plan & character opponent pickers, library snapshot pickers, pvp scope/rematch, bench focus, profile locale, plan-rules-editor conditions). Admin selects deferred. New /dev/select-preview harness. Browser-verified: open/anchor/min-width, keyboard nav + select, flip-up at viewport bottom, long-list scroll, disabled inert.
• Public roadmap refresh (item 5). The shipped lane was frozen at v0.42.0; refreshed to the recent ~8 highlights (v0.52 → v0.42 — recency is the cadence signal, release-notes are the archive). The two cube minors merged into one entry; the store/BP-purchase entry deliberately omitted (monetization ≠ roadmap material — the hard line); bulk-open kept as pure QoL with no money vocabulary. Copy in content/roadmap.ts + es/en catalogs.
• System-status health page + public ping (item 1, internal). Admin-only System Status at /health (ADMIN_REWRITES + nav link): deploy stamp (version/sha/env/region) + live, fail-closed, timed reachability of every external dependency — MongoDB ping · Kinde issuer · PostHog host · BetaHub host (a base probe, NOT the auth'd custom_fields path — it 302s and, followed, false-positives on a login page: the DEV-9 minefield) — plus config-mode rows (Stripe test/live, Sentry DSN). A failing dep is an ok:false row, never a thrown page. Public counterpart GET /api/health: version+sha+env only, no secrets, no probes (for uptime monitors).

Presentation + internal ops — no engine, balance, or determinism change.

• XP bar (item 3). A slim experience bar now shows on the character sheet header and on each roster champion card — the fill is your progress to the next level, on a full-width track so the cap reads even when the fill is short. At LEVEL_CAP the bar is full and distinctly tinted (bg-warn). New pure/server-safe XpBar component (components/game/xp-bar.tsx).
• Gems sorted consistently (item 2). Gem lists are now grouped by family (Ruby → Garnet → Sapphire → Diamond → Emerald → Opal) then by tier/rarity everywhere they appear — the cube strip and the socket picker share one sortGems helper (domain/gem-catalog.ts), so the order is the same wherever you look.
• Pack-reveal gems match the cube (item 4). When you open a pack, the gems in the drops row now render with the same chip as the cube — family-color dot, real gem name, and the inspect tooltip — instead of the raw gem · ruby_epic id. Falls back to a plain badge only if the id is unknown.
• Notification timestamps (item 6). Each notification row shows a localized relative time ("15h ago" / "hace 15h") as a single non-wrapping token, and hovering (or tapping) it reveals the exact date-time via InspectTip.

Presentation only — no engine, balance, or determinism change.

• Fix (DEV-C) — manual battle no longer jams when you tap a skill you can't use. The "use suggested" button (and, in edge cases, a stale skill tile) could submit a skill you couldn't afford or that was on cooldown; the engine rejected it and the turn locked up. Fixed two ways: the suggested pick is now always a legal skill (the engine falls back to an affordable one — display-only, so fight outcomes are byte-identical), and any illegal pick is rejected up front with a clear "that skill isn't available right now" message instead of stalling.
• Fix (DEV-9, internal) — player suggestions now reach BetaHub. The in-app feedback forwarder was posting feature-request custom fields whose IDs no longer exist on the project, so every suggestion was rejected (422) and stayed stuck in the queue. Repaired to the project's real required field IDs (verified live) and added a drift-guard test so a future rename fails the build, not production. (A one-time sweep re-forwards the suggestions that were stuck.)

Presentation/flow + integration only — engine determinism preserved (manual-determinism byte-identical).

• Fix (BUG #13) — manual ladder fight no longer jumps to another matchup at the end. When a manual fight was opened from the ladder (the intercepted fight modal), finishing it sometimes bounced you to a different opponent with no input. Cause: the fight-submit refresh dismissed the intercepted modal (App Router doesn't re-apply route interception on a router.refresh()), so after a win you landed on the ladder showing the next matchup. The refresh was also redundant inside the modal — the modal close already syncs the context, and the result card is drawn from the submit response. Fixed: the fight client only refreshes on the full-page route (a new isHosted flag), never inside the modal. Added manual_fight_exit telemetry + regression tests.

Presentation/flow only — engine + determinism untouched.

