Integration Report — Mindustry

Step 0

Licence conflict check

Run before any CMPSBL file is copied. A STOP/EVALUATE ONLY blocks integration, not the required read-only evaluation. Mindustry is an independent-function game product, not a rebrand/mirror/training corpus of the library.

Sub-package exceptions: none found in the pinned host snapshot (basis: root/subtree licence-name search). The kit itself documents thirteen historical Apache-2.0 npm packages, but none is being integrated here.

Verdict

Step 5A — the section that sells

Composite components built for Mindustry

Four combinations survived because the new behavior comes from the wiring itself. One deliberately exposes a library limit: update provenance/evidence is possible, but publisher authenticity still needs a host-supplied trusted digest/signature source.

COMPOSITE #1 — Packet Boundary Lab
  Composition:   CMPSBL BLD-ENG-248 "Adversarial Input Generator" (ADVERSARIAL_CATALOG, generateAdversarialInputs) + CMPSBL BLD-ENG-105 "Forensic Replay" (AuditEvent, ReplaySession, ReplayResult, ForensicReplayEngine) + host tests/src/test/java/**, core/src/mindustry/net/Packets.java, core/src/mindustry/net/Streamable.java, core/src/mindustry/io/SaveFileReader.java
  Problem:       No dedicated adversarial network/security test suite was found; Streamable.java:38-62 accepts an advertised stream total and accumulates data client-side, and SaveFileReader.java:133-138 notes missing read-count validation.
  Behaviour:     Generates boundary/overflow/encoding/Unicode fixtures, routes them through the existing Java parsers in tests, captures the exact failure as an event, then replays the same case as a deterministic regression. Production packet code stays unchanged during the first phase.
  New because:   The input generator alone only makes cases; forensic replay alone only replays events. Together with Mindustry parsers they create a reusable “break it, capture it, replay it” boundary laboratory.
  Attachment:    tests/src/test/java/** -> Packets/Streamable/SaveFileReader public/test-accessible surfaces
  Untouched:     Generated packet definitions, live server rate limits, game simulation, Steam transport ordering, and production save writer.
  Effort:        ~2–4 engineer-days (basis: 33 + 103 entry LOC, 5 concerns across adversarial classes/case mapping/event normalization/replay/result comparison, plus Java/JUnit bridge work; no production wiring).
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:     catalog edge cases -> Java fixture adapter -> Mindustry parser -> captured result/event
                                      |                         |
                                      +---- forensic replay <---+

COMPOSITE #2 — Outbound Dependency Fuse
  Composition:   CMPSBL BLD-ENG-303 "retry-with-backoff" (RetryOptions, retry) + CMPSBL BLD-ENG-011 "Circuit Breaker" (CircuitState, CircuitBreakerConfig, CircuitStats, createCircuitBreaker) + CMPSBL BLD-ENG-243 "Module Health Metrics" (ModuleState, ModuleHealthMetrics) + host core/src/mindustry/net/BeControl.java and core/src/mindustry/net/SteamAdmin.java
  Problem:       BeControl.java:65-87 and SteamAdmin.java:17-62 call GitHub/raw endpoints; failures are handled/fallbacked, but there is no common bounded retry + open-circuit + health-state policy.
  Behaviour:     A failed external call retries with a small jittered budget; repeated failures open one dependency-specific breaker; the current call is failed/fallbacked without hammering; passive health state records last-seen/error-rate/recovery. Existing URLs and product fallback behavior remain authoritative.
  New because:   Retry, breaker and health metrics separately solve attempt timing, outage isolation and observability; only the composition turns an external dependency into a bounded, observable failure domain.
  Attachment:    BeControl.checkUpdate/download and SteamAdmin.fetch/fetchImpl callbacks
  Untouched:     Game networking, packet rate limits, Steam send queue, update source selection, Steam ban semantics.
  Effort:        ~2–4 engineer-days (basis: 55 + 169 + 85 entry LOC, retry/state/threshold/health concerns, two Java HTTP call sites, and bridge parity tests).
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:     GitHub/feed call -> retry budget -> circuit state -> existing success/fallback
                                    |
                                    +-> health state/logging

COMPOSITE #3 — Admin Decision Black Box
  Composition:   CMPSBL BLD-ENG-136 "Audit-Grade Decision Ledger" (LedgerEntry, AuditGradeDecisionLedger) + CMPSBL BLD-ENG-009 "Tamper-Evident Chain" (createAuditChain) + CMPSBL BLD-ENG-105 "Forensic Replay" (AuditEvent, ReplaySession, ReplayResult, ForensicReplayEngine) + host server/src/mindustry/server/ServerControl.java and core/src/mindustry/net/Administration.java
  Problem:       ServerControl already writes logs and Administration owns bans/admin state, but no structured append-only decision record was found that can reconstruct a moderation/command sequence after the fact.
  Behaviour:     Selected admin commands and moderation outcomes emit a structured record, chain it append-only, and expose an incident slice that can be replayed in a test harness. It does not replace existing logs or moderation logic.
  New because:   The ledger creates structured decisions, the chain makes append-history tampering visible, and replay turns the record into a reproducible artifact; none alone produces an incident “black box.”
  Attachment:    ServerControl.handleCommandString result path + Administration ban/admin mutations
  Untouched:     Command grammar, admin authorization rules, ban data structures, gameplay, and ordinary console logging.
  Effort:        ~3–5 engineer-days (basis: 70 + 67 + 103 entry LOC, event/actor/outcome schema + chaining + replay + retention/privacy review + Java bridge).
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:     admin/mod action -> existing Mindustry decision -> structured ledger -> hash chain
                                                        |
                                                        +-> incident replay fixture

