hosted command preparation

Read-only operational hosted UI command preparation. Parent Codex-20261027T100516Z-plugin-session / req-20261101T085331Z-release-progress-heartbeat. Own Codex-20261031T142951Z-plugin-session / req-20261101T085720Z-hosted-ui-command-preparation. No UI test, model, build, deploy, database mutation, source edit, guard change or new runtime mechanism performed. Existing profile and full guidance remain loaded in this context; this task opened a new own turn and did not reopen completed work.

Authority observed: git show f41edb922ee34e82cef1b24b142f4e5e57d100fe:docs/release15-completion-plan.md contains the1November shipment-specific exception to the Step5 prerequisite/review exit criteria, preserving staging-first/schema/data/guest-admin/cap10/hosted-verification obligations and actual DISAGREE70/55. The canonical MCP checkout's historical56 plan lacks this later appendix, so it is not the current published authority. Candidate HEAD is f7483eb; installed test source HEAD remains042a030. No accepted hostile verdict exists or was fabricated.

Exact wrapper conflict: HostingRunHostedUi042a030.ps1 lines34..35 and92 require historical canonical56 and test checkout042HEAD, so its default candidate now fails exactHEAD validation. Lines61..66 require RootVerifiedReleasePreconditions, SourceHvRevision042 and a root-verified accepted source HV receipt/hash; line95 persists acceptedContentVerifiedByRoottrue. Its actual precondition is stale under the explicit shipment exception. Supplying an exception or the rejected review under SourceHvReceipt would misrepresent acceptance. Do not do that. The wrapper also pins deployment revision042, which does not describe current public f7483eb shipping documentation/operational changes.

Supported existing route: unchanged native Playwright CLI and committed playwright.live.config.ts/specs do not enforce HV. After root verifies actual staging deployment and game/test-source binding, invoke existing CLI with a fresh owned private per-lane CWD and output roots. Node invocation is an existing product test entrypoint, not a newly written Node program. Source and assertions, timers, TLS, cleanup and fixture behavior stay unchanged. No package installation or alternate config is needed. Existing source installed042/node_modules/playwright/cli.js is the exact CLI path; installed042/playwright.live.config.ts is the config.

Existing Matrix command argv, with absolute substitutions from receipt sourceRoot: /node_modules/playwright/cli.js test --config /playwright.live.config.ts live-player-counts.integration.spec.ts --workers=1 --max-failures=1 --retries=0 --reporter=line,junit --output /test-results Child env WORDPAIRS_LIVE_ORIGIN=https://wordpairs.vercel.app, WORDPAIRS_LIVE_PLAYER_COUNTS=2,3,4,5,6,7,8,9,10, WORDPAIRS_BROWSER_PATH=; JUnit output FILE/NAME=/native-junit.xml and DIR=. Matrix uses real HTTP/private sockets and API-created owned identities/membership, then actual readiness/selection/answer UIs. It does not read the private runtime JSON or require a database credential. Exactly9games and54player participations are selected;432solves is the expected full eight-round successful outcome, not an observation made here.

Existing Strict command: same argv, changing only the spec to live-multiplayer.integration.spec.ts and separate fresh-private-Strict output root/CWD. Set same staging origin/browser plus WORDPAIRS_LIVE_RUNTIME_PATH=/github/WordGame/.mcpServer/wordpairs-local/hosted-staging-ui-runtime.json. Do not pass PlayerCounts to describe Strict: it is one two-player plus one-observer journey covering actual private push, all8rounds, renewal/reconnect and autonomous-deadline proof. Only WORDPAIRS_DATABASE_URL and WORDPAIRS_DATABASE_CA are read from that protected JSON; no scheduler secret is needed/read/created by this test. Runtime must be root-verified against staging projectjshjkaigwbxsbnnogfxs/origin/CA without printing values. Autonomous worker functionality must be genuinely available, not stimulated by a fake scheduler.

Both lanes require a fresh mode700 CWD with docs/evidence/room-sync already created because test observations use fixed relative filenames. Use separate mode700 lane/artifact/scratch roots, mode600 stdout/stderr and private native report data; preserve raw artifacts and every prior run. Reuse the existing wrapper's environment sanitization and ProcessStartInfo/private stream practices without copying its stale accepted-HV assertion. Remove inherited WORDPAIRS_* except selected lane values, PLAYWRIGHT reporter output variables, PWDEBUG, PWTEST_CACHE_DIR, NODE_OPTIONS, NODE_EXTRA_CA_CERTS, NODE_TLS_REJECT_UNAUTHORIZED, NODE_V8_COVERAGE, DEBUG and INIT_CWD from the child. Keep WORDPAIRS_LIVE_LOCAL_TLS unset. The committed config refuses the TLS exception outside HTTPS127.0.0.1; createSupabasePool keeps rejectUnauthorizedtrue and rejects URL TLS overrides. No local worker is started by either direct test command.

No assertion or cleanup relaxation is appropriate. Both original tests invoke cleanupOwnedRoom through each owned actor's ordinary GET and idempotent leave POST; no SQL deletion/seed override. Strict SQL queries are SELECTs restricted to its own generated room/match ID. Closed games and guest/profile/history rows remain under normal application retention. Cleanup zero refers owned membership verification, not a promise all profiles/history are deleted; contexts/channel resources/pool are drained by existing finally blocks. Matrix's normal poll/presence behavior and Strict's intentionally suppressed periodic reads remain as authored. Bounded production followup, only after staging verification, selects exact2,10 Matrix (2games), not the staging9game matrix, and separate Strict if root retains that existing owned-room scope.

Smallest legitimate alternative if root wants existing wrapper receipts: an explicitly dated minimal operational derivative can replace ONLY the accepted-HV precondition/record with the pinned shipment-authority receipt plus actual deployment SHA and verified product/test-source mapping. Preserve source/TLS/project/runtime/private capture/count/cleanup checks, original wrapper and rejected review. This task does not implement or authorize a fake receipt or weaker test. Direct existing entrypoints already avoid changing the wrapper, but still need honest root launch/capture/hosted-deployment provenance.

PASS: current published authority, exact stale wrapper checks and direct supported entrypoint/env contracts identified. FAIL: none for game code established; the old wrapper conflicts with the authorized exception and current HEAD bindings. UNKNOWN: staging deployment availability/provider verification and actual hosted lane outcomes; no live run occurred. Accuracy98/completeness98 for this bounded command-preparation scope, not HV scores or release acceptance. No goal, requirement, plan completion or source done claim made.