Baseline revision: 761f1fc2cc5ab9939d0734407f263c839ab2e820
Ledger opened: 10 August 2026
This ledger preserves every original audit obligation. A row reaches
resolved only after its production invariant is enforced, the strongest
practical regression evidence passes, the full repository builds and packages,
an independent adversarial review has no unresolved blocker, and the fixing PR
is merged. BASE-05, PKG-01, COL-07, COL-08, and STAT-06–STAT-10 were discovered during remediation and are
tracked in addition to the original 35 findings.
Current closure state: all 44 ledger rows are resolved, merged, and independently reviewed. Live TF2/MariaDB latency and lifecycle exercises remain explicit external validation limits rather than open source findings.
| ID | Sev. | Plugin / contract | Confirmed root cause | Intended invariant | Planned PR | Regression / verification | PR URL | Merge commit | Status | Remaining uncertainty |
|---|---|---|---|---|---|---|---|---|---|---|
| DEP-01 | High | Optional saka provider bindings | REQUIRE_PLUGIN remains defined at optional include sites, so generated SharedPlugin records are required; several calls also lack runtime guards. |
Optional providers compile with required=0, every call is presence-gated, and intentionally required providers stay required. |
DEP metadata | Exact compressed/uncompressed SMX dependency parser, parent-negative fixtures, full build/package/checksums, and independent call-site review. | PR #43 | cf5b1a2cabe7beb5fde809664d64a92b00146c3c |
Resolved | Live missing-provider loader exercise remains a staging follow-up. |
| DEP-02 | High | sakaMAPVOTE / mapchooser compatibility |
The replacement includes stock <mapchooser> with REQUIRE_PLUGIN, embedding a required mapchooser.smx record that is absent from the package. |
sakaMAPVOTE.smx provides the ABI without requesting stock mapchooser.smx. |
DEP metadata | Exact SMX metadata/native inspection, source self-call guard, ZIP manifest, full build/package/checksums, and independent review. | PR #43 | cf5b1a2cabe7beb5fde809664d64a92b00146c3c |
Resolved | Live clean-load without stock mapchooser.smx remains a staging follow-up. |
| PKG-01 | Medium | Release package determinism | package-release.sh scans every filesystem translations/ directory, so ignored vendor trees inject one of several conflicting tfdb.phrases.txt files and dirty/clean builds produce different ZIPs. |
Translation inputs come only from tracked declared roots, and incomplete enumeration or duplicate runtime basenames fail instead of producing a partial or overwritten package. | Release packaging | Dirty-vs-clean manifest equality, ignored vendor injection, duplicate-basename and partial-enumerator negative fixtures, full build/package/parser/checksums, and independent review. | PR #46 | 5213fcd46ae22ad34f8f3a8e25976c8dfb9405ae |
Resolved | Source archives without Git metadata are not a supported packaging environment; ZIP timestamps are not normalized. |
| MAP-01 | High | Map-vote result state | The no-vote fallback calls only SetNextMap and bypasses the normal change-mode transition. |
Every concrete winner, including random fallback, applies the requested instant/round-end/map-end mode through one transition. | MAP state machine | Shared result transition, comment-aware parent-negative guard, full compressed/uncompressed build, package/checksums, and independent state review. | PR #44 | 5f7b63657bc8736ec8eab809b45ff50388de68b0 |
Resolved | Live changelevel timing remains a staging follow-up. |
| MAP-02 | High | RTV / next-map handoff | RTV and next-map flows use vote-completed state, which is also true for Extend and Don't Change, then consume stale sm_nextmap. |
Forced changes require a concrete pending map; completed-without-pending never consumes stale state. | MAP state machine | Concrete-state guards plus captured-target, invalid-target, and issuer-tracked engine-failure recovery; parent-negative fixtures, full build/package, and independent review. | PR #44 | 5f7b63657bc8736ec8eab809b45ff50388de68b0 |
Resolved | Live vote and server_changelevel_failed ordering remain staging follow-ups. |
