Show confirmed create/join guidance until local Continue without polling or ordinary game actions clearing unread text. Default shared toasts to no timeout with visible Dismiss controls.
Validation: 23 focused entry/action/seat tests, types/lint/build, and original local room creation with 43-second retention through polls and a circle change, explicit dismissal and no replay. No console errors. QA room preserved. Deployed acceptance remains open. Runtime fingerprint d57fa6a34bb1738017c2690ca5ad9f04b0b99458078a60c7ddd51e2c29483301; documentation overlay a8baa23802ac1c79321d67913c27512a199699839c1932947dfa3af95434cc37.
Operations now report the SQLite database size and page count, read through
PRAGMA page_count/page_size in the same authority-checked batch as the
lifecycle counters with non-numeric values clamped to zero; the page renders
both and states that free disk space is still unknown.
replaceMoritaniAssassinationTraitors draws the first distinct physical Traitor
Card from the reserve instead of the reserve's first entry, because the face-up
set-aside card can still sit in that list: re-drawing it produced a receipt
whose replacement equalled the revealed card, which the assassination integrity
check rejects mid-Mentat. With no distinct card left the step is blocked with an
explicit reason instead of committing an invalid receipt.
Four tests were made reproducible after measuring their real failure rates,
because a suite that fails for random reasons cannot act as a checkpoint gate:
the Discovery typed Spice Blow test now removes other cards for the same
territory so one blow deposits the printed amount (0/20 after, ~20% before); the
Discovery E2 skills deal is pinned with the new shared
tests/deterministic-random.ts helper so a Lasgun-shield explosion cannot
pre-empt its skill consumer (0/12 after, ~20% before); the Ecaz Occupy Ix/CHOAM
policy check accepts any legal continuation and still asserts the phase it
reaches (0/30 after, ~10% before); and the mixed-E3 Moritani Cunning test keeps
the random storm off red_chasm's single sector (0/25 after, ~20% before).
Offline suite 7,801/7,801 with typecheck and lint clean. No game, seat, saved
state or deployment changes.
Rejected administrator authentication and authorization attempts are now
recorded durably in a new additive admin_attempts table with a fixed reason
(invalid_key_format, unknown_or_disabled_key, missing_session,
unknown_or_expired_session, role_denied), the attempt kind, the attempted role
and an already-known account id. No key, key hash, session token, session hash,
request body, origin, address or user agent is stored, and the
unknown/disabled distinction is deliberately collapsed so the lookup cannot
become an account-enumeration oracle.
GET /api/admin/operations?attempts=1 returns seven-day per-reason counters plus
the twenty most recent attempts, newest first, to a live owner only, with
no-store and the same query guard as the other reads. The operations page adds
"List failed attempts" with the counters and the bounded sample, truncating each
account id to eight characters. Recording is best-effort inside the rejection
path, so a rejected request keeps its own answer even when the table is
unavailable, and the history never locks out, disables or revokes anything by
itself.
Evidence: tests/admin-attempts.test.ts asserts every recorded reason, the
kind/role/account fields, that successful sign-ins and privileged reads record
nothing, that no credential text appears anywhere in the page, the reporting
window, the twenty-row bound and the owner-only recheck after demotion, and that
a dropped attempts table leaves the original rejection answer unchanged. The
anonymous HTTP boundary denies ?attempts=1, and the panel was verified in the
real browser against a genuine recorded rejection. The shared AdminError moved
to db/admin-error.ts so the recorder and the access module no longer form a
value-import cycle. Offline suite 7,801/7,801 with typecheck and lint clean. No
game, seat, saved state or deployment changes.
Add an owner-only, read-only sample of at most ten live rooms whose public
pending interaction — decision, response, Truthtrance or phase opening — has
been idle longest, with the room code, idle duration, interaction kind, turn
and phase. GET /api/admin/operations?stalled=1 repeats live owner authority,
answers no-store, rejects any other query combination and repairs nothing;
paused, closed, removed and archived rooms are excluded and no private game
content is selected. The aggregate sample adds stalledRooms and
oldestStalledChange for the same predicate.
Owner-only unit coverage asserts the counters, the oldest stalled write, the
bounded oldest-first order, every exclusion boundary, idle arithmetic, the
absence of private content and the owner recheck after demotion. The anonymous
HTTP boundary denies the new read, and the full HTTP integration suite passes
55/55 against a local build of this revision. The panel was verified in the
real browser against six hours of genuine idle rooms, which caught and fixed a
missing threshold field in the response.
No game, seat, saved state, deployment, public start or played-save conversion
changes.
Let owners/operators mute or unmute new public/private sends from a human seat while retaining history, incoming messages, gameplay and credentials. Fence metadata and durable audit writes with live authority, membership and versions. Preserve exact admin/message retries and inherit restrictions through seat recovery.
Validation: types/lint, 5431 offline tests, build, 52 HTTP integration tests, 24 administrator HTTP groups, independent SQL/privacy/UI review and desktop/mobile refresh acceptance. All 2230 prior games and 4746 seats preserved. Additive migration 0016. Verified runtime fingerprint 588967fbb9c2e3b6abe2990c4fce96ee69e2256fb7e3ee416314b87593cebba9; documentation-only grammar/button-label review gives b5e57bdd26812debede91c588e38f247f1fa895ad23e7ae30bc8550eedcd90ec. New-revision deployed acceptance remains open; full admin/rules scope is unfinished.
