@homie-rocks/studio 0.30.1 → 0.31.0

package/worker/license.mjs

@@ -1,46 +1,49 @@
 /**
- * A GAME'S SOURCE LICENCE AND LINEAGE, shared by the site Worker (worker/index.mjs, worker/site.mjs) and the CLI
- * (lib/build.mjs, lib/studio.mjs).
+ * A GAME'S OWN LICENCE AND THE CREDIT IT OWES, shared by the site Worker (worker/site.mjs, worker/schema.mjs,
+ * worker/discover.mjs) and the CLI (lib/build.mjs).
  *
- * The licence is the owner's pick (game.json `"license"`), carried in the game's source.json beside who made it
- * (`credit`: studio, game, page), so a remix knows what it may do and whom to credit:
+ * The licence is a statement of rights the owner may make about the game: game.json `"license"` names an SPDX
+ * identifier ("MIT", "CC-BY-4.0"), as the word or as { "spdx": "<id>" }. The game's page, its structured data and
+ * /llms.txt say it. A game that names none says nothing: no licence is granted, and no page pretends otherwise.
  *
- *   "remix-with-credit"  the default: remix it, and the remix says "Remix of <game> by <studio>" with a link back
- *   "remix-freely"       remix it; the credit is welcome, not asked for (the remix flow still writes it)
- *   "no-remix"           the source can be read, not remixed: the remix flow refuses
+ * REMIX WAS RETIRED. A game used to be handed over whole (its source at /games/<id>/source.json, brought in with
+ * `game remix`), and `"license"` also took three words about that: "remix-with-credit", "remix-freely" and
+ * "no-remix". Games now build on each other through parts, pieces a studio chooses to share (parts/PARTS.md), each
+ * under its own SPDX licence. Nothing here grants or refuses a remix any more:
  *
- * Either the word, or { "kind": "<word>", "spdx": "<SPDX id>" } to name a licence too (e.g. "MIT", "CC-BY-4.0"); a
- * bare SPDX id ("MIT") is the default kind with that id. Anything else is the default.
- *
- * A remix's game.json `remixOf` (written by `homie-studio game remix`) is its lineage: the original's name, studio
- * and page, shown on the remix's landing ("Remix of <game> by <studio>") and in its credits.
+ *   - the three words, and `"kind"` in the object form, are read as no licence named (an SPDX id beside them stays);
+ *   - game.json `"remix"`, `"share"` and `landing.make` are ignored; retiredKeys() names the ones a game still
+ *     carries, so the build can say so once;
+ *   - `"remixOf"`, which `game remix` wrote into a game it made, is still read: it is a credit that game owes its
+ *     original, and its landing and credits keep showing it ("Based on <game> by <studio>", basedOnRow()).
  */
-export const LICENSE_KINDS = Object.freeze({
-  'remix-with-credit': 'Remix with credit',
-  'remix-freely': 'Remix freely',
-  'no-remix': 'Not for remixing',
-});
-export const DEFAULT_LICENSE = 'remix-with-credit';
 const SPDX = /^[A-Za-z0-9][A-Za-z0-9.+-]{0,63}$/;
+/** The three words `"license"` took while a game could be handed over whole: none of them is a licence. */
+const RETIRED_KINDS = new Set(['remix-with-credit', 'remix-freely', 'no-remix']);
 
-/** { kind, spdx } from what game.json (or a source.json) says. */
+/** { spdx } from what game.json (or a built catalogue row) says, or null when it names no licence. */
 export function licenseOf(value) {
-  const v = typeof value === 'string'
-    ? (Object.hasOwn(LICENSE_KINDS, value.trim()) ? { kind: value.trim() } : { spdx: value })
-    : value && typeof value === 'object' ? value : {};
-  const kind = Object.hasOwn(LICENSE_KINDS, v.kind) ? v.kind : DEFAULT_LICENSE;
-  const spdx = typeof v.spdx === 'string' && SPDX.test(v.spdx.trim()) ? v.spdx.trim() : null;
-  return { kind, spdx };
+  const v = typeof value === 'string' ? value : value && typeof value === 'object' ? value.spdx : null;
+  const spdx = typeof v === 'string' && SPDX.test(v.trim()) && !RETIRED_KINDS.has(v.trim()) ? v.trim() : null;
+  return spdx ? { spdx } : null;
 }
 
-/** "Remix with credit (MIT)". */
-export function licenseLabel(value) {
-  const l = licenseOf(value);
-  return `${LICENSE_KINDS[l.kind]}${l.spdx ? ` (${l.spdx})` : ''}`;
-}
+/** "MIT", or null for a game that names no licence. */
+export const licenseLabel = (value) => licenseOf(value)?.spdx ?? null;
 