| MAP-03 | Medium | MAPVOTE late load | Plugin-start resets both voting flows disabled and ignores late; only OnMapStart arms delays. |
Late load reconstructs map lifecycle and uses only the unelapsed initial delay without duplicate timers. | MAP lifecycle | Late flag capture, post-config elapsed-time reconstruction, retained timer replacement, parent-negative guard, full build/package, and independent review. | PR #44 | 5f7b63657bc8736ec8eab809b45ff50388de68b0 |
Resolved | Live hibernation/map elapsed-time behavior remains a staging follow-up. |
| MAP-04 | Medium | Mapcycle cursor | An unknown current map sets cursor 0, then the common increment selects entry 1. |
Found maps select their successor, unknown maps select entry 0, and empty lists remain safe. |
MAP lifecycle | Explicit found/unknown/empty/serial-reload transitions, parent-negative guard, full build/package, and independent review. | PR #44 | 5f7b63657bc8736ec8eab809b45ff50388de68b0 |
Resolved | Live mapcycle reload behavior remains a staging follow-up. |
| MAP-05 | Medium | Frag-limit compatibility | Both frag ConVars are registered without handles and never read. | Advertised frag thresholds and extension steps affect behavior, or are explicitly removed with a compatibility notice. | MAP frag compatibility | Pinned-MapChooser-equivalent frag threshold/extension logic, death-event hook, retained-handle guard, full build/package, and independent review. | PR #44 | 5f7b63657bc8736ec8eab809b45ff50388de68b0 |
Resolved | Live TF2 frag-event and nonzero-mp_fraglimit behavior remain staging follow-ups. |
| NER-01 | High | NER ↔ SOLO ownership | NER blindly toggles SOLO, does not record ownership, and does not restore on unload. | NER requests a target state, owns only changes it made, and reconciles add/remove/reload. | NER/SOLO state | Idempotent setter plus feature-gated rolling fallback, provider lifecycle reconciliation, parent-negative guards, full build/package, and independent ownership review. | PR #45 | 0c69790b4f6b3fd67eee410c5c43a8e2cfe7f712 |
Resolved | Live provider reload ordering remains a staging follow-up. |
| NER-02 | Medium | NER map-change suspension | The death path prints “temporarily disabled” but changes no effective state; protection and repeated notices remain active. | Operator intent is separate from effective suspension; suspension enters once and clears at a defined map boundary. | NER/SOLO state | Requested/effective split, feature-gated concrete target, issuer-aware failure reconciliation, deferred-respawn revalidation, parent-negative guards, and independent review. | PR #45 | 0c69790b4f6b3fd67eee410c5c43a8e2cfe7f712 |
Resolved | Live map/vote/event ordering remains a staging follow-up. |
| SOLO-01 | Medium | sakaSOLO public API |
Seven native handlers index SoloClient[GetNativeCell(1)] before validating 1..MaxClients. |
Every per-client native rejects out-of-range slots through one documented controlled error. | NER/SOLO state | Shared range validator, all-slot reset parity, public consumer fixture, 12-native export inspection, parent-negative guards, build/package, and independent review. | PR #45 | 0c69790b4f6b3fd67eee410c5c43a8e2cfe7f712 |
Resolved | Invalid-native runtime harness remains a staging follow-up. |
| SOLO-02 | Medium | sm_solo command |
Console index 0 reaches client-only APIs and per-client storage. |
Only valid in-game human clients enter player command logic; console/bots fail safely. | NER/SOLO state | Caller validation before all player APIs, parent-negative guard, full build/package, and independent review. | PR #45 | 0c69790b4f6b3fd67eee410c5c43a8e2cfe7f712 |
Resolved | Live console/bot/player command exercise remains a staging follow-up. |
| SOLO-03 | Medium | SDKHook lifecycle | Reset/death paths clear the flag before unhooking, causing the scheduled cleanup to skip SDKUnhook. |
Hook registration and no-damage state are torn down atomically on every path. | NER/SOLO state | Central teardown, userid + arm-generation DataPack, all reset/death/disable paths, parent-negative guards, full build/package, and independent ABA review. | PR #45 | 0c69790b4f6b3fd67eee410c5c43a8e2cfe7f712 |
Resolved | Live SDKHooks disconnect/slot-reuse behavior remains a staging follow-up. |
