Whole-document cloud saves could erase account Boss Cards when an old client omitted cards or sent a stale copy. Native clients also need to save cards without replacing browser characters, preferences or other fields.
Add authenticated PATCH /api/cloud-save with bossCards and expectedRevision. A SQLite transaction compares the revision and merges only cards; stale requests return 409 without writing. Legacy PUT retains its non-card replacement behavior and preserves collected cards with the source max-count/newest-claim merge. CORS permits PATCH.
Validation: 17 focused/existing server/database tests and 33 independent real HTTP/auth/SQLite checks pass, including account isolation, conflict/no-write, concurrent exact-one-winner, stale/omitted PUTs, logout and same-origin restart recovery. Native Godot also passes 33 scripted real-API cases, including two accounts with two characters each and source-generated rewards written durably by the existing bridge. Release hygiene check passes. All services use isolated loopback databases and generated credentials; no hosted deployment or hosted account mutation. Native UI/cache integration remains separately in progress under Codex/healer-man-godot #155.
Five scoped files; candidate/proof identities retained in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; branch fix/7-account-card-checkpoints. GPT-6 Luna / xhigh single_pass_source implemented backend/tests, single_pass_validation independently verified the API; root reviewed and publishes. Exact scoped head reviewed by root with independent Luna HTTP/SQLite audit; ready for merge. Final actual native evidence also passes owner-store43, account panel48 with two inspected Metal captures, app27, and recovery23native+25orchestrator checks. Recovery closes/reopens the factory and SQLite in the same Nodeprocess/origin; it is not an OSprocess restart. The optional cache permission fault is explicitly skipped on this host. Same-task notes and evidence will be added before closing #7.
Whole-document cloud saves could erase account Boss Cards when an old client omitted cards or sent a stale copy. Native clients also need to save cards without replacing browser characters, preferences or other fields.
Add authenticated PATCH /api/cloud-save with bossCards and expectedRevision. A SQLite transaction compares the revision and merges only cards; stale requests return 409 without writing. Legacy PUT retains its non-card replacement behavior and preserves collected cards with the source max-count/newest-claim merge. CORS permits PATCH.
Validation: 17 focused/existing server/database tests and 33 independent real HTTP/auth/SQLite checks pass, including account isolation, conflict/no-write, concurrent exact-one-winner, stale/omitted PUTs, logout and same-origin restart recovery. Native Godot also passes 33 scripted real-API cases, including two accounts with two characters each and source-generated rewards written durably by the existing bridge. Release hygiene check passes. All services use isolated loopback databases and generated credentials; no hosted deployment or hosted account mutation. Native UI/cache integration remains separately in progress under Codex/healer-man-godot #155.
Five scoped files; candidate/proof identities retained in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; branch fix/7-account-card-checkpoints. GPT-6 Luna / xhigh single_pass_source implemented backend/tests, single_pass_validation independently verified the API; root reviewed and publishes. Exact scoped head reviewed by root with independent Luna HTTP/SQLite audit; ready for merge. Final actual native evidence also passes owner-store43, account panel48 with two inspected Metal captures, app27, and recovery23native+25orchestrator checks. Recovery closes/reopens the factory and SQLite in the same Nodeprocess/origin; it is not an OSprocess restart. The optional cache permission fault is explicitly skipped on this host. Same-task notes and evidence will be added before closing #7.
Same-task notes and installed acceptance are complete; owning issue closure follows. Evidence: https://git.whoagland.com/attachments/42cc6673-dccd-4bb2-8169-e83dea41e215
SHA256 1145bd8be4bcf2c9c24e85d9e7ca4557319ad6ee7503874b8c301e362daff003. Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna / xhigh single_pass_source, single_pass_renderer and single_pass_validation contributed the recorded bounded scopes. Native branch fix/155-native-account-cards; source branch fix/7-account-card-checkpoints.
