At this level
pet.trezy · 48- pet.trezy.achievement record How a badge is earned. Published to the game's repo, one per achievement, alongside the `community.lexicon.badge.definition` it points at. The split is deliberate: the DEFINITION is the portable, standard artefact any client can read and render, and this is the game's private bookkeeping. Nothing here is needed to display a trophy — only to decide whether somebody has earned one — so it stays out of the interoperable record rather than bloating it with rules no other reader could evaluate anywa
- pet.trezy.activity record
- pet.trezy.authGame permission-set Everything the game writes to a player's repo. ⚠ ONE SET, BECAUSE EVERY PERMISSION IS NEEDED TO PLAY; there is no optional feature to split off. A set can grow without anybody re-consenting, which is the point of having one. ⚠ community.lexicon.badge.award IS NOT HERE AND CANNOT BE: HappyView only lets a pet.trezy.* set grant pet.trezy.* collections, so the badge collection is requested as its own repo: scope. ⚠ NO rpc PERMISSIONS, SO NO aud: the client calls HappyView procedures directly, not t
- pet.trezy.claimAwards procedure Publishes the badges the awards ledger says the caller has earned into the caller's own repo, as `community.lexicon.badge.award` records, and answers with everything they hold. Called on sign-in and after anything that might have earned one. It decides nothing: `job.run:games.achievements` owns that, and this only copies what is already recorded — so calling it twice writes nothing the second time, and calling it can never award anything.
- pet.trezy.collectCoins procedure
- pet.trezy.confessForgeries procedure Looks for records of the caller's that an ingest guard refused, and if there are any, writes the note twice: once into the game's own repo through a linked repo, where the caller cannot reach it, and once into the caller's repo, where they can delete it. Called on sign-in. It changes nothing about what the account may do — the forged records were refused at ingest, so the ledger was never wrong — and it is safe to call on every visit: an unchanged list rewrites nothing.
- pet.trezy.createInteraction procedure
- pet.trezy.createPet procedure
- pet.trezy.devicePreference record
- pet.trezy.dropFood procedure Put one morsel on the ground. Writes to the caller's terrarium space; the space is created lazily by the first drop, so a player who never feeds anything never gets one.
- pet.trezy.feature record One week's Pet of the Week, held in the publisher's repo. The record key is the ISO week (e.g. 2026-W39), so there is exactly one per week and every step that writes it is idempotent. ⚠ ONLY THE PUBLISHER'S COPY COUNTS. The index refuses this collection from any other repo, because eligibility, the ribbon and the badge all read it.
- pet.trezy.featureConsent record This keeper is happy for their pets to be Pet of the Week on Bluesky, with an @mention. The record existing is the yes; deleting it is the no. ⚠ PUBLIC ON PURPOSE, unlike pet.trezy.preferences: the weekly pick has to read it and cannot read a permissioned space, and agreeing to be posted about in public says nothing private. Not signed: forging your own consent is consenting, and a copy in anybody else's repo is never read.
- pet.trezy.featureReply record The featured keeper's answer for one week, keyed by that ISO week. Either a note to quote in the post (text, possibly empty) or decline: true for 'not this time'. Written only by pet.trezy.replyToFeature.
- pet.trezy.food record One kind of food. Published by the game, never by a player — the definitions guard refuses these from anybody but the publisher, the same as species and tiers. A food a client cannot draw must render nothing rather than a substitute, so these outlive any given build on purpose.
- pet.trezy.foodDrop record One morsel lying on the ground. Lives in the player's `pet.trezy.terrarium` SPACE, not their public repo: it is transient scenery, and a repo record would need a new OAuth scope in three places — which happyview-config.ts documents as breaking sign-in outright when the third is missed. A high price for recording that a morsel is at x=412. ⚠ NOTHING HERE IS SIGNED, SO NOTHING HERE MAY CARRY CONSEQUENCES. setPreferences.lua states the rule this obeys: a space is access control, not attestation. Fo
- pet.trezy.forgetDevice procedure Delete one device's text style override. This is the cleanup half of per-device preferences: a browser whose local storage is cleared can no longer find its own row, so without a way to delete rows by hand they accumulate for ever. Acts on the caller's own space and can only ever delete the caller's own row.
- pet.trezy.gameConfig record The game's tunable numbers — caps, and the curves that decay a pet's care — published in the game's own repo (did:plc:ollch4g7tes2reb5eceiwuol) at rkey `self`. Only records from that DID are ever read — record.index:pet.trezy.gameConfig refuses the rest, and a forged config is worth more to an attacker than a forged tier because it raises every cap at once. These are records rather than constants because an upgrade system is coming: players will unlock higher caps as records in their OWN repo, s
- pet.trezy.getCensus query The whole game in a handful of numbers, for /stats. Distinct from pet.trezy.getStats, which reports on ONE pet — this one never looks at an individual animal. Every figure is a plain aggregate over an indexed table, deliberately: the leaderboard pays three queries per pet to score a page, and a census that did the same would pay it for every pet in the game on every load.