Enable an existing AI difficulty for a human seat through admin controls without granting private access or advancing paused play. Preserve custody, credentials, takeback and separate paced resume. Bind atomic writes and outgoing-grant revocation to live authority, room/pause versions and active seat access with durable exact receipts.
Validation: types/lint, 5408 offline tests, build and 52 HTTP tests passed on source fingerprint 2157de0f4bb0b74d9760d52102601c52344cf674dee8ccd1d559f0a246a1d4ff; 22 authenticated admin HTTP groups, independent SQL/privacy/UI review, desktop/mobile and refresh checks. All 2098 baseline rooms and 4455 seats preserved. Migration 0015 is additive. Positive production admin QA awaits authorized access; full admin/rules scope remains unfinished.
Show progress during initial admin and seat-control submissions; retain exact recovery instructions for uncertain requests and explicit retries. Keep seat recovery and handover confirmations above the table until Continue without blocking gameplay. Use readable 16px text and 44px controls.
Verified isolated checkpoint: types, lint, 5381 offline tests, 52 HTTP tests and build. Local delayed/lost-response browser QA covered admin creation, durable retry, handover and seat recovery, mobile readability and saved-seat restoration. Existing 2098 rooms and 4455 seats preserved. Deployment acceptance follows separately.
Organize closed rooms with archive filters, live-authorized atomic receipts and exact saved retries. Preserve saved games, timestamps, credentials, discussion and AI deadlines. Unarchive leaves play closed; reopen requires unarchive, and removal/restoration preserves both flags.
Verified types, lint, 5379 offline tests, 52 HTTP tests and build. Twenty dedicated administrator HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed a single archive after a lost response and refresh, readable recovery text, mobile unarchive and separate reopening, and saved-seat restoration. All 2,049 baseline rooms, 4,348 seats and related records preserved. Authenticated production admin acceptance awaits authorized QA access; full admin and rules gates remain open.
Preserve readable private tables, discussion and pending games while closure blocks new play, joins, messages, AI and seat mutations. Add live-authorized atomic closure audits, room-version/revision fences, dedicated controls and exact saved retries. Reopen with the saved pause/join settings and current credentials; restoring a removed but closed room keeps its AI stopped.
Verified types, lint, 5356 offline tests, 52 HTTP tests and build. Seventeen dedicated authenticated HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed one close after a lost response and refresh, persistent readable notices, retained private draft, mobile reopening and saved-seat refresh. All 2,001 baseline rooms, 4,243 seats and related records preserved. Positive production admin acceptance awaits authorized QA access; full admin and rules gates remain open.
Preserve room JSON, seats, credentials and messages while removed rooms deny ordinary reads and writes. Add deliberate room-scoped controls, removed-directory filters, persistent player notices and live-authorized atomic version/revision audit receipts. Retain uncertain room/seat requests and hidden recovery drafts through removal; restore the prior pause/join settings without reviving revoked credentials.
Fix AI readiness after a joining human or human faction change so real lobby starts remain legal.
Verified types, lint, 5314 offline tests, 52 HTTP tests and build. Fourteen authenticated HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed a saved removal after a lost response and refresh, one audit on exact retry, persistent notices and recovery draft continuity. All 1,945 baseline rooms, 4,121 seats and related records preserved. Positive authenticated production admin acceptance remains pending authorized QA operator access; full admin and rules gates remain open.
Configure supported rules/modules and AI seats or assign an existing human as host without granting private-seat access. Use genuine unused-lobby checks, existing engine actions, live authorization/version/pause/seat fences and atomic audit receipts. Preserve exact account-bound retries across refresh and confirm completed operations after game start without resetting play.
Verified types, lint, 5260 offline tests, 52 HTTP tests and build. Eleven authenticated HTTP groups and independent privacy/persistence review passed. Browser QA confirmed one AI and audit after a lost response and refresh/retry, persisted rules and AI configuration, and readable 1280/390px layouts. All existing rooms and seats preserved. Actual authenticated production administrator acceptance remains pending authorized QA operator access.
Create an explicitly owned new host seat with supported rules/modules and ordered AI seats through one live-authorized transaction. Save exact account-bound retries across refresh, record durable audit metadata, and never restore a revoked or transferred host credential. Connect invitation joining and ordinary voluntary host handover. Preserve normal readiness and Advanced preview gates.
Verified types, lint, 5240 offline tests, 52 HTTP tests and build. Eight authenticated HTTP groups and independent privacy/persistence review passed. Browser QA confirmed one room after a lost response and refresh/retry, working host controls and saved continuation. Mobile layout passed; requested desktop viewport override did not take effect. Existing games preserved. Authenticated deployed administrator acceptance remains pending explicit QA access.
Provide authenticated owner/operator room controls with live account binding, durable audit and exact saved retries. Pause gates human, bot and automatic writes while preserving recovery, discussion and taking back control. Resume keeps decisions and restores AI pacing. Add directory availability filters and player notices.
