wtclaude 7b570c8ea1 feat(events): the minimal admin surface (Phase 3) ...

Three screens, an Events nav group and the six live run controls Phase 1 left
absent on purpose because nothing was in flight. An admin can now author,
publish, start and watch an event that announces things and cues a human; a
moderator can stop one that is going wrong.

Six controls, not eight. `advance` is absent because a phase today advances when
its steps go terminal — the per-step skip already does that — and Phase 5 is what
gives a phase an advance condition. Cancel takes `{ reason }`, not `{ cleanup }`,
until Phase 8's ledger exists. Every control is a compare-and-set on the status it
may act from, so a console rendered thirty seconds ago cannot act on a run that
has moved.

Fixes a defect in the Phase 2 runner: `advanceRun` drained up to
EVENT_STEPS_PER_TICK steps while only checking the run's status at the top of the
tick, so a pause pressed mid-batch did nothing for up to 24 more steps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T6t8mrAWhZU5vnyYgZTMtL

2026-09-02 08:39:35 -05:00

..

_helper.js

fix(test): stop the suite reaching a real database, and make it exit

2026-08-10 21:27:47 -05:00

_setup.js

fix(test): stop the suite reaching a real database, and make it exit

2026-08-10 21:27:47 -05:00

adminModules.test.js

fix(modules): stop a module before purging its tables

2026-08-12 09:05:21 -05:00

adminTrustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

adminUsers.test.js

feat(modules): the three de-entanglement registries, with core as the registrant

2026-08-10 17:47:59 -05:00

announceJobs.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

announceLegs.test.js

feat(modules): the three de-entanglement registries, with core as the registrant

2026-08-10 17:47:59 -05:00

appeals.pure.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appeals.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appLinks.test.js

feat(mobile-sso): serve assetlinks.json + App Links redirect allowlist

2026-07-20 18:37:17 -05:00

authController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

authMe.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

authTrustedDevice.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

bootOrder.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

botInternalKey.test.js

Isolate internal bot-config route from the public listener (#33)

2026-07-04 17:35:07 -05:00

botScore.test.js

Add Bot Activity admin panel: banned-IP view + recent events + emergency unban

2026-07-03 02:31:25 -05:00

brandAssets.test.js

feat(theming): brand-asset overrides and a cached, settings-aware HTML shell

2026-08-07 20:09:56 -05:00

checkModuleIdentifiers.test.js

refactor(modules)!: de-UO core's copy, and enforce it (phase 3, slice 4)

2026-08-11 21:41:18 -05:00

checkNoExternalHosts.test.js

feat(engagement): templates — the email block family, renderer and seeded set (engagement Phase 5a)

2026-08-29 13:07:39 -05:00

contentReports.test.js

test(teams): phase 5's server surface, and the negative property under it

2026-08-18 12:58:15 -05:00

csp.test.js

feat(security): soak the tightened CSP on report-only, with a same-origin sink

2026-07-27 15:19:26 -05:00

emailCollisionSurfaces.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

emailConfig.model.test.js

feat(email): remove Gmail OAuth2, put SMTP behind a transport registry

2026-08-28 20:52:55 -05:00

emailTemplates.test.js

fix(modules): bump the CLIENT half of MODULE_API_VERSION to 1.9.0

2026-09-01 01:22:00 -05:00

emailUniqueness.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

emailVerification.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

engagementAdmin.test.js

feat(engagement): deliverability — suppression, bounces and the verification gate

2026-08-31 10:47:34 -05:00

engagementCeilings.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

engagementDeliverability.test.js

feat(engagement): deliverability — suppression, bounces and the verification gate

2026-08-31 10:47:34 -05:00

engagementEmail.test.js

fix(engagement): claim the seed guard atomically, and let a rule name a digest body

2026-09-01 14:29:21 -05:00

engagementEngine.test.js

fix(engagement): claim the seed guard atomically, and let a rule name a digest body

