Fix public bank endpoint rollout (Refs josh/tws-zombies-scripts#13)

docs/guides/bank.md

@@ -9,9 +9,10 @@ IDs. This release does not introduce separate bank-assisted rankings.
 
 ## Setup and rollout
 
-1. Back up the controller database. Update every host agent to **1.9.0 or later**
-   before enabling the bank. This version settles game journals before removing
-   runtime storage; older agents do not. Package and offline-sign the agent
+1. Back up the controller database. Update every host agent to **1.9.1 or later**
+   before installing the public-endpoint bank scripts. This version settles both
+   public and legacy controller-derived journals before removing runtime storage.
+   Package and offline-sign the agent
    release using the [host update workflow](native-hosts.md).
 2. Deploy Electric Cherry and restart the controller. Migration 20 creates
    accounts, requests and the ledger; migration 21 adds instance credentials and
@@ -21,13 +22,20 @@ IDs. This release does not introduce separate bank-assisted rankings.
    prepared deposits; withdrawals remain available.
 4. Build/install TWS plugins `t5-plugin`/`t6-plugin` 1.1.0 or later and restart
    the **whole game-server process**. Install `tws_t5_bank.gsc` or
-   `tws_t6_bank.gsc` 1.0.0, common 1.0.0+ and telemetry 1.0.0+.
+   `tws_t6_bank.gsc` 2.0.0, common 1.0.0+ and telemetry 1.0.0+.
+   For existing servers changing endpoints, use the rebuild procedure below.
 5. Create or rebuild the servers through EC. Launch preparation generates a
    cryptographically random `ec_bank_` credential for each immutable instance,
    stores it in the private controller database, and injects it through
    `configs/electric_cherry_bank.cfg`. The launch command executes this private
-   file and sets `tws_server_id`. The host agent writes the private file and derives `tws_bank_url` from its
-   enrolled controller URL. Use an HTTPS controller URL.
+   file and sets `tws_server_id`. The host agent writes only `tws_bank_token` in
+   that private file; it no longer generates `tws_bank_url`.
+
+Both game scripts always send bank requests to
+`https://ec.thewrightserver.net/api/bank`, even if an old `tws_bank_url` remains
+in configuration. The host agent's enrolled HTTPS controller URL is separate
+and continues to carry agent traffic, including authenticated bank settlement.
+It may differ from the public endpoint reachable by game containers.
 
 There is **no `EC_BANK_TOKENS` environment map** and no per-server secret setup.
 The private configuration is sent only in that host's authenticated operation
@@ -49,6 +57,28 @@ transfers while the old controller/configuration still runs, then deploy and
 rebuild. Remove the obsolete environment map and any manually supplied token.
 Do not replace identities or discard pending journals to force an upgrade.
 
+### Upgrading from a controller-derived game endpoint
+
+Update agents to `1.9.1+` first. If an existing server's `tws_bank_url` differs
+from `https://ec.thewrightserver.net/api/bank`, rebuild that server through EC
+with bank scripts `2.0.0`. The agent stops the old game, settles its pending
+commit/cancel decisions with their original request IDs, then starts the
+replacement and removes old storage. The server identity and instance credential
+are preserved. Lost acknowledgments can replay the same decisions; EC's retained
+request IDs prevent duplicate ledger changes. An outage or invalid journal
+retains storage and blocks replacement until recovery succeeds.
+
+Do not deploy the new scripts with only a map restart when the endpoint changes:
+native journals are keyed by server and endpoint, and the new scripts cannot load
+the old scope. Do not rename, rewrite or delete pending journals. Keep the
+agent's enrolled controller URL unchanged until legacy journals drain; the
+agent accepts only the fixed public endpoint and the legacy `/api/bank` URL
+derived from that enrolled controller. Other legacy URLs require recovery with
+their original configuration before switching. If the old URL already matches
+the exact public endpoint, existing journals retain their identity and a map
+restart is sufficient for the script upgrade. No new native plugin build is
+required beyond `1.1.0`.
+
 ## Machine API
 
 All routes below are `POST /api/bank/<action>`, with `Content-Type:
@@ -136,14 +166,15 @@ original journal to resolve holds; never delete a pending journal to unblock
 the bank. If storage is permanently lost, reconcile against the retained
 request and ledger records before any manual repair.
 
-During removal, rebuild, host migration or launch cancellation, agent 1.9.0+
+During removal, rebuild, host migration or launch cancellation, agent 1.9.1+
 stops the game and drains its journals **before** deleting runtime files or
 starting a replacement. It uses its host credential at
 `POST /api/agent/bank/settle`; EC checks the assigned host, immutable instance,
 unfinished teardown operation, server and original request identity. This
 endpoint permits only commit/cancel, never new deposits or withdrawals. Journal
-URLs must match that host's configured controller; the agent never follows a
-journal URL. Corruption, a mismatched controller, failed acknowledgment or an
+URLs must match the public game-bank endpoint or that host's legacy
+controller-derived bank endpoint; the agent never follows a journal URL.
+Corruption, an unrecognized endpoint, failed acknowledgment or an
 outage retains storage and leaves the operation unresolved for retry. An
 interrupted rebuild uses the existing rebuild recovery workflow to retry with
 a fresh operation after settlement. Do not manually erase its old directory.
@@ -170,3 +201,8 @@ telemetry, `.help`, score HUD updates, death/respawn/disconnect during requests,
 lost prepare/commit replies, controller outage, disk failures and map/process
 restart with pending work. Confirm earned score and leaderboard behavior, and
 verify that another server's credential and the telemetry credential fail.
+For the endpoint upgrade, also test a different enrolled controller address and
+a stale `tws_bank_url`, `.b` with an empty balance, `.w all` with no funds, and
+rebuild/removal with both legacy and public journals. Drop a settlement reply,
+restart the agent and verify the original IDs settle without duplicate ledger
+changes before the replacement starts or runtime storage is removed.

docs/guides/native-hosts.md

@@ -1038,9 +1038,18 @@ game hosts. Run:
 
 ### Bank journals during server teardown
 
-Agent 1.9.0 adds `bank.settlement`: removal, rebuild, migration and creation
+Agent 1.9.0 introduced `bank.settlement`: removal, rebuild, migration and creation
 cancellation finish pending TWS bank decisions before deleting the old runtime.
 An unavailable controller or corrupt journal leaves the operation unresolved
 and preserves storage. Update all agents before enabling the
 [player bank](bank.md). EC generates and injects bank credentials per instance;
 no token map or manual server-secret provisioning is required.
+
+Agent **1.9.1+** recognizes both the fixed public game-bank endpoint
+`https://ec.thewrightserver.net/api/bank` and its own legacy controller-derived
+bank endpoint in journals. It stops generating `tws_bank_url` in the private
+game configuration. Agent transport still uses the enrolled controller URL and
+host credential; journal URLs never determine request destinations. Upgrade
+agents first, then [rebuild servers changing bank endpoints](bank.md#upgrading-from-a-controller-derived-game-endpoint)
+to drain pending decisions before the new scripts start. See the
+[agent changelog](../../agent/CHANGELOG.md) for release and validation details.