# UGLY trading pilot / v0.46.0

21 September 2026: owner authorized continued autonomous TESTNET integration/deployment. Based on working main wallet release v0.45.5, integrated on feature/ugly-trading-release. Wallet sign-in/creation was confirmed by the owner; real human trade signing and recovery/export remain separate acceptance checks. No mainnet, real-money trading, platform fees or server delegation enabled.

Public Robinhood Testnet deployment is recorded in contracts/testnet/trading-deployment.json. Market: 0x34794f88Abe77fA8788dd98E3A99b7be2DA009cC. Credits: 0x5F548403fA4c18a3Ef22F0A7f9DC987857312da4. Collectibles: 0x3154C52561784C89d7eB13Ca2CCCAb71f28B40a1. Pool: 0x9c6254f6e5f89F988DfAF3B9Bd9A2bf3c2C8bC81. All four source-verified by the explorer; exact deployed runtimes and contract relationships checked. Dedicated testnet deployer used; no player funds or credentials accessed. Initial pool reserves: 100 tUGLY / 1,000 tPLAY. Deployment creates liquidity only; no fabricated trades/chart history.

## How to test

1. Open /wallet.html, sign in with the same Google account, open/create the game wallet and copy its Robinhood Testnet address.
2. Obtain test ETH from the official faucet, complete explicit UGLY Lab ownership proof/tester consent. If another wallet is already linked, manage that existing link first; it is never silently replaced.
3. Open /trade.html or TRADE · TESTNET / the market screen inside UGLY. Game wallet is the default; Browser wallet remains an explicit alternative.
4. Use Get 1,000 tPLAY beside the trade controls. Under Need test assets? in the full terminal, claim tUGLY or mint one test NFT. Each action requires test ETH gas. Existing tUGLY has its 24-hour faucet cooldown.
5. Preview a Buy/Sell, review spend/minimum receive/price impact, and confirm. Exact approvals only; no unlimited allowance or server signing. Expired quotes must be refreshed.
6. List the test NFT, then use a second separately verified player account to purchase it. Confirm balances/ownership and explorer receipt. Sell no more tUGLY than intended: dropping below the plaza gate minimum can revoke entry.

Automation proves local-chain settlement and client guards; it does not impersonate real Google/Privy users or prove real-device UX. No official UGLY coin, eFrogs/eFroglets, real NFTs, bridging, PONS or Mosh execution is offered by this pilot.

## Deployment checks

Isolated production build growblocks-1ou47bexl-mycantera.vercel.app returned valid market reserves, quote/minimum output and Privy readiness. Wallet integration is current main v0.45.5; this release does not revert the single-button onboarding or readiness fixes. Human testnet signing is the next acceptance step.

## Product direction

The user wants token buying/selling from an interactive chart on a large plaza screen, alongside NFT trading. Each player should have an embedded game wallet they can fund separately from their main wallet. They want in-game Buy/Sell actions without repeated external wallet popups. Recommendation: evaluate Privy first; provider configuration and proof of user control are still required. See [the wallet decision](EMBEDDED-WALLET-DECISION.md).

## Implemented locally

- `trade.html`, `src/trading-ui.js`, `trading.css`: responsive chart terminal, Buy/Sell quote preview, exact minimum receive, price impact, 0.5% slippage, quote expiry, NFT inventory/listings, fixed token offers, test faucets and pending transaction recovery.
- `src/trading-board.js`: large clickable test-market screen in the UGLY scene, shared on-chain price source and a HUD entry. UGLY only; curated other projects remain unchanged.
- `server/trading.cjs`, `api/trading.js`: read-only fixed-network contract reader. Verifies chain, fresh block, exact runtime code and the relationship between market, pool and asset contracts. Portfolio identity comes from the existing server-verified UGLY testnet profile, never a submitted wallet address. No signing keys or custody ledger.
- `UglyTradingPilot.sol`: fixed-asset, non-upgradeable test market; maker-owned offers and atomic settlement; exact expected terms; cancellation and expiry; no platform fee or admin. The public contract itself is permissionless, not Google-gated.
- `UglyTestPool`: constant-product pool seeded entirely from test faucets during construction. Initial reserves: 100 tUGLY and 1,000 tPLAY. Swaps enforce minimum output and deadline. No user LP deposits, LP shares, withdrawal promise or mainnet capability. The pool holds test liquidity; it is not a per-player custodial deposit account.
- `UglyTestCredits`: 1,000 tPLAY/address/day; capped supply, no value. `UglyTestCollectibles`: one test NFT/address, enumerable ownership, max 100,000; no allocation, human verification or official UGLY collection claim.
- `src/trading-wallet.js`: existing-wallet EIP-1193 test adapter, explicit wallet approvals, fixed destinations/selectors, exact token allowance or NFT ID, zero native value, runtime/network/account guards, gas estimation, receipt data matching and two-block inclusion check. A pending transaction is reconciled alone and never silently triggers a newly selected trade.

