Configured the supplied public credentials and rebuilt dist/, but production integration remains incomplete.

• Actual Supabase Auth connection: HTTP 200.
• Player, score and leaderboard RPCs: HTTP 404.
• Production migrations executed: none.
• Production writes, score restoration, tables and RLS remain unverified.
• Build, typecheck, local SQL/browser checks and 16/16 design checks passed.

Full report includes actual results and blockers. SQL Editor instructions provide inspection, guarded migration preparation and verification steps. Authorized SQL execution and real-wallet tests are still required.

Not delivered: artifacts/SUPABASE_REPORT.md, artifacts/supabase-production.json. Under artifacts/, only this step's named outputs leave the machine.

Production integration remains incomplete. Auth returned HTTP 200; the required player, progress and leaderboard RPCs returned HTTP 404 (PGRST202). Production migrations, persistence and RLS remain unverified.

High — bug: forged frame-zero forage events mint unlimited ranked Lifetime Score. In isolated PostgreSQL, one authenticated wallet gained 700 permanent ranked points in 78 ms by submitting collection claims across ten runs without gameplay. Validate collectible eligibility and traversal timing, and enforce a reward budget across concurrent runs. The affected branch is 006_four_worlds.sql:154.

The exact inputs, measured results and source snippet are saved in .imd-findings.json. Site files were unchanged.

“Needs the requester” below means authorized production database/Auth access or real-wallet testing. These are blockers, not additional repository findings.

I've written a database fix for the high-severity forage finding (migration 008), but none of it has been run. Every shell command this session failed with Sandbox is required but failed to initialize: Failed to create bridge sockets after 5 attempts, so no test, build, typecheck, design probe or database command ran.

The finding holds. I confirmed it by reading the code, not by replaying it. The forage handler (supabase/migrations/006_four_worlds.sql:154) checks only the item's name and that it wasn't already collected in that run. The timing check always accepts frame 0. Migration 007 lets one wallet keep any number of runs open, so the same 70 points can be repeated in every run and land in the public Top 100.

The fix is a new file, supabase/migrations/008_reward_guard.sql. Migrations 001–007 are unchanged.

• Reachability: a collectible counts only if Chang could have reached it in the frames played, both from the start point and from the last item collected in that run. The limit is 2 pixels per frame (the game's top speed is 1.7, or 1.9 in mid-air on map 4), with 64 pixels of slack for reach. The reviewer's all-at-frame-0 batch is rejected at its first item, so nothing is credited.
• One score budget per wallet: all ranked points, from any run on any device, come from a shared budget. It holds up to 150 points and refills at 1 point per second. Points over the budget are still accepted as events but give no score, so an honest device's queued progress never gets stuck. Existing profiles start with a full budget.
• Run cap: a wallet can have at most four open runs. Starting a fifth closes the oldest, and points that run already saved stay credited.
• No site rebuild needed: the service status adds "migration":8 but keeps schema version 7 and rules version 6, so the committed dist/ still works as it is.

Supporting files updated:

• SQL tooling: the SQL generator, the production check script and both verification SQL files now include or expect 008.
• New test: supabase/tests/reward-guard.mjs replays the reviewer's exact 10-run attack. It also covers an honest walk through the map (all 70 points credited), a jump across the map (rejected), the shared budget across four runs (150–160 of 280 points credited) and the four-run cap.
• Docs: SQL_EDITOR.md, docs/SUPABASE_REPORT.md, README.md and VALIDATION.md describe 008.
• Reviewer answer: .imd-responses.json marks the finding as fixed and says plainly that nothing was run.

Before relying on it:

• Run node supabase/tests/reward-guard.mjs and node supabase/tests/production-handoff.mjs. The SQL could have errors I couldn't catch without running it.
• Several older test suites (major.mjs, concurrent-runs.mjs and the client tests) send chest or lantern pickups at frame 0. They passed against 001–007, but under 008 they'll fail until they use realistic frame numbers.
• No source or dist/ file changed, so the earlier build and browser results still describe the shipped site.

Production status (the brief's final report):

• Tables: not inspected. The publishable key can't read the private schema.
• Migrations executed: none against production.
• Environment variables: the supplied project URL and publishable key are already set in src/config.js. No secret or service-role key is in the frontend.
• RLS and real read/write tests: none performed.
• Remaining blocker: someone with admin access to the Supabase project has to apply the missing migrations, now through 008, using supabase/SQL_EDITOR.md, then run the seven required tests with real wallets. Integration is not complete until those pass.

Saved one finding to .imd-findings.json.

High — bug: the reward guard permanently discards acknowledged offline score. At supabase/migrations/008_reward_guard.sql:183, four valid queues worth 280 points persist only 150. After 75 real seconds, all events were acknowledged; retries recovered nothing. The actual save client deleted every queue and displayed “Wallet profile saved.” Retain unpaid validated rewards durably and show them as pending until credited.

The previous frame-zero exploit is fixed. All six regression checks and nine migration/preservation checks passed. Chromium guest play worked without script errors. WebKit testing was blocked by missing system libraries.

Production Auth returned 200; service-status and leaderboard RPCs returned 404. No production writes or migrations were performed. Production completion still requires authorized database access and real-wallet tests.

“Met” below identifies repository implementation or accurate reporting; it does not imply unperformed production tests passed.

Fixed locally and rebuilt dist/. Unpaid rewards now remain durable and pending until settled. The real-clock regression preserved all 280 points.

Build, typecheck, 16 SQL/client checks, 9 browser checks, and 16/16 design checks passed.

Production remains incomplete: Auth returns 200, but application RPCs return 404. No production migration or authenticated write occurred. Results and exact SQL instructions are in VALIDATION.md and SQL_EDITOR.md. The reviewer response is recorded in .imd-responses.json.

The reward-loss finding is fixed. The exact real-clock reproduction finished with Lifetime Score, produce points and leaderboard score all at 280, pending rewards at 0, and replay unchanged. All 16 SQL/client checks, nine browser checks and ten migration-handoff checks passed.

.imd-findings.json contains {"findings":[]}. No tracked files changed.

Production integration remains incomplete. Fresh requests returned Auth 200 and application RPCs 404. Production tables and policies remain uninspected; zero production migrations were executed; authenticated read/write and recovery tests remain unperformed. WebKit could not launch because system libraries were unavailable.

Below, met for implementation means locally verified, without claiming production acceptance. Needs requester identifies the administrative access, execution or real-wallet testing still required.