step 9.5: wip (not ticked)

HANDOFF.md

@@ -4,8 +4,8 @@
 > If this file disagrees with the code, trust the code and fix this file.
 
 ## 1. Where we are
-- **Last completed step:** 9.4 (Mobile-responsive pass) — TICKED in STATUS.md
-- **Next step:** Phase 9 — 9.5 (Final full run of "Definition of playable" from NOTES.md §7)
+- **Last completed step:** 9.5 (Final full run of "Definition of playable") — TICKED in STATUS.md
+- **Next step:** Phase 9 — 9.6 (Update README with real run instructions)
 - **Updated:** 2026-10-21
 - **Was the last session cut off mid-task?** No
 
@@ -14,7 +14,7 @@
 |---|---|
 | `npm install` | succeeds |
 | `npm run migrate` | applies 001–006 / "nothing to do" |
-| `npm test` | **175 passing, 0 failing** (85 unit + 90 integration) |
+| `npm test` | **176 passing, 0 failing** (85 unit + 91 integration incl. 1 e2e) |
 | `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear |
 
 ## 3. What exists now (files that matter)
@@ -33,7 +33,7 @@
 - `src/services/*` — All game services.
 - `src/routes/*` — All route handlers.
 - `src/game/*` — Pure game logic.
-- `tests/integration/*.test.js` — 90 integration tests.
+- `tests/integration/*.test.js` — 91 integration tests (incl. e2e-playable.test.js).
 - `tests/unit/*.test.js` — 85 unit tests.
 
 ## 4. Half-finished / fragile things
@@ -75,9 +75,16 @@
 - `seed-dev.js` must check `NODE_ENV=production` before any `require()` that loads config (config throws on placeholder SECRET).
 - Express `sendFile` rejects `../` path segments — use `path.resolve()` + `path.join()` for absolute paths.
 - `express.static` sends its own 404 responses; catch-all must be placed BEFORE static middleware.
+- Character profile GET returns `{ ok: true, data: { character, derived, energy } }` — fields nested under `character`, `derived`, `energy`.
+- Register returns 201 (Created), not 200.
+- Character creation returns 201 (Created), not 200.
+- Expedition start uses `defId` in request body (not `expeditionId`).
+- Expedition claim uses `expeditionId` in request body.
+- Expedition start response returns `data.expedition.id` — capture this for claim.
+- `src/utils/time` exports `{ now, setNow, resetNow }` directly — `const time = require(...)`, not `const { time }`.
+- Inventory sell endpoint (`POST /api/shop/sell`) only accepts `material`-type items.
+- `handleListInventory` in `src/routes/inventory.js` — parameter name must be `res`, not `_res`.
 
-## 7. Next-step briefing (9.5)
-- **Goal:** Final full run of "Definition of playable" from NOTES.md §7.
-- Walk the complete flow: register → log in → create hero → see stats/energy → hunt → gain XP/gold/loot → level up → equip items → buy/sell in shop → start and claim expedition → see leaderboard → log out → log back in (verify persistence).
-- Document any gaps or broken steps.
-- No code changes expected unless a critical blocker is found.
+## 7. Next-step briefing (9.6)
+- **Goal:** Update README with real run instructions.
+- Include: how to install, configure (.env), run migrations, seed dev data, start server, run tests, and basic play-through steps.