Code Farm economy rebalance: market saturation, infrastructure/defense/cosmetics, mastery track, secondary leaderboards, admin eras, underdog bonus and weekly contracts

Every purchase/upgrade path (new and pre-existing) is now race-safe against concurrent requests via atomic conditional SQL updates.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

devplacepy/services/devii/actions/catalog/game.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from ..spec import Action, Param
-from ._shared import body, path
+from ._shared import body, path, query
 
 
 GAME_ACTIONS: tuple[Action, ...] = (
@@ -24,10 +24,18 @@ GAME_ACTIONS: tuple[Action, ...] = (
         name="game_leaderboard",
         method="GET",
         path="/game/leaderboard",
-        summary="List the top Code Farm players",
+        summary="List the top Code Farm players on a given board",
+        description=(
+            "Boards: score (default, overall composite score), prestige, harvests "
+            "(this week), raids (avg coins per successful raid, min 3 raids), "
+            "time_to_kernel (fastest since last refactor), fair_play (rewards recent "
+            "activity over hoarding), era (current Era-only leaderboard, empty when no "
+            "Era is running)."
+        ),
         handler="http",
         requires_auth=False,
         read_only=True,
+        params=(query("board", "Leaderboard board key, defaults to score."),),
     ),
     Action(
         name="game_view_farm",
@@ -136,11 +144,16 @@ GAME_ACTIONS: tuple[Action, ...] = (
         name="game_claim_quest",
         method="POST",
         path="/game/quests/claim",
-        summary="Claim a completed daily Code Farm quest reward",
+        summary="Claim a completed daily or weekly Code Farm quest/contract reward",
         handler="http",
         requires_auth=True,
         params=(
             body("quest", "Quest kind: plant, harvest, water, or earn.", required=True),
+            body(
+                "scope",
+                "daily (default) or weekly (requires the Legacy Contracts Mastery upgrade).",
+                required=False,
+            ),
         ),
     ),
     Action(
@@ -166,4 +179,52 @@ GAME_ACTIONS: tuple[Action, ...] = (
             ),
         ),
     ),
+    Action(
+        name="game_upgrade_mastery",
+        method="POST",
+        path="/game/mastery",
+        summary="Spend Mastery points on a permanent Mastery upgrade (unlocked at prestige 50+): autoreplant, analytics, or contracts",
+        handler="http",
+        requires_auth=True,
+        params=(
+            body("key", "Mastery key: autoreplant, analytics, or contracts.", required=True),
+        ),
+    ),
+    Action(
+        name="game_buy_infrastructure",
+        method="POST",
+        path="/game/infrastructure/buy",
+        summary="Buy a permanent Infrastructure building (registry, canary, observability); expensive, prestige-gated, big coin sinks",
+        handler="http",
+        requires_auth=True,
+        params=(
+            body("key", "Infrastructure key: registry, canary, or observability.", required=True),
+        ),
+    ),
+    Action(
+        name="game_upgrade_defense",
+        method="POST",
+        path="/game/defense/upgrade",
+        summary="Upgrade your farm's Defense tier: reduces raid losses and adds steal grace, but costs an ongoing daily coin upkeep proportional to your wealth",
+        handler="http",
+        requires_auth=True,
+    ),
+    Action(
+        name="game_buy_cosmetic",
+        method="POST",
+        path="/game/cosmetics/buy",
+        summary="Buy a purely cosmetic title or plot skin with coins (no gameplay effect)",
+        handler="http",
+        requires_auth=True,
+        params=(body("key", "Cosmetic key from the farm's cosmetics list.", required=True),),
+    ),
+    Action(
+        name="game_equip_cosmetic",
+        method="POST",
+        path="/game/cosmetics/equip",
+        summary="Equip an owned cosmetic title so it shows on the leaderboard",
+        handler="http",
+        requires_auth=True,
+        params=(body("key", "An owned title cosmetic key.", required=True),),
+    ),
 )