Combined admin / Free-credit release preparation

Historical preparation record, September 12, 2026. The owner subsequently authorized the release, which is now deployed. Use the September 13 production release record for current flags, dates, deployment identities and checks. The off/unset flags and remaining-work lists below describe the earlier preparation state, not current production. The credential rotation and Neon restart / ClickHouse connector setup are also complete and must not be repeated.

Owner actions

No new service, billing setup or credential submission is currently needed. Both Stripe accounts, OpenRouter, ClickHouse, private Redis and PostHog export already work.

The owner confirmed the announcement was published and later explicitly authorized applying the release. No further announcement, approval, billing setup or credential submission is pending. New accounts switch September 13 at 01:04 UTC; the existing check-in cutoff remains September 20 at 20:00 UTC, with individual cycle handling as documented in the production release record.

Display all reset, expiry and rollout times in UTC or the viewer's local timezone with a timezone label. Do not present a regional reference timezone to users. The reset is one global instant: daily at 20:00 UTC, and the agreed existing-account policy cutoff is 2026-09-20T20:00:00Z. Localization changes only the display, never eligibility, expiry or the reset instant. Personal monthly cycles remain individual.

The completed credential rotation covered the web replicas, game runtime, GitHub recovery job and local production configuration; see its verification record. The analytics worker has no production DATABASE_URL. The new ClickPipe uses a separate replication credential. Better Auth and encryption secrets were not changed.

Rechecked live dependencies

• Railway yumina-analytics remains healthy on the existing deployment. Private Redis confirmed; no production DB credential; CDC remains false.
• Corporate Stripe: 3,290 balance entries / 2,778 distinct charges; 2,775 exact payment dimensions, three partial.
• Legacy Stripe: 324 balance entries / 150 charges; all 150 exact. Accounts Read returns 200. No old-key action remains for the owner.
• PostHog: 18,378 imported signup events through September 12 08:59 UTC. These are event counts, not the account denominator.
• The worker has now published a report, so health.ready is true. This does not mean all five reports or the source database import are ready: CDC is still disabled.

Prepared code

Finance detail contains customer averages, the proportion with negative play contribution, 95th-percentile and largest observed shortfall, and a separate full-allowance scenario at observed charged-play mix. Cohorts use purchases in the selected period, include pack receipts, and keep missing costs unavailable. Multi-plan customers are explicit. Capacity is not labeled a hard maximum. These calculations run in the background warehouse worker, not on admin navigation.

Free changes are disabled by default. The rollout resolver separates signup time, the shared check-in cutoff and personal cycles, while keeping paid entitlements unchanged. Initial grants, renewals, plan-sync receipts and pack grants are transactional. New Bonus has indexed lots and fixed expiry; existing addon stays protected as Saved. Compatibility keeps the existing aggregate addon column as Bonus + Saved so existing positive grants and cycle resets preserve both. It is a storage compatibility detail, not a consumer label.

The billing page, desktop/mobile profile dashboard and Mushies popup now share one three-color wallet component. Full pages show Monthly / Bonus / Saved amounts, reset/expiry groups and upcoming personal policy dates without requiring extra taps. The popup always shows the next Bonus expiry. A missing breakdown shows an explicit unavailable state rather than labeling combined addon funds as non-expiring Saved. Mounted wallet surfaces refresh on return, expiry and minute intervals; concurrent reads coalesce, and post-mutation refreshes supersede older requests.

English, Simplified/Traditional Chinese, Japanese and Spanish labels are included. Billing no longer promises that every check-in/invite reward never expires; purchased packs and protected existing rewards remain Saved. Its Free offer switches both the monthly amount and recovery floor/cap from the server's launch setting, while the promotion banner explicitly describes paid plans. New check-in tiles use the applicable schedule; claimed tiles retain their recorded amount. Referral forms and the signup invite modal show the new amount and expiry before claiming; outdated terms are rejected before issuing credits. Pending invite codes are retained until the user reviews the new terms. Gift receipts identify expiring portions.

Spending allocates earliest expiring credit first. Transfers preserve new expiring funding and have a reviewable funding split; the server rejects an outdated split. Monthly gift cap checks are inside the two-wallet transaction. Existing pack exemption and inviter milestones are not silently redesigned in phase one. Failed-request refund support preserves source/expiry, grants a single 24-hour grace lot when necessary and is idempotent; no automatic new charge/refund policy is enabled.

Release switches — all off / unset

• WALLET_BONUS_COMPAT_ENABLED: false by default. Enable only after additive schema and compatible clients exist; keep it on once Bonus exists.
• FREE_CREDIT_POLICY_ENABLED: false by default. No reductions until explicit activation.
• FREE_CREDIT_POLICY_LAUNCH_AT: unset; must be an explicit UTC instant.
• FREE_CREDIT_POLICY_EXISTING_AT: unset; proposed 2026-09-20T20:00:00Z.
• ADMIN_ANALYTICS_ENABLED and ANALYTICS_CAPTURE_ENABLED remain independently controlled.

