Changelog
Every change merged into Kheldra, one line each. 688 changes so far, newest first.
Grouped by date, then by area. The code at the end of each line is the pull request or commit that made the change.
2026-10-29
Server
- Load-test mode needs `KHELDRA_NON_PRODUCTION=1` as well as `KHELDRA_LOADTEST=1`, so a copied environment file cannot switch off the login, registration and reset limits
- Account ids are unique ignoring letter case, and reserved words such as admin and staff are refused as account ids
- Authenticated responses no longer send a hardcoded localhost CORS origin, and every "not yours" refusal is a 403
- A whisper that cannot be delivered gets one reply, so the reply no longer shows who is online
- Game and site pages refuse framing and MIME sniffing in the app, not only at the proxy
- Non-JSON action requests get 415, oversized action bodies get 413 and the connection closes, and prototype-named intents are refused
- Chat refuses every invisible format character, counts any dotted word with a letter ending as a link, and refuses words that mix Latin with Cyrillic or Greek letters
- Password reset checks the link before the password rules, and the account-wide login cap is 60 per 15 minutes
- Play scripts run only with a per-response nonce, so an injected inline script is refused
- A duplicate account id gets the same reply as other registration errors, so ids cannot be enumerated
2026-10-28
Gameplay
- Durability now follows one tier model: a first-tier tool or piece of gear lasts 250 uses and higher tiers last proportionally longer; hardwood and bones can be gathered in town, and repair kits fix worn bows and other weapons
- Resource nodes now have a cooldown for each hero, so one player can no longer strip a node bare for everyone else
- Wilderness resources and monsters grow back on a steady timer, and busier zones hold more of them
- World bosses appear on a schedule
- Mazes work again: walking into a room now enters it, so you can solve the puzzle, beat the boss, loot and leave through the exit, and the last guard no longer stands on the exit tile
- Pressing F to loot inside a maze or dungeon now finds the corpse next to you instead of reporting nothing to pick up
- Every lake, pond, river and coast now has a place to fish, and the fishing board shows the spots on your own map
- Gathering with a pickaxe now wears it by one point per gather, as intended
- Every maze puzzle now has a riddle hint in the dungeon panel when you stand beside the puzzle room, so mazes can be finished without already knowing the answer
- Mazes and Map 2 dungeons now appear in the Dungeons panel, the boss stays inside its room until you enter it, and Solve puzzle, Finish run and Leave are in the dungeon HUD
- Leaving a Map 1 maze by abandoning it now puts you at the maze entrance, the same place finishing does
- Homes are reclaimed after 120 days of inactivity, the same as guild land, with the same warnings before
Economy
- Guild commissions, market orders and mail keep your gold and items safe if anything fails midway
- Gold, item and experience rewards from fights and minigames are saved right away, so a restart cannot take them back
- New players can be gifted items and gold by friends straight away, and there is no limit on how much gold you can hold, send or earn
- Boss and group kill rewards are paid once per account, however many of your characters took part
- Minigame rewards are checked by the server: a game must last a minimum time, the daily puzzle, card table and tag are replayed and checked, and results without a started session earn no bonus
- The Town Bowyer's ashwood shortbow now costs 35 gold instead of 60, so a new player who follows the starter quests can afford their first bow
UI
- Pressing F on a corpse now walks you to it from up to 14 tiles away and loots it in one go, instead of telling you it is too far
- Looting with a bow or staff equipped no longer stops you several tiles short of the corpse
- Looting waits for your last step to reach the server and tries once more if it was refused for range, and repeat presses no longer cause "already looted" errors
- Looting shows what is happening ("Walking to...", "Looting..."), and a corpse still reserved for another hunter shows its "Loot in MM:SS" timer instead of making you walk over to be refused
- Loot all explains why it found nothing, and opt-in auto loot stops retrying a corpse it could not take
- Claiming a nearby item cache now walks you over to it instead of asking you to step closer by hand
- Auto attack now follows a monster that steps out of reach instead of stalling, swings come closer to the weapon's real speed, and tapping attack just before it recharges queues the swing instead of showing an error
- New players get a calmer first minute: the character screen shows one empty slot with the name box ready, the email verification reminder waits two minutes after you sign up, and the Town Crier greeting is no longer shown twice
- Walking into something now says what is in the way (a building, a person, furniture, water or a cliff, or the edge of the world) instead of "map object blocks movement", and picking a taken or invalid character name explains the problem
- The login screen no longer jumps while the player count loads, and the password box now says passwords need at least 8 characters
- Fixed rubber banding when sliding along walls, stalls and building corners, and a busy server no longer snaps your hero back to an old spot
- Fixed rubber banding when running past townsfolk: your hero now stops at people the way the server does instead of being snapped back several steps, and movement updates go out a little more often
- Gathering, looting and walking up to a monster now walk around walls and people and arrive properly before acting, so "out of reach" and "blocked" errors no longer interrupt them
- Click-to-move routes now keep a safe distance from townsfolk, walls and building corners, and a hero standing in a tight gap can walk out of it instead of being stuck
- Clicking somewhere you cannot reach no longer freezes the game for a moment
- Any blocked patch of ground inside the town walls is opened up when the server starts, so there are no unwalkable gaps in the streets
- The game runs much smoother with lots of players on screen and while walking: the screen is painted once per frame, the ground scrolls from a cached picture, and new terrain loads in the background instead of freezing the game
- New Options setting, Adaptive quality: on Automatic resolution the game lowers its internal resolution (the picture gets a little softer) while the frame rate stays low, and restores it when there is room
- The game loads faster: the ground and building art now loads as smaller WebP images (about 36 MB of images down to about 9 MB on a first load)
- Walking in busy areas is smoother again: the screen border shading, the glow around your hero and floating damage and XP numbers no longer cost extra work every frame, and clouds and lantern glows are dropped only while the game is struggling
- Loading the game and walking into new terrain no longer freezes it: the ground textures are prepared in idle moments and new ground is rebuilt in fewer, larger steps
- Card Table, Tag and Daily Puzzle now open from the minigame hub, and closing a minigame stops its timers so it can no longer score after you leave
- Your saved Move, Loot and Journal key bindings now work in the game, and the loot hint says Press F
- The game asks the server for far less in the background while you play, which helps on slow connections and phones
- The public works page sorts by most progress correctly, and failed attribute point confirmations can be retried safely
- The whole game and website now use the Grenze Gotisch Light typeface, loaded from our own server
