What the build added to the plan: gate 1 also needs public to name the
build staging names; gate 2 also needs the field list to match; gate 3
proves the update from the rig's appmanifest before rnpc.status; gates are
kept per wipe, public manifest and edge commit, with a 3-hour cool-down for
a failed Carbon or live attempt; the merge is a merge commit pinned with
head_commit_id; Closes since the last cutover's merge-base, leaving out PRs
main already has; dispatches dry unless dry_run is exactly false, and
code_ref for dry runs; rust-carbon started again if left stopped; 240
minutes. Then CI run 54's dry run: every gate refused for the right reason
on the 22 October public build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
On a forced-wipe weekend a workflow in runicnpc-rust merges edge into main
on its own once five gates pass: Rust's public build changed on wipe day,
Oxide's public release caught up, a Carbon boot on public Rust says
missing=- added=-, the drill's live half passes on public Rust with edge's
code, and PR checks pass. Hourly from Thursday 17:00 UTC to Sunday 23:00
UTC, then left to the org lead. The issues it closes come from the
`Closes #N` lines of the PRs merged into edge since the last release; it
merges with RUNICNPC_TOKEN, locked to the repo. RunicNPC only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
s5.kit.heal was Rust's November 2026 build: a player-only item (the syringe)
has a held entity only in the belt (ItemModEntity.playerOnlyEntityBeltOnly),
so RunicNPC's heal found nothing. D331 records the fix the org lead chose:
every kit extra is found by its item definition when it has no held entity.
s5.fight.shootBack was the harness: a cliff rock between the fifth fight's
pair on the drill's 3500 map. s5.fight.leash (run 49, left out of the 9c note)
did not come back in three tries; the likeliest way in and the harness's new
note are recorded, and the rule stays until a failing run says which.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Staging 26341433: three new swap fields (55 -> 58, main at the forced
wipe of 2026-11-05), the harness that stopped silently after place
failed (0.7.4), the drill's rig booting from fresh Kits and RunicNPC
data, its 5-minute stall limit and latest.log tail, and the two checks
(shootBack, kit.heal) still to explain. Stale example kits on a real
server: runicnpc-rust#21.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
USER_SAFETY.md §4.1 records the website fix: a forum post is not pushed,
put in the inbox or emailed to a member who blocks its author or the
thread's starter, and the digest applies each recipient's forum filter.
It also says why the Team activity feed needs nothing: forum posts never
appear in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Android-app#65 cut edge over to main as v0.7.0. Records how Play's
app-signing key became the release keystore's (PEPK run in CI from the
org secret; the local keystore was a different key), what is saved in
the Play Console, and why the release run's Play step stopped (the Play
Developer API is not enabled in the Cloud project).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The org lead's "none of those" on step 5's W1-W4 was about the demo's
data (no seeding), not about holding the features back. Record that,
the Module-Rust cutover (#73, v0.7.0) that brings them to the demo,
and the app cutover (Android-app#65) as step 6.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Report, hide and block walked on the web and in the app, Hide for everyone
from the queue, and S14, against website main + Module-Rust edge with
DEMO_MODE on and the demo's own seed. API 30/30, web and app rows all pass.
Walked locally, not on the demo, by the org lead's choice.
Records four findings about the demo itself, unchanged: chat is staff-only
there (W1), the rig has no chat to report (W2), play-review is an admin
(W3), and the demo runs Module-Rust v0.6.3, without this feature (W4).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
§4.3 rewritten to match what was built: the long-press sheet and what it
offers, the refusals, the re-read after a change, the Hidden by staff marker,
and Account -> Blocked. §7 step 4 recorded as built and walked on the
emulator, with the two things the walk found. android/PLAN.md M8 step 4
points at it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Rewrites §4.2 to match what was built: server/safety.js, the in-query feed
filter, rust_events.hidden_at / hidden_by, the staff hide and unhide routes
on the line's own menu, and what happens when core's safety reads fail.
Records §7 step 3 as built and walked (28 API rows and a browser pass).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
USER_SAFETY.md: S11-S14 (asked while building the core), §3 corrected
(the chat feed is already read per viewer), §4 rewritten to match what
was built, §7 step 2 recorded as built and walked.
