@4585` + `function msubSwitch(id) {@36638`, which is a pure pane toggle plus one `on-open` hook per pane. 25 test hooks are exported at `window.__mesh02 = Object.assign@38366`. - Connect: status card from `/api/manifest`, reusing `async function mpResolveMagnet(ui) {@29362` — the one resolver, parameterised by container ids, shared with the modal and Discover. - Discover: `async function _mdProbeManifest(base, ms) {@29503` fired in parallel across `const _MD_SCAN_PORTS = [1360, 1380];@29512`; list parsing in `function mpParseServerList(text) {@29477`; D4 gate in `function _mdHostApproved(url) {@29532`. - Lists: `const _ML_ACL_LISTS = ['blockServerIds'@29639` drives six textareas; the D2 flow is fetch → preview → `function mlPeerMerge() {@29743`, which is unreachable except from the button the preview renders. - Enforcement is two lines, and they are the reason the blacklist feels absolute: `rows = rows.filter(s => !_mpBlacklisted(s));@29348` on every rendered server list, and `if (_mpBlacklisted(addr))@29402` inside Join. Matching is by addr, bare host, serverId or world hash — `function _mpBlacklisted(s) {@29643`. - Presence: `const MP_CHAT_CAP = 200;@28503` ring, and `function _mpFootprints(look) {@29169`, which announces **once per cell arrival**, excluding yourself and anyone standing there — prints are for who you *missed*. ### C. Client persistence (localStorage) ``` mpBlacklist : ["host:port" | host | serverId | worldHash, …] hides rows, refuses Join mpWhitelist : ["host" | "host:port", …] approved sources (D4) mpListSources : [{ url, auto:bool }, …] auto honored only if host ∈ mpWhitelist mpChatLog : last 200 chat lines (💬 history, survives reload) ``` Server-list format (`http(s)` txt or JSON): text = one entry per line — `host:port`, `http(s)://…`, or an `coc:?…` magnet, `#` comments ignored; JSON = array of strings or `{addr,name}` objects. Parsed to `[{addr|url|magnet, name?}]`, deduped. ## IV. Spec → Shipped Delta | Spec claim | HEAD | Verdict | |---|---|---| | §3.1 endpoint shapes (all fields, both directions) | identical, field-for-field | ✅ exact | | PUT caps: ≤200/list, trimmed, deduped, unknown field → 400 | identical | ✅ exact | | `shareBlocklist` ignored by `aclAllows()` | 0 occurrences in `src/js/mesh.js` | ✅ exact | | §3.2 three localStorage keys | all three, same names | ✅ exact (+ `mpChatLog` from (h)) | | §3.3 parser contract | identical | ✅ exact (+ optional `name` passthrough) | | D6 ports 1360–1380, ~600 ms | `[1360, 1380]`, 600 ms abort | ✅ exact | | D1 sub-tab bar: **4** panes `🗺 Map · 🌐 Connect · 🔭 Discover · 🛡 Lists` | **6** panes `🗺 Local · 🌍 World · 🛰 Full · 🌐 Multiplayer · 🔭 Discover · 🛡 Lists` | ⚠ **stale labels, sound shell** — §MP-MAPTABS added World/Full on 2026-07-08 with **no change to `msubSwitch`'s contract**; pane ids `msub-connect/discover/lists` never moved | | Blacklist entry forms: `host:port` \| serverId \| worldHash | also matches a **bare host** | ⚠ report understates the shipped behaviour | | (f) "mud-harness [R] — **19** checks" | **18**, at `d86aeea`, at `c03cdc5` and at HEAD | ❌ **wrong the day it was written** — never 19 (see §VII) | | (a)–(j) all shipped | all ten live | ✅ | | §3.1 header path `wbapi-server.js` | `src/js/wbapi-server.js` since `5e48dd7` (2026-07-09) | ⓘ **correct for its day**, stale for 40 days | ## V. Non-Goals — Still Held? | Non-goal | Status | |---|---| | No auto-import of foreign blocklists (D2) | ✅ held — merge is click-only | | No client listening sockets | ✅ held — probe-only by construction | | No ACL of players/sessions (servers only) | ✅ held — no player/session key exists in any ACL path | | No LAN broadcast discovery | ✅ held — `dgram` occurs **0** times in `src/js/wbapi-server.js` and `src/js/mesh.js` | Four non-goals, four survivals, 42 days — each written as a *property to preserve* rather than a feature to postpone. A property has a test; a postponed feature has good intentions. ## VI. Defects Found (2026-08-17) - **§DX-02cs 🟢** — `src/js/wbapi-server.js:const parsed = JSON.parse(buf || '{}');@1616` resolves