- Windows are easier to use on phones and tablets: text is never smaller than 12 px, buttons are at least 44 px tall, and windows stay clear of notches and the keyboard
- The minigame hub shows a list and a detail view, ignores scores from games you already closed, and game keys stop moving your hero while a panel is open
- Standalone pages (housing, shops, crafting, scavenging, guild land and more) share one look and one set of buttons, and open correctly inside the game
- Signing in from a page that sent you there now returns you to that page
- Pay upkeep buttons and a weeks behind banner appear on the housing and guild land pages
- A window title follows the page it shows, and the crafting window has category tabs and a Show more button
- Windows resize in height as well as width, stay inside short screens, and typing in a window never triggers game hotkeys
- Fixed overlaps between the HUD, chat, tracker, coach tips, minimap and speech bubbles on tablets and phones, and the game screen stays clear while the sign-in gate is open
- Esc clears your target, otherwise it opens Settings, and Help now says so
- The player wiki now has a searchable game database (items, spells, skills, monsters, NPCs, shops, recipes, fishing spots, dungeons, zones, quests, mounts and vehicles) plus new guides for mazes, the world boss, economy tips, fishing, guild land, travel, classes, professions, PvP and a glossary
- Windows stack in the order you click them, Esc closes the top window, window positions are remembered for each screen size, and on phones windows open as full screen sheets with a close button
- The Features, Lore and Minigames panels can be resized and no longer block the game behind them
Fixes
- Fixed your hero snapping back when walking past the town gates and wall ends, which could stop you reaching the rocks beside them, and pressing Loot or F repeatedly while walking no longer pulls you back to an old spot
- Fixed your hero jumping back and forth to several spots while walking or mining on a weak phone connection: a short signal drop or slow reply no longer snaps you back to an old position, and late replies no longer pull you off the spot you just walked to
- Fixed "Something is in the way" when mining or gathering a rock that sits against a stall or prop: if you are standing right beside it, you can gather it from any side
- Accounts with a 6 or 7 character password can log in again
- Right-clicking the world works again: the menu with Walk here and the player actions no longer fails to open
- Fixed a missing combat image that was requested on every page load
- The Lost Forge Ore Cart no longer sits beside the map 2 gate, and rocks never respawn within 3 tiles of a gate, so walking up to a rock can no longer send a high level hero through it
- Locked items can no longer leave your bag through guild halls, home storage, mount packs or a PvP death drop
- Re-equipping an item you are already wearing no longer destroys the spare copy in your bag
- Recovering your belongings from a corpse always returns the full pile, and reclaimed home and guild land belongings can always be taken back however heavy they are
- Pet and summon kills now expire their loot window like any other kill
- Shrines, caves, discoveries, resting, fishing, ferries, farming, construction and other map specific places can no longer be used from the wrong map at the same coordinates
- Trade, bank, guild, party and other actions no longer fail when the server's event log is full, and your achievement and quest progress survive the log being trimmed
- You stay logged in across server restarts, and logging out, being banned or resetting your password ends every session on that account
- Many small fixes from a line by line audit: marketplace best price flags, news post ids, quest progress after trimming, hall of fame names, contract delivery respecting locked items, and stale or dead code removed
- Choosing an account or hero name now checks it against a naming policy, and passwords are checked against a list of common passwords
- Registration is limited to 15 accounts per address per hour, and the error says how many minutes remain
- Whispers need level 3 or a friend list entry, and error messages no longer reveal internal details
- Staff rank is matched to exact account names, so a lookalike name can never claim it
- Developer pages (console, map editor, art gallery) and the shutdown route need developer or staff access
- Money and item moving actions get a request id automatically, so a repeated click or retry cannot pay out twice
- The shops page no longer crashes, and the scavenging page shows your session
- The accommodation page no longer inserts server text as raw markup
Server
- Audited every place the server writes a hero's position and added tests (mining session, concurrent requests, 12,000 call fuzz, rollback copy round trip): only accepted moves and explicit teleports ever move a hero
- The server does less work behind every action and every refresh, so the game stays responsive when many players are online at once
- Pages and files are sent compressed (the main page goes from 488 KB to 135 KB, the art catalog from 10 MB to 255 KB) and are no longer read and hashed on every request
- Saves write only the sections that changed, quiet servers skip the per second world tick, and gather, craft, buy, sell, bank and trade actions copy only what they touch
- Gateway zone keys now use the same map and channel format as the zone code, and guild treasury and project history use their own bounded audit log
- The mail and recovery secret is kept in a private file next to the save instead of inside it
- The server notice poll keeps running so restart and maintenance notices arrive
- Map 1 quest content is checked against the live item, NPC and monster registries, with a register of every stage's IDs and an audit of settlement NPC roles
- Map 1 geography is pinned by a test, so the east gate and Kheldra Town anchor cannot move without a failing check
- Map 1 new-player journey runs as an automated check (character, spawn, two players, quest talk, shop, roads to three towns, play page) and writes a report
- Quest-giver dialogue has server-side help and denial replies for wrong-NPC, objective-incomplete and already-complete cases, and they never change progress
- Servers can drain: new actions stop, in flight ones finish, then it is safe to restart
- Saves are versioned with migrations, older events move to an archive, and a metrics page and slow action log show how the server is doing
- Staff commands are written to an audit file, with staff accounts set by KHELDRA_GM_ACCOUNTS
- Map based helpers share one near point check, and map 2 content now has a checked layout
- About 850 audit findings were turned into stable tests that no longer rely on timers
- Many more tests run on real behaviour instead of timers and fixed waits, and a hung test server is force-stopped after a few seconds
- Wiki and developer docs now cover drain mode, metrics, the name and password rules, per-hero resource cooldowns, window controls and the minigame hub
- The sqlite save no longer rewrites an unchanged world, the map loader skips the extra map data files, and a duplicated block of server routes was removed
2026-10-27
Gameplay
- Movement can follow the server world tick: your hero still moves the instant you press a key or click, and is gently corrected to the server position when it disagrees by more than a tile
- Spells attack from 6 tiles for 2 mana, and the range circle shows that
- Worn gear has its own 40-unit limit, separate from carry weight; equips and swaps over it are refused
- Map 1 quests for Neris in Riverlands can be accepted, tracked, guided to and claimed from the journal
- Failed actions say why: out of range, not enough mana, cooldown, nothing to loot, NPC too far
