Admin and Free-credit production release

The owner authorized applying the release after confirming the announcement was published. This record supersedes the earlier hold in the preparation notes. All times are UTC; user-facing dates use UTC or the viewer's local timezone.

The new admin and three-part Monthly / Bonus / Saved wallet are live. New-account Free terms activated at 2026-09-13T01:04:00Z, with the first natural signup and check-in verified at 01:08. Existing-account rewards change at 2026-09-20T20:00:00Z; monthly/recovery changes follow the first personal cycle starting on or after that cutoff. Paid benefits remain unchanged.

Completed

• At 00:31, applied the four additive wallet tables and the revised daily recovery function under yumina_schema_owner. In one repeatable-read transaction, all 31,263 wallet balances, aggregate addon balances and monthly allowances matched before/after. No existing credits were reclassified or expired. Primary and game-runtime public health checks remained successful.
• Preserved prior service settings and deployment identities in the existing encrypted local credentials store. The old recovery function definition is retained in an ignored local file.
• Staged web compatibility and analytics capture, with admin visibility and Free reductions still disabled.
• At 00:32, pushed release commit 52be2c6b83c5b948b630e140883bcad1bded907e to main. It was a fast-forward from the production base; no main-branch changes were discarded.
• Uploaded an isolated, tracked-files-only analytics image context from that same commit. The analytics worker holds no production PostgreSQL URL.
• All three deployments succeeded. Both web replicas report the new commit, healthy primary/read/Redis connections, enabled capture/compatibility, and disabled policy/admin flags. Anonymous analytics requests return 401.
• Cloudflare HTML paths were selectively purged. Home, index, plans, profile and admin return the new frontend with no-store headers.
• Verified natural play intervals, source heartbeat and post-cache provider costs flowing into ClickHouse. Three sampled real usage records matched token counts and exact decimal cost; their source-to-warehouse delay was about 14 seconds. The connector remains Running with about 1.5 MB of retained WAL and no recent warehouse query errors.
• At 00:37, enabled CDC on the analytics worker. It is building all 21 report/period combinations. Report reads use Redis; warmed checks were approximately 2–4 ms. Historical provider-request costs and play time remain explicitly incomplete; no invented backfill was added.
• The live wallet audit found 339 recorded spending allocations, no mismatched Bonus aggregates, and all newly frozen existing Free cycles still at 2,000 monthly / 1,000 recovery. No Bonus lots existed yet.
• Corrected Japanese recovery help to refer to the current cycle's recovery cap, rather than equating it with monthly credits. App typecheck/build and JSON validation passed.
• At 00:53, all 21 production report/period combinations were present and passed schema, source-coverage and financial arithmetic checks. Retention includes six cohorts, April–September, in daily/weekly/monthly activity and token views. The all-time atlas contains 500 worlds and 3,000 shared-player edges.
• Deployed final app commit 1cd9ef70bce5ed72b0436b44fcf5c6ea44fa3034, enabling admin, compatibility, capture and the timed Free policy. Both web replicas passed checks at 00:57: primary, read replica, Redis, matching frontend asset, all 21 reports, and anonymous-admin denial.
• Enabled worker platform health checks (/health, 120-second startup allowance), 90-second draining and 10-second overlap. A redeploy failed before starting a container because it fell back to a non-Docker build. Re-uploading the clean source context succeeded; the existing worker and reports stayed available. Persisted Dockerfile.analytics in service settings and RAILWAY_DOCKERFILE_PATH for future builds. The Cloud API does not accept DOCKERFILE in its Builder enum or a new legacy config-file path; those rejected updates made no changes.
• The replacement worker retained all 21 snapshots, acquired the lease, and resumed publishing. Its actual process has analytics and CDC enabled. The worker still has no production database connection.
• The running app passed seven pure configuration-boundary checks: before launch, new Free at launch, protected existing Free, existing reward cutoff, next personal cycle, unchanged Gold, and downgrade to Free after the cutoff. September Bonus expires October 31 at 20:00 UTC. These checks used the deployed binary and environment without changing user data.
• A subsequent live all-time customer-economics refresh exceeded the original 1 GiB query limit. The cache retained the previous complete report. The ClickHouse containers each have 16 GiB; set the importer to a bounded 2 GiB per query and 3 GiB per user, retaining the two-thread / 60-second / no-DDL restrictions and using 128 MiB external aggregation/sort thresholds. The exact failed query already uses 64 MiB grace-hash joins and grouping; it passed under the revised budget in 24 seconds, returning 20,331 aggregate rows. Restarted only the worker to refresh the failed report promptly. No database or application restart was needed for this correction.
• By 01:02, the worker published a fresh all-time finance report after the budget correction. All 21 reports remained available throughout; the stale finance report was replaced by a successfully computed result, not relabeled as fresh.

Deployment identities

Service	Release deployment
Web	17dcc3f9-3398-4609-8d04-4cf380a698bd
Game runtime	c7df1052-d532-41a9-b1b9-fedc7b92ad04
Analytics worker	44130241-071c-47c3-8756-83075e95e35c

Final production verification

The first natural signup after launch received exactly one 1,000-Mushie initial ledger grant and frozen terms of 1,000 monthly / 100 recovery floor / 500 recovery cap. Its first check-in created a 50-Mushie Bonus lot. Existing frozen Free cycles remained at 2,000 monthly / 200 recovery floor / 1,000 recovery cap. The audit recorded 1,495 allocated spending operations and no Bonus-to-wallet mismatches. This used real user activity; no synthetic production account or test charge was created.

Both web replicas, runtime and worker are healthy. Both web replicas have matching launch/cutoff settings and all 21 report snapshots. All finance periods were refreshed after the memory correction; slower token-period refreshes retain their last complete result with an explicit stale state until the next publication. Warmed report reads in the final web check were at most 13 ms inside the service; this is not a browser page-load or end-to-end API benchmark.

No owner action is required. No further database restart or credential rotation is pending.

Recovery constraints

Keep wallet compatibility enabled now that expiring Bonus exists. Do not roll back to an older build that describes all addon credits as non-expiring. If issuance must pause, disable only the new Free-policy issuance switch while retaining Bonus accounting, disclosed expiry, spending and refund support. Disabling the new admin does not require stopping capture or the worker. Preserve the durable ClickHouse snapshots and Redis last-good reports; never populate a missing report with fabricated zeroes.

The worker is deployed from a clean, tracked-source upload; future worker changes require a separate worker deployment. Retain its explicit Dockerfile path, health checks, two-thread / 60-second query bounds and memory limits. Historical request-cost, play-time and attribution gaps remain visible in report coverage; these were not fabricated during backfill.

The existing-account earning cutoff remains 2026-09-20T20:00:00Z. Personal cycle changes begin at the first cycle starting on or after that instant. Paid benefits and protected existing credits are unchanged.

Detailed operational evidence is kept in ignored packages/server/scripts/admin-analytics.local/production-release-results.local.json; it contains aggregate verification and deployment metadata, not credentials.