The first chart is recent actual pool executions in block order, not time-scaled OHLC, a fiat price, an oracle or official UGLY market data. No invented volume/history. Pool reserves and prices are manipulable test data; this experimental pool must never be promoted to a real-money exchange. NFT images are original code-native test artwork, not eFrogs/eFroglets assets.

## Verification

The isolated tool directory currently contains solc 0.8.30, OpenZeppelin 5.4.0 and Ganache 7.9.2. No npm dependencies or build tooling were added to the game. Compiler standard input, ABIs, bytecode and generated client selectors/runtime pins are retained.

```powershell
node scripts/build-ugly-trading.cjs <isolated-node_modules>
node scripts/test-ugly-trading.cjs <isolated-node_modules>
node scripts/test-trading-service.cjs <isolated-node_modules>
node scripts/test-trading-wallet.mjs
node serve.mjs 8804
node scripts/verify-trading.mjs <isolated-node_modules> http://127.0.0.1:8804
```

The browser harness deploys contracts to an ephemeral local EVM set to chain 46630, substitutes Google/verified-wallet boundaries, and supplies simulated wallet consent over CDP. It exercises token faucets, NFT mint, both pool swap directions, NFT listing and a second-wallet purchase, generated chart, desktop/mobile overflow, and the real UGLY renderer. It does not sign with a human wallet, mutate production projects or trade on a public chain. Desktop/mobile screenshots were reviewed. Ganache uses its JavaScript fallback on Node 24; no performance claim is made.

Contract tests include wrong-chain deployment, faucet limits, exact allowances, both token-offer directions, pool quote/minimum/deadline, NFT settlement, unauthorized cancellation, self-fill/replay, changed terms, maker NFT transfer, revoked approval and rollback of buyer payment, expiry, zero/oversized inputs, ETH rejection and no marketplace-held user balances. Service tests include runtime/chain/stale-block rejection, integer quotes, inventory, metadata, origin/auth/verification and server-bound wallet identity. Wallet tests cover precision, stale quotes, wrong accounts/code, cancellation, substituted selector, reverted approvals and pending recovery.

## Release limits and next checks

- Human acceptance: two real Google/Privy users, mobile and Telegram signing, browser-wallet fallback, recovery/export and funding/withdrawal independence. No unrestricted application signer.
- Automated browser regression now routes both players through the actual game-wallet adapter with controlled SDK/auth boundaries and a real local EVM. No window.ethereum is required. Tests cover buy/sell, exact approvals, NFT listing/purchase and desktop/mobile layout.
- Hostile NFT receiver tests include a mined reverted purchase: both asset legs and offer state roll back. Reentrant fill from receiver callback fails while valid settlement completes once. This is an internal review, not an external contract audit.
- Public-network deployment workflow is testnet-fixed, maximum 12M gas / 0.01 test ETH, signed transaction hash recorded before broadcast, no automatic duplicate deploy on retry. All sources verified; public reader verified current reserves and quote. No public-chain player trade has been executed by automation.
- Remaining production work: audited venue/settlement, reorg/replacement UX, RPC capacity/rate limiting, monitoring/incident response, independent recovery acceptance and fee/legal design. Mainnet, real deposits, PONS/Mosh, Linea settlement and fee collection remain off.
- To pause this UI: set server/trading-registry.json enabled=false, redeploy, and optionally remove the UGLY trading-board mount. Public testnet contracts remain permissionless and non-upgradeable; website pause cannot disable them on-chain.