-/** Whether the owner lets the game be remixed. */
-export const remixAllowed = (value) => licenseOf(value).kind !== 'no-remix';
+/**
+ * The retired settings a game.json still carries, as the words to print: `"remix"`, `"share"`, `landing.make`, and
+ * a `"license"` that is one of the three old words (or has a `"kind"`). `"remixOf"` is not one: it is still read.
+ */
+export function retiredKeys(g) {
+  const out = [];
+  if (g?.remix !== undefined) out.push('"remix"');
+  if (g?.share !== undefined) out.push('"share"');
+  const lic = g?.license;
+  if ((typeof lic === 'string' && RETIRED_KINDS.has(lic.trim())) || (lic && typeof lic === 'object' && lic.kind !== undefined)) out.push(`"license": ${JSON.stringify(typeof lic === 'string' ? lic.trim() : String(lic.kind)).slice(0, 40)}`);
+  if (g?.landing && typeof g.landing === 'object' && g.landing.make !== undefined) out.push('landing.make');
+  return out;
+}
 
 const line = (v, max) => (typeof v === 'string' && v.trim() ? v.replace(/[\x00-\x1f\x7f]+/g, ' ').trim().slice(0, max) : null);
 /** An https address, else null. */
@@ -48,8 +51,8 @@ export function httpsPage(v) {
   try { const u = new URL(String(v ?? '')); return u.protocol === 'https:' ? u.href : null; } catch { return null; }
 }
 
-/** A game's page from its source address: https://<site>/games/<id>/source.json is https://<site>/<id>/. */
-export function pageOfSource(source) {
+/** A game's page from the address its source once had: https://<site>/games/<id>/source.json is https://<site>/<id>/. */
+function pageOfSource(source) {
   try {
     const u = new URL(String(source ?? ''));
     const m = /^\/games\/([a-z0-9][a-z0-9-]{0,39})\/source\.json$/.exec(u.pathname);
@@ -58,17 +61,18 @@ export function pageOfSource(source) {
 }
 
 /**
- * What a game.json `remixOf` may show: the original's name, studio and page (an https link; a remix made before
- * 0.14.4 has only its source address, which names the page too), plain text only.
+ * The credit a game owes the game it was made from, as it may be shown: the original's name, studio and page (an
+ * https link), plain text only. Read from game.json `"remixOf"` (what `game remix` wrote; one made before 0.14.4
+ * has only the original's source address, which names its page too) or from a built catalogue row's `basedOn`.
  */
-export function remixRow(r) {
+export function basedOnRow(r) {
   if (!r || typeof r !== 'object') return null;
   const name = line(r.name, 80);
   return name ? { name, studio: line(r.studio, 80), page: httpsPage(r.page) ?? pageOfSource(r.source) } : null;
 }
 
-/** "Remix of Gem Rush by Night Owl Games" (the studio left out when the source named none). */
-export function remixCredit(r) {
-  const row = remixRow(r);
-  return row ? `Remix of ${row.name}${row.studio ? ` by ${row.studio}` : ''}` : null;
+/** "Based on Gem Rush by Night Owl Games" (the studio left out when the record named none). */
+export function basedOnCredit(r) {
+  const row = basedOnRow(r);
+  return row ? `Based on ${row.name}${row.studio ? ` by ${row.studio}` : ''}` : null;
 }

package/worker/office-page.mjs

@@ -226,16 +226,12 @@ export const OFFICE_SCRIPT = String.raw`(function () {
       b.setAttribute('data-v', p[0]); b.setAttribute('aria-pressed', g.launch === p[0] ? 'true' : 'false');
       st.appendChild(b);
     });
-    var remix = el('input', 'switch'); remix.type = 'checkbox'; remix.checked = g.remix; remix.disabled = !g.remixBuilt;
-    remix.setAttribute('aria-label', 'Remixable');
-    remix.onchange = function () { act('/_studio/api/game', { game: g.id, remix: remix.checked }, remix.checked ? g.name + '\'s source is open for remixing.' : g.name + '\'s source is withdrawn.'); };
     var max = el('input'); max.type = 'number'; max.min = '1'; max.max = String(g.seats); max.value = String(g.maxPlayers); max.setAttribute('aria-label', 'Players per room');
     var setMax = btn('Set', 'ghost small', function () {
       var n = Math.floor(Number(max.value));
       act('/_studio/api/game', { game: g.id, maxPlayers: n >= g.seats ? null : n }, 'Rooms of ' + g.name + ' now hold ' + Math.min(n, g.seats) + '.');
     });
     add(box, st,
-      add(el('label'), remix, el('span', '', !g.remixBuilt ? 'Remixable (not in the build)' : g.license === 'no-remix' ? 'Source shared (its licence: not for remixing)' : 'Remixable')),
       add(el('label'), el('span', 'dim', 'Players per room'), max, el('span', 'faint', 'of ' + g.seats), setMax),
       add(el('span', 'faint'), document.createTextNode(g.launchFrom === 'game.json' ? 'state from game.json' : '')));
     return box;

package/worker/office-schema.mjs

@@ -1,5 +1,11 @@
 /** The back office's D1 tables (worker/office.mjs), as the template's migration 0003 and `homie-studio upgrade` write them. */
 export const OFFICE_MIGRATION_FILE = '0005_studio_office.sql';
+/*
+ * This text is a migration that has run in studios in the field: it is never edited, not even its first comment.
+ * `office_games.remix` (the owner's switch for handing a game over whole) is still made here and still in every
+ * studio's table, though remix was retired: worker/office.mjs neither reads nor writes it, and no later migration
+ * drops it.
+ */
 export const OFFICE_MIGRATION = `-- The studio's back office (@homie-rocks/studio 0.13.0): each game's launch state, remix switch and room size,
 -- its invites and the passes they gave, and the controls the owner's AI asked the owner to confirm.
 CREATE TABLE IF NOT EXISTS office_games (

