feat(template): a module that builds and loads — Phase 5 slice 1

The kit's `template/`: a complete, minimal Runic Gateway module a reader copies,
renames, and runs before reading a chapter. Slice 0 landed the workflow that runs
it; this is the tree that workflow was written against, so the `template` job
arms itself with no edit to the guard.

Installed into a real core it adds one public page at `/examplegame/status`, a nav
row pointing at it, one API route described in an OpenAPI fragment core merges,
one table created by an idempotent schema fragment and dropped by a purge file,
and both lifecycle hooks. That is deliberately less than a real module does; what
it is complete about is the shape — every seam used once, with the reasoning next
to it.

Four decisions, settled with the org lead:

1. **Public tier only, plus the lifecycle hooks.** §2.11.1 d1's "one public route",
   plus enough to show the whole vertical seam once. Admin and player tiers become
   worked examples quoted from module-uo in chapter 2 rather than two thirds of a
   tree the reader deletes on day one.
2. **The release workflow ships as a file, in BOTH flavours** — `.gitea/` and
   `.github/`. Neither runs where it sits (a workflow is only read from a
   repository root) and each arms itself when the reader's copy is its own repo.
   Packaging is the part of a module that cannot be guessed at, and the kit's
   audience is outside this org, so assuming Gitea would have been assuming our
   own deployment. Core installs from a URL and does not care where the release
   lives — only that the host is on the operator's `MODULE_SOURCE_HOSTS`.
3. **A rename checklist that CI verifies**, not a rename script. `template/README.md`
   carries the table; `scripts/checkRenameSites.js` holds it against the tree in
   both directions — an unlisted file that still carries the placeholder fails, and
   so does a listed file that no longer does. The second half is the one usually
   left out and the more valuable: a row that has stopped matching reads as
   instructions to edit something that is not there. Same rule core's identifier
   check follows about its own exemptions. It has its own ten-test suite, run by
   CI as `node --test`, because a check that has never been shown to fail is a
   check nobody knows the state of.
4. **A neutral invented game.** One deviation from the literal answer, forced by
   decision 3: the id is `examplegame`, not `example`. The checklist check is a
   text search, and `example` occurs in ordinary English ("for example") all over
   prose that is not a rename site — a placeholder that cannot occur by accident is
   what makes the check answerable instead of a source of false alarms someone
   learns to ignore.

**The pin moves to the 1.4.0 bump** (website `edge` 1b692bf), which is what
`template/module.json` declares as `coreApi`. Slice 0 pinned its parent, before
1.4.0 existed, so `checkCoreApi.js` arms for the first time here — it asserts
EQUALITY, and its failing on the next contract bump is the system working.

Also in CI: the client tests now run AFTER the build (two of them read the built
chunk and skip without one — run first, the job reports green while asking nothing
about the artifact that ships), and `check:swagger` verifies the committed
fragment is current.

## The finding: an UPDATE that changes nothing does not touch ON UPDATE CURRENT_TIMESTAMP

Every suite passed, both guards passed, the chunk built, the module loaded into a
real core and the page rendered correctly. Two hours later the same page said the
world was offline, and it was wrong.

`updated_at` was declared `ON UPDATE CURRENT_TIMESTAMP`, and MariaDB fires that
only when an UPDATE actually CHANGES a value. The boot refresh writes the same
numbers every thirty seconds — which is exactly what a quiet game looks like — so
the timestamp froze at the first write, the row crossed the freshness window, and
the model correctly reported a stale row as offline. Verified against the live
database: two hours of refreshes, `updated_at` still the boot timestamp.

No test in this repo could see it. The model takes its clock as an argument, and
nothing in a suite runs the same UPDATE twice against a real database. It is only
visible as a page that was right when you looked at it and wrong an hour later.

The writer now sets `updated_at = CURRENT_TIMESTAMP` explicitly and the column
drops the clause that was not doing what it looked like it was doing; both carry
the reasoning. Re-verified end to end: the timestamp advances every interval and
the API reports fresh.

Falling out of the fix, the schema fragment gained the rule the reader hits next:
**changing a table is an ALTER, never an edit to its CREATE** — `CREATE TABLE IF
NOT EXISTS` does nothing when the table exists, so an edited column definition
takes effect on a fresh install and on no existing one, which is the worst
possible split because your development database is usually the fresh one.

## Verified

- 29 server tests, 18 client tests, 10 kit-script tests; `check:imports`,
  `check:externals`, `check:swagger` and `checkCoreApi` all green, run in CI's own
  order from a clean `npm ci`.
- Browser smoke (MODULE_API.md §7.7) against a real core built from the pinned
  ref: module `started`, published on `/api/v1/public/modules`, chunk served
  `no-cache` with the right MIME from the entry's directory while `module.json`
  and the server source 404, script tag injected after core's bundle, the page
  rendering inside core's own chrome, the nav row interleaved into the public
  header between Wiki and About, SPA navigation into it from another page, the
  module's path and schema and tag merged into `/api/docs.json`, and
  `[examplegame] registered against core API 1.4.0` in the console with no CSP
  report and no React error.

