The PvP_Characters table tallied wins and losses but held no token
balance and no purchase endpoint: earnings were client-reported
(winners credited themselves locally), so verifying only a spend
would have been security theater — a cheater could mint tokens by
self-reporting battle wins.
The server is now the ledger authority (FRE-142): registerCharacter
seeds the balance from the client cache exactly once and reconciles
it on every sync; battleResult requires the verified Lineage JWT
bearer, rejects non-participants, and credits the winner via the
reward formula ported from the client (computed from both registered
rows); a new purchase mutation checks cost, balance, and cooldown in
one conditional UPDATE scoped to the caller-owned row, so the spend
is atomic under concurrency and rate limiting survives cold starts.
Schema changes ship as an idempotent pvp-schema bootstrap
(pvpTokens, ownerUserId, lastPurchaseAt), mirroring the
analytics-schema pattern.
Client-side counterpart shipped in the lineage repo; design record
in its docs/security/pvp-server-side-purchases.md.
Tests: pvp-schema (DDL + legacy-column migration + idempotency),
pvp-rewards (formula parity with the client port, cost table),
pvp-ledger (seed-once reconciliation, owner binding, participant
verification, atomic spend, cooldown, refusal reasons) — 31 new tests
against in-memory SQLite; suite 572 pass (1 pre-existing audit
date-filter failure, unrelated).
Every cold origin render of /changelog died with ERR_HTTP_HEADERS_SENT:
the pending createAsync at the top of NookChangelogPage suspended the
whole component before <EdgeCacheHeaders> rendered, the shell flushed
while the S3 appcast fetch was in flight, and the boundary re-render
then called setResponseHeader on an already-sent response. Warm renders
hid it because the appcast's 5-minute module cache resolved in a
microtask; fresh Vercel isolates and cache expiry hit the crash, which
is why refreshes and direct navigation failed while in-app Links worked.
deferStream holds the stream until the releases resolve, so HttpHeader
always runs pre-flush. The S3 latency lands on origin renders only,
which the page's CDN-Cache-Control s-maxage=300 already keeps rare.
Tests: local prod-build cold-start loop (build + curl /nook/changelog),
red 3/3 before, green 5/5 after; stack identical to the prod trace.
Fixes FRE-112
The appcast retains only recent items, so releases before 0.6.0 had no
surface. The five older sections (0.5.0 back to the first widely
distributed 0.2.0) were recovered from the changelog file's git
history (The-Nook 1ad8a69 / db165cd), converted to the same HTML the
embed step produces, and checked in as an archive the page merges
behind the appcast items — appcast stays authoritative, archive fills
the gaps. 0.3.1 and 0.6.1 shipped without written notes and are absent
by design. Also fixes the accordion snapping 0.6.3 back open when all
sections were collapsed: after any click the state is a version or an
explicit none sentinel, never the initial first-open default.
Tests: tsc clean; dev render shows all eight releases with notes in
the DOM.
Issue: FRE-13
The release pipeline had no in-repo path to put a corrected appcast
back on S3 (the backfill of 0.6.0/0.6.2 notes needed one). Reads the
same bucket env the appcast route does; refuses to upload unless every
expected release item is present.
Tests: used for the production backfill; endpoint re-verified after.
The lifecycle job marked rows with an unconditional UPDATE before
sending, so two overlapping invocations (cron tick + manual hit, or
retry) both passed the SELECT, both ran the UPDATE — re-writing the
same value — and both sent the same email. Real duplicates went out to
licensees. Rows are now claimed with a conditional UPDATE (... AND
asked_at IS NULL), and the send happens only when the claim reports
rowsAffected 1; a racing invocation claims nothing and sends nothing.
Tests: lifecycle suite gains a lost-claim case; 36 nook API tests pass.
Issue: FRE-11
Releases that shipped before notes were embedded in the appcast
(0.6.2 and earlier) have empty descriptions, so expanding their row
rendered a blank expanse that read as broken. Show a muted "no notes
recorded" line instead; the appcast embed step now runs every release,
so history accumulates from here on.
Tests: vinxi build clean; tsc clean.
Issue: FRE-13
A long appcast made the page grow with every release and pushed
historical versions far below the fold. Versions now collapse to a
header row inside a fixed-height vertical panel (max-h 70vh): expanding
one never shifts the page, and history is browsed by scrolling inside
it. The newest release starts open; notes stay mounted and toggle via
hidden rather than unmounting, so crawlers still see every entry.
Tests: vinxi build clean; tsc clean.
Issue: FRE-13
The new subdomain pages 404ed in production: the vercel.json host
rewrites do not fire — SSR sees /agents, never /nook/agents — so pages
that only exist under src/routes/nook/* are unreachable from the
subdomain. Every pre-existing subdomain surface survives on top-level
host-dispatch routes (index, privacy, checkout, deletion), which is why
only the new pages broke. Give the three pages the same dispatch,
falling back to 404 on other sites.
Tests: full bun test run unchanged (539 pass); vinxi build clean.
Issue: FRE-12
One voice, one place, so agent-drafted assets stop inventing framing
per artifact. positioning.md carries the wedge, the category-noun rule
(freno-dev/AGENTS.md competitor ban), claims each backed by code, the
honest privacy scoping and the voice/banned-phrasings list. The tree
adds calendar.json, per-channel briefs, drafts → pending → approved →
posted, metrics and listening — with the hard rule up front: approved/
is the only thing a human ever publishes from, nothing posts itself.
Issue: FRE-17
Trials were anonymous — a 14-day trial you cannot talk to. trials gains
an email column (idempotent ALTER), POST /api/the-nook/trial-email
attaches the optional first-launch prompt's answer, and the address
lands in a Brevo list when NOOK_TRIAL_LIST_ID is set. The lifecycle
emails follow: a D+11 trial expiry reminder with a buy link, a purchase
thank-you from the Stripe webhook, and scheduled testimonial (D+3) and
review (D+14) asks via the daily /api/the-nook/lifecycle cron. Rows are
marked before sending so retries never double-send; trial addresses
that already bought get no buy reminder; the endpoint requires a
Bearer secret (CRON_SECRET / NOOK_LIFECYCLE_SECRET) and fails closed
when unconfigured — an open trigger would email real users. All sends
are best-effort and logged, never thrown.
Tests: trial-email (3) and lifecycle (6) suites; full run 539 pass.
Issues: FRE-10, FRE-11
Three organic surfaces, each answering an objection at the moment it
bites. /agents lists all twelve agents with each hook's exact event
surface (mirrors AgentSpec.all + hook/setup.go + the plugins) and what
a card can do — allow/deny or observe. /changelog renders the appcast
HTML the Sparkle updater already publishes, so release notes have one
source of truth. /faq answers privacy (scoped honestly: no prompt or
code content leaves the device), the notch question, battery,
permissions, the macOS 14 floor and offline use — no refund question,
per decision: the trial is the answer. Nav gains the three links.
Tests: appcast parser suite (5 tests) covers CDATA, escaped HTML,
Version-prefix titles and garbage input.
Issues: FRE-12, FRE-13, FRE-14
The landing page spent its strongest on-page signal on the word "Home";
the title now carries the positioning line and the OG title carries the
full brand phrase. /blog on a product subdomain served the personal blog
in dev (vinxi ignores the vercel.json rewrites that protect production),
splitting the brand and crawl equity — subdomain hits now render the
shared 404. /agents, /changelog and /faq join the sitemap registry so
they are indexed as they land.
Tests: bun test (539 pass); vinxi build clean, no new tsc errors.
Issues: FRE-8, FRE-15, FRE-9