package/worker/office.mjs

@@ -4,7 +4,7 @@
  *
  *   /_studio/office              the owner's live view: every live room of every game (players, bots, round,
  *                                uptime) and who is in it, refreshing by itself; kick, mute, announce, close a room;
- *                                each game's launch state, remix switch, room size and invites
+ *                                each game's launch state, room size and invites
  *   /_studio/confirm/<ask>       a control the owner's AI asked for, waiting for the owner's one tap
  *   /_studio/api/...             the same, as JSON, for the page, the in-game owner overlay, the CLI and the MCP
  *   /<game>/invite               an invite code, spent for this browser's pass to an invite-only game
@@ -14,8 +14,8 @@
  * office key (`homie-studio office key`, also minted with that login; D1 keeps only its SHA-256). A player can
  * never be the owner: the session is an HttpOnly cookie no page or game can read, and the games run in a sandboxed,
  * opaque-origin frame that can send no request as this site. With an office key, the AI can look, announce and
- * make invites; a control that takes something away (kick, mute, closing a room, a game's launch state, remix
- * switch or room size) only becomes an ASK, which the owner confirms with one tap in their signed-in browser.
+ * make invites; a control that takes something away (kick, mute, closing a room, a game's launch state
+ * or room size) only becomes an ASK, which the owner confirms with one tap in their signed-in browser.
  * No key can confirm an ask.
  *
  * CONTROLS ARE SIGNED. The Worker hands a room a control as a `ctl` message signed with the studio's own office
@@ -28,8 +28,12 @@
  * is left out of the studio's pages, /api/games, /api/rooms and the directory manifest, so the directory drops it
  * the next time it reads the studio; its own pages, rooms and play frame refuse anyone without access (the play
  * frame and its sockets carry a signed ticket the play page mints). A Preview (no D1, an unlisted address of a
- * branch under review) enforces no launch state. The remix switch publishes or withdraws the game's
- * /games/<id>/source.json (a game.json `"share": { "source": false }` builds none to publish).
+ * branch under review) enforces no launch state.
+ *
+ * `office_games` also has a `remix` column: the owner's switch for handing a game over whole, from when that existed
+ * (remix was retired). A migration that ran in the field is never edited and the column is never dropped, so it
+ * stays in the table with whatever it held; nothing here reads it and nothing writes it (settingsOf, the `game`
+ * action below).
  *
  * PLAYER ACCOUNTS (worker/players.mjs, handed over in worker/index.mjs with `usePlayers()`): `of(request, env)` names
  * the signed-in player in their play page's ticket, so their seat carries their account and a kick holds it on every
@@ -61,7 +65,6 @@ import { DEFAULT_MODEL, NEURONS_PER_M, OWNER_MODEL, vocabularyOf } from './brain
 import { OWNER_COOKIE, cookieValues, counter, ownerAllowed, ownerSession, today } from './stats.mjs';
 import { esc, layout, notFoundPage } from './site.mjs';
 import { confirmPage, lockedPage, officePage } from './office-page.mjs';
-import { licenseOf } from './license.mjs';
 import { CHAT_MODES, CHAT_WHO, checkChatRules, publicChat } from './chat.mjs';
 import { chatDay, chatOf, chatRowsOf, clearChatRules, dismissReport, reportsOf, writeChatRules } from './chat-store.mjs';
 import { checkRefund, checkSettle, describeRefund, officeShopPage, ordersCsv, performRefund, settleReferrer, shopOffice, statementsOut, statementsSend } from './shop.mjs';
@@ -178,7 +181,7 @@ export async function settingsOf(env, { fresh = false } = {}) {
   if (!fresh && hit && Date.now() - hit.at < 5000) return hit.map;
   let map = new Map();
   try {
-    const { results } = await env.DB.prepare('SELECT game, launch, remix, max_players, updated_at FROM office_games LIMIT 500').all();
+    const { results } = await env.DB.prepare('SELECT game, launch, max_players, updated_at FROM office_games LIMIT 500').all();
     map = new Map((results ?? []).map((r) => [r.game, r]));
   } catch { map = new Map(); }
   settingsCache.set(env.DB, { at: Date.now(), map });
@@ -192,11 +195,6 @@ export function launchOf(meta, settings, env) {
   const v = settings?.get(meta?.id)?.launch ?? meta?.launch ?? 'public';
   return LAUNCH_STATES.includes(v) ? v : 'public';
 }
-/** Whether the game's source is offered for remix: built (game.json share.source) and not withdrawn by the owner. */
-export function remixOf(meta, settings) {
-  if (meta?.landing?.source === false) return false;
-  return settings?.get(meta?.id)?.remix !== 0;
-}
 /** A room's seats: the game's own (its netplay manifest), lowered by the owner's room size. */
 export function seatsFor(meta, settings) {
   const own = seatsOf(meta);
@@ -616,7 +614,6 @@ export async function officeView(env, cat, origin) {
       // 0.17.0: the game's AI guides have words of their own (agents.json): without it they play but never talk.
       vocab: g.vocab === true,
       passes: (await passList(env, { game: g.id })).filter((x) => x.live || Date.now() - x.createdAt < 7 * 86_400_000),
-      remix: remixOf(g, settings), remixBuilt: g.landing?.source !== false, license: licenseOf(g.license).kind,
