Multiplayer launch implementation

Active work, September 9, 2026. Companion to the audited multiplayer platform design.

The owner confirmed hundreds of thousands of total campaign visitors, with staged concurrency growth. Do not describe this as 100,000 simultaneously tested players. The accepted scope includes gameplay and Dave UX, plus all six architecture stages. Evaluations in the design remain evaluations until evidence supports adoption.

Delivery checklist

• [x] Read current Sonnet usage and validate existing production Dave notebooks without modifying player data.
• [x] Fix inconsistent model response history and tolerate harmless JSON wrappers/optional annotations without relaxing native rewards.
• [x] Add private, correlated server/client Dave outcome diagnostics; separate generation, storage, ledger, rate and connection failures.
• [x] Validate paid replies commit with their ledger and usage records; failed transactions preserve balance/history.
• [x] Correct display-name analytics; use stable anonymous IDs, verified account IDs, login identification and logout rotation.
• [x] Finish English/Chinese visual/browser recovery checks on desktop and phone; publish and verify production.
• [x] Shared platform guest bootstrap, legacy token adapter, verified attribution and server-observed lifecycle events.
• [x] Room registry, host ownership/fencing, assigned endpoint support and scoped admission capabilities.
• [x] Burst admission, jittered reconnect, resume priority and drain lifecycle.
• [x] Persistence failure semantics, ordered/revisioned player writes and acknowledged shutdown; guest-safe storage.
• [x] Separately addressed US and Singapore hosts with private staged rollout; public enablement remains gated.
• [ ] Public room discovery and casual matchmaking with cancellation/reservations.
• [x] Cloudflare independent static delivery, verified downloads and public game startup.
• [x] Cloudflare bounded queued lifecycle ingestion, deduplication and backlog visibility.
• [ ] Namespaced creator storage and execution capability boundary; isolated runtime/pilot evaluation.
• [ ] Sustained staging load, bursts, reconnect storms, host failure/drain, stale credentials, database failures.
• [ ] Measured real Asia–Asia/Asia–US gameplay; user/device assistance may be required for real network evidence.

Current evidence and limits

The three sampled production notebooks validate. Recent Sonnet requests include successful billed replies and pvz-dave-unheard attempts completing in 2–6 seconds. The older endpoint groups silent background decisions and failed delivery together, so it does not establish the exact historical error. Existing PostHog has game networking events but no Dave-specific outcomes. No notebook reset is justified.

Railway HTTP logs subsequently established that the recent failed requests returned 422, including the two failures immediately after the successful 01:11:12 UTC reply. This is the generated-reply validation path. The old code did not retain the specific validation reason; the new bounded diagnostics do. Server commit 7af34179d is deployed successfully. PvZ commit d69ac81, release 7fc68c348b, is uploaded to S3 and verified at /pvz/. Both the main service (DB and Redis included) and realtime health endpoints return 200.

Persistence implementation now has ordered/coalesced snapshots, SQL revision checks, bounded payloads/deadlines, account-only progress sessions, restore failure rejection and acknowledged shutdown. The 80 game-host tests pass, including real PostgreSQL-engine conflict/failure tests and real WebSocket guest-outage/shutdown tests. Full build and typecheck pass. The additive revision migration is applied to development and the realtime production database. Commit 817aba0eb is deployed to the realtime host; health/status and startup logs verify it. Status distinguishes humans from bots (the five sea bots do not represent five people). This does not yet provide global room ownership, room resurrection or infrastructure-preserved draining.

Cloudflare yumina-game-edge version 2026-09-10.2 is live; source, route IDs and rollback are in infra/game-edge/README.md. Eight unit tests, full live SHA-256 comparisons for WASM/pak, cache hits, byte ranges and a production phone browser pass. /pvz?join=...&lang=... preserves its parameters. /pvz-models* has an explicit no-Worker exception. The route falls back to the existing main-service handlers if the account hits a Worker request limit. Worker account settings report the Standard usage model, but billing-subscription access is denied; the user has been asked to verify Workers Paid before promotion. A storage-provider read-only credential scoped to the two game prefixes remains a hardening follow-up.

Local actual-WASM checks use an isolated account/provider fixture; they prove UI behavior, not live Sonnet availability. Provider formatting and monetary settlement have separate service/SQL tests. Build and typecheck passed before the latest UI-only refinement. Railway CLI authentication was restored during this work; MCP had an OAuth scope problem.

No multi-region capacity or full campaign readiness is claimed until the corresponding gates are recorded here. A host replacement cannot preserve process-local PvZ rooms; drain and ownership must be deployed before replication.

