docs: cut stale design notes and fix the security report channel

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -10,8 +10,8 @@ body:
         - **`docs/quickstart.md` §8** has one troubleshooting entry per known failure mode, keyed to
           the exact message each one prints. Version mismatches, busy ports, `UNREACHABLE`
           databases, "Unable to connect", and wrong-build clients are all in there.
-        - **Security problems do not go here.** Use the "Report a vulnerability" link in this repo's
-          Security tab (private advisory) — do not open a public issue.
+        - **Security problems do not go here.** Send a private message to a maintainer on the
+          [LyraCore Discord](https://discord.gg/wxWHS3Tbj). Do not open a public issue.
 
         Public/VPS hosting, Windows/WSL, non-5875 clients, and requests for game data are out of
         scope for this alpha and will be closed as such (`SUPPORT.md` has the full list).

.github/ISSUE_TEMPLATE/config.yml

@@ -7,5 +7,5 @@ contact_links:
     url: https://github.com/LyraCoreProject/LyraCore/blob/main/docs/quickstart.md#8-troubleshooting
     about: One entry per known failure mode, keyed to the exact message it prints. Check here first.
   - name: Report a security vulnerability
-    url: https://github.com/LyraCoreProject/LyraCore/security/advisories/new
-    about: Private advisory thread. Do not report security problems in a public issue — several weaknesses are already known and accepted for this alpha's local-development-only posture, so check the advisory isn't a duplicate first.
+    url: https://discord.gg/wxWHS3Tbj
+    about: Send a private message to a maintainer on the LyraCore Discord. Do not report security problems in a public issue. This alpha supports local development only, and some weaknesses are known and accepted for it.

CONTRIBUTING.md

@@ -123,9 +123,9 @@ when** replace **Fix direction**.
 ## Reporting a bug
 
 Open an issue with the bug template: what you did, what you saw, and your `./lyracore doctor`
-output. If you know what 1.12.1 does instead, say so. Report a security problem privately through
-[GitHub's vulnerability reporting](https://github.com/LyraCoreProject/LyraCore/security/advisories/new),
-never in a public issue. [`SUPPORT.md`](SUPPORT.md) says what is in scope.
+output. If you know what 1.12.1 does instead, say so. Report a security problem in a private
+message to a maintainer on the [LyraCore Discord](https://discord.gg/wxWHS3Tbj), never in a public
+issue. [`SUPPORT.md`](SUPPORT.md) says what is in scope.
 
 ## Working with an AI agent
 

SUPPORT.md

@@ -1,74 +1,68 @@
 # Getting help
 
-LyraCore is an alpha, maintained by a very small number of people in their own time. There is no
-support contract, no SLA, and no hosted service. What there is: documentation that tries to be
-specific, and a tracker that gets read.
+LyraCore is an alpha, maintained by a few people in their spare time. There is no support contract
+and no hosted service.
 
-## The answer is often already written down
+## Look here first
 
 | Your situation | Where to look |
 |---|---|
-| "I cloned it, now what?" | [`docs/quickstart.md`](./docs/quickstart.md) — prerequisites, `./lyracore dev up`, account creation, `realmlist.wtf`, LAN play. |
-| The stack will not start, a port is busy, `doctor` complains, the client will not connect | [`docs/quickstart.md` §8](./docs/quickstart.md#8-troubleshooting) — one entry per failure mode, with the exact message each one prints. |
-| What does this CLI command do / is it safe | The [CLI command reference](https://github.com/LyraCoreProject/lyracore-cli/blob/main/docs/commands.md) in the `lyracore-cli` repository. |
-| How does the thing actually work | [`docs/architecture.md`](./docs/architecture.md), whose §9 indexes the rest of the documentation. |
-| I want to change something | [`CONTRIBUTING.md`](./CONTRIBUTING.md): the three documents to read first, what gets in, and how a pull request is judged. |
-| Is it safe to expose this | No — see the warning banner in [`README.md`](./README.md). |
-| Where does world content come from | [`docs/data-ingestion.md`](./docs/data-ingestion.md). |
+| You cloned it and want a running realm | [`docs/quickstart.md`](./docs/quickstart.md): prerequisites, `./lyracore dev up`, accounts, `realmlist.wtf` and LAN play. |
+| The stack does not start, a port is busy, `doctor` complains, or the client does not connect | [`docs/quickstart.md` §8](./docs/quickstart.md#8-troubleshooting), one entry per failure with the message it prints. |
+| What a CLI command does, and whether it is safe | The [CLI command reference](https://github.com/LyraCoreProject/lyracore-cli/blob/main/docs/commands.md) in the `lyracore-cli` repository. |
+| How the server works | [`docs/architecture.md`](./docs/architecture.md). |
+| You want to change something | [`CONTRIBUTING.md`](./CONTRIBUTING.md). |
+| Where world content comes from | [`docs/data-ingestion.md`](./docs/data-ingestion.md). |
 
-Before reporting anything, run:
+Before you report a problem, run:
 
 ```bash
 ./lyracore doctor
 ./lyracore dev status
 ```
 
-Between them they distinguish most of the common failures — a wrong toolchain version, a port held
-by someone else's process, a healthy pair of processes pointed at a node where nothing was ever
-published.
+`doctor` finds a wrong toolchain version or a port held by another process. `dev status` finds a
+running stack whose node has no published Module.
 