Verified types, lint, 5223 offline tests, 52 HTTP tests and build. Independent persistence/privacy review and authenticated HTTP acceptance passed. Desktop/mobile browser QA confirmed lost-response refresh/retry makes one audit row and resume restores controls. Existing games preserved. Authenticated deployed admin acceptance remains pending explicit QA access confirmation.
Show concise progress during first room create/join; reserve persistent recovery instructions for saved/uncertain attempts. Retain completed-action text until a local Continue button, without gating rules or AI. Preserve unread text across backgrounding, bounded summaries, mute and private-safe feedback. Fix the container QA helper path-import collision.
Verified: typecheck, lint, 5200 offline tests, 52 HTTP tests and production build. Delayed/lost-response browser checks prove progress, refresh recovery and exact retry without duplicates. Notice stayed for over 47 seconds while the QA game progressed; Continue advances only presentation. Mobile 16px/44px controls verified. Existing games preserved. Container/deployed acceptance follows publication.
Connect personal operator-provisioned admin keys, persisted roles and eight-hour sessions, current/all-session revocation and a filtered room directory. Additive schema protects final owner, revokes disabled accounts and records safe audit history. No game state changes; remaining administration scope stays explicit.
Verified: typecheck, lint, 5196 offline tests, 52 HTTP tests, production build; authenticated local HTTP and desktop/mobile browser checks. Independent privacy/security review fixed malformed nested roster searches and read-time session revocation. Preserved 1,671 prior rooms and 3,538 seats. Container/deployed acceptance follows publication.
Add room-creation and host lobby rules selectors, readiness reset, explicit
preview start and a persistent warning. Admit the six classic factions,
Tech Tokens with 3+ players and optional Stronghold Cards through genuine
setup. Keep expansion/module gates and complete-rules/publication criteria.
Persist the preview marker and enforce fresh native leaders, unchanged
piece custody and clean runtime/pacing state. Preserve private projections,
JSON continuation, exact room-entry retries and version/CAS protection.
Independent review resolved malformed leader, extra card-zone, missing
required-key and stale bot-deadline admission gaps.
Validation on the shared development tree: types, lint, 5169 offline
tests, build and 50 HTTP tests passed. The tree also contained the
separate deployment task's changes; this commit stages only preview scope.
All 57 base rosters completed real setup with each legal AI profile. Five
normal-preview-start games (2–6 seats) completed 1950 actions and
51 JSON restores without rejected actions; no strategy calibration.
Browser: actual create, host switch/readiness/Stronghold reset, explicit
start, exact private refresh, desktop and mobile warning checked. Retained
dev process stopped; backed up 1,629 saved games, restored server with all
unchanged, and resumed the same traitor choice into Storm. Baseline all-table
preservation retained 1626 rooms and 3442 seats; totals
now 1669 rooms and 3536 seats. No reset or automation.
Preview remains incomplete. Legacy unsupported expansion creation payloads
remain accepted for exact retry compatibility but cannot start. Existing
rules ambiguities and full visual acceptance remain open.
Present public plans in physical attacker/defender order with exact force dials,
played leader portraits and printed strength, readable used-card faces and direct
inspectors. Keep Cheap Heroes, printed Worthless category, empty slots and late
rescue defense distinct. Preserve Banker, native bonus, KH, Stone Burner,
Poison Tooth and Diplomat details rather than treating printed values as scores.
Mount one shared display after the main grid so every viewer retains access
while another seat owns a post-reveal choice. Keyboard links focus the display
and pending controls. Render nothing before public revelation, select exact
used identities from the authorized projection, and consume no private insight
or hands. No game rule, saved field, endpoint, AI strategy or release gate changes.
Five new cases cover genuine sealed/revealed actions, stable order, used-card
privacy, JSON immutability, fractional dials, hero/Worthless/late/empty slots
and both seats during a real Diplomat decision. All28 related focused cases
passed before final rule-link adapter changes; types, lint, all 5017 offline
tests and production build pass on the final stable source. First broad run
caught plain rules-page anchors; next/link and test aliases correct this.
Independent privacy/layout review and final follow-up found no material issues.
No API/auth/persistence changes; HTTP tests and full game samples not repeated.
Browser QA creates a fresh human Emperor/Easy Harkonnen lobby with genuine
setup, then explicitly stages a conserved battle. Normal engine actions choose
battle and seal the opponent plan; human browser action seals dial2, Captain
Aramsham, Slip Tip and Shield. Public display absent beforehand and shows correct
both plans afterward. Leader/opponent-card inspection, Escape/focus return,
internal help, keyboard section links and refresh preserve the pending decision.
At390x844, client/scrollWidth375, stacked panels299px, rules16px and controls44px;
normal viewport restores1265px and two560.5px plans without horizontal overflow.
Screenshot capture timed out; full visual/screen-reader acceptance remains open.
All 1579 opening games, 3347 saved seats and auxiliary rows
remain identical. One isolated QA game adds one seat and one entry receipt.
Its room remains unchanged after human seal through inspection/help/refresh,
and its saved seat remains unchanged. SQLite integrity and foreign keys pass.
No server restart, migration, reset, recurring automation or calibration.
