The 88a680a7 #1 fix keeps the paid-run view through a failed GET /api/world/runs/. But the page also re-checks the session on every window focus and on visibilitychange to visible (lines 91-92), and recheck() calls invalidate() first (sets identity=null and removes #world-wallet-library) and then session().

If that one GET /api/world/session fails for a transient reason (network error, a 502/503 or Cloudflare HTML page that makes response.json() throw, or any response that fails the shape check, which throws AUTH_UNAVAILABLE), session()'s catch (line 16) leaves identity null and sets authError. refreshView() then calls mount(), and mount() only builds the run view when identity&&opaque(run) (line 81). So the view goes away: the 'Paid. Your report is being prepared ...

This page updates by itself' text, the World order link, the Check again button and the poll are all gone. The page shows 'World wallet collection is temporarily unavailable' with a 'Connect World wallet' button. Nothing retries the session.

The view only comes back after another focus or visibility change, or a reload. This is the most common moment for the check to run: the buyer has just paid in the World tab and switches back to the Celestao tab. It is also the same outage the fix was meant to survive.

The page still says not to pay again only while the run view is shown, so the buyer is left with no in-page status for a paid order and is sent to reconnect.

showRun now keeps the World order link, the Check again button and the 5 s poll after a failed GET /api/world/runs/. But the run view is only built when mount() sees a non-null identity (line 81), and identity comes from GET /api/world/session, which on Celestao goes through the same identity() dependency (app.py:108-118: world.introspect over the bridge).

When World is unreachable that route answers 503 WORLD_AUTH_UNAVAILABLE, session() (line 14/16) throws AUTH_UNAVAILABLE and leaves identity null, so: (a) a buyer returning from World to celestao.com/?world_run=#/saved during the outage gets no run view at all: no 'paid, do not create another order' text, no World order link, no Check again, no poll, only 'Temporarily unavailable' and a 'Connect World wallet' button; nothing retries until a focus/visibilitychange; (b) a page that is already polling through the outage (the case the fix was written for: 'World stays unreachable') loses the whole view the first time the window gets focus or becomes visible again, because recheck() (line 90) calls invalidate() (epoch++), then session() fails, then refreshView() rebuilds the library without the run host; the pending 5 s timer then fires with live()===false and does nothing.

The status check and the session check fail together in a World outage, so the new 503 path in showRun is reached only when the outage starts between the two requests, and is undone by the next focus. The fix's tests (tests/celestao-home-prices.test.mjs runPage) always answer /api/world/session with 200, so neither case is exercised.

Fix: Build the run host from the URL id whenever world_run is opaque, even without identity, when the session failure is AUTH_UNAVAILABLE/a 5xx (not a 401): show the 'if you paid, do not pay again' text, the World order link and Check again, and schedule the same visible-only poll that retries session() and then showRun(). Only a 401 from /api/world/session (lost sign-in) should drop it. Add a test whose session answer is 503.

The guard's comment says its scope is 'every source file the Worker bundle can import (server/, worker/, src/shared/)' and that 'Browser code under src/world/ is not scanned'. But worker/app.ts imports Worker-side modules from src/world/ (line 3: import {UPSTREAM_TTL_MS} from '../src/world/cadence.ts'; line 29: import {CHARACTER_COLLECTIONS} from '../src/world/collections.ts'; earlier server/*.ts also import src/world/market.ts, model.ts, status.ts, siwe.ts).

A fetch with redirect:'error' or an unsupported cache mode added to any of them ships in the Worker and is never scanned. Inside the scanned roots, options() (line 14) only matches an unquoted key followed by a string literal (\bredirect\s*:\s*['"`]). So {'redirect':'error'}, {"cache":"reload"}, {redirect:MODE} with const MODE='error', and init.redirect='error' all pass.

Workers throw a TypeError for redirect:'error' and for any cache value other than no-store/no-cache at compat date 2026-05-15: cache_option_enabled (2024-11-11) allows only 'no-store', and cache_no_cache_enabled (2025-08-07) adds 'no-cache'. This is a gap in the guard. No current Worker file is known to use one of these forms.

Fix: build the scan set from the Worker's import graph (follow relative imports from worker/index.ts, or scan the wrangler/esbuild bundle output) instead of fixed roots. Match keys with optional quotes (['"]?redirect['"]?\s*:) and assignments (.redirect\s*=). Fail on any non-literal redirect/cache value in Worker files, or route fetch through one Worker helper that whitelists options at run time and test that helper.

AUDIT_REQUEST section 1 #1 says that for AUTH_REQUIRED/CONTEXT_CHANGED 'the page asks the buyer to reconnect'. In the code, a 401, or a 409 CONTEXT_CHANGED (another tab connected a different wallet), on GET /api/world/runs/ reaches api() line 21.

