Removes operator-private material from the shipped tree, corrects documentation
that had drifted from the code, deletes dead code, and applies a consistent
prose style.
Private material moved out of the public tree (docs/private/, git-ignored):
- the wallet keyfile recovery runbook and its helper scripts, which together
published the mainnet wallet file path, the service account, backup snapshot
filenames, and the wallet RPC listener state. The helper duplicated the same
constants, so relocating the document alone would not have removed them.
- the stagenet parallel-candidate runbook and its fixtures.
- the dated production-state record, the internal remediation plan, and the
TODO list. None are reference documentation for an outside reader.
Redacted or genericised:
- operator home-directory paths in shipped scripts and units. The asset build
script now takes KENNEY_ASSETS_DIR instead of a hard-coded path.
- private LAN addresses in tests, env examples and deploy docs, replaced with
RFC 5737 documentation addresses.
- the default alert sender and the notification hub example.
- the Monero wallet unit now matches the Wownero one: a dedicated service
account and a config file, instead of the operator's login account with the
wallet password in argv where any local user can read it from /proc.
Ignore rules now cover every .env variant rather than the bare name, plus local
agent state. The deployment docs instruct operators to create .env.mainnet and
.env.stagenet, which the exact-name rule would have allowed to be committed.
Documentation corrected against the code: per-chain dungeon level counts, the
premium unlock rule, Tavern chat scope, backup retention, the chain-profile
fallback, the environment template location, and several sections describing
shipped work as pending.
Dead code removed: configPersistence, rpccalls, a duplicate vendored ROT.js
bundle, the unused tile-picker overlay, the unreachable legacy game-size path
and its vestigial parameter, spectator stubs that shadowed the real
SpectatorManager, and commented-out debugging. nip98 now imports the shared
nostr loader rather than duplicating it.
Prose style: em-dashes removed throughout in favour of colons, semicolons and
commas; comments restated as present-tense descriptions of the code rather than
narration of past changes.
127 suites / 1015 tests pass.
Records the fallback list as an OPTION rather than an expectation, with the
caveat that matters here: a fallback only helps if it can fail independently.
A second daemon in the same office shares the outage that takes the first one
down. A node reachable over a separate path — a home node across the mesh, or a
public/community node — is what actually adds availability.
Also records the split the operator identified: free/credits instances only need
the daemon for block height, so a remote node is a reasonable fallback there.
Instances taking payments should prefer daemons they control, because block
height feeds match fairness and entropy. Either way each endpoint still has to
pass the chain-identity check, so a remote node cannot serve another chain.
Closes the two findings left open from the pre-launch review.
Node redundancy (it was node reachability, not chain health)
RPC_ENDPOINTS accepts any number of daemons in preference order; PRIMARY /
FALLBACK still work and are appended. The list is deduplicated, which exposes
that the stock config pointed both at the SAME host — what looked like
redundancy was one node.
One logical call now walks every endpoint before failing, instead of needing
three consecutive failures to try exactly one alternate. Each node still has
to pass the chain-identity check before it may answer, so failover cannot
silently serve another chain's data. `failoverActive` is no longer a one-way
latch: the preferred node is re-tested every RPC_PREFERRED_RETRY_MS, so
recovery no longer requires a restart. healthCheck probes every node.
Graceful failure
Entries are refused while no node is reachable. A run is measured in blocks
and its entry block comes from the last successful poll, so a game admitted
during an outage was anchored to an already-past block and killed as a timeout
on the first recovered poll — the player lost a run, and in paid mode an
entry, to our infrastructure. The gate sits in _runAdmission, ahead of any
credit spend, and says so to the player.
Wallet: refused, not failed over
Two wallet-rpc processes over one wallet file can build transactions from the
same outputs and corrupt the cache. A standby wallet is a custody decision for
the operator, not something this code may take on its own — daemons are
read-only and interchangeable, wallets are neither. So a wallet outage
declines paid intake cleanly and leaves credits and free play working.
Auth limiter evicts instead of refusing
The bounded key map 429'd any NEW ip once full, turning a memory cap into a
DoS primitive: a distributed source could hold it at capacity and lock every
first-time caller out of Smirk login. It now reclaims expired entries and, if
still full, evicts the oldest live windows. Same memory ceiling, still a
working limiter.
129 suites / 1026 tests pass.