- Talk replies show under the NPC card, and a walk that stops short still opens the NPC dialog
- A quest you are already tracking shows as tracked, not with an Accept button
- Your hotbar layout is now saved to your character, so it follows you across browsers and devices instead of resetting
- Pressing Loot with nothing to loot, or attacking a target clearly out of reach, no longer sends a request to the server, and an identical refusal message now shows once every two seconds instead of repeating
- Map 2 guild trainers in all three cities teach all 29 trainer-sourced spells
- Skills and abilities on Map 2 train by use, the same as Map 1; there are no skill or ability trainers
Economy
- One repair kit fully restores one item; repair all spends one kit per worn tool
- Map 2 dungeon runs pay items only, with no gold
UI
- Error and refusal messages now say what happened and what to do next in plain words, with no internal ids, codes or technical terms
- A full channel now tells you plainly: "This channel is full right now. Try again in a minute" instead of a raw error
- The login screen shows each channel as open, busy or full when the server reports zones
- Your equipped title now shows on the nameplate of players near you
- The news panel always shows a Close button in its header, and long news scrolls
- The abilities window is called Hotbar Settings, and K opens Skills & Progression
- Social, Guild, Shop and Options open their own windows
- Inventory opens on I; other windows no longer show Crafting in their place
- Chat tabs for Party and Trade explain how to fill them; collapsing the chat keeps the tabs
- Next steps sits above the chat, the activity box stops short of the hotbar, and the star toggle is clear
- The first click on the menu is no longer swallowed by the login news
- Guild hall shows a loading line instead of a blank window
- Map labels are larger and skip overlapping labels
- Character stat names no longer break mid-word
- On phones, the side menu, damage numbers, banner, tracker and equipment labels fit the screen
- On phones, the game menu bar sits under the character card, Quests and Next steps fold to one tap-to-open row, the minimap and location card fit, the Activity tabs scroll sideways, and the hotbar slots are larger
- Leaving town no longer freezes the game for seconds: the ground textures are prepared while you are still inside, and the town ground overlay draws faster
Server
- A refused move into a full channel now answers with the same error shape as other refusals, an error message plus a zone_full code, with the status unchanged
- Chat messages are now checked more strictly on the server: control and zero-width characters are refused, runs of more than 8 of the same character are shortened to 8, messages with no letter or number are refused, and at most one link is allowed per message; length, rate and duplicate limits are unchanged
- Click-to-walk and guide routes in town now plan in about 3 ms instead of about 50 ms: only the solids near each checked step are tested, and the guide route is planned once per waypoint instead of every half tile walked
- Added a shared database layer for the global world store (`server/db/`): a store interface that SQLite now implements with no change in behaviour, and a Postgres backend with one snapshot row and an events table, one transaction per save and the same checksum, chosen with `KHELDRA_STORAGE=postgres` and `KHELDRA_DB_URL` (SQLite stays the default; Postgres is not yet opened by server.mjs and the `pg` driver is not installed)
- The bot stress tool has a `--movement intent` option (default `move`, unchanged) that walks bots with POST /intent at up to 10 a second with a rising seq per character, and its report counts intents accepted, stale and refused
- Zone stores are now wired into the server behind `KHELDRA_ZONE_STORES=1` (off by default, so nothing changes): each zone's characters and mobs are saved to that zone's own file beside the world save and merged back at boot, while accounts, gold, guilds and the market stay in the global store, which wins any conflict
- A map change between two zones that run in different zone processes now goes through the durable zone-transfer record: the source worker drops the character, the destination worker accepts it, and only then does the main process move it; if the destination refuses or does not answer the character stays where it was, and a crash part-way is finished or undone by the boot recovery (only with `KHELDRA_ZONE_PROCESSES`, no money or items travel this way)
- 61 more single-character actions (titles, item locks, talents, outfits, mounts, vehicles, companions, cooking, livestock, town interiors, quest and story syncs and similar) now undo a failed save from a small snapshot of just your character instead of a copy of the whole world; money, market, bank, trade, guild, party, dungeon and duel actions are unchanged
- After login, if the server routes your character's zone to a different address, the game page reconnects there and carries the session token in a hidden form instead of the address, only when the login included a gateway token and `/route` answers (a 404 or the same address changes nothing)
- The movement-intent route can now send a listed zone's intents to that zone's worker process (`KHELDRA_ZONE_PROCESSES`, empty by default so nothing changes); the main process still applies every move, and if a worker crashes it is logged and that zone's intents run in the main process again so no player gets stuck
- Added a prototype of running one zone as its own worker process (`server/zone-worker.mjs`, started and fed intents by `server/zone-host.mjs`), only for zones listed in `KHELDRA_ZONE_PROCESSES` (empty by default, so nothing spawns); the worker loads just its zone's characters, answers tick and intent messages, and never saves, so the main process stays the only writer
- Login can also return a signed gateway session token behind `KHELDRA_GATEWAY=1` (key in `KHELDRA_GATEWAY_KEY`, off by default); requests accept either the normal session or an unexpired gateway token for an existing account, and nothing changes while the flag is off
- The game client now reconnects to the live feed with a randomised delay (10 s doubling to 60 s on repeated failures, plus 0 to 5 s of jitter, reset when a connection succeeds) so clients do not all return together after a server restart, and with the movement-intent flag on it uses the feed's "ack" event to drop acknowledged inputs immediately
- Added a second admission rule behind `KHELDRA_ADMISSION_V2=1` (off by default, not wired into the server yet): busy-server refusals start when the queue passes 4 per active player (50 to 1000) or when the median tick over 5 seconds is slow, instead of at a flat 200 queued or one slow tick; still a 503 with Retry-After
- A new GET /route?zone=<key> route (only with `KHELDRA_GATEWAY=1`, otherwise 404) returns the address that serves a zone from `KHELDRA_ZONE_ADDRESSES` (comma list of zoneKey=url, defaulting to this server), and login also returns the zone key your character is in
- A new GET /capacity route (only with `KHELDRA_ZONES=1`, otherwise 404) lists each zone with its member count, cap and whether it is still accepting players
- Added `server/zone-store.mjs`: one checksummed SQLite file per zone, behind `KHELDRA_ZONE_STORES=1` (off by default); accounts and money stay in the single world store, and nothing is wired into the server yet so nothing changes in play
- Added a short status page for the server scaling work: which phases are done behind flags, the flags and their defaults, load results at 25, 100 and 180 bots, and the decisions still open
- Zone placement is wired into the server behind `KHELDRA_ZONES=1` (off by default): characters are placed in their map and channel at login and creation, map changes go through the saved transfer record and are finished or undone on restart, and a channel at `KHELDRA_ZONE_CAP` (default 125) refuses with a "zone full" error