| SOLO-04 | Low | Timer lifecycle | Map/round timers are untracked, lack TIMER_FLAG_NO_MAPCHANGE, and mutate globals after boundaries. |
A callback from map/round generation N cannot mutate generation N+1. | NER/SOLO state | Retained handles, map/round generations, TIMER_FLAG_NO_MAPCHANGE, boundary invalidation, parent-negative guard, build/package, and independent review. |
PR #45 | 0c69790b4f6b3fd67eee410c5c43a8e2cfe7f712 |
Resolved | Live map/round timer cancellation remains a staging follow-up. |
| BASE-01 | High | Reserved-slot admission | player_connect requires Saka_IsValidPlayer, but the connecting client is not in-game and may not resolve by userid. |
An authorized arriving donor at capacity causes exactly one eligible non-donor eviction; other connections do not. | BASE admission | Idempotent authorization coordinator, whitelist-outcome interlock, both victim modes, captured beneficiary plus delayed capacity/eligibility/hot-disable revalidation, pending/engine-kick exclusion, parent-negative guards, build/package, and independent review. | PR #47 | 2f09945e4e6643f5150ad9c33c56763f04382862 |
Resolved | Live connection-forward and delayed-kick timing remain staging follow-ups. |
| BASE-02 | High | Whitelist DB health | Initial connection failure overwrites configured active state, making the fail-closed branch unreachable and scheduling no retry. | Configuration, DB health, and admission policy are separate; enabled fail-closed never silently opens and recovery retries safely. | BASE admission | Separate readiness state, retained capped backoff, fail-open/fail-closed connect/escape/query paths, stale-query generations, parent-negative guards, build/package, and independent review. | PR #47 | 2f09945e4e6643f5150ad9c33c56763f04382862 |
Resolved | Live DB reconnect and query-callback timing remain staging follow-ups. |
| BASE-03 | High | MBRS gameplay phase | Per-frame code forces max speed whenever enabled with no setup/live-round state. | Speed override applies only in the defined pre-round phase and never persists into live play. | BASE gameplay | Authoritative RoundState_Preround gate, per-client captured override lifecycle, class/attribute fallback, disable/map/unload restoration, parent-negative guards, build/package, and independent review. |
PR #48 | 3fd0064081dbebfd1edee893af6e503d75ff5212 |
Resolved | Live TF2 class/condition speed restoration remains a staging follow-up. |
| BASE-04 | High | 1vs1 GOD state | Activation counts all team members, not one alive opponent per team; rechecks omit death/spawn and protection is not participant-scoped. | Active only with exactly one eligible alive RED and one BLUE, and only those two are protected. | BASE gameplay | Alive-human RED/BLU evaluator, participant userids, standard/Arena live-round activation, restart/end/map clearing, spawn/death/team/disconnect/late-load transitions, participant-scoped damage guard, parent-negative guards, build/package, and independent review. | PR #48 | 3fd0064081dbebfd1edee893af6e503d75ff5212 |
Resolved | Live damage/event ordering remains a staging follow-up. |
| BASE-05 | High | Whitelist authorization lifecycle | Whitelist checks run only from OnClientPutInServer when already authorized; SourceMod permits authorization afterward and there is no later retry. |
Every connecting human is decided exactly once after authorization regardless of callback ordering. | BASE admission | Explicit pending/checking/allowed/denied state, authorized + post-admin retries, userid/query/policy generations, pre-game callback acceptance, parent-negative guards, build/package, and independent review. | PR #47 | 2f09945e4e6643f5150ad9c33c56763f04382862 |
Resolved | Live callback ordering remains a staging follow-up. |
| DON-01 | High | Donor retention | Expiry/admin removal deletes the donor row, whose FK uses ON DELETE CASCADE for donation history. |
Expiry/revocation changes eligibility without deleting identity or donation history; destructive retention is separate and explicit. | DON retention | Idempotent is_active migration/backfill, revoke/reactivate/expire paths without identity deletion, connected-cache expiry reconciliation, source guards, disposable MySQL fixtures, build/package, and independent review. |