       seats: seatsOf(g), maxPlayers: max, maxSet: Number(row?.max_players) >= 1 ? Number(row.max_players) : null,
       play: `${origin}/${g.id}/play`, page: `${origin}/${g.id}/`,
       invites: launch === 'invite' || (await hasInvites(env, g.id)) ? await invitesOf(env, g.id, origin) : [],
@@ -691,7 +688,6 @@ function checkAction(cat, op, body) {
       if (!meta) return bad('game is one of this studio\'s game ids');
       const launch = body.launch === undefined || body.launch === null ? undefined : String(body.launch);
       if (launch !== undefined && !LAUNCH_STATES.includes(launch)) return bad('launch is private, invite or public');
-      const remix = body.remix === undefined || body.remix === null ? undefined : body.remix === true || body.remix === 'on';
       let maxPlayers;
       if (body.maxPlayers === null || body.maxPlayers === 'game') maxPlayers = null;
       else if (body.maxPlayers !== undefined) {
@@ -699,9 +695,10 @@ function checkAction(cat, op, body) {
         if (!(maxPlayers >= 1)) return bad('maxPlayers is a number from 1 to the game\'s own seats, or null for the game\'s own');
         maxPlayers = Math.min(maxPlayers, seatsOf(meta));
       }
-      if (launch === undefined && remix === undefined && maxPlayers === undefined) return bad('say what to change: launch, remix or maxPlayers');
-      if (remix === true && meta.landing?.source === false) return bad(`${meta.name}'s source is not in its build (game.json "share": { "source": false }); set it to true and deploy first`);
-      return { ok: true, action: { op, game: meta.id, ...(launch !== undefined ? { launch } : {}), ...(remix !== undefined ? { remix } : {}), ...(maxPlayers !== undefined ? { maxPlayers } : {}) } };
+      // An older plugin or CLI may still send `remix` (the switch that offered a game whole). It is not a setting
+      // any more: alone it is refused in a sentence, and beside a launch state or a room size it is left out.
+      if (launch === undefined && maxPlayers === undefined) return bad(body.remix !== undefined && body.remix !== null ? 'remix was retired: a game is no longer handed over whole, so there is no switch to set. A studio shares pieces of its games as parts (/parts/)' : 'say what to change: launch or maxPlayers');
+      return { ok: true, action: { op, game: meta.id, ...(launch !== undefined ? { launch } : {}), ...(maxPlayers !== undefined ? { maxPlayers } : {}) } };
     }
     case 'server-create': {
       if (!meta) return bad('game is one of this studio\'s game ids');
@@ -822,7 +819,6 @@ export function describe(cat, a) {
     case 'game': {
       const bits = [];
       if (a.launch) bits.push({ private: `make ${gname} private (only you can open it; after the current round everyone else leaves its rooms with a thank-you, and it leaves the directory on the next read)`, invite: `make ${gname} an invite-only beta (invited players only; after the current round everyone else leaves its rooms with a thank-you, and it leaves the directory on the next read)`, public: `make ${gname} public (anyone can play; listed in the directory on the next read)` }[a.launch]);
-      if (a.remix !== undefined) bits.push(a.remix ? `publish ${gname}'s source for remixing` : `withdraw ${gname}'s source from remixing`);
       if (a.maxPlayers !== undefined) bits.push(a.maxPlayers === null ? `give ${gname}'s rooms the game's own number of seats` : `set ${gname}'s rooms to at most ${a.maxPlayers} players`);
       const s = bits.join('; ');
       return `${s.charAt(0).toUpperCase()}${s.slice(1)}.`;
@@ -950,16 +946,16 @@ export async function perform(env, cat, a) {
       const row = settings.get(meta.id) ?? {};
       const next = {
         launch: a.launch ?? row.launch ?? null,
-        remix: a.remix === undefined ? (row.remix ?? null) : (a.remix ? 1 : 0),
         max: a.maxPlayers === undefined ? (row.max_players ?? null) : a.maxPlayers,
       };
-      await env.DB.prepare(`INSERT INTO office_games (game, launch, remix, max_players, updated_at) VALUES (?1, ?2, ?3, ?4, ?5)
-        ON CONFLICT(game) DO UPDATE SET launch = excluded.launch, remix = excluded.remix, max_players = excluded.max_players, updated_at = excluded.updated_at`)
-        .bind(meta.id, next.launch, next.remix, next.max, Date.now()).run();
+      // The table's `remix` column is not named: a new row leaves it NULL and an old row keeps what it had (above).
+      await env.DB.prepare(`INSERT INTO office_games (game, launch, max_players, updated_at) VALUES (?1, ?2, ?3, ?4)
+        ON CONFLICT(game) DO UPDATE SET launch = excluded.launch, max_players = excluded.max_players, updated_at = excluded.updated_at`)
+        .bind(meta.id, next.launch, next.max, Date.now()).run();
       forgetSettings(env);
       const fresh = await settingsOf(env, { fresh: true });
       const launch = launchOf(meta, fresh, env);
-      const done = { ok: true, op: 'game', game: meta.id, launch, remix: remixOf(meta, fresh), maxPlayers: seatsFor(meta, fresh), regating: 0 };
+      const done = { ok: true, op: 'game', game: meta.id, launch, maxPlayers: seatsFor(meta, fresh), regating: 0 };
       const rooms = await liveRooms(env, meta.id);
       // Who may play changed: every live room finishes its current round, with a notice, and then whoever the new
       // state leaves out is sent out of it (the owner, and in an invite-only beta the invited, play on). Back to a

