§4.3 rewritten to match what was built: the long-press sheet and what it
offers, the refusals, the re-read after a change, the Hidden by staff marker,
and Account -> Blocked. §7 step 4 recorded as built and walked on the
emulator, with the two things the walk found. android/PLAN.md M8 step 4
points at it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Rewrites §4.2 to match what was built: server/safety.js, the in-query feed
filter, rust_events.hidden_at / hidden_by, the staff hide and unhide routes
on the line's own menu, and what happens when core's safety reads fail.
Records §7 step 3 as built and walked (28 API rows and a browser pass).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
USER_SAFETY.md: S11-S14 (asked while building the core), §3 corrected
(the chat feed is already read per viewer), §4 rewritten to match what
was built, §7 step 2 recorded as built and walked.
MODULE_API.md: 1.21.0 (registerReportTargets, registerGameIdentities,
ctx.safety). BACKEND_DESIGN.md: user_blocks / user_hidden_items, the
content_reports snapshot and actioned_with, the new routes, the folder
map. TEAMS.md §5.6 amended. README row updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md step 6: W1 (Module-Rust#71), W2 (Module-uo#48) and W3
(Rust-Plugins#47) move from "not fixed" to fixed. modules/rust/PLAN.md 29.8:
Carbon 2.0.262 no longer answers "user not found" for a never-seen Steam id;
it writes the grant or membership into one shared blank record held by every
never-seen id. The bridge now checks for a record first on Carbon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Every row of ACCOUNT_DELETION.md §6 step 6 walked on 2026-10-30 against
website 7bd93b8 with Module-Rust edge on the Carbon rig and Module-uo main
with the local ServUO and a uo-link sidecar: web and app deletions, the other
device's session, the Rust grant leaving the rig, the UO link cleared with and
without the sidecar, the forum's two views, the reserved staff name, the demo
and the last admin. Three findings left unfixed (W1-W3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md §6 step 4 gains what was built beyond §4.3 (refusals
read off the body, the trust token dropped, the snackbar notice, the push
opt-in kept) and what was checked on the emulator. android/PLAN.md M8 step 3
notes the app's part is built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md: status line, and §6 step 3 marked built with what went beyond
§4.4 (Module-uo queues before calling, also retries on a live server.hello, clears
pending rows on a webId-less login, lists them via GET /admin/uo-link/config).
modules/uo/SCHEMA.md: the new shard_pending_unlinks table, and the table count
corrected (it was already stale: 33 tables, 32 shard_* plus uo_link_config).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md §6 step 2 is built (website feature/account-deletion).
- MODULE_API.md: 1.20.0, api.onUserDeleting (§1.1, §1.1 history, §2.4).
- BACKEND_DESIGN.md: reserved_usernames, DELETE /auth/me/account, the admin
delete now running the same procedure, the demo lock row, and §6.6 on the
procedure, the display rule and what goes and what stays.
- TEAMS.md: the forum's deleted-author rule is now "[deleted player]" for
members and the stored name, marked, for staff.
- ACCOUNT_DELETION.md: AD12 (wrong password or code is 400, not 401) and
AD13 (a deleted account drops off Forum guests), both asked of the org
lead while building; §4.1 refusals carry codes; step 2 marked built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
A cascade is not an unlink. For UO the link lives on the shard (the
site's shard_account_links is a mirror), so dropping the mirror alone
would leave the shard attributing the game account to a deleted user.
- AD10: the hook is onUserDeleting and runs before the delete; each
module calls its own unlink for every link (Rust: links.unlinkOwned;
UO: the sidecar's DELETE /link/{account}, as the staff unlink does).
- AD11: an unlink that can't finish never holds up the deletion. A shard
that is offline queues into shard_pending_unlinks, retried on
reconnect. A protected staff account (403) is listed for admins as
"still linked on the shard".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The org lead answered the plan's six questions on 2026-10-29:
- delete at once, no grace period
- what a member wrote stays, and members see every snapshot of a
deleted account as "[deleted player]"
- staff keep the name and the IP for moderation, so the stored rows are
untouched and the rule is about who sees what (displayAuthor)
- the password is always the proof; SSO sits on top of a real account
- a UO game account stays on the shard; no protocol change
- a deleted staff username is never available again (reserved_usernames)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
ACCOUNT_DELETION.md is the plan of record for the org lead's decision:
a member deletes their own account on the website and in the app, as
Google Play requires of an app that starts accounts.
- One deletion service for the admin route and the member's own route,
with a confirm step, the last-admin and demo refusals, clearing the
username snapshots on what the member wrote, and a notice by email.
- MODULE_API 1.20.0: api.onUserDeleted, which runs after the commit and
can't stop a deletion.
- Screens on the web and in the app; runicgateway.com /delete-account/
as the address Play is given.
