Admin and Free-credit connection audit

Checked September 12, 2026, approximately 10:45 UTC. Live checks were read-only. This is preparation, not permission to deploy, enable replication, rotate credentials or activate reductions. The owner will publish the announcement personally before the changes take effect.

Verified connections

Component	Observed result	Remaining dependency
Railway	Eight production service instances report successful, running deployments. Web, analytics worker and Redis are in US West; game services and ingress also include Singapore.	The revised web/admin branch has not been deployed.
Web → Redis → analytics worker	Web and worker use matching Redis credentials and database. Worker connects through redis.railway.internal. Worker has no production database URL.	Verify authenticated report latency after the new web build is available in staging.
Neon primary	PostgreSQL 17.11 connection passed in a read-only transaction. Four usage-cost/measurement columns and three analytics tables are present.	wal_level=replica; the analytics publication is absent. Logical replication remains deliberately deferred.
Neon read replica	Separate read URL connects; pg_is_in_recovery() is true. Wallet and analytics tables are visible.	Include both primary and read configuration in the later rotation. No credential changed here.
ClickHouse	AWS US West service is running. Importer grants are exactly SELECT/INSERT on yumina_analytics.*.	No ClickPipe exists yet. Its source connection and initial import follow the later replication enablement.
Stripe	Both distinct accounts verify. Corporate ledger: 3,290 entries / 2,778 charges. Legacy: 324 entries / 150 charges, all mapped. Import cursors advance through 10:44 UTC.	Three corporate charges have known products but no reliable customer link: one Gold, two WeChat Gold. Keep them unattributed; do not guess an identity.
OpenRouter	Account billing import is complete through its 10:44 UTC cutoff. Full-history audit cursor is present. Uses actual account charges, without applying cache discounts twice.	Match closed cutoffs when reconciling the completed dashboard; detailed historical request costs are not inferred from list prices.
PostHog	18,404 signup events imported; latest event approximately 09:59 UTC. Private export configuration is present and the hourly import continues.	Earlier-than-July-28 acquisition remains unknown. These are event counts, not total users.
Cloudflare	Yumina zone active; HTTPS certificate active, TLS minimum 1.2. Existing cache rules cover public assets/worlds; no broad admin/API cache-all rule found.	Local release adds explicit no-store headers to admin failures and new reward endpoints. Live configuration was not changed.
Game events	Cloudflare producer/consumer bindings are present, delivery is unpaused, authenticated status returns 200, queue backlog and dead letters both zero.	New analytics capture remains off until its release checks pass.
Storage	Product assets and private analytics exports already use configured storage; analytics exports use the dedicated Railway bucket.	Cloudflare R2 is not enabled and is not a dependency of this release. Do not create an unnecessary second store.

These checks establish configuration and observed connectivity. They do not prove complete report reconciliation, continuous availability or production UI latency.

Release remains disabled

Production web has no enabled ADMIN_ANALYTICS_ENABLED, ANALYTICS_CAPTURE_ENABLED, WALLET_BONUS_COMPAT_ENABLED or FREE_CREDIT_POLICY_ENABLED setting. Worker ANALYTICS_CDC_READY is false. The four Bonus/cycle/refund side tables have not been applied to production. No restart, role, publication, ClickPipe, secret or DNS mutation was made.

The worker's health endpoint says ready because it has published a report. That is not a declaration that all five dashboard reports are complete; the source import is still missing. Individual reports retain their completeness and freshness states.

Local preparation completed

• Saved the admin/Free-policy implementation in a local checkpoint and integrated origin/main at 0615db7ea, including the now-landed Krew work. Nothing was pushed. Concurrent work in the main checkout was not modified.
• Added browser/CDN no-store coverage for admin responses, including authorization failures, and the new account-specific referral/gift routes. Public feeds keep their existing cache policy.
• Made admin credit grants and community reward receipts participate in their wallet transaction. Future administrative deductions have ledger type admin, so they are not counted as AI usage. Historical entries are unchanged.
• Rechecked cycle-specific recovery, Bonus expiry, protected Saved funds, retry behavior and paid-tier preservation after integration.
• Full monorepo typecheck/build passed after integration. Analytics suite: 23 passed; its two external integration tests were run separately against disposable ClickHouse databases and both passed. Wallet/cache suite: 23 passed; admin client request-reuse/isolation suite: three passed. The final admin-deduction change also passed the isolated wallet integration test.

Gates that remain before launch

1. Local desktop/mobile and authenticated compiled-server rehearsal is complete; see local release verification. The browser uses synthetic report responses; the server rehearsal uses real endpoints and signed fixture sessions against isolated PGlite. A final PostgreSQL/Redis/container rehearsal remains before production activation.
2. Build and smoke-test the final container image in the agreed build environment. Local production compilation passes; Docker is not available in this local shell. Do not deploy a staging or production service merely to bypass the owner's push restriction.
3. Install the additive Bonus schema and matching recovery function in the reviewed release sequence; verify compatible clients before enabling new Bonus issuance. Production schema/function installation is still pending.
4. At the separately agreed final maintenance step, enable replication and carry out the reviewed credential transition. Complete the managed initial import, verify lag/deletes and reconcile report totals before turning on the new admin.
5. Record when the owner actually published the notice. Keep existing-account changes no earlier than the promised notice window; if September 21 no longer allows seven days, select a later cutoff. New-account activation and existing personal cycles remain separate.

No new account, billing setup or key submission is needed from the owner now. Announcement publication and the later maintenance/activation decision remain with the owner.

September 12 follow-up: the owner explicitly authorized local browser checks. The completed verification and fixes are recorded in local release verification. The live connection findings above retain their original check time.