# Phase 6 — Deferred Items

Items discovered during plan execution that are out of scope per the
SCOPE BOUNDARY rule (only auto-fix issues directly caused by the
current task's changes; pre-existing failures are deferred).

## From Plan 06-03

- **`apps/server/test/admin-stubs.test.ts`** — 2 tests fail in this
  worktree (`admin-stubs.ts source contains zero RCE-surface tokens`
  and `opcode 12 (mod-execute) is NOT exposed via a runtime handler in
  admin-stubs`). The comment-strip regex
  (`/\/\/.*$/` per-line) isn't removing the `//` comment lines that
  reference the historically-relevant tokens, so the negative-match
  assertions trip on doc strings. Verified pre-existing via `git stash`.
  Plan 06-03 changes (`packages/protocol/*`, `apps/server/src/RebnoRoom.ts`,
  `apps/server/src/onMessageHandlers.ts`, `apps/server/src/rate-limit.ts`,
  `tools/scripts/lint-rate-limit-budgets.mjs`) do not touch
  `apps/server/src/admin-stubs.ts` or this test file.

- **Stale `.js` emit files in `apps/server/{src,test}/`** — the
  `.gitignore` already excludes them but they were present in the
  worktree from a prior tsc run and intercepted vitest's TS resolution
  (vitest 4 + NodeNext picked up `rate-limit.js` instead of
  `rate-limit.ts`). Cleared during plan 06-03 via `find ... -delete`
  on untracked files only. Re-run of `tsc -b` would re-emit them; the
  long-term fix belongs in a tooling plan that disables emit (e.g.
  `noEmit: true` in `apps/server/tsconfig.json` + a separate
  `tsconfig.build.json` for actual builds).

- **Server integration test "seat reservation expired" flake** —
  `apps/server/test/{auth,reconnect,rate-limit,room-hot-reload,sigterm,authority}.integ.test.ts`
  surface intermittent `MatchMakeError: seat reservation expired` on
  this Windows worktree environment. The sub-second timing suggests
  Colyseus's matchmaker is rejecting the seat reservation before the
  WS client can consume it, possibly due to onAuth ServerError being
  surfaced through the SDK as the "seat reservation expired" sentinel
  rather than the underlying message. Pre-existing on this worktree
  (verified via `git stash` against the rejoin test). Coverage of the
  underlying contract (PROTOCOL_VERSION mismatch handling, SIGTERM
  grace, allowReconnection) lives in the protocol unit tests
  (`packages/protocol/test/codec.test.ts`) and server unit tests; the
  integ-level reproduction is environmental.

- **Room layout signature mismatch in tests** — `keys/rebno-room-signing.ed25519`
  is gitignored; new worktrees have the public-key file but not the
  private key, so `loadOrGenerateKeys` regenerates a new keypair and
  the signed `apps/server/rooms/mvp-lobby/000.sig` no longer verifies.
  This breaks `boot.integ.test.ts:rooms_loaded === 1` and the
  `home-portal-spawn.integ.test.ts` lookup path on a fresh worktree.
  Workaround: copy the canonical private key into the worktree before
  running integ tests, or override `ROOM_SIGNING_PRIVATE_KEY_PATH`.
  Plan 06-03 home-portal contract is verified by the `findHomePortal()`
  fallback logic and the protocol-package contract; full e2e coverage
  for spawn at (500, 500) requires a worktree with valid signing keys.

## From Plan 06-08

- **Windows entry-guard mismatch in `apps/server/src/index.ts:387`** — the
  guard is
  ```ts
  if (import.meta.url === `file://${process.argv[1]}`) { boot()… }
  ```
  On Windows, `import.meta.url` resolves to `file:///C:/.../src/index.ts`
  (forward slashes, triple-slash) while `process.argv[1]` is
  `C:\Users\...\src\index.ts` (backslashes, no scheme). The string
  comparison never matches, so `pnpm --filter @rebno/server dev` exits
  silently after `.env` load instead of booting Express + Colyseus on
  :2567. Affects only Windows local dev — Linux CI (ubuntu-latest) is
  unaffected. The proper fix is `pathToFileURL(process.argv[1]).href`
  on the right-hand side; tooling work for a future plan.

  Direct impact on plan 06-08: the local-dev Playwright two-client smoke
  cannot run on this Windows worktree. The plan task 2 explicitly
  acknowledges operator-driven smoke ("Local manual smoke (operator)
  before declaring task done"). CI runs on ubuntu-latest where the
  guard works; the staging-deploy Playwright step (Task 3 YAML
  extension) will exercise the test against deployed staging.

- **Server static-mount missing for client bundle** —
  `apps/server/src/index.ts` does NOT call `app.use(express.static(...))`
  for `apps/server/public/`. Plan 06-01 created the mount-point directory
  (`apps/server/public/.gitkeep` + `.gitignore`) and plan 06-08 task 3
  extends `deploy-staging.yml` to bundle the client into that directory
  via `pnpm --filter @rebno/client build:staging`, but no current plan
  wires the Express middleware that would actually serve `index.html`
  + `/assets/*.js` to a Chrome request hitting `/`. Result: a Playwright
  test pointed at `https://staging.rebno.decidel.com/` (the deploy-staging
  post-deploy gate) will currently 404 on the SPA root.

  Plan 06-08 sidesteps this for LOCAL e2e by booting Vite dev server on
  :5173 (which serves the SPA from source and proxies API/WS to :2567)
  — see `apps/client/playwright.config.ts` two-webServer mode. The
  static-mount wiring belongs in a near-term plan (likely 06-09 verify
  gate or a dedicated server hardening plan); plan 06-08 task 3 should
  not be considered fully GREEN against deployed staging until the
  middleware lands. Documented as a known limitation in 06-08-SUMMARY.md.

## From Plan 06-06

- **`tools/scripts/lint-game-logic-purity.mjs` CRLF strip bug** — the
  per-line comment stripper uses `/\/\/.*$/` which on Windows (CRLF
  line endings) leaves the `\r` in place and `$` does not match before
  it, so `// ... Math.random anywhere.\r` is not stripped. Result:
  `packages/game-logic/src/{rng.ts,step.ts}` are reported as containing
  forbidden API `Math.random` even though the references are in
  comments documenting that they DO NOT use it. Pre-existing on
  Windows worktrees (the lint script predates plan 06-06). Plan 06-06's
  new `accumulator.ts` is independently verified clean (no Math.random
  occurrences anywhere, even in comments). Suggested fix is a one-line
  regex change to `/\/\/[^\r\n]*$/m` or pre-strip CR; that's tooling
  work for a future plan, NOT plan 06-06's mandate.