# Repository Development Rules

- The server is authoritative for balances, energy, rewards, wheel results and conversion.
- Never trust client-supplied reward, multiplier, price or completion state.
- Every critical mutation must be idempotent.
- Every balance change must use the double-entry ledger functions.
- OC_POINTS and OC_TOKEN must remain separate assets.
- Launch date and conversion rules are settings, not hard-coded UI values.
- Never commit real Telegram, payment, store, KYC or blockchain secrets.
- Do not claim third-party audit, KYC or exchange listing unless verified externally.
- Run `npm run check` and `npm test` after domain changes.