step 9.2: done

HANDOFF.md

@@ -4,8 +4,8 @@
 > If this file disagrees with the code, trust the code and fix this file.
 
 ## 1. Where we are
-- **Last completed step:** 9.1 (Security checklist walk — fixed innerHTML + added rate limiter) — TICKED in STATUS.md
-- **Next step:** Phase 9 — 9.2 (Add `npm run seed:dev` creating a demo account and hero)
+- **Last completed step:** 9.2 (seed-dev script — creates demo account + hero) — TICKED in STATUS.md
+- **Next step:** Phase 9 — 9.3 (Global error pages / friendly UI error toasts. Loading states.)
 - **Updated:** 2026-10-21
 - **Was the last session cut off mid-task?** No
 
@@ -15,6 +15,7 @@
 | `npm install` | succeeds |
 | `npm run migrate` | applies 001–006 / "nothing to do" |
 | `npm test` | **172 passing, 0 failing** (85 unit + 87 integration) |
+| `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear |
 
 ## 3. What exists now (files that matter)
 - `public/profile.html` — Public hero profile page (reads ?name=, displays stats/equipment).
@@ -23,6 +24,7 @@
 - `public/js/game.js` — hunt UI + inventory UI + expedition UI.
 - `public/shop.html` — Dedicated shop page.
 - `public/login.html`, `public/register.html`, `public/create-hero.html` — Auth & hero creation.
+- `scripts/seed-dev.js` — Creates demo account + hero + starter gear (idempotent, skips in production).
 - `src/services/heroProfileService.js` — `getHeroProfile(heroName)`.
 - `src/routes/heroProfile.js` — `GET /api/heroes/:name` (public).
 - `src/services/leaderboardService.js` — `getLeaderboard(type, page, limit)`.
@@ -53,7 +55,7 @@
 - Equipment bonuses not yet passed into combat (Issue #5 in STATUS.md).
 - Starter gear (GAME_DESIGN.md §Items) documented but not auto-created on character creation.
 - `GET /api/zones` documented in API.md but not implemented (Issue #2).
-- Step 9.2 (`npm run seed:dev`) not yet implemented.
+- Step 9.3 (error pages/toasts/loading states) not yet implemented.
 
 ## 5. Decisions & deviations from the docs
 - D-004..D-007 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock).
@@ -84,10 +86,12 @@
 - Hero profile endpoint is PUBLIC — no `requireAuth` middleware.
 - Profile page is public: no auth.js guard needed; uses ?name= query param for lookup.
 - Rate limiters in tests: set `NODE_ENV=test` to get 1000 req/window limit; otherwise tests fail with 429.
+- `seed-dev.js` must check `NODE_ENV=production` before any `require()` that loads config (config throws on placeholder SECRET).
 
-## 7. Next-step briefing (9.2)
-- **Goal:** Add `npm run seed:dev` script that creates a demo account and hero on an empty DB.
-- **Docs:** None specific — follow existing patterns (migrate.js, authService, characterService).
-- Should: run migrations, then insert a test user + character, optionally give starter gear.
-- Should be safe to re-run (check if demo user exists first).
-- Should NOT be used in production (skip if NODE_ENV=production or check for a flag).
+## 7. Next-step briefing (9.3)
+- **Goal:** Add global error pages / friendly UI error toasts. Loading states.
+- **Docs:** UI_GUIDE, SECURITY (for error handling), TESTING.
+- Should: add a generic 404/500 error page template in `public/`.
+- Should: add a toast notification system (JS + CSS) for user-facing errors.
+- Should: add loading spinners/states for async operations (hunt, buy, etc.).
+- Should NOT introduce new dependencies — use vanilla HTML/CSS/JS.