• Live allocation preview (FR9 / PRO-89). On the character sheet, while your stat allocation is unsaved, a "Pending build" line shows how the points you're spending change your resolved secondaries — Health / Crit / Armor / Evasion — before you Save. Only the stats that actually move are listed (up = good tint, down = bad). Same resolve engine the fight uses, so the preview is the real numbers. Presentation only.
• Channeler: the basic is sustainable now (B8, balance). Every other class has a cost-0 basic; the Channeler's cheapest skill (Dual Strike) cost resource, so it could run dry with no free fallback. Its resource now generates on every action (genOnAct 12, mirroring the Warrior's earn-on-action), making the basic net-neutral — you never get resource-locked. Balance-verified: endgame-balance (realistic gear) fixes the Channeler's mid-tier hole (T6 field-avg 30 → 53) with no dominance. (The default pnpm harness reads a caster artifact on this — known magic-stacked-gear skew, PRO-93; endgame-balance is the real guard.)

Presentation + one resource-rule change — no engine-structure change; auto/manual determinism preserved.

• Fix (B12) — socketed-gem stats now show on the item card. A gem's stat only got folded into an item's affix lines at snapshot time, so on a live stash/cube item the card showed the gem's socket pip but not the stat it grants — a Diamond's crit read as "0%" on a legendary even though it applied in the fight. The card now lists each socketed gem's affix as a ◈ gem-granted line (e.g. "◈ Crit +9% — Diamond (Epic)"). Snapshot/equipped items are unaffected (no double-count). Display only — the resolved build was always correct.

Presentation only — engine untouched, harness byte-identical.

• Fix (B10) — Swift Band was a trap ring. Swift Band (level 10, ring) carried the exact same affixes as the level-5 Swift Loop (attack speed +6% / evasion +8) but at a higher budget cost — so the "upgrade" was strictly worse (more of your build budget for identical stats). Buffed to attack speed +8% / evasion +12 so the Loop → Band step is a real upgrade. Catalog-balance harness green (no class dominant at L10/15/18; the ring now earns a place in several optimal loadouts).

Presentation/data only — engine untouched, harness byte-identical logic.

• Reforge is now sign-aware (server/reforge.ts). Premium = toward-better: positive affixes grow (×1.05–1.30), negative (penalty) affixes shrink toward zero (×0.70–0.95) — a smaller penalty IS the improvement. Base reforge unchanged (±15% symmetric gamble). Regression test added (a tradeoff item's negative affix never grows past its baseline on premium).
• Recovery: re-run a premium reforge on an affected ring — it rerolls from the catalog baseline, so the penalty lands at or below −20 again (and the positives grow).

• Naming (§1). "Gamble" is gone. Opening a socket is now "Open socket — {70/50/35}%" (the odds are the explanation). Punch gets a hover/tap tooltip: what it is + where you get it (1 per pack, or buy for 40 BP). Reforge carries its one-liner ("reroll the item's affixes"). ES mirrors, Rj-locked.
• Shared item picker (§2). Both <select> dropdowns are gone. Every picker (Improve / Sockets / Gems / Reforge) now has toggled slot + rarity chips + a name search, plus a Gems-only "free socket" toggle. One <ItemPicker>, used across the tabs; the socket/reforge grids gained the same filtering.
• Gem pedagogy (§4). <GemInspect> — hover (tap on touch) any gem for its family · effect · tier — on the cube's owned-gem strip (item-card socket pips already had it). No more dead title= attributes.
• Section intros (§6) + recipe collapse (§5). Each cube section opens with a dismissible "what & how" card (sticky per-browser; a "?" brings it back). The long recipe sections now collapse, state remembered.
• House primitive (§3). @floating-ui/react adopted as the standard for any future dropdown/popover (conventions.md); a /dev/cube-preview harness seeds the real cube with sample data for mobile-screens.

Presentation only — engine untouched, harness byte-identical.

• Fix — desktop replay combat log was missing. Since v0.43.7 the fight replay's right column showed only the playback controls (Replay / Reset / Speed / Tick) with no combat log at all on desktop. Cause: the mobile collapsible wrapped the log in a native <details> and tried to force it open on desktop with a display:block on the child. Modern Chrome hides a closed <details>'s content via the ::details-content pseudo-element (content-visibility:hidden), which that child rule can't override — so the log collapsed to 0×0 and vanished. Replaced the native <details> with a controlled disclosure (a plain <div> + toggle button): desktop force-visible is a plain class on a plain element (reliably wins), mobile stays a tap-to- expand collapsible. Verified in a real browser at 1440px (log inline, all entries) and 360px (collapsed bar, tap expands).
• Test — the thrice-burned area gets a real render guard. This log area had regressed 3× (hover ×2, log ×1) under green static + happy-dom tests that couldn't see container queries or ::details-content. The render suite now mounts the replay, flips the mobile toggle via a real event, and pins the no-native-<details> + desktop-force-visible invariants (mutation-proven).