Adversarial multi-agent review of the launch candidate produced 22 confirmed
findings (12 more were refuted). This closes the critical, high, and the
mediums/lows that are cheap and real, then does the iso/3D/Tavern art pass.
CRITICAL — unauthenticated remote kill switch
Socket.IO does not wrap listener invocation, and this process treats
uncaughtException/unhandledRejection as fatal, so ONE unguarded throw in ANY
listener exits the server. `socket.emit('debug_ping')` with no argument did
exactly that, and systemd restarts straight back into it. Every registration
in handleConnection now goes through a safe-dispatch wrapper that contains
sync throws and rejected promises to the offending socket; handleDebugPing
also stops trusting its payload.
HIGH
- NIP-98 login now binds the signed event to this deployment's host. The path
check alone let an event signed for any other origin authenticate here, and
linking ADOPTS the account owning that pubkey — full account takeover.
- Fog of war is enforced server-side. getState() shipped absolute
entrance/exit/treasure coordinates and the monster's exact position in every
frame, with concealment implemented only in the browser. Discovery is sticky;
the monster is reported only while in view.
- NODE_ENV must now be explicit and recognized. Unset, every production gate
read false while DebugManager reported production and silenced logging.
- Tavern chat applies the lobby's ban list, rate limiter and user_id
attribution before entering global chat.
- userRegistry is deleted by socket.id (it was keyed by socket.id and deleted
by socket.client.id, so nothing was ever freed).
MEDIUM / LOW
- Payouts: a legitimately split transfer_split kept its transaction hashes
instead of quarantining already-broadcast funds with tx_hash NULL, and
provably pre-broadcast failures return to 'pending' rather than needs_review.
- RateLimiter key parsing fixed — cleanup() freed nothing and expired windows
never reset, because ids contain colons.
- Enter no longer submits a paid entry from behind a modal.
- Lobby chat no longer double-escapes server-escaped text.
- Rate limits for identity:get / address:prompt / early_entry.
- Spectators released when a game ends by disconnect, not just settlement.
- movementManager / addressManager per-socket maps cleaned on disconnect.
Renderers
Iso: opaque shading instead of translucent fog, additive torch/lantern/beacon
light pools, crevice AO, embers, cold memory wash, and it stops reallocating
the whole canvas every animation frame.
3D: instanced level geometry (3 draw calls), procedural stone/flagstone
materials, torch lights + shadows, real meshes for stairs/chest/monster
(they were humanoid capsules), dust motes, wall cutaway, and lighting
rebalanced now that fog is measured from the camera.
Tavern
Block height and hash fragments drift around the stage edge and ripple when a
block lands, fed by a cosmetic chain tip added to the blockheight broadcast.
Speech bubbles work again (they keyed off a socketId the server stopped
sending).
126 suites / 1005 tests pass.
Even with the anon_token status query, Smirk one-click stayed disabled after a reload: the server
ROTATES the session token on every resume (sessionManager), so the initial SmirkAuth.checkStatus()
raced the rotation and 403d with the now-stale token, leaving _isLinked=false. Re-run checkStatus
right after the fresh token is persisted (session_token / session_resumed) via _refreshSmirkLinked,
so _isLinked reflects the current token before the user buys — restoring the Smirk payment popup.
1) Double invoice: the "Buy Selected Package" button carries BOTH id=buy-credits-btn AND
class=mode-option, so a click fired the generic .mode-option handler (no data attrs -> defaulted
to single_game -> a spurious 1-credit invoice) AND its own buy-credits handler (the real pack).
Guard the generic handler to ignore #buy-credits-btn and intentless clicks.
2) Smirk one-click payment never opened: /api/auth/smirk/status 403d, leaving _isLinked=false so
onPaymentCreated skipped the Smirk path. The BOLA-hardened query matched socket_id AND anon_token,
but socket_id is VOLATILE (changes every refresh) so it returned 0 rows after a reload. Match on
the anon_token alone — the actual ownership secret — same protection, no refresh fragility.
Marking only the adjacent walkable cells was not enough — a dark wall-gap/void still read as a
hole you could walk into. Now every visible floor cell gets a soft cyan pip, so the WALKABLE
ground is explicit everywhere; a dark gap with no pip is unambiguously not floor. Keeps the
stronger pulsing outline on the immediately-adjacent walkable cells.
