scatter-sync: room edits reach a joiner whose approval dial-back is still opening; scatter suites back to required

.env.example

@@ -42,3 +42,19 @@ VITE_SKIP_WELCOME=false
 # `<package version>-preview`; set VITE_RELEASE_LABEL (≤ 24 chars) to name it explicitly.
 # VITE_ERROR_REPORTS_URL=
 # VITE_RELEASE_LABEL=
+
+# 69 T3: Content-Security-Policy for BUILDS (`npm run dev` sends none). The policy is written into
+# every page as a <meta> (see csp.config.js) and `frame-ancestors` into build/_headers (Cloudflare
+# Pages reads it; another server should send that header line itself). All optional:
+# VITE_CSP_SCRIPT_SRC=            # extra script origins, e.g. https://static.cloudflareinsights.com
+# VITE_CSP_CONNECT_SRC=           # REPLACES the default connect-src ('self' https: wss: + localhost)
+# VITE_CSP_EXTRA_CONNECT=         # added to the default connect-src
+# VITE_CSP_IMG_SRC=               # REPLACES the default img-src / media-src ('self' data: blob: https:)
+# VITE_CSP_FRAME_ANCESTORS=       # who may frame the app (default * — see VITE_PLAY_ORIGIN)
+# VITE_CSP=off                    # ship no policy (a deployment that sets its own at the edge)
+
+# 69 T4: an optional second origin for PLAYING (same build, served twice). Play links and embeds point
+# there; storage is per origin, so a played scene's page holds none of the editor's (login, AI keys,
+# autosaves). On that origin the page is player-only. Unset = one origin for everything (as before).
+# VITE_PLAY_ORIGIN=https://play.example.com
+# VITE_APP_ORIGIN=https://app.example.com     # where the player's "Open in the app" link goes

.github/workflows/battery.yml

@@ -0,0 +1,110 @@
+# deps-auto — ONE SHARD SET OF THE E2E BATTERY (called by deps.yml: the required set, then the optional set).
+# scripts/ci/battery.cjs decides which suites a shard runs (tests/e2e/battery.json); this file only builds the
+# machine: the lockfile's Playwright container, core + the sibling content at the refs battery.json pins, the
+# module zips, then the shard (its own dev server + local signaling server) and the artifact.
+name: battery
+
+on:
+  workflow_call:
+    inputs:
+      set:
+        description: required | optional | confirm (re-runs the required set's reds on fresh runners)
+        type: string
+        required: true
+      matrix:
+        description: the plan job's matrix JSON for this set
+        type: string
+        required: true
+      playwright:
+        type: string
+        required: true
+      refs:
+        description: battery.json's refs (JSON)
+        type: string
+        required: true
+      deadline:
+        description: minutes after which a shard starts no new suite
+        type: number
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  shard:
+    name: ${{ inputs.set }} ${{ matrix.shard }}/${{ matrix.of }}
+    runs-on: ubuntu-latest
+    # a hard cap far past any deadline: the deadline is what ends a shard normally
+    timeout-minutes: 110
+    # the browsers and their OS libraries at exactly the lockfile's Playwright: no 5-minute apt step per shard
+    container:
+      image: mcr.microsoft.com/playwright:v${{ inputs.playwright }}-noble
+      options: --ipc=host
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(inputs.matrix) }}
+    # the sibling checkouts sit beside core, where the suites' own defaults look for them. Inside a
+    # container the workspace is NOT ${{ github.workspace }} (that is the host path): use the env vars.
+    env:
+      E2E_NO_PERF_OFFER: '1'
+      MODE: quick
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: core
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ fromJSON(inputs.refs).scenes.repo }}
+          ref: ${{ fromJSON(inputs.refs).scenes.ref }}
+          path: scenes
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ fromJSON(inputs.refs).modules.repo }}
+          ref: ${{ fromJSON(inputs.refs).modules.ref }}
+          path: modules
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ fromJSON(inputs.refs).packs.repo }}
+          ref: ${{ fromJSON(inputs.refs).packs.ref }}
+          path: packs
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: core/.nvmrc
+          cache: npm
+          cache-dependency-path: |
+            core/package-lock.json
+            modules/package-lock.json
+      - name: install
+        run: |
+          command -v openssl > /dev/null || (apt-get update -qq && apt-get install -y -qq --no-install-recommends openssl > /dev/null)
+          (cd core && npm ci --no-audit --no-fund && npm run certs)
+          # the module zips the game suites install (MODULES_REPO)
+          (cd modules && npm ci --no-audit --no-fund && node scripts/pack.cjs --all --force)
+      # confirm: what the required shards left red (or unrun), from their artifacts
+      - uses: actions/download-artifact@v4
+        if: inputs.set == 'confirm'
+        with:
+          pattern: battery-required-*
+          path: prev
+      - name: battery shard ${{ matrix.shard }}/${{ matrix.of }} (~${{ matrix.est }} min, ${{ matrix.suites }} suites)
+        working-directory: core
+        run: |
+          W=$GITHUB_WORKSPACE; S=$W/scenes; G=$S/games
+          export SCENES_DIR=$S SCENES_REPO=$S SHELL_SCENES_DIR=$G GAMES_DIR=$G FBW_SCENES=$S/examples
+          export MODULES_REPO=$W/modules MODULES_DIR=$W/modules PACKS_DIR=$W/packs
+          for g in dungeon-realms:DUNGEON_REALMS escape-room:ESCAPE football:FOOTBALL jam-room:JAM_ROOM marble-maze:MARBLE \
+                   mini-golf:MINIGOLF sky-run:SKY_RUN stars-room:STARS_ROOM target-toss:TARGET_TOSS towers:TOWERS \
+                   untangle:UNTANGLE waves:WAVES race:RACE; do export "${g#*:}_TPSCENE=$G/${g%%:*}/scene.tpscene"; done
+          export JELLY_TPSCENE=$S/examples/jelly-room/scene.tpscene TANK_TPSCENE=$S/examples/fluid-tank-toy/scene.tpscene \
+                 POOL_TPSCENE=$S/examples/pool-party/scene.tpscene
+          node scripts/ci/battery.cjs run --set ${{ inputs.set }} ${{ inputs.set == 'confirm' && '--from "$W/prev"' || '' }} --shard ${{ matrix.shard }} --of ${{ matrix.of }} --serve --port 5173 \
+            --deadline ${{ inputs.deadline }} --out "$W/battery-out"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: battery-${{ inputs.set }}-${{ matrix.shard }}
+          # every suite's log; screenshots and evidence only for the suites that failed (the runner deletes the
+          # rest). Beside core, not in it: an artefact inside the served tree reloads the app mid-test.
+          path: battery-out
+          retention-days: 14
+          if-no-files-found: ignore

