@homie-rocks/studio 0.46.2 → 0.46.5

package/saves/SAVES.md

@@ -64,8 +64,8 @@ landing. Pressing Play never needs an account.
   security key. No password, no email. A guest who makes an account keeps everything: it is the same player.
 - **Another device**: "Sign in" with the same passkey. The device's own passkey sync carries it (iCloud Keychain,
   Google Password Manager, a password manager), or the browser offers a phone's QR code. The same saves are there.
-  A guest who signs in to an account they already have keeps the account's saves, and anything only the guest had
-  (keys, stats, memorials the account lacks) moves over.
+  A guest who signs in to an account they already have loses nothing: what only the guest had (keys, stats,
+  memorials) moves over, and a key both have is combined ("When a guest signs in to their account", below).
 - **Recovery**: add another passkey on another device or a security key (`/account/`). A **recovery email** is
   offered only when the studio has a mail sender: a Cloudflare Email Service binding named `PLAYER_MAIL`
   (`"send_email": [{ "name": "PLAYER_MAIL" }]` in wrangler.jsonc; Email Sending needs the Workers paid plan and a
@@ -130,6 +130,82 @@ an old offline copy of a dead hero is a conflict with the wipe, and the wipe win
 
 A write is atomic **per key**, not across keys: keep one character in one key.
 
+## When a guest signs in to their account
+
+Somebody plays as a guest, then signs in to the account they made on another device. Both players have saves.
+Whatever only the guest had moves to the account as it is (keys, stats, memorials), and the guest is gone. For a
+key **both** have, the game says how the two combine, once, when the studio's Worker loads
+(`site/src/worker.mjs`):
+
+```js
+import { mergeSaves } from '@homie-rocks/studio/worker';
+
+mergeSaves({
+  'night-run': {
+    saves: {
+      'server:career-v1': { union: 'matches', by: 'id', order: 'endedAt', keep: 100 },
+      settings: 'newer', 'best-level': 'larger', coins: 'sum', 'slot-*': 'account',
+      inventory: (guest, account, ctx) => ({ items: [...new Set([...account.items, ...guest.items])] }),
+    },
+    stats: { kills: 'sum', level: 'larger', 'best-time': 'smaller' },
+  },
+});
+```
+
+A name is the exact key, or a prefix ending in `*`. The exact key beats a prefix; a longer prefix beats a shorter
+one. A rule that is none of the ones below throws when the Worker loads, naming it.
+
+| A save's rule | The account ends with |
+| --- | --- |
+| `'account'`, `'guest'` | that side's value. |
+| `'newer'` | the one written last (a tie: the account's). |
+| `'larger'`, `'smaller'` | the larger or smaller of two numbers. `{ rule: 'larger', by: 'level' }` compares that number in two objects and keeps the whole object. |
+| `'sum'` | two numbers added; or two objects with every number they share added, and for anything else the account's (the guest's where the account has none). |
+| `{ union: 'matches', by: 'id', order: 'endedAt', keep: 100 }` | the account's object with that list joined to the guest's by `by` (on the same id, the account's entry), newest `order` first, cut to `keep`. `order` and `keep` are optional; `'union'` alone is exactly the rule shown. A joined list too large for a save loses entries from its end until it fits. |
+| `(guest, account, ctx) => value` | what the game's own function returns, run on the server. It may be async. `ctx` is `{ game, key, guest: { updatedAt, version }, account: { updatedAt, version } }`. |
+
+A stat's rule is `'sum'`, `'larger'`, `'smaller'`, `'guest'` or `'account'`.
+
+**With no rule**, and whenever a rule cannot apply (two values that are not numbers to compare, a function that
+throws, returns nothing, or returns more than a save holds), the default applies. It never fails the sign-in:
+
+1. Equal values: nothing to do.
+2. Two values of the **record shape** the room server writes (`{ matches: [{ id, … }] }`, every `id` a text):
+   joined by id, newest first. For a `server:` key the newest 100 are kept, the record's own bound; only the server
+   can write such a key, so nothing else could combine the two. A key the browser wrote that happens to have this
+   shape is joined the same way and not cut (it is cut only if it would not fit a save). Declare `'account'` for a
+   key of that shape that must not be joined.
