Take updates from trevato/cs #286

Merged, green, and pushed. Final state: bun run test (typecheck + 1240 tests) passes, all three games serve, and scripts/mutate-result.ts reports 28 mutants dead and 4 redundant as noted.

---

refs/following/main (013620e) merged into this branch. The two trees diverged before the engine was pulled out of the game, so most of the parent's 62 commits land against src/client/{math,physics,renderer,trace,input,policy,textures}.ts — the modules this repository moved behind src/engine/. That is the conflict that decides most of the file-by-file calls below.

This repository's side won, and why

• The four modify/delete conflicts — src/client/physics.ts, renderer.ts, trace.ts, input.ts: the deletions stand. Those concepts live behind the door now (src/engine/physics.ts, renderer.ts, trace.ts, controls.ts) and two other games import them from there.
• The 30 content conflicts — main.ts, world.ts, bots.ts, hud.ts, combat.ts, weapons.ts, models.ts, map.ts, audio.ts, observe.ts, action.ts, weights.ts, db.ts, server.ts, result.ts, pages/game.ts, rl/arena.ts, tty.ts, scripts/{build,train}.ts, README.md and their tests: ours. Each of these imports through src/engine/index.ts; taking the parent's text would put the game back inside the engine.
• The 25 add/add conflicts — both sides wrote a module of the same name. Ours in every case, and in the security-relevant ones ours is also the stricter: who.ts (same constant-time HMAC compare, plus an identity length cap and a checked expiry shape), limit.ts (a token bucket with a swept, bounded table rather than a fixed window), compress.ts (the measured level-6 decision, a type rule and a q-value-aware accept-encoding), server.ts (the CSP carries a sha256 of each page's style block instead of 'unsafe-inline'), result.ts, db.test.ts, spectate.ts, summary.ts, report.ts, buy.ts, scripts/cost.ts (ours measures what an engine group adds to a bundle; the parent's measured a simulation tick, which src/budget.test.ts already holds here).
• Config — tsconfig.json, package.json, forge.json, bun.lock, AGENTS.md: ours. This repository already runs the typecheck the parent added (test is typecheck && bun test) and its tsconfig is the stricter one; the parent's AGENTS.md wording names a bun run check script that does not exist here.
• Three files git auto-merged through the renames — src/engine/math.ts, net.ts, learn.ts: reverted to ours. fallenMatrix exists to draw the parent's bodies.ts, which is not here and is not on the door; policyOver/policyBytes and the learn.ts rewrite exist to feed the parent's worker-pool trainer, and moving PPO invalidates the shipped weights src/rl/guard.ts re-measures.
• 60 of the parent's 62 new files were dropped, because each is either written against the pre-extraction client or is a concept this repository already built its own way: radar.ts↔minimap.ts, grenades.ts↔grenade.ts, loop.ts/fullscreen.ts↔engine/, bind.ts/press.ts↔src/bind.ts+engine/controls.ts, plan.ts↔src/plan/, saved.ts/settings.ts↔replay.ts+the settings in main.ts, bundle.ts↔bundles.ts, tabs.ts↔terminal/screen.ts, player.ts↔who.ts+db.ts, and the tests for modules that no longer exist.

The parent's side won, twice

• src/tree.test.ts (new here) — the guard that no cookie jar and no scratch directory sits in the tree, with the .gitignore entries it reads. Adapted: its scratch names now subtract node_modules, dist, static and data, which tools in this repository build into on purpose; without that it is red on any machine that has run or built the app. It still fires on a planted .scout-tmp/cookies.txt.
• saveMatch in src/db.ts — a match's numbers only ever count up. Posts arrive as the match is played and src/client/pending.ts retries one that failed, so the last post to reach the database is not always the latest one the game made, and an overwrite let a retried early post undo a finished match. Each number is raised rather than replaced, the score is taken whole from whichever post knows the most rounds, and finished never goes back down — which is what liveness already assumed. Two new tests cover both directions.

What I changed rather than merged. One existing test, src/db.test.ts "which day a result counts for is read out of its id": it posted 3 kills after 9 as incidental setup and asserted the 3 stuck. The subject is the day, not the kills, so the second post now sends 13 and the assertion follows; the rule it actually tests is untouched. Separately, scripts/mutate-result.ts had been reporting 11 of its mutants as "no longer in src/result.ts" since integer and cleanName moved to src/gate.ts — a mutant now names the file it breaks, and all 32 do what the list says again.

What I chose not to do. I did not port the parent's lower bound on the clock (seconds >= rounds * 10): seconds is world.time, and this repository's headless stage ends rounds without running the clock, so the rule refuses bodies three games' boot tests produce. And I did not rebuild the parent's features that were written on the old client — radio calls, bullet-hole decals, nameplates, between-tick interpolation, snapshot save/restore (restoreWorld/Saved), the adaptive render scale in quality.ts, multi-core training (rl/pool|shard|worker), the second handcrafted map, scripts/measure.ts and src/readme.test.ts. Each is a port into the engine's shape rather than a merge, and each deserves its own issue and its own pins.

To try it: the preview's /, /range and /example all answer (33 kB, 18 kB and 12 kB of server-rendered HTML in 2–23 ms locally), and the leaderboard is the thing to poke — play a match, walk out of it mid-way, and check the row does not lose rounds when a late post lands.

Closes #275

🤖 Generated with Claude Code

Closes #275