So I think, after tonight, that the back end part of this has settled down.
I now pass back complex (plist) data on most calls - which usually includes the user info. I was originally doing a double trip - for example, when a disarm attempt was made, the client would get back info about it - but then would have to get user info, to get sta/hp/exp info. So that user info is now passed on most calls. Kind of a pain - not to much change in the back end, but had to rip the tester a bit.
Leveling is in - user has minlevel/maxlevel, current exp, and level. When Max is hit, the user info is updated. They now have skill points, which can be spent on Sta/Defuse/Making
Regen is working - as the user makes calls, if more than a minute has passed since a stamina/hp update, that info is updated. So if 5 minutes have gone by, the user regens 5 hp and 5 stamina (might be every 4 or something, but that's what I have for testing). The client can also do a timer to update that info on the client - but the server is always in charge of what's "real".
Both leveling and regen happen pretty much whenever a validated user does anything... so for example they could be just mucking around with listing bombs - a bomb they placed a day ago goes off - and they'll see exp/level info updated the next time they do any action.
The only big thing I have left is bonus items and purchases. I want the first version to have some kind of profit model (which has always been users purchasing virtual goods). Eventually this will be things like buying power ups and the like for bombs, and special defusing items - but for the first version I very well may just let them buy bombs. I will likely work that out once the iPhone client is done, as I don't understand the details of in-app purchases yet.
I'm still worried this isn't going to get past the Apple mods. I want to get the basic iPhone client running ASAP so I can submit this sucker and see if I'm going to have something or not. VERY frustrating not knowing that.
If it's no go, then I'll likely be dropping my iPhone and moving my daily use and development to Android.