Undead Patch Notes — Mail Outbox, Checkout Cutover & Reliability

Date: 25 July 2026

Status: Live on production (includes DB migrations)

This pass is mostly account and billing infrastructure: mail is less likely to vanish on a transient send failure, the old checkout path no longer misleads players, and login/register plus trusted-proxy rate limiting are tightened. Most of it is behind the scenes, but registration, verify mail, and shop checkout should feel steadier.

Live site: https://undead.punkcan.art Updates index: https://undead.punkcan.art/docs/updates Related: Account AP stock, vaccine & interaction

1. Legacy checkout disabled

Early POST /api/v1/billing/checkout now returns 410 and directs you to Profile → Game Shop. Retire old scripts or bookmarks that hit legacy checkout.

Shop fulfillment remains account AP potion stock, then allocate on Profile (see the 24 July notes).

2. Account mail outbox

Verify-email and reset-password mail in production are written to a retryable outbox before send. Brief provider failures are less likely to drop messages forever; ops can track and resend by status.

3. Login / register & security (brief)

Usually invisible to players, but now live:

• Register / verify-email return clear conflicts on unique races instead of vague errors
• Reset-password and character-create metadata writes use row locks against concurrent overwrites
• Rate limits key off the client IP behind trusted proxies (so one edge hop does not throttle everyone together)
• Public responses include baseline security headers (CSP, HSTS in production, etc.)

World tick also monitors long-stuck processing actions and alerts ops (lease work remains a follow-up).

What to watch

1. Buy AP potions via Profile → Game Shop.
2. If verify / reset mail is missing, wait and retry or contact ops (outbox is trackable).
3. Gameplay rules still follow the 24 July account-stock / vaccine / interaction post.