Refs: MODULE_SYSTEM.md §2.11.1 (slice 1), MODULE_API.md §2.x, §3.x, §5.1, §7.7.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/checkRenameSites.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+// The rename checklist in `template/README.md`, checked against the tree.
+//
+// A reader's first action is to copy `template/` and make it theirs, and the only
+// thing telling them where the placeholder name is buried is that table. A
+// checklist nobody verifies is wrong by the second edit to the template — someone
+// adds a file, mentions the placeholder id in it, and every reader after that
+// ships a module with a stray `examplegame` in its OpenAPI tags.
+//
+// So this asserts the table and the tree agree, in BOTH directions:
+//
+//   • every file that still mentions the placeholder is listed, and
+//   • every listed file exists and still mentions it.
+//
+// The second half is the one that is easy to leave out and is the more valuable:
+// an entry that has stopped matching is an entry that will be read as instructions
+// to edit something that is not there. Same rule the identifier check in core's CI
+// follows about its own exemptions — an exemption that no longer matches fails the
+// build rather than being quietly tolerated.
+//
+// **Why the placeholder is `examplegame` and not `example`.** This is a whole-file
+// text search, and `example` appears in ordinary English ("for example") all over
+// prose that is not a rename site at all. A placeholder that cannot occur by
+// accident is what makes a check like this answerable rather than a source of
+// false alarms someone eventually learns to ignore.
+//
+// Usage: node scripts/checkRenameSites.js        (from the repo root)
+
+const fs = require('fs')
+const path = require('path')
+
+const ROOT = path.resolve(__dirname, '..')
+const TEMPLATE = path.join(ROOT, 'template')
+const CHECKLIST = path.join(TEMPLATE, 'README.md')
+
+// Anything a rename has to touch: the id (`examplegame`), the display name
+// ("Example Game"), and the placeholder world ("Example World"). One pattern
+// rather than three, because they are one decision.
+const PLACEHOLDER = /example[ -]?(game|world)/i
+
+// Directories with nothing of ours in them. `dist` and `node_modules` are build
+// output — a chunk full of the placeholder is not a rename site, it is the
+// consequence of one.
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'dist'])
+
+// The checklist is the one file exempt from the scan: it is a table OF the
+// placeholder and would trivially list itself.
+const SELF = 'README.md'
+
+/** Every file under `template/`, template-relative, sorted. */
+function templateFiles(dir = TEMPLATE, out = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      templateFiles(path.join(dir, entry.name), out)
+    } else if (entry.isFile()) {
+      out.push(path.relative(TEMPLATE, path.join(dir, entry.name)).split(path.sep).join('/'))
+    }
+  }
+  return out.sort()
+}
+
+/**
+ * The paths the checklist names, read from between its two markers.
+ *
+ * Delimited by explicit HTML comments rather than by looking for a heading or for
+ * every backticked path in the document: the README quotes plenty of paths in
+ * prose and in its tree diagram, and none of those are checklist entries. An
+ * explicit marker also means the table can be reformatted freely.
+ */
+function checklistPaths(markdown) {
+  const start = markdown.indexOf('<!-- rename-sites -->')
+  const end = markdown.indexOf('<!-- /rename-sites -->')
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error(
+      'template/README.md has no <!-- rename-sites --> … <!-- /rename-sites --> block. ' +
+      'That block is the checklist this check exists to verify.',
+    )
+  }
+  const table = markdown.slice(start, end)
+  const paths = []
+  for (const line of table.split('\n')) {
+    // A table row whose first cell is a backticked path.
+    const match = /^\|\s*`([^`]+)`\s*\|/.exec(line.trim())
+    if (match) paths.push(match[1])
+  }
+  return paths
+}
+
+/** Everything wrong, as sentences. Empty means the checklist is current. */
+function problems({ files, listed, contains }) {
+  const out = []
+  const listedSet = new Set(listed)
+
+  const duplicates = listed.filter((p, i) => listed.indexOf(p) !== i)
+  for (const p of new Set(duplicates)) out.push(`${p} is listed in the checklist twice.`)
+
+  for (const file of files) {
+    if (file === SELF) continue
+    if (!contains(file)) continue
+    if (!listedSet.has(file)) {
+      out.push(
+        `${file} still mentions the placeholder and is NOT in the rename checklist. ` +
+        'Add a row for it, or take the placeholder out of the file.',
+      )
+    }
+  }
+
+  const present = new Set(files)
+  for (const file of listed) {
+    if (!present.has(file)) {
+      out.push(`the checklist lists ${file}, which does not exist. Remove the row or restore the file.`)
+    } else if (!contains(file)) {
+      out.push(
+        `the checklist lists ${file}, which no longer mentions the placeholder. ` +
+        'A row that has stopped matching tells a reader to edit something that is not there.',
+      )
+    }
+  }
+
+  return out
+}
+
+module.exports = { PLACEHOLDER, checklistPaths, problems, templateFiles, TEMPLATE }
+
+if (require.main !== module) return
+
+if (!fs.existsSync(TEMPLATE)) {
+  console.log('checkRenameSites: no template/ yet — nothing to check')
+  process.exit(0)
+}
+
+const files = templateFiles()
+const listed = checklistPaths(fs.readFileSync(CHECKLIST, 'utf8'))
+const contains = (file) => PLACEHOLDER.test(fs.readFileSync(path.join(TEMPLATE, file), 'utf8'))
+
+const found = problems({ files, listed, contains })
+
+if (found.length) {
+  console.error(`\n${found.length} problem(s) with the rename checklist in template/README.md:\n`)
+  for (const p of found) console.error(`  - ${p}`)
+  console.error('')
+  process.exit(1)
+}
+
+console.log(`OK — the rename checklist matches the template (${listed.length} files).`)