Done

Shipped pieces of AskRue™ / RUEZALS Login (as of 2026-07).

Gate & auth

• Public gate UX on ruezals.chat (scene, About / Features, House Rules, world etiquette links).
• Login ladder: username → password (Next) → TOTP when hooked; enroll QR only after password when not hooked.
• Username + password auth; totp_enabled gate on session login.
• Account TOTP start → confirm + one-time backup codes.
• Rate limits + lockout on auth endpoints.
• Password required before /totp-qr returns otpauth.

Surface cleanup & security hygiene

• Removed THE BAR / THE GATHERING caption and Realm lands CTAs from gate; House Rules bottom-center.
• Static Terms / Privacy / AUP + gate links; recovery FAQ / Contact Us hint.
• Public _BACKUP-askrue-login and remaining webroot *.bak moved off public tree; static deny for backups / editor leftovers (method review A6 closed).
• Finder law on brand face (three nested triangle finders, 18px W/B/W).

Identity product law (locked)

• AskRue™ = website + phone/tablet (one system); phone never opens the dining hall alone.
• Username immutable; display name changeable; email optional for day-to-day login.
• No SMS OTP.

To fill… formal ship-pack version tags / SHIP-SKIN-RECORD pointers when archived into wiki.

• After the door opens → RUEZALS chat (stop).
• Brand / marketing → RUEZALS.com or RUEZALS stub only.