Native Codex/healer-man-godot#155 needs authenticated owner-scoped Boss Card checkpoints without replacing unrelated cloud data. Published source main ff20ab8779 exposes only whole-document PUT /api/cloud-save with last-write-wins and no card merge. A native card-only client cannot guarantee preserving characters/preferences or cards written by another client through that API.
Acceptance:
Add authenticated PATCH /api/cloud-save accepting {bossCards:{counts,lastClaims},expectedRevision:nonnegativeInteger}; derive account identity only from Bearer auth.
Atomically compare current revision (missing row0), return409revision_conflict without writes on mismatch, and merge card data with source account policy (maximum rarity counts and deterministic lastClaims) while preserving all non-card fields exactly.
Preserve existing source PUT behavior for other fields while ensuring a stale or omitted Boss Cards field cannot erase already collected account cards; apply the same source card reconciliation when cards already exist.
Retain source boss keys/rarities and normalization; never import a device/offline collection or trust caller-supplied account identity. Keep unrelated combat/stat/gear/room behavior unchanged.
Verify actual source HTTP/auth/SQLite behavior for two accounts, card-only updates, preservation, revision conflict/retry, stale legacy PUT, unauthorized requests, dedup/reload/restart; preserve existing relevant source tests.
Publish scoped source commit/review and evidence, native155 dependency link, Projects input copies and source-specific Obsidian note. This adds no deployment or real hosted-account mutation.
Coordinator /root session01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna/xhigh single_pass_source owns source server/card merge and focused tests, single_pass_validation independently verifies real source API. Root owns cross-repo integration/publication/memory. Native session/UI integration remains in Codex/healer-man-godot#155. This is a source prerequisite; native issue stays open until genuine native auth/sync evidence exists.
Native Codex/healer-man-godot#155 needs authenticated owner-scoped Boss Card checkpoints without replacing unrelated cloud data. Published source main ff20ab87790ffbb0662823e1c15c667ef88adc7d exposes only whole-document PUT /api/cloud-save with last-write-wins and no card merge. A native card-only client cannot guarantee preserving characters/preferences or cards written by another client through that API.
Acceptance:
- Add authenticated PATCH /api/cloud-save accepting {bossCards:{counts,lastClaims},expectedRevision:nonnegativeInteger}; derive account identity only from Bearer auth.
- Atomically compare current revision (missing row0), return409revision_conflict without writes on mismatch, and merge card data with source account policy (maximum rarity counts and deterministic lastClaims) while preserving all non-card fields exactly.
- Preserve existing source PUT behavior for other fields while ensuring a stale or omitted Boss Cards field cannot erase already collected account cards; apply the same source card reconciliation when cards already exist.
- Retain source boss keys/rarities and normalization; never import a device/offline collection or trust caller-supplied account identity. Keep unrelated combat/stat/gear/room behavior unchanged.
- Verify actual source HTTP/auth/SQLite behavior for two accounts, card-only updates, preservation, revision conflict/retry, stale legacy PUT, unauthorized requests, dedup/reload/restart; preserve existing relevant source tests.
- Publish scoped source commit/review and evidence, native155 dependency link, Projects input copies and source-specific Obsidian note. This adds no deployment or real hosted-account mutation.
Coordinator /root session01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna/xhigh single_pass_source owns source server/card merge and focused tests, single_pass_validation independently verifies real source API. Root owns cross-repo integration/publication/memory. Native session/UI integration remains in Codex/healer-man-godot#155. This is a source prerequisite; native issue stays open until genuine native auth/sync evidence exists.
Claimed by worker: /root session01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; single_pass_source Luna/xhigh.
Working branch: fix/7-account-card-checkpoints.
Other agents should choose another ready, unassigned issue. This claim records coordination, not a server-side lock.
Claimed by worker: /root session01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; single_pass_source Luna/xhigh.
Working branch: `fix/7-account-card-checkpoints`.
