Update Healer Man server

docs/CONTROL_UTILITY_CONTINUATION_2026-10-06.md

@@ -0,0 +1,168 @@
+# Control and utility continuation — 2026-10-06
+
+Lichborne now uses exact source-backed player/companion cast allowances and
+named-shout purge. Kick and Pummel join Shield Bash's source-bound ordinary-NPC
+full blocking. Player weapon autos respect pacify. Deterrence's complete linked
+source package is audited; missing runtime inputs remain explicit.
+
+## Implemented behavior
+
+- `enemyControlImmunityPurge.ts` binds Lichborne 49039 to its selected WoW335
+  identity, class, retained raw attributes and three Aura77 scalar signatures.
+  Explicit fear/stun/confuse cast permissions are separate from purge. Player
+  and configured companion casts remove only the four named FEAR-mechanic
+  shout auras, including 20511's stun/rider. Known generic fear/stun/confuse can
+  permit Lichborne but remain active and keep the actor controlled. Unknown
+  source controls and unsupported generic sleep fail closed. Berserker Rage
+  retains its narrower behavior. Existing Fear/Sleep immunity metadata is
+  consumed; Charm is source-proven but has no runtime immunity value.
+- `partyRuntime.ts` selects a learned, source-proven escape ability for its
+  owner, retaining target validity, costs and cooldowns. Lichborne's source
+  GCD is zero: it neither waits for nor clears another active GCD. Retained
+  action-blocking control keeps the companion holding.
+- `enemyUtilitySpellBlocking.ts` binds exact WoW335 Shield Bash 72, Kick 1766
+  and Pummel 6552 to identity/class/profile/raw metadata and the complete
+  projected effects. Only source-bound ability validation reconstructs the
+  two audited custom bits; an unbound raw disposition without proof falls back.
+  Foreign profiles/ranks, modified effects/wrappers, native actors/targets and
+  nonordinary recipients cannot borrow the contracts. Full block suppresses
+  effects while committing cost/cooldown, emits a zero-damage blocked result
+  and has no critical-block roll. A nonmelee-casting defender cannot block;
+  real interruption and the source school lockout remain.
+- `abilityCatalog.ts` keeps the saved public `rogue-kick` identity and only
+  its imported five-second interrupt. The generic merge previously attached
+  prototype damage and a second four-second interrupt to this exact source
+  row. Only that known merge changes. Pummel retains its four-second lockout
+  and level 38 unlock. Tests use level 40 actors and pinned Kam Deepfury at
+  level 25, with deterministic rolls and synthetic health/cast preparation.
+- `combatStore.ts` suppresses main/offhand autos and the owned Scout ranged
+  scheduler while that actor has an active pacified tag. Target selection
+  persists; expiry resumes ordinary cadence. Another actor's aura cannot
+  suppress the player. Accepted-aura scheduler fixtures do not claim a live
+  Deterrence cast or native readiness promotion.
+
+## Source and remaining limits
+
+Exact client/core evidence: [Lichborne](LICHBORNE_CONTROL_ESCAPE_2026-10-06.md),
+[utility extension](UTILITY_HIT_EXTENSION_AUDIT_2026-10-06.md) and
+[Deterrence](WOW335_DETERRENCE_SOURCE_2026-10-06.md). Historical inputs were
+read only. Pinned `spell_linked_spell` type 2 links Deterrence 19263 to 67801,
+even without a client trigger. Its five-second package includes parry, deflect,
+pacify, ignore-hit-direction and ranged-hit penalty. Aura 185's private helper
+name/comment is corrected; it is not Disarm. The Deterrence helper validates
+source signatures only, with no playable import or damage outcome claimed.
+
+Full utility miss/dodge/parry/mechanic-resist tables still need caster hit,
+attribute7 and target defense inputs, including ignored combat-result/template
+gates. General Magic miss/resist/deflect stays gated. Deterrence needs the
+per-hit AlwaysHit source flag and correct post-miss/resist deflect stage;
+damage class alone cannot provide this. Exact flee RNG, private stance DUMMY,
+Targorr timing, Charm/general control purges, native custom gear and broader
+procs remain separate work. Level cap 80, loot and Ready-five scope are intact.
+
+## Verification
+
+The final focused selection passes **138/138 tests in 19 files**. JSON evidence is
+`artifacts/control-utility-followup-2026-10-06/focused-vitest.json`. Eleven more
+selected existing Kick/Ready/catalog checks pass, with 130 other cases excluded
+by the title filter. Ready-five passes seven Vitest and twenty Python checks.
+Initial diagnostics catch fixture identity/learnability/facing errors and an
+outdated whitelist assertion; corrected fixtures and the final selection pass.
+The failed whitelist report is retained separately.
+
+The final selection adds explicit pure and actual learned-cast rejection checks
+for Bladestorm under named Fear and the 20511 stun. A purge-capable accepted
+grant does not supply permission to cast through those controls. Rejected casts
+preserve auras, control, resources, cooldown and GCD. The existing source guard
+already enforces this; these additions are test coverage. An intermediate
+14-file selection also passes, but omits five intended files and is preserved
+as `focused-incomplete-selection.json`; only the final 19-file selection is
+credited above.
