updating buff and debuff icons. separated COA classes from WoW classes on the character creation screen

DEPLOYMENT.md

@@ -5,6 +5,9 @@ Healer Man uses the same local-Gitea deployment pattern as the previous
 filesystem, mount the runnable checkout into one Node container, and update it
 with a local fast-forward pull plus an app restart.
 
+For the repeatable Git, TrueNAS, signed-APK, and Obtainium release checklist,
+follow [RELEASE_RUNBOOK.md](RELEASE_RUNBOOK.md).
+
 The public URL remains `https://iwanttoheal.phenomrom.com`. The old game and
 Healer Man cannot both own host port `4173`; stop the old app before the final
 cutover. Keep its checkout and database until the replacement is verified.
@@ -14,7 +17,7 @@ cutover. Keep its checkout and database until the replacement is verified.
 The `healer-man` TrueNAS app is the browser host and online account server. One
 Node 24 process serves the production Vite bundle and authenticated `/api`
 routes on port `4173`. Its SQLite database stores accounts, hashed credentials,
-sessions, and cloud rosters under `/app/data/game.db`.
+sessions, and cloud rosters under `/app/runtime-data/game.db`.
 
 The source checkout and persistent data are separate mounts. Replacing the
 container, rebuilding `dist`, or pulling source must not replace the database.
@@ -63,18 +66,16 @@ clone alone cannot retrieve them.
 ## First installation
 
 Create an empty Gitea repository named `phenom/healer-man`, then initialize and
-push the local `D:\Projects\HealerMan` project to its `main` branch.
+push the local `F:\Projects\HealerMan` project to its `main` branch.
 
-The current project directory is not yet a Git working tree. After creating the
-empty Gitea repository, run this once from PowerShell on the development PC:
+The project is already connected to Gitea. Verify the checkout and both remote
+URLs from PowerShell with these exact commands:
 
 ```powershell
-Set-Location D:\Projects\HealerMan
-git init -b main
-git remote add origin https://git.whoagland.com/phenom/healer-man.git
-git add .
-git commit -m "Initial Healer Man import"
-git push -u origin main
+Set-Location F:\Projects\HealerMan
+git status --short --branch
+git remote -v
+git branch --show-current
 ```
 
 If the repository slug differs, change both the remote URL here and every
@@ -129,7 +130,7 @@ services:
     environment:
       CORS_ORIGINS: "https://iwanttoheal.phenomrom.com,capacitor://localhost,http://localhost,https://localhost"
       CONTENT_DIR: /app/content
-      DATA_DIR: /app/data
+      DATA_DIR: /app/runtime-data
       HOST: 0.0.0.0
       NODE_OPTIONS: "--max-old-space-size=4096"
       PORT: "4173"
@@ -143,13 +144,15 @@ services:
     restart: unless-stopped
     volumes:
       - /mnt/usbssds/apps/healer-man/app:/app
-      - /mnt/usbssds/apps/healer-man/data:/app/data
+      - /mnt/usbssds/apps/healer-man/data:/app/runtime-data
       - /mnt/usbssds/apps/healer-man/content:/app/content
     working_dir: /app
 ```
 
-Do not remove either persistent mount. `/app/data` owns account/cloud-save data;
-`/app/content` owns downloadable manifests and immutable content objects. The
+Do not remove either persistent mount. `/app/runtime-data` owns
+account/cloud-save data; `/app/content` owns downloadable manifests and
+immutable content objects. Never mount a volume at `/app/data`, because that
+would hide the checkout's required `/app/data/loot/schema.sql`. The
 startup command installs locked dependencies, initializes the schema, publishes
 new or changed content objects, builds the full browser bundle, and starts the
 combined static/API/content server. Existing content objects are reused.
@@ -173,15 +176,64 @@ schema-compatible with Healer Man and must not be copied over the new one.
 
 ## Update workflow
 
-Push `main` from the development PC. Then run on TrueNAS:
+For a code update that includes a new APK, choose the next version first. The
+example below upgrades `0.1.0` to `0.1.1`; replace `2` if it is not the next
+unused Android `versionCode`. Then run these commands in **Windows PowerShell**
+on the development PC. Stop if any test or build fails:
 
-```sh
-git -C /mnt/usbssds/apps/healer-man/app pull --ff-only \
-  /mnt/.ix-apps/app_mounts/gitea/data/git/repositories/phenom/healer-man.git \
-  main
+```powershell
+Set-Location F:\Projects\HealerMan
+
+$VersionName = '0.1.1'
+$VersionCode = 2
+npm version $VersionName --no-git-tag-version
+
+npm run content:test
+npm run server:test
+npm test
+npm run build
+npm test -- --run src/avatar
+npx vitest run src/game/inputManager.test.ts src/game/inputMath.test.ts
+
+git status --short
+git diff --check
+git add -A
+git status --short
+git diff --cached --stat
+git diff --cached --check
+git commit -m "Release Healer Man $VersionName"
+git push origin main
+git rev-parse HEAD
 ```
 
