SUPER BOMB REVERSI To-Do 202605252359
STATE SNAPSHOT
✔ Auth refactor COMPLETE: session dependency removed
✔ Single signed cookie system: sbr_auth
✔ Google + Dev login unified under HMAC token payload
✔ Runtime now fully token-driven (no scattered session reads)
CRITICAL REMINDER
You renamed index.php to:
monday_sucks_20260526_index_rename_back.php
Do NOT lose this file name or future-you will waste 40 minutes.
NEXT DEBUG TARGET (HIGH PRIORITY)
show_game without tog is choking intermittently.
LIKELY AREA:
- auto-nav queue edge case
- missing termination condition
- double trigger from navigation loop
START TRACE HERE:
→ reproduce with 3 games (bh baby path)
→ force end-of-queue state
→ confirm show_game behavior WITHOUT auto-nav
KNOWN WEIRDNESS
• Two bottom links exist where only one should
• Likely duplicated render path OR fallback nav injection
• Treat as symptom, not root cause
ARCHITECTURE PROGRESS
Session state eliminated.
All auth now flows through:
sbr_auth → signed JSON payload → HMAC verification
Dev auth is unified.
It is just: dev_auth flag inside token
STATUS
SITE: stable-ish
AUTH: clean
GAME ENGINE: mostly stable, one known choke point
REENTRY DIRECTIVE
Next:
1. Fix show_game toggle choke
2. Find duplicate link render path
3. Re-test full auth flow (Google + Dev)
4. Only then expand game modes (guess-a-number later)