+3. Anything else: the account's value stays, and the guest's is **handed back** to the browser that signed in. The
+   play page raises it as an ordinary conflict, `mine` the guest's value and `theirs` the account's: a game with
+   `onConflict` keeps or merges it, and its answer is written on top; without `onConflict` the account's stays and
+   the game hears `conflict` with `kept: 'theirs'`. A stat keeps the account's number.
+
+The sign-in answers with what happened, beside `adoptedGuest: true`:
+
+```js
+adopted: {
+  merged: [{ game, key, rule, took }],      // took: 'merged', 'guest' or 'account' (a rule chose it)
+  moved: 3,                                 // keys only the guest had
+  kept: [{ game, key, value }],             // case 3; `rule` and `error` when a declared rule could not apply
+  stats: { merged: [{ game, name, rule }], kept: [{ game, name, value }] },
+}
+```
+
+`kept` carries at most 256 KiB of values; past that a key is named with `truncated: true` and the play page uses
+its own copy of the guest's value. A sign-in on `/account/` has no game to ask, so there the account's simply stays.
+
+It happens **exactly once**, in the one database transaction of the sign-in. If a room writes a record to either
+player between the read and that transaction, the transaction fails whole, and it is read and tried again; after
+four tries the account keeps every key both have and the answer says `fallback: true`. A round that ended a moment
+before the sign-in writes its record a moment after, under the guest's id: the guest leaves a forwarding row
+(`saves`, game `''`, key `server:moved`) and the record follows it to the account.
+
+**What is new and what is a fix.** `mergeSaves` and its rules are opt-in: a studio that declares nothing has the
+results it always had for every key and stat (the account's stays). Two things changed for everyone, both fixes:
+server records are joined (a guest's verified matches used to vanish), and a value the account did not take is
+handed back instead of dropped. A merged value larger than 64 KiB falls to the default; a merge never counts
+against a game's 256 KiB.
+
 ## The hall of the fallen: a hardcore recipe
 
 ```ts
@@ -182,6 +258,10 @@ Migration `site/migrations/0004_players.sql` (deploy applies it; an older studio
 | `player_emails` | a recovery email, only if the player added one | |
 | `saves`, `player_stats`, `memorials` | what the game saved | anything the game did not |
 
+A guest who signed in to their account leaves two small rows in `saves` under game `''`: `server:moved` under the
+guest's id (the account's id and when) and `server:from:<guest>` under the account's. They are in no export and no
+count, and they are deleted with the account.
+
 - **The player** sees all of it at `/account/`, downloads it as one JSON file (`/api/player/export`), and deletes
   it all (`/api/player/delete`): their passkeys, sessions, saves, stats, memorials and email, and their large
   saves in R2. The page tells them to remove the passkey from their device too, and tells the device itself where
@@ -227,7 +307,7 @@ Same origin only (a POST must come from this site's own pages, as JSON). For ref
 | --- | --- |
 | `GET /api/player/me` | the signed-in player, the features (`accounts`, `email`), the limits |
 | `POST /api/player/signup/options`, `POST /api/player/signup` | make an account, or add a passkey to this browser's guest or account |
-| `POST /api/player/signin/options`, `POST /api/player/signin` | sign in with a passkey (discoverable: no name typed) |
+| `POST /api/player/signin/options`, `POST /api/player/signin` | sign in with a passkey (discoverable: no name typed): `{ ok, player, adoptedGuest, adopted? }` |
 | `POST /api/player/signout`, `POST /api/player/name`, `GET /api/player/passkeys`, `POST /api/player/passkeys/remove` | |
 | `GET /api/player/export`, `POST /api/player/delete` (`{ "confirm": "delete" }`) | everything, and nothing |
 | `GET /api/player/saves/<game>[?values=1]`, `GET /api/player/saves/<game>/<key>` | read |

package/saves/saves.ts

@@ -54,6 +54,8 @@ export interface SavesOptions {
    * Another device saved a key since this one's copy (this browser was offline, or two devices played at once).
