PLAN.md §30 as approved, plus D119/D120 from the build.
Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
asks map.info; a new key or hash from the free Rust+ cache (or a render
kept on disk) is fetched in slices, checked against its SHA-256 and stored
in one statement. One fetch per server, a backoff on failure, `stale`
abandons a fetch that straddles a map change. Render now (D109) is
admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
fleet default plus per-server override (D114), the players layer capped by
presence (D113), own dot and online first-party clan mates for a linked
viewer (D115, D117, D118). A layer the viewer may not see is absent from
the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
/map/live; admin /servers/:id/map/fetch and /render; the Map card on the
visibility PUT. Swagger fragment and frozen manifest regenerated.
Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
(labels only when a cell is wide enough to hold one), a legend that lists
hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.
Capability `map` declared for the Android app (phase 15).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Phase 2 of docs/modules/rust/PLAN.md. Phase 1 built five guards and ran them by
hand; this repo had no workflows at all, so nothing gated the branch that gets
released and there was no way to release it.
Three pieces:
- **release.yml** — the derived-version engine link, installer and Module-uo
already run (conventional-commit subjects since the newest tag; module.json's
version survives as a floor; workflow_dispatch as the backdoor), assembling the
bundle from an include list and publishing the tarball, the install manifest
carrying its sha256, and SHA256SUMS. The tag is the number that ships and CI
stamps it into the bundle's own module.json.
- **pr-checks.yml** — server tests, check:imports, check:bundle, check:swagger,
the client build, client tests and check:externals, plus frozen-manifest.
- **frozen-manifest** — clones core at the sha pinned in ci/core-ref.json,
generates its route table without this module and with it, and takes the
difference. It ran locally against that exact ref: six routes, all documented,
no core route moved. That is the first proof by a running core that /rust
collides with nothing — phase 1 could only check it by reading, because core
mounts /status and /version at a tier root where the loader's own collision
probe cannot see them.
The bundle carries no node_modules, because the shipped half declares no runtime
dependencies (org lead, phase 2). checkBundle.js holds both halves of that: the
include list still covers everything server/index.js reaches, and no dependency
has appeared without the release learning to pack it. Verified by breaking it —
dropping "model" from the list names the exact edit and exits 1.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4