Presentation only — engine untouched, harness byte-identical.

• "Improve this item" (default cube tab). Pick an item → a server-computed recommender surfaces the best legal next step (open socket / socket gem / reforge) with cost, success %, and what it does. Actions are wired: open-socket and reforge act directly; socket-gem routes to the Gems tab (needs the gem+socket pick). Reads the shipped cube-helpers rates — invents no economy.
• Premium reforge surfaced (the guaranteed-improvement tier) wherever it's usable, plus a "what essence is for" line — killing the essence-invisibility signal without changing its faucet/sink.
• Cost legibility + the doctrine guardrail. Short on materials shows exactly what's missing ("you need X more"); direct actions disable until affordable; the BP path is an informational opt-in shown after the earned step — never a default.
• Internal: cube-recommend.ts (pure, 7/7 tests) + cube_improve_opened / cube_recommend_followed telemetry (the success metric: does reforge/premium usage climb from ~0).

• Per-anim KO baseline (koFeetY/koContentH, additive to the sheet manifest): the held ko frame is re-anchored to its own alpha-bbox bottom on the KO hold (deathTopple settle + applyDeadPose) and restored to idle on re-idle. Anchor-only — a lying corpse keeps the standing scale. Presentation only; runDuel/events byte-identical (determinism untouched).
• pnpm measure:ko-feety re-measures the held ko frame from local PNGs (no PixelLab pull) → manifest + module. 12 fighters + 222 variants; 65 corrected ≥4px. The gear-pull emitter preserves koFeetY through re-emits.

• Store live in test mode. Three BP packs (300 / 800 / 1400) behind the store flag at 100%, Stripe TEST keys (card 4242) — real BP, fake money, nothing charged. Server-detected test-mode banner (off the sk_test_ key prefix — auto-hides under a live key), a "X BP left this week" weekly-cap line (rolling-7-day 1,400 BP cap, server-enforced), and doctrine-v2 card copy localized ES/EN.
• Public odds page (/pack/odds) auto-goes-live with the flag — identical odds always, no pity, no "premium" packs.
• The line, reconciled (doctrine v2). Roadmap footer + store copy: money can buy time, never the outcome — not items, materials, gems, rank, or season rewards. The old "BP is never sold" line is retired (BP is now buyable); the store footer no longer contradicts itself.
• Internal: /dev/store-cards screenshot harness; manifest tripwire logged (a wide store flag + a live key = real-sales auto-exposure → re-scoping the flag is a REQUIRED pre-sk_live_ go-live step).

• Skill-tier gate (PRO-84): a skill unlocking at level U needs U − 1 points already spent in earlier-unlocking skills (T2: 2 · T3: 6 · T4: 9). Derived from the unlock schedule — zero magic numbers (skillUnlockLevelByKey, single source). Enforced in validateSkillAllocation (domain), the PATCH save route, and the sheet UI.
• Per-skill tenure cap (PRO-86-LITE): a track caps at min(10, level − unlockLevel) — a just-unlocked skill fills in as you level, never expanding past the existing 10-point cap; the ×(1+bonus) clamp is unchanged.
• Skill card states + explainer: the panel shows the live per-skill cap, a "needs X more points in earlier skills first" reason on a gated skill, and a "just unlocked — investable next level" note (en/es).
• Migration + free-rearrange grace: the 4 pre-existing builds illegal under the new rule are legalized (excess points refunded to the pool); a migration bell explains it, and the first skill-panel save afterward waives the skill respec fee entirely — the player may rearrange ALL skills free once. NPCs are exempt (curated ladder content; no reseed).
• Internal: pnpm migrate:skill-gating (dry-run default, --apply to commit) + /dev/skill-gate screenshot harness. Field-neutral verified via a stash A/B on pnpm endgame-balance.