## 21 September 2026 / v0.46.1 live RPC resilience and checkpoint

Testnet trading is deployed on growblocks.vercel.app/trade.html, also accessible from the UGLY market screen/HUD and game wallet. Public market/quote API initially showed intermittent upstream failures. Added paced read-only RPC calls, at most three attempts on transient failures, coalesced three-second block/runtime verification, and private method/status/code diagnostics. Tests prove retry bounds, cache reuse/expiry and fail-closed outages. Updated developer-site docs with fixed UGLY trading pilot and limits. No player trade on public chain or real Privy signature claimed. Resume tomorrow with two human accounts and test ETH only; guide: docs/TRADING-PILOT.md. Mainnet, real assets, fees and delegation stay off.


Final production smoke check (21 September): /trade.html, market, buy/sell quotes and wallet readiness returned HTTP 200; invalid quote returned 400 and unsigned portfolio returned 401. Live v0.46.1 is growblocks-csw1thqyk-mycantera.vercel.app, aliased to growblocks.vercel.app. Next session: the two-human-account test described above; no real-user transaction success is claimed yet.


## 21 September 2026 / v0.46.2 Trading funding guidance

A real player reported a failed tPLAY approval with zero native test ETH and zero tPLAY. Portfolio now reads native ETH at the verified block. Trading shows test ETH and a visible official faucet link, rejects unfunded reviews and rechecks before confirmation. Wallet execution checks input-token balance before approvals and native balance against buffered gas cost before each send. Known raw wallet gas errors become actionable messages. No wallet funding or player transaction was performed. Wallet unit tests cover zero tokens, zero gas and insufficient gas without any send; service tests and local-EVM desktop/mobile buy/sell/NFT regression pass, including zero-funds UI checks. Real Privy consent remains a user test.


## 21 September 2026 / v0.47.0 UGLY trading playground

Owner rejected hidden tPLAY funding and an unclear Sell mode. Redesigned the terminal in approved Launch Party typography/pink/lime/gold with chart and adjacent trade ticket. Zero-tPLAY wallets get a first-screen Get 1,000 tPLAY card; the same explicit claim remains next to the ticket, with daily cooldown guidance. Sell selects 25% of holdings and exposes 25/50/75/100% presets, live reserve-based receive estimate, balance and plaza-access warning. Buy has fixed amount presets. Claims and swaps still require review and wallet confirmation; no automatic signing or funding.

New src/trading-chart.js renders actual execution history only: labelled price/block axes, buy/sell points, volume, Last 20/80 filters, pointer and keyboard inspection, explorer-linked recent swaps, liquidity and pool-reference line. No fake candles or invented prices. Public market refresh polls every 20 seconds only while visible and idle, never resetting an open review. Compact wallet options and mobile Buy/Sell shortcuts reduce navigation. Reference: https://fomo.family/ for trading-first clarity; no FOMO code, assets or claims copied.

Validation: syntax, wallet guard unit tests and real local-EVM browser flow passed. Browser fixture reproduces 2 tUGLY / 0 tPLAY, proves Sell selects 0.5, 100% shows access warning, tPLAY claim is above the fold at 390x844 and the main claim button completes a faucet transaction. Buy/sell, all faucets, NFT listing/second-wallet purchase, chart controls and mobile width checks pass. Screenshots reviewed. Google/Privy consent remain mocked; no real user signature or real-phone performance claimed. Contracts, fees, authorization and testnet scope unchanged.