Adding a third visible bucket must never be rolled back to code that describes all addon as non-expiring. Pausing new issuance is different from suspending disclosed expiry; a grace extension must be applied consistently to read/spend paths and announced if needed.

Work remaining before the switch

The replacement application login is live across the verified consumers, the old password has been retired, and Neon's replication restart is complete. The ClickPipe is Running with its initial snapshot and canonical views prepared. These completed steps do not need repeating; see the connection results.

1. Local browser and compiled-server rehearsals pass. The real-service pass verifies two app instances on PostgreSQL 17.11 / Redis, concurrent grants/gifts/recovery, both Linux images, the web's normal startup command, and the compiled Linux worker. The temporary VM CPU issue is resolved; an analytics-table startup race was fixed and retested. Two replicas of the compatible binary were tested; this does not authorize mixing an older Bonus-unaware binary into issuance or certify Neon's pooler. See the real service verification.
2. Apply prepare-free-credit-policy.sql and the matching revised daily recovery function only in the reviewed deployment sequence. Neither has been applied to production. Reconcile balances and source groups before enabling issuance. Frozen cycle terms are shared with the SQL recovery function. Legacy 1,000-credit wallet rows are not mistaken for new policy. A recovery update skips concurrent balance/plan/cycle changes rather than overwriting them.
3. Main-branch integration through 4c362c546 is complete. Recheck drift at release time, build release images and deploy compatibility/capture with new admin and Free reductions still disabled. Purge/reload stale clients before exposing expiring rewards.
4. The credential/restart/connector steps and retained-history reconciliation are complete: 4,125,659 credit entries and 4,939,868 usage records matched through September 12 00:00 UTC. During the separately approved application release, enable and verify genuine capture, then complete worker CDC readiness and production snapshot checks. Keep admin and Free reductions off until their separate gates pass.
5. Both Stripe ledgers and OpenRouter totals reconcile. Three corporate payments totaling $15 remain explicitly unmapped to users. All 21 report/period combinations passed the real-data rehearsal after query-memory and cutoff fixes. Historical per-request cost and foreground time remain unavailable where never recorded. See the live-data verification for current results and limits.
6. The owner has published the notice. After release approval, activate the new-account policy at the declared launch instant, and expose the new admin after its readiness checks. Existing earning changes follow their notice/cycle dates. These are separate switches within one coordinated release, not one irreversible switch.
7. Check wallet differences, duplicate operations, stale reports, p95 latency, retained play and financial gap. Generation reservations and future qualified-referral rules remain phase-two work; do not include their savings or eligibility changes in this release announcement.

The owner's remaining role is agreeing to the application release and activation timing. The announcement is already published. The technical preparation, migration and verification work above stays with the implementation; no further database setup is currently needed from the owner.

Validation completed locally

• After the owner's announcement confirmation, 22 wallet checks passed: five-locale rendered disclosures, grouping equal expiry dates, the next-expiry preview, empty/missing breakdowns, concurrent reads, stale responses after purchases/debits, and existing balance-health/popup regressions. Billing and both profile layouts share the component. These additions were checked through rendered DOM and code/build validation; no new browser session was opened.
• Full monorepo typecheck: eight tasks passed. Full production build: five tasks passed. Existing large-chunk warnings remain; they do not establish dashboard latency.
• Six focused tests passed, including real wallet operations in disposable in-memory PostgreSQL (PGlite): initial grant deduplication, paid plan preservation, claim-lot uniqueness rollback, debit retries, earliest-expiry allocation, expiry, refund retries and the one-time expiry grace.
• The same isolated database executed the revised recovery SQL function: legacy Free floor 200, frozen new Free floor 100, Gold floor 500, daily idempotency and 500-cycle cap. PGlite's built-in SHA-256 supplies the digest function in this fixture; production pgcrypto installation remains a staging check.
• Disposable ClickHouse integration passed, including the actual customer-economics warehouse query and existing report reconciliation fixtures. The test database was removed afterward. This checks calculations against known fixtures, not full production data completeness.
• With the owner’s explicit authorization, desktop/mobile browser checks and real authenticated endpoint rehearsals are now complete. See local release verification for current results and their limits. No production policy DDL/function, deployment, reward activation, restart or credential rotation occurred in this preparation.

Earlier connection audit and local integration status: September 12 stack audit. Restart and rotation subsequently completed, as recorded in the connection results above. Application deployment and policy activation remain deferred.

The four wallet policy tables are now represented in Drizzle as well as the separate SQL installer. This prevents future schema maintenance from proposing removal of the side tables. A schema test verifies columns, named constraints, cascade rules and indexes against the installer.