Shared identity foundation: a signed platform cookie and standalone browser SDK now migrate existing PvZ guests, preserve live guest seat tokens through login, and link observed guest activity only through authenticated account requests. Atomic link ownership prevents combining two registered accounts; stale-tab/account checks prevent login races. The additive game_guest_links migration is applied to development and production. Identity/server, SDK and PvZ analytics tests pass; full build/typecheck pass. The generic room adapter and authoritative lifecycle reporting remain separate unfinished work.

Regional foundation 4f1bd867c is deployed to the main control API and two independently addressed relay-only hosts (US West and Singapore). The hosts have public admission keys and their own heartbeat secrets, with no account database or signing private key. Both passed actual desktop-host/Chinese-phone-guest invite and forced-reconnect tests against production APIs. The public rollout flag remains off. Six control tests, SQL concurrency races, and the game tests establish reservation/idempotency, owner fencing, replay prevention and same-boot resume. This is not host-crash recovery.

Generic GameRoomConnection now supports shared guests, cancellation and a single 15-second admission deadline; five regression tests pass. Its automatic reconnect and regional runtime migration are still separate work. The regional PvZ adapter has jitter and local resume; authenticated resume priority is implemented and tested under a full handshake budget. Lifecycle Worker/Queues resources now exist, with a tested deduplicating SQL sink and bounded server emitters; deployed event verification is the next gate. See infra/game-events/README.md and infra/game-regions/README.md for resource IDs, limits and recovery behavior.

Further save audit found that the original PvZ cloud PUT trusted whichever account cookie was current, while the native profile stayed pinned to the tab's original account. The new endpoint requires that original account ID and observed revision. A different account or competing tab cannot overwrite it; preconditionless old clients must refresh before cloud writes resume. Device-local saving continues. The game also limits retries during outages and keeps a recovery copy on conflict. Owner/CAS SQL tests, browser-shell save tests and full build/typecheck pass. The latest actual-WASM Chinese desktop/phone test again passes the shared model pill, credit errors, provider switching, failed-reply recovery and native restart.

September 10 verification: game source 91bae46, release 726ff81725, is uploaded to S3 and verified on https://yumina.io/pvz/ in phone landscape. Main deployment 4ddeec0d-5397-42b2-b3c3-7f1d1c169ec5 is successful; US/Asia hosts run the new backward-compatible draft frame support from 24b986dc9. A real browser test exposed the old draft's deliberate disconnect failure screen. Setup actions now have bounded sequence/acknowledgement/replay, the draft clock pauses, and picks survive. Both regional hosts passed intentionally lost native pick + reconnect + duplicate replay checks. Draining each host preserved that draft/reconnect while a fresh room was assigned to the other host. Both hosts were restored to accepting. Public regional routing is still off; legacy invites need a migration policy.

The isolated 10-minute soak used 500 rooms / 1,000 simulated players, 20 input frames/sec/player. It sent 12,013,574 frames and delivered 12,013,516; the 58-frame difference occurred around intentional socket replacements (the native game has its separately tested replay). Zero unexpected closes; 100 priority resumes completed in 399ms during a 1,000-connection anonymous burst. Uniform samples across the full run measured local p95 13.86ms / p99 18.52ms. Relay RSS was 200MiB mid-run / 204MiB at completion, heap 18.6MiB at completion, event-loop p99 22.3ms, maximum 149.9ms. These are local transport tests on this computer, not WAN or Railway capacity guarantees. Source: packages/game-server/scripts/regional-soak.mjs.

The real Queue probe paused delivery, enqueued duplicate/reordered QA events, then resumed it. PostgreSQL converged to three unique event IDs, one disconnected session, sequence 3 and 40,000 cumulative active milliseconds. PostHog showed one join and one departure with unique UUIDs. Queue/DLQ were empty after consumption. Instant queue metrics lagged during the short pause, so they are approximate; retained SQL/event receipt times are the audit evidence. Minute activity updates remain in SQL aggregates and no longer generate per-player PostHog heartbeats. The status command distinguishes room participants, actual input-producing players, connected seats/subjects, 30-second engaged visits and verified merged guest/account totals. QA is always separate. Backlog warnings currently go to Worker logs, not an external paging channel.

Validation: 85 game-server tests, 42 browser-shell tests, three Worker tests, full monorepo build (5 tasks) and typecheck (8 tasks). The owner has no physical Asia/US testers available yet; real regional gameplay quality remains unverified.