That calls invalidate() (line 10), which removes #world-wallet-library: the identity box with its Connect button, the run host, the World order link and the collection list. showRun's catch then finds live()===false and adds nothing, and nothing calls mount() again. The /saved page is left with no wallet section, no reconnect prompt and no word that the order is paid, until a window focus or visibilitychange runs recheck(). Polling stops, which is correct.

The page does not 'ask the buyer to reconnect', and a buyer who stays on the page (no focus change, common in an in-app webview) sees nothing. The fix's test for this case ('a lost sign-in stops polling') only counts timers and calls.

Fix: after invalidate() on the run page, call refreshView()/mount() (or have showRun's AUTH_REQUIRED branch remount) so the library is rebuilt with identityBox showing 'Reconnect your World wallet' and the Connect button. Keep the poll stopped, and assert the reconnect prompt in the test.

tests/worker-fetch-redirect.test.mjs is the only check that Worker-side code never passes a fetch option Workers reject (redirect:"error" throws a TypeError in workerd before anything is sent; cache modes other than no-store/no-cache throw "Unsupported cache mode"). Its options() helper matches \bredirect\s*:\s*(['"])value\1` only.

Three spellings that are valid TypeScript, reach the Worker bundle through src/shared/ or server/, and are rejected by Workers at run time are not seen: (a) a property assignment init.redirect='error' / init.cache='force-cache' (no colon); (b) a quoted key {"redirect":"error","cache":"reload"} (the quote sits between the word and the colon, so \bredirect\s*: does not match); (c) an identifier value {redirect:MODE} with const MODE='error' (no literal after the colon).

The guard was widened in this submission precisely because the previous form was too narrow; these three forms are the ordinary way a refactor would introduce the option (an options object built step by step, a JSON-style object, a shared constant). Node accepts all three, so the unit suite passes while every production delivery fails, which is the failure 88a680a7 #2 was raised to prevent.

The disclosed limitation ("cannot see options built at run time") covers (c) only partially and not (a) or (b), which are static text.

The new catch in showRun schedules poll() for every error code except AUTH_REQUIRED, CONTEXT_CHANGED and NOT_FOUND.

Two answers in that set are explicit "stop asking" signals: Celestao's WalletLimits answers 429 {"error":"RATE_LIMITED"} with Retry-After: 60 once a peer has spent 180 wallet-API requests in a minute (limits.py line 21), and identity() in app.py answers 503 WORLD_AUTH_UNAVAILABLE when World refuses or cannot answer the per-request world.introspect call (bridge.py: any non-200/401 status, including World's own 429 from BRIDGE_LIMITER, 120 per bridge session per minute).

In both states the page keeps sending one GET /api/world/runs/ every 5 s (12/min per visible tab) for as long as the tab is visible.

Because every authenticated Celestao request performs a World introspection first, each poll is also one POST /api/celestao-auth/session from the Celestao VPS to World, so a World outage or a World rate limit is amplified rather than relieved: the buyer's tab keeps the Celestao bucket and the bridge-session bucket busy, and other wallet actions in the same browser (opening a saved report, the collection list, logout) get 429 too.

Submission33 discloses "no back-off" in general; the concrete defects are that Retry-After is ignored and that a 429 is treated like a network blip. Before this change a failed check stopped polling, so this is new behaviour of the live page.

GET /api/world/runs/ returns only state/recordId/failure. A run stays state='prepared' with order_id IS NULL after its expires_ms passes whenever the buyer never quoted (left the World checkout page) or quoted and let the quote lapse without re-submitting the same input on Celestao (retire_lapsed runs only inside prepare(), on a repeat request).

World can no longer quote it (goldQuote requires expires_ms>now OR order_id IS NOT NULL) and pruneCelestaoAuth deletes the World checkout row after one day, so the World order link answers NOT_FOUND ("This reading does not belong to this wallet"), while the Celestao page says "This reading has not started yet.

If you paid in World, it usually starts within 1–3 minutes" and polls every 5 s (prepared is in the poll list at world-wallet.js line 72) until vault.prune_unpaid removes the row 30 days later. No money is at risk (the run is unpaid by construction), but the page claims a payment can be pending and spends 12 requests and 12 World introspections a minute on a run that can never change state. The disclosed item 6 describes the retired subset only.

api() throws AUTH_REQUIRED before any request when context.expiresAt<=Date.now(), without calling invalidate(). The new catch at line 73 excludes AUTH_REQUIRED from controls() and poll(), on the stated assumption that "the page asks the buyer to reconnect".

On this path nothing asks: identity stays set, the identity box keeps the wallet address and the Disconnect button, the collection list stays, and the run view shrinks to the one line "Reconnect your World wallet." with no World order link, no Check again button and no poll. The World order link does not need a Celestao session at all, so the one control that still works is the one removed.