MODULE_API.md: 1.21.0 (registerReportTargets, registerGameIdentities,
ctx.safety). BACKEND_DESIGN.md: user_blocks / user_hidden_items, the
content_reports snapshot and actioned_with, the new routes, the folder
map. TEAMS.md §5.6 amended. README row updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md step 6: W1 (Module-Rust#71), W2 (Module-uo#48) and W3
(Rust-Plugins#47) move from "not fixed" to fixed. modules/rust/PLAN.md 29.8:
Carbon 2.0.262 no longer answers "user not found" for a never-seen Steam id;
it writes the grant or membership into one shared blank record held by every
never-seen id. The bridge now checks for a record first on Carbon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Every row of ACCOUNT_DELETION.md §6 step 6 walked on 2026-10-30 against
website 7bd93b8 with Module-Rust edge on the Carbon rig and Module-uo main
with the local ServUO and a uo-link sidecar: web and app deletions, the other
device's session, the Rust grant leaving the rig, the UO link cleared with and
without the sidecar, the forum's two views, the reserved staff name, the demo
and the last admin. Three findings left unfixed (W1-W3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md §6 step 4 gains what was built beyond §4.3 (refusals
read off the body, the trust token dropped, the snackbar notice, the push
opt-in kept) and what was checked on the emulator. android/PLAN.md M8 step 3
notes the app's part is built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md: status line, and §6 step 3 marked built with what went beyond
§4.4 (Module-uo queues before calling, also retries on a live server.hello, clears
pending rows on a webId-less login, lists them via GET /admin/uo-link/config).
modules/uo/SCHEMA.md: the new shard_pending_unlinks table, and the table count
corrected (it was already stale: 33 tables, 32 shard_* plus uo_link_config).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md §6 step 2 is built (website feature/account-deletion).
- MODULE_API.md: 1.20.0, api.onUserDeleting (§1.1, §1.1 history, §2.4).
- BACKEND_DESIGN.md: reserved_usernames, DELETE /auth/me/account, the admin
delete now running the same procedure, the demo lock row, and §6.6 on the
procedure, the display rule and what goes and what stays.
- TEAMS.md: the forum's deleted-author rule is now "[deleted player]" for
members and the stored name, marked, for staff.
- ACCOUNT_DELETION.md: AD12 (wrong password or code is 400, not 401) and
AD13 (a deleted account drops off Forum guests), both asked of the org
lead while building; §4.1 refusals carry codes; step 2 marked built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
A cascade is not an unlink. For UO the link lives on the shard (the
site's shard_account_links is a mirror), so dropping the mirror alone
would leave the shard attributing the game account to a deleted user.
- AD10: the hook is onUserDeleting and runs before the delete; each
module calls its own unlink for every link (Rust: links.unlinkOwned;
UO: the sidecar's DELETE /link/{account}, as the staff unlink does).
- AD11: an unlink that can't finish never holds up the deletion. A shard
that is offline queues into shard_pending_unlinks, retried on
reconnect. A protected staff account (403) is listed for admins as
"still linked on the shard".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The org lead answered the plan's six questions on 2026-10-29:
- delete at once, no grace period
- what a member wrote stays, and members see every snapshot of a
deleted account as "[deleted player]"
- staff keep the name and the IP for moderation, so the stored rows are
untouched and the rule is about who sees what (displayAuthor)
- the password is always the proof; SSO sits on top of a real account
- a UO game account stays on the shard; no protocol change
- a deleted staff username is never available again (reserved_usernames)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md is the plan of record for the org lead's decision:
a member deletes their own account on the website and in the app, as
Google Play requires of an app that starts accounts.
- One deletion service for the admin route and the member's own route,
with a confirm step, the last-admin and demo refusals, clearing the
username snapshots on what the member wrote, and a notice by email.
- MODULE_API 1.20.0: api.onUserDeleted, which runs after the commit and
can't stop a deletion.
- Screens on the web and in the app; runicgateway.com /delete-account/
as the address Play is given.
- What the schema already does (59 keys: credentials cascade, content
detaches), the gaps, six questions, and the build order.
M8's order puts account deletion before report, block and hide, which
moves USER_SAFETY.md's reportTargets to MODULE_API 1.21.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
runicgateway.com#44 declares everything the app sends as collected,
not shared, encrypted in transit and required, after an audit of
data/api/ on edge. Account deletion is left open for the org lead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