.github/workflows/ci.yml

@@ -23,6 +23,11 @@ on:
   push:
     branches: [main, release/next]
   workflow_call:
+    inputs:
+      # deps.yml: the e2e battery runs these suites itself, so the two browser jobs below stand down
+      battery:
+        type: boolean
+        default: false
 
 jobs:
   build:
@@ -149,6 +154,7 @@ jobs:
       - run: npm run test:unit
 
   e2e-smoke:
+    if: ${{ !inputs.battery }}
     runs-on: ubuntu-latest
     # NOT a gate yet — see the header. Flip this to false once it has been green on a few
     # PRs in a row; until then a red here is a signal to read, not a block.
@@ -195,6 +201,7 @@ jobs:
   # screen-reader basics (live regions, selection announce, the object-list tree). One page at a
   # time and DOM-only assertions, so — unlike e2e-smoke — it gates.
   a11y:
+    if: ${{ !inputs.battery }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/deps.yml

@@ -4,7 +4,9 @@
 # target-branch). Every PR into `deps` runs the whole release gate here: ci.yml (build, the
 # svelte-check ratchet, vitest, scene-lint, kit-diff, a11y, supply chain) and perf-budget.yml, both
 # called as reusable workflows, then the integrators' e2e battery split into shards on
-# GitHub-hosted runners (SwiftShader: no GPU). `deps-gate` is the one required check; the ruleset on
+# GitHub-hosted runners (SwiftShader: no GPU, battery.yml): the REQUIRED set gates; the OPTIONAL set (red on
+# SwiftShader with unchanged code, each with its reason in tests/e2e/battery.json) runs after it and is only
+# reported. `deps-gate` is the one required check; the ruleset on
 # `deps` also requires the `pc-battery` commit status, which the GPU check on a desktop posts for a
 # PR that changes what the app ships (scripts/ci/pc-battery.sh — pulled from there, no runner of ours
 # in this public repo) and this workflow posts as "not needed" for every other PR.
@@ -82,17 +84,29 @@ jobs:
     needs: scope
     if: needs.scope.outputs.gate_ci == 'true'
     uses: ./.github/workflows/ci.yml
+    with:
+      battery: true
 