- What the schema already does (59 keys: credentials cascade, content
detaches), the gaps, six questions, and the build order.
M8's order puts account deletion before report, block and hide, which
moves USER_SAFETY.md's reportTargets to MODULE_API 1.21.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
runicgateway.com#44 declares everything the app sends as collected,
not shared, encrypted in transit and required, after an audit of
data/api/ on edge. Account deletion is left open for the org lead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
- USER_SAFETY.md: section 5 becomes decisions S6-S10 (an account to report,
game-identity blocks allowed, staff cannot be blocked, a block only hides,
staff see hidden chat marked).
- DEMO_MODE.md: DM33-DM35 (visibly fake 1234567890-prefixed Steam and
Discord ids plus the org lead's own Steam id; Rust-themed invented names).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
- website/USER_SAFETY.md (new): report, block and hide on the website and
in the app, S1-S5 decided by the org lead, five questions open.
- android/PLAN.md: M8's three open items decided (keep the rating and add
report/block/hide; conservative data safety; UnifiedPush on specialUse
with restart on boot), the order to the cutover, and M21 (Teams and the
team forum in the app, planned, not scheduled).
- website/DEMO_MODE.md: DM32 and section 11, the demo content plan (two
seed passes; moderation, Teams/forum/reports, event history, Rust stats).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The 12:00 UTC wipe on 2026-10-28 installed Module-Rust v0.6.3 (its first run
tagged v0.6.2 and failed to publish it). play-review walked 19/19, the seeded
events' actions came up enabled and Server greeting ran, and both Steam
unlinks answer 403 DEMO_LOCKED with the link kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DM27 locks removing a Steam link on the demo (player route by demoLocks,
staff route in its handler); DM28 has seed:demo switch on the actions the
seeded events use; DM29 leaves SECRET_WORDS as is. The Chrome problem was
local to the walker's PC, and play-review is walked once the fixes land.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Every lock through the API (87 checks), the console deny list at save on the
demo and at run on a local core, the three published logins in the browser,
the app on the public HTTPS address, and one wipe cycle restoring a changed
config, permission, NPC placement, event and hero draft. Lists what the walk
found: seeded events whose actions start disabled, the credential check
over-flagging, play-review not walked, the open Steam unlink, empty
moderation queues.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The first restored wipes brought the default set's permissions back but
not its NPC profiles (the restored rig is marked managed, so a fresh site
adopts none and its first push empties them) or its chat titles (never
adopted). §7.1 records the exception, §7.3 the fixture's new npcs and chat
keys, step 5 of §7.3 the NPC push, §9.1 DM26, and §10 step 5 the default
set, the baseline, the restored wipes and the public URL (Cloudflare set to
DNS only so the app logs the real visitor).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md §3.3 gets the data: URI rule (a pasted image is an upload),
§9.1 records DM25, and §10 step 5 records the first wipes: the rig half
worked, and the seed loaded no module because the runner's chown of
modules/ and logs/ failed silently. BACKEND_DESIGN.md §5.1 mirrors the rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md follows website#227:
- §7.2: the baseline is captured with a power stop (quit saves), DM22; a
first wipe with no baseline only starts the rig; what the panel calls
were checked to do (synchronous decompress, binary-safe write); the
server identifier is now 6eb9d621.
- §7.3: MODULES comes from state/modules.env; MODULE_SOURCE_HOSTS seeds a
fresh database's allowlist; the exact seed:demo command.
- §7.5: where the bundle is recorded (state/bundle.json and the rig's own
rust-link/bundle.json) and which plugin files the wipe writes.
- §8: the deploy directory and the full .env contents.
- §9.1: DM22 (power stop), DM23 (/opt/demo.runicgateway.com, host mode),
DM24 (Module-Rust cut over now, v0.6.0).
- §10: step 5's files built and how each half was tested.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md: hero_layout joins the "Settings that reach a lock" row, a
paragraph under "Settings stay open" says what the hero editor does on the
demo, DM21 records the decision, and the step-5 walk checks it.
BACKEND_DESIGN.md: the protected-keys list in the demo section.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
- DM19: the app shows a refusal as one snackbar with the server's sentence;
lines that blame the role say the demo sentence; ErrorKind.DEMO_LOCKED for
load screens. §3.1 rewritten to match.
- DM20: the app shows the banner only; its strip names the site's sign-in page
for the passwords (§6).
- §10 step 4 built as Android-app#61.
- android/PLAN.md §7: the demo's refusal and strip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
DEMO_MODE.md §10 step 3 is Integration-kit#17. The kit pins the sha
website#224 merged as. Chapter 2 gains a section on a public demo site,
covering demoLocks, ctx.demoMode and onDemoSeed. Chapter 5 covers
demoRefuses. Module-Rust's pin moves to the same sha in Module-Rust#63.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
