S3-022: Adopt verified published foundation releases

Parent and ownership

Parent epic: https://github.com/stacksjs/the-settlers-iii-remake/issues/6 Source owner: stacksjs/the-settlers-iii-remake. Master roadmap: https://github.com/stacksjs/the-settlers-iii-remake/issues/4.

Problem and observable result

Upgrade source packages through Stacks where relevant. Update application manifests and lockfiles. Pass production regression without application shims.

The current application is a browser prototype. Passing the Riverlands campaign does not establish original-game or native parity. This issue is complete only when its stated behavior has retained evidence.

Evidence and interfaces

Craft owns graphics, native hosting, and platform capabilities. stx owns compilation/reactivity. ts-css owns style semantics. Stacks owns build and release orchestration. The game consumes published contracts.

• https://github.com/craft-native/craft/tree/cfde9ae33285d0697182fc794f799e108c11db32
• https://github.com/stacksjs/stx/tree/c5db290664
• https://github.com/home-lang/home-os/tree/151269666bc09aa15a271f1c1f4603f681132e65

Pin the inspected revisions and fixture hashes in the implementation evidence. Original-game observations govern rules and timing. JSettlers is implementation evidence, not an authoritative balance specification. Unknown values remain explicitly unverified.

Acceptance criteria

• Upgrade source packages through Stacks where relevant.
• Update application manifests and lockfiles.
• Pass production regression without application shims.
• The visible result agrees with the underlying simulation or platform state, including failure paths.
• Tests exercise the maintained public interface and retain reproducible fixtures or execution receipts.

Test matrix

• Run frozen install and production campaign.
• Verify installed exports and versions.
• Exercise invalid input, cancellation or interruption, and repeated execution where this interface permits them.
• Verify determinism/conservation for simulation changes and resource ownership/disposal for platform changes.
• Run owning-repository lint, relevant type checks and tests. Capture actual native output for native capability claims.

Scope constraints

Implement this behavior as a complete verifiable slice. Do not silently expand into adjacent tickets or substitute simplified gameplay. Keep the shared TypeScript simulation, shared stx signals, and ts-css conventions. Native gameplay and HUD must not depend on a WebView. HomeOS reuse must not introduce a kernel dependency into the game. Existing unrelated edits and authored guidance must be preserved.

Blocked by

• https://github.com/craft-native/craft/issues/396
• https://github.com/stacksjs/stacks/issues/2958

Upstream release and adoption

Application behavior belongs here. If a reproduction identifies a framework defect, repair and release its owning source first, update Stacks where affected, then install the verified packages here.

No node_modules edits, copied runtimes, generated-source string patches, fabricated globals, successful no-op implementations, or skipped release gates. Push tested conventional commits as Chris to the owning origin/main without coauthor trailers or force pushes.

Completion evidence

• Implementation commits and relevant upstream issue links.
• Exact checks and results, fixture hashes, and screenshots/native execution evidence where applicable.
• Published package versions, downstream lockfile identity, and release receipts when affected.
• Remaining limitations stated explicitly. Partial work does not close this issue.

Additional verified delivery blockers

The native blocking relationships also include these owning-source defects found during normal foundation installation and clean-build verification:

• https://github.com/stacksjs/stacks/issues/3094 - Build selected workspace providers before their consumers, retaining normal export checks and one build per package.
• https://github.com/stacksjs/stacks/issues/3095 - Resolve workspace package names from their manifests so external @stacksjs/desktop retains its own public exports.
• https://github.com/pantry-pm/pantry/issues/265 - Preserve the original valid Craft signature and entitlements through normal Pantry publication and installation.

These add to the roadmap blockers above. Verified source, actual successful publication gates and normal downstream acceptance remain required. Local source commits and public tarball availability alone do not complete adoption.

Verified published foundations are now installed and pushed in game commit 8a1daa3, normally to main as Chris without coauthors:

• Stacks 0.75.305
• STX 0.2.691
• Craft 0.0.341
• Pantry 0.11.127

Published installed-package receipt and browser acceptance are committed alongside the exact-source plan.