PR #49 | 80dbc1541d779b4b1702541dbc7aca6a3e2fd24f |
Resolved | Live SourceMod cache/expiry ordering remains a staging follow-up. |
| DON-02 | Medium | Donation mutation results | Remove/update helpers return SQL execution success without classifying zero affected rows. | Applied, unchanged/not-found, and DB failure semantics are explicit; legacy bool ABI remains documented. | DON retention | Pre-mutation snapshots plus affected-row/post-state reconciliation, explicit admin outcomes, documented idempotent bool mapping, source guards, disposable MySQL changed/same/missing/rerun cases, build/package, and independent review. | PR #49 | 80dbc1541d779b4b1702541dbc7aca6a3e2fd24f |
Resolved | Live SourceMod DB-error and concurrent-writer exercise remains a staging follow-up. |
| DON-03 | Medium | SteamID normalization | Prefix-only checks and unchecked StringToInt arithmetic accept malformed/trailing/overflowing identities. |
Only exact supported Steam2/Steam3 grammar is accepted and emitted as canonical Steam3 without overflow. | DON API/input | Exact grammar plus decimal string range checks, uint32-safe Steam2 conversion, canonical output, parent-negative guards, build/package, and independent review. | PR #50 | 827e89de0aaaec1f2b69f91be6fbaf538974787c |
Resolved | Live production parser fixture execution |
| DON-04 | Medium | Async donor-list identity | A DataPack stores the raw client slot; callback output and locale can target a reused slot. |
Async player output resolves the initiating userid; console remains console; reused/disconnected slots receive nothing. | DON API/input | Userid/console-sentinel request context, callback resolution before error/locale/output, parent-negative guards, build/package, and independent review. | PR #50 | 827e89de0aaaec1f2b69f91be6fbaf538974787c |
Resolved | Live delayed-query disconnect/slot-reuse timing |
| DON-05 | Medium | Donation API validation | Only the admin command checks amount bounds; the native reaches the core mutation without them. | One core validator rejects non-finite, non-positive, and schema-unsafe amounts for every caller. | DON API/input | Correct float-cell decoding, shared finite/range validator at the core SQL boundary, strict command parsing, compiled consumer, parent-negative guards, build/package, and independent review. | PR #50 | 827e89de0aaaec1f2b69f91be6fbaf538974787c |
Resolved | Live SourcePawn NaN/infinity native fixture execution |
| COL-01 | High | Premium entitlement lifecycle | Premium overwrites the sole selected group and only donor=true is reconciled; no ownership/restoration or live revocation signal exists. | Premium is reversible and independent of selection; only an owned override is restored on expiry/revocation. | COLORS entitlement/schema | Persisted previous-group/ownership state, owned grant/restore SQL, admin rename/delete/selection preservation, connect/library/timer reconciliation, legacy-row policy, source guards, build/package, and disposable DB fixtures. | PR #51 | f2a1aea30de2c29e958ee27a48a4c5e9075bd56f |
Resolved | Live DONATE change notification |
| COL-02 | High | COLORS upgrade deployment | Required Steam2→Steam3 SQL is omitted from docs/package; existing scripts are not fully rerun-safe or collision-safe. | Ordered, idempotent, non-destructive migrations ship with backup/rollback/downtime guidance. | COLORS entitlement/schema | Three ordered batch-safe migrations, collision/malformed/incompatible fail-closed preflights, tracked release packaging, backup/downtime/rollback runbook, source guards, and clean/partial/rerun/adversarial MySQL 9.7 fixtures. | PR #51 | f2a1aea30de2c29e958ee27a48a4c5e9075bd56f |
Resolved | Operator backup/rollback rehearsal |
| COL-03 | Medium | Chat filter boundaries | Every term uses unbounded substring matching and only the first occurrence is replaced. | Exact-word and intentional-substring policies are explicit, case-insensitive, and replace all occurrences. | COLORS filter/privacy | Explicit per-term modes, immutable lowercase scan, UTF-8-conservative token boundaries, length-preserving all-occurrence masking, extracted production-policy fixtures, source guards, build/package, and independent review. | PR #52 | 6889974bcd9f6ccb85e101e46b2105f76300229b |