• Fix: app-wide `<Button asChild>` crash. The v0.45.1 pending-button change emitted {spinner}{children} as two siblings; under asChild that handed Radix Slot a [null, child] array and it threw "Expected a single React element child". Every asChild button — back links, nav, "New champion", equip CTAs — was crashing on develop. Now the spinner + children live in one expression, so Slot always sees a single child. (Regression lock added: Button asChild render matrix.)

• Bulk-open WHY affordance. The pack ×5 / ×10 buttons used to just grey out when you couldn't afford them. They now show the exact BP shortfall on hover/tap (InspectTip) instead of a silent disable.

• House rule (conventions.md): every mutation shows pending within one frame and holds it until the new data paints. Primitive-driven, not hand-rolled.
• Foundation: a <Button pending> primitive (spinner + disabled + aria-busy, reduced-motion safe); useRefreshTransition so pending = busy || isRefreshing covers the RSC repaint; request-scoped dedup of getCurrentUser + active-character (a refresh was paying the Kinde+user lookup 2–3× and active-char resolution 2×); first-run flag folded into the layout's Promise.all.
• Routes: pure track() analytics tails moved to afterResponse() so the response returns at transaction commit instead of after 1–6 awaited PostHog calls (markStep/tickQuest stay awaited — the refresh reads them back).
• Surfaces: the character sheet (stats/skills/plan/equip/unequip/subclass/aura), the cube (holds pending through the repaint; reload + refresh run concurrently), the mill, and the packs all get true pending-until-painted with per-slot / per-branch spinners and a .catch on every handler.

• Bulk open ×5 / ×10. /api/packs/open takes { count } (1–10). There is no pity system (rolls are stateless), so ×N is provably N independent opens with identical odds — one guarded debit of PACK_COST × count, one aggregated $inc (punch + gems + blueprints), one insertMany.
• Aggregated reveal. Per-card flips don't scale to 25–50 items, so bulk opens get a new PackBulkReveal: a rarity tally + an epic/legendary standouts rail as full cards + a toggle to the full sorted grid + the aggregated cube drops + a no-odds-drift note. A single open keeps the per-card flip moment.

• Fix — desktop hover tooltips (regression). The replay combat-log breakdown tooltips stopped opening on hover on desktop again. The InspectTip openOn refactor gated hover to pointerType === 'mouse', which rejects a pen or an empty/unknown pointerType some desktop browsers report. Now hover opens for any non-touch pointer; touch still uses tap/long-press (double-tap fix preserved). Locked with a regression test (hover opens for pen/empty pointerType, not touch).
• Fix — mobile combat log. The log wasn't hidden, but it rendered last in the single-column mobile layout, buried below the tall fight stage — so it read as missing. It's now a labeled "Combat log" collapsible that shows right under the stage (tap to expand); desktop keeps the inline two-column view.

• Fix — Gems tab lists socketable items. v0.43.5 restored the "Your gems" strip, but the item selector still filtered on sockets.length > 0 (already opened sockets). Items that have socket capacity by rarity but no opened socket yet — the common case for fresh drops, which start sockets: [] — never appeared, so a player with socketable gear still saw no list. The selector now lists any item whose rarity grants socket capacity (rarity-sorted), and when the selected item still has an unopened socket it offers an inline "open the next socket" gamble (same action as the Sockets tab, with the live success %) so a gem can be placed without hopping tabs.

• Fix — gems now list. The cube Gems tab short-circuited to an empty card when you owned 0 socketable items, hiding your gems entirely. A "Your gems" strip now shows the owned-gem inventory independently; only the socket-into-item selector stays gated on having a socketed item.
• Ladder tier collapse. Tiers you've outleveled collapse to a compact "completed" chip (were full panels) — click to expand. Keeps the page on the live tier.
• Desktop section landings. The sidebar section headers (Arena/Stash/Market/ Lab) now route to their landing overview pages — one canonical overview per section on desktop too (was mobile-only).
• Internal: cube reforge verified (base vs premium, bounds, sockets untouched) + its pure reroll extracted to a unit-tested module.

• Allocation +/- are always visible. The stat-panel and skill-track +/- buttons no longer appear/disappear — they're always shown, disabled when you can't use them (no points, at the cap, at zero), with a tap/hover reason. No layout shift between states. Sheet + create flow.
• Item lists sort by rarity (legendary → epic → magic → common; tie-break by budget) everywhere: /items stash + catalog, equip/Change pickers, cube (sockets/reforge/experiment/recipe), and the mill. Existing filters still apply.

