# Map and production audit — October 5, 2026

Tracked in [Linear DUN-30](https://linear.app/dungeons-and-projects/issue/DUN-30/fix-map-and-gameplay-bugs-and-prepare-minegeo-for-production).

## Fixes

- Panorama viewers own and release their textures on unmount. Failed and stalled
  loads release completed and late-arriving faces. There is no unbounded global
  cache of every panorama and rotating signed URL.
- Map-image failures and stalled loads show a retry control, including results.
  Map cleanup is installed before image initialization. Resizing keeps the map
  fitted or preserves the player's view. Keyboard users can pan with arrow keys
  and press Enter to place a pin at the center.
- Countdown synchronization accounts for request latency and uses a monotonic
  clock. Submission has an immediate lock, failed timeout requests stop retrying
  behind an error dialog, current-round points update immediately, and timeout
  results do not retain an unsubmitted pin.
- Session media signing uses a single batch for the map and 30 faces. Catalog
  signing deduplicates images. Existing revision/media authorization is retained.
- Missing/invalid map IDs get a 404; backend failures reach the retryable error
  boundary. The error page now uses Next.js 16.3's `retry()` to fetch fresh data.
  Database transport/schema errors return 503 without exposing their internals.
- All API responses prevent caching, guest HTTPS cookies respect the configured
  proxy origin, production disables the origin bypass, and baseline browser
  security headers are configured. Startup validates environment, heap and
  panorama size before launching either process.
- Client requests explain offline, timeout and non-JSON gateway errors. Catalog
  searches trim whitespace, source/result selection exposes pressed state,
  successful dashboard refreshes clear stale errors, and sign-out failures stay
  visible. Results now label the dashboard link accurately as My maps.

## Validation

- 63 Node regression tests passed, including new client-error, texture-disposal,
  clock, startup-config, backend-error and production-origin tests.
- TypeScript checking and the optimized Next.js 16.3.8 production build passed.
- The HTTP/API/Storage smoke passed against both development and compiled
  production servers with the configured backend. It exercised pages/JARs,
  headers, privacy, signed map/cubemap downloads, five rounds, duplicate requests,
  out-of-bounds rejection and foreign-origin denial, then deleted its test games.
- Codex's built-in browser verified the live homepage/catalog, trimmed search,
  hard-mode panorama and timeout, game reload/results and result-round selection.
  A separate local fixture verified failed map images, successful retry, keyboard
  guessing and rectangular-map resizing. Browser checks found no uncaught errors.
- The production npm dependency audit reported zero known vulnerabilities.
- The Supabase security advisor and a permissions query confirmed public workflow
  RPCs use invoker security and deny anon/authenticated execution. Informational
  no-policy notices concern deliberately server-only RLS tables.

## Launch requirements and limits

Leaked-password protection remains disabled in the configured Supabase project;
it must be enabled in provider settings where the plan supports it. Production
SMTP, emailed login/recovery delivery, public HTTPS/proxy configuration and
restoration from backups were not exercised in this local audit. No deployment,
new Minecraft client capture, or cross-platform worker benchmark was performed.
Follow [the production guide](production.md) before public launch.