Updates

Profile pages and leaderboard identity polish

• Rebuilt public user profiles around arcade stats, leaderboard rank, recent activity, and cleaner public labels.
• Linked leaderboard and top-player names to their user profiles so player identity is easier to follow across game pages.
• Tightened profile responsiveness for desktop and mobile, including wrapped header controls, safer stat grids, and compact mobile spacing.

Registration wallet and email allowlist cleanup

• Kept millix.com wallet identifiers restricted while separating the Pagado identifier path so Pagado addresses are accepted correctly.
• Corrected the restricted-wallet message to reference tangled.com and the Tangled browser consistently.
• Expanded the registration email allowlist so tangled.com addresses can register.

Pong multiplayer production pass

• Reviewed and repaired the multiplayer invite flow so invite links prepopulate the room code for the joining player.
• Improved live match handling so the main ball and remote paddle state stay playable instead of feeling stalled or overly jerky.
• Ran production checks around the multiplayer page, room handoff, and claim-related safety paths.

Sudoku hard payout pool expansion

• Expanded the seeded Sudoku catalog so each difficulty, including hard, now has a much larger rotation of verified boards instead of a tiny pool that could be exhausted quickly.
• Updated the Sudoku claim UI to clearly mark a run as practice-only when an account has already claimed every seeded board for that difficulty, instead of surfacing a confusing late \"already claimed\" dead end.
• This should unblock hard-mode players who were running into repeated duplicate-claim messages after burning through the original board set.

Blaster post-claim tray cleanup

• Cleared the Blaster claim tray after a successful reCAPTCHA submission so the page no longer invites a duplicate claim on the same finished run.
• Now resets the reCAPTCHA widget after success and swaps the tray into a completed state instead of leaving the live claim button visible.
• This keeps the visible page state aligned with the successful millix award confirmation shown on the game canvas.

Blaster live session claim check

• Changed Blaster game-over payout routing to ask WordPress live whether the current player is logged in and has a wallet address, instead of trusting cached page-localized flags alone.
• Eligible runs now show a visible checking state first, then open either the claim prompt or the wallet modal based on the live session response.
• This protects the claim handoff when production page cache serves anonymous script data to an otherwise logged-in player.

Blaster claim handoff simplification

• Removed the extra post-game Blaster AJAX gate and now use the page-level logged-in and wallet state directly to decide the next payout step.
• Eligible logged-in runs now open reCAPTCHA immediately when a wallet is present, or open the add-wallet path immediately when one is missing.
• This cuts out the silent handoff failure that was leaving qualifying game-over screens stranded with no visible claim action.

Blaster claim flow hardening

• Switched Blaster claim eligibility checks to use the actual in-game final score first, so a qualifying run does not depend on the sidebar score text staying in sync at game over.
• Made the post-game claim tray force itself visible instead of relying only on the hidden attribute toggle, which gives the payout guidance a much more reliable entrance.
• Auto-opened the right next step for eligible runs, sending claim-ready players to reCAPTCHA and wallet-missing players straight to the wallet-address modal.

Blaster claim tray hardening

• Moved the Blaster post-game claim guidance into a fixed on-screen tray so eligible payout actions stay visible right after a run ends.
• Added button focus and escape-close behavior around the live claim prompt to make the next step easier to reach from keyboard play.
• Removed the leftover inline AdSense block from Blaster to cut one more source of page noise and startup friction.

Blaster claim visibility repair

• Added a visible post-game claim panel beneath the Blaster canvas so eligible runs always surface the next payout step in normal page UI.
• Wired direct open actions for the wallet modal and the reCAPTCHA claim prompt instead of relying only on the older hidden trigger link.
• Kept the claim path reachable even if the legacy modal handoff is slow or fails to surface clearly after game over.

Blaster claim prompt repair

• Fixed the Blaster score-claim handoff so eligible runs can open the live reCAPTCHA claim prompt again instead of stalling on a dead AJAX response.
• Added a visible minimum-score note on the Blaster page so players can see the claim threshold before and after a run.
• Improved the post-game messages for wallet-address and claim-prompt edge cases so the payout flow is easier to understand.

Hextris share link cleanup

• Repointed the live Hextris share actions from the old third-party Hextris domains to the Cobra Helix production game URL.
• Replaced insecure legacy share URLs with current HTTPS endpoints for Twitter and Facebook.
• Removed a small but real off-site dependency from the visible game-over sharing flow so Hextris better matches the current production site.

Stack payout hardening

• Moved Stack onto the shared arcade claim validator so claims now require a nonce, login, wallet address, reCAPTCHA, and encrypted score payload.
• Added the rolling hourly arcade cap to Stack claims and returned explicit success or failure responses for the live frontend flow.
• Wired a dedicated Stack claim nonce into the frontend so the production claim path no longer relies on the old unguarded handler.