The installed published @stacksjs/actions/release-evidence module verified all 95 selected original archives, installed package trees, immutable source tags and required CI/release jobs. It ran app/tools/STX types, Pickier, tests, asset verification, fidelity/roadmap checks and the production browser campaign, all exit 0, without changing the verified lock. Normal Bun and native Pantry installs and frozen Bun install passed.

Additional actual browser acceptance passed 4x18 control-frame/guide steps, 5 resize, 19 production, 33 selection, 2x25 recruitment, 36 working-area and checkpoint checks. The numbered group test now uses a real native driver Digit1 press and retains the Group 1 is empty assertion. No DOM KeyboardEvent substitute remains for that key.

The recruitment-control implementation's main CI passed in run 40178778347; its original diagnostics artifact 12593556609 was checked against GitHub SHA256 and ZIP CRC, including both 25-step recruitment scenarios. The new dependency commit has its own CI running.

The separately triggered Stacks 0.75.306 at ca70562 updates Stacks' own Pantry Action/SDK pins. Its exact-source CI and Releaser are pending, so it is not qualified or installed here. Native game acceptance and original Gold Edition observations remain open.

The game dependency adoption commit 8a1daa3 is now green in full main CI.

Independently verified its original diagnostics artifact 12593702234: 15520 bytes, GitHub SHA256 86764d35348d9cee2cb15c06b5b30c6f99967dab45494d23e2d20e3158767294 and all ZIP CRCs. All 274 scenario steps passed across campaign (58), four control-frame/guide profiles (4x18), resize (5), production (19), selection (33), desktop/phone recruitment (2x25), working areas (36) and checkpoints (1). All recorded console, network and collection errors are empty. The retained selection report confirms the actual native Digit1 press.

The game is installed on verified Stacks 0.75.305 / STX 0.2.691 / Craft 0.0.341 / Pantry 0.11.127. Its published-package verifier and committed exact-source receipts also passed all consumer checks and complete installed-file comparisons for the 95 selected archives.

Stacks' separate Pantry adoption CI identified a bootstrap pin I missed: the installer still defaulted to126 while CI used127. The existing test reproduced it locally, and the owning installer was corrected in 0e03732. All 1461 Buddy tests / 6229 assertions then passed, plus bootstrap/lock tests and lint (zero errors, six existing warnings). The maintained patch command exited0 and created v0.75.307 at dc7923c. Its exact-source CI and Releaser are pending. It is not qualified or installed; failed/historical revisions and release gates are preserved.

Original Gold Edition observations and true native game acceptance remain open. This is verified browser progress, not a claim of complete original-game parity.

Adopted the independently qualified cohort through the normal buddy upgrade --version 0.75.308 and installers in f4a3507: Stacks 0.75.308, STX 0.2.691, Craft 0.0.341, Pantry 0.11.127, project Bun 1.4.4. Both committed locks are generated by normal installers, and frozen Bun installation passes. The upgrade also reconciles 25 stale framework dependency declarations across five support manifests.

Stacks source d8e5b07941486adf7c5f7ec472307119530020a9 passed all 17 required main CI jobs and all release jobs. Independently checked all 86 original npm archives against publisher SHA-512/SHA-1 receipts and complete bytes; all five native Buddy originals match the original manifest, GitHub digests, ZIP CRCs and target architectures. The original macOS arm64 executable reports the expected version and pinned Bun.

The game's installed published actions verifier checked 95 selected original package archives against installed trees, exact source/release gates, and all seven application checks. The complete dedicated production browser suite passed 292 steps, including desktop and phone HUD/recruitment cases, with zero recorded console, request or collection errors. The installed published @stacksjs/testing/browser also passed 14 startup and isolation tests, 82 assertions, including actual Chrome isolation.

