step 10.1: done

HANDOFF.md

@@ -4,9 +4,9 @@
 > If this file disagrees with the code, trust the code and fix this file.
 
 ## 1. Where we are
-- **Last completed step:** 9.6 (Update README with real run instructions) — TICKED in STATUS.md
-- **Next step:** Phase 9 is complete. Ready to start Stretch Goals (S1–S7) or address Known Issues from STATUS.md.
-- **Updated:** 2026-10-21
+- **Last completed step:** 10.1 (Fix expedition START corrupting energy) — TICKED in STATUS.md
+- **Next step:** Phase 10.2 — Fix expedition CLAIM overwriting XP
+- **Updated:** 2026-10-22
 - **Was the last session cut off mid-task?** No
 
 ## 2. Verified state (run these first)
@@ -14,7 +14,7 @@
 |---|---|
 | `npm install` | succeeds |
 | `npm run migrate` | applies 001–006 / "nothing to do" |
-| `npm test` | **176 passing, 0 failing** (85 unit + 91 integration incl. 1 e2e) |
+| `npm test` | **178 passing, 0 failing** (85 unit + 93 integration incl. 2 new 10.1 tests) |
 | `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear |
 | `npm start` + `curl localhost:3000/api/health` | `{"ok":true}` |
 
@@ -31,10 +31,12 @@
 - `public/js/auth.js` — Shared API wrapper + showError.
 - `scripts/seed-dev.js` — Creates demo account + hero + starter gear.
 - `src/app.js` — Express app with helmet, rate limiters, catch-all 404, 500 HTML serving.
+- `src/services/expeditionService.js` — **Fixed in 10.1:** transaction param order corrected `(cid, ne, eat, defid, sat, endAt)`.
 - `src/services/*` — All game services.
 - `src/routes/*` — All route handlers.
 - `src/game/*` — Pure game logic.
-- `tests/integration/*.test.js` — 91 integration tests (incl. e2e-playable.test.js).
+- `tests/integration/expeditions.test.js` — 16 expedition tests (incl. 2 new 10.1 DB-level assertions).
+- `tests/integration/*.test.js` — 93 integration tests (incl. 1 e2e).
 - `tests/unit/*.test.js` — 85 unit tests.
 - `README.md` — Updated with real run instructions, play-through steps, project structure, known issues.
 
@@ -47,6 +49,7 @@
 - Starter gear documented but not auto-created on character creation.
 - `GET /api/zones` documented in API.md but not implemented (Issue #2).
 - Mobile nav uses emoji icons (⚔️ 🏕️ 🎒) — verify they render acceptably on all platforms.
+- **10.2 next:** expedition claim overwrites XP instead of adding to it; needs shared `applyXpGain` function.
 
 ## 5. Decisions & deviations from the docs
 - D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock).
@@ -56,7 +59,6 @@
 - Inventory response uses `itemId` (item.id) and `inventoryId` (inventory row id) to avoid confusion.
 - Consumable effect parsing: regex `^(heal|energy):(\d+)$` on items.effect field.
 - Qty decrement avoids CHECK constraint violation: delete directly when qty==1, decrement when qty>1.
-- D-008..D-013 from previous steps.
 
 ## 6. Gotchas learned
 - `npm test` must be `node --test` with NO path/glob; files must be named `*.test.js`.
@@ -65,7 +67,7 @@
 - Verify test COUNT, not just "all passing".
 - Node.js `fetch` doesn't persist cookies across calls — extract `Set-Cookie` header and pass manually in integration tests.
 - SQL `SELECT id` from inventory returns the auto-increment row id; rename with `AS inventory_id` when you also need `item_id`.
-- Transaction callback args must match the call order exactly.
+- Transaction callback args must match the call order exactly. (This is the 10.1 bug — double-check param/call order in every new transaction.)
 - Error responses from route-level `AppError`s do NOT include `data` field.
 - `setNow` affects ALL `now()` calls including those in service logic.
 - Shop API returns `{ ok: true, data: { stock: [...], character: {...} } }` — field is `stock`, not `stocks`.
@@ -86,9 +88,8 @@
 - `src/utils/time` exports `{ now, setNow, resetNow }` directly — `const time = require(...)`, not `const { time }`.
 - Inventory sell endpoint (`POST /api/shop/sell`) only accepts `material`-type items.
 - `handleListInventory` in `src/routes/inventory.js` — parameter name must be `res`, not `_res`.
+- Character profile response has `energy` at `data.energy.current`, NOT `data.character.energy`.
 
 ## 7. Next-step briefing
-- **Phase 9 is complete.** All hardening and polish done.
-- **Stretch Goals available:** S1 (PvP duels), S2 (Skills/talents), S3 (Guilds), S4 (Player market), S5 (Daily rewards/quests), S6 (In-game chat), S7 (Achievements).
-- **Or address Known Issues:** Issue #2 (`GET /api/zones` missing — major), Issue #5 (equipment not in combat — minor), Issue #3 (`npm run seed` dead script — cosmetic).
-- **Recommended next step:** Fix Known Issue #2 (`GET /api/zones`) since it's a documented API gap and would improve the hunt UI. Then consider S7 (Achievements) as it's a self-contained, low-risk stretch goal that adds meaningful gameplay.
+- **Next step: 10.2** — Fix expedition CLAIM overwriting XP. The `claimExpedition` transaction uses `updateCharacterXp.run(xp, lvl, pts, cid)` which OVERWRITES xp/level/points instead of ADDING to current values. Needs a shared `applyXpGain` function used by BOTH `huntService` and `expeditionService`.
+- **Before 10.2:** check `src/services/expeditionService.js` `claimExpedition` transaction — same param-order bug pattern as 10.1 may be present.