COMPOSITE #4 — Bleeding-Edge Update Evidence Gate
  Composition:   CMPSBL BLD-ENG-229 "Provenance Chain Verifier" (ProvenanceLink, ProvenanceVerdict, ProvenanceChainVerifier) + CMPSBL BLD-ENG-009 "Tamper-Evident Chain" (createAuditChain) + host core/src/mindustry/net/BeControl.java + host SHA-256 pattern in core/src/mindustry/mod/DataAssetCache.java
  Problem:       BeControl.java:106-125 downloads then executes the desktop JAR; BeControl.java:143-164 downloads then replaces the server JAR. No local expected-digest or publisher-signature comparison was found before execute/replace.
  Behaviour:     Before launch/replace, compute a SHA-256 digest using the host’s existing hashing primitive, compare it to an expected digest supplied by a separately trusted release process, record the release metadata/digest decision in provenance and append-only evidence, and fail closed/manual if a trusted expected digest is unavailable or mismatched.
  New because:   Mindustry supplies SHA-256 mechanics; the catalog supplies provenance/audit evidence. Their composition can enforce a host-owned digest gate, but the catalog does NOT supply the missing independent trust anchor/signature verifier. This composite must not be described as cryptographic publisher authentication unless the host adds that trust source.
  Attachment:    BeControl.showUpdateDialog completion callback before Runtime.exec; BeControl headless download completion before dest.copyTo(source)
  Untouched:     GitHub release discovery, update UI, autosave/restart sequence, normal stable releases.
  Effort:        ~3–6 engineer-days (basis: 108 + 67 entry LOC, provenance/hash-chain concerns, two updater branches, trusted-digest release-process work and security tests; signature/trust-anchor implementation is host work, not catalog value).
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:     release metadata + trusted expected digest
                |
JAR download -> SHA-256 compare -> allow execute/replace OR fail closed
                |
                +-> provenance link -> tamper-evident receipt

Composite ledger

Build this composite first: Packet Boundary Lab. It changes the purchase decision because it validates the unclaimed Java bridge on a reversible, test-only path before production architecture depends on it.

Each composite inherits the weakest ingredient verification claim; where an ingredient has “Not claimed”, the composite has “Not claimed”.

Step 5B — new single-component designs

New components designed for this product

These are smaller, single-purpose host adapters built from one engineered catalog component plus Mindustry code. They are useful independently and can become ingredients in the Step 5A composites.

DESIGN #1 — Protocol Edge Fixture Factory
  Built from:   CMPSBL BLD-ENG-248 "Adversarial Input Generator" (ADVERSARIAL_CATALOG, generateAdversarialInputs)
  Plus host:    tests/src/test/java/**; core/src/mindustry/net/Packets.java; core/src/mindustry/net/Streamable.java; core/src/mindustry/io/SaveFileReader.java
  What it is:   A test-only adapter that translates the catalog’s injection/overflow/encoding/Unicode cases into valid Java/JUnit fixtures for Mindustry packet, stream and save boundaries. It records which parser accepted/rejected each case without changing production behavior.
  New because:  The catalog emits generic adversarial cases; the host adapter makes them game-protocol/save aware. This is smaller than the Packet Boundary Lab because it stops at deterministic fixture generation and results.
  Unlocks:      A repeatable parser-edge test lane that can be run on every protocol/save change.
  Evidence path:JUnit cases and a machine-readable failing-fixture record in the test output; no production telemetry required.
  Effort:       ~1–2 engineer-days (basis: 33 entry LOC + 3 host parser families + Java/JUnit mapping; test-only).
  Constraints:  BLD-ENG-248: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated | Host-language constraint: Java is one of the 23 non-TypeScript polyglot targets whose emitted sample is Not claimed; pre-purchase kit contains no polyglot/ bundle, so this report cannot verify the Java bridge.
  Confidence:   high — the host has concrete parsers and a JUnit module; only bridge shape is unverified.
  Data path:     ADVERSARIAL_CATALOG -> Java fixture mapper -> Packets / Streamable / SaveFileReader -> JUnit result