- Saving a hotbar layout and turning in a Map 1 quest step now roll back only the touched character instead of copying the whole world on every request
- Large unchanged server objects can be marked stable so their JSON text is built once and reused instead of re-encoded on every response
- Movement checks (step size, speed cap and moveDebt, walkability, collision, stamina) now live in one shared module, `server/movement-rules.mjs`, used by the existing /move route with identical accept and refuse results; groundwork for the flagged fixed-rate tick, nothing changes while the flag is off
- Added an optional fixed-rate world tick scheduler (10 ticks a second, off unless `KHELDRA_WORLD_TICK=1`; `KHELDRA_TICK_HZ` sets the rate) that applies each character's latest intent once per tick, runs at most 2 ticks after a stall and skips instead of queuing when a tick runs long; not wired into the live server yet
- Added the POST /intent route and a per-character intent store behind `KHELDRA_WORLD_TICK=1` (off by default, 404 otherwise); it keeps only the newest intent per character for the world tick
- The POST /intent route has its own per-account limit of 15 a second (the client sends at most 10), so intents are not starved by other actions and cannot flood the world tick
- Added the client half of intent-based movement (prediction, input buffer, server reconcile, 10 per second sender), not yet loaded by the game and off by default
- The live feed can send an "ack" event with the newest accepted input sequence, only when KHELDRA_WORLD_TICK=1; the sequence source is a stub returning 0 until the intent module lands
- A character moving between zones now has a saved transfer record (requested, leaving, arrived, done) that a restart can finish or roll back, so no one is lost or duplicated mid-move; not connected to anything yet, so nothing changes in play
- Added `server/gateway.mjs`: a routing table from a zone (map and channel) to the process that serves it, with the local address as the default, and a signed session token (account id, expiry, HMAC from `KHELDRA_GATEWAY_KEY`) that can be checked without the world; not used by the server yet, so nothing changes in play
- Presence, feed and snapshot polls no longer scan every character: nearby players and the default character come from a per-map index, so polling cost stops growing with the player count
- The mutation queue pauses for the event loop after about 10 ms of back-to-back work, so timers, requests and the health check keep running while a backlog drains; set `KHELDRA_QUEUE_YIELD_MS` to change the 10 ms (0 yields after every job)
- The item and recipe catalogs are cached, so repeat loads cost nothing
- The live feed now keeps a per-map list of changed entity ids and each stream re-reads and diffs only those against its own last-sent copy (verified byte for byte, with a full-diff fallback), so flush cost follows what changed instead of the whole visible set; callers pass `notify(mapId, {characters, mobs, npcs, summons})`, and `notify()` without ids still does the full diff
- Idle /me polls return 304: open world events and full ore veins no longer put a moving clock in the body
- Everyone on one map now shares a single prepared copy of the nearby players, mobs and NPCs for each change, so a crowd of live feeds costs about half as much server time; each player still sees exactly the same snapshot
- Promo codes redeem once instead of twice
- Move, talk, rest, bandage, potion, attack and loot no longer re-scan every character or copy the whole world after each action: the server notes only the characters and mobs the action touched, so a busy server with hundreds of players spends far less time per action; set `KHELDRA_ROLLBACK_VERIFY=1` to cross-check it against the full scan
- The live feed is gzip-compressed for browsers that accept it and no longer sends mob loot tables or home positions, cutting feed bandwidth by roughly 99% per player; set `KHELDRA_FEED_GZIP=0` to turn compression off
- The /snapshot poll is about 65% smaller: monsters, NPCs and players are sent only with the fields the client reads, and positions are rounded to 3 decimals
- The game sends fewer requests: walking updates less often, auto attack stops swinging at targets out of reach, and staff and repair checks are not repeated
- A zone registry tracks which map and channel each character is in, capped at 125 per zone, behind a flag that is off and not yet used by the game
- With `KHELDRA_WORLD_TICK=1` the 10 ticks a second world tick now takes each character's newest movement intent, moves them one step through the shared movement rules, and the live feed ack reports the real accepted sequence; off by default and the /move route is unchanged
- Map 2 settlement positions are read from `server/maps/map2-settlements.json`; the world-expansion proposal is kept as history only
2026-10-26
Gameplay
- Hold the attack button anywhere over a monster to keep attacking, as in an MMORPG
- Tools wear down at a twentieth of the old pace
- Route clicks queue behind the current route instead of restarting it
- Bows, staves, wands and rods reach their full range when you attack
- Q and R walk only as far as your weapon needs before attacking, not all the way to the monster
- Kheldra Town is larger: the town extends further north, east and west
Economy
- A repair kit fully restores a worn tool
- Gathering tools can be stored in an equipment section, where they add no weight to your pack
- Staff can create, edit, switch off and retire promo codes from the staff panel, and each code is still redeemed once per character
- Staff can grant up to 50,000 gold to a player per command with a reason, and remove gold with a reason, and developers can mint gold with a reason; every change is logged with before and after balances
- Moving town treasury gold when the treasury is empty now reports an error and moves nothing
UI
- Resting at the Wayfarer Inn restores your health to full, as well as your mana
- The minimap shows Map 1 roads, the river and settlements
- You can accept at most five quests in ten minutes, so quests cannot be clicked through in one go
- A Mage Training Yard sits beside Civic Court in Kheldra Town
- Fallen monsters keep their loot bag visible to every player until it is claimed or expires
- Right-click another player and choose Invite to party; a party is created first if you have none
- Character, Quest Journal and Skills or Spells windows can be open together; Escape closes the top one first
- The summoning trainer sells Summon Hawk at level 20
- The M map shows Map 1 roads, the river and settlements
- Double-click a repair kit to repair every worn tool at once
- Carry weight depends on your class: fighters carry the most, summoners less, mages the least
- Mounts and vehicles carry 50% more weight and slots
- Right-click a player to invite them to your guild
- Distances are shown in steps instead of tiles
- Double-click an equipped item to unequip it
- The cursor shows the gathering tool over resources and a crosshair over monsters
- Pressing C, L, B, I, J or K again closes its window, including Stats, Skills and Spells
- Standing at a building door shows the building name before you go in
- Right-click another player to add them as a friend or ignore them
- Loot bags you cannot pick up are hidden, so the map is less cluttered
- The bank has separate All buttons: one fills from your carried gold, the other from your vault balance
Server
- Staff can inspect quests, sanctions and reports, guilds, parties and market listings, and see world event, encounter and health status, from the staff panel
- Staff can end a player's sessions, end a mute or ban early, and cancel a stuck market listing with its goods and deposit returned once