- pet.trezy.getDefinitions query Every species and tier definition the game will actually price from. Reads the INDEX, not the publisher's PDS, and filters to the publisher DID. The store must price from the same rows createPet charges from: definitions can be published and not yet indexed, and reading the PDS in that state renders a full catalogue at correct prices where every purchase refuses. Returns both collections in one answer so a species can never be shown without its tier.
- pet.trezy.getDiagnostics procedure Everything the server knows about the CALLER's own game state. Read-only; writes nothing. Takes no input at all, and that is the security model: with no `did` parameter there is no way to ask about anybody else, so cross-account access is impossible by construction rather than gated by a check that could later be loosened. A PROCEDURE rather than a query for one concrete reason: HappyView enforces authentication on procedures at the transport, so an unauthenticated call gets a 401 and this scr
- pet.trezy.getFeatureCandidates query Keepers who could be Pet of the Week as of a moment, and for each the pets that could be featured. A keeper qualifies when they have a featureConsent record, an activity record in the 14 days before asOf, no refused record in the 90 days before it, were not the keeper of a feature picked in the 365 days before it, and were not passed over in the 84 days before it. A pet qualifies when it is not retired and has at least 3 interactions. Every window is measured from asOf, never from the clock, so
- pet.trezy.getFeatureStatus query The caller's own Pet of the Week state: consent, the account-wide interaction count, this week's pick and the last posted feature. ⚠ IT ONLY EVER DESCRIBES THE CALLER; there is no parameter that names anybody else.
- pet.trezy.getFeatures query Feature records, newest week first, with what a reader needs to show them: the pet's facts, the keeper's reply and consent. Public: every field here is already public in somebody's repo.
- pet.trezy.getForgeries query Every record of this account's that an ingest guard refused, one entry each, with the reason written out. Reads `trezy_pet_rejections`, which the guards fill as forged records arrive on the firehose — so this is a report of what was already stopped, not a check performed now. Nothing here changes what the account may do: the refusal happened at ingest and the ledger never saw the record.
- pet.trezy.getLeaderboard query
- pet.trezy.getNewPets query The pets adopted in the 7 days before asOf, for the weekly arrivals post. Live pets only: a pet retired inside the same week is not an arrival any more. ⚠ `total` IS THE TRUE COUNT AND `pets` IS ONLY WHAT FITS ON STAGE — the post's number must be how many animals arrived, not how many the renderer could draw. Carries no keeper DID and no pet name, because the post says neither — `#pet` carries `rkey` rather than the at-URI so the caller never even receives the keeper's DID, which sits in the URI
- pet.trezy.getPet query
- pet.trezy.getPets query The at-uris of a player's pets, newest first, optionally filtered by state. Returns IDs only by default.
- pet.trezy.getPreferences query Everything the caller's account knows about how to present the game: the account-wide default, and every device that has been given its own text style. Takes no DID — it answers for whoever is authenticated and nobody else. ⚠ IT RETURNS THE WHOLE PICTURE RATHER THAN AN ANSWER, deliberately: which of these applies depends on which device is asking and what its browser still remembers, and that reconciliation lives in one tested place on the client (src/lib/preferences.ts) instead of being half he
- pet.trezy.getResetStatus query The caller's most recent account reset, if they have ever started one. Answers the question the client asks on every load: is a reset running, did the last one finish, and did it finish cleanly. A QUERY rather than a procedure because it is read-only and polled while a reset runs. It takes no parameters at all — it reports on `caller_did` and nothing else, so there is no way to watch somebody else's reset. Anonymous callers get a refusal rather than a 401: a Lua script cannot set its own HTTP s
- pet.trezy.getStats query
- pet.trezy.getWallet query One pet's share of what has accrued since the wallet's anchor.
- pet.trezy.group record A group a species can belong to — a family (canines), a habit (nocturnal), or a place (woodland). Published in the game's own repo (did:plc:ollch4g7tes2reb5eceiwuol); record.index:pet.trezy.group refuses the rest. GROUPS OVERLAP BY DESIGN: a wolf cub is a mammal AND a canine AND woodland, and all three are true at once. That is what lets the vocabulary mix levels — a class next to a family next to a behaviour — without any of them being wrong, which a single field forcing one bucket per species
- pet.trezy.newPets record One week's arrivals post, held in the publisher's repo, keyed by the ISO week (e.g. 2026-W40). It is both the history and the idempotency guard: a run that finds this week's record posts nothing. ⚠ ONLY THE PUBLISHER'S COPY COUNTS — the index refuses this collection from any other repo, or anybody could stop the week's post by writing their own.