DESIGN #2 — Retry Policy Adapter
  Built from:   CMPSBL BLD-ENG-303 "retry-with-backoff" (RetryOptions, retry)
  Plus host:    core/src/mindustry/net/BeControl.java (176 nonblank LOC); core/src/mindustry/net/SteamAdmin.java (70 nonblank LOC)
  What it is:   A narrow Java-side wrapper around the existing callback HTTP calls that defines max attempts, exponential backoff with jitter, retry predicates and cancellation. It preserves each caller’s current success/error/fallback callbacks.
  New because:  Mindustry has error callbacks/fallbacks but no shared bounded retry policy on these paths; the adapter adds only that policy rather than importing a larger resilience subsystem.
  Unlocks:      Consistent transient-failure handling with one policy that can be tested independently.
  Evidence path:Attempt-count/timing unit tests plus existing logs; no new customer-facing surface.
  Effort:       ~1–2 engineer-days (basis: 55 entry LOC + jitter/predicate/cancellation + two Java call sites).
  Constraints:  BLD-ENG-303: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated | Host-language constraint: Java is one of the 23 non-TypeScript polyglot targets whose emitted sample is Not claimed; pre-purchase kit contains no polyglot/ bundle, so this report cannot verify the Java bridge.
  Confidence:   high for semantics, medium for delivery because Java bridge is Not claimed.
  Data path:     BeControl / SteamAdmin call -> RetryOptions adapter -> existing Http callback -> existing outcome

DESIGN #3 — Admin Decision Receipt
  Built from:   CMPSBL BLD-ENG-136 "Audit-Grade Decision Ledger" (LedgerEntry, AuditGradeDecisionLedger)
  Plus host:    server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC); core/src/mindustry/net/Administration.java (639 nonblank LOC)
  What it is:   A structured receipt emitted after selected moderation/administration decisions: actor reference, command/action class, target reference, result and time. The existing console log remains the human-readable record.
  New because:  Current logs say what happened; the receipt gives a stable schema and hash-linked decision history suitable for replay or audit later.
  Unlocks:      Faster incident review and a durable moderation evidence surface for operated servers.
  Evidence path:Ledger entries exported by incident/time range and cross-referenced to existing server logs.
  Effort:       ~1–2 engineer-days (basis: 70 entry LOC + event schema + 2 host decision surfaces + retention policy).
  Constraints:  BLD-ENG-136: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated | Host-language constraint: Java is one of the 23 non-TypeScript polyglot targets whose emitted sample is Not claimed; pre-purchase kit contains no polyglot/ bundle, so this report cannot verify the Java bridge.
  Confidence:   medium/high — host attachment is clear; privacy/retention policy is product-specific.
  Data path:     admin action -> existing decision -> LedgerEntry -> append-only decision ledger

DESIGN #4 — Release Provenance Receipt
  Built from:   CMPSBL BLD-ENG-229 "Provenance Chain Verifier" (ProvenanceLink, ProvenanceVerdict, ProvenanceChainVerifier)
  Plus host:    core/src/mindustry/net/BeControl.java
  What it is:   Records which release metadata URL, build number, asset URL and locally computed digest were considered before an updater decision. It is an evidence record only.
  New because:  The updater currently moves from metadata to executable/replacement behavior without a structured provenance artifact. This adds traceability while deliberately refusing to claim authenticity.
  Unlocks:      Post-incident proof of what updater metadata and bytes were observed; a foundation for a later real signature/digest gate.
  Evidence path:A provenance chain entry per update check/download decision.
  Effort:       ~1–2 engineer-days (basis: 108 entry LOC + metadata/digest mapping + Java bridge; excludes any trust-anchor/signature system).
  Constraints:  BLD-ENG-229: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated | Host-language constraint: Java is one of the 23 non-TypeScript polyglot targets whose emitted sample is Not claimed; pre-purchase kit contains no polyglot/ bundle, so this report cannot verify the Java bridge.
  Confidence:   medium — useful evidence, but it does not close the critical authenticity gap by itself.
  Data path:     GitHub release metadata + local digest -> ProvenanceLink -> provenance verdict/chain

DESIGN #5 — Endpoint Health Card
  Built from:   CMPSBL BLD-ENG-243 "Module Health Metrics" (ModuleState, ModuleHealthMetrics)
  Plus host:    core/src/mindustry/net/BeControl.java (176 nonblank LOC); core/src/mindustry/net/SteamAdmin.java (70 nonblank LOC); server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC)
  What it is:   Maintains passive last-success, last-error, uptime/error-rate and health score for the updater and Steam ban feed. In headless mode it can be surfaced through an existing status/log command rather than a new UI.
  New because:  The host has failures in logs but no common health state object for these dependencies.
  Unlocks:      Operators can distinguish “feature is fine but upstream is down” from local failure without reading raw logs.
  Evidence path:A status snapshot/log line derived from ModuleHealthMetrics; no automatic control decision required initially.
  Effort:       ~1 engineer-day (basis: 85 entry LOC + 4 health fields + two dependency adapters).
  Constraints:  BLD-ENG-243: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated | Host-language constraint: Java is one of the 23 non-TypeScript polyglot targets whose emitted sample is Not claimed; pre-purchase kit contains no polyglot/ bundle, so this report cannot verify the Java bridge.
  Confidence:   high — can start read-only/passive.
  Data path:     BeControl / SteamAdmin outcomes -> ModuleHealthMetrics -> existing status/log surface

Build this one first: Protocol Edge Fixture Factory. It is test-only, touches no production critical path, and gives the fastest evidence about whether the post-purchase Java bridge is usable.

