6e5f4b5222
The URL is public, so this is the first thing a stranger meets.
ENTER, PINNED. The exploit shipped because the rule lived in a keydown closure
inside boot(), behind a canvas and a WebGL context — nowhere a test could
reach. That's WHY it went out: not carelessness, no seam. `enterCommits(phase,
cardOpen)` is a value now, asserted exhaustively over PHASES so a sixth phase
is covered the day it appears, and the safe default (may not advance) is the
one it gets. Mutation-checked: reverting the guard reddens forecast, storm and
aftermath.
SPLASH. A cold visitor used to land on a job sheet — an invoice-shaped card
from a business they'd never heard of, quoting money for a job nobody had
explained, controls revealed later on prep's help line. It's a good SECOND
card. One more .card, not a menu system: there is nothing to configure. Built
on E's letterhead because the masthead IS the game's name. boot({splash:false})
for benches and D's harness.
P PAUSE — and the test is the story. The pause lives in frame(), frame() is
only called by rAF, and rAF DOES NOT FIRE IN A HIDDEN TAB. My first probe drove
the real loop and reported success: simT advanced 0 while paused... and 0 while
running. It was measuring a frozen tab, and it would have passed no matter what
I wrote. So the rule is a value: accumulate(acc, raw, paused). Paused DRAINS
the accumulator rather than carrying it — a kept `acc` spends time that elapsed
while you were paused on the first frame after resume, which is a free sixtieth
of a second of storm and exactly how two runs of a deterministic sim come to
disagree. Storm-only, and cleared at every phase change: a pause flag left set
where P is inert would be a soft-lock built out of a comfort feature.
M MUTE — wired, honest, and not advertised yet. C's bus has no tap: createAudio
holds `master` inside skyfx's closure and exposes only unlockAudio(). Asked in
THREADS. `sky.setMute?.(on)` behind a key the splash promises would be D's
night-3 soft-lock with a keycap on it — `rigging.setWorld?.(world)` sat in this
same file for a sprint doing nothing, silently, because ?.() on a missing method
looks exactly like a call. So the UI asks before it advertises, and M lights up
by itself the day C lands the tap.
TOUCH NOTICE. The naive check is the bug: `(pointer: coarse)` asks what the
PRIMARY pointer is, so a touchscreen laptop answers coarse and gets locked out
of a game it can play — worse than the dead canvas it replaces. `(any-pointer:
fine)` asks whether a mouse exists at all. Detection errs toward letting people
in; unknown browsers get the game, not a lecture.
DEV LINE. Out from under B's anchor panel (both were top-left, typesetting on
each other), and off unless localhost or ?dev=1 — a stranger on partly.party was
reading "60 fps · storm 12.3s · debris 4" on the front door.
selftest 338/0/0 (was 335).
55 lines
2.2 KiB
HTML
55 lines
2.2 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<title>HARD YARDS — rig it, then survive the night</title>
|
|
<style>
|
|
html, body { margin: 0; height: 100%; overflow: hidden; background: #9fc4dd; }
|
|
canvas { display: block; width: 100%; height: 100%; }
|
|
#dev, #help {
|
|
position: fixed; left: 10px;
|
|
font: 12px ui-monospace, SFMono-Regular, Menlo, monospace;
|
|
color: #eef4f8; text-shadow: 0 1px 2px #0009;
|
|
pointer-events: none; user-select: none;
|
|
}
|
|
/* SPRINT13 gate 3 — the dev line moved out from under Lane B's anchor panel
|
|
(top:12/left:12; this was top:10/left:10, so they typeset on top of each
|
|
other all sprint — QA snag list). Top-RIGHT now, and hidden unless asked
|
|
for: see main.js's dev-line block. A stranger on partly.party was reading
|
|
"60 fps · storm 12.3s · debris 4" on the front door of a public game, which
|
|
is a dev build talking to someone who came to play. */
|
|
#dev { top: 10px; right: 10px; left: auto; text-align: right; display: none; }
|
|
#dev.on { display: block; }
|
|
#help { bottom: 10px; opacity: .75; }
|
|
#banner {
|
|
position: fixed; top: 38%; left: 0; right: 0;
|
|
text-align: center; pointer-events: none; user-select: none;
|
|
font: 700 42px/1 ui-monospace, SFMono-Regular, Menlo, monospace;
|
|
letter-spacing: .18em; color: #fff; text-shadow: 0 2px 12px #0007;
|
|
opacity: 0; transition: opacity .45s ease;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<canvas id="c"></canvas>
|
|
<div id="banner"></div>
|
|
<div id="dev">booting…</div>
|
|
|
|
<script type="importmap">
|
|
{ "imports": { "three": "./vendor/three.module.js",
|
|
"three/addons/": "./vendor/addons/" } }
|
|
</script>
|
|
<script type="module">
|
|
import { boot } from './js/main.js';
|
|
// boot() is async now — it fetches two storm defs, the ped, the clip pack
|
|
// and Lane E's debris GLBs. Surface a failure on the page rather than
|
|
// letting it die as an unhandled rejection behind a blue screen.
|
|
boot().catch((err) => {
|
|
console.error(err);
|
|
document.getElementById('dev').textContent = `BOOT FAILED — ${err.message} (see console)`;
|
|
});
|
|
</script>
|
|
</body>
|
|
</html>
|