CardShopCoop v1.0.29

Preemptive fixes from a full audit of the game against the mod. Every game system was swept for 2-player coverage gaps before anyone got burned (full audit in the repo: docs/audit-2026-07-07.md - 134 systems confirmed covered, 10 real gaps found and fixed). Adds a new network message, so 1.0.29 only connects to 1.0.29 - both players must update (the launcher does it automatically).

Duplication & money exploits (found by the audit, never reported)

• Packs sitting in an auto pack opener duplicated on the host every time a guest joined (same for deodorant cans in the auto cleanser). Fixed.
• A guest could sell a boxed-up shelf the host placed - the shared wallet got the money while the shelf survived, repeatably. Guest furniture selling is blocked (with a message) until a fully-validated version ships.
• A purchase whose charge the host declined (wallet short) still delivered the product free. Purchases are now held the split-second until their charge clears, then delivered or cancelled.

Guest actions that silently did nothing (or worse)

• The guest's deodorant spray never actually cleaned a smelly customer. Now it does.
• A guest placing a decoration lost it for good (and could teleport a different decoration). Blocked with a message for now.
• Pulling a shelf item into an empty box destroyed the item. Fixed.

Robustness

• A host worker could take or drain the box a guest was carrying, right out of their hands. Fixed.
• Disconnecting while carrying a box left it invisible and untouchable for everyone until the session restarted. Fixed for item, card, and furniture boxes.
• A guest loading their own save from the pause menu left a broken half-session. The session now ends cleanly.
• Re-grading a card could delete a duplicate graded card on every player who owned one. Fixed.

Everything above was traced against the game's own code and adversarially re-verified before release. If anything misbehaves, grab BepInEx\CardShopCoop_<number>.log from BOTH PCs.