Scoreboard

The numbers, each with its basis

Coverage is reported rather than implied. Shared-entry, discovery and twin-row edge cases are excluded from valuation as described below.

Step 1

What this repository already has

Host inventory was completed before catalog exposure. The pinned ZIP contains 4,511 members (basis: ZIP central-directory count), 4,238 files after extraction (basis: filesystem count), including 866 Java files (basis: .java count). A broad source/config scan counted about 260,312 nonblank text lines (basis: enumerated code/config/document extensions); the table focuses on units relevant to resilience, trust, audit, networking, codegen and tests.

Step 2

Five-axis screen of the candidate set

All 1,162 engineered rows were parsed after the host inventory. Forty-one rows matched a host concern strongly enough to read in full; the table keeps all forty-one, including rejects. Whole-subsystem screening was explicit: all 16 Subsystem-class rows were screened by Phase 2 metadata; SUBSYS-04 and SUBSYS-14 were read in full and rejected as disproportionate/wrong-boundary. DREAM received a full primitive read plus its three smaller direct dream rows and was rejected for lack of a host job.

Candidates screened in full: 41 (basis: host-matched set) · carried forward: 9 · rejected: 32. The catalog contains 240 rows flagged shared-entry (basis: parsed Phase 2/3 metadata); they were parsed and capability-screened but not sized/recommended from class-wide columns, and none contributes to savings. Twin artifacts were deduplicated for value: a twin counterpart never creates a second savings claim for the same capability.

Step 3

Constraints this host imposes

The dominant constraint is not licensing; it is execution evidence. The post-purchase delivery claims a polyglot bridge mechanism, but Java output is explicitly Not claimed and the emitter is absent from this pre-purchase kit.

Every recommended component's Verified column, quoted verbatim and expanded:

1. BLD-ENG-248: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
2. BLD-ENG-303: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
3. BLD-ENG-011: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
4. BLD-ENG-243: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
5. BLD-ENG-009: C:ok I:ok B:exec T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
6. BLD-ENG-136: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
7. BLD-ENG-229: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
8. BLD-ENG-105: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.
9. BLD-ENG-108: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit; mode=direct; ports=none; slices=none stated.

Governed runtime: none of the nine recommended rows is governed-required; all nine report mode direct. No governed runtime slice is required by these recommendations.

Adapter ports: none on the nine recommended engineered rows. Separate host-language bridge work remains required and is Not claimed for Java.

Step 4

Ranked recommendations

Nine engineered rows are worth funding consideration; only eight apply at the host defaults. Nothing here replaces Mindustry's core game/network/save systems. The release-authenticity gap remains host work because the catalog has no correct matching primitive.

