Ship the browser smash toy publicly and document it.
Deploy: web/ is live at https://digalot.fyi/destroy/ — served on the dealgod VPS like
thriftgod (an nginx:alpine static container on dealgod_default + a /destroy/ location in
the shared reverse proxy). README.md now carries the exact deploy/update steps + a full
rollback runbook. No app code changed.
3GOD hardening (LANE5 deliverable B) was found ALREADY DONE on the live instance and
verified — not re-changed:
- GOD3_OPEN is off: unauthenticated write via Cloudflare → 403; GET /api/list → authed:false.
- SSRF plugged: POST /api/fetch with file:///etc/hostname and http://169.254.169.254/ →
rejected ("only public http(s) URLs allowed"), nothing written.
- Reads stay public (CF GET 200 + CORS *); trusted tailnet peers still push passwordless
via the TS_ALLOW IP allowlist (this session's meshgod pushes used that path).
Verified public: /destroy/ 200 over CF, JS as application/javascript, props (intact +
fractured) load from /3god/a/* with CORS *, printer boss shatters into 16 GLB chunks,
no console errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Consume Lane 2's props + close the review gaps in the browser toy.
props.js: all 16 depot slugs added to CATALOG (material/kind per prop; printer is the
boss). loadFractured() now (a) caches its result per id — including the null miss — so a
prop with no fractured sibling stops re-fetching + 404-ing on EVERY spawn (the record.
fractured.glb spam), and (b) returns the real chunk container (the fractured_root wrapper
Blender exports), so physics.js's direct-children chunk swap actually fires.
main.js: loadHeroProps() places the printer BOSS + office set dressing (desk, crt-monitor,
filing-cabinet, water-cooler) with their fractured templates. The boss soaks 4 hits then
bursts into its 16 GLB chunks (kept non-shatterable so a topple can't break it early).
Pointer-lock fallback (shareability fix): if the lock request is refused — iframes/embedded
hosts, where the toy used to dead-end on the title screen — we fall back to DRAG-TO-LOOK
(hold-drag rotates, a tap still smashes) so the shareable link always plays.
Assets: office-printer / crt-monitor / filing-cabinet mirrored into web/assets/ (offline
fallback); record/crate/rack.fractured.glb generated + mirrored so the record ritual smashes
into real chunks. The three store fractured GLBs were also pushed to the 3GOD shelf.
Verified in-browser via ?debug: printer aimSmash→"printer" then 16 chunks; thrown record →
8 chunks; debris drains 16→0; record.fractured.glb serves 200 (no 404); drag-look rotates
the camera when pointer lock is unavailable.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A shareable one-click web toy (not a port of the Godot game): walk a record store
first-person, pull a record, and wreck the place in the browser. Built on
thriftgod's pointer-lock FP-interior patterns, zero build step (three r0.175 +
@dimforge/rapier3d-compat over an importmap).
- physics.js: Rapier WASM world, one body per prop, support-graph cascade
(smash a rack → its crates pancake), pre-fractured swap (chunk_* bodies) with
generative-shard fallback until Lane 2 ships fractured GLBs, capped debris pool.
- props.js: GLTFLoader/DRACOLoader; loads props live from the 3GOD depot
(/a/<file>, CORS-open) with a local web/assets/ mirror fallback so it never
hard-fails offline. Read-only against the depot.
- juice.js: camera-trauma screenshake, hitstop, per-material particle bursts and
procedural Web-Audio smash voices (wood/cardboard/vinyl/glass/steel), combo HUD.
- main.js: FP controller, record-store room, grab/smash raycasting, record ritual
(pull → held → throw → shatter), "share your mess" canvas screenshot.
Assets mirrored offline: record/crate/rack (from the Godot lane) + cashbot/
council-bin (from 3GOD). Verified in-browser: props load, smashing spawns shards +
particles + combo, rack cascade pancakes its crates, record ritual and share work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