package/worker/pages.mjs

@@ -4,6 +4,7 @@
  */
 import { esc, layout } from './site.mjs';
 import { NET_PALETTE } from './room.mjs';
+import { PARAM_VALUE, PREFS_LIMITS, playParams } from './seats.mjs';
 import { SKILLS } from './agents.mjs';
 import { KIDS_LINE, POLICY_WORDS } from './servers.mjs';
 import { SAVES_SHELL_CSS, SAVES_SHELL_JS } from './saves-shell.mjs';
@@ -101,7 +102,7 @@ export function playPage(cat, g, { screen = false, joinUrl = null, qr = null, lo
   const arrive = arrivalCard(cat, g, { screen });
   const css = `:root{--hot:${/^#[0-9a-f]{3,8}$/i.test(accent) ? accent : '#ffcf5a'}}
 html, body { height: 100%; margin: 0; overflow: hidden; overscroll-behavior: none; background: #04060c; touch-action: none; -webkit-user-select: none; user-select: none; -webkit-touch-callout: none; -webkit-tap-highlight-color: transparent; }
-iframe.game { position: fixed; inset: 0; width: 100%; height: 100%; border: 0; display: block; background: #04060c; touch-action: none; }
+iframe.game { position: fixed; inset: 0; width: 100%; height: 100%; border: 0; display: block; background: #04060c; touch-action: none; -webkit-user-select: none; user-select: none; -webkit-touch-callout: none; }
 .chip { position: fixed; left: max(10px, env(safe-area-inset-left)); bottom: max(10px, env(safe-area-inset-bottom)); z-index: 5; padding: 6px 10px; border-radius: 999px; background: rgba(0,0,0,.55); color: #dfe6f5; font: 12px/1.2 ui-sans-serif, system-ui, sans-serif; pointer-events: none; backdrop-filter: blur(6px); -webkit-backdrop-filter: blur(6px); transition: opacity .6s; }
 .chip.quiet { opacity: 0; }
 .card { position: fixed; right: 12px; bottom: 12px; z-index: 4; max-width: 300px; padding: 10px 12px; border-radius: 12px; background: rgba(8,12,22,.82); border: 1px solid rgba(255,255,255,.14); color: #e8ecf5; font: 13px/1.35 ui-sans-serif, system-ui, sans-serif; }
@@ -171,7 +172,8 @@ ${arrive.css}${SERVER_CSS}${CHAT_CSS}${g.saves && !screen ? SAVES_SHELL_CSS : ''
   const srv = server ? { id: server.id, name: server.name, badge: server.badge, line: server.line, policy: server.policy, kids: Boolean(server.kids), mentor: Boolean(server.mentor), levelMax: server.levelMax } : null;
   // game.json "agents": { "vote": "game" } draws its own vote card; false turns the vote off (section 17).
   const vote = g.agents?.vote === 'game' || g.agents?.vote === false ? g.agents.vote : 'shell';
-  const boot = { game: g.id, name: g.name, screen: Boolean(screen), share: places, ...(room ? { room } : {}), ...(ticket ? { t: ticket } : {}), ...(owner ? { owner: true, launch } : {}), ...(srv ? { server: srv } : {}), vote, skills: SKILLS.map((k) => ({ level: k.level, name: k.name, card: k.card })), words: POLICY_WORDS, kidsLine: KIDS_LINE, ...(shop ? { shop } : {}) };
+  // The address's switches the game's frame is handed (NETPLAY.md section 24): the defaults and the game's own names.
+  const boot = { game: g.id, name: g.name, screen: Boolean(screen), share: places, params: playParams(g), paramValue: PARAM_VALUE, prefs: PREFS_LIMITS, ...(room ? { room } : {}), ...(ticket ? { t: ticket } : {}), ...(owner ? { owner: true, launch } : {}), ...(srv ? { server: srv } : {}), vote, skills: SKILLS.map((k) => ({ level: k.level, name: k.name, card: k.card })), words: POLICY_WORDS, kidsLine: KIDS_LINE, ...(shop ? { shop } : {}) };
   // game.json "screen": { "join": "top-left" | "top-right" | "bottom-left" | "bottom-right" } keeps the card off the game's own HUD.
   const joinCorner = corner('join', 'bottom-right');
   const first = places.desk;
@@ -401,25 +403,47 @@ const SHELL_JS = String.raw`(function () {
       }
     } catch (e) {}
     var KEY = 'homie-net.' + boot.game + '.' + room + '.' + want;
-    var token = null;
-    try { token = sessionStorage.getItem(KEY); } catch (e) {}
-    var q = new URLSearchParams({ room: room, device: device, want: want });