    * Return the value to keep (merge them, or return `mine`), or `undefined` for the cloud's (the default: a stale
    * offline copy never overwrites newer progress, so a hardcore character cannot come back from the dead).
+   * It is also asked when a guest signs in to an account that has the same key with another value and no
+   * `mergeSaves` rule combined them on the server: `mine` is the guest's value, `theirs` the account's.
    */
   onConflict?: (c: Conflict) => unknown | Promise<unknown>;
   /** Tests and custom shells: where messages go (default: the parent frame) and the shell's answer window. */

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.46.2","sha256":"335192af92b18b0857b7a32abc28017670a609737ef888a592f78e75561d16f0"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.46.5","sha256":"6e01cf0c45cbe8649134cb3332feed0ba34c9ac39f3431d4c8374e0237345c0b"});

package/worker/index.mjs

@@ -92,7 +92,7 @@ import { NetRoom, WATCH_POLICIES, departure, errorLine, versionOf } from './room
 import { hostedGame, hostedBuild, compiledFor, startHost } from './hosted.mjs';
 import { roomStore, restoreDelay } from './room-store.mjs';
 import { appCors, isAppOrigin } from './standalone.mjs';
-import { ROOM_ID, badRoomPage, embedAncestors, embedPreview, frameAncestors, noWatchPage, playPage, watchPage } from './pages.mjs';
+import { ROOM_ID, badRoomPage, embedAncestors, embedPreview, frameAncestors, noWatchPage, playPage, shellKey, shellStandIn, watchPage } from './pages.mjs';
 import {
   PUBLIC_SERVER, SERVER_ID, homeOf, memberCounts, memberOf, noteMember, policyOf, pooledRoom, roomCode, roomServer, serverAccess, serverPassOf, serverView, serversOf,
   setMembership,
@@ -143,6 +143,8 @@ export { usePlayers } from './office.mjs';
 export { countVisit } from './stats.mjs';
 /** Players and cloud saves (saves/SAVES.md): `players.list`, `players.get`, `players.isOwner`… for the back office. */
 export { players, cleanName } from './players.mjs';
+/** How a guest's saves combine with the account's when they sign in (saves/SAVES.md): the studio's Worker calls it once, at load. */
+export { mergeSaves } from './saves.mjs';
 
 const GAME_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
 const POST_SLUG = /^[a-z0-9][a-z0-9-]{0,79}$/;
@@ -1224,6 +1226,17 @@ async function route(request, env, ctx) {
     if (sub === '__game' || sub === '__game/' || sub === '__game/index.html') {
       if (url.searchParams.get('embed') === '1' && (!playerEnabled(cat, meta) || launch !== 'public')) return notFoundPage('Embedding is off for this game.', cat);
       const who = await ticketSub(env, game, url.searchParams.get('t'));
+      // A play page left open across a deploy (0.46.5). One that names what it was made for (`sh`) and is behind is
+      // told so, and reloads itself whole, once, to the same room and seat. One from before that handshake is sent
+      // to a fresh page only when this game cannot work inside it: the game keeps verified results for a player, and
+      // the old page has no player ticket to give its frame (a result would have nobody to be written for).
+      if (url.searchParams.get('pf') === '1' && url.searchParams.get('embed') !== '1' && url.searchParams.get('want') !== 'screen' && !url.searchParams.has('watch')) {
+        const said = url.searchParams.get('sh'), now = shellKey(meta);
+        const ticketless = Boolean(meta.room?.records && env.DB) && !holders(who).some((x) => x.startsWith('p-'));
+        if (said !== null ? said !== now : ticketless) {
+          return new Response(shellStandIn(url.searchParams.get('room') ?? '', said !== null ? now : null), { headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' } });
+        }
+      }
       if (launch !== 'public' && !(await ticketAllows(env, who, launch))) return new Response('This game is not open to you.\n', { status: 403, headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' } });
       // An agent's frame (hands `self`): the game plays as that AI.
