Implemented the assigned server/shared auth, proxy, retention, cancellation, and Docker changes. The Expanse world and anonymous viewing paths were left unchanged.

• Refresh failures now retain the bearer, show an unavailable state, deduplicate checks, and retry with bounded backoff and Retry-After support. Only an authoritative 401 ends the session.
• Trusted forwarding is opt-in by exact proxy address. Challenge and verify have per-peer limits; session polling uses the global limit without consuming the sign-in bucket.
• Profiles expire after 90 days of inactivity and are evicted atomically when capacity requires it. Active sessions are bounded globally, per address, and per origin.
• Challenge cancellation uses a separate secret; the client validates the server’s world-scope format and exact signed message.
• Docker copies modules with readable permissions and runs import checks as node. Caddy routes auth and Expanse APIs to port 8788 and serves static files.

Checks: the serial backend/client auth suite passed, 30/30; JavaScript syntax checks and git diff --check passed. It includes real HTTP signature tests and 50 simulated verified-session polls followed by sign-in.

Unresolved: ARM64 build/start could not be verified because the Docker daemon socket denied access. Browser and real wallet-extension/device checks were not run. HUD copy and duplicate screen-reader announcements were outside this assignment’s file scope. The findings matrix is in FINDINGS.md; API and setup/rollback details are in API-v1.md and SETUP.md.

Implemented recovery and cancellation fixes, honest unconfirmed states, and single auth announcements. Updated the static export and documentation.

Passed: 247 Node tests, 51 frontend tests, 33 HUD browser scenarios, 9 demo scenarios, build/typecheck, and 16 design checks.

Evidence, fix matrix, and limitations. Safari, actual extensions/devices, ARM startup, and full backend saturation remain unverified. No production access occurred.

Saved two medium findings in .imd-findings.json:

• Cross-origin responses prevent honoring Retry-After.
• Reloads orphan sessions, blocking the fourth sign-in.

No critical/high hosting blockers, transaction/approval flows, or exported secrets found.

Passed: 247 backend tests, 51 frontend tests, 33 Chromium scenarios, typecheck and build. Application files unchanged. Actual wallet extensions and ARM deployment remain unverified.

Findings saved in .imd-findings.json. Application files remain unchanged.

• High — bug: cross-origin throttling hides Retry-After. Real browser testing found a 60-second cooldown became a 762ms retry because CORS hid the response/header.
• Medium — bug: reload/session-limit recovery copy is false. Three sign-in/reload cycles leave three server sessions. The fourth sign-in fails, despite copy saying reload ends sessions and advising a one-minute wait.

Fresh checks passed: 247 backend, 29 auth-client, 51 frontend, 33 HUD browser and 9 standalone browser scenarios, plus typecheck, build, five inspector viewports and taste@1. Providers were simulated; signatures and HTTP verification were real.

STRATOKS is an observer for an autonomous world, carried visually by a painted landscape and compact moss-and-gold controls.

I found 9 problems and wrote them to .imd-findings.json: 2 high, 4 medium, 2 low and 1 note on untested items. I reproduced the first four in Node against the current code, using the real HTTP handler, the real signature check and throwaway signers. The two medium findings from the earlier reviewers hold up on reading the code, but I didn't re-run their browser tests. The two low findings come from reading the code and docs only. No repository files were changed except the findings file.

Things I checked that looked correct:

• Server-side checks on challenge fields and the exact signed message.
• Single-use nonces.
• Cancellation needs the secret, and the public nonce alone can't end a session.
• Logout and cancel are tied to the origin.
• The client keeps the credential on 429, 5xx and timeouts, and only ends the se

I fixed all three severe findings and the five advisory ones I judged real. The ARM64 build, real wallet extensions and a real-browser cross-origin run are still not done.

The auth suites (expanse-auth and expanse-auth-client) pass 31 of 31. I added one regression test covering the global ceiling, profile recovery, session fairness, rate-key eviction and CORS headers. I did not run it against the old code first to confirm each case failed, so I haven't shown the fixes turn failing tests green. I did not run the other existing suites (typecheck, build, simulation).

• Global ceiling (high): each request now passes a per-peer check before it counts toward the global budget. The routes that had no per-peer limit (config, session, logout, preflight) get their own larger bucket of 240 requests a minute per peer. One peer can no longer burn the whole 600-a-minute global budget.
• Profile store at capacity (high): the least recently verified inactive profile is evicted to admit a new signer once it is past 24 hours old. The 90-day expiry stays.
• Retry-After across origins (high): every auth response now carries the exact allowed-origin CORS headers and exposes Retry-After. That includes early 429 and 503 responses and preflights. My test checks the headers over real HTTP, but Node's fetch doesn't enforce CORS, so a real-browser run is still outstanding.
• Per-origin session cap (medium): at the per-origin or global session cap, the address holding the most sessions loses its oldest one. The signer asking for a new session is never the one evicted.
• Rate-key store (medium): when the store is full it drops its oldest bucket instead of rejecting new peers, and IPv6 clients are bucketed by /64. I changed the old rate_store_full test to match.
• Dockerfile (low): code is now owned by root:root at 0755, so the node user can read it but not write it.
• SETUP.md (low): the Caddy example now overwrites X-Forwarded-For, and the docs describe the new retention and eviction behaviour.
• Unverified acceptance items (info): I disputed this one only in the sense that it is accurate and still open. There is no Docker daemon here, so I did not build or start the linux/arm64 image. I also did not test with real wallet extensions or devices.

