Admin visual port and Users directory

This follow-up ports the accepted v10/v11 visual reference into the React app. The ignored yumina-admin-concept-v12.html adds the Users interaction preview; every local concept.html remains a sample, not a database-connected admin. The real application is /app/admin.

Scope

• Dedicated admin navigation inside the main app: Overview, Users, Moderation, Operations; a direct return to Yumina; compact mobile navigation and safe-area spacing.
• Overview keeps the reference's panels, four headline metrics, paired activity/new-account charts, revenue above retention, world atlas and Mushie flow. Report timestamps use UTC and visibly disclose delayed data.
• Users shows clickable account groups and effective-plan counts, global sorting, search and server pagination. Sorts include recorded tokens, play time, creator audience interactions, estimated cost, activity, balances and signup date. Existing user details and account actions remain available.
• Moderation uses the same layout, cover-led queue, edition selection, inline world/UI/lorebook snapshots and decision controls. Existing revision checks and action endpoints remain intact.

Users data contract

Current account, wallet, entitlement, model-price and world-owner dimensions come from Neon. A shared 20-second process cache coalesces simultaneous loads. Recent admin mutations and explicit refresh bypass it to the primary. Effective plans are resolved against the current time, including temporary benefits; analytical data never authorizes an action.

Usage history is prepared by the analytics worker in ClickHouse. Redis contains immutable monthly daily buckets, monthly per-person totals, today's activity and a per-person all-time aggregate. A manifest publishes only fully written keys. The HTTP endpoint never scans usage history or calls a provider. Period projections are cached independently of search and sorting; counts and ordered pagination use the same population. Responses contain at most 200 accounts, with 20 requested by the UI.

The worker refreshes current usage and at most one cold historical month per tick. A newly deployed worker needs time to prepare all history. Missing buckets are unavailable, not zero. Cache failures retain a last-good result only for the exact same period.

Creator interactions mean other people's recorded play generations in worlds currently owned by that creator. Self-play is excluded. Deleted worlds and missing historical world attribution cannot be counted. Studio usage is a separate metric. Play time unions recorded foreground intervals; historical and standalone-game gaps are not estimated. Active people require a meaningful action; visits alone do not qualify. Groups can overlap.

Users cost is a current-model-price estimate excluding BYOK, not reconciled provider spending. Unpriced platform tokens make that person's estimate unavailable. Total tokens still include BYOK. The finance overview continues to use imported Stripe receipts and actual OpenRouter usage, with source coverage, fees and contribution semantics unchanged.

The directory preserves the existing consumer-usage scope: play, Studio, translations and side replies. Background memory extraction and compaction are excluded from its token/cost ranking and remain included in the platform-wide Overview totals. The UI and API definition disclose that distinction.

Refresh scheduling

The worker now alternates an individual due overview period with the oldest due detailed report. Vendor imports run sequentially between report jobs when due. A cooperative 120-second pass budget returns control to housekeeping; an already-running report finishes atomically. Failed or unavailable builds wait 60 seconds before retry and do not replace the last-good report. Report source cutoffs and freshness formulas are unchanged.

Validation and release

The earlier production release is recorded in admin-production-release-2026-09-13.md. During this follow-up, production primary/read/Redis health and all 21 prepared reports were verified. At 01:22 UTC they contained 31,277 accounts and $71,856.78 of imported AI usage; these are point-in-time checks, not hard-coded UI values.

Final root build and typecheck passed, alongside 60 focused tests covering Users data, pagination, cancellation, effective plans, query deadlines, source accounting, refresh scheduling and worker leases. Real PostgreSQL dimension queries were exercised in PGlite. Bounded, read-only live ClickHouse queries verified the actual current-month and one-day data shapes, including BYOK and foreground interval aggregation. The largest current-month query returned 12,253 rows / 5.02 MB; usage queries completed in 11–14 seconds under the 20-second bound. A synthetic 332,000-user-day history fit the monthly budgets; projection and sorting across 31,000 accounts took 77 ms locally (not an end-to-end HTTP benchmark).

Review corrections include iOS safe-area spacing, an exit/retry when world inspection fails, clearing chart pins when their bucket disappears, and hiding section links when the legacy overview is enabled. No browser verification was performed during this follow-up.

Deployment order: publish the analytics worker, verify the Users manifest and prepared coverage, then publish the app and check both web replicas and authenticated/anonymous boundaries. No schema migration, Neon restart, credential rotation or pricing-policy change is needed for this follow-up.

Production completion

The release is live as of 2026-09-13 02:07 UTC. Worker deployment ea511ef8-e702-41e0-8003-c87cd5300a8d runs analytics code a4895b6aeb5feb1af0e82e4ed93b29e25832c615. A one-off warmup used the same worker lease and tested month-preparation function, yielding between months to ordinary reports; it exited successfully. All eight months, February–September, were prepared before the web switch. April remains the first displayed chart/cohort month.

The unrelated PvZ styling commit that landed during preparation was merged and preserved. The integrated release passed root typecheck/build. Web deployment ec6b25e3-776c-4afe-8996-8e8546064f8a runs c3c5868d08d5781575eefa74db3889b4115ab5a9 on two verified replicas: dfd39855-4fff-4d5b-b52c-ffcfb6833096 and fe61287a-db7e-4abc-9c1b-926d153e8475. Both report healthy primary/read/Redis connections, all 21 reports, the same /assets/main-B7irq9Wv.js frontend, and anonymous-admin denial. Public Overview, Users and Moderation return that entry with no-store and Cloudflare DYNAMIC; protected data endpoints return 401 anonymously.

A read-only production account query combined with the real prepared history verified 31,290 accounts, consistent effective-plan counts, two disjoint pages and five sorting modes. Global projection took 136 ms locally, excluding network and the uncached dimension query. At 02:07, the web service read and validated the 12.55 MB all-time Users aggregate in 190 ms; subsequent period reads reuse the parsed projection. Its source watermark advanced to 02:01 and covered 23,313 recorded users. These are deployment checks, not permanent UI values or browser benchmarks.

Reports remain independent: at the replica checks all-time finance was fresh, while Overview retained a delayed snapshot with an explicit timestamp. Source lag and unrecorded historical game time are still disclosed. No synthetic records, charges, grants or account actions were made to verify production. Detailed aggregate evidence is retained in ignored packages/server/scripts/admin-analytics.local checks.