Findings, in fixed shape

[HARDEN] CMPSBL BLD-ENG-303 "retry-with-backoff" -> host: core/src/mindustry/net/BeControl.java (176 nonblank LOC); core/src/mindustry/net/SteamAdmin.java (70 nonblank LOC)
  Why: Adds bounded exponential backoff, jitter, retry predicates and cancellation to external HTTP paths without replacing their product semantics.
  Uses: RetryOptions, retry
  Saves: ~1–2 engineer-days (basis: 55 entry LOC + jitter/predicate/cancellation concerns + Java callback adapter/tests).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-011 "Circuit Breaker" -> host: core/src/mindustry/net/BeControl.java (176 nonblank LOC); core/src/mindustry/net/SteamAdmin.java (70 nonblank LOC)
  Why: Adds a closed/open/half-open failure state so a dead external dependency is not retried indefinitely by callers or schedules.
  Uses: CircuitState, CircuitBreakerConfig, CircuitStats, createCircuitBreaker, createBreakerPanel
  Saves: ~1–3 engineer-days (basis: 169 entry LOC + 3-state transitions + backoff/jitter + stats + Java adapter/tests).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-266 "Retry Budget" -> host: host-first inventory: no sufficiently specific attachment point
  Why: No retry-storm evidence; token-bucket retry budgeting adds state before volume justifies it.
  Uses: tryRetry`, `remainingBudget`, `configureBudget`, `getBudgetStats`, `resetBudget
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-078 "Fallback Chain Architect" -> host: host-first inventory: no sufficiently specific attachment point
  Why: SteamAdmin already has a specific two-URL fallback, while the updater has one authority; a provider-chain abstraction adds little.
  Uses: ProviderSpec`, `FallbackChain`, `buildFallbackChain
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-047 "Circuit Breaker Fabric" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Breaker fabric is a mesh where one small breaker is enough for the observed external calls.
  Uses: BreakerState`, `CircuitBreaker`, `createBreaker`, `recordSuccess`, `recordFailure`, `canExecute`, `getBreaker`, `getAllBreakers`, `resetBreaker
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:exec T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-243 "Module Health Metrics" -> host: core/src/mindustry/net/BeControl.java (176 nonblank LOC); core/src/mindustry/net/SteamAdmin.java (70 nonblank LOC); server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC)
  Why: Makes updater/ban-feed health explicit instead of inferring it from log lines.
  Uses: ModuleState, ModuleHealthMetrics
  Saves: ~1 engineer-day (basis: 85 entry LOC + uptime/error-rate/last-seen/health-score concerns + Java adapter).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-009 "Tamper-Evident Chain" -> host: server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC); core/src/mindustry/net/Administration.java (639 nonblank LOC); core/src/mindustry/net/BeControl.java (176 nonblank LOC)
  Why: Adds append-only hash chaining for selected operational receipts; it does not replace current logs.
  Uses: createAuditChain
  Saves: ~1–2 engineer-days (basis: 67 entry LOC + append-only/hash-link concerns + event schema/retention policy + Java adapter).
  Verified: C:ok I:ok B:exec T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-136 "Audit-Grade Decision Ledger" -> host: server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC); core/src/mindustry/net/Administration.java (639 nonblank LOC)
  Why: Adds structured immutable decision records for admin commands/bans instead of reconstructing intent from free-text logs.
  Uses: LedgerEntry, AuditGradeDecisionLedger
  Saves: ~1–2 engineer-days (basis: 70 entry LOC + decision schema/hash chain + actor/outcome mapping + Java adapter).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-229 "Provenance Chain Verifier" -> host: core/src/mindustry/net/BeControl.java (176 nonblank LOC); core/src/mindustry/mod/DataAssetCache.java (70 nonblank LOC)
  Why: Adds prev-hash provenance evidence around release metadata/download decisions. It does NOT authenticate the downloaded JAR and must not be sold as doing so.
  Uses: ProvenanceLink, ProvenanceVerdict, ProvenanceChainVerifier
  Saves: ~1–3 engineer-days (basis: 108 entry LOC + provenance linkage/verdict + host SHA-256/digest-policy work + Java adapter).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-255 "Fingerprint Gate" -> host: core/src/mindustry/net/BeControl.java:106-125,143-164 (176 nonblank LOC file)
  Why: Uses deterministic FNV-1a structural fingerprints. That is drift detection, not a secure release authenticity check for executable JARs.
  Uses: SourceFingerprint`, `FingerprintVerification`, `computeFingerprint`, `computeMultiFileFingerprint`, `verifyFingerprint`, `ArtifactFingerprint`, `ArtifactSealInput`, `computeArtifactFingerprint`, `verifyArtifactFingerprint
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-248 "Adversarial Input Generator" -> host: tests/src/test/java/** (1,957 nonblank LOC total); core/src/mindustry/net/Streamable.java (129 nonblank LOC); core/src/mindustry/net/Packets.java (157 nonblank LOC); core/src/mindustry/io/SaveFileReader.java (188 nonblank LOC)
  Why: The host has parsers/stream assemblers but no dedicated adversarial network/security fixture suite.
  Uses: ADVERSARIAL_CATALOG, generateAdversarialInputs
  Saves: ~1–2 engineer-days (basis: 33 entry LOC + input-category mapping + Java/JUnit adapter + regression fixtures).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-174 "Adversarial Simulation" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Adversarial simulation is broader than the concrete parser/input gap; BLD-ENG-248 is smaller and easier to attach in tests.
  Uses: AttackScenario`, `SimulationResult`, `AdversarialSimulation
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-193 "Artifact Hardening Foundry" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Generic hardening attestations do not close a specific host failure before concrete adversarial tests exist.
  Uses: HardeningStage`, `Artifact`, `HardeningAttestation`, `ArtifactHardeningFoundry
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-098 "Terminal Command Parser" -> host: server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC); core/src/mindustry/net/Administration.java (639 nonblank LOC)
  Why: The host already has mature command registration/parsing. The optional socket concern is authentication, not parsing.
  Uses: CommandDefinition`, `ArgDefinition`, `FlagDefinition`, `ParsedCommand`, `AutocompleteResult`, `TerminalCommandParser
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-108 "API Key Lifecycle" -> host: server/src/mindustry/server/ServerControl.java:1428-1446 (1,255 nonblank LOC file); core/src/mindustry/net/Administration.java:553-555 (639 nonblank LOC file)
  Why: Conditional only: if socketInput is intentionally exposed beyond localhost, add key issuance/rotation/revocation before accepting commands. At defaults, skip it.
  Uses: APIKey, KeyAuditEntry, APIKeyLifecycleManager
  Saves: ~2–4 engineer-days if activated (basis: 99 entry LOC + key rotation/revocation/audit + security review + Java socket handshake; zero if socket stays disabled/localhost).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-074 "Capability Gate Engine" -> host: server/src/mindustry/server/ServerControl.java:1428-1446 (1,255 nonblank LOC file)
  Why: Generic capability gates do not establish identity on the raw TCP command socket and overlap existing admin permission semantics.
  Uses: CapabilityGate`, `GateEvaluation`, `registerGate`, `evaluateGate`, `listGates`, `removeGate
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:exec T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-247 "Secret Redactor" -> host: host-first inventory: no sufficiently specific attachment point
  Why: No evidenced secret-heavy structured logging path justified a redactor as a first-order change.
  Uses: redactSecrets`, `redactContext
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-256 "Schema Validator" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Its XSS/SQL/event-handler injection archetypes do not match Mindustry binary packet/save schemas; wrapping generated protocol would be the wrong abstraction.
  Uses: FieldSchema`, `ExecutorSchema`, `ValidationIssue`, `InputArchetype`, `ValidationReport`, `SchemaRegistry`, `validateInput
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-105 "Forensic Replay" -> host: server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC); core/src/mindustry/net/Administration.java (639 nonblank LOC); tests/src/test/java/** (1,957 nonblank LOC total)
  Why: Turns captured admin/incident events into reproducible replay sessions for regression analysis.
  Uses: AuditEvent, ReplaySession, ReplayResult, ForensicReplayEngine
  Saves: ~1–3 engineer-days (basis: 103 entry LOC + event normalization/replay/result comparison + Java/JUnit adapter).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-060 "Temporal Regression Sandbox" -> host: host-first inventory: no sufficiently specific attachment point
  Why: No time-series regression domain was found that would justify a temporal sandbox.
  Uses: StateSnapshot`, `RegressionResult`, `binarySearchRegression
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-050 "Shadow Run Environment" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Mindustry is not exposing a web-request lane suitable for production traffic mirroring; shadow infrastructure would be disproportionate.
  Uses: ShadowRun`, `ShadowAssertion`, `createShadowRun`, `startRun`, `addAssertion`, `addLog`, `completeRun`, `getRun`, `listRuns
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-215 "Contract Evolution Mediator" -> host: core/src/mindustry/net/Packets.java (157 nonblank LOC); core/src/mindustry/core/NetServer.java (1,235 nonblank LOC)
  Why: Mindustry already owns generated packet/version compatibility. A second contract-evolution layer risks competing with the authoritative protocol.
  Uses: ContractVersion`, `Contract`, `ContractEvolutionMediator
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-249 "Pipeline Lineage Registry" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Stage-by-stage pipeline lineage is less direct than event/update provenance and would duplicate evidence models.
  Uses: PipelineLineageRecord`, `PipelineLineageRegistry
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-096 "Webhook Reliability" -> host: core/src/mindustry/net/BeControl.java:106-125,143-164 (176 nonblank LOC file)
  Why: Webhook retry/dedupe/signature verification is the wrong transport and trust model for GitHub release JAR authentication.
  Uses: WebhookEvent`, `DeliveryAttempt`, `WebhookConfig`, `WebhookReliabilityEngine
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-012 "Rate Limiter" -> host: core/src/mindustry/net/Administration.java:543-552 (639 nonblank LOC file); core/src/mindustry/net/ArcNetProvider.java:129-170 (545 nonblank LOC file)
  Why: Host already has interaction/message/packet/chat limits, blacklists and kicks. Replacing them would trade specific game controls for a generic limiter.
  Uses: Strategy`, `RateLimitConfig`, `RateLimitResult`, `createRateLimiter
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-066 "Adaptive Rate Limiting" -> host: core/src/mindustry/net/Administration.java:543-552 (639 nonblank LOC file); core/src/mindustry/net/ArcNetProvider.java:166-170 (545 nonblank LOC file)
  Why: Host packet-abuse defense is already specific and trusted; provider-health adaptive limiting does not solve an observed gap.
  Uses: RateLimiter`, `createLimiter`, `tryConsume`, `adaptLimit`, `getLimiter`, `listLimiters
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL PROD-DEP-GUARDIAN "dep-guardian" -> host: host-first inventory: no sufficiently specific attachment point
  Why: A Node-oriented dependency product with 3,242 closure LOC is disproportionate to the Java game gaps identified.
  Uses: DepGuardian`, `registerRule`, `removeRule`, `getRegisteredRules`, `registerUpgradeHandler`, `ReceiptChain`, `DEFAULT_GUARDIAN_CONFIG`, `getLifecycleSummary
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:exec T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL PKG-TEST-HARNESS "@cmpsbl/test-harness" -> host: tests/src/test/java/** (1,957 nonblank LOC total)
  Why: Its job is CMPSBL pipeline/bridge validation, not Mindustry JUnit packet/save testing; 19,970 closure LOC is excessive.
  Uses: TestResult`, `TestSuiteResult`, `FingerprintRecord`, `verifyFingerprint`, `validateManifest`, `testChainExecution`, `testBridge`, `testFirstContact`, `formatTestResults` +1 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: self-contained
  Ports to implement: none

