[mhmdibrahimm]

Summary

• add authenticated Hunter nomination to the authoritative lobby match
• create durable preparing-round headers from locked lobby configuration and membership
• prioritize Hunter volunteers and cryptographically fill remaining Hunter slots server-side
• broadcast public round state separately from each player's private role assignment
• extend the Unity development panel with nomination, map selection, round start, and private-role state
• add a deterministic Main Camera and Directional Light so state transitions render cleanly in the Unity Game view

Impact

Clients can volunteer themselves for Hunter but cannot select another player or submit a role. The server remains authoritative for membership, round creation, and role assignment. A lobby can now transition into a preparing round with private Hunter/Hider roles.

Validation

• npm run verify
• npm run realtime:smoke
• Unity 6000.3.18f1 script compilation
• WebGL development build
• two-client visual validation with a WebGL host and Unity Editor guest

Visual verification

The approved host and guest captures show the same preparing round while exposing only the current client's private role.

The credential-free, non-interactive WebGL visual preview is deployed at https://hive-chameleon.vercel.app.

Dependency

PR #6 is merged. This PR now targets develop.

[mhmdibrahimm]

@mcfarhat PR #7 is reopened and retargeted to develop. The credential-free WebGL visual preview is live at https://hive-chameleon.vercel.app (commit 8e2599d). It shows the nomination, preparing-round, and private-role UI without publishing realtime credentials; live actions still require the local stack.

[mcfarhat]

Hi Mohammad — reviewed this end to end, and it is genuinely strong work. Highlights:

• Server-authoritative roles done right. selectRoundRoles prioritizes authenticated volunteers, then fills remaining hunter slots server-side with a crypto/rand Fisher-Yates shuffle (rand.Int over big.Int — unbiased). Clients never pick their own role.
• Injection-proof nomination. The payload cannot smuggle a player_id or role (nice that you have a test locking that to InvalidArgument).
• No hidden-role leakage. roundPublicSnapshot strips RoleAssignments (json:"-") and you assert the public JSON never contains "hunter"/"player_id" — exactly right for a hide-and-seek game.
• Concurrency + integrity. FOR UPDATE locks, optimistic row_version / ExpectedLobbyVersion (Aborted on drift), published-map gate, active-round guard, hunterCount+1 minimum, unique-member checks, UUIDv7 round IDs, and version stamping (protocol/result/scoring) on the round header. Error wrapping with %w throughout. All 5 CI checks pass.

One clarifying question before it goes in: RecordNominationChange validates membership + no-active-round and advances row_version, but I do not see the nominated flag persisted to Postgres — StartRound receives nominations as an in-memory map. Confirm nominations are held in the authoritative match state and survive a match-handler restart (or is that intentionally ephemeral until StartRound?). Not a blocker, just want the durability story explicit.

Holding the actual merge for Dr. Mohammad's final sign-off. Excellent milestone — thank you.