Record Basic Moritani plus the full Leader Skills deck as the next concrete
integration target, requiring coordinated profile guards and real Terror/death/
revival continuations. Existing rulings and mode gates stay explicit; the later
Tleilaxu revival-offer ordering issue remains a gated integration dependency.
Private evidence: 20260921-revealed-plans.
Verified source tree: 8d5496cdea0076aa1cdab4590e95fcaa677c9d2d8513190c2ce9ac6c90bb9196
Add an enlarged public sheet beneath each player, available while actions are
pending. Only faction identity and table rules mode enter the reader; it sends
no action and receives no private player data. Basic/Advanced preview explicitly
leaves the table mode unchanged. Native mode control, keyboard scrolling,
Escape/focus restoration and internal links use existing dialog components.
The internal gallery covers all twelve factions with bundled Homeworld artwork.
Share every faction's Basic and Advanced paragraphs with the main reference.
Replace Richese's generic placeholder, centralize Ecaz/Moritani guidance from
settled contracts, correct CHOAM Auditor/Baliset/Jubba availability and align the
Fremen/Ecaz Sietch Tabr exception. Full printed text, unresolved powers and
combined-rule acceptance remain explicit. No new rule, AI strategy or gate.
Four focused tests cover all12 identities, shared paragraphs, artwork files,
internal links, mode separation, gallery defaults and per-viewer busy controls.
The first busy-control assertion falsely matched CSS disabled variants; it now
checks actual disabled attributes. All16 related focused cases pass. Independent
review caught missing Moritani optionality and stale Fremen exception text;
those were fixed and final review found no material issue. Auditor limits and
full actual-card cancellation cost were checked against the existing contract.
Types, lint, all 5000 offline tests and production build pass on stable source.
No API/auth/persistence changes; HTTP tests were not repeated.
Browser QA reused the existing two-player Basic auction without game actions.
Both own and opposing inspectors work; Enter opens, Escape closes and returns
focus, reopening resets Basic, and Advanced preview explicitly preserves the
Basic table. ArrowDown scrolls the focused long sheet. At390px, dialog359x828,
scroll client/width342 without horizontal overflow,16px text and44px controls.
Gallery334px fits without overflow; Richese, Ecaz and Moritani selection and
Advanced paragraphs render, faction change resets Basic and bundled art loads.
Internal help and Advanced Moritani links expand their topics. Back and refresh
preserve four hand cards and the pending minimum bid2; normal viewport restored.
Screenshot capture timed out; full visual/screen-reader acceptance remains open.
All 1539 opening games, 3259 saved seats and auxiliary rows
remain identical, including the QA room. SQLite integrity and foreign keys pass.
No new games, server restart, migration, reset or recurring automation.
Private evidence: 20260921-faction-sheets.
Verified source tree: 6b738958f30fc381d3e9eb26398239bbd88f1d4281f8ff5ff2bb3b3259494a93
Wrap existing physical hand cards with local name search, printed-category
filters and saved/name/category display order. Preserve card IDs, actions and
inspectors, keep required decisions outside filtering, and recompute results
from current owned cards. Provide count, clear filters, keyboard scrolling,
separate empty/no-match states and internal guidance. Filters reset on leaving
the hand tab, changing seats or refreshing; saved order is never modified.
Correct the stale Harass availability note to reflect connected allocation.
Six focused tests cover normalized literal search, duplicate physical IDs,
canonical expansion categories, stable immutable sorting, current holdings,
JSON restoration, full-table per-seat privacy and empty setup messaging.
Independent review found no material issue. Types, lint, all 4996 offline
tests and production build pass on stable source. No HTTP, auth, schema or
persistence implementation changed, so HTTP tests were not repeated.
Browser QA used a new two-player Basic Harkonnen/Easy Atreides game created
through genuine setup. Search/category/reset, named inspector and all three
sort orders worked. An active no-match filter updated from 0 of 2 to 0 of 4
when a real auction purchase and Harkonnen bonus arrived. Leaving the hand tab
and refreshing restored all four cards in their original saved order while
the second auction remained at a human decision. Enter in search performed
no game action. The internal guide worked by keyboard. At 390px, controls
were 44px high with 16px text and 14px labels, form width/scroll width 339px;
the focused overflowing card row responded to ArrowRight. Normal viewport
restored. Screenshot capture timed out; full visual/screen-reader acceptance
and complete expansion/card-effect combinations remain open.
All 1538 opening rooms, 3258 seats and auxiliary rows
remain unchanged. SQLite integrity and foreign keys pass. Only one isolated
QA game, its human seat and entry receipt were added; the AI remains in game state. Healthy server reused without restart,
migration, reset or automation. No AI strategy or mode/publication gate changed.
Private evidence: 20260921-hand-browsing.
Verified source tree: 39dce28efa52dd66baf019baaf8610e6795601b3b569ac4ac0b6f405bffc1d96
Add server-derived physical draw counts above the board after setup begins.
Counts exclude hands, auction pools, faction caches and discards; the client
receives only two numbers, without deck identities or order. Lobby counts are
absent, zero remains explicit and existing refill/custody rules are unchanged.
An internal guide explains pile boundaries, empty/refill behavior, first-turn
worm return and existing authorized inspection. Nexus counts remain separate.
