Saved 4 high findings in .imd-findings.json:

• bug: Overlapping tab commits can erase a successful action while assigning a higher revision.
• bug: Reset/import can reuse a stale tab’s telemetry anchor, counting previous passages again.
• bug: Repeated failed writes inflate revisions, allowing pagehide to undo another tab’s reset.
• fidelity: The downloadable ZIP contains the old application and omits synchronization code and tests.

Each finding includes exact source snippets, the required change, and a concrete reproduction.

Validation: 28/28 Node tests passed, including all original engine tests. The live API check passed. Chromium launch failures and missing WebKit libraries prevented visual and taste@1 verification.

Wheelhaven is a real-wheel crop game carried by a botanical storybook scene. Application files remain unchanged.

Fixed all four findings, added concurrency regressions, and rebuilt the source ZIP to match the final code.

Passed: 45 tests, 18 browser checks per storage backend, build/typecheck, and 16/16 design checks. Responses are recorded in .imd-responses.json.

GitHub and site publication remain pending; publishing tools are unavailable here.

Not delivered: artifacts/validation.md. Under artifacts/, only this step's named outputs leave the machine.

Three prior findings are fixed: overlapping commits, the stale source archive, and failed-write/pagehide resurrection.

High bug: reset/import can still count old wheel passages again. When the initiating tab’s feed is unavailable, replacement clears the shared anchor. A delayed older response can establish an older baseline, allowing replayed telemetry to grow imported broccoli from 5→10, or newly planted broccoli from 0→5. Confirmed through the UI at 390px with both coordination backends.

The exact source citation, fix and reproduction are recorded in .imd-findings.json.

Existing checks pass: 45/45 Node tests, 18/18 browser checks per backend, and 16/16 taste checks. WebKit was not tested; the live API check encountered a TLS connection reset.

Wheelhaven’s visual idea remains a quiet illustrated pantry garden powered by a real hamster’s wheel. Website source files were unchanged.

The replay defect is fixed: after a reset or import, a delayed feed response can no longer grow crops a second time. The code isn't committed or published. The changes are in the working tree, and I didn't push to GitHub or update wheelhaven.imd.site, because this environment has no publishing tool and hosting is handled by IMD's delivery stage.

Reproducing the finding: it reproduced in Chromium through the real UI, for all four reset/import and Web Locks/IndexedDB combinations. Import grew broccoli from 5 to 10, and reset's new broccoli went from 0 to 5, with dew still at 7.

Cause: when the tab doing the reset or import had no fresh feed, it saved anchor: null and kept no record of the newest shared sample. A delayed older response then became the new baseline, so replaying the newer sample counted those wheel passages again.

The fix

• dist/store.mjs: a reset or import that can't set an anchor now saves the newest shared sample as replayFloor, and later resets or imports keep it. A floor or anchor inside an imported file is ignored.
• dist/game.mjs: applyTelemetry rejects anything older than the anchor or floor before changing any state. The first eligible response sets a new baseline with no growth and clears the floor. The floor also survives reloads and new tabs.

One fix beyond the finding: the same double-growth could happen with no reset at all. A delayed response from a previous device epoch rewound the anchor, and replaying that epoch's newer sample grew broccoli from 5 to 10. I reproduced this on the old engine in Node only, not through the UI. The age check now applies across epochs, so a genuinely new device could wait up to about 60 seconds if timestamps disagree.

Checks after the final build

The new browser checks run the reported sequence for reset and import, holding a real response in flight. After the replay, crops stay at 5 after import and 0 after reset, and three new passages then count once. I ran the browser and probe checks through a scratch setup using the Chromium already installed on this machine, not the browser build Playwright 1.61.1 expects.

Remaining limitation

If a reset or import happens over an old save whose anchor has no date, the floor uses the browser's clock. A clock running behind the feed could accept a slightly older response, and one running ahead delays the new baseline. This is recorded in VALIDATION.md.

I also removed a line from VALIDATION.md that claimed an artifacts/validation.md copy, because that file doesn't exist. The finding is answered as fixed in .imd-responses.json.

I confirmed the fix holds by reading the code. I couldn't run anything this round: the Bash sandbox failed to start on every attempt ("Failed to create bridge sockets"), so I didn't run npm test, test/browser-sync.mjs or the taste probe. .imd-findings.json holds {"findings":[]}.

Last round's finding: fixed. That was the high bug where reset and import dropped the shared replay floor (dist/store.mjs:47). I traced my own reproduction through the new code:

• The replacement keeps a floor. B resets or imports while its own feed is unavailable. anchorReplacement (dist/store.mjs:48-64) still stores no anchor, but it now saves the shared sample S105 as replayFloor (line 51) and returns at line 55.
• The delayed old response is refused. B's held-back S100 response arrives. applyTelemetry (dist/game.mjs:168-172) compares it with the floor, sees it was received 5 s earlier, and returns outOfOrder. The saved anchor and the season round stay as they were.
• A repeated S105 grows nothing. A refreshes with the same S105 response. It passes the floor check (same time, same count). There's no previous anchor, so game.mjs:177-179 re-anchors with a change of 0 and clears the floor. Imported broccoli stays at 5 and the new broccoli after a reset stays at 0.
• The floor survives reloads. It is kept when a page reloads or a new tab opens (game.mjs:235-236), and a second reset or import passes it on (store.mjs:51).
• The other paths are covered. A fresh, newer sample in the resetting tab is accepted against the floor and sets the starting point with no growth. A fresh but older one cannot rewind a newer shared anchor (store.mjs:56-61).
• There's a regression test. test/sync.test.mjs:394-413 runs exactly this sequence for reset and import, with no, unavailable and expired local feeds. It checks that the old response is rejected without writing, that growth stays the same after the repeat, and that 3 new passages add exactly +3.

The author's stated limitation is real but small. With an old save whose anchor has no date, the floor takes the browser's clock. If that clock runs ahead of the feed, the first responses after a reset or import are refused until the feed's time passes it. Nothing grows twice; the cost is a short wait before growth resumes. VALIDATION.md records it, and I'm not raising it as a finding.

New findings: none. I found nothing new I could reproduce.

Requirements

• "Fix the advisory finding… stale tabs cannot replace newer progress": met. dist/store.mjs does every game action, reset and import while holding a lock across tabs and re-reads storage first. On page close, flush only writes changes that failed to save earlier.
• "Adopt validated current state before gameplay actions": met (store.commit, which re-reads storage first at line 145).
• "Propagate reset/import correctly": met (store.replace writes a new, higher save version; anchorReplacement).
• "Preserve telemetry anchoring so the same wheel passages cannot grow crops twice": met, as traced above (game.mjs:166-184).
• "Regression coverage for two tabs, feed refresh, pagehide and reset/import": met in the code (test/sync.test.mjs, test/browser-sync.mjs). I didn't run it this round.
• "Run the existing 15 engine tests": the author reports 60/60 passing, which includes the 15. I couldn't re-run them.
• Chinese/English interface, single real-wheel planting, SVG art, Squeekchain APIs, plain JS modules, MIT