[SKIP] CMPSBL SUBP-05 "TRIAGE" -> host: host-first inventory: no sufficiently specific attachment point
  Why: TRIAGE is a 943-closure-LOC recovery ladder where retry + one breaker cover the observed HTTP calls more directly.
  Uses: triageContract`, `createTriage`, `BUILT_IN_RULES`, `DEFAULT_CLASSIFICATION`, `classifyWith`, `normaliseKind`, `normaliseMessage`, `LadderRule`, `TriageOptions` +8 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL SUBP-06 "BULKHEAD" -> host: desktop/src/mindustry/desktop/steam/SNet.java:568-607 (577 nonblank LOC file)
  Why: Steam transport already implements ordered retry/backpressure and a 50 MiB queue cap; a generic bulkhead would duplicate trusted transport semantics.
  Uses: BulkheadOptions`, `BulkheadRunOptions`, `Bulkhead`, `createBulkhead`, `BulkheadSubject`, `bulkheadContract`, `BulkheadRejection`, `BulkheadPolicy`, `RejectionReason` +1 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL SUBP-03 "COMPANION" -> host: host-first inventory: no sufficiently specific attachment point
  Why: A 1,225-entry-LOC host-integration seam is premature while the Java emitter itself is Not claimed in the pre-purchase evidence.
  Uses: COMPANION_PORT_IDS`, `createFallbackClock`, `createFallbackRandom`, `createMemoryState`, `createFallbackMetadata`, `CountingTelemetry`, `createFallbackTelemetry`, `createFetchHttp`, `InProcessQueue` +42 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:exec T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL VPACK-CYBER-PERIMETER-SUITE "Rate-Limit, Origin & Secret-Leak Defense Layer" -> host: host-first inventory: no sufficiently specific attachment point
  Why: It duplicates mature host perimeter controls, and AGENTS rule 12 says VerticalLayerPack artifacts cannot be attached by import even though the row says Mode=direct.
  Uses: cmpsbl_cps_watchtower`, `cmpsbl_cps_aegis_block`, `cmpsbl_cps_aegis_allow`, `cmpsbl_cps_aegis_check`, `cmpsbl_cps_bastion`, `cmpsbl_cps_cipher`, `CYBER_PERIMETER_SUITE_LAYER
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL VPACK-ADVERSARIAL-WARGAME "Continuous Red-Team Stress Layer" -> host: host-first inventory: no sufficiently specific attachment point
  Why: The capability is relevant, but the layer must be Ascension-wrapped and is much broader than a test-only input generator.
  Uses: ADVERSARIAL_WARGAME_LAYER
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL VPACK-DETERMINISTIC-REPLAY-VAULT "Bug Reproduction & Replay Layer" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Sealing every capability call is disproportionate; targeted incident replay is enough, and the layer cannot be directly imported.
  Uses: cmpsbl_replay_seal`, `cmpsbl_replay_get`, `cmpsbl_replay_count`, `DETERMINISTIC_REPLAY_VAULT_LAYER
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL VPACK-SENTINEL-EVOLUTION "Safe Patch Rollout Layer" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Patch dependency simulation does not solve the observed updater trust gap; layer attachment also requires Ascension.
  Uses: cmpsbl_sent_enqueue`, `cmpsbl_sent_topo_order`, `cmpsbl_sent_simulate`, `cmpsbl_sent_apply`, `SENTINEL_EVOLUTION_LAYER
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:load T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:load = entry point imports and exposes exports; no zero-arity behavior was fabricated; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL PRIM-ENG-01 "DREAM" -> host: repository-wide host inventory
  Why: DREAM received a full read: its idle-cycle low-confidence pattern synthesis has no evidenced product/ops job here, costs a 47,391-LOC closure and PORT-PERSISTENCE, and the Java bridge remains Not claimed.
  Uses: PrimitiveClassification`, `PrimitiveSource`, `PrimitiveCatalogEntry`, `PRIMITIVE_CATALOG`, `registerAllPrimitives`, `getCatalogEntry`, `getCatalogBySource`, `getCatalogNames`, `invokePrimitive` +51 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:proj(12) I:ok B:exec T:— S:scan — C:proj(12) = Compiles under project settings; strict-mode errors are recorded by the number in the token; I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:exec = entry point loads; zero-arity exports were executed twice and compared structurally; T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: self-contained
  Ports to implement: PORT-PERSISTENCE

