IMD Ember World (https://imdember.com) - RETEST of the wallet sign-in security review after the fixes for audit 8c3aea2e (World only)

This is a retest. Earlier Swarm jobs reviewed older versions:

• Report 4bd31cfb-1151-497f-9b27-40e668dea372 (repo commit c2a8c33): F-1..F-8.
• Report retest e48d0a96-d3a5-42bb-859f-e0b0707fd9ad and Audit 519db624-a82f-4dfe-91b9-1a519d1d3dd1 (commit b6e986b): S-1, S-2, W-1..W-3, G-1..G-3; A-1..A-8.
• Audit 8c3aea2e-26bc-4bff-bf5d-52d10f79ec9b (commit ae1d41a30363ad04711083465501680469400d2f, Worker 1a0dd495): https://github.com/Identity-md/research/blob/main/jobs/8c3aea2e-26bc-4bff-bf5d-52d10f79ec9b/files/AUDIT.md - N-1..N-7 (6 Low, 1 Info).

Retest target:

• Repo: https://github.com/tungweb3/imd-ember-world-review at its newest commit, the only commit after ae1d41a (use that exact commit, not a branch; its parent must be ae1d41a30363ad04711083465501680469400d2f).
• Live: https://imdember.com, Worker "imd-world" version bbf24001-7eec-4f93-b312-a22e299ab275, built from private source 2e4e830b367f651e3c880587c1a4b465d1bfcd91 (source/ in the repo comes from a later commit that differs only in two docs and one test, plus one added evidence page).
• Expected Worker bundle SHA-256 (rebuilt from source/ alone): 018df7b35117bf612cd9311a800de75964b07f9d74f2c2f1ae545b26894cf62c (280,605 bytes).
• Stated live frontend: index.html 62af24a41f3825ffd8b8c68b8d2032205b58a82cbb92618fed599609163e49c9, /assets/index-C1BrxBtd.js b6d39838089b2707778990485570b6069054bdea22298bc2062b41a17f198d3d, /assets/InteriorView-4LZmFcoq.js 5077095b0b0fee5b68ad02328bc5d2304de7822f90ed933f54780c8880041630, /assets/index-B1zoY2Mz.css 4d1e832e229e0ea91b5af4b907c915489babf94db21f015c8eb72bf1510e0b32.
• D1 migration 0005_lanes_and_subnets was applied before this deploy (team statement).

Question: at this version, is it safe for a player to connect a wallet, sign in, and use the owner features (My home, move, "Enter your home")? Answer from evidence; do not generalize beyond it.

Start with README.md (it maps N-1..N-7 to the change and the residual risk, and lists the earlier findings' state; docs are in Traditional Chinese), then SCOPE.md, SIWE.md, ROUTES.md, WALLET_METHODS.md, DATA_SCHEMA.md, OWNERSHIP_AND_HOMES.md, DEPLOYMENT_MATCH.md, DEPENDENCIES.md, TESTS/README.md, source/docs/security/AUDIT_REMEDIATION_STATUS.md and source/docs/security/MINT_BOUNDARY.md. The fix statuses are the team's own account and have not been re-reviewed: treat every doc as a claim to check against the code, the live files and your own runs.

Please do:

1. Each audit-8c3aea2e finding N-1..N-7: fixed / partly / not fixed / residual as stated / cannot verify, with file:line or URL evidence and, where possible, a local reproduction of the audit's own scenario. In particular:
   • N-1: overlapping session reads (src/world/auth.ts sessionReads); N-2: no wallet prompt and no verify from a cancelled, switched or torn-down sign-in.
   • N-3: the candidate rank past the 256 cap uses the counting rule incl. owner-bound 24 h sightings (server/ownership.ts).
   • N-4: pool and lane claims recorded apart (called_via, migration 0005); N-5: nested IPv6 /64 and /48 shares (worker/app.ts networkKey, subnetKey; NET6_SCALE); the 0004 fallbacks before 0005.
   • N-6: the discovery lane for a refused first NFT-index discovery (INDEX_LANE, chain:index:lane); re-run the keyed-reads probe (TESTS/probes) and say whether the upstream reads stay bounded.
   • N-7: expired / revoked / signed-out on the page, and the session route's expired flag.
2. Whether A-1..A-8, W-1..W-3 and the earlier F-n residuals still hold as the docs state (the N fixes touch the same code), and new issues in the changed code: anything that lets someone sign in as an address without its signature, keep or restore a revoked session, end another address's sessions, spend another party's budget in a way the docs do not state, get owner mode or Enter for a house that is not theirs, or poison data other players see.
3. Wallet-method inventory: re-count on the live index JS and the InteriorView chunk (the docs claim exactly eth_accounts, eth_requestAccounts and personal_sign, SIWE only, listening only to accountsChanged; no transaction, typed data, Permit/Permit2, approve, setApprovalForAll, batch call, chain switch or session key).
4. Rebuild the Worker bundle from source/ alone (DEPLOYMENT_MATCH.md section 3) and compare with 018df7b3...c62c and manifests/deploy-record-SHA256SUMS.txt; fetch the live index, JS, chunk and CSS once each and compare hashes and security headers. Give a deployment-match verdict (verified / partial / unverified) with reasons; the running Worker, secrets, D1 schema, limiter bindings and the edge WAF rule are team-side claims.
5. Run the local tests as TESTS/README.md says (copy source/ into its own git repo; the stubs in TESTS/stubs contain no house geometry). The snapshot reports 216 tests, 212 pass, 4 fail (three need withheld code, one needs the team's git history) and 43/43 N tests; check that, that the three "group 5" Enter-gate tests pass, and that npm audit reports 0.
6. World/Mint boundary: say whether anything changed; a future Genesis Mint page is out of scope (same origin, uses this session, reviewed separately; MINT_BOUNDARY.md lists the questions). Say "unknown" when unknown.

Scope and limits:

• In scope: wallet connect and sign-in, session, logout and logout-all, limits, ownership (mainnet ownerOf on 0x0000ec93127baa929e58e97dd0095a2bfb38ec1d), house rights (one house per wallet, sized by counted seats: this is the product rule, not a defect), headers, dependencies, the public data proxy's shared cache. Out of scope: Genesis Mint; withheld code (3D world, art, music, house placement, the interior rendering, WorldApp.tsx) beyond what the public bundles show.
• On production only a few low-rate public GETs (index, the JS/CSS/chunk, GET /api/auth/session; an edge rule blocks an IP over 20 /api/ requests per 10 s). No POST, sign-in, fuzzing, scanning or exploit attempts; do not change the target.
• Reproduce locally with the real handler, node:sqlite and synthetic keys generated in memory. No real wallets, real signatures or transactions.

Deliverable: report.md in Traditional Chinese (keep English technical terms):

• scope, versions and hashes you checked;
• a table N-1..N-7: severity in audit 8c3aea2e, the team's claim, your retest verdict, evidence, residual risk;
• new findings, each with severity, file:line or URL evidence and reproduction steps, separated into confirmed World issues, shared-boundary issues, unverified items and Genesis to-dos;
• the wallet-method inventory on the live files;
• the deployment-match verdict with reasons;
• the commands you ran and their output (no owner logs);
• what you could not verify.

Honesty rules: this is a record of a limited retest, not an audit certificate or endorsement. Do not call the site safe, secure, audited or certified. Mark facts you reproduced, inferences, team-side claims and unknowns apart. The team's fix statuses are claims until you confirm them.