2026-09-01 14:29:21 -05:00

engagementEngineSql.test.js

feat(engagement): the rules engine, cooldowns and outbox (engagement Phase 4a)

2026-08-29 08:07:27 -05:00

engagementInapp.test.js

feat(engagement): the in-app channel, core and web (engagement Phase 7)

2026-08-31 02:07:10 -05:00

engagementManifest.test.js

feat(modules): event triggers, audiences and the ceiling lattice (engagement Phase 2)

2026-08-29 06:40:28 -05:00

engagementRetention.test.js

feat(engagement): retention — three sweeps and one recorded refusal

2026-09-01 15:40:53 -05:00

engagementRetentionSql.test.js

feat(engagement): retention — three sweeps and one recorded refusal

2026-09-01 15:40:53 -05:00

engagementTemplatesAdmin.test.js

feat(engagement): the template editor, the trigger catalog and the send log (engagement Phase 5b)

2026-08-29 18:13:57 -05:00

engagementTriggers.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

eventActionRegistry.test.js

feat(events): the runner (Phase 2)

2026-09-02 06:32:24 -05:00

eventRunControls.test.js

feat(events): the minimal admin surface (Phase 3)

2026-09-02 08:39:35 -05:00

eventRunner.test.js

feat(events): the minimal admin surface (Phase 3)

2026-09-02 08:39:35 -05:00

eventRunnerSql.test.js

feat(events): the minimal admin surface (Phase 3)

2026-09-02 08:39:35 -05:00

eventsAdmin.test.js

feat(events): schema, CRUD and the core action registry (Phase 1)

2026-09-01 23:29:07 -05:00

eventSpec.test.js

feat(events): schema, CRUD and the core action registry (Phase 1)

2026-09-01 23:29:07 -05:00

honeypot.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

2026-07-02 23:22:35 -05:00

htmlShell.test.js

feat(modules): the client registry, window.__rg and the chunk's script injection

2026-08-10 22:54:16 -05:00

inviteController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

invites.test.js

feat(provisioning): game-account signup, admin email invites, unlink (2.0)

2026-07-17 15:50:49 -05:00

loginProtection.test.js

test(login): stop the backoff-guard test racing its own one-second lock

2026-08-12 08:16:59 -05:00

mailer.test.js

feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)

2026-08-29 20:11:54 -05:00

mailTransports.test.js

feat(email): remove Gmail OAuth2, put SMTP behind a transport registry

2026-08-28 20:52:55 -05:00

mobileAuthBridge.model.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

mobileDeviceSessions.test.js

refactor(api): collapse /admin/account and /player/account onto /auth/me/account

2026-08-29 00:49:25 -05:00

mobileSession.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

mobileSsoBridge.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

moderation.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

moderation.test.js

fix(moderation): windowValue must not fall back to the 30d total on a null column

2026-07-22 13:14:02 -05:00

moduleArchive.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleClientChunk.test.js

feat(modules): the client registry, window.__rg and the chunk's script injection

2026-08-10 22:54:16 -05:00

moduleDeclared.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

moduleDocsSpec.test.js

feat(modules): merge module OpenAPI fragments into /api/docs.json (phase 3, slice 5)

2026-08-11 22:57:37 -05:00

moduleEngagementSeeds.test.js

fix(engagement): claim the seed guard atomically, and let a rule name a digest body

2026-09-01 14:29:21 -05:00

moduleInstall.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleLifecycle.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleLoader.test.js

feat(modules): event triggers, audiences and the ceiling lattice (engagement Phase 2)

2026-08-29 06:40:28 -05:00

moduleRegistries.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

modules.model.test.js

fix(modules): three defects a real install exposed (phase 4, slice 1)

2026-08-12 03:48:27 -05:00

moduleSchema.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

navOverrides.test.js

feat(theming): dropdown sections and added links in the public header

2026-08-08 00:42:19 -05:00

newsNotify.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

notificationChannelPrefs.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

notificationsRoutes.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

pages.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

passwordResetController.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

passwordResets.test.js

feat(auth): self-service password reset (backend + web)