The Kenney iso wall tiles are single-cell segments that leave triangular gaps between slabs, which
read as doorways but are solid wall. Rather than chase perfect wall continuity, flag the cells the
player can actually step to: a soft pulsing cyan diamond outline on each orthogonally-adjacent
walkable+explored floor cell. A reliable "you can go here" cue regardless of wall rendering.
Iso revealed the WHOLE map from move 0: unexplored (dark) cells fell back to the floor tile
(_tileUrl(dark) -> tiles.floor) and rendered as floor. Now skip dark cells entirely (unexplored =
void), and dim explored tiles by the lightGrid brightness (globalAlpha, floor to 0.16) so the
remembered area fades to black with distance — parity with the 2D modes and 3D (which already
skips dark + uses THREE distance fog).
Zoom: the wheel handler based its step on a hardcoded 1.7, but iso defaults to 1.0 — so the first
scroll (either direction) jumped up to ~1.7 and read as "always zoom in". Base the step on the
CURRENT effective zoom via SP._defaultZoom() instead. Same mode-aware default now used by the camera.
Iso occlusion: tall walls (184px) hide the floor/openings behind them (inherent to iso painter
order). Add a cutaway — walls between the camera and the player (higher x+y, within ~3 cells) draw
at 0.28 alpha so you can see yourself and the openings right in front of you.
Two iso bugs from reusing the tavern renderer for the SP dungeon:
- Character always faced down/SW: sceneFromGameState hardcoded facing:"down", so the renderers
ignored their movement-inferred facing (truthy default won). Now facing defaults to null (SP
server sends none) so iso/3D infer it from movement; facingDelta(null)=down keeps tiled fine.
- "Copy of himself at the origin": the iso renderer drew EVERY entity via _charFrame, so the
entrance feature rendered as a male character at the start. Features/items now draw as pack tiles
(stairs/chest) or a glyph; monsters get a red tint so they do not read as a second player.
- Iso & 3D character faced the wrong way: the SP game never sends player.facing (only the tavern
does) so it defaulted to down/SW. Both renderers now INFER facing from the movement delta they
already track (explicit e.facing still wins for the tavern).
- 3D could break the game: wrap ThreeRenderer construction (createRenderer) and the _animate RAF
body in try/catch — a 3D failure now falls back to Tiled / stops the loop instead of throwing.
- ASCII walls/floors were near-invisible (legend colours are near-black, tuned for tile fog): use
brighter glyph colours for wall/floor in ASCII (features keep their own colours).
Root cause of iso rendering fully black: `.rotdis canvas { max-height:100%; object-fit:contain }`
(styling meant for the legacy ROT canvas) also applied to the render-kit canvas. SP only overrode
max-width. A canvas TALLER than the host (iso: ~2445px vs ~900px host) got object-fit-shrunk to
~0.37x while the CAMERA translate is computed in buffer space — so the player landed far off-screen
(black). Tiled/ascii canvases usually fit the host, so they escaped it. Fix: override max-height:none
+ object-fit:fill so the buffer maps 1:1 and the camera transform alone controls scale/position.
Iso default zoom set to 1.0 (its 84px tiles are large); tiled/ascii keep 1.7.
Three mode-switch issues:
- Picking 3D gave "original": SP._ensureRenderer used the sync createRenderer, which falls back to
Tiled when THREE (lazy CDN load) is not ready. Now it kicks off RK.ensureThree and re-mounts as
real 3D once loaded (renders Tiled meanwhile so it is not blank).
- ASCII torches were inert glyphs: they now draw a warm flickering radial glow (actual light source)
with the glyph at full brightness, driven by a throttled ~22fps RAF (cancelled on destroy).
- Switching to iso could show black while the pack images load: tiles now draw a legend-coloured iso
diamond placeholder until the real image is ready, so the dungeon shape + camera always read.
3D built every tile including unexplored, revealing the whole map. Now: _buildTiles skips
unexplored (dark) cells so they never render (void), and the scene gets THREE distance Fog
(black, 14->32) which — since the camera follows the player — fades explored tiles to black away
from you. Background set to pure black to match. Entities are already fog-gated at the scene
level (features on seen, monster in-view). Net: unexplored hidden, explored fades with distance,
no map-edge leak — matching the 2D modes.