## 21 September 2026 / v0.47.1 Plaza-first trading direction

Owner clarifies that the product is social trading inside each token's 3D plaza, not a competing standalone exchange terminal. Saved researched architecture in docs/PLAZA-TRADING-EXPERIENCE.md. FOMO official terms identify Privy; affiliate commissions exist, but no public embedded trading API was verified. Current Privy docs explicitly list Robinhood mainnet/testnet app-paid sponsorship and swaps. Stablecoin-paid gas on Robinhood is not established. Relay publicly lists 4663 enabled and documents same-chain app fees; actual token route/fee collection remains to prove. No sponsored billing, wallet upgrade, signer delegation, real deposits or fees enabled.

UGLY screen now uses labelled execution chart and recent swaps; interaction opens a nonmodal desktop side ticket/mobile bottom ticket with camera focus/restoration. World remains visible. Current polling is eventual consistency, not the proposed multi-instance ordered feed. Verified-trader opt-in attribution, owner market registry, sponsorship and routing are later gated stages. Existing testnet authorization and transaction checks preserved. Local EVM trading/browser and desktop/mobile dock tests passed; human provider consent not claimed.


## 21 September 2026 / v0.48.0 UGLY trading floor feedback

Owner requests the plaza-first trading experience in the approved gaming brand. Improved the in-world side ticket and phone bottom drawer in UGLY pink/lime/gold, with a separate pool-price HUD, one-thumb sticky review/funding action, and restored camera/play on close. World and shared physical chart remain visible. Confirmed receipts produce a dismissible success card; transaction progress distinguishes checks, wallet consent and chain confirmation. Pending-transaction recovery is now visible in-world rather than hidden in the standalone NFT column.

Market API adds chain/hash/log-index event IDs, block hashes and confirmation depth, deduplicates and orders logs. The screen rim reacts briefly to newly observed swaps only after two subsequent blocks; initial history, duplicate polls, reconnect replay and older snapshots do not replay effects. Reduced motion suppresses the pulse. This is bounded HTTP polling, not a synchronized multi-instance indexer, and no player name/trusted-trader badge is inferred from a wallet.

Validation: real local-EVM token claims/buy/sell and NFT listing/second-wallet purchase through the real embedded-wallet adapter with mocked Google/Privy boundaries; new success and in-world pending/mobile-action assertions; feed replay/finality unit checks; service sorting/dedup against actual local chain logs; existing wallet security tests. Desktop and 390x844 screenshots inspected. No real user signature, public-chain swap, provider gas sponsorship or real-phone FPS claimed.

Gas sponsorship is NOT enabled by this release. Public Privy app config reports user-controlled-server-wallets-only, but does not expose sponsorship readiness. Asked owner to confirm Fee sponsorship for Robinhood Testnet 46630, client requests and spending limits. Native EIP-7702 sponsored execution needs a separate verified wrapped-receipt path and zero-ETH provider acceptance before relaxing native-gas preflight. Existing exact-call/receipt guards stay intact. No backend signing authority, spending credits, mainnet, real-asset deposits or fee collection added. Read docs/PLAZA-TRADING-EXPERIENCE.md.


## 21 September 2026 / v0.49.0 Live UGLY price trail and candle feed

Owner requests dynamic charts that respond to trading and keep moving through quiet periods, with the token logo leading the line. Physical UGLY screen now shows a five-minute pool-price step trail from actual post-swap reserves, with the UGLY logo at the current-price edge. Time scrolls left while unchanged prices remain flat. No invented price oscillations or fake trades. The display clock stops extrapolating after 15 seconds without fresh data, marks DELAYED, and stops intermediate motion for reduced-motion users. Desktop texture refresh is capped at 4 Hz, phones at 2 Hz; no new scene geometry or player movement changes.

/api/trading?stream=1 provides bounded 55-second SSE connections, automatic reconnect, complete recent-market snapshots and explicit unavailable events. A coalesced 3-second read loop serves spectators in each warm function instance; browser has one shared EventSource for screen/terminal and a 12-second HTTP fallback while disconnected. Hidden tabs close their stream. This is NOT a globally single indexer across Vercel instances, persistent all-history archive or proof of thousand-player capacity. Feed scope remains the latest 80 swaps in the last 10,000 blocks. Event block headers supply canonical timestamps and are cached by block hash. Reconnect/reorg snapshots replace chart data rather than append duplicate points.

