Develop Warpkeep 0.4 gameplay, Verdant Citadel and sealed realm delivery

[ael-dev3]

Warpkeep 0.4 connects gather → choose → build → benefit → return with the Verdant Citadel presentation and a Windows/WSL/Linux delivery path. It establishes the mobile game foundation, authoritative progression and recovery needed for a persistent keep.

This PR is development integration, not a shipped 0.4 release. Genesis 001 preservation and its admission freeze remain required; Genesis 002 stays sealed, and the real owner's isolated PTR is the target for the new experience. Live preservation, owner play and device acceptance remain unfinished.

Resulting behavior

• Worker journeys, construction, progression and resource feedback use server authority, scoped session renewal, exact retry identity and reconnect handling.
• The keep and atlas provide responsive layouts, quality settings, reduced motion, schematic fallback and deferred runtime loading.
• A pending command retains the last confirmed keep, balances, selection and panel. Resources show the pending status while mutations stay disabled. Uncertain or expired sessions retire the old presentation.
• Native preparation and independent rebuilding connect generated realm consumers with protected Linux delivery and recovery. Existing PTR module inspection/application has a dedicated workflow job and authenticated completion-record path; remaining import/owner integration is explicitly unfinished.
• Recovery verifies original uploaded Worker bytes and configuration, preserves authority across renewal, and rechecks identity and elapsed time after asynchronous provider reads.
• Repository guidance requires reviewed development publication, complete outgoing-history secret scans, non-forced pushes and live-ref verification. The quiet sync check covers maintained related repositories and idle WSL checkouts. Active build inputs remain pinned; private evidence stays outside Git and no new Desktop output is created.

Verified at the published checkpoint

Reviewed source 820e611148db4a27df1e2d75910f57b7e8a08578 merged through the normal protected squash on September 12 to signed main commit c4b95505b73705d120aff3f3318d2bd5151f6565 (M1). Its tree 24f5ceb4e36814b0a2bdb691adb59591db676611 exactly matches the reviewed source. Windows and native checkouts were deliberately moved cleanly to M1; Windows now owns generated integration on codex/0.4-prepared-source.

• 113 affected tests passed on both Windows and native Linux, covering the actual route, screen, scene, accessibility and controller. The route correction first reproduced both obsolete pending-message expectations, then verified retained accessible feedback, original panel/confirmation identity, disabled duplicates, selection and no replay through Back navigation. Native execution reported two React act warnings in a separate viewport-refresh case.
• Application/test types, repository file-size policy and changed-document links passed. Independent review found no actionable defect.
• The complete production build passed using Node 22.22.3/npm 10.9.8, including generated assets, integrity/provenance, output boundaries and Mini App manifest checks. Vite's timing/large-chunk advisories remain.
• Dependency audit found zero vulnerabilities; registry signatures and available attestations verified. Complete outgoing development ranges passed Gitleaks before publication.
• The checked-in sealed-launch verifier passed in preparation mode with pagesDeploymentApproved=false.
• CodeQL and every required Verify job succeeded at the reviewed 820e611 source. The root suite passed 10,526 tests (657 files), with 181 tests/two files skipped; its additional serial release-workflow checks and the module rehearsals also completed. Aggregate Verify succeeded at 11:24:38 UTC. The later main CodeQL run succeeded, while its Linux Verify job stopped at a full-history scanner false positive. PR #234 contains the verified scoped repair and has its own hosted checks.

Browser evidence uses the local synthetic fixture, not owner gameplay. Portrait/short-landscape checks verified retained pending feedback and no horizontal overflow. On the current head, balanced and reduced mobile-sized scenes completed three warm-up and twenty measured mount/unmount cycles each, with stable renderer counts and clean final disposal. Three context-loss/restoration cycles per quality returned to their baseline. A bounded mature-keep observation settled to idle. These checks do not establish production load, transfer, heap, GPU upload or physical-phone performance.

Promotion and remaining release work

Preserve the annotated source-history tags source-history/warpkeep-0.4-pr228-2615518e5172 and source-history/warpkeep-0.4-pr228-820e611148db; the latter retains the full current published history. Both are source retention, not release certificates.

The M1 source squash is complete, GitHub's commit signature is valid, and the exact tree and live main were independently checked. The retired branch was automatically deleted; its full source history remains in the annotated tag. Fresh native preparation and its independent rebuild check both passed from clean M1 with every returned identity matching. Export that verified family, reconcile the scoped scanner/routing repair through PR #234, then promote the generated family through protected M2. Require M2 Verify before sealed preflight. Do not deploy interim M1 or hand-edit source pins. The sync task now recognizes the generated-integration branch and pinned native input.

The existing no-clone export composition passed a locked integrity check and temporary-index patch roundtrip on retained input 8033e01c. That historical family predates the current runtime and does not replace fresh M1 preparation/checking. Windows generated paths have explicit LF attributes; complete candidate-byte verification remains possible despite the checkout's general CRLF setting. The receiving checkout must be idle: ordinary patch rejection is no-effect, but process interruption or I/O failure can leave partial work requiring inspection.

A protected preflight-inspected result proves the actual runner/source/bundle/GitHub-permit path. It does not invoke provider/owner adapters or validate their credentials, realm state or historical receipts.

Remaining work:

• Complete authenticated import/adoption continuity and owner/live caller composition. Preserve existing owner state and original receipt coordinates.
• Establish genuine provider update authority and authenticated game-state access. The observed SQL 403 was INVALID_PTR_OWNER_SESSION; it establishes neither provider permission nor denial.
• Capture real G001 preservation, G002 denial, populated recovery and the owner's useful first-session/return journey.
• Improve economy-building hierarchy, terrain cohesion and desktop action discoverability; complete production/device measurements and final live acceptance. The older capture's security warnings/network error remain unclassified because it retained no detailed diagnostic causes.

The execution handoff, release evidence and acceptance checklist distinguish implementation, historical evidence and remaining release requirements.