Harden gameplay timing and map loading

docs/production-audit.md

@@ -0,0 +1,57 @@
+# Map and production audit — October 5, 2026
+
+Tracked in [Linear DUN-30](https://linear.app/dungeons-and-projects/issue/DUN-30/fix-map-and-gameplay-bugs-and-prepare-minegeo-for-production).
+
+## Fixes
+
+- Panorama viewers own and release their textures on unmount. Failed and stalled
+  loads release completed and late-arriving faces. There is no unbounded global
+  cache of every panorama and rotating signed URL.
+- Map-image failures and stalled loads show a retry control, including results.
+  Map cleanup is installed before image initialization. Resizing keeps the map
+  fitted or preserves the player's view. Keyboard users can pan with arrow keys
+  and press Enter to place a pin at the center.
+- Countdown synchronization accounts for request latency and uses a monotonic
+  clock. Submission has an immediate lock, failed timeout requests stop retrying
+  behind an error dialog, current-round points update immediately, and timeout
+  results do not retain an unsubmitted pin.
+- Session media signing uses a single batch for the map and 30 faces. Catalog
+  signing deduplicates images. Existing revision/media authorization is retained.
+- Missing/invalid map IDs get a 404; backend failures reach the retryable error
+  boundary. The error page now uses Next.js 16.3's `retry()` to fetch fresh data.
+  Database transport/schema errors return 503 without exposing their internals.
+- All API responses prevent caching, guest HTTPS cookies respect the configured
+  proxy origin, production disables the origin bypass, and baseline browser
+  security headers are configured. Startup validates environment, heap and
+  panorama size before launching either process.
+- Client requests explain offline, timeout and non-JSON gateway errors. Catalog
+  searches trim whitespace, source/result selection exposes pressed state,
+  successful dashboard refreshes clear stale errors, and sign-out failures stay
+  visible. Results now label the dashboard link accurately as My maps.
+
+## Validation
+
+- 63 Node regression tests passed, including new client-error, texture-disposal,
+  clock, startup-config, backend-error and production-origin tests.
+- TypeScript checking and the optimized Next.js 16.3.8 production build passed.
+- The HTTP/API/Storage smoke passed against both development and compiled
+  production servers with the configured backend. It exercised pages/JARs,
+  headers, privacy, signed map/cubemap downloads, five rounds, duplicate requests,
+  out-of-bounds rejection and foreign-origin denial, then deleted its test games.
+- Codex's built-in browser verified the live homepage/catalog, trimmed search,
+  hard-mode panorama and timeout, game reload/results and result-round selection.
+  A separate local fixture verified failed map images, successful retry, keyboard
+  guessing and rectangular-map resizing. Browser checks found no uncaught errors.
+- The production npm dependency audit reported zero known vulnerabilities.
+- The Supabase security advisor and a permissions query confirmed public workflow
+  RPCs use invoker security and deny anon/authenticated execution. Informational
+  no-policy notices concern deliberately server-only RLS tables.
+
+## Launch requirements and limits
+
+Leaked-password protection remains disabled in the configured Supabase project;
+it must be enabled in provider settings where the plan supports it. Production
+SMTP, emailed login/recovery delivery, public HTTPS/proxy configuration and
+restoration from backups were not exercised in this local audit. No deployment,
+new Minecraft client capture, or cross-platform worker benchmark was performed.
+Follow [the production guide](production.md) before public launch.