-Restart `healer-man` in the TrueNAS Apps UI afterward. Container startup
+Before `git commit`, read the staged file list printed by `git status --short`.
+Do not commit a `.env` file, password, API token, keystore, APK, database,
+`content/`, `dist/`, `dist-android/`, or `.android-public/` output. The final
+command prints the exact deployed commit ID.
+
+Next, open the TrueNAS Apps UI and **stop** `healer-man`. Open a TrueNAS shell
+and run these exact commands:
+
+```sh
+sudo mkdir -p /mnt/usbssds/apps/healer-man/backups
+if sudo test -f /mnt/usbssds/apps/healer-man/data/game.db; then
+  sudo cp -p \
+    /mnt/usbssds/apps/healer-man/data/game.db \
+    /mnt/usbssds/apps/healer-man/backups/game-$(date +%Y%m%d-%H%M%S).db
+fi
+
+sudo git config --global --add safe.directory \
+  /mnt/usbssds/apps/healer-man/app
+sudo git -C /mnt/usbssds/apps/healer-man/app pull --ff-only \
+  /mnt/.ix-apps/app_mounts/gitea/data/git/repositories/phenom/healer-man.git \
+  main
+sudo chown -R truenas_admin:truenas_admin \
+  /mnt/usbssds/apps/healer-man/app
+sudo git -C /mnt/usbssds/apps/healer-man/app rev-parse HEAD
+```
+
+The TrueNAS commit ID must match the one printed on the development PC. Start
+`healer-man` in the TrueNAS Apps UI afterward. Container startup
 publishes immutable content objects and replaces `manifest.json` only after all
 objects exist, then rebuilds the browser client and starts the server. Android
 devices discover the small new manifest and download only missing or changed
@@ -189,6 +241,14 @@ files. Asset-only updates do not require a new APK. A failed fast-forward pull
 deliberately leaves the running checkout unchanged; resolve diverged history on
 the development machine rather than forcing the TrueNAS checkout.
 
+After the logs say the server is listening on port `4173`, run on TrueNAS:
+
+```sh
+curl -fI http://127.0.0.1:4173/
+curl -fsS http://127.0.0.1:4173/api/health
+curl -fsS http://127.0.0.1:4173/content/manifest.json | head -c 500
+```
+
 To publish content manually without restarting the app container, run inside a
 Node 24 environment that mounts the checkout and content volume:
 
@@ -222,11 +282,11 @@ Install JDK 21 and Android SDK Platform 36 on the development PC and set
 `JAVA_HOME` plus `ANDROID_SDK_ROOT`. The build wrapper also recognizes the
 project's existing portable JDK/SDK layout when present.
 
-For each Android version, push `main` first. Then set the permanent signing-key
-secrets and Gitea token in the development shell:
+For each Android version, complete the exact update workflow above first. Then
+set the permanent signing-key secrets and Gitea token in PowerShell:
 
 ```powershell
-$env:ANDROID_KEYSTORE_FILE = 'D:\secure\healer-man-release.jks'
+$env:ANDROID_KEYSTORE_FILE = 'F:\secure\healer-man-release.jks'
 $env:ANDROID_KEYSTORE_PASSWORD = '...'
 $env:ANDROID_KEY_ALIAS = 'healer-man'
 $env:ANDROID_KEY_PASSWORD = '...'