Other agents should choose another ready, unassigned issue. This claim records coordination, not a server-side lock.
Prerequisite for native #155, same coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6, branch fix/7-account-card-checkpoints. GPT-6 Luna / xhigh single_pass_source owns five backend/doc/test files; single_pass_validation independently exercises real HTTP/auth/SQLite; root publishes and validates native integration.
The frozen candidate passes 17 focused/existing server and database tests plus 33 independent real-API checks. PATCH /api/cloud-save authenticates the owner, compares expectedRevision in a SQLite transaction, merges only bossCards, retains every non-card field and returns 409 without writing on stale revisions. Legacy PUT retains max counts/newer claim identities when incoming cards are stale or absent. CORS preflight permits PATCH. Checks include separate accounts, malformed input, exact-one-winner concurrency, source save preservation, logout/relogin, and database/server restart on the same isolated origin. No hosted accounts/data were touched. Frozen input identities and reports are retained under Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Candidate is not committed, published or deployed yet; native Godot integration validation is underway.
Prerequisite for native [#155](https://git.whoagland.com/Codex/healer-man-godot/issues/155), same coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6, branch fix/7-account-card-checkpoints. GPT-6 Luna / xhigh single_pass_source owns five backend/doc/test files; single_pass_validation independently exercises real HTTP/auth/SQLite; root publishes and validates native integration.
The frozen candidate passes 17 focused/existing server and database tests plus 33 independent real-API checks. PATCH /api/cloud-save authenticates the owner, compares expectedRevision in a SQLite transaction, merges only bossCards, retains every non-card field and returns 409 without writing on stale revisions. Legacy PUT retains max counts/newer claim identities when incoming cards are stale or absent. CORS preflight permits PATCH. Checks include separate accounts, malformed input, exact-one-winner concurrency, source save preservation, logout/relogin, and database/server restart on the same isolated origin. No hosted accounts/data were touched. Frozen input identities and reports are retained under Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Candidate is not committed, published or deployed yet; native Godot integration validation is underway.
Authenticated card-only PATCH uses an atomic SQLite revision comparison, rejects stale writes without mutation and merges only cards, preserving version1/2, browser characters/preferences and unknown fields. Legacy full-save PUT retains its non-card behavior while keeping collected cards across omitted/stale card snapshots. CORS advertises PATCH. Backend source is merged, with no hosted deployment.
Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna / xhigh single_pass_source, single_pass_renderer and single_pass_validation contributed the recorded bounded scopes. Native branch fix/155-native-account-cards; source branch fix/7-account-card-checkpoints.
Native scoped head fe432e90c8af3d13a33c26afca9f7b119d4b0285 is merged by PR268 at main dfbf161fbf672789b2e3f3dd270877360a4d4ac5. Source scoped head 5385b14e3a is merged by PR8 at source main ab37006932. Source17 focused and33 independent HTTP checks pass. Actual/main-rebased native session33, actual store43, menu27, panel48 with two opened/inspected Metal captures and review/actual recovery23native+25orchestrator checks pass with clean logs and unchanged isolated preferences. Permission injection is explicitly skipped on this host; menu probes use controlled viewer/party doubles, graphics use synthetic account snapshots, and recovery reopens the factory/SQLite in the same Nodeprocess/origin rather than restarting an OSprocess.
Thirty native scoped files are installed in /Users/warren/Projects/HealerMan-Godot-Test. Shared HEAD/index and61unowned guarded paths, prior RoM icons, WoW/RoM stats, gear, rigs, character-library and source reward rules remain preserved. Seven Obsidian notes/worklog are updated and mirrored under Projects; scoped local notes commit 59dcc9edc05ca5a1e4a770d6ff3e9e4e3d1a39d2 and bundle preserve the shared vault HEAD/index, without remote vault push. Exact code, used inputs, source identities, reports, original failed/superseded attempts, inspected captures and bundles remain in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Fixture service is stopped; private credential/cache/database contents are excluded and actual secret values were scanned in memory before upload.