       const agentPart = holders(who).find((x) => x.startsWith('a-'));
@@ -1776,7 +1789,12 @@ export class Table {
     sql.exec('CREATE TABLE IF NOT EXISTS round_players(owner TEXT PRIMARY KEY,player TEXT)');
     const client=[...this.room.clients.values()].find(c=>c.seat!==null&&'p'+this.room.seats.get(c.seat)?.occ===owner);
     const player=client?.player??sql.exec('SELECT player FROM round_players WHERE owner=?',owner).toArray()[0]?.player;
-    if(!player)return;
+    if(!player){
+      // Never dropped in silence (0.46.5): the log says so, and the person is told on their own screen.
+      try{console.error(JSON.stringify({at:new Date().toISOString(),ev:'record-unsaved',why:'no-player',game:this.game??null,room:this.code??null,key,id:value?.id??null}));}catch{}
+      if(client)this.room.error(client,'unsaved','This round was not saved to your history. Reload the page to keep the next one.');
+      return;
+    }
     sql.exec('CREATE TABLE IF NOT EXISTS round_outbox(id TEXT PRIMARY KEY,player TEXT,key TEXT,value TEXT)');
     sql.exec('INSERT OR IGNORE INTO round_outbox VALUES(?,?,?,?)',player+':'+key+':'+value.id,player,key,JSON.stringify(value));
     this.ctx.waitUntil(this.flushRoundRecords());

package/worker/pages.mjs

@@ -8,6 +8,36 @@ import { playerAncestors, PLAYER_SANDBOX, PLAYER_SIZE } from './embed.mjs';
 import { esc, layout, gameSocialTags } from './site.mjs';
 import { NET_PALETTE } from './room.mjs';
 import { PARAM_VALUE, PREFS_LIMITS, playParams } from './seats.mjs';
+import { STUDIO_VERSION_TAG } from './version.mjs';
+
+/**
+ * What a play page was made for (0.46.5): the toolkit that wrote it and the parts of the game's manifest it is built
+ * around (who may sit, what the room keeps, whether the player has saves and a ticket). The page hands it to the
+ * game's frame (`sh`), and the Worker that serves the frame knows what a page made now would say. A page left open
+ * across a deploy says something older: it is brought up to date with one full reload, to the same room and seat,
+ * instead of hosting a newer game inside a page that lacks what that game needs (a player ticket, for one).
+ * It does not change when only the game's code or art does: that is still a reload of the frame alone.
+ */
+export function shellKey(g) {
+  // Never what names a build (the rules' build and state hashes, the bundle's version): those change with every
+  // edit, and a newer build of the same game inside the same page is exactly what the frame's own reload is for.
+  const { build: _build, stateHash: _state, ...room } = g?.room ?? {};
+  const { version: _version, ...netplay } = g?.netplay ?? {};
+  const text = JSON.stringify([g?.kind ?? null, g?.players ?? null, room, g?.saves ?? null, g?.agents ?? null, g?.screen ?? null, netplay, g?.launch ?? null]);
+  let h = 2166136261;
+  for (let i = 0; i < text.length; i += 1) { h ^= text.charCodeAt(i); h = Math.imul(h, 16777619); }
+  return `${STUDIO_VERSION_TAG}-${(h >>> 0).toString(36)}`;
+}
+/**
+ * The frame's stand-in when its page is older than the game it would host. It tells the page, and loads no game.
+ * `key`: the page understands the handshake and reloads itself once. No key: a page from before the handshake, whose
+ * only way to load a whole new page is the one it has for leaving a finished room; it is used only when the game cannot
+ * work inside that page at all.
