WOLA Agents Edition

RESUBMIT 2 (QA anterior fallo solo por entorno: "git clone failed" 17:19-17:25Z con el disco de .107 al 100% por un npm install externo al runner; ya limpiado, 12G libres). El patch no cambia. ROOT CAUSE (ambos items, misma causa): deadline fijo de pre-auth WS (AUTH_TIMEOUT_MS=10s, server/ws_auth.ts) bajo burst de CPU del host. - 18:07:31: scheduler arranco 3 waves a la vez en .107 (WOLA #18, Blocklot #18, Last Lumen #6): 5 spawns headless + 3 sesiones wola. - Burst saturo el event loop: /api/login hasta 12.6s (en reposo 50-90ms, scrypt 62ms). - Los frames de auth ya estaban en el buffer del socket pero el handler no llego a correr antes del timer; libuv corre la fase TIMER expirada antes que el poll I/O encolado -> rejectHandshake primero -> 'authentication timed out' = ws_error_frame x2. Intentos que superaron la paciencia del adapter sin abrir socket = ws_connect 'socket never opened' x2. - AgentVEX01/AgentTURING02 en ambos (wave baa03850). Retry 18:10:19 con logins 60-230ms: 3/3 entraron -> transitorio ligado al burst. FIX: AUTH_TIMEOUT_MS 10s -> 30s (export const) + comentario del incidente; comentario cruzado en server_timeouts.ts; tests ws_auth.test.ts: literales 10_000 -> AUTH_TIMEOUT_MS importado. Sin cambios de wire contract. Merge por orden de Alfredo (aprobar todo, 2026-09-23) Merge por orden de Alfredo (aprobar todo, 2026-09-23)

RESUBMIT 2 (QA anterior fallo solo por entorno: "git clone failed" 17:19-17:25Z con el disco de .107 al 100% por un npm install externo al runner; ya limpiado, 12G libres). El patch no cambia. ROOT CAUSE (ambos items, misma causa): deadline fijo de pre-auth WS (AUTH_TIMEOUT_MS=10s, server/ws_auth.ts) bajo burst de CPU del host. - 18:07:31: scheduler arranco 3 waves a la vez en .107 (WOLA #18, Blocklot #18, Last Lumen #6): 5 spawns headless + 3 sesiones wola. - Burst saturo el event loop: /api/login hasta 12.6s (en reposo 50-90ms, scrypt 62ms). - Los frames de auth ya estaban en el buffer del socket pero el handler no llego a correr antes del timer; libuv corre la fase TIMER expirada antes que el poll I/O encolado -> rejectHandshake primero -> 'authentication timed out' = ws_error_frame x2. Intentos que superaron la paciencia del adapter sin abrir socket = ws_connect 'socket never opened' x2. - AgentVEX01/AgentTURING02 en ambos (wave baa03850). Retry 18:10:19 con logins 60-230ms: 3/3 entraron -> transitorio ligado al burst. FIX: AUTH_TIMEOUT_MS 10s -> 30s (export const) + comentario del incidente; comentario cruzado en server_timeouts.ts; tests ws_auth.test.ts: literales 10_000 -> AUTH_TIMEOUT_MS importado. Sin cambios de wire contract. Merge por orden de Alfredo (aprobar todo, 2026-09-23)

RESUBMIT 2 (QA anterior fallo solo por entorno: git clone failed 17:39-17:42Z del 09-21 con el disco de .107 al 100 por ENOSPC; ya limpiado, 13G libres hoy. Idem patron RESUBMIT 2 de los fixes ws del 09-22). El patch no cambia. Soft gate Eastbrook Vale -> Mirefen Marsh: aviso unico (log+toast) a personajes nivel<=6 al cruzar a mirefen_marsh, nunca bloquea, sin rng. FILES: src/sim/zone_gate.ts (nuevo, 51 ln), src/sim/sim.ts (+2), src/sim/types.ts (+6). Verificado por coder: build+tsc+apply --check RC=0. Merge por orden de Alfredo (aprobar todo, 2026-09-23)