• Roster slot icons are now inspectable. On /characters, hovering (or tapping on touch) an equipped slot tile opens the item's full card — name, rarity, affixes, and sockets/gems — reusing the existing ItemCard. The roster loads the full equipped items for weapon/armor/ring (rolled affixes + sockets).

• Defense + Activity merged into one tabbed panel. The PvP right column stacked two panels (Defense inbox, then Arena activity); they're now one panel with two tabs — Defense (default: personal + actionable, keeps the scope selector, seen/unread behavior, and replay links) and Activity (the global feed). An unread dot shows on the Defense tab when fresh defense results exist. Shorter page, biggest win on mobile. All prior behaviors preserved inside their tabs.

• Sprite regression fixed: the /characters card portrait rendered BLANK. The v0.43.0 EquippedSpritePreview swap positions its <img> absolutely with no width, so in the card's flex-centered portrait it collapsed to 0 width. Fixed with a definite width — the champion's idle sprite now renders (and animates), crest as fallback, never blank.
• Equipped-slot item art: the three slot tiles were generic glyphs even when geared. Each equipped slot now shows the item's icon art (ItemIcon via gearDefById; slot glyph as the per-item fallback); empty slots keep the outlined glyph. The roster loader now also fetches the ring defId.

• Discoverable delete (friction): champion delete was a 10px muted word on the roster. New danger zone on the champion sheet with type-the-name-to-confirm, wired to the existing DELETE route (a plain hard delete; account-level tombstone rules are unrelated).
• Roster equipment sprites (friction): /characters cards showed the crest, not the equipped sprite — swapped to the leaderboard's EquippedSpritePreview (idle crop, crest fallback), roster loader reuses the same equippedGear fetch.
• DoT damage made visible (pedagogy): skill cards showed only "applies X (Yt)". Damage-over-time is FLAT (the engine subtracts the status's per-tick damage straight from HP — no scaling), so the card now states dmg/t × dur (total) for dot statuses.
• Respec / tree-order explainer (pedagogy): the rule was unexplained — any unlocked skill in any order, and points are refundable for a respec fee (10 × level BP). Added a skills-panel line.
• Build budget visibility (pedagogy): item cards show a per-item BUDGET, but the champion cap (200 + level·80, enforced on every build save) was never shown. Surfaced the used/cap bar + an explaining tooltip in the equipment section.
• Branded root loading (Batch 2): the app-wide loading fallback is now the DDRO wordmark with a subtle pulse (no spinner).

• Mobile double-tap fixed (P0-A): a tooltip on a gem dot / stat-delta chip INSIDE a clickable card was swallowing the first tap (InspectTip stopPropagation + tap-toggle), so equip/pick needed a second tap. InspectTip gained openOn modes; action-surface tips now use longpress — a quick TAP falls through to the action, a hold inspects. Hover is gated to a real mouse (no touch-emulated re-open). Emulated-touch regression test added.
• Sign-in from Discord fixed (P0-B): Google OAuth (disallowed_useragent) fails inside Discord's in-app browser, and every invite arrives via Discord — logged-out visitors there couldn't sign in. A new banner in the unauthed shell detects embedded webviews (Discord Android/iOS, Android wv, iOS no-Safari-token, other in-app browsers) and routes them to a real browser with a copy-link button. UX routing only — auth is never gated on the UA; the LoginLink stays live. ?webview=1 forces it for QA. 11 UA-detection tests.

• Floating pill bottom nav (replaces the old below-md tab bar + empty "More" drawer). A sharp-cornered glass pill carrying EXACTLY the five desktop sections — Champions · Stash · Arena (dead-center, on a raised accent disc) · Market · Lab. No "Me" tab; the account avatar stays in the top bar. MOBILE_TAB_MATCH rewired so every contextual route lights the right section tab.
• Section landing pages (/arena /stash /market /lab): each a card list to that section's children (shared SectionLanding server component, shell.sections i18n en+es), used as the pill's destination. Champions → the /characters roster. Desktop sidebar unchanged.
• Touch-tooltip audit (item 2) — every inspectable tooltip now works on TAP, not just hover (dead on touch). Fixed the real gaps → InspectTip: the mill item chip (its unique bit, the mill yield, is now shown inline on the card), the character sheet's ◆ signature-node blurb + dust/essence note, the scout sheet's ◆ invested marker, and the ladder's grey-decay reason. 7/8 surfaces were already covered; the stat bars were already touch-capable. Canonical emulated-touch test added (tests/components/inspect-tip.test.tsx).
• Internal: institutionalized a Playwright device-emulation screenshot gate (pnpm mobile-screens, iPhone + tablet) for mobile-affecting changes, wired into the release ritual; landing-card descriptions wrap (line-clamp) instead of edge-clipping.