Native scoped head fe432e90c8af3d13a33c26afca9f7b119d4b0285 is merged by PR268 at main dfbf161fbf672789b2e3f3dd270877360a4d4ac5. Source scoped head 5385b14e3a is merged by PR8 at source main ab37006932. Source17 focused and33 independent HTTP checks pass. Actual/main-rebased native session33, actual store43, menu27, panel48 with two opened/inspected Metal captures and review/actual recovery23native+25orchestrator checks pass with clean logs and unchanged isolated preferences. Permission injection is explicitly skipped on this host; menu probes use controlled viewer/party doubles, graphics use synthetic account snapshots, and recovery reopens the factory/SQLite in the same Nodeprocess/origin rather than restarting an OSprocess.
Thirty native scoped files are installed in /Users/warren/Projects/HealerMan-Godot-Test. Shared HEAD/index and61unowned guarded paths, prior RoM icons, WoW/RoM stats, gear, rigs, character-library and source reward rules remain preserved. Seven Obsidian notes/worklog are updated and mirrored under Projects; scoped local notes commit 59dcc9edc05ca5a1e4a770d6ff3e9e4e3d1a39d2 and bundle preserve the shared vault HEAD/index, without remote vault push. Exact code, used inputs, source identities, reports, original failed/superseded attempts, inspected captures and bundles remain in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Fixture service is stopped; private credential/cache/database contents are excluded and actual secret values were scanned in memory before upload.
Tokens stay in memory; sign in after restart. Browser/offline rosters and cards are not automatically imported into online accounts. Source merging follows maximum counts/newest claims, not an additive per-kill ledger. No hosted deployment, live boss victory, manual login, audio listening or source-client fidelity claim. Native docs and PLAYTEST_NOTES record current validation and the historical boss boundary. Code publication, main integration and actual installation are all complete; acceptance is complete for these scoped issues.
Same-task notes and installed acceptance are complete; owning issue closure follows. Evidence: https://git.whoagland.com/attachments/42cc6673-dccd-4bb2-8169-e83dea41e215
SHA256 1145bd8be4bcf2c9c24e85d9e7ca4557319ad6ee7503874b8c301e362daff003. Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna / xhigh single_pass_source, single_pass_renderer and single_pass_validation contributed the recorded bounded scopes. Native branch fix/155-native-account-cards; source branch fix/7-account-card-checkpoints.
Native scoped head fe432e90c8af3d13a33c26afca9f7b119d4b0285 is merged by PR268 at main dfbf161fbf672789b2e3f3dd270877360a4d4ac5. Source scoped head 5385b14e3a9d0f35c7ad3d3a3c86e2ccb860dba3 is merged by PR8 at source main ab37006932eca20aae22327e64ecba8dd29f00fb. Source17 focused and33 independent HTTP checks pass. Actual/main-rebased native session33, actual store43, menu27, panel48 with two opened/inspected Metal captures and review/actual recovery23native+25orchestrator checks pass with clean logs and unchanged isolated preferences. Permission injection is explicitly skipped on this host; menu probes use controlled viewer/party doubles, graphics use synthetic account snapshots, and recovery reopens the factory/SQLite in the same Nodeprocess/origin rather than restarting an OSprocess.
Thirty native scoped files are installed in /Users/warren/Projects/HealerMan-Godot-Test. Shared HEAD/index and61unowned guarded paths, prior RoM icons, WoW/RoM stats, gear, rigs, character-library and source reward rules remain preserved. Seven Obsidian notes/worklog are updated and mirrored under Projects; scoped local notes commit 59dcc9edc05ca5a1e4a770d6ff3e9e4e3d1a39d2 and bundle preserve the shared vault HEAD/index, without remote vault push. Exact code, used inputs, source identities, reports, original failed/superseded attempts, inspected captures and bundles remain in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Fixture service is stopped; private credential/cache/database contents are excluded and actual secret values were scanned in memory before upload.
Tokens stay in memory; sign in after restart. Browser/offline rosters and cards are not automatically imported into online accounts. Source merging follows maximum counts/newest claims, not an additive per-kill ledger. No hosted deployment, live boss victory, manual login, audio listening or source-client fidelity claim. Native docs and PLAYTEST_NOTES record current validation and the historical boss boundary. Code publication, main integration and actual installation are all complete; acceptance is complete for these scoped issues.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Whole-document cloud saves could erase account Boss Cards when an old client omitted cards or sent a stale copy. Native clients also need to save cards without replacing browser characters, preferences or other fields.