Detailed terminal now has actual 1m/5m OHLC execution-price candles, quote-token volume, time spacing/gaps, confirmation shading and keyboard/pointer inspection. These differ intentionally from the screen's marginal pool-price trail. Server-fed updates continue while review/signing is open without replacing the reviewed intent, deadline, amounts or minimum receive. DexScreener/DEXTools integrations remain off because the exact testnet pool has not been established as supported. No changes to execution permission, gas sponsorship, custody or fees.

Validation: timestamp/candle unit tests including gaps, duplicates and replacement; two simultaneous HTTP SSE clients with reconnect/outage/lifetime/cleanup tests; actual local-EVM service timestamps; desktop/mobile real local-EVM token/NFT browser flow with controlled Google/Privy consent, unchanged review during feed updates and candle interval selection. Visual screenshots reviewed. Production smoke passed on growblocks.vercel.app: two separate streamed snapshots arrived at approximately 3.4s and 9.1s with advancing blocks. Deployed v0.49.0 as dpl_FWKWQxXCAyjbPqZRZanKSLGUU7g5. No human wallet transaction or large-scale load result claimed. Official hosting streaming reference: https://vercel.com/docs/functions/streaming-functions .


## 21 September 2026 / v0.50.0 Main-stage market screen

Owner wants the chart on the plaza's main screen by default, with creator image/video overrides. UGLY now renders its live market texture directly on the existing main brandScreen. Removed the separate floating trading board. Shared main-screen selection is used by trading and broadcasting; UGLY stock stage display enlarged 30%, raised slightly, with a simpler 16:9 layout, larger price, wider graph and one recent confirmed swap instead of a dense sidebar. Owner-moved/scaled screens retain their placement. Desktop/mobile watch cameras target the actual screen; mobile camera stays forward of the entrance scenery and restores its previous FOV on exit.

Existing owner-authorized local/global media broadcasts overlay the chart. Ending the programme reveals the live chart again. UGLY owner Event Controls expose LIVE TOKEN CHART (DEFAULT), IMAGE and VIDEO; Apply chart reuses the existing authenticated end-media operation. Global broadcast priority remains intact. Clicking projected media no longer opens trading. No new permissions, arbitrary token registrations or mainnet execution. UGLY is the only configured tradable market: other project/custom plazas retain existing artwork until a supported market is actually connected; do not claim universal creator token/chart configuration is implemented.

Validation: trading browser regression asserts the chart uses screen-artwork and no floating board remains; desktop/mobile stage screenshots inspected. Broadcast server ownership/transfer/global/URL/timeline tests pass. Browser broadcast fixture updated to mock current plaza admission, verifies image overlay, chart restoration, owner chart option, mobile controls and lost-owner closure. Existing SEC MP4 passed decode, late-join seek, play, all-screen loop and shared-decoder checks. Local preview server now supports HTTP byte ranges, fixing non-seekable preview playback; exact/suffix/invalid-range and HEAD tests pass. Browser-generated WebM fixture was replaced with the existing seekable MP4. No production owner programme was changed by QA.


## 21 September 2026 / v0.51.0 Plaza Settings and global chart restoration

Owner reported selecting the chart left UGLY video playing. Root cause: global media overrides local media, while the old Apply chart only ended the local programme and claimed success. Global admin controls were also restricted to requests originating in the main plaza. Verified SHAMA Google identity now has the same global broadcast authority from any valid plaza; other owner permissions remain unchanged.

New server `chart` command for UGLY restores its local default and, only with global-admin permission, explicit `endGlobal:true` and the current global revision, atomically clears active global media. Both document revisions and plaza ownership guard the commit. Announcements/countdowns survive. Ordinary plaza owners cannot cancel a global programme; stale revisions fail without partial changes. Ending a global programme affects all plazas and the UI explains this before the user applies it. No production programme is automatically changed by deployment or testing.