+ */
+export function shellStandIn(room, key) {
+  const message = key ? { t: 'homie-net', what: 'shell', key } : { t: 'homie-net', what: 'rematch', room };
+  return `<!doctype html><meta charset="utf-8"><title>Updating</title><body style="margin:0;background:#0b0d14;color:#cfd6e6;font:15px system-ui;display:grid;place-items:center;height:100vh"><p>This game was updated. Loading it again…</p><script>try{parent.postMessage(${JSON.stringify(message).replace(/</g, '\\u003c')},'*');}catch(e){}</script>`;
+}
 import { SKILLS } from './agents.mjs';
 import { KIDS_LINE, POLICY_WORDS } from './servers.mjs';
 import { SAVES_SHELL_CSS, SAVES_SHELL_JS } from './saves-shell.mjs';
@@ -180,7 +210,7 @@ ${SERVER_CSS}${CHAT_CSS}${g.saves && !screen ? SAVES_SHELL_CSS : ''}${shop ? SHO
   // game.json "agents": { "vote": "game" } draws its own vote card; false turns the vote off (section 17).
   const vote = g.agents?.vote === 'game' || g.agents?.vote === false ? g.agents.vote : 'shell';
   // The address's switches the game's frame is handed (NETPLAY.md section 24): the defaults and the game's own names.
-  const boot = { ...(g.kind === 'app' ? { kind: 'app', appWords: appWords(g) } : {}), embed, game: g.id, name: g.name, screen: Boolean(screen), share: places, params: playParams(g), paramValue: PARAM_VALUE, prefs: PREFS_LIMITS, ...(room ? { room } : {}), ...(ticket ? { t: ticket } : {}), ...(owner ? { owner: true, launch } : {}), ...(srv ? { server: srv } : {}), vote, skills: SKILLS.map((k) => ({ level: k.level, name: k.name, card: k.card })), words: POLICY_WORDS, kidsLine: KIDS_LINE, ...(shop ? { shop } : {}) };
+  const boot = { ...(g.kind === 'app' ? { kind: 'app', appWords: appWords(g) } : {}), embed, game: g.id, name: g.name, screen: Boolean(screen), share: places, params: playParams(g), paramValue: PARAM_VALUE, prefs: PREFS_LIMITS, ...(room ? { room } : {}), ...(ticket ? { t: ticket } : {}), sh: shellKey(g), ...(owner ? { owner: true, launch } : {}), ...(srv ? { server: srv } : {}), vote, skills: SKILLS.map((k) => ({ level: k.level, name: k.name, card: k.card })), words: POLICY_WORDS, kidsLine: KIDS_LINE, ...(shop ? { shop } : {}) };
   // game.json "screen": { "join": "top-left" | "top-right" | "bottom-left" | "bottom-right" } keeps the card off the game's own HUD.
   const joinCorner = corner('join', 'bottom-right');
   const first = places.desk;
@@ -497,6 +527,8 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
       q.set('b', roomKey);
       if (boot.embed) q.set('name', guestName);
       if (boot.t) q.set('t', boot.t);
+      // What this page was made for (0.46.5): the Worker answers with a stand-in when a page made now would differ.
+      if (boot.sh) q.set('sh', shellSaid || boot.sh);
       if (!boot.embed && params.get('name')) q.set('name', params.get('name'));
       else if (!boot.embed) {
         // A player with an account (or a named guest) on this studio plays under their own name in every room.
@@ -517,6 +549,18 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
     }
     state.params = {};
     (boot.params || []).forEach(function (k) { var v = params.get(k); if (v !== null && new RegExp(boot.paramValue || '^$').test(v)) state.params[k] = v; });
+    // The Worker says this page is older than the game (a deploy while it was open): one full reload, which keeps the
+    // room (it is in the address) and the seat (its token is in this tab's storage). Once for each newer page: if the
+    // reload came back the same, the frame is asked for as the Worker described it and play goes on.