Fixes
- The staff panel no longer draws its navigation and sections twice when it is opened again while the first load is still running
2026-10-24
Gameplay
- Characters keep the same size relative to the world at every zoom level, and players are the same height as NPCs
- Map 1 ground no longer shows a repeating tile pattern: the outer terrain is drawn at a larger scale with the repeats blended together
UI
- Add a top menu bar with Character, Inventory, Skills, Map, Quests, Guild, Social, Shop and Options
- Add Party and Nearby Players panels
- The side menu on desktop opens and closes with the Menu button, so it no longer covers the minimap
- The minimap shows land, water and mountains across all of Map 1, not just around the original town
- Staff messages, events and server restarts appear in the News panel and on Discord, with 15 minutes' warning before the daily restart
Server
- Add a server-authoritative class and job progression vertical slice with fifteen hybrid trees, idempotent milestones and cosmetic titles
- Staff teleport and spawn commands can reach any tile of Map 1
- The server reports the commit it is running in its health check
- The server restarts itself after a crash, and survives internet and wifi outages instead of stopping
- The website can be hosted separately from the game server, and the game moves to its own address
Fixes
- Reduce lag spikes: town guard fights are no longer saved over and over, and the world is saved every 5 seconds instead of every 2
- Improve frame rate on slower computers by drawing the ground with far fewer draw calls
- The login message in chat shows the character's name instead of "undefined"
Website
- Add a player FAQ with 126 questions and eight new wiki guides, with contents lists, previous and next links and an A to Z index
- The privacy page says an email address is required to register
2026-10-23
Gameplay
- Add the first spell expansion: Ice Shard, Lightning Bolt, Grave Bolt, Lesser Mend, Flame Lance, Earth Spike, Healing Wave, Guardian Ward, Siphon Life, Curse Frailty, Summon Sprite, Summon Guardian, Arcane Clarity and Magic Resistance
- Add gameplay effects for Arcane Clarity, Curse Frailty and Magic Resistance, still awaiting full review
- Make repair all partial, so it repairs every piece it can afford and skips the rest
- Corpses can be raised for 2.5 minutes at every skill level
- Spells show as Locked until the school level meets their requirement, instead of Learnable
- Route planning crosses the outer Map 1 terrain, so the hero walks past the town edge
- Map 1 outer terrain uses finished textures, a feathered core edge and a soft shoreline
- Leave dungeon button under the damage counter, shown only inside a dungeon
- Characters logged out inside a dungeon for 3 minutes return to where they entered
- Maze rooms take one tap each, and number keys 1-9 take exits
- Next steps reward line names the quest giver
- Phone quick menu stays closed until opened, then slides in from the right
Server
- Add a 64 by 64 world chunk kernel, not yet wired into play
- Add a validator that rejects unsupported spell effect kinds before the trainer lists them
- Add a settlement registry for the five planned maps, not yet loaded into play
- Add a spell and skill audit of the live catalog
- Browsers cache map terrain for a day, and map responses are gzipped (a chunk drops from about 8 KB to under 0.25 KB)
- Connect every walkable part of Map 1 to the spawn, with water and mountain passes where land was cut off
- Menu pages allow same-origin scripts, so their own scripts load
- Restarts return players from dungeons, with 50 gold and 3 bandages each as a sorry
- Dungeon catalog cached in browsers
- Maze steps write no ledger event and no full save, and the logout check runs once per tick
- Welcome notice reads pre-alpha instead of playtest
Fixes
- Trim the world event ledger before loot and equipment repair, so both keep working after long play sessions
- Serve the wiki pages from the site route
- Stop a Cleanse cast with no active root, slow or poison from spending mana
- Menu pages with no character say to create one at /play, instead of loading forever
- Maze camera stays centred, so a corner spawn stays visible
- Dungeon window says Mazes and scrolls
Website
- Add a sign-in page, and link sign-in and create account from every site page
- Registration is open to everyone, with no invite code, and the homepage says so
2026-10-22
Gameplay
- Give basic spells the bow rhythm: one cast every 1.3 seconds, with no per-spell delays; the Portal spell now lands in the Town Square and checks ferries and combat tags like the portal books
- Contested extraction of Lawless Wilds gathering nodes
- Give the quiver its own worn slot
- Show item weight everywhere items are listed
- Add a Materials in inventory filter to crafting
- Batch G1: spell cadence, gather reach, corpse loot timer, quest guide X
- Show carried weight in the inventory and add the overweight speed penalty
- Let a corpse be raised for 30 seconds, longer with necromancy skill
- Stop characters gathering and fighting at the same time
- Make training targets practise continuously until stopped
- Integrate all finished feature branches
- Give the new first-town vendors greeting lines
- Staff ranks belong to characters; dev rank replaces admin
Economy
- Give paid tiers 4 to 10 bank tabs and stable slots on the taming curve, with 75 slots per bank tab
- Flag trading price outliers for review
- CORE-14 settlement project tiers, upgrade costs, and decay effect
- Reconcile CORE-24 territory and regional economies, record contested extraction gap
- Cover worker contract escrow, payout, cancel and expiry
- Live-refresh market, group finder and player bounty lists
- Remove attribute caps and gold respec; make confirm prominent
- Add readable messages, wait countdowns and repair and buy guards
- Batch G2: shop, tooltips, modal frame, Esc, markers, settings
- Add shared item context menu for inventory, equipment, bank and shop
- Add a Repair all button with a cost tooltip to the inventory sheet
- Seed NPC market with level 10-50 weapon and armour
- Record owner decision to keep supporter decor, stable display and bank tab slots
- Call the free tier Adventurer
UI
- Regenerate art catalog with needs-visual-review records
- Show the item tooltip on every item window
- Lift the NPC card above the phone touch controls
- Polish the guild hall window for phone and desktop
- Restyle the NPC card as a Quest Journal page
- Live-refresh HUD iframe pages on state change
- Move attribute effect text into tooltips on the stat name
- Add a Who's online menu link and show revival time from the server
- Update the double-click assertion for the armed unequip
- Refresh open windows live after every state refresh
- Close crafting chain gaps, nail quest units, NPC speech, and map tab
- Walk up before opening doors, boxes and objects; route far clicks around corners
- Port referenced courier-sites-d assets from art/courier-sites-d-gpt6-20261017
- Port referenced ambient-insects assets from art/agent-ambientinsects10f-20261017
- Wire mail, gallery, weather and emote routes with Features tabs
- Bring modal dialogs to the WAI-ARIA dialog standard with a shared focus helper
- Wire caves, summon expiry, day/night, xp-loss, production plan, pack layout and showcase into server and Features tabs
- Log characters out after 10 minutes out of focus
- Ask for a missing account email and let the legacy register panel send one
- Add a Nearby caches tab to the Features hub
Server
- Show live uptime, players online, memory, event-loop lag and server errors on /health and the status page, with one-hour charts
- Pin ecology respawn floor, grace and per-character discovery
- Pin advisory alt detection
- Pin existing PvP escape rules
- Pin party encounter budgets
