DM27 locks removing a Steam link on the demo (player route by demoLocks,
staff route in its handler); DM28 has seed:demo switch on the actions the
seeded events use; DM29 leaves SECRET_WORDS as is. The Chrome problem was
local to the walker's PC, and play-review is walked once the fixes land.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Every lock through the API (87 checks), the console deny list at save on the
demo and at run on a local core, the three published logins in the browser,
the app on the public HTTPS address, and one wipe cycle restoring a changed
config, permission, NPC placement, event and hero draft. Lists what the walk
found: seeded events whose actions start disabled, the credential check
over-flagging, play-review not walked, the open Steam unlink, empty
moderation queues.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The first restored wipes brought the default set's permissions back but
not its NPC profiles (the restored rig is marked managed, so a fresh site
adopts none and its first push empties them) or its chat titles (never
adopted). §7.1 records the exception, §7.3 the fixture's new npcs and chat
keys, step 5 of §7.3 the NPC push, §9.1 DM26, and §10 step 5 the default
set, the baseline, the restored wipes and the public URL (Cloudflare set to
DNS only so the app logs the real visitor).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md §3.3 gets the data: URI rule (a pasted image is an upload),
§9.1 records DM25, and §10 step 5 records the first wipes: the rig half
worked, and the seed loaded no module because the runner's chown of
modules/ and logs/ failed silently. BACKEND_DESIGN.md §5.1 mirrors the rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md follows website#227:
- §7.2: the baseline is captured with a power stop (quit saves), DM22; a
first wipe with no baseline only starts the rig; what the panel calls
were checked to do (synchronous decompress, binary-safe write); the
server identifier is now 6eb9d621.
- §7.3: MODULES comes from state/modules.env; MODULE_SOURCE_HOSTS seeds a
fresh database's allowlist; the exact seed:demo command.
- §7.5: where the bundle is recorded (state/bundle.json and the rig's own
rust-link/bundle.json) and which plugin files the wipe writes.
- §8: the deploy directory and the full .env contents.
- §9.1: DM22 (power stop), DM23 (/opt/demo.runicgateway.com, host mode),
DM24 (Module-Rust cut over now, v0.6.0).
- §10: step 5's files built and how each half was tested.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md: hero_layout joins the "Settings that reach a lock" row, a
paragraph under "Settings stay open" says what the hero editor does on the
demo, DM21 records the decision, and the step-5 walk checks it.
BACKEND_DESIGN.md: the protected-keys list in the demo section.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
- DM19: the app shows a refusal as one snackbar with the server's sentence;
lines that blame the role say the demo sentence; ErrorKind.DEMO_LOCKED for
load screens. §3.1 rewritten to match.
- DM20: the app shows the banner only; its strip names the site's sign-in page
for the passwords (§6).
- §10 step 4 built as Android-app#61.
- android/PLAN.md §7: the demo's refusal and strip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md §10 step 3 is Integration-kit#17. The kit pins the sha
website#224 merged as. Chapter 2 gains a section on a public demo site,
covering demoLocks, ctx.demoMode and onDemoSeed. Chapter 5 covers
demoRefuses. Module-Rust's pin moves to the same sha in Module-Rust#63.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DM18 (org lead, 2026-10-24): core's event save never asked a module
about a step's params, so the console-command deny list's save-time
refusal is a new core hook, demoRefuses(params), asked at create, save
and publish on the demo. MODULE_API 1.19.0.
- DEMO_MODE.md: §3.4 says where the save-time check lives; DM18 row;
step 2 marked built (website#224, Module-Rust#62) with the module's
bridge recognition and fail-closed rules; the Rust fixture section.
- MODULE_API.md: 1.19.0 in §1.1, the changelog, the registerEventActions
signature and the action rules.
- BACKEND_DESIGN.md §5.1: event steps on the demo.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
- DEMO_MODE.md: DM15 (onDemoSeed), DM16 (POST /auth/register locked), DM17
(sessions route locked outright on a demo account). It also covers the settings
keys that reach a Tier A lock, how demo accounts are recognised, failing
closed, the published logins, the toast, the seed's fixture shape and $env,
and the fact that there is no seeded team (Teams come from the rig's clans).
The §3.2 example drops the config-file POST that DM14 opened. Step 1 is
marked built.
- MODULE_API.md: 1.18.0. demoLocks in module.json, ctx.demoMode, and
api.onDemoSeed, which must upsert because it runs on every seed.
- BACKEND_DESIGN.md: §5.1 demo mode, and demo_state in the settings table.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Visitors may read and change every plugin config except the bridge's: the
editor's save reloads through the bridge (with rollback, D178/D179), not
the console, and the wipe restores oxide/config. The RunicGateway plugin's
files are refused for reading as well as writing and left out of the file
list, because they hold credentials for talking to the sidecar directly.
Because the editor masks secret fields only in the form today, the demo
also redacts flagged values server-side, makes them read-only, refuses
raw-JSON saves, and leaves the sidecar URL out of the Servers admin view.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DM11: console-command steps keep running on the demo except a deny list
(quit/restart, oxide.unload/reload, rcon.*, fps.limit, server.tickrate),
matched on the normalised first word (global. stripped, o. mapped to
oxide.) and enforced by the module at save and at run behind a new
ctx.demoMode.
DM12: "latest" follows the Rust bundle for the rig's plugins and sidecar,
the newest Module-Rust release on the same protocol (a new protocol field
in its install manifest, which core's installer ignores), and the website
main image. If nothing matches yet, the wipe keeps the previous set.
DM13: only settings stay open. The org lead created the Pterodactyl
subuser and added PTERODACTYL_CLIENT_KEY.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The org lead's answers of 2026-10-23: demoLocks in module.json, settings
open, the rig open but reset each cycle through Pterodactyl, content open
with uploads locked hard, the Oxide rig as the demo's, a stand-in Steam
link, every 2 hours, files in website/, latest versions, and every lock at
the server route level.
Adds the rig reset (§7.1-7.2): the site's first sync imports what is on
the rig (D198, D244), so the rig is restored from a baseline archive
before the site relinks, and that first import is the reset. Adds the
hard upload rule (any multipart body refused). Three follow-ups: F1
console-command steps, F2 "latest" across the bundle, F3 reading of DM2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The design for website#222, before any code: one DEMO_MODE flag on the
normal image that locks destructive writes with a 403 DEMO_LOCKED, four
published static logins, no outbound mail/push/Discord, a banner with the
next reset time, and a scheduled wipe on the demo-site runner (drop the
volumes, redeploy, seed accounts + the rig link + content).
Tier A locks are listed route by route. Nine questions for the org lead
(module lock declaration, the rig, visitor content, rig sharing with
walks, the stand-in Steam link, cadence, where the files live, version).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