Independent review found no material issue. Six focused cases cover genuine
Basic setup, every viewer, private-field exclusion, JSON/input immutability,
actual auction draws and refill, physical custody, Spice refill with Thumper
annotations excluded, skipped worm return and connected busy/empty/lobby UI.
The initial refill assertion assumed a single card; it was corrected to account
for a legal randomized chain of worms before a territory. The original broad check caught seven view-equality failures in privacy
fixtures that also changed the now-public deck count. Their four test files now
vary hidden allocations/identities at fixed public counts, retain whole-view
assertions and check physical custody. The Sapho fixture now returns its
swapped card rather than losing it. A reviewed CHOAM correction keeps its owner
empty during donor1to2 by staging a hidden discard; the original oracle test
remains intact. All70 affected focused tests pass.
Types, lint, all 4990 offline tests, production build and 49 HTTP tests
passed on stable source. Browser QA reused the existing three-human Basic Nexus
without any game action. Treachery29 and Spice19 matched saved physical arrays;
390px layout fit within339px without internal overflow, with16px body/14px labels.
The internal guide worked by click and Enter, and Back/refresh restored the same
counts. Normal viewport restored and preview retained. Screenshot capture timed
out; full visual, screen-reader,200% text and combined-game acceptance stay open.
All 1499 opening rooms, 3171 seats and auxiliary rows are
unchanged. SQLite integrity and foreign keys pass; isolated HTTP rooms are new.
Healthy server reused without restart, migration, reset or recurring automation.
Full AI refinement remains deferred and no mode/publication gate was opened.
Private evidence: 20260921-deck-status.
Verified source tree: 091be8f49f9b637b9a79da43271cbffdff5cf8c9f653484afa7041c71af88e98
Each player summary opens enlarged original counter diagrams and public physical
pools. The inventory separates reserves, Tanks, board locations and foreign
Homeworld deployments. Native Homeworlds break down existing reserves; elites
and advisor stances remain subsets. The reference gallery covers all twelve
factions, including Suboids/Cyborgs, Sardaukar, Fedaykin and BG advisor faces.
Actual force keys retain unplaced Mobile Stronghold and Discovery groups.
Basic Homeworld special identity comes from public typed pools, not mode alone.
Concealed No-Fields expose only a separate marker/location; no value or future
materialization is inferred. Temporary battle strength creates no physical
counter. Invalid projections show a refresh notice instead of invented totals.
Inspection updates from current props and submits no action or saved mutation.
Independent review found no material issue and clarified No-Field wording:
revelation draws from reserves available then, without earmarking counters.
Eleven new focused cases cover faction identity, typed pools, advisors, genuine
Basic Homeworld public views, native/foreign splits, genuine Ix setup before HMS
placement, a controlled Discovery position, JSON continuation, input immutability,
concealed0/3/5 equivalence, named controls and malformed projection feedback.
A test-only Homeworld projection initially omitted its card identity; corrected
before final checks. Lint's semantic status element was corrected to output.
Types, lint, all 4984 offline tests and production build passed on stable
source. No HTTP/auth/schema/persistence behavior changed, so no additional HTTP
suite was required. Browser QA reused an isolated existing three-human Basic
Nexus without game actions. All three public inspectors showed correct pools;
Escape restored trigger focus, Enter opened inspection and PageDown scrolled the
labelled region. At390px the dialog359px fit, body text16px and Close44px high.
All twelve gallery choices rendered named160px diagrams without gallery overflow.
Internal guide, Back and refresh worked; viewport reset and preview retained.
Screenshot capture timed out. Full visual/screen-reader/200% zoom, manufactured
component fidelity and all-configuration browser acceptance remain open.
All 1499 original rooms, 3171 seats and auxiliary rows are
unchanged; SQLite integrity and foreign keys pass. The healthy server was reused
without restart, migration, reset or automation. AI strategy/calibration remains
deferred until non-AI features are complete; no mode/publication gate was opened.
Private evidence: 20260921-force-inspection.
Verified source tree: 5d7ffd471229faa13224fd5a87d33c3ac5af866446241a7881926a54c1ee49eb
An unallied sender can withdraw its unanswered offer during an ordinary Nexus.
The table names the outgoing recipient and keeps this distinct from breaking a
formed alliance. The chronicle now records named proposals, withdrawals and
breaks. Existing authoritative quote, timing locks, readiness, physical custody,
Nexus-card forfeiture and request/version handling remain unchanged.
Full-table rendering checks cover owner/recipient/observer controls, replacement,
withdrawal, incoming offers, break, blocked timing and JSON continuation. A
production SQLite race permits exactly one acceptance or withdrawal at a version;
a stale withdrawal cannot break an alliance formed by the accepted request.
Private restored views and seat credentials remain intact. All four current AI
profiles retain legal participation; no strategy or calibration changes.
Independent review found no material issue. Types, lint, all 4973 offline
tests, production build and 49 HTTP tests passed on stable source.
Browser QA used a fresh three-human Basic lobby, genuine setup and a controlled
later-Storm boundary with existing Spice Cards reordered; actual Storm/Worm
resolution opened the Nexus. This is a focused position, not a full-game sample.
