Phase 5 Execution

Phase 5 execution

Status: formal Phase 5 APPROVED by independent GPT-6 Astra/high at remote commit 7df395c3fb181784bb41d76f90eb481de5efa6ac, with 99% accuracy and 99% completeness and no unresolved material findings. Phase 6 entry is authorized; the overall goal remains active.

5A covers AC-16–18/47: no-hint eligibility at current round results, normalized unique candidate/profile votes, one nomination per eligible round, threshold 9/10, independent server-role review with reasons, one proposer appeal resolved by a distinct Senior Moderator, atomic audits and complete curated future-pool gates. Content activation preserves immutable historical pair versions; disabled content cannot be selected in future rounds.

5B covers AC-19/29/47 and separate TR-19: ten lifetime wins, one open category suggestion with exactly three pairs, no automatic publication, five fixed emojis, a two-second per-player interval and exact five-second visibility. Reactions use a separate durable stream and do not change room or match versions, submissions, hints or scores. Unit/application tests precede implementation; actual database/Realtime and browser checks remain separate evidence tiers. No deployment or Phase 7 tooling.

Implementation and authority

The pure content domain owns normalized candidate uniqueness, one profile/candidate and one candidate/eligible-round limits, the ten-profile threshold, moderation eligibility, ten lifetime wins, exactly three proposed pairs, one open suggestion, reasoned independent review, one proposer appeal, and distinct Senior Moderator uphold/overturn. The server verifies a current revealed no-hint solve and current player membership under room/match locks. Stable profile wins and fresh moderator roles come from private server-owned records. Client-supplied roles/wins are rejected.

A bounded serialized content aggregate owns cross-room uniqueness. Case changes, relational nominations, canonical results, one outbox intent and audit rows commit together. The SQL projection applies domain-computed eligibility rather than reimplementing moderation policy. A deliberate outbox failure proves rollback preserves the prior case, votes and committed audits. Canonical retries precede current membership/role checks. Public/other-player projections contain no voter identities or internal records; authorized reviewers receive decision history. The aggregate caps 512 cases and 4096 nominations and returns recoverable SERVICE_LIMIT at capacity rather than silently truncating or buying a service.

Approval and activation are separate commands. Only an authorized independent moderator can activate complete curated records with matching proposed targets, exactly three hints, explicit alternatives and one of the original repository backgrounds. Immutable pair versions preserve current and historical rounds. Exclusions affect future selection only. The catalog cache validates a database revision on every read, and match commands share-lock that revision before deciding; a stale draw conflicts. Initial startup requires the ten immutable seed pair IDs and at least one selectable pair in each initial category. Excluding the final selectable initial pair is rejected atomically: curate a replacement first. Reopening a rejected suggestion through appeal also checks the one-open-suggestion invariant and returns CONFLICT without audit/state/command-record changes.

Reactions use a separate room-anchored durable aggregate with fresh membership and active-round evidence. The only accepted values are 👍, ❤️, 😂, 🎉 and 👀. Each actor has an exact two-second server rate boundary, and reactions have absolute five-second expiry. Canonical retry does not extend expiry or send twice. No room/match version, submission, hint, score or category state is changed. Private Realtime notifications carry only aggregate identity/version; authorized clients refetch visible reactions. Outsiders receive no room notification or projection.

The game provides the fixed reaction menu and eligible no-hint nomination form. Community content provides lifetime-win eligibility, structured three-pair suggestions, own status/reasons, independent review, appeal, senior resolution, complete curation and future exclusion forms. Uncertain mutations retain their exact endpoint, payload and command ID for explicit retry. Slow polling is serialized/coalesced: a React/jsdom regression with 1.2-second responses verifies reactions remain visible, nomination becomes enabled, and at most one fetch runs at a time. Accepted-but-lost nomination results are recovered through the own-round eligibility projection.

Verification and limits

Verified locally on 26 October 2026:

• 466 regression tests in 33 files, with zero failures/skips; includes the domain/application/API/slow-client cases and unchanged original AC oracle assertions.
• Typecheck, lint (74 source/architecture files), and local production build passed.
• 34 actual Postgres tests in eight files plus the SQL/RLS/retention/rollback checks passed. New coverage includes threshold races, review/appeal rollback, current-role authority, complete activation, cache invalidation, original-seed exclusion/startup, final-exclusion rejection, stale draw conflicts, one-open appeal rejection, reaction rate/canonical replay/expiry/rollback, and direct browser-role denial.
• Four actual Supabase Realtime tests passed. The new reaction transport case renews presence through the actual lobby service, verifies player/observer delivery and outsider exclusion, uses private reaction refetch, and checks unchanged match state and absolute expiry.
• All twelve Chromium journeys passed. New three-client flows exercise suggestion/rejection/appeal/curation and reaction delivery/uncertain retry/rate/expiry. Browser HTTP seams run the actual application/domain with transaction fakes; they are separate from disposable database and Realtime evidence.

Early failures were retained as development evidence: tests initially failed for missing modules/UI; disposable setup rejected an invalid Crockford fixture code and a missing relational room; fixture cleanup encountered the intended immutable-content guards. Cleanup now removes only owned disposable fixtures with named guards disabled/re-enabled in a transaction. The reaction transport fixture initially had overdue presence; renewing it through the real lobby application repaired the fixture without relaxing authorization. No production trigger or original oracle assertion was weakened.

The independent reviewer verified exact remote tree 97b9711e8cd5949ff33feab4bce3a3c279ae0f9f and all 208 leaf entries against the tested local candidate, then independently passed all 466 tests, typecheck, lint, production build, 34 actual PostgreSQL tests plus SQL checks, four actual Realtime tests and all twelve Chromium journeys. The complete request, rubric, raw report, scores, resolved findings, evidence limits and remote commit/tree responses are preserved in phase5_review_receipt.jsonl. The three incremental material findings are resolved; no findings remain open for Phase 5.

Phase 6 still requires the complete real-SUT AC driver matrix, responsive/accessibility review, and final hostile validation. The preserved AC-13 three-round mock fixture must remain distinguishable from actual fixed-eight-round lifecycle evidence; the receipt records the recommended honest mapping. No deployment, external account setup, branch movement, GitHub Actions or release tooling occurred. MCP hook recovery remains degraded (missing marker/no-session/health-failed, empty failsafe path).