2026-07-19 03:57:13 -05:00

playerAccounts.test.js

refactor(api): collapse /admin/account and /player/account onto /auth/me/account

2026-08-29 00:49:25 -05:00

playerRouteAccess.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

providers.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

publicBrand.test.js

feat(theming): server-resolved theme engine and admin appearance UI

2026-08-07 19:16:23 -05:00

publicController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

publicModules.test.js

feat(modules): publish the installed-module list at /api/v1/public/modules

2026-08-10 22:03:22 -05:00

publicVersion.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

pushDispatch.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

recoveryCodes.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

registry.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

requireInternalKey.test.js

Isolate internal bot-config route from the public listener (#33)

2026-07-04 17:35:07 -05:00

reservedNames.test.js

feat(teams): reserved-name screening, auto-hide, and the admin-approval gate

2026-08-17 15:08:58 -05:00

routeManifest.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

secretBox.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

selfTrustedDevices.test.js

refactor(api): collapse /admin/account and /player/account onto /auth/me/account

2026-08-29 00:49:25 -05:00

session.test.js

Fix SSO flow-token / session type confusion (#32)

2026-07-04 21:54:58 -05:00

settingsGameSignup.test.js

refactor(client): delete the UO client half (phase 3, slice 3)

2026-08-11 18:39:55 -05:00

settingsTheming.test.js

feat(theming): wire the three navs and add the admin nav builder

2026-08-08 00:02:33 -05:00

slashCommands.test.js

feat(teams): the slash-command seam, and the first command through it

2026-08-18 18:53:34 -05:00

ssoCallback.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00

ssoEmailVerified.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

ssoState.test.js

Enforce TOTP second factor on SSO login (#31)

2026-07-04 22:17:35 -05:00

ssoTrustedDevice.test.js

feat(auth): honor and establish trusted devices on the SSO login paths

2026-07-28 01:01:12 -05:00

teamAccess.test.js

feat(teams): the four-path access resolver and staff leadership overrides

2026-08-17 14:57:23 -05:00

teamActivity.test.js

feat(teams): the activity feed, its two writers and its retention

2026-08-17 20:15:18 -05:00

teamBridge.test.js

feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)

2026-08-29 20:11:54 -05:00

teamForum.test.js

test(teams): phase 5's server surface, and the negative property under it

2026-08-18 12:58:15 -05:00

teamIntegration.test.js

feat(teams): phase 8 — the notifications bridge, and the gate §7.2 could not check

2026-08-18 20:25:30 -05:00

teamModeration.test.js

feat(teams): reserved-name screening, auto-hide, and the admin-approval gate

2026-08-17 15:08:58 -05:00

teamNotify.test.js

feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)

2026-08-29 20:11:54 -05:00

teamNotifyDispatch.test.js

feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)

2026-08-29 20:11:54 -05:00

teamProvider.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

teamRoster.test.js

feat(teams): the roster's audience projection, and optionalAuth to resolve it

2026-08-17 20:15:36 -05:00

teamRoutes.test.js

fix(teams): let a post-moderation mistake reach the model that explains it

2026-08-18 13:25:21 -05:00

teamSync.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

teamVoice.test.js

fix(teams): the two defects the phase 9 rig walk found

2026-08-19 00:07:27 -05:00

teamVoiceSync.test.js

fix(teams): the two defects the phase 9 rig walk found

2026-08-19 00:07:27 -05:00

themeResolve.test.js

feat(theming): server-resolved theme engine and admin appearance UI

2026-08-07 19:16:23 -05:00

totp.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

2026-07-02 23:22:35 -05:00

trustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

trustProxy.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)

2026-07-02 23:22:35 -05:00

usernamePolicy.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00

userNotificationsSql.test.js

feat(engagement): the in-app channel, core and web (engagement Phase 7)

2026-08-31 02:07:10 -05:00