-    if (token) q.set('k', token);
-    q.set('b', roomKey);
-    if (boot.t) q.set('t', boot.t);
-    if (params.get('name')) q.set('name', params.get('name'));
-    else {
-      // A player with an account (or a named guest) on this studio plays under their own name in every room.
-      try { var who = JSON.parse(localStorage.getItem('homie.player') || 'null'); if (who && typeof who.name === 'string' && who.name) q.set('name', who.name.slice(0, 24)); } catch (e) {}
+    // The frame's address, made again for a reload of the game (a newer build, section 23): the seat's token as it is now.
+    function frameUrl() {
+      var token = null;
+      try { token = sessionStorage.getItem(KEY); } catch (e) {}
+      var q = new URLSearchParams({ room: room, device: device, want: want });
+      if (token) q.set('k', token);
+      q.set('b', roomKey);
+      if (boot.t) q.set('t', boot.t);
+      if (params.get('name')) q.set('name', params.get('name'));
+      else {
+        // A player with an account (or a named guest) on this studio plays under their own name in every room.
+        try { var who = JSON.parse(localStorage.getItem('homie.player') || 'null'); if (who && typeof who.name === 'string' && who.name) q.set('name', who.name.slice(0, 24)); } catch (e) {}
+      }
+      // Quiet AI (this browser hides AI speech): the helper starts hushed, and hears a change by message.
+      if (state.quietAi) q.set('hush', '1');
+      // Room chat (section 19): this browser's "Show chat" and "Show my messages over my character", for the game's bubbles.
+      try { if (localStorage.getItem('homie-chat-show') === '0') q.set('chat', '0'); if (localStorage.getItem('homie-chat-bubble') === '0') q.set('bub', '0'); } catch (e) {}
+      // The frame cannot read this page's address (it is an opaque origin): hand it the game's own switches (section 24).
+      // An allow-list: ?debug and ?q always, the port kit's three, and the names game.json "netplay.params" declares;
+      // never one this page uses itself (the room, the token, the ticket). The game reads them as net.params.
+      var okValue = new RegExp(boot.paramValue || '^[A-Za-z0-9_.~-]{0,48}$');
+      (boot.params || ['debug', 'q', 'touchdebug', 'cam', 'view']).forEach(function (k) { var v = params.get(k); if (v !== null && okValue.test(v)) q.set(k, v); });
+      // This page keeps net.prefs for the frame (section 24).
+      q.set('pf', '1');
+      return '/' + boot.game + '/__game/?' + q.toString();
     }
-    if (params.get('debug') === '1') q.set('debug', '1');
-    // Quiet AI (this browser hides AI speech): the helper starts hushed, and hears a change by message.
-    if (state.quietAi) q.set('hush', '1');
-    // Room chat (section 19): this browser's "Show chat" and "Show my messages over my character", for the game's bubbles.
-    try { if (localStorage.getItem('homie-chat-show') === '0') q.set('chat', '0'); if (localStorage.getItem('homie-chat-bubble') === '0') q.set('bub', '0'); } catch (e) {}
-    // The frame cannot read this page's address (it is an opaque origin): hand it the game's own switches.
-    ['touchdebug', 'cam', 'view'].forEach(function (k) { var v = params.get(k); if (v && /^[A-Za-z0-9_-]{1,16}$/.test(v)) q.set(k, v); });
-    frame.src = '/' + boot.game + '/__game/?' + q.toString();
+    state.params = {};
+    (boot.params || []).forEach(function (k) { var v = params.get(k); if (v !== null && new RegExp(boot.paramValue || '^$').test(v)) state.params[k] = v; });
+    // A newer build of the game is live (section 23): load the frame again, at most twice a minute (a build whose
+    // files are still the old ones at the edge would otherwise reload for ever).
+    var reloads = [];
+    function reloadGame() {
+      var t = Date.now();
+      reloads = reloads.filter(function (x) { return t - x < 60000; });