Resolved | Live Chat Processor formatting |
| COL-04 | Medium | Group DB integrity | Group names lack a unique key and creation is check-then-insert; lookup of duplicates is unordered. | One canonical group row is DB-enforced with deterministic dedupe and atomic idempotent creation. | COLORS group integrity | Collation-consistent deterministic dedupe, exact-reference rewrite, non-empty/NOT NULL/unique metadata inspection, no-overwrite upsert/readback, concurrent/rerun/adversarial MySQL fixtures, source guards, build/package, and independent review. |
PR #53 | 70853077a9dfe6481a868c908074c3307dc20de2 |
Resolved | Live operator migration and concurrent admin exercise |
| COL-05 | Low | Color validation | Hex acceptance checks only # plus length and never validates digits. |
Accept exactly 6/8 hexadecimal digits, normalize case, and retain allow-listed named colors. | COLORS filter/privacy | Complete-token canonical normalizer across all eight input paths, exact hex-digit/range-length checks, production multicolors allow-list fixtures, source guards, build/package, and independent review. | PR #52 | 6889974bcd9f6ccb85e101e46b2105f76300229b |
Resolved | Rendering integration |
| COL-06 | Low | Filter logging/privacy | Default structured and file sinks duplicate full name, SteamID, IP, original, and filtered messages with no retention policy. | Defaults minimize data, avoid IP/full originals, use one sink, and document opt-in retention/access. | COLORS filter/privacy | Logging-off source/package defaults, one opt-in metadata-only sink, already-masked admin notices, upgrade/access/seven-day retention guidance, fixtures, source guards, build/package, and independent review. | PR #52 | 6889974bcd9f6ccb85e101e46b2105f76300229b |
Resolved | Existing-install ConVar migration |
| COL-07 | High | Admin target identity | Long-lived admin menus/chat prompts retain a raw client slot, and online mutations only check whether that slot is occupied; a disconnect/reuse can edit the successor. | Every online admin mutation proves the current authenticated SteamID matches the identity captured at selection, otherwise it uses the original identity's offline DB path. | COLORS filter/privacy | Raw slot state eliminated, central selected-SteamID resolver, caller-domination fixtures/guards, slot-reuse mutations, build/package, and independent review. | PR #52 | 6889974bcd9f6ccb85e101e46b2105f76300229b |
Resolved | Live menu/input disconnect and slot-reuse timing |
| COL-08 | High | Group-name runtime/schema capacity | VARCHAR(32) accepts 32 utf8mb4 characters, but group/menu/cache buffers hold only 31 bytes plus NUL; distinct rows can alias after truncation, while empty or embedded-NUL names are not persistently excluded. |
Every valid stored group name is losslessly representable across DB, menus, caches, and SQL; interactive accepted tokens are preserved whole, and empty/embedded-NUL names remain impossible after migration. | COLORS group integrity | 129-byte runtime and 257-byte escaped buffers, lossless menu labels, expanded repeated-name queries, full-width shared-prefix fixtures, enforced named CHECK metadata/startup validation, direct invalid-name rejection, source guards, build/package, and independent review. | PR #53 | 70853077a9dfe6481a868c908074c3307dc20de2 |
Resolved | Live 32-character utf8mb4 menu/input exercise |
| STAT-01 | High | Season transition command | forcetransition permits same/backward target then archives/deletes/reset state. |
Normal transition target is strictly the expected successor before any mutation; reset is a separate confirmed operation. | STATS seasons | Exact-successor source guards, same-season no-op contract, disposable sentinel/transaction fixture, full build/package, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | Calendar-boundary staging |
