# Manual QA — NEO-40 (progression telemetry hook sites)

Reference: [implementation plan](../plans/NEO-40-implementation-plan.md), [NEO-38 manual QA](./NEO-38.md) (same server surface).

## Preconditions

- Same as NEO-38: run `NeonSprawl.Server` (`dotnet run` from `server/NeonSprawl.Server`; default `http://localhost:5253`).
- This story adds **comments only**; behavior matches NEO-38.

```bash
BASE=http://localhost:5253
ID=dev-local-1
```

## Verify API unchanged

1. **Grant** (same as NEO-38 happy path):

```bash
curl -sS -i -X POST "${BASE}/game/players/${ID}/skill-progression" \
  -H "Content-Type: application/json" \
  -d '{"schemaVersion":1,"skillId":"salvage","amount":10,"sourceKind":"activity"}'
```

Expect **HTTP 200**, `granted` **true**, `progression` and `levelUps` present as before.

2. **Level-up path** (optional, same as NEO-38 bonus): large grant on `intrusion` if XP crosses the curve threshold; expect `levelUps` non-empty when a boundary is crossed.

## Code review check

- Open `server/NeonSprawl.Server/Game/Skills/SkillProgressionSnapshotApi.cs` and confirm **comment blocks** mark **`xp_grant`** (after successful `TryApplyXpDelta`) and **`level_up`** (inside `nextLevel > prevLevel`), referencing **E9.M1** / no production ingest.
- Confirm there are **no** new `ILogger` or metrics calls for these events.