• Build summary panel (B): the full resolved sheet from toActor (the same actor combat + replay run), grouped Offense / Defense / Resource — physical + magic damage%, attack speed, crit chance/dmg, accuracy, max HP, evasion, armor, resist, damage reduction, block chance/amount, resource pool/regen. Truthfulness pinned by a test (the one derivation, damage% by tag, + every actor field is present); all values rounded for display.
• Gear comparison (C): each equip-picker card shows the resolved-stat DELTA of swapping it for the item equipped in that slot — per-affected-stat ± chips (green up / red down) from domain/gear-compare.ts gearSwapDeltas (toActor twice, diffed → the engine's numbers; tested equal to the before/after difference exactly). Plus a "what leaves if I swap" note when the currently-equipped item has socketed gems (they unequip with it and their bonus leaves the active build — distinct from mill's DESTROY).
• The /items inspection-panel comparison needs a character selector (that page is account-level) — follow-up.

• InspectTip default surface. Bare-content tooltips (the new socket-dot gem tips, the threat chip, gauge/resource tips) had no background and rendered as transparent popovers. The InspectTip card now owns the surface (rounded, bordered, elevated bg-surface-container- high, shadow) — so EVERY inspect tooltip is legible everywhere. The one usage that brought its own card (the replay hit-breakdown) dropped its redundant background.

• One shared `ItemCard` everywhere. The champion sheet (equipped panels + equip/change picker) rendered items via an ad-hoc ItemRow; the cube via a bespoke ItemTile + chips. Both are gone — every item render now flows through ItemCard, so the socket row, gem fills, ◈ gem-affix marker, unique/description, and budget land on all of them at once (stash · catalog · sheet · cube socket/gems/reforge/recipe/experiment · mill · pack reveal).
• Socket row (ItemCard): N slots by capacity, empty = hollow, filled = the gem-family color dot with an InspectTip (gem name + mod line). New gemFamilyColor helper (ruby/garnet/sapphire/diamond/emerald/opal). Gem-granted affixes already marked ◈.
• Disabled reason (ItemCard.disabledReason + a footer slot). The equip picker greys unequippable items with the WHY — "Requiere nivel 10" / "Requiere INT 22" (es tuteo), computed client-side (canEquip vs base primary stats) to mirror the server gate, instead of failing silently on click.
• Mill gem warning: milling permanently destroys socketed gems (no refund — verified in /api/inventory/mill); the confirm now counts + warns.
• The combatant scout stays snapshot-based (gems baked into the frozen affix list, shown via ◈) — snapshots don't track live sockets, so no socket row there by design.
• Threaded sockets/maxSockets (+ reqLevel/reqStat on the sheet) through the items, sheet, mill, cube, and pack payloads. Removed dead ItemRow/ItemTile bodies + the void ItemCard suppression. Static guards updated for the unification.

• Rarity glow pool on the champion-sheet preview. The EquippedSpritePreview (a plain <img> stepper) never rendered the rarity presence the fight stage draws — added a soft tinted pool under the fighter for magic+ gear (CSS; brighter by tier; no provider import).
• Dev breadcrumb for silent variant fallback (traceVariant): the resolved variantKey + the fallback REASON (variant/base/default) + the weapon/armor tokens (null → missing defIds) are stamped as data-attrs (data-variant-reason/-wtoken/ -atoken on the sheet; data-attacker/defender-variant on the fight stage) + a dev console.debug. A silent drop to the base fighter can't hide again.
• Diagnosis: resolution + manifest + assets are correct; plain-steel = a snapshot whose equipped entries predate defId. Census + a byte-identical backfill (pnpm audit:snapshots, pnpm backfill:snapshot-defids) handle the stale data separately.