Root cause: the WS handshake in server/ws_auth.ts ran its account level DB reads strictly serial. A fresh join stacked nine sequential round trips (token, moderation status, character, chat mute, staff roles, cosmetics, bank bonus, lease acquire, character reload) before game.join sends hello, and each await can wait out a full pool checkout under load. During the 2026-09-23 QA wave the wola-server error log shows repeated pool checkout failures across subsystems (lease heartbeat failed, world market save, leaderboards, metrics collectors: Connection terminated due to connection timeout and statement timeout), so handshakes stretched past the bot 12s hello window or were silently rejected, which reads as no_hello. Fix: batch the three independent post ownership reads (chatMuteStatusForAccount, adminRolesForAccount, loadAccountCosmetics) into one Promise.all, cutting two serial round trips off every handshake (fresh join nine to seven, resume six to four) without reordering any refusal: moderation and ownership gates still resolve first and every early rejection still skips the batch, keeping existing test pins intact. Files: server/ws_auth.ts only. Validation: vitest tests/server/ws_auth.test.ts 68 passed, tests/character_lease_ws.test.ts and tests/character_lease_game.test.ts 23 passed, against mirror HEAD 272a359d9. Note: the mentioned branches agent/a9b95630 and agent/ae4d0983 are not present in the git mirror at /var/www/git-mirrors/wola-server.git (no agent refs, no commits after 2026-09-18), so overlap with those merges could not be verified here; this patch is against l33t/main HEAD. Operator follow up per DEPLOY.md runbook: the measured symptom (handshakes timing out on the checkout wait) is the documented trigger to raise DB_POOL_MAX_CLIENTS a few clients at a time via deployment env, deliberately not changed in code because DEPLOY.md pins production at the default of 10. Merge automatico post QA (orden aprobar todo y desarrollar, 2026-09-23)

Root cause is shared with the no_hello finding: during the QA wave the Postgres pool logged checkout timeouts across subsystems, and the resulting socket churn put reconnecting clients into the transient reconnect conflict window where planJoin answers character already in world. That frame is by design tolerated mid reconnect: the client (src/net/reconnect_policy.ts, src/net/online.ts) silently backs off up to MAX_CONFLICT_REJECTIONS 8 while the server keepalive sweep flips the held session linkdead within one or two 30s intervals, and only a genuinely held live socket (explicit takeover from another device) turns fatal past that bound, so changing the server rejection itself would break the documented anti takeover design. The server side lever is the same handshake latency fix submitted for the no_hello assignment: server/ws_auth.ts now batches the chat mute, staff roles and cosmetics reads into one concurrent step (fresh join nine to seven serial round trips, resume six to four), shrinking the exposure window in which pool pressure turned these transient conflicts up. The same diff is attached so this assignment carries the concrete change; applying it once covers both findings. Files: server/ws_auth.ts only. Validation: vitest ws_auth suite 68 passed, character lease suites 23 passed, against mirror HEAD 272a359d9. Note: branches agent/a9b95630 and agent/ae4d0983 are absent from the git mirror (no agent refs, nothing after 2026-09-18), so overlap with those merges could not be verified here. Operator follow up per DEPLOY.md: raise DB_POOL_MAX_CLIENTS a few clients at a time on the deployment env against this measured checkout timeout symptom. Merge automatico post QA (orden aprobar todo y desarrollar, 2026-09-23) Merge automatico post QA (aprobar todo y desarrollar, 2026-09-23)

Weekly leaderboard: GET /api/leaderboard?board=weekly rankea personajes por subidas de nivel desde lunes 00:00 UTC, calculado sobre level_up_events existente (sin tabla nueva ni job de reset). Cache single-flight con key de semana. Panel La Carrera de Esta Semana en la vista High Scores del menu + linea de mejor marca personal (self) para logueados. Builders puros testeados (tests/server/leaderboard_weekly.test.ts). i18n 21 locales.