- Pin solo raid reward parity
- CORE-11 entry warning, combat-tag logout refusal, and safe-zone tests
- Lock CORE-07 adopted companion rules (loyalty bounds, rabid departure, re-tame)
- Adopt best-practice defaults for open design decisions
- Propose inferred rules for partial CORE items
- Propose power grid and contested extraction design with open owner decisions
- Reconcile CORE-19 power, storage and maintenance as existing components
- Reconcile CORE-04 archery and ranged combat as already implemented
- Pin solo/guild endgame ascension parity
- Add current main audit for 2026-10-22
- Separate production release gates from gameplay scope
- Finish guild hall server rules and audit log
- Update the death-splash test to the no-checking rule
- Every water body has a fishing spot
- Keep one location per account; refuse a second IP while a session is active
- Allow one active session per account
- Port cosmetic monetization spec, checklist and idea inventory
- Make clock-sensitive tests deterministic
- Make server test harnesses reliable under load
- Wire racing, tournaments, festival, contraband and speedrun into server routes
- Expose the abuse ledger report on a dev-only route
Fixes
- Resolve 390px mobile HUD overlaps
- Block movement into town NPC footprints
- Align PvP zone loot copy with owner decision
- Guard load-time localStorage reads so storage failures do not block play
- Harden journal, inventory and HUD layouts for narrow and short screens
- Fix shop card layout on narrow and wide screens
- Fix play.html element order after dialogs-a11y merge
Website
- Import the draft art for 44 registered cosmetics and emotes; nothing is for sale yet
- Describe the paid tiers by their bank and stable allowances, not by price alone
- Withhold cosmetic and emote sales until their art is approved
- Add a Manage subscription button that opens the Stripe Customer Portal for subscribers
- Link the community Discord from the site navigation and every page footer
- Move account creation to a website page and a dialog on the login screen
- Site: art on every homepage card, rename Join to Join newsletter
- Show the supporter tiers on the store page
2026-10-21
Gameplay
- Monsters wander near home; town guards show a blade cut when they strike
- Add backlog wave: weather, caves, mail, tournaments, talents, siege and wiring
- Flag suspicious offline job patterns
- Minigames: fill end-to-end gaps across all board and expansion games
- Minigames: shared framework, hub and 25 games with capped rewards
- Move Android material out of the Kheldra repo
- Gameplay expansion catalogue and agent task board
- Explain dungeon exit when /stuck is used inside a dungeon
- Game item fixes round 1 and 2 (checkpoint)
- Exclude flat images from near-duplicate clustering
Economy
- Record approved membership pricing
- Approve four tier prices and rank proposed entitlements
- Stock first-town gear for levels 1-25
- Let arrows fill the shop stock; cap them by quiver, not weight
- Show the early-revival price on the death screen
- Close out economy work and remove dead listing fee
- Remove unused 5 percent market tax and close launch wipe item
- Record owner decisions on economy open items
- Make merchant purchases server-authoritative and idempotent
- Fund offline wages from reserves and charge exchange fees
- Add server-side economy config
- Add retention principles to economy doc
- Add read-only economy telemetry
- Add idea register with float and sink criteria
- Revise economy and monetization doc
- Systems: quality tiers, tool wear, lore, moods, notices, shrines, auctions, repair tax, guild rites
- Finish partial item fixes: sell prices, tracker removal, monster drop sources
- Bank rows show item tooltips
UI
- Warm the daylight world and keep lantern light on by day
- Keep the phone menu sheet clear of overlays without relying on :has()
- Five character slots, with empty slots shown; switch, log out and all windows in the menu
- Add staff ranks, moderation and staff controls in the menu
- Polish phone menu, GM item caches, and finish the backlog polish pass
- Hide joystick until touched and keep quest markers off dialogs
- Add who's online tab with all, friends, guild and party views
- Free up map space on phone screens
- Add feature hub and client tabs for the held backlog systems
- Run queued game-host updates in a quiet US window
- Minigames: verified detail, rules for MG-28 to MG-33, cosmetic overlays
- Round 3: timed crafting queue, weights and carry limit, click-to-approach, U panel, settings groups
- Dungeon entry: arrow-key movement, entrance art and new Crypt location
Server
- Link 50-product draft catalog to decisions register
- Draft 50-item cosmetic catalog with SKU and release gates
- Resolve payment provider and catalog ambiguity
- Reconcile monetization decisions and archive policy
- Require an email address to create an account
- Share terrain by reference in rollback copies
- Pin durable saves in HTTP tests that read the save file
- Turn on write-behind persistence by default
- Add held backlog features and wire them into the server
- Approve dual Kheldra and Open Faldon community outreach
- Add queued remote restart and update for the game host
- Ignore deploy/.env so VPS secrets stay out of git
- Ignore stray save folder created when the server starts from the repo root
- Weight limit covers remaining item paths
- Hide gather nodes on cooldown from the navigation index
- Add CC0 license records and asset pipeline docs
- Add license-gated asset sourcing pipeline
Fixes
- Fix phone layout overlaps on play screen
- Correct purchase atomicity reference in economy doc
Website
- Leaderboard: account creation counts on the site and in game
- Add back-to-main-site links to the login card and character screen
- Show players online and their rank tiers on the homepage and login
- Add GM role, GM commands and a sitemap page
- Restyle site to the game palette and remove placeholder copy
- Redesign the public site with game art and a clearer layout
- Add daily economy report and playtest prep
- Add Kheldra Discord invitation and community outreach copy
- Add Google Analytics to every page and a sitemap
- Replace reset wording with no-wipes policy and add legal and backup docs
- Add safe public domain deployment and operations runbook
- Add store page with no sales before launch
- Remove reset wording from refund policy
- Add refund minimization section to economy doc
- Root serves the landing page; the game moves to /play
- Landing page, video navigation and newsletter sign-up
2026-10-20
Gameplay
- Unified XP curve: one shared slow curve for characters, skills and spells (L5 about 1h)
- Record the worn-equipment report as closed by the owner, not reproduced
- Add MMO improvement review
- Loot refusal says when it opens to party/everyone
Economy
- Dock: 4-column grid, icons for Awards, Market, Group finder and News, caption hidden
- Attribute points on level-up, soft caps, token/gold respecs, milestone free respecs, webhook-safe token grants
- Economy sinks (bank, repair, crafting, market, upkeep ledger), lumber value offset, moderation and admin console, server.mjs wiring, proxy-aware client IP
- Balance pass 2: slower XP curves (L5 ~1h), grandfathered migration, gold sinks, opt-in XP loss model
- UI fixes from feature tour: shop open after approach, crafting layout, Awards dock label, chat tabs, onboarding scroll, empty icon manifest
- Prune settled gold offers after an hour
- Duels (server), economy abuse watch (dev-token flags + offline report)
- Server fixes from HTTP sweep: first-move allowance, clearer purchase/equip errors
- Achievements and titles, market search, group finder; mobile/toast/journal CSS fixes
- Auto-loot, Loot all (F), bank sort
- Chat: global and trade channels with rate limits, tabs and commands
- Shops: 10,000-unit shelves refilled by the next 1-minute tick
