Use proxy-free runtime for built local serving

README.md

@@ -337,7 +337,7 @@ See [source-bound verification](docs/VERIFICATION_WORKFLOW.md#compact-checks-and
 for private full logs/reports and deferred final audits. Existing games, access
 controls, secret protection and CI/deployment/publication gates remain protected.
 
-The production build is written to `dist`. `npm start` runs that build with Wrangler; apply its database migrations to the intended storage environment before use. The included local migration command targets the development database, not a remote deployment.
+The production build is written to `dist`. `npm start` serves that immutable build directly through Miniflare, without Wrangler's development proxy. Apply migrations to the intended storage environment first. Local serving defaults to the existing `.wrangler/state` and port 3000; `DUNE_STATE_PATH` and `DUNE_PORT` select explicit alternatives. The container entrypoint retains `/data` and applies additive migrations before startup. The local migration command does not target a remote deployment.
 
 Reproduce the current AI study with:
 

deploy/container-entrypoint.sh

@@ -3,7 +3,8 @@ set -eu
 
 # A failed migration must stop startup. Both commands use the same local D1 ID
 # and storage root. Never reset or replace this directory during updates.
-state_path=${DUNE_STATE_PATH:-/data}
+export DUNE_STATE_PATH="${DUNE_STATE_PATH:-/data}"
+state_path=$DUNE_STATE_PATH
 # Validate before migration; this is an administrator setting, not a request header.
 node --input-type=module -e '
   const value = process.env.DUNE_PUBLIC_ORIGIN;

deploy/serve.mjs

@@ -11,7 +11,7 @@ for (const db of config.d1_databases) {
     throw new Error(`Migration/runtime database identity mismatch for ${db.binding}`);
   }
 }
-const state = resolve(process.env.DUNE_STATE_PATH || '/data');
+const state = resolve(process.env.DUNE_STATE_PATH || '.wrangler/state');
 const port = Number(process.env.DUNE_PORT || 3000);
 if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error('Invalid DUNE_PORT');
 async function modulesIn(directory) {

docs/CURRENT_STATUS.md

@@ -29,6 +29,27 @@ optional skill bands, combinations and public expansion starts remain open.
 Rules implementation continues; comprehensive assurance and administration
 remain deferred until all rules are implemented.
 
+**Built-runtime proxy cutover — 9 October.** `npm start` now uses the
+existing direct Miniflare adapter rather than Wrangler's development proxy.
+Local storage defaults to `.wrangler/state`; the container explicitly keeps
+`/data`. No API authorization, retry or migration policy changed. A
+checksum-verified Node22.23.3 build/start and eleven real HTTP probes pass:
+HTML200, invalid JSON400, foreign origin403, oversized413, create201,
+authenticated read200, anonymous denial409 and four five-second-cadenced
+invalid POST400 responses. Four original focused integration cases also
+pass against a dedicated new QA store; types/lint and entrypoint syntax pass.
+
+The separate historical paired CI failure remains unidentified:
+[job111453717886](https://github.com/Quintine/Dune/actions/runs/37208188809/job/111453717886)
+exposes only step7/exit1; annotations add no failing request, log download
+returns403, and this host has neither `gh` nor Docker. The later
+[job111464477749](https://github.com/Quintine/Dune/actions/runs/37211854749/job/111464477749)
+is independently observed success, not proof of the earlier cause. Those
+diagnosis/dependent-repair tasks remain blocked on authorized historical
+logs or an exact reproducible failure. No deployment or Docker proof is
+claimed for this cutover.
+
+
 **Multi-pile battle skills prototype — 9 October.** A surviving Smuggler
 controller can allocate its fixed reveal-time collection across existing
 sectors; a surviving Sandmaster winner selects one remaining pile for +3.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,36 @@
 # Dune implementation status
 
+## 9 October 2026 — built npm runtime uses the proxy-free adapter
+
+`npm start` still invoked Wrangler despite the container's existing direct
+Miniflare runtime and the recorded dev-proxy disconnect. It now runs
+`deploy/serve.mjs`; the default local path remains `.wrangler/state`, while
+the container entrypoint exports its existing `/data` default explicitly.
+No application authorization, automatic HTTP retry or migration changes.
+The [upstream proxy report](https://github.com/cloudflare/workers-sdk/issues/14641)
+and earlier literal “worker restarted mid-request” witness explain the
+local tooling distinction; this is not an upstream SDK repair.
+
+Official Node22.23.3 archive SHA-256 matches the
+[published checksum](https://nodejs.org/dist/v22.23.3/SHASUMS256.txt)
+and its extracted executable. The actual build, `npm start`, throwaway
+HTTP program and same-executable test subprocesses use that Node22.
+Eleven HTTP probes return the expected 200/400/403/413/201/200/409 plus
+four 400 responses at five-second cadence, without retry. Four original
+normal-room, Advanced-lobby and denied-admin boundary cases pass. The new
+QA room QZD2XV8L and integration records are only in
+`/tmp/dune-built-runtime-20261009-T1OPGq`; existing stores were not targeted.
+Types/lint and `sh -n` pass. Build retains its existing chunk-size warning.
+
+The historical paired failure is separate: API metadata confirms
+CI37208188809/job111453717886 failed isolated step7 and skipped publication;
+public annotations contain only exit1 and its log endpoint returns403.
+`gh` and Docker are unavailable here. API metadata confirms the later
+CI37211854749/job111464477749 success, but neither that result nor current
+proxy-free passes identify the former failing request/cause. Diagnosis and
+dependent repair remain blocked without authorized logs or a reproducer.
+No complete HTTP/Docker/deployed acceptance is claimed.
+
 ## 9 October 2026 — owned multi-pile Smuggler and Sandmaster choices
 
 The multi-pile guards now have working choices in supported Basic/Advanced

package.json

@@ -8,7 +8,7 @@
   "scripts": {
     "dev": "vinext dev",
     "build": "vinext build",
-    "start": "wrangler dev --config dist/server/wrangler.json",
+    "start": "node deploy/serve.mjs",
     "lint": "oxlint",
     "format": "oxfmt",
     "db:generate": "drizzle-kit generate",