3D is a paid rung and should behave like the other modes. Rework the THREE camera to FOLLOW the
player instead of framing the whole level: canvas now sizes to the host (setSize updateStyle),
the ortho frustum is a fixed player-centered zoom (span 8) with host aspect, and _animate re-targets
the camera to the player world position every frame (keeps the iso (8,9,8) offset; glides smoothly
since the player mesh lerps). SP._applyCamera no longer CSS-transforms the 3D canvas (it fills the
host and THREE owns the camera). Handles host resize via _fitToHost.
The ASCII renderer never set focusPoint, so switching to it mid-game left the SP camera with no
focus → scale-only transform pinned the grid to the corner and the explored area sat off-screen
(black). AsciiRenderer.render now sets focusPoint on the player cell (sticky), and the camera
fallback covers name==="ascii" too (cell-based, same as tiled). Iso already reports focusPoint.
3D drives its own THREE camera + sizes its canvas to the level, so _applyCamera now scale-to-FITS
the 3D canvas into the host (centered, no player-follow) instead of applying a broken zoom.
The SP camera still intermittently pinned the whole level to the top-left at game start: the
per-frame _applyCamera read renderer.focusPoint as null (a start-of-game race, or a tick reading
a just-(re)created renderer instance before its first render) and fell back to a scale-only
transform. Add a fallback: when focusPoint is absent, derive it from SP._lastState.player (tiled
coords, cell=24) so the camera always has a target and centers the player. Also read host dims
via clientW/H||offsetW/H for resilience.
Explored-but-not-visible tiles rendered at a flat 0.25 brightness — a hard-edged grey block
that outlined the explored map (and its edge). Now explored memory dims AND fades toward black
with distance from the player, so the remembered area melts into the dark with no revealing
edge. Also set the render host background to pure #000 so the area beyond the map edge is the
SAME black as an unexplored in-bounds tile (previously #0a0c0f vs #000 — a shade seam that
traced the boundary). Currently-visible lighting unchanged.
Red pulse: _fxOnPlayerMoved fired a full-screen red FX.flash whenever a monster was within 3
tiles (throttled 550ms) — the monster usually IS within 3 tiles, so it pulsed on nearly every
step. Removed it; the monster is already on-screen, so proximity needs no flash. FX.flash is now
reserved for genuine one-shots (win/lose).
Descend feedback: taking the stairs only logged a tiny chat line. Add showEventBanner() — a big
centered pop-in/hold/fade banner over the game view (pointer-events:none, auto-removed) fired on
descend ("LEVEL n / N") and treasure ("TREASURE SECURED"), with a soft one-shot colored flash.
Chat lines kept as the log trail.
Camera: mount the render-kit host with inset:0 (fill #game-display) instead of
min(100%,78vh)+translate(-50%) centering. #game-display is grid-bounded (container is
100vh/overflow-hidden), so filling it gives the camera reliable clientWidth/Height every
frame — fixes the intermittent "player stranded in a top band, black below" off-centering.
Torches (in-game): drop the pack torch SPRITE composite — several sheets place it off-center/
rotated, reading as misaligned. Keep wall base + procedural RK.fx flame: a clean wall-mounted
torch that looks right in every pack.
Wait animations: shrink the juice bursts (18-24 -> 6-7 particles, spread 1.8-2.4 -> 0.6-0.7)
and remove the red death/caught bursts, so a grab/escape reads as a tight glint on the hero
instead of an explosion spraying onto the wall torches.
Text: the block-QUEUE wait runs drawPaymentAnimation (printed "Awaiting payment") and the
payment wait runs the epic scene (printed "Awaiting next block") — the labels were backwards.
Both now derive the label from Game._awaitingPayment so it always matches the real state.
Juice: add a tile-agnostic particle-burst helper (window.FX.sparkle) and fire one-shot bursts
on the dramatic beats — gold on treasure grab, green on escape, red on death/caught — in BOTH
animations. Particle-based, so it is identical and safe in every pack; no-op if FX is absent.
Note: the ROT waiting display is independent of the render-kit pack (always the classic tileset),
so these animations work in all packs but do not visually swap to match a non-original pack.