| STAT-02 | High | Online playtime flush | Bulk upload saves only dirty players; elapsed playtime alone is not dirty and save failures do not abort archival. | Every loaded player flushes accrued time exactly once and transition aborts on any required save failure. | STATS seasons | Forced all-loaded flush, post-write baseline advancement, missing-row reconciliation, gapless per-player carry boundary from the confirmed save timestamp, late-reload connected-session reopening, source mutations, disposable DB fixture, build/package, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | Live database latency at a calendar boundary |
| STAT-03 | High | Transition recovery | Transaction error publishes the pending season and reloads rolled-back stale main-table rows; runtime failures can strand joining clients. | Season is published/loaded only after commit; failure retains quarantined prior state and supports safe retry. | STATS seasons | InnoDB rollback injection, monotonic token-bound pending/committed CAS, distinct prepare/archive/cleanup ambiguity inspection, restart replay before config-disable handling, full read/write quarantine, DB-handle serialization, packaged recovery runbook, source mutations, build/package, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | SourceMod transaction callback and normal unload ordering |
| STAT-06 | High | Transition-window stat retention | The required async archive/reset window skips DB writes but continues mutating slot caches; success resets those caches, while disconnect clears them, losing post-flush stats. | Every authorized identity journals playtime/gameplay by SteamID across connect/disconnect/slot reuse and applies it exactly once after commit. | STATS seasons | Per-SteamID memory journal plus revisioned InnoDB carry journal, independent new-season top speed, exact pending/committed-generation queued writes, revision-advanced final unload snapshot, durable-before-main reconciliation, tri-state archive-source handling for newcomer retries, idempotent retry and atomic cleanup, source mutations, disposable DB fixture, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | Abrupt host/process loss before a queued carry write reaches MySQL |
| STAT-07 | High | Season transaction engine | Fresh schema does not request InnoDB and legacy tables are not inspected, yet archive/reset correctness assumes transactional rollback. | Fresh tables are InnoDB and every main/archive participant is verified InnoDB before mutation under the documented no-concurrent-DDL operating contract; legacy conversion is operator-controlled and documented. | STATS seasons | Explicit fresh DDL, main/archive/marker/carry and metadata-archive engine preflight during transition/recovery plus locked prepare/unload revalidation, stable runtime-drift/MyISAM negative fixtures, explicit prohibition on live concurrent DDL, shipped conversion/rollback runbook, source mutations, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | Production conversion duration and lock behavior; external DDL while the plugin is loaded is unsupported |
| STAT-08 | High | Skipped-season recovery | Startup assigns all stale rows to detectedSeason - 1, so multi-month downtime relabels older data as the immediately previous season. |
The active table's actual season is derived from stored login metadata and catch-up advances one exact successor at a time without putting live carry data in empty intermediate seasons. | STATS seasons | MIN/MAX stored-season derivation with NULL/unusable/mixed-season quarantine, private durable catch-up cursor, stable public season until final reconciliation, original metadata-source retention, source mutations, disposable multi-step marker/archive fixture, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | Legacy rows with unusable, pre-reference, or heterogeneous login timestamps require operator repair |
| STAT-09 | Medium | Death-event handle mode | player_death is hooked PostNoCopy although its callback reads userid and attacker; SourceMod may legally supply INVALID_HANDLE. |
Every event callback that reads fields receives a copied event handle. | STATS seasons | Exact hook-mode guard, parent-negative mutation, warning-free build, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | Live TF2 event dispatch ordering |
| STAT-10 | High | Fresh STATS schema compatibility | The base DDL declares comment TEXT DEFAULT ''; MySQL 9.7 rejects a default on that TEXT column, so a fresh install cannot create/prepare the schema. |