Browser proposal, refresh, keyboard withdrawal, retained incoming invitation,
acceptance, break and named chronicle entries passed. At390px the page375px and
withdraw339px by46px fit, with16px text. Final refresh restored no offers or
alliances. No screenshot was captured; full visual/assistive and all-configuration
acceptance remain open. Browser lost-response injection was not performed.
All 1459 original rooms, 3081 seats and auxiliary rows are
unchanged. SQLite integrity and foreign keys pass. The healthy server was reused
without restart, migration, reset or recurring maintenance. Full rules and
expansion completion remain gated. The goal retains deferred full AI development,
three adjacent approximate75% targets, no usage cutoff, selective subagents and
verified Git pushes.
Private evidence: 20260921-nexus-offer.
Verified source tree: e44e61b651e66cad23326bcca3ba2eecd6bb5a779a16e0273db8d0039f453511
Players can select a non-allied recipient and explicitly pay a whole-spice bribe
outside Mentat and open decision/response windows. The server derives private
payment limits from uncommitted spice and existing joint Truthtrance completion
checks on isolated copies. Target-specific Bureaucrat guards preserve supported
redirect/allow continuations. Reserved bids, sealed spending and incoming escrow
cannot be spent twice. No strategic AI negotiation or mode/publication changes.
The panel separates deferred incoming bribes from spendable supply, disables
stale/invalid selections and uses existing request/version fencing. The chronicle
now describes actual payment and next-Mentat spendability rather than a promise.
Internal guidance and the implementation checklist record this boundary. The
separate Emperor gift/Bureaucrat source ambiguity remains explicitly pending.
Independent review found no material issue. Focused tests cover out-of-turn
payment, JSON escrow/collection, private budgets, invalid targets/amounts,
phase/response gates, reserved bids, joint promises, supported redirection and
rendered controls. Existing Bureaucrat SQLite/all-four legal response tests pass.
The new HTTP test races duplicate submissions and verifies one debit, refreshed
private balances and stale/over-budget rejection.
Types, lint, all 4968 offline tests, production build and 49 HTTP tests
pass on stable source. Preliminary checks caught a typed fixture opener and
semantic-status/internal-link/template lint requirements and the new SSR test
needed the existing Vinext Link alias. All were corrected before the
final4 run. Browser QA used genuine fresh Basic setup with a human payer and
Easy AI recipient: 11 rejected by controls, 4 paid from10 leaving6, one public
payment entry and unchanged recipient spendable10 with4 in escrow after refresh.
Keyboard selection and amount access passed. At390px the panel fits with16px
text and44px-or-larger controls; linked rules and back navigation work. Screenshot
capture timed out; full visual/assistive and all-configuration acceptance remain
open. Browser transport loss was not injected; HTTP concurrency is separately
covered. This is playability evidence, not difficulty calibration.
All 1418 original rooms, 2991 seats and auxiliary rows are
unchanged. SQLite integrity and foreign keys pass. The healthy server was reused
without restart, migration, reset or recurring maintenance.
Private evidence: 20260921-bribe-controls.
Verified source tree: b9a8594c5dcd85f78974c9647f24f5f6eba60a38c9dcd2badcf4529d1e825ae1
Humans can discuss plans publicly or message another human seat privately while
pending game decisions stay intact. The conversation panel provides plain text,
explicit recipient names and factions, saved history, private pagination and
exact retries through refresh. Human AI-control owners can still talk; bots do
not interpret messages or negotiate. Existing game actions execute agreements.
An additive indexed D1 message table stores discussion separately from game JSON,
versioning, readiness and bot continuation. Every read/insert checks active seat
credentials and membership; direct audiences and cursor lookups are filtered
before limiting. Public history has no private activity counts or sequential IDs.
Recovery/handover inherits seat history while fencing old credentials.
Independent review found two retry races: a rotation between a committed insert
and receipt read, and stale unmounted completion deleting a newer retry record.
Both are fixed with regressions. A prior uncertain retry stays pending on later
rejection. The nine focused offline cases and two HTTP cases cover production SQL,
concurrent/altered receipts, audience/cursor privacy, rotation/membership races,
actual saved-kit recovery and unchanged sealed setup state.
Types, lint, all 4963 offline tests, production build and 48 HTTP tests
pass on stable source. An initial check caught an invalid checklist status label;
that was corrected before the successful final2 verification.
Desktop browser checks send public/private messages, receive a peer reply, retain
private history after refresh and remove it on channel switch. Literal markup and
URLs remain text. Recipient and bystander API reads confirm the browser messages'
audiences. Screenshot capture was unavailable and the viewport override did not
take effect; mobile, full keyboard/visual and injected browser network-failure
acceptance remain open. No final rules, mode, AI or publication gate changes.
All 1373 pre-existing rooms, 2883 seats and auxiliary rows
are unchanged. SQLite integrity/foreign keys pass; migration 0007 adds messages
without replacing data. The healthy server was reused without restart.
Private evidence: 20260921-table-talk.