+    var shellSaid = '';
+    function shellBehind(key) {
+      var tried = '';
+      try { tried = sessionStorage.getItem('homie-shell') || ''; } catch (e) {}
+      if (tried === key) { shellSaid = key; frame.src = frameUrl(); return; }
+      try { sessionStorage.setItem('homie-shell', key); } catch (e) { shellSaid = key; frame.src = frameUrl(); return; }
+      state.shellReload = key;
+      location.reload();
+    }
     var updating = buildRetry(function () {
       state.stale = null; state.closed = null; state.reloaded = (state.reloaded || 0) + 1;
       frame.src = frameUrl();
@@ -532,6 +576,7 @@ const SHELL_JS = String.raw`${BUILD_RETRY_JS}(function () {
       var m = ev.data;
       if (!m || typeof m !== 'object' || m.t !== 'homie-net') return;
       A.message(m);
+      if (m.what === 'shell' && typeof m.key === 'string' && /^[A-Za-z0-9._-]{1,64}$/.test(m.key)) { shellBehind(m.key); return; }
       if (m.what === 'wait') updating.stop();
       if (m.what === 'build' && updating.acknowledge(m.ver) && toast) toast.hidden = true;
       if (m.what === 'attached' || m.what === 'ready') updating.reported();

package/worker/players.mjs

@@ -28,7 +28,7 @@ import { toolIdentity } from './tool-identity.mjs';
 import { handleFor } from './room.mjs';
 import { isAiName } from './agents.mjs';
 import { cookieValue } from './stats.mjs';
-import { adoptStatements, bumpPlayerStats, dropPlayerData, fall, fallenList, getSave, listSaves, playerData, readPlayerStats, SAVE_LIMITS, savesSummary, wipeSaves, writeSaves } from './saves.mjs';
+import { adoptGuest, bumpPlayerStats, dropPlayerData, fall, fallenList, getSave, listSaves, playerData, readPlayerStats, SAVE_LIMITS, savesSummary, wipeSaves, writeSaves } from './saves.mjs';
 import { bytesToB64url, randomToken, sha256Hex, verifyAssertion, verifyRegistration } from './webauthn.mjs';
 import { ACCOUNT_JS, accountPage } from './account-page.mjs';
 import { adoptShopStatements, migrated as shopMigrated, forgetPlayerShop, livePurchases, shopDataOf } from './shop-store.mjs';
@@ -693,21 +693,19 @@ async function apiRoute(request, env, ctx, url, parts, { catalogueOf, read, f })
       session.statement,
     ];
     let adopted = null;
-    if (current && current.player.id !== key.player) {
-      writes.push(env.DB.prepare('DELETE FROM player_sessions WHERE hash = ?1').bind(current.hash));
-      // A guest signing in to their account: what only the guest had moves over, then the guest is gone.
-      if (current.player.guest) {
-        adopted = await adoptStatements(env, current.player.id, key.player);
-        writes.push(...adopted.statements, ...(await adoptShopStatements(env, current.player.id, key.player)),
-          env.DB.prepare('DELETE FROM player_sessions WHERE player = ?1').bind(current.player.id),
-          env.DB.prepare('DELETE FROM player_challenges WHERE player = ?1').bind(current.player.id),
-          env.DB.prepare('DELETE FROM players WHERE id = ?1 AND guest = 1').bind(current.player.id));
-      }
-    }
-    await env.DB.batch(writes);
-    if (adopted) await adopted.after();
+    if (current && current.player.id !== key.player) writes.push(env.DB.prepare('DELETE FROM player_sessions WHERE hash = ?1').bind(current.hash));
+    if (current && current.player.id !== key.player && current.player.guest) {
+      // A guest signing in to their account: what only the guest had moves over, what both have is combined by the
+      // game's rules (mergeSaves), then the guest is gone. One batch; read and tried again if a room wrote in between.