non-object JSON verbatim, and the 44 handlers that dereference it are unguarded. Measured live: `PUT /api/mesh/acl` with body `null` or `5` returns **500 and a raw JS TypeError string** instead of this report's documented 400; `POST /api/mesh/connect` and `POST /api/session/start` fail the same way. Arrays and strings correctly 400. One-line fix at the single choke point. - **§DX-02ct 🟢** — the retired four-tab roster still ships in two docs (`docs/notes/docs-node-network.md:451`, `index.md:191`); `mechanics.md` was updated and is correct. `index.md:191` also still reads *"(g) docs/CLI closes it"* for an increment that closed on 2026-07-07. - **§DX-02cu 🟡** — the 🛡 Lists ACL editor offers `mode: allowlist` with no warning that saving it while the three allow* lists are empty **isolates the server completely** (in and out). `docs/api/wbapi-help.md` documents the hazard; the in-game surface that can trigger it does not. ## VII. Verification Method and Results (§DOC-02bx) 1. **Instrument 101 (path-parts router).** `mesh/acl` and `mesh/blocklist` grep to **0** as URL literals and are both live: the router dispatches on `parts[0]`/`parts[1]`. A literal URL grep would have declared this report's whole server surface unshipped. 2. **Instrument 84 (a report amended by the work it authorises).** The a–j increment table was added by `c03cdc5` — increment (g) itself. §1–§6 are the original 2026-07-06 design lock, unedited. Both halves are dated in the header above so a later reader cannot mistake the retrospective table for a prediction. 3. **Instrument 70 (run the acceptance test).** `src/tests/integration/mesh-connections-ui.test.js:sub-tab shell: 6 tabs / 6 panes@48` — **8/8 green** (4.7 s). Harness section `src/tests/mud-harness.mjs:const aclR2 = path.join(tmp,@1365` — **18/18 green**, covering GET-defaults, PUT roundtrip, disk persistence, comment-key survival, five validation 400s, and the 403→200→403 share flip. `npm run test:mud` overall: **267 ✓ / 2 ✗**, both failures the carried §DX-02ca `[D]` idle-TTL reds — a different section, unrelated to any claim here. 4. **The one wrong number, and how it was caught.** Increment (f) claims 19 checks in `[R]`. Static call sites: **18** at `d86aeea` (the commit that wrote the claim), **18** at `c03cdc5`, **18** at HEAD; the live run prints **18**. There are no loops in that section, so runtime cannot exceed the static count. This is a review defect, not rot — *a figure you must count is a claim, and this one was never true.* 5. **D7 measured, not asserted.** `grep -cE "msub|mpBlacklist|MP\.|mesh" src/js/mover.js` → **0**. The footprint kernel restates the invariant in its own header comment at the one site that could have broken it — the mover *could* have read footprints for free, and does not. 6. **Live endpoint replay.** A scratch server on `PORT=1379` with a scratch `MESH_ACL_FILE` reproduced the §3.1 GET default response **byte-for-byte** against the block quoted above, round-tripped a PUT, and produced the §DX-02cs 500s. **Gate state at verification:** `check:anchors` 3,301 anchors / 81 docs, 0 dead (117 stale hints = unchanged baseline) · `play.html` untouched by this pass. ## VIII. Conclusion §MESH-02 is the strongest survival in the §MESH block. Six weeks on, every endpoint shape, constant, list key and locked decision measures exact against HEAD; three tables of claims produced exactly one wrong figure, and that figure was wrong the day it was typed rather than eroded since. The durable lesson is **where a design's contract actually lives**. D1 named four sub-tabs; the bar has six, because the contract was never the labels — it was `msubSwitch` plus four stable pane ids, onto which two unrelated panes were bolted a day later without touching a line of §MESH-02 code. The decisions stated as *properties* — share-OUT only, opt-in publication, whitelist-gated auto-fetch, the mover reads nothing — are all still enforced, each by code a test can point at. The labels drifted and it did not matter; the properties did not drift, because something is watching them.