Verified source tree: 236dd55b6c15d55dbced735be67427e5fbd7fa348d583f119e67a03894ec21b0
Let the host change an existing permanent AI seat's difficulty, faction and player circle without removing and readding it. Shared strict validation limits configuration to the authenticated host in the lobby, existing profiles, enabled available factions and unoccupied circles. Preserve seat identity and initialize changed faction rosters consistently. Changes reset human readiness, keep bots ready and explain the changed fields in public history.
Use existing AI strategies without calibration or strength changes. Full AI development waits for all non-AI game features; the goal retains the three adjacent 75% targets, mandatory Git checkpoints and selective subagents without a usage cutoff. No mode or publication gate opens.
Independent implementation and review cover the quote, engine, controls and persistence tests. Types, lint, 4916 offline tests, production build and 46 HTTP checks pass on stable final source. Ten new offline cases cover all factions/profiles, strict guards, roster/identity, immutable rejection, restart/privacy and both configuration-versus-start race outcomes. HTTP verifies authentication, host authority, CSRF, stale/future requests, private views and saved settings. Identical direct actions preserve players/readiness/history but retain the generic action store's version increment; controls suppress them.
Browser QA changed difficulty, faction and circle, verified readiness reset and history, restored settings after refresh and used keyboard selection. Expanded mobile cards were widened after discovering cramped controls; measured selects/buttons are 272 by 44 pixels at a 390-pixel viewport without document overflow. Desktop controls measure 169 by 44 pixels. Screenshot capture timed out, so screenshot-based visual acceptance remains unverified. Configuration controls disappear after starting and saved AI settings persist in setup. The final source rerun follows a preliminary run invalidated by the mobile/readability edits.
All 1262 original rooms, 2644 seats and every prior recovery/entry/handover/delegation/migration row remain unchanged. SQLite integrity and foreign keys pass. No database reset, migration, server restart, usage check or automation was performed. Broader rules, components, durable unattended continuation and final AI acceptance remain unfinished.
Verified source tree: 8c1baf4602d000ee37f081b2a03f8a87e89a63ef14a7121f24268c575a1ac281
Let a human owner authorize another human in the started room to start a fixed difficulty once within 24 hours. The owner retains the seat, cookie, private hand, recovery setup and takeback control. Consent is explicit even while online; neither host status nor inactivity authorizes a takeover. Activation enters the existing paced private-view AI path without strategic changes.
Add additive migration 0006, both exact session fences, owner/delegate-only metadata in the authenticated room snapshot, atomic CAS activation and consumption, expiry and terminal retry receipts. Replacement hides older consent; own AI changes invalidate unused consent. Recovery or handover of either bound seat invalidates the grant. Future-version guards prevent stale computed state from overwriting a racing action. Exact browser retry records retain the original operation/version across refresh and cannot rearm old consent. Shared HTTP continuation preserves coalescing across ordinary and control routes.
Independent review found no material remaining issue. Revoke messaging accurately handles activation winning the race. Browser QA exercised grant/revoke, preserved consent after refresh, reciprocal fixed-profile activation, consumed receipts, keyboard takeback and private ownership. The panel now remains expanded after success and action buttons are at least 44px. Responsive screenshot acceptance remains open because the browser viewport override targeted a failed secondary-origin tab; desktop controls and no-overflow width were verified. The QA room is stopped at a genuine human setup decision with both seats taken back.
Types, lint, all 4906 offline tests, production build and all 45 HTTP tests pass on the stable source fingerprint. Seven new offline cases cover client consent/retry validation and real SQLite privacy, restart, one-use races, future versions, takeback, expiry and both-seat recovery/handover; two new HTTP cases cover authentication, injection, fixed-profile continuation and takeback. The first broad run exposed 68 legacy VM fixtures missing the new production dependency; their mappings were updated and the real shared continuation remains exercised. The historical 0005 migration test verifies backfill before applying 0006 for current code.
All 1174 original rooms, 2456 seats and every prior recovery/entry/handover/migration row remain unchanged. SQLite integrity and foreign keys pass; migration and QA added 88 rooms and 188 seats. No reset, server restart, usage check or automation was performed.
The current Sites integration has no supported durable Cron/DO provisioning path. Document this platform blocker rather than adding an inert scheduled export; unattended resumption and broader network-failure acceptance remain unfinished. Full rules, component, AI strength and publication gates remain closed.
Verified source tree: 2d86fc611e9ef4f5a10db10f96687a31db1ec238908ecf1e9333c50fac9ccaa8
New players can open Learn to play from the lobby or rules reference. Five lessons explain public/private information and turn phases, then offer three independent exercises for ordinary shipment budgets, a sealed battle plan and spice collection, followed by joining and recovering a real table. Shipping, combat and collection use existing production quotes rather than a separate simplified calculator. The fixed opposing plan is a teaching example, not an AI match.
Reuse the battle wheel and card inspectors, provide keyboard inputs, move focus to the current lesson heading and stack the layout on phones. Versioned browser-local choices preserve lesson position, shipment, defense/dial and reveal state. Whitelisted validation rejects corrupt saves and impossible committed shipments. SSR uses a stable hydration placeholder before reading browser storage; direct user handlers save choices and retain usable in-memory state on storage failure. No room, seat credential or multiplayer API is used.
