[dop42]

This implements the owner's four decisions on the questions from #99, one commit per decision. lua tests/run.lua passes with 5143 checks. luac -p and the sandbox-globals check are clean, the manifest is unchanged, and every new message has an en and fr version.

1. Needs are server-authoritative

• Before: the client decayed hunger and thirst itself and pushed the values to the server (opx:net:needs:push). The server stored whatever came in after bounding it, so a client that always pushed 100 was never hungry.
• After:
  • The server decays every need on its own clock (DECAY_MS, each need's DECAY_PER_MINUTE) while the character is loaded. Values load when the character module announces the character on the server, without waiting for the client to ask.
  • A need goes up only through the server needs contract. Three paths use it:
    • an item whose USE.STATUS is consumed (the inventory adds it after taking the unit);
    • the new /opx.needs.set <player> <need> <value> command (ACL command.opx.needs.set);
    • the new creator exports GetNeeds, plus AddNeeds / SetNeeds (both gated by WRITERS).
  • The push event and its acknowledgement are removed. The client asks for its values once and displays every values event it receives; its contract is now read-only (GetNeeds).
  • Every change raises opx:on:needs:changed with its reason (loaded, decay, use, staff, ext:<caller>). This happens on the server bus too, so the HUD and subscribers keep working unchanged.
  • The header comment that recorded the old "client owns the values" ruling now records the new one.
  • PUSH_MS and PUSH_DELTA are removed from the config.
  • Nothing in the runtime downs or kills a player whose needs run out, and none is added.

2. Global chat requires a loaded character

• Before: any admitted connection could broadcast to everyone, including one still on the character screen.
• After: a connection with no loaded character is refused with chat.notLoaded (en+fr), with a cooldown so a flood earns one toast.
  • Staff can still speak: STAFF_PERMISSION in config/chat.lua, command.opx.admin by default.
  • The console speaks through the chat contract and never goes through this check.
  • The existing tests that assumed unloaded players could speak are updated.

3. Share codes are redeemed in a shop's fitting room and billed at its prices

• Before: a code dressed the player in someone else's saved outfit for free, anywhere.
• After:
  • A shop's room is opened under the shop's name (shops:<key>), and the appearance contract can report it (PricedRoom).
  • Redeeming requires standing at that shop's counter (shopAt: reach, bucket, job gate, not downed) with that shop's room open.
  • The outfit is then put on inside the room, with no free grant of its own. When the room is saved, the room's charge bills the changed pieces at the shop's PRICES, through the same server-side billing as rack pieces (audit: body, entry and survival — relog/restart deadlocks, free revive on rejoin, server-side shop billing #75/fix: player-flow papercuts 2 — the lead's decisions on heal, uniforms, prices, contacts, garages, spawn hold, labels #96). Cancelling costs nothing.
  • New refusals: shops.redeemAtShop and shops.redeemInRoom.

4. Giving an item asks the receiver to accept

• Before: the stack moved as soon as the giver pressed give.
• After: pressing give creates an offer.
  • The receiver sees a menu card with the item, the count, and where the giver stands, in the ux: clearer menus — give list says where a person stands, never their name #91 wording (To your left · 1.2 m). It never shows a name. The receiver picks Accept or Refuse; closing the card counts as a refusal.
  • The server holds a token for 15 s. A sweep withdraws unanswered offers and tells the giver.
  • On Accept, the server checks again that:
    • both players can act;
    • they are still in reach;
    • the same stack is still in the giver's slot;
    • the receiver has room.
  • Rate limits: one offer out per giver, one in per receiver, 3 s between offers from the same giver. The answer counts against the inventory request rate limit.
  • Only the intended receiver can answer a token, and replaying an answer moves nothing.

Also

core/client/ui.lua now yields between copying the locale catalogue and building its key list. Without this, the ~50 new strings pushed one resume of the client boot over its budget test (4,684 instructions against a 4,500 limit). With the yield, each resume handles at most one part, whatever the catalogue's size.

The #99 fuzz battery still passes: 85 net events (the needs push is gone, the give answer is new). It also covers the new inventory:giveAnswer event automatically.

README: new section "Four rules the server keeps", plus the needs exports and the server opx:on:needs:changed event. Config comments in config/needs.lua, config/chat.lua and config/shops.lua are updated.

🤖 Generated with Claude Code