+      if (reloads.length >= 2) { flash('This game was updated. Reload the page to play the new version.'); return false; }
+      reloads.push(t);
+      state.stale = null; state.closed = null; state.reloaded = (state.reloaded || 0) + 1;
+      try { frame.src = frameUrl(); } catch (e) {}
+      return true;
+    }
+    frame.src = frameUrl();
     A.room(labelOf(room));
     frame.addEventListener('load', function () { A.frameLoaded(); try { frame.focus(); frame.contentWindow.focus(); } catch (e) {} });
     window.addEventListener('pointerdown', function (e) { if ((ui && ui.contains(e.target)) || (e.target.closest && e.target.closest('[data-keep-focus]'))) return; try { frame.focus(); } catch (e2) {} }, { passive: true });
@@ -428,10 +452,26 @@ const SHELL_JS = String.raw`(function () {
       var m = ev.data;
       if (!m || typeof m !== 'object' || m.t !== 'homie-net') return;
       A.message(m);
-      if (m.what === 'attached') state.attached = true;
+      if (m.what === 'attached') { state.attached = true; lastRects = ''; tellRects(); }
+      // The link (section 22): in the room, knocking again, or playing alone because the room never answered.
+      if (m.what === 'link' && typeof m.state === 'string') state.link = { state: m.state, why: String(m.why || ''), hosting: m.hosting === true, at: Date.now() };
+      // The game's own word that it was playable (section 21), beside who lifted the card: a late one is a game whose
+      // arrival should be 'game'. A performance probe reads both here.
+      if (m.what === 'ready') {
+        state.ready = { mode: m.mode === 'game' ? 'game' : 'auto', ms: Number(m.ms) || 0, lateMs: typeof m.lateMs === 'number' ? m.lateMs : null, atMs: Math.round(typeof performance !== 'undefined' && performance.now ? performance.now() : Date.now()) };
+        if (A.state) { A.state.explicitMs = state.ready.atMs; A.state.lateMs = state.ready.lateMs; }
+      }
+      if (m.what === 'prefs') answerPrefs(m);
+      // A newer build of the game is live. Kept out of a room for it (final): the game loads again now. Still
+      // playing in its own room: it loads again at the round's break, or at once on a big screen (nothing to lose).
+      if (m.what === 'stale') {
+        state.stale = { ver: typeof m.ver === 'string' ? m.ver : null, final: m.final === true };
+        if (m.final === true || screenMode) reloadGame();
+        else flash('A new version of ' + boot.name + ' is ready: it loads after this round.');
+      }
       if (m.what === 'token' && typeof m.token === 'string') { state.seat = m.seat; try { sessionStorage.setItem(KEY, m.token); } catch (e) {} if (window.__homieChat) window.__homieChat.seat(); }
       if (m.what === 'stats') state.stats = m.stats;
-      if (m.what === 'round') onRound(m.round);
+      if (m.what === 'round') { onRound(m.round); if (state.stale && m.round && m.round.phase === 'over') reloadGame(); }
       if (m.what === 'roster') state.roster = m.slots;
       if (m.what === 'closed') { state.closed = m.why; if (m.why === 'kicked' || m.why === 'room-closed' || m.why === 'agents-off') notice(m.why === 'kicked' ? 'kicked' : 'closed', m); }
       // A game's net.pickPlayer(seat): only an owner's page listens (its overlay opens that player's card).
@@ -440,6 +480,8 @@ const SHELL_JS = String.raw`(function () {
     });
     watch(room);
     shareReady(room);
+    addEventListener('resize', tellRects);
+    if (typeof setInterval === 'function') setInterval(tellRects, 1000);
     if (screenMode && !document.querySelector('[data-join]') && !LOCAL) {
       var h2 = document.createElement('h2'); h2.textContent = 'Join on your phone';
       var div = document.createElement('div'); div.textContent = location.origin + '/' + boot.game + '/play?room=' + encodeURIComponent(room);
@@ -447,6 +489,79 @@ const SHELL_JS = String.raw`(function () {
     }
   }
 