Six new tests cover prices and affordability, every offered battle dial/defense, protected ties, weapon death, actual losses/bounty, collection limits and city capacity, saved-choice validation and internal rule links. Types, lint, 4872 offline tests and production build pass on the unchanged source fingerprint below. The first required check stopped on React setState-in-effect and semantic-status lint findings; these were fixed before the successful complete run. Independent review found no material defect in the examples or final hydration/save implementation.
Browser controls verified an unaffordable shipment, legal six-force shipment, card inspection, protected 8-8 aggressor victory, Snooper/projectile death and bounty, sealed refresh, city collection, lobby return/re-entry and newly changed choices after the hydration correction. At 390px the battle controls and lobby Learn link stayed within page bounds; the viewport override was reset. Screenshot capture timed out, so visual screenshot acceptance is still open. Storage-denial browser testing and the broader faction, movement, bidding, alliance, Advanced and expansion curriculum remain unfinished.
All 1106 current rooms, 2314 seats and all original recovery/entry/handover rows exactly match the fresh outage backup. SQLite integrity and foreign-key checks pass. The healthy server was reused; no restart, database migration/reset or maintenance automation was needed. HTTP integration and full-game samples were not rerun for this isolated teaching surface; server game behavior did not change.
A bounded independent primary-source review supports Smuggler's reveal-bound deferred survival receipt but found no exact ruling for modified leader strength. Record the one new user question and preserve the unanswered gate; lower collection remains missing. This does not enable any rules mode, expansion or publication gate.
Verified source tree: 99718ab49c4fec14820cbaf35f2e0f815e6424e910ee67c4daa1941afdeca2f0
Connect browser-local mute, keyboard volume and a test sample with short original Web Audio cues for public phase/status/turn changes and tagged automatic actions. Audio consumes only projected sequences and public phase identity, with no game actions, private eligibility checks, media requests or saved-game writes. Preferences default off at 35%, survive refresh and synchronize across same-origin tabs.
Silent initial snapshots, stale sequence rejection, batch priority and a 700ms cooldown avoid historical replay and queued bursts. User gestures unlock audio; hidden tabs stay silent. Mute, backgrounding and unmount stop active voices, pending unlocks are cancelled, and unavailable audio remains cosmetic. Existing automatic visual notices and AI pacing remain independent.
Six focused regressions cover cursor consumption, phase priority, room changes, bounded volume and voices, unlock cancellation, disposal, unavailable audio and accessible initial controls. Independent review found a mobile panel overflow; the corrected panel stayed inside the viewport in DOM measurements. Browser controls verified enable/mute, keyboard volume, zero-volume disabling, refresh restoration and cross-tab preference updates. Preferences were restored to off/35%. Physical output and screenshot acceptance remain unverified because screenshot capture timed out. Broader event coverage and final sound design remain unfinished.
Types, lint and 4856 offline tests plus production build pass on the unchanged source fingerprint below. The first broad check found the accessibility linter's semantic-output requirement; the status element was corrected before the final checks. HTTP/AI calibration runs were not repeated for this cosmetic-only change.
All 1,072 saved games, 2,243 seats and original recovery/entry/handover records match the pre-outage backup; SQLite quick-check and foreign keys pass. The responding server and isolated browser seat were reused after the latest outage, without resetting games or creating automation. Mode and publication gates remain closed.
Verified source tree: da84d2cc4ed5b0face56afb034857b85c52708e11d86ff3f1cb3c8abdeee99d0
Let a current owner issue, cancel or replace a private 24-hour one-time offer.
Recipients accept the same faction and saved game while old browser sessions,
recovery keys and entry receipts lose authority. Preserve exact claim retries
across refresh, restart and later offers, with private tab-scoped continuation.
Fence every claim mutation to its winning transaction. Add durable receipts
and additive backfill for already-issued offers without changing game JSON or
existing seat authority. Block competing navigation during unresolved owner
operations; remove invalidated owner kits on confirmed recovery.
Record the pending CHOAM Nexus after-victory secrecy/window decision without
inventing the unresolved gameplay or opening mode/publication gates.
Validation: types/lint and 4,364 offline tests passed; production build passed;
43 HTTP tests passed. Added 19 offline and 3 HTTP regressions. Independent
privacy/persistence review passed, including deterministic CAS interleavings,
rollback, legacy migration and exact receipt restoration. Browser room 2EMYG4CY
retained private setup choices after handover/refresh and continued into Storm;
follow-up recovery removed its invalid offer with cards/forces/spice unchanged.
All 218 opening rooms preserved (291 after QA and both broad runs). The opening
456 seat, 49 recovery-key, 56 recovery-receipt and 106 entry-receipt rows were
also verified unchanged. Server reused; no restart or recurring automation.
Final private report: ~/.local/share/dune/checkpoints/20260913-seat-handover/
verification-final/report.json. Source fingerprint:
8949cdf58eb8bc8bd33f2657c6b21352b3ee5e17e2a556c684a89073015632f4.
Check/build/HTTP duration: 140565/6689/24835 ms. The earlier broad run passed;
a final recovery-UI review fix required the second source-bound run.
Goal aggregate counter 64,301,976 -> 65,031,751 before Git (729,775) for this
bounded capability and its concurrency/recovery review; full goal remains active.
Quintine