step 10.3: done

HANDOFF.md

@@ -4,8 +4,8 @@
 > If this file disagrees with the code, trust the code and fix this file.
 
 ## 1. Where we are
-- **Last completed step:** 10.2 (Fix expedition CLAIM overwriting XP) — TICKED in STATUS.md
-- **Next step:** Phase 10.3 — Make expeditions testable (inject time/rng)
+- **Last completed step:** 10.3 (Make expeditions testable — inject time/rng) — TICKED in STATUS.md
+- **Next step:** Phase 10.4 — Fix `GET /api/auth/me` and `POST /api/auth/login` to return real username and hasHero
 - **Updated:** 2026-10-22
 - **Was the last session cut off mid-task?** No
 
@@ -14,7 +14,7 @@
 |---|---|
 | `npm install` | succeeds |
 | `npm run migrate` | applies 001–006 / "nothing to do" |
-| `npm test` | **182 passing, 0 failing** (85 unit + 97 integration incl. 4 new 10.2 tests) |
+| `npm test` | **184 passing, 0 failing** (85 unit + 99 integration incl. 2 new 10.3 tests) |
 | `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear |
 | `npm start` + `curl localhost:3000/api/health` | `{"ok":true}` |
 
@@ -31,14 +31,14 @@
 - `public/js/auth.js` — Shared API wrapper + showError.
 - `scripts/seed-dev.js` — Creates demo account + hero + starter gear.
 - `src/app.js` — Express app with helmet, rate limiters, catch-all 404, 500 HTML serving.
-- `src/services/expeditionService.js` — Fixed in 10.1 (energy tx params) + 10.2 (uses `applyXpGain`).
+- `src/services/expeditionService.js` — Fixed in 10.1 (energy tx params) + 10.2 (uses `applyXpGain`) + 10.3 (injectable `opts.now`/`opts.rng`).
 - `src/services/huntService.js` — Refactored in 10.2 to use `applyXpGain` instead of inline `checkLevelUp`.
 - `src/game/leveling.js` — Added `applyXpGain` shared function (used by huntService + expeditionService).
-- `src/services/*` — All game services.
-- `src/routes/*` — All route handlers.
-- `src/game/*` — Pure game logic.
-- `tests/integration/expeditions.test.js` — 20 expedition tests (incl. 4 new 10.2 tests).
-- `tests/integration/*.test.js` — 97 integration tests (incl. 1 e2e).
+- `src/routes/expeditions.js` — Route handler passes `req.body._opts` to `claimExpedition`.
+- `src/utils/time.js` — `{ now, setNow, resetNow }` — `const time = require(...)`, not destructured.
+- `src/utils/rng.js` — `{ mulberry32, rngInt, rngFloat, rngRange }` — Mulberry32 PRNG.
+- `tests/integration/expeditions.test.js` — 22 expedition tests (incl. 2 new 10.3 tests).
+- `tests/integration/*.test.js` — 99 integration tests (incl. 1 e2e).
 - `tests/unit/*.test.js` — 85 unit tests.
 - `README.md` — Updated with real run instructions, play-through steps, project structure, known issues.
 
@@ -51,7 +51,7 @@
 - Starter gear documented but not auto-created on character creation.
 - `GET /api/zones` documented in API.md but not implemented (Issue #2).
 - Mobile nav uses emoji icons (⚔️ 🏕️ 🎒) — verify they render acceptably on all platforms.
-- **10.3 next:** expeditionService uses `Math.random()` for gold and `Date.now()` for time — needs injectable `rng` and `time.now()` so tests can control them.
+- **10.4 next:** `GET /api/auth/me` and `POST /api/auth/login` need to return real `username` and correct `hasHero`. Frontend (`login.js`, `create-hero.js`) needs updating for navigation logic.
 
 ## 5. Decisions & deviations from the docs
 - D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock).
@@ -92,6 +92,14 @@
 - Inventory sell endpoint (`POST /api/shop/sell`) only accepts `material`-type items.
 - `handleListInventory` in `src/routes/inventory.js` — parameter name must be `res`, not `_res`.
 - Character profile response has `energy` at `data.energy.current`, NOT `data.character.energy`.
+- **10.3:** `expeditionService.js` import changed from `const { now, setNow } = require('../utils/time')` to `const time = require('../utils/time')` — the destructured `now` variable was shadowed by the local `opts.now ?? time.now()` pattern.
+- **10.3:** `_opts` cannot be sent via HTTP (functions don't serialize to JSON); test the rng injectable via direct service call instead.
 
 ## 7. Next-step briefing
-- **Next step: 10.3** — Make expeditions testable. `claimExpedition` uses `Math.random()` for gold calculation and `now()` (which delegates to `Date.now()`) for time checks. Needs injectable `rng` and `time.now()` so tests can assert exact gold values and control time for ends_at checks. The route handler already passes `opts` to `startExpedition`; add the same pattern to `claimExpedition`.
+- **Next step: 10.4** — Fix `GET /api/auth/me` and `POST /api/auth/login`:
+  - Currently `/me` may return hardcoded/stale username and `hasHero` is always `false`
+  - Need to store username in session at login/register
+  - `hasHero` should check if a character row exists for the user
+  - Frontend: `public/js/login.js` — returning players with a hero go to `/game.html`; without → `/create-hero.html`
+  - Frontend: `public/js/create-hero.js` — redirect to `/game.html` if hero already exists
+  - Tests: `/me` before hero → `hasHero:false`, after creating → `hasHero:true`, `username` non-empty