[SKIP] CMPSBL BLD-ENG-260 "Dream Synthesizer" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Offline memory consolidation has no host memory-learning pipeline to attach to.
  Uses: MemoryFragment`, `ConsolidationResult`, `DreamConfig`, `DreamSynthesizer
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-271 "Dream Generation Gate" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Generation-depth limits only matter when synthesized memories exist; Mindustry has no such pipeline.
  Uses: DreamCandidate`, `MAX_GENERATION`, `memoryWeight`, `sortBySynthesisPriority`, `filterDreamCandidates`, `rankDreamCandidates
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL BLD-ENG-164 "Dream Cross-Pollination" -> host: host-first inventory: no sufficiently specific attachment point
  Why: Cross-pollinating dream insights is novel but unrelated to the host gaps.
  Uses: DreamInsight`, `DreamCrossPollination
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:ok I:ok B:— T:— S:scan — C:ok = Compiles (batch tsgo --strict --noEmit); I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: none

[SKIP] CMPSBL SUBSYS-04 "Shadow Mesh" -> host: tests/src/test/java/**; core/src/mindustry/net/**
  Why: Whole-subsystem shadow/adversarial infrastructure has a 65,882-LOC closure and C:proj(14); no production shadow lane justifies it.
  Uses: generateAdversarialInputs`, `runShadowProbe`, `runAllShadowProbes`, `runShadowBatch`, `startShadowScheduler`, `stopShadowScheduler`, `getShadowMeshAnalytics`, `runShadowBuild`, `runAllShadowBuilds` +6 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:proj(14) I:ok B:— T:— S:scan — C:proj(14) = Compiles under project settings; strict-mode errors are recorded by the number in the token; I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: PORT-PERSISTENCE; host peers: @types/node, zustand