 ## Where to ask
 
-**Bugs, questions and concrete proposals → [GitHub Issues](https://github.com/LyraCoreProject/LyraCore/issues).**
-For a bug, include the quickstart step you were on, your `./lyracore doctor` output, and the log the
-failure appeared in. Those three answers turn a report into a fix. A question is welcome there too:
-say what you expected and what you saw.
+Use [GitHub Issues](https://github.com/LyraCoreProject/LyraCore/issues) for bugs, questions and
+proposals. For a bug, give the quickstart step you were on, your `./lyracore doctor` output and the
+log that shows the failure. For a question, say what you expected and what you saw.
 
-**Security reports → not here.** Use GitHub's private vulnerability reporting on this repository; do
-not open a public issue.
+Report a security problem in a private message to a maintainer on the
+[LyraCore Discord](https://discord.gg/wxWHS3Tbj). Do not post it in a channel or a public issue.
+Report harassment or abuse the same way.
 
-There is no chat server, no forum, no mailing list, and no social account. If you find something
-claiming to be an official LyraCore channel, it is not one.
+This repository and that Discord server are the only official channels.
 
 ## What is in scope
 
-Supported, and worth reporting:
+We support:
 
-- The **local development fixture** on Linux and macOS: `./lyracore` and everything
+- The local development fixture on Linux and macOS: `./lyracore` and everything
   [`docs/quickstart.md`](./docs/quickstart.md) describes.
-- A stock, unmodified **1.12.1 build 5875** client connecting over loopback or a private LAN.
-- The **seeded** world — the fixture written by the module's `init` reducer, which needs no
-  client-data import.
-- Anything in this repository being wrong: a broken command, a stale document, a dead link.
-
-Out of scope, and closed as such:
-
-- **Public or VPS hosting.** Not supported in this alpha, at all. See the warning banner in
-  [`README.md`](./README.md).
-- **Windows and WSL.** Not covered and not tested.
-- **Any client that is not build 5875**, and any modified or launcher-patched client.
-- **Requests for game data** — a client, MPQ/DBC files, or a world-database dump. This project
-  distributes none of those and will not point you at somewhere that does.
-- **Problems that only appear after your own content import.** Say so in the report; it is still
-  worth filing, but it is a different world from the seeded fixture the test suites run against.
-- Conduct problems — harassment, abuse, or bad-faith participation. Report those privately to the maintainers rather than in a public issue.
-
-## Response expectations
-
-Best effort, by people with day jobs. `P1` (blocks play, or a live regression) gets looked at first;
-everything else is queued by priority label (`P1`-`P4`) on [GitHub Issues](https://github.com/LyraCoreProject/LyraCore/issues).
-A quiet issue has not been rejected. An issue with **How to check** waits on a person at a real game
-client, which is scarcer here than engineering time.
-
-The fastest way to get something fixed is a pull request. [`CONTRIBUTING.md`](./CONTRIBUTING.md)
-says where to start and how a pull request is judged.
+- An unmodified 1.12.1 build 5875 client over loopback or a private LAN.
+- The seeded world that the Module's `init` reducer writes. It needs no client data import.
+- Errors in this repository, such as a broken command, a stale document or a dead link.
+
+We close these as out of scope:
+
+- Public or VPS hosting. The [`README.md`](./README.md) says why.
+- Windows and WSL. Nobody tests them.
+- A client that is not build 5875, or a modified or launcher-patched client.
+- Requests for game data: a client, MPQ or DBC files, or a world database dump. This project
+  distributes none of them and does not say where to find them.
+
+A problem that appears only after your own content import is still worth a report. Say so in it,
+because the test suites run against the seeded world, not yours.
+
+## Response times
+
+We work through [issues](https://github.com/LyraCoreProject/LyraCore/issues) by priority label, `P1`
+(blocks play, or a live regression) first and `P4` last. A quiet issue is not a rejected one. An
+issue with **How to check** waits for a person with a real game client, and we have fewer of those
+than engineers.
+
+A pull request is the fastest way to get a fix. [`CONTRIBUTING.md`](./CONTRIBUTING.md) says how we
+judge one.

docs/benilla-compatibility.md

@@ -5,8 +5,8 @@ The Gateway's development dependencies pin `benilla-protocol` and `benilla-srp`
 to `c2fc3cf304075a0fa1c9accffaf5efb99be9edfe`. Tests use that revision from Cargo,
 so changes in a neighboring Benilla checkout cannot change the results.
 
