website/TEAMS.md

@@ -2537,6 +2537,19 @@ inside `website`, so the bot half lands in the same PR as the server half; `modu
 because the command that proves the seam belongs to the module and not to core (see the amendment at
 the head of [§7.1](#71-slash-command-registration)).
 
+**Walked on the live rig before the PRs opened** — real ServUO + real sidecar (protocol 4) + the app
+with module-uo installed, with the bot's own pull/execute path driven against it and a fake standing
+in for Discord. It proved the audience rung holding over the chat surface (guilds gated to `staff`:
+anonymous and linked-player refused, linked admin served, same command), the Discord provider
+resolving by `kind` on a deployment whose provider slug is `my-discord`, a banned account resolving as
+unlinked, the disable nudge firing with its reason and degrading to a log line with no bot running,
+and the pull emptying plus dispatch answering `unknown` for a module switched off at runtime.
+
+**It found two defects, both folded in.** A refusal was posted PUBLICLY — ephemerality is fixed at the
+deferral, before the handler has said anything, so the envelope's flag was read and ignored, and "not
+shown to your account" announced a member's access level to the channel. And the refusal offered
+linking on a shard gated to `staff`, where linking reaches `player` and stops.
+
 **The bot got its first test harness.** It had no `test` script and no tests at all — CI ran
 `npm ci --prefix bot` and nothing else — which was defensible while the bot only wired up its own
 static commands. It is not defensible now that it merges a pulled set into a single all-or-nothing