Fix bank GUID serialization on T5 and T6 (Refs #15)

README.md

@@ -226,6 +226,47 @@ are not refunded when a match ends or its process crashes. As with any live
 score, the journal cannot make game memory and the remote database atomic
 across a machine/storage failure.
 
+### Bank identity validation
+
+Bank scripts `2.0.1` use T5's `player getGuid()` and T6's persistent
+`player.guid`, matching each game's telemetry identity source. Both normalize
+integer identities to strings and preserve existing strings exactly, including
+large or zero-prefixed GUIDs. Missing or invalid identities show a private
+"Bank player identity unavailable" message before any request, journal write
+or score change. GUIDs must meet EC's existing 1–64 character token contract
+(`A–Z`, `a–z`, `0–9`, `_`, `.`, `:`, `-`). Persisted decisions and their retries
+retain that original string identity, even after the player disconnects.
+
+No new plugin or EC update is required for this fix. Install the updated bank
+script in each game's script directory and restart the map. This does not
+repair an older numeric-GUID journal: preserve any such pending decisions and
+their request IDs for scoped recovery; never delete them to unblock a rebuild.
+The endpoint upgrade procedure below still applies to legacy URLs.
+
+Run `node tools/check_bank.mjs` for both scripts' portable fixtures. To also
+exercise the actual EC bank service and bank migrations with isolated SQLite:
+
+```sh
+node tools/check_bank.mjs --ec-root /path/to/electric-cherry
+python3 tools/test_plugin_bank.py
+```
+
+The optional EC check requires that checkout's installed `typescript` and
+`better-sqlite3` dependencies. It uses no EC configuration, credentials, network
+or production database. It covers numeric rejection, normalized balances and
+transfers, zero-balance `.w all`, cancellation, and idempotent commit replay.
+Native checks require the pinned JSON headers as described above. These tests
+do not validate game VM linking, HTTP route authentication or deployed artifacts.
+
+After deployment, compare the SHA-256 hashes of both installed bank scripts
+with the source files from this release, and confirm the map restarted. On T5
+and T6, check `.b`, a deposit, a withdrawal, and `.w all` with zero bank balance
+(an insufficient-balance message with no point change). Confirm EC records
+string GUIDs matching telemetry, one ledger entry per completed transfer, and
+unchanged `score_total`. On a test server, interrupt settlement and restart the
+map/process: the original request ID and decision must settle once without
+reapplying game points. GSC compilation and these live checks remain required.
+
 ### Upgrading the bank endpoint
 
 Deploy the Electric Cherry agent `1.9.1+` companion to