Add safe bank failure diagnostics for T5 and T6

Address #14 with request correlation, bounded parser reasons, startup version reporting, and rate-limited storage and settlement logs. Preserve accounting and API identity contracts, extend portable tests, and update release versions and rollout guidance.

README.md

@@ -183,7 +183,7 @@ shared by GUID across games and survive map/server restarts. Transfers do not
 change `score_total`; bank-assisted matches still count on existing leaderboards.
 
 Deploy [Electric Cherry #146](https://gitea.thewrightserver.net/josh/electric-cherry/issues/146)
-first, then build/install both native plugins `1.1.0` and **restart the server
+first, then build/install both native plugins `1.2.0` and **restart the server
 processes**. The plugins provide `bankLoad`, `bankStore`, `bankRemove` and
 `bankResponse`. Removing the bank script is necessary to omit these linking
 requirements; disabling it by dvar does not avoid linking.
@@ -226,6 +226,62 @@ are not refunded when a match ends or its process crashes. As with any live
 score, the journal cannot make game memory and the remote database atomic
 across a machine/storage failure.
 
+### Bank diagnostics — TWS #14
+
+Bank scripts `2.0.2` require their matching TWS plugins `1.2.0+`. Startup logs
+report the script version, the loaded plugin's TWS version via `bankVersion()`,
+the effective endpoint, a validated server ID, credential format validation,
+and the loaded journal count. Credential validation checks the local format;
+HTTP 401/403 still identifies a credential rejected by EC. A failed journal load
+logs `pending=unknown` and disables the bank; invalid configuration reports that
+journals were not loaded. Server IDs outside the bounded log-safe token alphabet
+are shown as `invalid`/`unavailable` without changing the configured API identity.
+
+Each HTTP attempt receives a local `correlation=bank-<map milliseconds>-<counter>`
+for console diagnostics, including `.b`. These IDs are scoped to a map/process
+log, never sent to EC, and never replace durable transfer IDs. Balance requests
+still omit the API request ID and require an empty response ID. Transfer logs
+also include their original request ID, linking prepare, journal and settlement.
+
+Outcomes distinguish request creation, transport failure, HTTP rejection,
+missing diagnostics/response, invalid acknowledgment (with a fixed parser reason),
+request-ID mismatch, unexpected state, and valid application rejection. Available
+HTTP status, curl code and cumulative DNS/connect/TLS/total milliseconds are
+included; absent or malformed fields say `unavailable`. Only allowlisted response
+codes reach logs; unfamiliar codes say `unknown`. No token, authorization header,
+raw response/request body, transport exception or private configuration contents
+are logged. Existing point accounting, journal format, API payloads, retry delays
+and player-facing messages are unchanged.
+
+Settlement lines add the durable decision, attempt count, pending seconds, next
+retry delay, cleanup failures and eventual resolution. Pending time begins when
+a new cancel decision is attempted; recovered journals measure from this map's
+load, so downtime is not included. Counters reset on map/process restart. Repeated
+identical failures per action are summarized at most every 30 seconds, with a
+`suppressed` count. Reason/status/code changes and recovery log immediately.
+Native storage logs similarly identify load/write/remove failures and recovery.
+Rate-limited attempts retain their correlation internally; only emitted lines
+appear in the console. No log history or retry metadata is added to the journal.
+
+Build/install both updated DLLs and **restart each full server process**, then
+install the corresponding scripts and restart the map if they were copied after
+startup. `bankVersion()` is a new linking requirement even when the bank is
+disabled by dvar. No EC/agent change or new third-party dependency is required;
+existing bank API, common/telemetry and endpoint-migration requirements still apply.
+Verify deployed DLL and GSC SHA-256 hashes against the built release artifacts,
+and confirm startup reports `script=2.0.2 plugin=1.2.0` before interpreting results.
+An old bank script checksum on Ascension was reported in issue #14; deploying
+only the DLL does not update GSC. No deployment was performed here.
+
+Run `node tools/check_bank.mjs --ec-root /path/to/electric-cherry` and
+`python3 tools/test_plugin_bank.py`. On **both T5 and T6**, compile/link and test
+successful `.b`/deposit/withdrawal, HTTP 401/403, timeout, malformed JSON/schema,
+wrong response ID, unwritable/corrupt journals and settlement recovery after a
+map/process restart. Check first/change/recovery logs, 30-second suppression,
+HTTP timings, unchanged player messages/points and one remote ledger entry per
+transfer. Keep journal files intact during failure tests. Windows DLL/GSC builds,
+installed-artifact verification and these live game checks remain required.
+
 ### Bank identity validation
 
 Bank scripts `2.0.1` use T5's `player getGuid()` and T6's persistent