Only a focus or visibilitychange event (recheck()) repairs it; a buyer who keeps the tab in front sees the contradiction for as long as they wait. Pre-existing in the pre-fetch check, but the new catch turns it into a dead end for the paid-run view.

The 88a680a7 #1 change keeps the link, the Check again button and the 5 s poll inside showRun() after a failed GET /api/world/runs/. But the run view exists only while identity is set: mount() builds the run host only when identity&&opaque(run) (line 81), and identity comes from GET /api/world/session.

On Celestao that route goes through the same identity() dependency as the status check (celestao_world/app.py lines 108-118: sessions.read then world.introspect over the bridge), so in the outage the fix was written for ("World stays unreachable") the session check answers 503 WORLD_AUTH_UNAVAILABLE at the same time as the status check. session() (line 14/16) then throws AUTH_UNAVAILABLE, leaves identity null and sets authError. Two consequences.

(a) A buyer who returns from World to /?world_run=#/saved during the outage gets no run view at all: no "paid, do not create another order" text, no World order link, no Check again, no poll, only "Temporarily unavailable" and a Connect World wallet button; nothing retries until a focus/visibilitychange.

(b) A page that is already polling through the outage loses the whole view the first time the window gets focus or becomes visible: recheck() (line 90) calls invalidate() first (epoch++, identity=null, #world-wallet-library removed), then session() fails, then refreshView() rebuilds the library without the run host; the pending 5 s timer fires with live()===false and does nothing.

A single transient failure of the session request (network error, a non-JSON 502 page) has the same effect, and switching to the World app to look at the order and back is exactly the move a waiting buyer makes. The World order link does not need a Celestao session, so the one control that still works is the one removed.

The submission's tests (tests/celestao-home-prices.test.mjs runPage) always answer /api/world/session with 200 and never fire the focus listener, so neither case is exercised. No money is at risk: World still refuses a second payment for the same run, but the page now offers a sign-in instead of the order status, which is the symptom #1 was meant to remove.

Fix: in recheck(), do not invalidate before the session answer arrives; only invalidate and drop the view on a definite 401 or a changed context, and on AUTH_UNAVAILABLE/network failure keep the previous identity and view and retry session() on the same 5 s cadence while a world_run view is open.

In mount(), when world_run is opaque and the session failure is not a 401, still build the run host with the "if you paid, do not pay again" text, the World order link and Check again, and poll session() then showRun(). Add tests whose session answer is 503 and that fire the focus listener. Reported by the permissions, math and flow specialists; merged here.

tests/worker-fetch-redirect.test.mjs is the only check that Worker-side code never passes a fetch option Workers reject (redirect:'error' throws a TypeError in workerd before anything is sent; cache values other than no-store/no-cache throw "Unsupported cache mode"; integrity throws). Two gaps. (1) options() matches only an unquoted key followed by a string literal (\bredirect\s*:\squote...), and the credentials/referrerPolicy/integrity check matches only \bkey\s:.

A quoted key puts the closing quote between the name and the colon, so {'redirect':'error'}, {"cache":"reload"}, {'integrity':'sha256-…'} pass; a property assignment init.redirect='error' / init.cache='force-cache' (no colon) passes; an identifier value {redirect:MODE} with const MODE='error', and a shorthand property {redirect} with const redirect='error', pass.

All are static text an ordinary refactor produces (a JSON-style literal, an options object built step by step, a shared constant), all are valid TypeScript, and Node accepts all of them, so the unit suite stays green while every production delivery fails, which is exactly the failure 88a680a7 #2 was raised to prevent. The disclosure ("cannot see options built at run time") covers the constant case only partially and the quoted-key and assignment cases not at all.

(2) ROOTS (line 11) are server/, worker/ and src/shared/, and the comment says src/world/ is browser code, but worker/app.ts imports ../src/world/cadence.ts (line 3) and ../src/world/collections.ts (line 29) (and server/ files import src/world/market.ts, model.ts, status.ts, siwe.ts per the import graph), so those modules ship in the Worker bundle and are never scanned.

Side note: current workerd ignores credentials/referrerPolicy rather than rejecting them, so the test comment overstates that part; banning them is harmless.

Fix: match keys with optional quotes and the assignment form, e.g. (?:^|[^\w$.])['"]?${key}['"]?\s*[:=]\s*(?:(['"])([^'"])\1|([A-Za-z_$][\w$])) and treat a non-literal value or a shorthand/computed key as an offender; build the scan set from the Worker's real import graph (follow relative imports from worker/index.ts, or read the esbuild metafile) and fail when a Worker-side import resolves outside the scanned set.

Better still, route every Worker subrequest through one helper whose RequestInit type limits redirect to 'manual'|'follow' and cache to 'no-store'|'no-cache', and have the guard assert bare fetch( appears only in that helper. Reported by all four specialists; merged here.