Tokens stay in memory; sign in after restart. Browser/offline rosters and cards are not automatically imported into online accounts. Source merging follows maximum counts/newest claims, not an additive per-kill ledger. No hosted deployment, live boss victory, manual login, audio listening or source-client fidelity claim. Native docs and PLAYTEST_NOTES record current validation and the historical boss boundary. Code publication, main integration and actual installation are all complete; acceptance is complete for these scoped issues.
Authenticated card-only PATCH uses an atomic SQLite revision comparison, rejects stale writes without mutation and merges only cards, preserving version1/2, browser characters/preferences and unknown fields. Legacy full-save PUT retains its non-card behavior while keeping collected cards across omitted/stale card snapshots. CORS advertises PATCH. Backend source is merged, with no hosted deployment.
Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna / xhigh single_pass_source, single_pass_renderer and single_pass_validation contributed the recorded bounded scopes. Native branch fix/155-native-account-cards; source branch fix/7-account-card-checkpoints.
Native scoped head fe432e90c8af3d13a33c26afca9f7b119d4b0285 is merged by PR268 at main dfbf161fbf672789b2e3f3dd270877360a4d4ac5. Source scoped head 5385b14e3a9d0f35c7ad3d3a3c86e2ccb860dba3 is merged by PR8 at source main ab37006932eca20aae22327e64ecba8dd29f00fb. Source17 focused and33 independent HTTP checks pass. Actual/main-rebased native session33, actual store43, menu27, panel48 with two opened/inspected Metal captures and review/actual recovery23native+25orchestrator checks pass with clean logs and unchanged isolated preferences. Permission injection is explicitly skipped on this host; menu probes use controlled viewer/party doubles, graphics use synthetic account snapshots, and recovery reopens the factory/SQLite in the same Nodeprocess/origin rather than restarting an OSprocess.
Thirty native scoped files are installed in /Users/warren/Projects/HealerMan-Godot-Test. Shared HEAD/index and61unowned guarded paths, prior RoM icons, WoW/RoM stats, gear, rigs, character-library and source reward rules remain preserved. Seven Obsidian notes/worklog are updated and mirrored under Projects; scoped local notes commit 59dcc9edc05ca5a1e4a770d6ff3e9e4e3d1a39d2 and bundle preserve the shared vault HEAD/index, without remote vault push. Exact code, used inputs, source identities, reports, original failed/superseded attempts, inspected captures and bundles remain in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Fixture service is stopped; private credential/cache/database contents are excluded and actual secret values were scanned in memory before upload.
Tokens stay in memory; sign in after restart. Browser/offline rosters and cards are not automatically imported into online accounts. Source merging follows maximum counts/newest claims, not an additive per-kill ledger. No hosted deployment, live boss victory, manual login, audio listening or source-client fidelity claim. Native docs and PLAYTEST_NOTES record current validation and the historical boss boundary. Code publication, main integration and actual installation are all complete; acceptance is complete for these scoped issues.
Evidence ZIP, downloaded/hash verified: https://git.whoagland.com/attachments/96b0c0a4-9bce-4b7a-ad8e-830a16417d46
SHA256 1145bd8be4bcf2c9c24e85d9e7ca4557319ad6ee7503874b8c301e362daff003; 292 entries, 10873854 bytes.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Native Codex/healer-man-godot#155 needs authenticated owner-scoped Boss Card checkpoints without replacing unrelated cloud data. Published source main
ff20ab8779exposes only whole-document PUT /api/cloud-save with last-write-wins and no card merge. A native card-only client cannot guarantee preserving characters/preferences or cards written by another client through that API.Acceptance:
Coordinator /root session01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna/xhigh single_pass_source owns source server/card merge and focused tests, single_pass_validation independently verifies real source API. Root owns cross-repo integration/publication/memory. Native session/UI integration remains in Codex/healer-man-godot#155. This is a source prerequisite; native issue stays open until genuine native auth/sync evidence exists.