Fresh schema initializes on the supported MySQL line with explicit caller-supplied non-null comments and no invalid TEXT default. | STATS seasons | Exact DDL guard, disposable MySQL 9.7 fresh-schema fixture, full build/package, and independent review. | PR #54 | fbb077e35d2cdf4fa9bb4fdc686f9331639c2be8 |
Resolved | MariaDB fresh-schema confirmation |
| STAT-04 | Medium | Ranking semantics | Ranking counts rows >= the player's value, giving tied leaders the worst rank; menus use different sequential semantics. |
One documented competition-ranking rule is used across API and UI, with missing players returning the documented error. | STATS API/ranking | Deterministic current/archive SQLite fixture proves [100,100,100,90] -> [1,1,1,4], missing-player failure, stable SteamID tie ordering, API/menu/query parity, compiled public consumer, and source-pattern regression gates. |
PR #55 | 71286cb5b729efd8912960c5f59b4a81100ad241 |
Resolved | Stable secondary ordering |
| STAT-05 | Low | Season/config validation | Calendar values are copied unchecked and arbitrary season integers become table identifiers; live reload can rebase calendar meaning. | Startup/reload calendar ranges and native season arguments are validated before state or SQL construction. | STATS API/ranking | Atomic candidate-config validation covers every documented range and rejects live calendar rebasing without partial state/timer changes; safe season resolution and compiled consumer cover negative/huge/future/missing/current/archive inputs; source-pattern, build, parser, and package gates. | PR #55 | 71286cb5b729efd8912960c5f59b4a81100ad241 |
Resolved | Reload compatibility policy |
| OPS-01 | Medium | Database driver contract | Docs say generic DBI and SakaDatabase accepts any driver, while all four schemas/queries require MySQL/MariaDB. |
Every named connection fails fast unless it uses the MySQL driver; docs/package state the requirement. | DB driver contract | Exact pre-charset driver rejection and charset-failure guards, warning-free seven-plugin plus external-consumer build, deterministic SQLite incompatibility fixture, source-faithful disposable MySQL 9.7 eight-table initialization, shipped runbook/package checks, semantic source mutations, and independent adversarial review. | PR #56 | 8386e7e01f444edaa8f171766e71ed3bfce65edf |
Resolved | Live SourceMod driver-name/product behavior and real MariaDB connection confirmation |
| OPS-02 | Medium | SQL latency / cache ordering | Shared synchronous helpers are called from joins, chat, menus, gameplay callbacks, and public natives. | No network SQL runs on latency-sensitive callbacks; async identities/order/errors/cache freshness are explicit and ABI-compatible. | Async foundation + COLORS/DONATE/STATS follow-ups | Threaded/cache-only runtime paths, userid/serial/SteamID/generation checks, serialized/coalesced writes, bounded retries and cache freshness, source guards, warning-free builds, API consumers, CI, and independent adversarial review. | PR #57 · PR #58 · PR #59 | DONATE c4b98b4a76175a6c4dfd6f34891a0eb87cfcf339; COLORS b1fde5d0832fc17f9d9cd50517af7837c9f6c25c; STATS 11010e47c42e016cf9232e8607d8a0d6844f17a4 |
Resolved | Live delayed-network latency, SourceMod unload ordering, and representative TF2 player-flow exercise remain staging validation limits. |
- Baseline report and this ledger.
- Dependency metadata and compiled-artifact verification (
DEP-01,DEP-02). - MAPVOTE state machine/lifecycle/frag compatibility (
MAP-01–MAP-05). - NER/SOLO state ownership and lifecycle (
NER-01,NER-02,SOLO-01–SOLO-04). - BASE admission and gameplay (
BASE-01–BASE-05). - DONATE retention/mutation and API/input work (
DON-01–DON-05). - COLORS entitlement/schema/migrations, then filtering/privacy (
COL-01–COL-08). - STATS transition and API/ranking validation (
STAT-01–STAT-10). - MySQL driver enforcement and ordered asynchronous SQL work (
OPS-01,OPS-02). - Independent closure re-audit and final report update.
This was the delivery sequence used for the audit. Merged outcomes and remaining validation limits are recorded in the rows above; this is not a backlog for the current release.