Event Controls renamed Plaza Settings. Shared owner dialog uses approved Lilita One/Nunito, pink/lime/navy, Screen/Announcements/Events navigation, large content choices, current effective screen status, visible global takeover state, conditional media/video fields, sticky Apply/status footer, explicit success/errors, timezone-labelled countdowns and mobile layout. UI draft selection is distinct from server-applied state. Global controls available to SHAMA in UGLY; regular owners see why a global override blocks their change. No new wallet, trading, access or custody features. Market availability remains UGLY only.

Validation: server regression covers root admin from partner routes, missing confirmation, stale global revision, wrong owner, ordinary-owner global denial, atomic restoration and announcement preservation. Browser QA covers actual image/video projection, playback/loop/seek, chart restoration under a global override, simulated conflict, ordinary-owner blocked controls, section navigation, desktop/mobile screenshots and removal of controls after ownership loss. Tests use mocked identities/service state, not production account writes. Real owner's session remains final acceptance.


## 21 September 2026 / v0.52.0 Forward-moving chart and fitted partner stages

Owner approved the centred token / travelling-chart direction and requested main screens integrated into UGLY and Bundle Cat architecture. UGLY chart head is now fixed at horizontal canvas centre. Actual five-minute pool-price history scrolls left into it; right side is explicitly empty next-trade space. Quiet-feed forward motion comes from subtle horizontal trails and a slight logo tilt, never invented price movement. Existing confirmed-swap pulses remain. Canvas refresh capped near 24 Hz desktop / 12 Hz mobile; paused under broadcasts, hidden tabs, stale feeds, and reduced motion (low-frequency data refresh remains). No new market, wallet or execution capability. Real-device performance remains unmeasured.

New src/partner-stage.js builds a fitted static surround around the actual main screen transform. UGLY gets stone piers, champagne-metal fluting, deep cabinet, stepped cornice, lime recess and grounded sill. Bundle Cat gets plum timber piers, stone footing, twin teal pagoda eaves, warm lanterns and pink recess. Existing generic frame is hidden; artwork plane, screen IDs, owner image/video broadcasts and picking are preserved. Added pier collisions; central gathering floor stays open. Stock Bundle Cat screen moves slightly forward of the old lighting truss to prevent a beam across its image. Owner-moved/scaled screen positions are retained. UGLY's redundant fixed-size cabinet was removed and wordmark raised above the new cornice. Saved cloud records are not rewritten.

Validation: full local-EVM desktop/mobile trading regression passed. New verify-partner-stage.mjs checks both real rendered surrounds, bounded batches, pier collisions, clear centre, quiet-feed animation, delayed-feed freeze and reduced-motion stability; screenshots inspected. Broadcast image/video/global/loop/seek/settings regression run against the new surrounds. Auth/market fixtures remain mocked for stage QA; no production broadcast or real user trade is executed.


## 21 September 2026 / v0.53.0 Game-wallet-first entry

Owner approved Privy game wallet as the normal path and removing the first-screen address field. Main plaza now requests only the guest name; optional unverified address input and its handlers are removed. Legacy local guest metadata is preserved but is never used as ownership proof or access permission. Guest exploration remains available; Google sign-in and explicit game-wallet setup remain the path for multiplayer/wallet features. No automatic wallet creation or signing was added.

Trading and gate onboarding now lead to Game Wallet, with safe same-origin return links to plaza/trading pages. Existing browser-wallet selection is nested under Existing holdings / access and resets to Game wallet on account change. UGLY Lab's external/manual signing lives in an optional expandable section; existing verified addresses, conflicts, consent and access checks are not replaced or bypassed. Wallet setup returns to the requesting page after its existing verification/enrollment flow. No RPC permissions, sponsorship, deposit/withdrawal execution or server custody changes.

Validation: address-free guest entry and desktop/mobile visuals; existing embedded-wallet creation/identity-switch/conflict/consent regression; gated entry and revocation; real signature verifier with controlled external-wallet signing; same-origin return-route rejection checks. Local-EVM token/NFT trading regression exercised. A chart-test race was corrected by reading its inspected-candle result in the same browser evaluation, before the next live feed can redraw it. Screenshots use controlled identities, not production wallet operations.