Add authenticated PATCH /api/cloud-save with bossCards and expectedRevision. A SQLite transaction compares the revision and merges only cards; stale requests return 409 without writing. Legacy PUT retains its non-card replacement behavior and preserves collected cards with the source max-count/newest-claim merge. CORS permits PATCH.
Validation: 17 focused/existing server/database tests and 33 independent real HTTP/auth/SQLite checks pass, including account isolation, conflict/no-write, concurrent exact-one-winner, stale/omitted PUTs, logout and same-origin restart recovery. Native Godot also passes 33 scripted real-API cases, including two accounts with two characters each and source-generated rewards written durably by the existing bridge. Release hygiene check passes. All services use isolated loopback databases and generated credentials; no hosted deployment or hosted account mutation. Native UI/cache integration remains separately in progress under Codex/healer-man-godot #155.
Five scoped files; candidate/proof identities retained in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; branch fix/7-account-card-checkpoints. GPT-6 Luna / xhigh single_pass_source implemented backend/tests, single_pass_validation independently verified the API; root reviewed and publishes. Exact scoped head reviewed by root with independent Luna HTTP/SQLite audit; ready for merge. Final actual native evidence also passes owner-store43, account panel48 with two inspected Metal captures, app27, and recovery23native+25orchestrator checks. Recovery closes/reopens the factory and SQLite in the same Nodeprocess/origin; it is not an OSprocess restart. The optional cache permission fault is explicitly skipped on this host. Same-task notes and evidence will be added before closing #7.
Same-task notes and installed acceptance are complete; owning issue closure follows. Evidence: https://git.whoagland.com/attachments/42cc6673-dccd-4bb2-8169-e83dea41e215
SHA256 1145bd8be4bcf2c9c24e85d9e7ca4557319ad6ee7503874b8c301e362daff003. Coordinator /root session 01a11cd3-fa7c-7510-ba8f-bc7a3d0310a6; GPT-6 Luna / xhigh single_pass_source, single_pass_renderer and single_pass_validation contributed the recorded bounded scopes. Native branch fix/155-native-account-cards; source branch fix/7-account-card-checkpoints.
Native scoped head fe432e90c8af3d13a33c26afca9f7b119d4b0285 is merged by PR268 at main dfbf161fbf672789b2e3f3dd270877360a4d4ac5. Source scoped head
5385b14e3ais merged by PR8 at source mainab37006932. Source17 focused and33 independent HTTP checks pass. Actual/main-rebased native session33, actual store43, menu27, panel48 with two opened/inspected Metal captures and review/actual recovery23native+25orchestrator checks pass with clean logs and unchanged isolated preferences. Permission injection is explicitly skipped on this host; menu probes use controlled viewer/party doubles, graphics use synthetic account snapshots, and recovery reopens the factory/SQLite in the same Nodeprocess/origin rather than restarting an OSprocess.Thirty native scoped files are installed in /Users/warren/Projects/HealerMan-Godot-Test. Shared HEAD/index and61unowned guarded paths, prior RoM icons, WoW/RoM stats, gear, rigs, character-library and source reward rules remain preserved. Seven Obsidian notes/worklog are updated and mirrored under Projects; scoped local notes commit 59dcc9edc05ca5a1e4a770d6ff3e9e4e3d1a39d2 and bundle preserve the shared vault HEAD/index, without remote vault push. Exact code, used inputs, source identities, reports, original failed/superseded attempts, inspected captures and bundles remain in Projects/Issue-Fixes/155-native-account-cards-2026-10-10. Fixture service is stopped; private credential/cache/database contents are excluded and actual secret values were scanned in memory before upload.
Tokens stay in memory; sign in after restart. Browser/offline rosters and cards are not automatically imported into online accounts. Source merging follows maximum counts/newest claims, not an additive per-kill ledger. No hosted deployment, live boss victory, manual login, audio listening or source-client fidelity claim. Native docs and PLAYTEST_NOTES record current validation and the historical boss boundary. Code publication, main integration and actual installation are all complete; acceptance is complete for these scoped issues.