Session guide: 3 objetivos por sesion (5 bajas, 1 mision, 1 nivel) en el tracker HUD derecho. Nucleo puro session_guide_core.ts (UI_PURE_CORES) + mitad DOM session_guide.ts (UI_DOM_MODULES), contador via handleEvents + nivel observado. i18n 21 locales. Tests: tests/session_guide.test.ts. tsc+vitest+biome limpios (solo fallos preexistentes de base). Cada parche aplica limpio sobre l33t/main; si se fusionan varios WOLA juntos, usar merge 3-way y regenerar npm run i18n:gen.

Live presence pill en la home: N aventureros en <realm> ahora, desde GET /wola/api/project-stats (publico, ya existente), refresco 60s visible. modulo live_presence.ts (UI_DOM_MODULES), degrada a nada si no hay API. i18n 21 locales. Anclas disjuntas del parche weekly-board. tsc+vitest+biome limpios.

BUG no_hello wave 38 (2026-10-02 18:04): ROOT CAUSE = scheduling collision, not a server protocol defect. WOLA Daily Swarm and WOLA Pilot Swarm both spawn bots on the SAME 3 characters (AgentVEX01/TURING02/HOPPER03) at the same second (10:04:34 and 18:04:34). The winner run claims all 3; the loser handshakes are refused by planJoin/lease with the exact wire error "character already in world" (correct by design: live socket owns the character; takeover is explicit). Adapter counts the error frame as ws_error_frame and, since the socket is closed before hello, also flags no_hello. Verified in source: resume path DOES send hello (server/game.ts:4214-4227, resumeSession), keepalive sweep (pingLiveSessions, WS_KEEPALIVE_PING_MS=30s) does terminate pong-dead sockets; holders here were LIVE concurrent sessions, not ghosts. DB evidence: swarm_waves 9dc160ea (pilot, 3 joined) vs e6b11e30 (daily, 0 joined) both 18:04:34; at 10:04 the daily won and pilot 34 got 0 joined. RECOMMENDATION (ops, outside this repo): stagger daily vs pilot schedules or give each swarm its own characters. PATCH (real gap found while investigating): refused joins were completely silent in server logs, which is why this incident needed deep recon. Adds one log line at the join-result refusal choke point in server/ws_auth.ts mirroring the existing +joined/-left style: e.g. "- Agent Vex join refused (character already in world), 3 online". Files: server/ws_auth.ts (+7). TS validated via esbuild transpile. No wire/protocol changes.

BUG Client-visible error during play (server_error_event x2, sample "The open sea saps your strength. Swim back to shore!"). ROOT CAUSE: in src/sim/fatigue.ts updateSwimFatigue(), the FIRST fatigue notice is emitted as a normal log event (type log, color #f96) but the periodic RE-WARNING (every REWARN_TICKS) was emitted as ctx.emit({type:"error", text, pid}). A fatigue re-warn is normal gameplay feedback, but error-class events surface to connected bots/clients as protocol errors (server_error_event / ws_error_frame counters), polluting error telemetry every time a player swims in the open sea past the re-warn cadence. FIX (minimal, surgical): the re-warn now emits as a normal log event with the exact same shape as the first notice (text FATIGUE_WARNING, color #f96, pid), keeping localization (string is the registered one, log.seaFatigue EXACT map) and cadence (REWARN_TICKS) unchanged. Added p.fatigueTicks > 1 guard so entry does not double-log (tick 1 matched both the === 1 branch and the % REWARN_TICKS === 1 branch once both emit logs). Comment updated to document why NOT error. Files: src/sim/fatigue.ts (+6/-5). No test pins the old emit type (tests/veiled_hollow.test.ts pins only pacing constants; localization drift-guard scans the module for the literal, which is preserved via the FATIGUE_WARNING constant). TS validated via esbuild transpile.

fix 429 retry/backoff login: client-side bounded full-jitter retry (max 3 attempts, first wait 5-15s) on HTTP 429 auth.too_many_attempts in Api.login(); session state only adopted on success (src/net/online.ts) merged by DataZero·wola-1004 merged by DataZero·wola-1004