Every capability is expected to preserve authoritative simulation, privacy boundaries, constraint-based HUD layout, and a reliable path from local validation to production.
Accounts
Identity before access
Password and Google sign-in share the same fail-closed account policy: verified identity, safe linking, suspension checks, and TOTP assurance all happen before a session is issued.
Replays
Capture by consent
Replay archival is off by default and can be enabled only for an individual developer-mode match. Live and in-memory replay behavior stays available without silently writing every game.
Operations
One production shape
The Worker, D1 migration chain, and existing REPLAYS bucket are kept aligned so release validation describes the infrastructure that actually runs the game.
Mobile
Command without obstruction
The battlefield is the focus on phones. Passive notices stay out of the play lane, while essential anti-air interaction remains a reachable touch control.
What comes next
Make the connected theater deeper
Future work will build on this foundation with ranked recovery, richer replay tools, seasonal operations, and store packaging. The order matters: competitive features should arrive only after their state, identity, and recovery paths can be inspected and tested.