Fix bank GUID serialization on T5 and T6 (Refs #15)

CHANGELOG.md

@@ -6,6 +6,41 @@ T5/T6 script and each native plugin. Current versions are recorded in
 
 ## 2026-10-12
 
+### String bank identities — TWS #15
+
+| Component | Version | Affected source |
+| --- | --- | --- |
+| `tws_t5_bank.gsc` | `2.0.1` | `t5/scripts/tws_t5_bank.gsc` |
+| `tws_t6_bank.gsc` | `2.0.1` | `t6/scripts/tws_t6_bank.gsc` |
+
+- Normalize T5's `player getGuid()` and T6's persistent `player.guid` to
+  strings before balance/prepare requests or durable cancel/commit decisions.
+  Preserve large and zero-prefixed string GUIDs without numeric conversion.
+  Reject missing, unsupported or invalid identities privately before HTTP,
+  journaling or score changes, using EC's 1–64 character token contract.
+- Both engines receive the fix. T6 uses the same field as telemetry, populated
+  by stock connection initialization; fixtures no longer give T6 a getter shim.
+  Other scripts and native plugins are unchanged.
+- Checks: `node tools/check_bank.mjs` covers numeric/string/missing identities,
+  balance, prepare, both decisions and exact-body replay after restart.
+  Its optional `--ec-root` mode executes the actual EC bank service and bank
+  migrations against isolated SQLite, covering the original numeric rejection,
+  deposits, withdrawals, zero-balance `.w all`, cancellation and idempotent
+  commit recovery. All 34 fixture groups passed with EC checkout `d614707`;
+  `python3 tools/test_plugin_bank.py` also passed both engines' native
+  storage/response, process-restart and component checks with sanitizers.
+- Compatibility: no new dependency requirement or EC source change. Existing
+  plugins `1.1.0`, common/telemetry `1.0.0+`, and EC agent `1.9.1+` remain
+  sufficient. Deployment: copy each updated bank script to its game's script
+  directory and restart the map; no full server-process restart is required
+  for this fix. Continue following the endpoint migration procedure if also
+  upgrading from a legacy URL.
+- This fix prevents new invalid journals; it does not rewrite old pending
+  decisions. No production recovery or deployment was performed as part of
+  this change.
+  GSC compilation, deployed-artifact verification and live T5/T6 command checks
+  remain required; see [bank identity validation](README.md#bank-identity-validation).
+
 ### Public game-bank endpoint — TWS #13
 
 | Component | Version | Affected source |