Render pet art, restructure the repo, and close the CI gaps

[heyradcode]

Description

Two bodies of work on one branch: the pet-art feature that started it, and the
repo-structure and CI cleanup that followed.

273 files, +4193/-1893.

Pet art

• Web and mobile clients now render generated pet art, via petArtUrl from
  @shared/core so the route shape is written down once and only the env read is
  per-platform. Art stays optional: unset the variable and pets fall back to emoji.
• Pet cards fill their upper panel with the art, size to their content, and stop
  overflowing a squeezed gallery. The create dialog reveals the new pet's art and
  closes once the pet has settled.
• Battle and breeding both reuse the same card, so a combatant and a breeding
  parent look like the pet you picked.
• Sidebar can be pinned open. Favicon replaced with a CryptoPets mark.
• Fixes an EVM mint that stranded at the settle phase.

Repo structure

• services/ now holds the two satellite services, indexer-go and
  image-generator. backend stays at the root: it is the application server,
  the only pnpm workspace member of the three, and the only one that builds from
  the root lockfile.
• The Go module path moved with it. pb/ was regenerated from an updated
  go_package rather than string-edited, since the descriptor embeds that path
  with byte-length prefixes.
• shared/src/hooks/ was 36 files flat at its root, 71% of the package. Grouped
  into battle, pets, marriage, session and tx, matching the adapters/ and
  chains/ directories already there. Consumers are unaffected: every import goes
  through the @shared/core barrel.

CI: checks that existed but nothing ran

Four gaps, each the same shape as a green build that proves nothing.

• pnpm build ran in no workflow. frontend, backend and website have no
  typecheck script, so the build is their only type check, and vitest strips types
  without checking them. Verified by injecting const x: number = "..." into a
  tested file: 17/17 tests passed, tsc caught it.
• The root pnpm lint ran in no workflow. Only protocol and verifier were
  linted in CI. frontend, shared, website and mobile were linted by hand,
  including frontend's custom CSS-naming check that AGENTS.md lists under
  Enforcement.
• mobile's jest suite ran nowhere, and verifier had a typecheck script
  nothing invoked.
• backend had no ESLint at all and contracts/ethereum no linter. Backend
  came back clean at 9 findings across 203 files. Solidity uses solhint with
  security rules only: solhint:recommended reports 595 problems here, mostly
  missing natspec plus gas-style changes that would alter revert data and the
  event ABI on deployed upgradeable contracts. Every security rule already passed.

New workflows: static-checks (lint + build) and mobile.

Bugs found and fixed

• A rejected settleBreed stranded the breed. useBreedPets set its
  sent-once guard before sending and cleared it only in reset(), so a declined
  wallet prompt left both fees spent, the request pending on chain, and no way to
  retry. useCreatePet had fixed this and documented why; the fix had not been
  carried across. The EVM entropy settle flow both hooks duplicated now lives in
  one useEvmEntropySettleFlow, so it cannot drift apart again.
• A golden-vector-adjacent check had been silently skipping since the combat
  engine moved to protocol. image-generator's digitPair parity test guarded
  on a path that no longer existed, so it skipped instead of failing. The ports
  agree, so this arms the check rather than fixing a drift.
• backend/API.md described a second WebSocket deleted in 17666ad.
• docs/architecture.md does not exist but was linked from README,
  CONTRIBUTING, docs/README, CLAUDE.md and AGENTS.md.

Tests

shared 60.8% → 63.0%, picked by what a silent failure costs rather than by
percentage. time.ts, pdas.ts, accountClient.ts and constants.ts are now at
100% statements, functions and branches.

Two cross-language guards, both verified to fail on an injected change:

• Solana PDA seeds are hand-copied from the Anchor program; the seed strings are
  now checked against the Rust source.
• PET_ACCOUNT_{ID,OWNER}_MEMCMP_OFFSET are byte positions in a Rust struct,
  previously asserted only against a comment. Removing open_to_challenges
  shifted every field after it once already.

Also characterises the EVM settle path in useCreatePet and useBreedPets, which
was untested in both: their suites mock the entropy watcher to a no-op.

Developer experience

• pnpm dev now runs backend, frontend, image-generator and indexer-go, the last
  hot-reloaded by air. It deliberately omits --kill-others-on-fail: two of the
  four exit at boot when unconfigured, and either killing the backend and frontend
  would be worse than that service being down. The trade-off is that a backend
  crash no longer stops the stack, so panes are labelled BE/FE/ART/IDX.
  air must be on PATH for dev:idx.
• DEVELOPMENT.md listed six dev scripts of which five no longer existed.
• Dropped the four name-theme cards from the rename panel.

Verification

root lint / build	pass
backend	717/717
protocol	558/558
shared	480/480
frontend	312/312
image-generator	252/252 + smoke
contracts/ethereum	111 passing
indexer-go	8 packages, vet clean
verifier	78/78
mobile	1/1

Reviewer notes

• render.yaml changes rootDir for two services. The first deploy after merge is
  where a wrong value would show.
• The required check renames from Build to Static checks; branch protection
  needs updating.
• website/README.md documents a deploy workflow removed in 49c5e63. I marked the
  section stale rather than guessing the current mechanism. It needs an owner.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
do-not-stop-frontend	Ready	Preview	Aug 5, 2026 10:43pm
do-not-stop-website	Ready	Preview	Aug 5, 2026 10:43pm

[github-actions]

🧪 Coverage

Package	Statements	Branches	Functions	Lines	Overall
backend	86.56% (1842/2128)	79.04% (924/1169)	86.79% (368/424)	87.14% (1742/1999)	85.24% (4876/5720)
frontend	68.39% (1294/1892)	70.40% (1087/1544)	64.35% (316/491)	68.75% (1173/1706)	68.70% (3870/5633)
shared	62.97% (1463/2323)	64.79% (922/1423)	64.51% (300/465)	64.86% (1344/2072)	64.13% (4029/6283)

[aichannode]

Good job! Nice!