+
+All three subprocesses use GPT-6 Luna extra-high. Source workers finish, and
+the independent integration review finds no further actionable issue after
+generic-fear bypass and source-level fixture corrections. The utility worker
+verifies the public/source Kick merge and exact contracts. No higher-tier
+subprocess is used. Concurrent healer-recovery edits briefly lack an import
+during one worker check; the owning concurrent edit supplies it before final
+focused validation. Root does not claim ownership of that feature. The first
+build catches a narrow/wide control-type mismatch; root changes the comparison
+without changing its runtime behavior before rebuilding.
+
+## Final build and content freeze
+
+The normal build's prebuild hooks and 8 GB TypeScript compilation pass. An
+earlier concurrent terrain fixture has an invalid material enum until its owner
+corrects it; four targeted terrain checks then pass. The default Vite output
+fails with Windows EPERM contention in `dist/assets`. A fresh isolated Vite
+build succeeds, followed by the normal precompression and release-bundle
+verifier. The failed attempts and `build-isolated.log` are retained in the task
+artifact directory. No shared output or other process is removed.
+
+The isolated build is frozen under
+`artifacts/control-utility-followup-2026-10-06/frozen-20261007-033245765/`.
+Its 5,967 files contain 118,418,867 bytes, aggregate SHA-256
+`00b7c1b19b0c8e64aba05732c24c7f3f65fa92c5260b4b3dee55391d5af2a2e4`.
+The freshly copied content manifest is
+`91b22f898ddabb4d20f1331f682852c33e5a6781c75caec9b1e435ebc60a0e39`,
+version `content-d1ec6f1f858f21c1`. All 27,587 referenced objects verify before
+QA (6,566,442,405 bytes; 21,605 logical files). The prior pass's content is not
+reused because the current manifest differs. The build's historical Wailing
+bootstrap assets do not select the live test dungeon.
+
+## Final Cellblock Rush evidence
+
+The single final routine run is
+`playtest-artifacts/stockade-weapon-utilities/20261007-033835372/` (UTC run ID;
+October 6 locally). Normal UI creates a Discipline Priest and four Ready
+companions, with isolated pre-entry level 30 preparation. Its seeded boss is
+Targorr the Dread, entry 1696, source/live actor `creature-84027`. Native progress
+and the results overlay agree on **1/1 in 03:05.6**, Easy/Normal. No player or
+party deaths occur; effective player healing totals 2,301.8 HP. Historical
+`fullClear` field names certify this entered one-boss slice only.
+
+The committed recorder retains 762 consecutive events, IDs 9–770, with zero
+gaps, errors or discarded events/states. Companion Kick events 496 and 765
+have `kind: cast`, zero damage and unblocked hit outcomes. No Kick damage event
+is recorded. No active source cast is captured for Targorr, so these Kick
+results do not prove a live interruption. Shield Bash 536/706 immediately
+precedes Daze grants 537/707; Daze duration/movement remains fixture evidence.
+Pummel is unobserved: the live actors are below its level 38 unlock. Utility
+full blocks, Lichborne/control escape and pacify are deterministic-fixture
+coverage, not observed live applications in this seed. There is no Death
+Knight in the Ready-only live party.
+
+Existing Disarm evidence contains four tank windows and seven mainhand autos
+during them (364, 373, 555, 569, 647, 659, 762). Each records raw damage 57,
+versus 68/70 outside those windows. This is consistent with the existing unarmed
+fallback and removed weapon contribution, not a requirement to suppress every
+swing. Disarm and the new pacify scheduler gate have different source behavior.
+
+Root's labeled `root-evidence-audit.cjs/.json` independently rehashes all 5,967
+frozen build files, seven loaded chunks and 2,124 served manifest objects
+(77,019,550 bytes). Build and full content manifest remain unchanged; every
+checked object matches its address and captured manifest reference, with zero
+integrity failures. Raw network response bodies are not retained; the audit
+matches immutable local bytes to recorded successful response URLs/status.
+
+Root views the actual roster, equipped-party, route-50 and native results PNGs.
+Player/companion bodies, the staff and shield silhouette render. Close-party
+overlap and HUD occlusion limit a complete per-companion equipment review.
+Nine PNGs exist; no live camera-drag evidence is credited. Page exceptions are
+zero; the only console error is favicon 404. The harness cleans up its helper,
+server and browser. No gameplay source change or additional live run follows
+the frozen build. Final TypeScript compilation also passes after the test-only
+rejection additions.
+
+The independent GPT-6 Luna extra-high evidence review finishes without a
+discrepancy. It separately checks raw event-ID continuity, native one-boss
+completion and agreement between captured fingerprints and root audit. It
+confirms the unarmed Disarm evidence and live utility/control attribution above;
+it does not rehash the content, run tests/builds/browser, or broaden the audit's
+network-body boundary.
+
+Final game release hygiene passes 78 changed paths, including untracked files,
+and is recorded in
+`artifacts/control-utility-followup-2026-10-06/release-check.log`. Game/vault
+changes are reviewed separately, canonical notes are updated, and the task
+worklog closes without staging, commit or deployment.