- Shop: show restock as relative time
- Shop modal: MMO-style one-line rows, purse header, clear tabs
UI
- Prune third-party art to what catalog items actually use
- Wire DustyChest CC0 icons; bring in asset-sourcing records, registry and candidate catalog
- Stand-in icons for nearly every item, plus 2026-10-21 docs
- Death splash fix, fixed character size on zoom, docs refresh
- Pre-grade raster props and actor sprites once instead of a ctx.filter per draw; record performance notes
- Prefetch the crafting recipe book so the window fills in at once
- World map default size, death splash copy matches its buttons, record map and playthrough findings
- HUD: top row no longer swallows canvas clicks
- Journal Map tab opens the world map instead of toggling it straight back closed
- Document compact HUD; note phone layout and crafting load gaps
- Compact HUD: small one-row hotbar, icon-only dock, tight activity panel, smaller windows; prune stale tracked quests
- Account recovery: optional email, verification, password reset, mailer abstraction, login UI
- Trusted proxy and bind host settings
- Compact world saves, quest names in tracking toast, playtest guide
- Label gear with the play style it suits and warn on a mismatch; record owner reports
- Wire pack 004: 23 alchemy and gathering icons; add worn-equipment persistence test
- Wire NPC roles through the shared resolver, tint painted sprites per role, painted ranger portrait
- Client: onboarding checklist, duel UI, chat/help/friends/settings updates, tester CSS fixes
- Wire pack 003: 14 ingredient and cooked-food icons; seeds get no produce icon
- Write up provisional art approvals with evidence, limits and backlog coverage
- Wire pack 002: 24 food and potion icons; replace earlier potions, bread and raw fish
- Record art handoff pack triage in open-work doc
- Record provisional approval for wired item icons and HUD badges
- Wire 16 common-item icons into inventory art; fix hammer matching cooked meat
- Wire painted HUD dock badges (backpack, quest, spellbook, gear) from art handoff pack
- Painted world sprites for all 70 NPCs (per-NPC lookup); cutter fragment cleanup; cursor test matches SVG cursors
- Painted icons for the 7 missing spells; item icon pack loader
- Icon sheet batches for all item templates; cutter --all mode
- Icon sheet cutter (magenta key, trim, 128px) and batch lists for remaining hand-authored items
- Housing: distance check on build/demolish + tests; audio recipe tests; art catalog keeps provenance
- Gather cursor icons over ready nodes; ComfyUI icon generator script (samples unreviewed)
- HUD: experience bar under stamina
- Tracker drops completed quests
- Spell trainer: Learn buttons + NPC action; click dungeon entrances to enter; harden sorts
- Restore painted character art: extract approved atlas poses
- Keep hold-attack block ahead of click handler (test regex)
- Loot windows (owner 2m, party 5m, all 20m); hold-to-attack; legacy sound respects mute; brighter town ground; slim chat panel
- Esc with nothing open opens Settings; default to full daylight, softer night tint
- Show character/skill levels in crafting, skills, spells and abilities windows
- NPC dialogue: Track/Untrack button for the shown quest
- Crafting book: side tabs with All, search keeps focus, craftable-only checkbox
- Art tests: count character families separately from item-icon samples
- Art generator: item-icon recipe and 20-icon unreviewed sample (not wired into client)
- Art generator: --replace only overwrites files it generated
- NPC modal: full quest text, hide overlay markers
- UI: hide empty message-log backdrop; NPC dialogue as centered modal
- Overnight work: real-browser QA fixes, reviews, world map, loot, spells, mob AI, chat/friends/bounties, perf and security fixes
- Overnight checkpoint 2: chat, friends, bounties, dungeon book, settings, loot tables, spells, mob AI, UI smoke tooling, eval-free client
- Overnight checkpoint (new files): tests, docs, asset scripts, tools, art
- Overnight checkpoint: balance passes 1-5, gear levels, potions, quests, UI books/windows, flows tests, audits
Server
- Make the CI workflow manual-only (workflow_dispatch)
- Add community ideas doc
- Launch kit: CI workflow, backup/restore tools, Docker/Caddy/systemd deploy kit, deployment and operations docs
- More tree nodes: forestry and mining reach L5/L10/L20 within ~12%; sim skips depleted sites
- Add launch preparation checklist
- Single tracked quest with a quick switcher; sliding login sessions
- NPC placement audit + test; move Brook Fisher to the mill pond; re-carve NPC pockets for saved worlds
- Stop archiving per-tick mob wandering in the event ledger
- Remove unused exports
- Cut per-mutation and per-tick world cost: cheap rollback snapshot, skip idle persists
- Archive finished docs under docs/archive and rewrite references
- Close open items: home build reach, land reclamation notices, factory demolish control, open-work doc
Fixes
- Deactivate stalls on failed renewal per owner policy
- Fix hotkey clash (achievements on H), document new systems and keybindings
Website
- Link art sourcing docs from the index; mention Credits in the player guide
- Plot-site validation, titles in party/guild, rename flow, duel spells, UI verification fixes (CSP img blob, level-up toast curve, attribute styles), docs
- Attribute points affect real pools, level shown from XP, CC BY icons wired, /credits
- Add dry-run marketing scripts for Discord, YouTube and Instagram
- Block duplicate live sends in marketing scripts
- Test hardening: scripts, dev-state analytics salt redaction, dungeon-flow timing
- Wire UI tag and redraw backpack when painted icons finish loading
- Player tools (invites, feedback, analytics, news), legal pages and site, write-behind persistence (off by default), 339 painted item icons, test hardening
2026-10-19
Gameplay
- Actors keep a standard size when zoomed in and shrink only when zooming out
- Group skills into paged categories (Combat, Magic, Gathering, Crafting, Support)
- Implement owner-approved factory placement policy
- Implement owner-approved land reclamation and release policy
- Tell players which PvP zone they are in
- Size factory footprint to comparable starter buildings
- Pin the no-seizure invariant for homes and guild land
- Stop combat-tagged players escaping into the protected town
- Confirmed voluntary release of guild land
- Cover the farm and livestock loop end to end
- Make every implemented spell castable from the client
- Smelting needs one ore, reachable from Workshop Scrap
- Let owners withdraw stored factory inputs
- Add remaining spell effects: town portal, grave command, soul bind, wisp summon
- Define missing items and give generic materials real sources
- Update hospital and factory gameplay status
- Add owned factory production loop
- Update hospital verification evidence
- Cover hospital patient reach and capacity
- Filter hospital patients by treatment reach
- Keep hospital evidence count current
- Document cooperative hospital implementation boundary
- Cover hospital supply and treatment rules
- Add cooperative hospital service
- Document supported healing spells and cast failure safety
- Cover greater Mend gameplay
- Verify dismantle then release conserves materials
- Allow safe dismantling before home release
- Clarify waystone pacing versus spell cooldowns
- Document implemented spell effects and XP awards
- Keep PvP spell attacks on shared cadence
- Remove spell cooldowns per gameplay direction
- Implement safe voluntary home release
Economy
- Gameplay polish batch: bank box at the door, book-style stats/skills/spells, dock slide-away, gear overlay, hover tips, zoom, nameplates
- Batch movement reports, sell values, potions, spawn ring, catalog fixes
- Book-style quest journal, visible town walls, route distance, shop sort/filter and layout fixes