+  /*
+   * NET.PREFS (NETPLAY.md section 24). The game's frame is an opaque origin (no allow-same-origin: a stranger's game
+   * must never read this site's storage, cookies or the owner's session), so its own localStorage throws. This page
+   * keeps a few settings for it instead: one JSON object per game under this site's storage, 16 KB and 32 keys at
+   * most, read and written only for this page's own game. With no storage (a private window): for the visit.
+   */
+  var PREFS_KEY = 'homie-prefs.' + boot.game;
+  var PREFS = boot.prefs || { bytes: 16384, keys: 32, key: 64 };
+  var prefsMem = null;
+  function prefsRead() {
+    if (prefsMem) return prefsMem;
+    try { var o = JSON.parse(localStorage.getItem(PREFS_KEY) || '{}'); return o && typeof o === 'object' && !Array.isArray(o) ? o : {}; } catch (e) { prefsMem = {}; return prefsMem; }
+  }
+  function prefsWrite(o) {
+    var text = JSON.stringify(o);
+    if (typeof text !== 'string' || text.length > PREFS.bytes || Object.keys(o).length > PREFS.keys) return 'too-large';
+    if (prefsMem) { prefsMem = o; return 'memory'; }
+    try { localStorage.setItem(PREFS_KEY, text); return 'kept'; } catch (e) { prefsMem = o; return 'memory'; }
+  }
+  function answerPrefs(m) {
+    var out = { t: 'homie-prefs', n: m.n, ok: false };
+    try {
+      var all = prefsRead();
+      var k = m.k;
+      var okKey = typeof k === 'string' && k.length > 0 && k.length <= PREFS.key && k !== '__proto__';
+      if (m.op === 'all') { out.ok = true; out.all = all; }
+      else if (!okKey) out.why = 'key';
+      else if (m.op === 'set' || m.op === 'del') {
+        var next = {};
+        Object.keys(all).forEach(function (x) { if (x !== k) next[x] = all[x]; });
+        if (m.op === 'set' && m.v !== null && m.v !== undefined) next[k] = m.v;
+        var how = prefsWrite(next);
+        if (how === 'too-large') out.why = how; else { out.ok = true; out.kept = how; }
+      } else out.why = 'op';
+    } catch (e) { out.why = 'error'; }
+    state.prefs = { op: m.op, ok: out.ok, why: out.why || null };
+    try { frame.contentWindow.postMessage(out, '*'); } catch (e2) {}
+  }
+
+  /*
+   * WHERE THIS PAGE'S OWN CONTROLS SIT OVER THE GAME (section 24). The frame fills the page, so these rectangles are
+   * in the game's own CSS pixels. A game's HUD check that only measures inside the frame cannot see them: the room
+   * button, the server pill, the chat pill, the "3 playing" chip (it fades, and comes back), the big screen's join
+   * card, the studio's banner. Said to the helper when it attaches, on a resize or a turn, and when one moves.
+   */
+  var RECTS = [['room', '[data-share-toggle]'], ['server', '[data-server-toggle]'], ['chat', '[data-chat-toggle]'], ['chip', '[data-chip]', true], ['join', '[data-join]'], ['banner', '[data-banner]'], ['ticker', '.ctick', true], ['results', '[data-results]'], ['screen', '[data-screen]'], ['sheet', '[data-share-sheet]'], ['server-sheet', '[data-server-sheet]'], ['vote', '[data-vote]']];
+  var lastRects = '';
+  function shellRects() {
+    var out = [];
+    RECTS.forEach(function (r) {
+      var el = null;
+      try { el = document.querySelector(r[1]); } catch (e) { el = null; }
+      if (!el || el.hidden || typeof el.getBoundingClientRect !== 'function') return;
+      var b = el.getBoundingClientRect();
+      if (!b || !(b.width > 0) || !(b.height > 0)) return;
+      var o = { id: r[0], x: Math.round(b.left), y: Math.round(b.top), w: Math.round(b.width), h: Math.round(b.height) };
+      if (r[2]) o.fades = true;
+      out.push(o);
+    });
+    return out;
+  }
+  function tellRects() {
+    if (!state.attached) return;
+    var w = typeof innerWidth === 'number' ? innerWidth : 0;
+    var h = typeof innerHeight === 'number' ? innerHeight : 0;
+    var msg = { t: 'homie-shell', device: device, orientation: w > h ? 'landscape' : 'portrait', width: w, height: h, rects: shellRects() };
+    var sig = JSON.stringify(msg);
+    if (sig === lastRects) return;
+    lastRects = sig;
+    state.rects = msg;
+    try { frame.contentWindow.postMessage(msg, '*'); } catch (e) {}
+  }
+
   function onRound(r) {
     if (!r) return;
     state.round = r;
@@ -566,6 +681,9 @@ const SHELL_JS = String.raw`(function () {
     if (f && f.counts && f.counts.watchers) bits.push(f.counts.watchers + ' watching');
     if (state.full) bits.push('waiting for a seat');
     if (state.closed) bits.push(state.closed === 'replaced' ? 'opened in another tab' : 'reconnecting');
+    // The link (section 22): cut off from the room and knocking again, or playing alone because it never answered.
+    else if (state.link && state.link.state === 'reconnecting') bits.push('reconnecting');
+    else if (state.link && state.link.state === 'alone') bits.push('offline, reconnecting');
     // The arrival card's line: the room and who is in it ("Room 2 · 3 playing · 2 AI").
     if (!A.done && state.room) A.facts([labelOf(state.room), n ? n + ' playing' : '', aiN ? aiN + ' AI' : ''].filter(Boolean).join(' · '));
     say(bits.join(' · ') || 'joining…');
@@ -899,7 +1017,7 @@ html, body { height: 100%; margin: 0; overflow: hidden; overscroll-behavior: non
 body { --u: clamp(12px, calc(0.8vmin + 7px), 22px); --band: #080b14; --line: rgba(255,255,255,.08); display: flex; flex-direction: column; font: 600 var(--u)/1.25 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif; }
 body.big { --u: clamp(16px, calc(1vmin + 6px), 32px); }
 .stage { position: relative; flex: 1; min-height: 0; background: #04060c; }
-iframe.game { position: absolute; inset: 0; width: 100%; height: 100%; border: 0; display: block; background: #04060c; }
+iframe.game { position: absolute; inset: 0; width: 100%; height: 100%; border: 0; display: block; background: #04060c; -webkit-user-select: none; user-select: none; -webkit-touch-callout: none; }
 .wtop { flex: none; display: flex; align-items: center; gap: calc(var(--u) * .7); padding: max(calc(var(--u) * .5), env(safe-area-inset-top)) max(calc(var(--u) * .9), env(safe-area-inset-right)) calc(var(--u) * .5) max(calc(var(--u) * .9), env(safe-area-inset-left)); background: linear-gradient(#0b0f1a, var(--band)); border-bottom: 1px solid var(--line); min-width: 0; }
 .grow { flex: 1; }
 .live { flex: none; display: inline-flex; align-items: center; gap: .45em; padding: .3em .7em .3em .6em; border-radius: 999px; background: rgba(255,59,92,.16); border: 1px solid rgba(255,90,120,.5); font-weight: 800; font-size: .74em; letter-spacing: .14em; text-transform: uppercase; color: #ffd9e0; }