+  # the budget gate in three parallel parts (~20 min each instead of ~60 in one)
   perf:
     needs: scope
     if: needs.scope.outputs.gate_ci == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        part: [1, 2, 3]
     uses: ./.github/workflows/perf-budget.yml
+    with:
+      part: ${{ matrix.part }}
+      parts: 3
 
   plan:
     needs: scope
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.plan.outputs.matrix }}
+      optional_matrix: ${{ steps.plan.outputs.optional_matrix }}
+      optional_shards: ${{ steps.plan.outputs.optional_shards }}
       playwright: ${{ steps.pw.outputs.version }}
       refs: ${{ steps.refs.outputs.refs }}
     steps:
@@ -104,81 +118,60 @@ jobs:
       - id: refs
         run: echo "refs=$(node -p "JSON.stringify(require('./tests/e2e/battery.json').refs)")" >> "$GITHUB_OUTPUT"
 
+  # the suites that gate (sized by battery.json to finish inside the hour)
   e2e:
-    name: e2e ${{ matrix.shard }}/${{ matrix.of }}
     needs: plan
+    uses: ./.github/workflows/battery.yml
+    with:
+      set: required
+      matrix: ${{ needs.plan.outputs.matrix }}
+      playwright: ${{ needs.plan.outputs.playwright }}
+      refs: ${{ needs.plan.outputs.refs }}
+      deadline: 75
+
+  # SwiftShader makes any one suite fail now and then, twice on one loaded runner too: a required red (or a suite
+  # the deadline left unrun) gets two more tries on a FRESH runner before it counts
+  confirm:
+    needs: [plan, e2e]
+    if: always() && needs.e2e.result == 'failure'
+    uses: ./.github/workflows/battery.yml
+    with:
+      set: confirm
+      matrix: '{"include":[{"shard":1,"of":3,"suites":0,"est":0},{"shard":2,"of":3,"suites":0,"est":0},{"shard":3,"of":3,"suites":0,"est":0}]}'
+      playwright: ${{ needs.plan.outputs.playwright }}
+      refs: ${{ needs.plan.outputs.refs }}
+      deadline: 20
+
+  # red or flaky on SwiftShader with the same red on unchanged code: run, reported, never waited for. They start
+  # AFTER the required shards and the confirm step (the free plan runs 20 jobs at once); deps-gate does not need them.
+  e2e-optional:
+    needs: [plan, e2e, confirm]
+    if: always() && needs.plan.outputs.optional_shards != '0'
+    uses: ./.github/workflows/battery.yml
+    with:
+      set: optional
+      matrix: ${{ needs.plan.outputs.optional_matrix }}
+      playwright: ${{ needs.plan.outputs.playwright }}
+      refs: ${{ needs.plan.outputs.refs }}
+      deadline: 40
+
+  optional-report:
+    needs: e2e-optional
+    if: always() && needs.e2e-optional.result != 'skipped'
     runs-on: ubuntu-latest
-    timeout-minutes: 100
-    # the browsers and their OS libraries at exactly the lockfile's Playwright: no 5-minute apt step per shard
-    container:
-      image: mcr.microsoft.com/playwright:v${{ needs.plan.outputs.playwright }}-noble
-      options: --ipc=host
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
-    # the sibling checkouts sit beside core, where the suites' own defaults look for them. Inside a
-    # container the workspace is NOT ${{ github.workspace }} (that is the host path): use the env vars.
-    env:
-      E2E_NO_PERF_OFFER: '1'
-      MODE: quick
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
         with:
-          path: core
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ fromJSON(needs.plan.outputs.refs).scenes.repo }}
-          ref: ${{ fromJSON(needs.plan.outputs.refs).scenes.ref }}
-          path: scenes
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ fromJSON(needs.plan.outputs.refs).modules.repo }}
-          ref: ${{ fromJSON(needs.plan.outputs.refs).modules.ref }}
-          path: modules
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ fromJSON(needs.plan.outputs.refs).packs.repo }}
-          ref: ${{ fromJSON(needs.plan.outputs.refs).packs.ref }}
-          path: packs
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: core/.nvmrc
-          cache: npm
-          cache-dependency-path: |
-            core/package-lock.json
-            modules/package-lock.json
-      - name: install
-        run: |
-          command -v openssl > /dev/null || (apt-get update -qq && apt-get install -y -qq --no-install-recommends openssl > /dev/null)
-          (cd core && npm ci --no-audit --no-fund && npm run certs)
-          # the module zips the game suites install (MODULES_REPO)
-          (cd modules && npm ci --no-audit --no-fund && node scripts/pack.cjs --all --force)
-      - name: battery shard ${{ matrix.shard }}/${{ matrix.of }} (~${{ matrix.est }} min, ${{ matrix.suites }} suites)
-        working-directory: core
-        run: |
-          W=$GITHUB_WORKSPACE; S=$W/scenes; G=$S/games
-          export SCENES_DIR=$S SCENES_REPO=$S SHELL_SCENES_DIR=$G GAMES_DIR=$G FBW_SCENES=$S/examples
-          export MODULES_REPO=$W/modules MODULES_DIR=$W/modules PACKS_DIR=$W/packs
-          for g in dungeon-realms:DUNGEON_REALMS escape-room:ESCAPE football:FOOTBALL jam-room:JAM_ROOM marble-maze:MARBLE \
-                   mini-golf:MINIGOLF sky-run:SKY_RUN stars-room:STARS_ROOM target-toss:TARGET_TOSS towers:TOWERS \
-                   untangle:UNTANGLE waves:WAVES race:RACE; do export "${g#*:}_TPSCENE=$G/${g%%:*}/scene.tpscene"; done
-          export JELLY_TPSCENE=$S/examples/jelly-room/scene.tpscene TANK_TPSCENE=$S/examples/fluid-tank-toy/scene.tpscene \
-                 POOL_TPSCENE=$S/examples/pool-party/scene.tpscene
-          node scripts/ci/battery.cjs run --shard ${{ matrix.shard }} --of ${{ matrix.of }} --serve --port 5173 --out "$W/battery-out"
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: battery-${{ matrix.shard }}
-          # every suite's log; screenshots and evidence only for the suites that failed (the runner deletes the
-          # rest). Beside core, not in it: an artefact inside the served tree reloads the app mid-test.
-          path: battery-out
-          retention-days: 14
-          if-no-files-found: ignore
+          pattern: battery-optional-*
+          path: battery
+      - name: optional suites (report only)
+        run: node scripts/ci/battery.cjs report battery || true
 