• `domain/skill-formula.ts` — resolveSkillFormula(skill, ctx) mirrors engine.ts dealDamage line-for-line: effectMagnitude(base · skillScale · spMult, tags, mods). Crit is a separate "on crit" figure with its odds; per-hit variance is a ±band (HIT_VARIANCE, now exported from the engine so there's one source); mitigation/block are target-contextual and omitted. Heal/shield branch correctly (the engine scales them by base · skillScale · spMult only, NOT through effectMagnitude). Truthfulness test: the card's resolved number equals the real duel's Base breakdown step for every class opener.
• `SkillCard` — one component for every surface: header (name · tags · cost/cd · resource) + description + per-effect formula rows + "+X% per skill point" (real skillPointBonus) + the node-5 breakpoint named with its effect (skillBreakpoint()) + flavor. hideHeader mode for the sheet's SP panel; static effectSummary fallback with no build.
• Wired live on the champion sheet skills panel, the manual /battle buttons (ⓘ InspectTip), and the /kit demo; the plan editor shows the description card on an ⓘ beside each action (a <select> can't host a tooltip) — live numbers there are a fast-follow. Mobile tap-toggle via InspectTip.
• `messages/{en,es}/skills.json` (new namespace): 24 skills × description + flavor (es tuteo; skill names stay English), 12 breakpoint effects, and the card chrome.

• Double-sided ranked filter (server/pvp.ts + /api/pvp/opponents, PRO): while a champion is under the 10-ranked-game floor (count DERIVED from mode:'pvp' duels only — no stored counter, so the rating/defense write path is untouched), its ranked matrix is shielded to a fixed ±3 level window (tier-aligned; the grey-decay knee). The shield is a CLIFF, not gradual — a widening shield is farmable. It is DOUBLE-SIDED: a protected newcomer is neither served giants nor served TO them.
• Asymmetric anti-farm (attackAllowed): a veteran can't attack DOWN on a far under-floor account, but a newcomer may opt to punch UP at a graduated foe (its own matrix hunger-widens to offer that; the threat chip labels it honestly). A route-level 403 backstop in /api/duels re-checks server-side (fightability gate, Elo untouched).
• Hunger fallback: a protected newcomer with fewer than 3 in-window rivals auto-widens its own view until it finds them — an empty arena is worse than a stretched one.
• Threat chip (ThreatChip + threatTier): a 5-tier indicator on every rival card (ranked, direct duels, ladder) on the grey-decay 3/6 knees — dire/risky/even/soft/trivial → "Muy superior / Riesgoso / A tu altura / Por debajo / Muy inferior" (tuteo, no raw numbers; exact gap in the InspectTip; colored by who's favored).
• Scope split: /api/pvp/opponents?scope=ranked (default, protected) vs scope=open (direct duels / casual — unfiltered, shows everyone with honest chips). No-stakes bravado stays open by design.
• Tests: window/attack math + 5-tier threat (domain) · matrix filter both-directions + ranked-PvP-only derivation + hunger stretch + open-scope + /api/duels backstop (route) · chip render both directions.

• Unique effects family 1 (domain/uniques.ts, PRO-84): UniqueKey + UNIQUE_PARAMS (the single source of tuning), threaded ItemDef.uniqueKey → defToItem → Item.unique → Actor.uniques. Applied at the dealDamage choke point, each with its OWN breakdown step: Regicide/Last Stand/Channel pre-mitigation multipliers, Pierce armor-ignore on crit, Runebite crit-bleed (dot).
• Balance (gated, isolated Δ win-rate — same item both ways, only the engine hook toggles; L16, N=400/opp/side): Pierce +4.5 · Regicide +4.7 · Channel +2.6 · Last Stand +6.0 · Runebite +5.8pp. None dominant; catalog-balance reports "dominant: none" at every band, with the four legendaries becoming the optimal endgame pick for their class. New harness pnpm uniques-balance.
• Honest labels (parseUnique + uniqueViewByDefId): the item card resolves a legendary's unique from the static catalog by defId and renders it truthfully — live effect text (rarity-tinted) for wired/stat-stick uniques, a dimmed "poder latente" (es) / "dormant" (en) pill for the unwired. The (engine support: …) dev annotation never reaches players. Wired on /items, /mill, and the pack-open reveal.
• Tests: tests/domain/uniques.test.ts (firing, breakdown lines, determinism, byte- identical sample gear, parse/live-vs-dormant) + tests/components/item-card-unique.test.tsx (card never lies in either direction).

