[mhmdibrahimm]

What changed

• add the server-authoritative Casual round phase machine (preparing → hiding → hunting → terminal)
• accept Hunter aim intent only while Nakama owns hit resolution, shells, reloads, discoveries, idempotency, and win conditions
• assign private randomized Hider slots without leaking them through public round snapshots
• add Unity realtime models, private/public opcode handling, Hunter controls, countdowns, discoveries, and terminal-state presentation
• persist pre-round Hunter nominations on the open lobby membership, rehydrate them after a match-handler restart, and consume them transactionally at round start
• extend the database model, runtime documentation, unit coverage, schema contract, and two-client smoke flow

Why

This implements Trello card #32’s acceptance criterion: a complete Casual round reaches a terminal state under server authority, with no client declaring hits, scores, roles, or results.

The durable nomination change addresses Mr Farhat’s PR #7 and Trello follow-up about match-handler restart behavior.

Scope boundaries

• durable terminal result commits and publication remain card #33
• Infection mode, spectator/Answer Check, reconnect restoration, and polished map/gameplay UI remain their dedicated M4 cards

Validation

• npm run verify
• npm run realtime:smoke
• Go unit tests and race detector
• PostgreSQL migration/schema contract
• Unity 6000.3.18f1 WebGL build
• browser render, scrolling, and console validation

Visual preview: https://hive-chameleon-mz29yal7f-evaras-projects.vercel.app

[mcfarhat]

Hi Mohammad — reviewed #8 and it is another strong one, and I want to call out that it directly closes the open question from #7:

• Durable Hunter nominations (the #7 follow-up). The new migration adds game.lobby_membership.hunter_nominated with a clear comment — Nakama rehydrates it after a match-handler restart and clears it transactionally at round start. That is exactly the durability gap I flagged; nicely done.

On the Casual round itself:

• Server-authoritative fire resolution. HandleFire only accepts aim intent — the server owns shells, reload windows, discoveries, and win conditions. Nice gating: phase must be hunting (else round_terminal/not_hunting), aim-slot bounds-checked, reload window enforced, out-of-shells enforced.
• Idempotent + bounded. Replays short-circuit via hunter.Commands[CommandID] (every path, including rejects, caches its result), and maximumProcessedCommands caps per-hunter command memory so a spammed client cannot grow state unbounded.
• Clean phase machine (preparing → hiding → hunting → terminal) advanced by deadline, private randomized hiding slots via crypto/rand, discovery dedup via FoundHiders, and a proper server-side win (complete("hunters", "all_hiders_found") when every hider is found). All 5 CI checks pass; MERGEABLE/CLEAN.

No blockers from me — this is merge-ready. Holding the actual merge for Dr. Mohammad's sign-off. Excellent work again.