Use public endpoint for game bank requests (Refs #13)

README.md

@@ -190,11 +190,15 @@ requirements; disabling it by dvar does not avoid linking.
 
 Electric Cherry generates a unique bank token when it prepares a native server
 instance and injects it through that instance's private
-`electric_cherry_bank.cfg`. It sets `tws_server_id`, `tws_bank_token` and
-`tws_bank_url` automatically. Rebuilds and host moves keep the instance token;
+`electric_cherry_bank.cfg`, with `tws_server_id` supplied by the launch configuration.
+Both bank scripts `2.0.0` always use `https://ec.thewrightserver.net/api/bank`;
+`tws_bank_url` is no longer read, even if an old configuration still sets it.
+The host agent's enrolled controller address is independent and continues to
+serve agent traffic. Agent `1.9.1+` writes only the private `tws_bank_token` in
+the bank configuration. Rebuilds and host moves keep the instance token;
 destroying the instance revokes it. Reusing a server name gets a new token.
 There is no `EC_BANK_TOKENS` map or per-server secret to maintain. Keep secrets
-outside shared scripts and promoted configs. The URL must use HTTPS.
+outside shared scripts and promoted configs.
 Set `tws_bank_enabled 0` to disable the module; restart maps after script/config changes.
 Electric Cherry's `EC_BANK_MAX_BALANCE` defaults to 250000 (range 1–1000000).
 Each transfer and bank-funded spendable balance is capped at 1000000 points.
@@ -209,7 +213,7 @@ have only one prepared transfer across the fleet.
 
 Preserve `tws-bank/t5/` and `tws-bank/t6/`, relative to the game process working
 directory, across process/container restarts, with one process per server/endpoint
-directory. EC host agents **1.9.0+** settle
+directory. EC host agents **1.9.1+** settle
 pending journals before deleting runtime storage on removal, rebuild, migration
 or launch cancellation. Update the agents before enabling the bank. An outage
 or invalid journal blocks cleanup and preserves the files. Decisions are scoped
@@ -222,11 +226,41 @@ are not refunded when a match ends or its process crashes. As with any live
 score, the journal cannot make game memory and the remote database atomic
 across a machine/storage failure.
 
+### Upgrading the bank endpoint
+
+Deploy the Electric Cherry agent `1.9.1+` companion to
+[TWS #13](https://gitea.thewrightserver.net/josh/tws-zombies-scripts/issues/13)
+before installing bank scripts `2.0.0`. It accepts journals for the public game
+endpoint and the legacy bank URL derived from that host's enrolled controller.
+It settles through the existing authenticated, instance-scoped agent API at the
+controller; it never follows journal URLs and rejects other endpoint identities.
+The instance token and server identity must stay the same through the upgrade.
+
+**If the old `tws_bank_url` differs from the public endpoint, rebuild the server
+through EC with agent `1.9.1+` and the new scripts.** The agent stops the old
+process and settles its original commit/cancel decisions before starting the
+replacement and deleting old storage. A lost reply replays the same request ID;
+EC deduplicates it. An outage, corrupt journal or failed acknowledgment retains
+storage and blocks the replacement. Resolve the failure and retry the rebuild.
+Keep the enrolled controller address unchanged until legacy decisions drain.
+Do not merely replace scripts and restart the map: native journals are keyed by
+server and endpoint, so the new scripts cannot see a legacy endpoint's pending
+decisions. Do not rename, rewrite or delete those journals to force migration.
+
+If the previous endpoint already was the exact public URL, install the scripts
+and restart the map; saved decisions replay under the same journal identity.
+No new plugin build or full process restart is required for that case. Other
+legacy endpoints are refused by the agent and require recovery with their
+original configuration before switching. No deployment has been performed here.
+
 Run `node tools/check_bank.mjs` and `python3 tools/test_plugin_bank.py`.
 Before rollout, build/link Windows DLLs, compile GSC, and verify both games:
 help, balance and `all` commands, score HUD/persistence, max/overdraw errors,
 death/respawn/disconnect during HTTP, late telemetry, lost prepare/commit
 responses, disk failures and map/process restart with pending decisions.
+For this upgrade also verify stale URL settings are ignored, an empty `.b`
+shows zero, `.w all` reports insufficient balance, and an EC rebuild/removal
+settles legacy and public journals without duplicate ledger entries or lost points.
 
 ## Map record announcements