Claimed by worker: /root session01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; single_pass_source Luna/xhigh.
Working branch:
fix/7-account-card-checkpoints.Other agents should choose another ready, unassigned issue. This claim records coordination, not a server-side lock.
Prerequisite for native #155, same coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6, branch fix/7-account-card-checkpoints. GPT-6 Luna / xhigh single_pass_source owns five backend/doc/test files; single_pass_validation independently exercises real HTTP/auth/SQLite; root publishes and validates native integration.
The frozen candidate passes 17 focused/existing server and database tests plus 33 independent real-API checks. PATCH /api/cloud-save authenticates the owner, compares expectedRevision in a SQLite transaction, merges only bossCards, retains every non-card field and returns 409 without writing on stale revisions. Legacy PUT retains max counts/newer claim identities when incoming cards are stale or absent. CORS preflight permits PATCH. Checks include separate accounts, malformed input, exact-one-winner concurrency, source save preservation, logout/relogin, and database/server restart on the same isolated origin. No hosted accounts/data were touched. Frozen input identities and reports are retained under Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Candidate is not committed, published or deployed yet; native Godot integration validation is underway.
Authenticated card-only PATCH uses an atomic SQLite revision comparison, rejects stale writes without mutation and merges only cards, preserving version1/2, browser characters/preferences and unknown fields. Legacy full-save PUT retains its non-card behavior while keeping collected cards across omitted/stale card snapshots. CORS advertises PATCH. Backend source is merged, with no hosted deployment.
Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna / xhigh single_pass_source, single_pass_renderer and single_pass_validation contributed the recorded bounded scopes. Native branch fix/155-native-account-cards; source branch fix/7-account-card-checkpoints.
Native scoped head fe432e90c8af3d13a33c26afca9f7b119d4b0285 is merged by PR268 at main dfbf161fbf672789b2e3f3dd270877360a4d4ac5. Source scoped head
5385b14e3ais merged by PR8 at source mainab37006932. Source17 focused and33 independent HTTP checks pass. Actual/main-rebased native session33, actual store43, menu27, panel48 with two opened/inspected Metal captures and review/actual recovery23native+25orchestrator checks pass with clean logs and unchanged isolated preferences. Permission injection is explicitly skipped on this host; menu probes use controlled viewer/party doubles, graphics use synthetic account snapshots, and recovery reopens the factory/SQLite in the same Nodeprocess/origin rather than restarting an OSprocess.Thirty native scoped files are installed in /Users/warren/Projects/HealerMan-Godot-Test. Shared HEAD/index and61unowned guarded paths, prior RoM icons, WoW/RoM stats, gear, rigs, character-library and source reward rules remain preserved. Seven Obsidian notes/worklog are updated and mirrored under Projects; scoped local notes commit 59dcc9edc05ca5a1e4a770d6ff3e9e4e3d1a39d2 and bundle preserve the shared vault HEAD/index, without remote vault push. Exact code, used inputs, source identities, reports, original failed/superseded attempts, inspected captures and bundles remain in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Fixture service is stopped; private credential/cache/database contents are excluded and actual secret values were scanned in memory before upload.
Tokens stay in memory; sign in after restart. Browser/offline rosters and cards are not automatically imported into online accounts. Source merging follows maximum counts/newest claims, not an additive per-kill ledger. No hosted deployment, live boss victory, manual login, audio listening or source-client fidelity claim. Native docs and PLAYTEST_NOTES record current validation and the historical boss boundary. Code publication, main integration and actual installation are all complete; acceptance is complete for these scoped issues.
Evidence ZIP, downloaded/hash verified: https://git.whoagland.com/attachments/96b0c0a4-9bce-4b7a-ad8e-830a16417d46
SHA256 1145bd8be4bcf2c9c24e85d9e7ca4557319ad6ee7503874b8c301e362daff003; 292 entries, 10873854 bytes.