- Share merchant stock across players per NPC
- Owner-approved PvP item loss (#149) and stall suspension rule
- Implement owner-approved physical stall rent and sales fee
- Prove physical stall trades conserve coins and items
- Cover farmed hay buying and feeding a mount
- Verify concurrent stall buyers settle a listing once
UI
- Slim compact window frame and tighter journal/book spacing
- Maximise modal windows, add character portrait with gear slots to Stats, fix character card test harness
- Polish login and character screens: town backdrop, framed cards, password toggle, remembered account name, character cards
- Abilities rebuilt as a paged book; new beginner-friendly Crafting window (N / dock)
- Tracker: raise above the HUD and confirm with a message when tracking
- Add HUD tracker with Track buttons; richer quest, skill and spell detail
- Group spells into school pages (Destruction, Restoration, Necromancy, Summoning)
- Compact NPC dialogue card
- Journal retheme and scrolling, minimap NPC names, world-map NPC info panel, route fixes
- Rebuild quest journal: region rail, searchable/sortable contents, one page per quest with Accept and Guide
- Redesign quest journal with status tabs and badges; move second-bar toggle beside hotbar
- Enlarge town 5x with role-placed NPCs, texture-built ground, world map and painted art
- Rebuild inventory as a single window; instant tooltips; bow auto-defend
- Add combat feedback, usable world objects, world skills, new-player guide and painted art
- Add RuneScape-style interaction loop, two-bar hotbar and world geometry rules
- Add game HUD, map 1 collision data, new-player hotbar and polished screens
- Update generated production art manifests and SVG assets
- Smooth movement, inventory interactions, vendor merging and town ground
- Record in-repo provenance for botanical-icons-c assets
- Backfill art provenance from folder manifests
- Connect committed NPC role portraits from the approved concept atlas
- Port world light and map-edge feathering, unify world labels
- MMORPG HUD theme pass, readable nameplates and phone hotbar
- Add community hospital care panel
- Align spellbook UI with no-cooldown casting
Server
- Add placeholder asset hooks for overnight agents
- Path guide for Guide targets and tracked quests; idle stamina regeneration on the server
- Add load bot, throwaway-server runner, cost benchmark and scaling plan
- Pin quest event de-duplication and replay protection
- Record 2026-10-19 owner decisions for open gap items
- G0 lane: verify and harden startup, saves, backups and restarts
- Legacy save without terrain migrates and keeps character data
- Character state survives graceful stop and abrupt kill (G0-13, G0-15)
- Rehearse backup, damage, restore and restart with a real character
- Factory placement over HTTP, with retries and refused sites
- Add current-main audit pinned to 0960cd56
- Refuse factory sites on claimed homes and guild land
- Farming loop from seed to recipe, with live HTTP evidence
- Validate factory footprint before construction
- Reconcile spell effect status and add summon lifecycle test
- Reconcile spell effect status with implemented kinds
- Triage remote branches with no PR
- Add current main audit pinned to 9067bff7
- Resolve audit findings and integrate gameplay branches
- Skip identical SQLite world writes
- Ignore server runtime data directory
- Realign stale town fixtures with current footprint and terrain
- Consolidate gameplay slices and server safeguards
- Reject a competing SQLite server process
- Test owned factory production lifecycle
- Test hospital capacity and ledger atomicity
- Test rejection before first SQLite world save
- Verify the active writer stays authoritative
- Document quest acceptance and event-ledger requirements
- Cover quest acceptance ledger failure atomicity
- Require a writable event ledger before quest acceptance
- Cover repeated authenticated spell casts
- Test SQLite server exclusivity and crash recovery
- Reject concurrent SQLite world servers
- Test spell ledger failure atomicity
- Reject spell casts when event ledger is unavailable
- Verify greater Mend tops off and rejects at full health
- Cover authenticated home release over HTTP
- Test immediate repeated world spell effects
- Test complete home release asset recovery
- Wire town armorer starter catalog
Fixes
- Fix quest journal list rows collapsing into each other
- Explain a corrupt save and leave it untouched
- Fix courier marker 404s and the dead art runtime tag
- Stop 404s from courier markers and the dead art runtime tag
- Give farm seeds a source so crops can be planted
- Move browser session token from sessionStorage to HttpOnly cookie
- Block archery shots through overworld terrain
- Sandbox generated HTML and SVG assets
- Validate account identity in character ownership checks
- Block movement through solid town interior furniture
- Server review hardening (tests, dev-state redaction, event ledger, stamina, receipts, worn-copy trades)
- Block trading or storing worn copies that would mint durability
- Bound event ledger, honor regenerated stamina, retain retry receipts
- Make server test suite green and redact dev state dump
2026-10-18
Gameplay
- Implement graveCommand targeting for active necromantic summons
- Apply Soul Bind damage mitigation to normal and heavy enemy attacks
- Use actual progression skill XP and learned spells in regression fixtures
- Add regression coverage for frostbind and battlefield revival
- Apply frostbind immobilization to enemy pursuit and return AI
- Keep inventory open during equipment refresh
- Show early revival payment feedback
- Extend wilderness loot grace to fifteen minutes
- Make defeated monster loot auto-approachable
- Show equipped projectile stack quantity
- Add resource tracking to world finder
- Preserve full projectile stacks when equipping
- Add safe relocation for overworld mobs near town
Economy
- Test dungeon-local wisp summoning and encounter membership
- Clear legacy merchant cooldown display
- Allow purchases while merchant stock is available
- Normalize merchant stock and restock policy
- Show exact equipment repair materials
- Add ore merchant stock
- Price loot by item value
UI
- Add character inventory hotkey
- Double click bandages to heal
- Toggle modal hotkeys
- Enable right click resource gathering
- Expose stats and progression tabs in character panel
- Use approved painted art and gate unreviewed assets
Server
- Add townPortal destination and cooldown regression test
- Implement townPortal spell with safe-travel checks and destination validation
- Cover wisp summon lifetime and duplicate-slot rejection
- Implement summonWisp spell with timed server-side summon and slot validation
- Add regression tests for frostbind enemy pursuit and leash movement
- Cover forged identity and downed interior NPC access
- Cover all town door ranges and malformed interior/recovery states
- Reject invalid character state for town building access
- Protect death timer from repeated down events
- Cover death revival and town interior entry exit boundaries
- Cover owned character creation boundaries and rollback
- Record owner testing approval and starter town completion
Fixes
- Fix summon wisp positioning and encounter membership in dungeons
- Enforce identity and living state for interior NPC services
- Harden basic gameplay state and ownership boundaries
- Reject invalid death and health states before town interactions
- Make repeated death notifications idempotent
- Validate health state before death and revival mutations
- Reject inherited and unsafe character keys in town building actions
- Validate character creation inputs before mutating world
- Correct mainline SQLite status and missing hospital factory modules
2026-10-17
UI
- Optional authoritative terrain visibility for overworld combat