-All 277 requests in the pinned Benilla writer now have a typed dispatch pattern
-or a reviewed raw route. The inventory test flags requests with neither source
+Every request in the pinned Benilla writer has a typed dispatch pattern or a
+reviewed raw route. The inventory test flags requests with neither source
 classification. This accounts for requests; it does not certify every gameplay path or every outgoing
 packet. Unsupported operations return a Refusal where the protocol defines one,
 or a System Message naming the unavailable feature.
@@ -115,10 +115,6 @@ The Headless Client scenarios cover these exchanges through the same WorldStore
   packet's quest id, money and XP. An incomplete quest must stay on the progress
   screen and grant nothing when its reward screen is requested.
 
-The reward scenario exposed `CMSG_QUESTGIVER_REQUEST_REWARD`, which now uses the
-same durable completion evaluation as `CMSG_QUESTGIVER_COMPLETE_QUEST`. Choosing
-a reward still crosses the Store Seam and leaves the grant rules in the Module.
-
 ## Durable scenarios
 
 The ignored `benilla_durable_` tests start private SpacetimeDB instances on loopback
@@ -149,25 +145,6 @@ runs them in CI. They cover:
 - Refusing a distant, dead or wrong-kind innkeeper, then binding at the selected
   innkeeper and receiving the new hearth point during the same World Session.
 
-Module inventory regressions also check that split, destroy, use, move, merge,
-vendor sale, disenchanting and reagent consumption cannot change offered trade
-items. Quest item exchanges use the same inventory Gate. Scheduled crafting checks
-all reagents before consuming any or charging power. Automatic grants that grow
-an offered stack clear both acceptances and refresh both trade windows. Failed
-crafts also refresh the restored quantities. A completed trade delivers the newly
-accepted stack count and copper. Equipment moves refuse a two-handed weapon
-while an offhand item is equipped, and refuse the reverse combination. The
-Character must remove the conflicting item first.
-
-The XP scenario found a codec mismatch. Vanilla kill XP includes base XP and the
-group multiplier; other XP awards have no extra fields. The Gateway now writes
-that layout directly. `XpEvent.rested_bonus` is an appended field with a zero
-default so the kill packet can distinguish base XP from rested XP.
-
-The bag scenario found missing container pointers at world entry. Those pointers
-now follow the item and Character creation packets, using the same slot mapping
-as incremental inventory updates.
-
 ## Additional protocol corrections
 
 The Gateway owns these build-5875 layouts where the protocol library differs:
@@ -188,6 +165,11 @@ The Gateway owns these build-5875 layouts where the protocol library differs:
 Ticket requests receive Refusals after framing checks. The unavailable service
 does not decompress the optional transcript or allocate from its size headers.
 
+Kill XP carries base XP and the group multiplier; other XP awards have no extra
+fields, and the Gateway writes that layout directly. At world entry, container
+pointers follow the item and Character creation packets, with the same slot
+mapping as incremental inventory updates.
+
 At War changes reach the existing Module operation. Bind and talent-reset
 confirmations also reach existing Module operations. Selecting the gossip option
 opens the confirmation dialog first. Talent quotes use the same price calculation
@@ -234,21 +216,6 @@ System Message. Possession and remote movement authority remain unavailable.
 The scenarios establish the behavior listed above, not every branch of the older
 handlers. Further gameplay verification includes targeted item spells, channel
 refresh and reconnect, pet spell execution, multi-shard instance flows and the
-complete outgoing opcode inventory. The source report contains 346 outgoing
-opcode rows; decoder presence alone does not require a realm to emit each one.
-
-## Verification record
-
-The workspace run passed 4,376 tests with `lyracore-package-delta` excluded,
-using the Module's `debug_reducers` feature. All eight durable Benilla scenarios
-passed against disposable SpacetimeDB instances. Formatting, workspace Clippy with
-all targets and features, and the check of all 1,182 Gateway binding files passed.
-Plain publish from `main` at `f09dafbd` to this Module migrated a private instance
-without clearing it. Its Character rows survived, and `XpEvent.rested_bonus` was
-readable after the update.
-
-An earlier full workspace run found two unchanged package-delta fixture failures:
-`a_package_may_insert_a_quest_inside_the_package_range` and
-`an_incomplete_quest_insert_is_refused`. Their shared `WHOLE_QUEST_ROW` lacks the
-`quest_type` field required by the existing package-delta schema. Those files are
-outside this change.
+complete outgoing opcode inventory. Decoder presence alone does not require a
+realm to emit an outgoing message.
+