The answers for every finding are in .imd-responses.json.

Corrected reload/privacy and session-limit messages, updated documentation, and rebuilt dist/.

Passed: 248 backend tests, 51 frontend tests, 35 HUD browser scenarios, typecheck, build, and 16/16 design checks.

Automatic reload revocation remains disputed and unimplemented; surviving sessions are now disclosed accurately. Safari and real wallets remain unverified.

Validation evidence · Finding responses

Both findings from last round are fixed, and I found nothing new. .imd-findings.json holds an empty list, and I changed no repository files.

I only re-tested the two findings this round. I did not redo the full requirement list or the probe, so the "not re-measured" and "not re-run" cells are carried over, not checked again.

Finding 1 (high): cross-origin throttling hid Retry-After from the client. Fixed.

• Code: server/src/expanse/visitor-auth.js:252-258 now sets the exact allowed origin, Access-Control-Expose-Headers: Retry-After and Vary: Origin at the top of handleVisitorAuth. That runs before the 503 busy check, the rate limiter and the preflight branch.
• Real-browser test: the author had not run one, so I did. I used Chromium at 390×844, started startHudDemo({port:0}), served a page from a separate origin and added that origin to auth.origins. Then:
  • Repeated sign-in requests: the 11th and 12th POST /api/auth/nonce returned 429 signup_rate_limited, and the page read retry-after = "60". Last round it read null.
  • Global limit hit: with global.count forced to the limit, fetch('/api/auth/config') returned a readable 429 with retry-after "60" and the rate_limited body. Last round it failed with "Failed to fetch".
• Client side: shared/visitor-auth-client.js:71-75 turns the header into a delay, and lines 106-107 set retryAfterUntil and wait at least that long before retrying. With the header now readable, the client waits out the server's cooldown instead of retrying after about a second.

Finding 2 (medium): the copy said reload ends the session, but sessions stayed on the server and filled the account's limit. Fixed.

• Wording: web/src/expanse/VisitorWallet.tsx:116 (the verified status) and :179 (the privacy note) now say "Reload forgets this tab’s credential. Sign out before reloading to end the server session; otherwise it lasts until expiry or server restart."
• Session-limit message: :15 gives session_store_full its own message before the generic rate_limited|store_full "Wait a minute" text: "This account or origin has reached its active-session limit. Sign out in another signed-in tab, or wait for existing sessions to expire."
• Server match: the server sends exactly that code when the per-address, per-origin or overall session limit is hit (visitor-auth.js:157,167,168).
• Built preview: the same strings are in dist/assets/index-CJb5861Y.js, so the published preview matches the source.

One-sentence idea: STRATOKS Expanse is a living, top-down simulated world you can watch without a wallet, with optional sign-in shown as a small, honest status in the HUD.

Wrote .imd-findings.json with two remaining medium findings:

• Throttled CORS preflights still hide Retry-After.
• Reloads still exhaust the three-session allowance; corrected wording accurately discloses this.

No critical/high findings. No transaction/approval flows or public secrets found.

Passed: 248 backend, 51 frontend and 35 browser checks, typecheck, and byte-identical export rebuild. Simulated wallets used real signatures. Project source unchanged; no production access.

Review complete. The findings file holds three entries, all snippet-checked against the tree, and no repository file was changed.

Settled as fixed. I re-ran each prior finding over real HTTP against the final code, and the existing suites pass 78 of 78.

• One peer exhausting the global ceiling (high): fixed. An attacker peer is capped at 240 polls, another visitor's challenge and verify succeed, and 50 verified sessions behind a trusted proxy polled twice at the shipped cadence with every response 200 while two attacker peers hammered polls and sign-ups.
• Profile store never recovering (high): fixed. At capacity the store is still full after 23 hours, admits a new signer after 25 hours and after 7 days, and 3 retained profiles survive restart with the same service identity.
• Per-origin session cap held by disposable addresses (medium): fixed. Two signers with three sessions each no longer block an honest third signer at a cap of 6.
• Rate-key store lockout (medium): fixed. 500 distinct IPv6 peers followed by a new IPv4 peer all return 200.
• SETUP.md Caddy block (low): fixed. The forwarded-header overwrite is now in the documented block.
• Runtime user owning code (low): fixed by Dockerfile semantics only. Root ownership with mode 0755 is present, but no Docker daemon exists here to build the image.

Still open, in severity order.

1. Medium. The cross-origin Retry-After fix is only partial. The client always sends a custom header, so every cross-origin call needs a preflight, and rate limiting runs before the OPTIONS branch. With the bucket exhausted, the preflight itself returns 429 with Retry-After, and under concurrency pressure it returns 503. Browsers treat a non-ok preflight as a CORS network error, so the page never sees the cooldown and retries after about one second. Reproduced at the HTTP level this round. Chromium could not launch on this machine, so the browser step rests on the Fetch specification and the specialist's Chromium run.
2. Low, scope decision. Three sign-in and reload cycles still hold the per-address cap for the full hour. The misleading copy is fixed and the author disputes a design change. I recorded it as a documented tradeoff for the requester, not a defect that reopens the work.
3. Info. Unverified acceptance items remain: linux/arm64 build and start, executed image permissions, real wallet extensions, and real-browser cross-origin runs.

The specialist's reload finding was merged into item 2 rather than kept as a new defect. Nothing else new reproduced.