[SKIP] CMPSBL SUBSYS-14 "Terminal / Substrate Bridge" -> host: server/src/mindustry/server/ServerControl.java (1,255 nonblank LOC)
  Why: The 33,527-LOC command subsystem does not address raw socket authentication and would compete with the existing server command surface.
  Uses: executeCommand`, `dryRunCommand`, `executeWithApproval`, `executeImmediate`, `registerHandler`, `hasHandler`, `getHandler`, `validateRegistry`, `validateCommandOutput` +19 more
  Saves: 0 engineer-days credited (basis: rejected candidate; no adoption value counted).
  Verified: C:proj(7) I:ok B:— T:— S:scan — C:proj(7) = Compiles under project settings; strict-mode errors are recorded by the number in the token; I:ok = installed with install.mjs into an empty host and type-checked there with tsgo --noEmit --skipLibCheck; B:— = Not claimed (behavior); T:— = Not claimed (test coverage); S:scan = author's 13-rule deterministic static unsafe-construct sweep reported clean; not an independent security audit
  Mode: direct
  Ports to implement: PORT-PERSISTENCE

Gap map

Honest totals: 9 engineered rows are feasible enough to retain (basis: Step 2), 8 create measurable value at default configuration (basis: BLD-ENG-108 is conditional), and the first funding gate should cover only the 3 quick wins until Java bridge evidence exists.

Step 6

Build versus buy

The current authoritative licence is US$499 once per company, perpetual. The kit’s older source-release/annual language is stale and is not used in this calculation.

Assumptions

US$150 per senior engineer-hour (basis: kit’s own costing convention), 40 paid engineering hours per week, one experienced Java engineer with security review available. Estimates err upward on integration because Java output is Not claimed and downward on capability value because portfolio reuse is credited at zero.

What the team would probably never have arrived at alone

The strongest counterfactual is not retry logic; it is the combination of adversarial fixture generation with forensic replay and structured/tamper-evident moderation evidence. Mindustry already has domain-specific reliability code, so the novel value is turning failures and operator decisions into reproducible evidence artifacts rather than adding another generic runtime layer.

Is this a good trade at the stated price?

Conditional yes. US$499 itself breaks even after 3.33 senior-engineer hours (basis: 499/150), but the real decision is the 1–2 week Java integration risk. Buy only if a post-purchase proof can generate/bridge BLD-ENG-248 or BLD-ENG-303 into a compiling Java 17/Gradle test path quickly. Do not buy if the primary expectation is cryptographic updater authentication: that capability is missing from the engineered catalog.

What would change this answer: verified Java bridge evidence for the retained IDs moves the verdict toward BUY; inability to produce behaviorally equivalent Java within the first test-only proof moves it to DO NOT BUY. A vendor-supplied general publisher-signature/release-digest verifier would materially increase value for this host.

Step 7

90-day roadmap, assuming it was bought

Capacity assumption: one experienced Java engineer, about 40 engineering hours/week (basis: cost model), with occasional security review; roadmap intentionally does not plan parallel six-person work.

Discovery Vault — provisional, kept out of every total

Machine-synthesised discoveries worth reading after purchase

All 6,479 index rows were screened (basis: 1,510 disc-* + 4,969 vdisc-*). The pre-purchase kit does not contain vault source, so no API, LOC, verification or savings claim is made for the shortlist below.

The gaming-v1 subset contains 427 rows (basis: parsed keyword field); 229 had broad keyword/concept overlap with the host-first concerns, but only the five above are retained for post-purchase reading. None contributes to Step 4 ranking, Step 6 money or the lead statistics.

Step 8 — appended, never merged into the body

Self-correction addendum

This addendum records both host-claim corrections and evaluator/kit control-plane edge cases. It intentionally does not rewrite earlier body claims in place. The highest-risk evaluator mistakes would have been: reading the catalog before the host, treating a name match as a capability match, double-counting twins, sizing shared-entry/discovery rows, treating Mode=direct as permission to import layer classes, upgrading Not claimed Java output, or relabeling FNV/provenance/webhook semantics as executable-release authentication.

Claim ceiling

What is and is not verified

Extracted from systems the author has run in production since August 2025. Operationally exercised, not independently security-audited.

In pre-purchase evaluation, verification axes quoted in this report come verbatim from the generated AGENT-HANDOFF-CATALOG.md; in a full delivery, artifact manifests override it. Every component records testCoverage: Not claimed, and no component has had an independent third-party security review. Static scan results and adversarial suites are the author's own. TypeScript is canonical; emitted TypeScript/Python/JavaScript samples are build-checked, while the other 23 targets, including Java, are Not claimed.

Verification axes cited: C (compile), I (empty-host integration), B (behavior/load), T (test coverage), S (author-run security scan). “Not claimed” is preserved exactly where the catalog makes no claim.