The new catch schedules poll() for every error code except AUTH_REQUIRED, CONTEXT_CHANGED and NOT_FOUND. Two answers in that set are explicit "stop asking" signals.

Celestao's WalletLimits (celestao_world/limits.py line 21-29) answers 429 {"error":"RATE_LIMITED"} with Retry-After: 60 once a peer group has spent 180 wallet-API requests in a minute, and identity() (app.py line 117) answers 503 WORLD_AUTH_UNAVAILABLE whenever the per-request world.introspect call fails (bridge.py lines 35-45: any non-200 status, non-JSON body or httpx error).

In both states the page keeps sending one GET /api/world/runs/ every 5 s for as long as the tab is visible (12 per minute per tab).

Because GET /api/world/runs/ depends on checked -> identity, every poll is also one Celestao-to-World introspection, so a World outage or World-side rate limit is amplified rather than relieved, and other wallet actions in the same browser (open a saved report, the collection list, logout) share the same 180/minute bucket and get 429 too. api() discards the response status and headers, so the Retry-After value is not available to the page.

The disclosure says "no back-off" and that each check is one same-origin GET to Celestao; it does not say that each check is also one World introspection, nor that Retry-After is ignored. Before this change a failed check stopped polling, so this is new behaviour of the live page.

Fix: have api() attach status and Retry-After to the thrown Error; in the showRun catch skip poll() for 429 and for the 503 codes WORLD_AUTH_UNAVAILABLE/WALLET_NOT_CONFIGURED/STORAGE_UNAVAILABLE or delay them by max(Retry-After, backoff); keep a per-request attempt counter in the request object and double the delay on consecutive failures (5, 10, 20, 40 s, capped at 60 s); keep controls() so the buyer can still check by hand.

api() throws AUTH_REQUIRED before any request when context.expiresAt<=Date.now(), without calling invalidate(). The new catch at line 73 gives AUTH_REQUIRED neither controls() nor poll(), on the stated assumption that "the page asks the buyer to reconnect".

On this path nothing asks: identity stays set, the identity box keeps the wallet address and the Disconnect button, the collection list stays, and the run view becomes the one line "請重新連接 World 錢包。" with no World order link, no Check again and no poll. The order link is a plain World URL and needs no Celestao session, so the one control that still works is the one removed.

Only a focus or visibilitychange (recheck()) repairs it; a buyer who keeps the tab in front sees the contradiction for as long as they wait. The pre-flight expiry check is pre-existing; the new catch turns it into a dead end for the paid-run view.

Fix: in api(), call invalidate() before throwing on local expiry so the identity box and the error agree and the next recheck rebuilds the view; and in the showRun catch call controls() for AUTH_REQUIRED too (only poll() needs a session).

AUDIT_REQUEST section 1 #1 says that for AUTH_REQUIRED/CONTEXT_CHANGED "the page asks the buyer to reconnect".

In the code a 401, or a 409 CONTEXT_CHANGED (another tab connected a different wallet), on GET /api/world/runs/ reaches line 21, which calls invalidate() (removes #world-wallet-library: the identity box with its Connect button, the run host, the order link and the collection list) and throws AUTH_REQUIRED. showRun's catch then finds live()===false and adds nothing, and nothing calls mount() again.

The /saved page is left with no wallet section at all, no reconnect prompt and no word that the order is paid, until a window focus or visibilitychange runs recheck(); a buyer who stays on the page (common in an in-app webview) sees nothing. Polling stops, which is correct. The submission's test for this case ('a lost sign-in stops polling') only counts timers and calls.

Fix: after invalidate() on the run page call refreshView()/mount() (or have the AUTH_REQUIRED branch of showRun remount), so the library is rebuilt with the identity box showing the reconnect text and the Connect button; keep the poll stopped and assert the prompt in the test.

GET /api/world/runs/ returns only state/recordId/failure. A run stays state='prepared' with order_id NULL after its expires_ms passes whenever the buyer never quoted (left the World checkout page) or let the quote lapse without re-submitting the same input on Celestao: retire_lapsed (vault.py line 166) runs only inside prepare() on a repeat request, and prune_unpaid (vault.py line 149-152) deletes such rows only after UNPAID_GRACE_MS (30 days per the privacy text).

For such a run the Celestao page shows "這筆解讀還沒開始產生。如果已在 World 付款，通常約 1–3 分鐘內會開始" and polls every 5 s (prepared is in the poll list at world-wallet.js line 72) although nothing can change its state. No money is at risk: the run is unpaid by construction. Disclosed item 6 describes the retired subset only.

Fix: have status() also return ordered (order_id is not None) and expiresMs (both already in _run_view's columns) and in showRun treat state==='prepared' && !run.ordered && run.expiresMs + grace <= Date.now() as lapsed: show a "this quote lapsed; start the reading again" text, keep the link, do not poll.