   # THE required check (the ruleset on `deps` names it)
   gate:
     name: deps-gate
-    needs: [scope, ci, perf, plan, e2e]
+    needs: [scope, ci, perf, plan, e2e, confirm]
     if: always() && needs.scope.result == 'success'
     runs-on: ubuntu-latest
     permissions:
@@ -190,7 +183,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
         with:
-          pattern: battery-*
+          pattern: battery-required-*
+          path: battery
+      - uses: actions/download-artifact@v4
+        if: needs.confirm.result != 'skipped'
+        with:
+          pattern: battery-confirm-*
           path: battery
       - name: battery report
         id: report

.github/workflows/perf-budget.yml

@@ -20,18 +20,26 @@ on:
   push:
     branches: [main, release/next]
   workflow_call:
+    inputs:
+      # deps-auto: deps.yml runs the gate as `parts` parallel jobs, this one = `part` (scripts/perf-games.cjs --part)
+      part:
+        type: number
+        default: 0
+      parts:
+        type: number
+        default: 1
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: perf-budget-${{ github.ref }}
+  group: perf-budget-${{ github.ref }}-${{ inputs.part }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   budget:
-    name: perf-budget
+    name: perf-budget${{ inputs.part && format(' {0}/{1}', inputs.part, inputs.parts) || '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 75
     steps:
@@ -91,13 +99,14 @@ jobs:
           APP_URL: https://localhost:5173/
           PERF_SCENES_DIR: ${{ runner.temp }}/perf-deps/scenes
           PERF_MODULES_DIR: ${{ runner.temp }}/perf-deps/modules
-        run: node scripts/perf-games.cjs --check --label ci --out perf/out
+          PART: ${{ inputs.part && format('{0}/{1}', inputs.part, inputs.parts) || '' }}
+        run: node scripts/perf-games.cjs --check --label ci${PART:+-${PART%/*}} --out perf/out ${PART:+--part $PART}
 
       - name: the table
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: perf-budget
+          name: perf-budget${{ inputs.part && format('-{0}', inputs.part) || '' }}
           path: perf/out/
           if-no-files-found: ignore