[coin-au-carre]

Update PurpleWave from a57d2511cc4f6318c2a2d61a504e8f58a7b090af to buildable upstream 08672150433a2c60f5db23e10d2bc15dbc6e302e, rebase runtime-state isolation and guard the reproduced empty-threat Gather.max crash. Assigned Protoss/Terran/Zerg local 1v1 remains experimental. Production approval is deferred; no releaseStatus approval is added.

For players, the 172-commit upstream update includes PvP opening/defense changes, Dark Templar targeting, Observer survival/scouting fixes, and pathfinding/combat-simulation performance work. These describe source changes, not a measured strength or performance gain. The local Gather guard prevents an empty-threat scoring exception for zero-health worker snapshots.

Corrected unpublished sb.6 is built through guarded recipe 17b377c with ShieldBattery modifier attribution and experimental 1v1 in both embedded descriptor and matching staging fragment:

• ZIP SHA-256: 477ee3cc900eb0851bcd726c8e2f8781579a38daaf8c0f876383b5127f0db722 (20,065,830 bytes).
• Descriptor SHA-256: 18362afc51831f3bd78135edbf42bcbee4fec5960715811ecce4f2e5cef1d6f0.
• All six runtime JARs, patched upstream source, notices and working configuration match prior admitted runtime. Only descriptor, build record and packager snapshot differ from the previous local archive. Earlier archives remain preserved by their original digests; no published package is overwritten.

Removed standalone production proposal/fragment/validation, release-unit note, superseded sb.5 reports and two ShieldBattery bridge patches. Relevant prior source/gameplay/persistence evidence is consolidated in a historical record with its original package/client scope. Those observations remain evidence for the tested combinations; they do not make this candidate verified across shipped clients.

Local validation at 1b5f02f:

• Fresh guarded JDK 21.0.11 / Scala 2.12.20 build; eight actual compiled Gather regressions passed.
• Independent offline rebuild from extracted packaged source reproduced all six runtime JARs.
• Actual ShieldBattery catalog verifier, installer and profile-reset functions passed isolated signed HTTPS installation, signature/ZIP tamper and descriptor-mismatch rejection, failed-install preservation, two isolated profiles and offline reset with zero requests and immutable package unchanged. Test signing used ephemeral trust and normal TLS certificate verification; reset probes were synthetic. No new Electron UI, active-game lease or gameplay verification is claimed.
• Frozen-lockfile install with scripts disabled, metadata check, typecheck, lint/format, repository validation and all 66 tooling tests passed. Maintained archive/descriptor verifier and committed-recipe guard passed; separate Gate production publication and approve six existing local-practice releases #4 production gate rejected this candidate before download.

The experimental staging fragment is prepared, but catalog/catalog.json remains unchanged. At reconciliation, the sb.6 release URL was unavailable. Integrate the per-release gate from #4 and host this exact ZIP before adding the matching fragment to active staging catalog; otherwise it would block staging preparation. Production approval requires a later reviewed change after required client fixes ship and exact signed staging delivery/receipt are verified. minimumBridgeVersion is parsed but not enforced by the client, so increasing its string alone would not protect older clients.

Human difficulty, public competition, Random, teams/FFA, unusual maps and exhaustive late-game command conformance remain unverified. Pushing this PR does not upload a release, sign/publish a catalog or promote production.

Current admission and limits · Corrected staging fragment · Fresh validation · Scoped historical evidence

[2Pacalypse-]

Thanks for the thorough work on this. The upstream update itself looks good to me: both patches apply cleanly to 08672150, and I went through the full upstream diff from the sb.4 pin without finding any new file, network or process access outside the profile with the fixed configuration. I'd like a couple of changes before merging, though, mostly around the production-approval part.

1. The catalog fragment no longer matches the approved ZIP

The last commit (fd0985f) changed the modifier for the upstream-update entry from "Florian D." to "ShieldBattery" in the fragment and in package-purplewave.ts, but kept the artifact sha256 and manifestSha256. At c6b968b the fragment's package object serializes to exactly 18d363c4…, but at the head it serializes to 56656317…. So the package.json inside 60f80501… still says "Florian D.", and once the fragment is merged into the catalog, publish preparation would reject it: docs/publisher.md requires the embedded descriptor to equal the catalog's package object. pnpm validate and the tests don't read files under docs/, which is why nothing caught it.

There are two ways to fix it: revert the fragment edit and keep the admitted ZIP as it is, or repackage with "ShieldBattery" and re-run the checks that are tied to the archive hash (signed install, tamper rejection, reset) on the new bytes.

2. The required client fixes aren't expressed in the package

The descriptor still declares minimumBridgeVersion: '1' with 1v1 verified. The dependency on ShieldBattery#1831, #1837 and #1841 only appears in the limitations text. A client that gets #1838 (production runtime and approval gates) before #1841 would install this release and hit what your admission record measured: roughly 2,000 rejected Lift commands per Terran bot per game, and rejected Spider Mine attempts, while the listing says verified. I'm not sure whether the app currently enforces minimumBridgeVersion, but if it does, bumping it to the bridge version that contains those fixes would make the requirement real. Otherwise, tie the approval to the ShieldBattery release that ships them. If you repackage for #1, this costs nothing extra.

Suggestion: split the production approval out

Since production is blocked on PR #4 and four ShieldBattery PRs anyway, I'd rather this PR add sb.6 to catalog/catalog.json for staging with experimental 1v1, the same way Steamhammer and Infested Artosis were admitted. Production approval can then be a small follow-up catalog change once those land, which is the flow #4 itself describes. That would let us drop the standalone production fragment, the production validation files, the release-unit note, and the bot.json limitations that point at unmerged PRs. I'd also leave out the sb.5 docs for the superseded candidate, and the two ShieldBattery bridge patches under docs/releases/, which fit better in the ShieldBattery PRs. The sb.6 admission record can carry forward whatever from sb.5 still applies.

Questions

• Could you add a short summary of what changed for players between the two upstream pins? The release records cover the test evidence well but don't say what the update brings.

[coin-au-carre]

Addressed your review in 17b377c / 1b5f02f:

1. Rebuilt/repackaged unpublished sb.6 with ShieldBattery attribution. New ZIP 477ee3cc… and descriptor 18362afc… match the staging fragment exactly. Reran archive-dependent checks on these bytes: signed isolated HTTPS install, signature/ZIP tamper and descriptor-mismatch rejection, failed-install preservation and offline reset passed using actual ShieldBattery functions. These are function-level checks, not new Electron UI/gameplay evidence. All six runtime JARs match the earlier admitted runtime; packaged-source rebuild reproduced them.
2. Candidate and embedded descriptor now keep 1v1 experimental, with production approval deferred. I checked minimumBridgeVersion: the client parses it but does not enforce it. Raising it would not gate the required fixes, so approval must wait for the client release shipping them and verified signed staging delivery.
3. Removed production proposal/fragment/validation, release-unit note, superseded sb.5 reports and ShieldBattery bridge patches. Applicable old evidence is consolidated with its original scope. I agree on experimental staging, but left the active catalog unchanged because the exact ZIP must be hosted and Gate production publication and approve six existing local-practice releases #4 gate integrated first; adding an unavailable URL now would break staging preparation. The matching experimental fragment is ready for that step and has no production approval.

For players: upstream brings PvP opening/defense work, Dark Templar targeting, Observer survival/scouting fixes, and pathfinding/combat-simulation performance changes; the local guard prevents the reproduced empty-threat Gather crash. Admission and description now summarize this without claiming a measured strength gain.

All 66 tooling tests, contributor checks and eight compiled Gather regressions passed. No package upload or catalog publication/promotion performed.