Torches replace WALL cells adjacent to floor (dungeon.js), but the Tiled renderer based the
torch on a floor tile and drew only a procedural flame — so they read as flames floating on
the floor. Base the dungeon torch on `wall` and draw the pack torch sprite over it, then RK.fx
animates the flame/glow on top: a proper wall-mounted sconce. Fire fixtures now composite
base + sprite + flame (hazards keep base + pulse, no sprite).
The render-kit "waiting room" replaced the beloved scripted drama (player races for a
pulsating treasure, grabs it, escapes or is devoured by a monster pack, death shockwave +
ESCAPED! celebration, randomized variants) with a static lit room — a big downgrade. Restore
BOTH ROT waiting animations (block-wait AND awaiting-payment, selected via Game._awaitingPayment)
by hiding the render-kit host and letting the ROT display own the waiting screen. Remove the
now-unused SP.showWaiting/hideWaiting/waitingScene bridge code. The pack/mode still applies in
actual gameplay, which is what matters.
The consolidated entry modal Free Play + Next block path emitted a bare join_queue with no free
intent, so handleGameQueue ran full payment eligibility and (on a mixed paid+free instance) fired
show_payment_options — the old "Choose How to Play" modal appeared on top of an already-queued free
game. Thread the free flag end-to-end, mirroring auto_start{free}: join_queue{free} -> handleJoinQueue
-> handleGameQueue (skips _checkPaymentEligibility when free+freePlayEnabled, tags the queued entry
free) -> queueManager.addPlayer stores free -> startGamesForWaiting/startGameImmediately pass
{ forceFree } into processGameStart, so the block-landing start takes no credit/payment and lands on
the Pleb board. Ranked queued path (plain join_queue) unchanged. Suite 62/435 green.
The "Free game — dropping in…" (begin) and "Starting game…" (onGameStart) console lines were
permanent log entries, so a running game sat next to text reading as if it were perpetually
starting. Tag both as transient: entry-progress is removed when onGameStart fires (kept during
the real block-wait for the queued variant); the game-start "Starting game…" line is removed once
Game.startGame succeeds. The server status_update "Game started! Escape before the next block!"
remains the standing confirmation.
The next-block wait now draws a small lit "mining room" Scene through the ACTIVE renderer
(RK.SPGame.showWaiting) — floor/walls/torches in your chosen pack (Tiled/Iso/3D), camera
centered, torches flickering via the FX loop — with the "Mining the next block" text as an
overlay. So the wait inherits your tiles/mode instead of being the plain ROT animation.
Falls back to the ROT WaitingScreenAnimator if the kit is unavailable. SP.render clears the
overlay when the real game starts.
Roguelike layout on desktop: sidebar left, play area filling the top, and the message log
(row 3, 132px) + command input (row 4) span full-width BELOW the game. The chat panel flips
from a left-column (border-right) to a bottom bar (border-top); the sidebar now scrolls if
its controls are tall. Mobile (<=820px) keeps its existing single-column stack untouched.
Per the menu redesign: PLAY on top, then Loadout (Character + Style/render-picker), Explore
(Watch + Tavern), Progress & account (Shop + Anim + the hud-chip toolbar). Pure reorder +
group headers — every id/handler preserved, no grid change. Bottom-console (#3) is next.
- Modal: "Safe — full block window" overstated it (blocks arrive randomly, Poisson). Now
"Start fresh · blocks land at random" / "Jump in · race the time left".
- Camera: was snapping to the player every frame (jerky on canvas resize / level teleport).
Now glides (lerp 0.3) and only snaps on a big jump; snap-centers on new-game start.
Replaces the timing-only modal (which then triggered the server payment/options modal) with
a single dialog: a timing toggle (Next block / Right now) + stakes cards (Free / Ranked +
Buy credits). Each card emits the FINAL intent so the server never re-prompts:
- Free -> auto_start {free:true} / join_queue (free:true skips the options modal)
- Ranked + credits -> auto_start / join_queue (uses a credit)
- Ranked no-credits / Buy -> PaymentUI.show() (the real payment, not a redundant choose)
Nothing starts until a card is clicked, so the game never renders behind the modal.
The player-centered camera snapped the dungeon to the top-left corner after a while: the
renderer nulled focusPoint on a transient player-less frame, so the transform lost its
translate. Fix: focusPoint is now sticky (keep the last if the player is momentarily
absent), and the SP bridge re-applies the camera every frame via its own RAF loop, so a
canvas resize or a stale frame can no longer break centering.
jwinterm