• Committed published-module verification
• Committed browser and installed-testing acceptance
• Upstream shared-Chrome evidence and remaining cold-start investigation

This qualifies the browser cohort and installed framework contracts. It does not establish full native game frames, HUD/input, lifecycle or store delivery; issue 25 remains open for those acceptance criteria. No original Gold Edition parity is inferred.

Final main CI is successful on exact head 64dd8b04506e0b6b2c577590315b852b121d2568. Downloaded the original campaign-browser-check artifact 12595958336 (15,740 bytes), matched GitHub SHA-256 22aec373984d22c02a5be1baf57aebb935ee91f6ffead460a99812bd1c660baa, checked every ZIP entry CRC, and independently confirmed all 292 successful browser steps with zero recorded console errors, failed requests or collection errors.

The standalone driver fix is released and adopted through the maintained source workflow: Stacks v0.75.310, exact source f04f7238. Exact source CI and all five Releaser jobs succeeded.

All 86 original npm archives match publisher receipts, complete bytes, SHA512 and SHA1. All five original native archives match the original manifest and GitHub digests; ZIP CRCs and executable architectures pass. The original ARM64 Buddy reports 0.75.310 on Bun 1.4.4. The defaults archive contains the exact shared helper/driver source, and the testing bundle includes preparation while public declarations carry no private source import.

The game adopted 0.75.310 through normal Buddy upgrade, original Pantry 0.11.127 install and frozen Bun 1.4.4 install. Its installed published verifier accepted95 original package trees and all seven consumer checks. The full battle now passes through the installed standalone driver: 612,342 ms at normal 4x, complete defeat, save and real reload, zero recorded console/network/collection errors. Ten suites total 385 successful steps. No app keepalive, injected clock/session, copied runtime or installed-module patch was introduced.

Public publication receipt, installed receipt, and browser acceptance are on main. Game CI40208919317 is running; its original diagnostics will be checked before final closure.

Exact main CI 40208919317 succeeded on 85ac0f1, which remains origin/main. The original job log confirms 272 unit tests, zero failures, 22,758 assertions.

The original campaign-browser-check artifact 12604504234 is 19,659 bytes. Its SHA-256 481b25aad73ed1cad91acf0c5bb7e1137055e895aaedf5b9f6522c852275d3f4 matches GitHub's digest, every ZIP CRC passes, and every recorded assertion across 385 browser steps passes with zero console, network or collection errors. The complete normal seed-2 battle ran 610,472 ms, reached defeat, then acknowledged save and passed the seed/outcome assertions after a real reload. The archive contains diagnostics and media identities only, with no original raster upload.

This qualifies the specific source fixes and the published Stacks 0.75.310 adoption recorded in the source/publication and browser acceptance receipts. The broader roadmap remains open for human-victory coverage, all seeds, factions, religious AI, original Gold balance/timing, campaigns and complete native applications.

Qualified adoption is now on main as https://github.com/stacksjs/the-settlers-iii-remake/commit/08d4eff3b50eb295e68324c2b453551cf829defb. Exact CI is green: https://github.com/stacksjs/the-settlers-iii-remake/actions/runs/40225612811.

The game normally installs Stacks 0.75.311, STX 0.2.691, Craft 0.0.341, Pantry 0.11.127 and Bun 1.4.4. The installed published verifier validates all 95 selected original package trees and seven consumer checks. Upstream source/release gates, all 86 Stacks npm archives and five original Buddy native ZIPs are qualified before normal adoption. The exact game-main original diagnostic artifact (ID 12611880667, SHA256 732cbccb239192709ac82a56aa0c393eadcc2f7e6f5319699f9bb9ca85c3ebf5) passes its GitHub digest, all CRCs and every one of 385 successful browser steps, with no error collections.

Receipts are committed under docs/roadmap/receipts/framework-0.75.311-*. The original Craft CLI, Bun and browser still match the same five-tick engine/save/replay fixture at c331a944. This remains headless fixture evidence. Complete native graphics, HUD, frame/input/lifecycle and finished cross-platform game acceptance remain open; this issue is not closed by the package adoption alone.