- pet.trezy.pet record
- pet.trezy.preferences record
- pet.trezy.repairRecords procedure Report, clean up, or repair the caller's own game records. Acts only on the authenticated caller's repo; it never accepts a DID.
- pet.trezy.replyToFeature procedure The featured keeper's answer for one week: a note to quote in the post (text, may be empty) or decline: true for 'not this time'. Writes pet.trezy.featureReply/<week> into the caller's repo. Refuses unless the caller is that week's keeper and the post has not gone out yet.
- pet.trezy.resetAccount procedure Queue the erasure of everything the game knows about the caller. THE MOST DESTRUCTIVE CALL IN THE GAME AND IT CANNOT BE UNDONE — pets, money, the starter grant, the high-water mark and every record in the caller's repo. It ENQUEUES rather than doing the work, and returns a job id to watch with pet.trezy.getResetStatus. That is not for the progress bar's sake: the erasure makes one PDS round trip PER RECORD, activity records accrue one per interaction, and XRPC scripts have an instruction limit
- pet.trezy.resolveFeeding procedure Settle what happened in the terrarium while nobody was watching, and report the state feeding needs. Called on load. HappyView has no scheduler — the only job trigger is job.run:<type>, fired by jobs.create — so an absence is replayed here rather than ticked by a cron. The player cannot tell the difference: they close the tab with four morsels down and come back to find the pets fed and one morsel left. What they gain is that the gap is computed at the moment it can be REPORTED, and that resolut
- pet.trezy.retirePet procedure Retire one of the caller's own pets: put it away, off the stage and out of the collection's foreground. IRREVERSIBLE — there is no un-retire, here or anywhere, by design. A client MUST confirm before calling this and MUST name the pet in the confirmation. The pet is not deleted and not refunded: its ledger row stays, its price still counts as spent, and the record in the caller's repo is left where it is. REFUSES the caller's last ACTIVE pet with last-active-pet: only active pets earn and nothin
- pet.trezy.setFeatureConsent procedure Say yes or no to the caller's pets being Pet of the Week. Yes writes pet.trezy.featureConsent/self into the caller's repo; no deletes it. Idempotent both ways.
- pet.trezy.setPreferences procedure Save a text style, either for the whole account or for one device. ⚠ `scope` IS REQUIRED AND HAS NO DEFAULT. Guessing it is the one mistake that cannot be undone by guessing again: silently defaulting to `account` changes the typeface on every device somebody owns when they meant to change one, and silently defaulting to `device` leaves them wondering why their laptop never followed. The client always knows which the player asked for, because the player was asked.
- pet.trezy.shameOnYou record A note that somebody was caught forging records. Written in TWO places for two different reasons: one copy in the game's own repo, keyed by the offender's DID, which they cannot delete and which is the durable account; and one copy in the offender's repo, which they can delete the moment they notice — and noticing is the point of that one. Neither is a punishment. Nothing in the game reads these records or behaves differently because one exists; the forged records were already refused at ingest,
- pet.trezy.species record A species the game knows about, published in the game's own repo (did:plc:ollch4g7tes2reb5eceiwuol). Only records from that DID are ever read — record.index:pet.trezy.species refuses the rest. THIS RECORD IS THE WHOLE SPECIES: identity, economy, artwork and temperament. The client compiles in nothing about any species and derives nothing from a filename; it draws what these records say and caches the answer. A species not published here does not exist to the game, and changing one here changes i
- pet.trezy.swapPets procedure Change which of the caller's pets are on the stage. Pass `activate` to bring a pet on, `deactivate` to take one off, or both to swap in one call. Acts only on the authenticated caller's own rows and never accepts a DID. TOUCHES NO MONEY AT ALL: it writes a stint to trezy_pet_stage_log recording exactly when each pet went on or came off, and the accrual reads those stints so every pet is paid for the stretches it was genuinely on stage and no others. Coins already waiting stay waiting — nothing i
- pet.trezy.tier record A rarity tier and its base price, published in the game's own repo (did:plc:ollch4g7tes2reb5eceiwuol). No prices live in code at all, so repricing is publishing a record. Only records from that DID are ever read — record.index:pet.trezy.tier refuses the rest, and a forged tier reprices every species in it at once.
- pet.trezy.wallet record