+      const guest = current.player.id;
+      const shop = await adoptShopStatements(env, guest, key.player);
+      adopted = await adoptGuest(env, guest, key.player, (statements) => [...writes, ...statements, ...shop,
+        env.DB.prepare('DELETE FROM player_sessions WHERE player = ?1').bind(guest),
+        env.DB.prepare('DELETE FROM player_challenges WHERE player = ?1').bind(guest),
+        env.DB.prepare('DELETE FROM players WHERE id = ?1 AND guest = 1').bind(guest)]);
+    } else await env.DB.batch(writes);
     const player = { id: key.player, name: key.name, named: Number(key.named) === 1, guest: false, owner: Number(key.owner) === 1, since: Number(key.created_at) };
-    return withCookies(json({ ok: true, player: await meOf(env, player), adoptedGuest: Boolean(adopted) }), [session.cookie]);
+    return withCookies(json({ ok: true, player: await meOf(env, player), adoptedGuest: Boolean(adopted), ...(adopted ? { adopted } : {}) }), [session.cookie]);
   }
 
   /* ---------------- a recovery email, signed out: the link in the mail is the proof */

package/worker/room.mjs

@@ -452,7 +452,8 @@ export class NetRoom {
         this.stats.evs += 1;
         const out = { t: 'ev', from: Number.isInteger(m.from) ? m.from : null, k: kind, d: m.d ?? null };
         const line = JSON.stringify(out);
-        if (Number.isInteger(m.to)) { for (const o of this.live()) if (o.seat === m.to) this.sendText(o.conn, line); return; }
+        // `to: -1` (0.46.3): everyone with no seat, a watcher. An effect with an audience reaches them whole.
+        if (Number.isInteger(m.to)) { for (const o of this.live()) if (m.to === -1 ? o.seat === null : o.seat === m.to) this.sendText(o.conn, line); return; }
         for (const o of this.live()) if (!this.lite(o) || this.liteHears(kind)) this.sendText(o.conn, line);
         return;
       }
@@ -460,6 +461,25 @@ export class NetRoom {
     }
   }
 
+  /**
+   * One measurement of a connection's round trip (0.46.3), and what the rules are told: a LOW PERCENTILE of the last ten
+   * seconds of them. A measurement is never shorter than the real round trip, so the low end of a window is close to
+   * it and one slow answer does not raise it; a window, so a connection that really got slower or faster is followed.
+   * A client can still pretend to be slower by answering late every time: what that buys is bounded by the game's
+   * `room.rewindSeconds`, and with acknowledgements on the input frames it has to send its input late as well.
+   */
+  latencySample(c, ms, now) {
+    if (!(ms >= 0 && ms <= 10000)) return;
+    const w = (c.rttWindow ??= []);
+    w.push([now, ms]);
+    while (w.length > 256 || (w.length > 1 && w[0][0] < now - 10000)) w.shift();
+    const sorted = w.map((x) => x[1]).sort((a, b) => a - b);
+    const low = sorted[Math.floor((sorted.length - 1) * 0.1)];
+    if (c.measuredRtt !== undefined && Math.abs(low - c.measuredRtt) < 2 && now - (c.rttToldAt ?? 0) < 1000) return;
+    c.measuredRtt = low; c.rttToldAt = now;
+    if (c.seat !== null) this.toServer({ t: 'latency', seat: c.seat, ms: low });
+  }
+
   /** A snapshot from the host (a browser's socket `c`, or the server: `c` null), kept for joiners and fanned out. */
   hostSnap(c, m, now, text = null) {
     // The server's stamp is this relay's own clock; a browser's is its estimate of it, and is checked.
@@ -468,6 +488,7 @@ export class NetRoom {
     // Revision 10: a rules game's snapshot names the room's epoch.
     if ((!c || this.rules && c.rules) && Number.isFinite(m.e)) snap.e = m.e;
     this.lastSnap = snap;
+    if (!c) { const sentAt = (this.snapAt ??= new Map()); sentAt.set(snap.k, now); if (sentAt.size > 128) sentAt.delete(sentAt.keys().next().value); }
     if (c) c.lastSnapAt = now;
     this.stats.snaps += 1;
     this.snapTimes.push(now);
@@ -870,6 +891,9 @@ export class NetRoom {
         if (this.server) {
           if (!Array.isArray(m.s)) return;
           this.stats.ins += 1;
+          // 0.46.3: the frame names the newest snapshot this browser had when it sent it (`g`). From when that snapshot
+          // left here to when this input arrived is this connection's round trip, measured on the input's own path.