• Action-gauge snapshot on `DuelEvent` (domain/engine.ts, PRO-84): Duel.snapshot() now carries both sides' action gauge (gaugeA/gaugeB, 0–100) alongside HP + resource, so every combat event has it and replays are scrub-correct. Additive + presentation-only — RNG untouched, log strings unchanged → harness byte-identical (manual-determinism proves runDuel ≡ replayManual event-for-event).
• `GaugeBar`: a deliberately thin, continuous bar (distinct from the segmented HP/resource bars — it reads as speed/tempo, not tactical units), accent-colored, InspectTip for the exact fill, reduced-motion safe (width transition gated behind motion-safe). i18n es/en.
• Wired onto the replay stage (scrub-correct from the event snapshot; hidden on legacy duels) and manual `/battle` (swapped the ad-hoc inline gauge for the shared component in both panels).

• Resource snapshot on `DuelEvent` (domain/engine.ts, PRO-83): Duel.snapshot() now carries both sides' resource (resA/resB/maxResA/maxResB/resNameA/resNameB) alongside HP, so every combat event has it and replays are scrub-correct. Additive + presentation-only — RNG untouched, log strings unchanged → harness byte-identical (manual-determinism proves runDuel ≡ replayManual event-for-event).
• `ResourceBar` (sibling of HpBar): segmented, resource-colored (rage red, energy amber, mana blue, balance epic — from the design tokens), current/max, InspectTip for the exact numbers, reduced-motion safe (segments change instantly, no continuous animation). i18n es/en (Furia/Energía/Maná/Balance).
• Wired onto the replay stage (scrub-correct from the event snapshot; hidden on legacy duels with no resource events) and manual `/battle` (the shared bar, pairing with the existing per-skill affordability — the cost economy in real time).
• Chore: the 2 stale ddro-develop.vercel.app APP_URL fallbacks (email.ts, betahub-forward.ts) → the canonical app.develop.fibonaxis.dev (domain-migration runbook item).

• Global feedback entry point (account menu → "Report or suggest"). A modal that reuses the fight-report machinery: POSTs /api/reports with a new targetKind: 'feedback' (no target entity — the route mints a fresh row per submission so each lands separately) and surfaces in the SAME admin inbox (dismiss-only, no owner). App version + pathname auto-attach for triage.
• Feedback modal is a full form (zero-friction — only type + message required): bugs can add steps-to-reproduce, what-you-expected, and severity (bloquea/molesta/detalle); ideas can add "what problem would it solve". Everything optional maps to the matching BetaHub field. Mobile-first single column. Message limit raised 200 → 500.
• Support tickets — a third feedback type, "Account problem" (es "Problema con mi cuenta"), that becomes a private BetaHub support ticket (not the public tracker; a "Privado — solo lo ve el equipo" hint says so). The forwarder attaches the account email as the reply channel (read at send time, never stored).
• BetaHub forwarder (server/betahub-forward.ts, PRO-74). Each feedback/duel/ support report is mirrored SERVER-SIDE into BetaHub — bug → issues.json, suggestion → feature_requests.json, account problem → tickets.json — auto-filled with context the player never types (release label, device/UA, locale, account id (never email), duel id + replay link) AND the project's required custom fields. Auth FormUser. Fail-soft: runs after the response via after(), so a BetaHub outage never touches the player's success; the row carries pending/synced/failed (shown in admin) and every submit re-sweeps stragglers (daily-cron backstop). One-way for now.
• Community → Discord — an external "Community" link in the account menu, shown once NEXT_PUBLIC_DISCORD_INVITE_URL is configured.
• Spanish onboarding path: a visitor with no chosen locale is served es when their browser prefers Spanish (Accept-Language) or via a `?lang=es` invite link (param wins); the choice sets the NEXT_LOCALE cookie pre-auth and survives signup into User.prefs.locale. No URL/route change (no-prefix architecture stands).
• Roadmap — the horizon gains three aspirational items (no dates): Livelier fights (animation polish), Live duels (real-time turn-by-turn) and Regional ranking (best in your country; self-declared, never IP). The footer carries a subtle growth/support line, keeping "power is never sold — it's played" verbatim. (Seasons stays in "building" until v0.35.0 tags at S2.)