+          if (Number.isInteger(m.g)) { c.inBand = true; const sent = this.snapAt?.get(m.g); if (sent !== undefined) this.latencySample(c, now - sent, now); }
           this.toServer({ t: 'in', from: c.seat, e: Number(m.e) || 0, k: Number(m.k) || 0, s: m.s.slice(0, 64), r: Number(m.r) || 0 });
           return;
         }
@@ -909,7 +933,7 @@ export class NetRoom {
         const recipients = isHost && this.rules && c.rules ? this.live() : this.others(c);
         if (isHost) {
           if (typeof m.to === 'string') { const o = this.clients.get(m.to); if (o && o.helloed && (o !== c || (this.rules && c.rules))) this.send(o, out); }
-          else if (Number.isInteger(m.to)) { for (const o of recipients) if (o.seat === m.to) this.send(o, out); }
+          else if (Number.isInteger(m.to)) { for (const o of recipients) if (m.to === -1 ? o.seat === null : o.seat === m.to) this.send(o, out); }
           // An agent with no game client hears only what is addressed to its seat (the lite feed), and the party's lines.
           else for (const o of recipients) { if (!this.lite(o) || this.liteHears(kind)) this.send(o, out); }
         } else {
@@ -958,7 +982,8 @@ export class NetRoom {
       case 'probeAck': {
         if (c.probe && m.n === c.probe.n) {
           const ms = now - c.probe.at; c.probe = null;
-          if(ms>=0 && ms<=10000){ c.measuredRtt=Math.min(c.measuredRtt??Infinity,ms); if(c.seat!==null)this.toServer({t:'latency',seat:c.seat,ms:c.measuredRtt}); }
+          // A browser that acknowledges on its input frames is measured there; this separate answer is for one that does not.
+          if(ms>=0 && ms<=10000 && !c.inBand) this.latencySample(c, ms, now);
         }
         return;
       }

package/worker/saves-shell.mjs

@@ -321,6 +321,25 @@ export const SAVES_SHELL_JS = `${PASSKEY_JS}
     });
   }
 
+  /**
+   * This browser's guest signed in to an account that had some of the same keys with other values, and no rule of
+   * the game's combined them on the server (mergeSaves): the account's stayed, and the sign-in answered with the
+   * guest's. Each is an ordinary conflict, the guest's value (mine) against the account's (theirs), so a game with
+   * onConflict keeps or merges it. Never a server: key: a browser cannot write one.
+   */
+  function keptByAccount(adopted, guestCopy) {
+    var asked = [];
+    ((adopted && adopted.kept) || []).forEach(function (k) {
+      var key = String(k.key);
+      if (k.game !== GAME || key.indexOf('server:') === 0 || !KEY.test(key)) return;
+      var mine = k.value !== undefined ? k.value : guestCopy[key];
+      if (mine === undefined || mine === null) return;
+      var c = S.cache[key];
+      asked.push(resolve(key, { op: 'set', v: mine }, { value: c ? c.v : null, version: c ? c.ver : 0 }, false));
+    });
+    if (asked.length) Promise.all(asked).then(function () { flush(); });
+  }
+
   addEventListener('online', function () { online(true); S.backoff = 0; flush(); });
   addEventListener('offline', function () { online(false); });
   document.addEventListener('visibilitychange', function () { if (document.visibilityState === 'hidden') flush(true); });
@@ -385,9 +404,10 @@ export const SAVES_SHELL_JS = `${PASSKEY_JS}
     };
     inn.onclick = function () {
       busy(true); said.className = 'said'; said.textContent = 'Follow your device…';
-      flush().then(function () { return P.signIn(); }).then(function (r) {
+      var guestCopy = {};
+      flush().then(function () { guestCopy = snapshot(); return P.signIn(); }).then(function (r) {
         setPlayer({ id: r.player.id, name: r.player.name, guest: false, owner: r.player.owner }, false);
-        return refresh().then(function () { tell('player', { player: me(), cache: snapshot() }); close(); });
+        return refresh().then(function () { tell('player', { player: me(), cache: snapshot() }); close(); keptByAccount(r.adopted, guestCopy); });
       }).catch(function (e) { said.className = 'said bad'; said.textContent = e && e.name ? P.said(e) : (e && e.message) || 'That did not work.'; busy(false); P.prime('in', '/api/player/signin/options'); });
     };
   }