Game-wide production ad cleanup follow-up

• Ran a production sweep across all live Cobra Helix game pages to verify public availability, load status, and lingering ad-recovery risk.
• Confirmed every current public game page returns successfully on production after the earlier cleanup.
• Extended the game-page AdSense scrubber so embedded adsbygoogle push calls are stripped even when they appear inside larger inline scripts, covering the Hextris edge case.

Blaster production startup sync

• Deployed the current Blaster startup fix to production so Enter, Space, and the Start button all trigger the first run correctly.
• Aligned the live Blaster asset with the local theme after production was found to still be serving the older keypress-only startup script.
• Disabled AdSense loading on game pages so active runs are not interrupted by the site-wide allow-ads message or related ad recovery overlays.

Radius Raid safety review

• Disabled the legacy Radius Tangled direct-payout endpoint so raw posted scores can no longer trigger the old external payment path.
• Hardened Radius Raid startup so corrupted saved browser stats cannot crash the game before it loads.
• Removed the old js13kgames.com credits button route and pointed that action back to the Cobra Helix games page.
• Made the legacy Tangled-specific Radius script safe to open in Chrome when the Tangled browser bridge is unavailable.
• Removed redundant legacy Radius module scripts from the page load; the bundled Radius script now loads without the old namespace errors.

Blaster startup fix

• Fixed Blaster startup so the visible Start Game button and keyboard controls can start a run reliably.
• Prevented the first non-Enter keypress from locking the game into a not-started state.
• Added a fallback Blaster score value so early gameplay cannot produce invalid scores while the score setting request is still loading.

Helix Rift claim flow

• Added the missing Helix Rift claim panel so completed runs can surface claimable millix.
• Added nonce, login, wallet, reCAPTCHA, best-score delta, and hourly-cap checks to the Helix Rift claim endpoint.
• Verified submitted Helix Rift scores against the enemy kill breakdown before storing pending claims.

Removed legacy third-party button texture

• Replaced the old Skywarrior/GameAddict widgetback.png button texture with local CSS gradients.
• Removed the blocked third-party image request seen on Snake and Blaster production smoke tests.
• Bumped the child theme stylesheet version so browsers request the cleaned CSS.

Targeted game JS stability cleanup

• Hardened Helix Block Drop and Pong claim flows so delayed reCAPTCHA initialization cannot throw page-level errors.
• Fixed Snake and Blaster legacy jQuery startup handlers that could throw "$ is not a function" under production script loading.
• Removed Snake's generic purge global collision by moving its purge multiplier onto a snake-specific variable.
• Verified the updated production assets with syntax checks and targeted browser smoke tests for Helix Block Drop, Pong, Snake, and Blaster.

Ninja Run claim-flow hardening

• Reviewed Ninja Run production claim handling for nonce, login, wallet, reCAPTCHA, score cap, score formula, best-score delta, and hourly cap checks.
• Hardened the Ninja Run claim bridge so reCAPTCHA timing cannot throw errors while Google scripts are still initializing.
• Prepared a production smoke test pass for Ninja Run boot, canvas rendering, and page-level JavaScript errors.

Sudoku and Minesweeper readiness fix

• Fixed Sudoku startup so reCAPTCHA timing can no longer stop the board from rendering its 81 playable cells.
• Added the same defensive reCAPTCHA method checks to Minesweeper to prevent background claim-widget timing errors.
• Verified production Sudoku board render, keypad input, hint, and reset behavior.
• Verified production Minesweeper board render, reveal, reset, and desktop right-click flag behavior.

Game performance and payout safety pass

• Changed Ninja Run to load its embedded game frame eagerly so the playable area starts loading immediately instead of waiting for lazy-frame heuristics.
• Removed an unused global jquery-confirm CDN request from the child theme enqueue list to reduce extra JavaScript work on every page.
• Disabled the legacy raw-score multiplayer REST payout endpoint so pending payout rows must go through the newer nonce, login, wallet, encrypted-score, and cap-aware claim handlers.
• Repeated production timing checks after the Helix Rift spike; the page settled back near the other game pages after cache warm-up.

Updates page color refresh

• Reworked the Updates page onto a light canvas with white update cards, dark readable copy, and Cobra red accents.
• Scoped the page background so the global red site gradient no longer wraps the updates log.
• Bumped the child theme stylesheet version so production browsers request the refreshed CSS.

Hextris first-click fix and game stability pass

• Repositioned and enlarged the invisible Hextris start-button hitbox so the visible Play triangle and Play label start the game on the first click or tap.
• Fixed a Hextris script parse issue caused by adjacent bundled closures.
• Moved the Hextris purge state onto a Cobra Helix namespaced global to avoid collisions with cache or optimization tooling.
• Guarded the Radius modal binding so shared site JavaScript does not throw errors on pages without the Radius modal.
• Verified production Hextris in a browser: the visible Play button starts the game, desktop and mobile-size checks pass, and no page-level JavaScript errors were thrown.

Production performance and safety cleanup

• Added a short transient cache to the header spinner markup to reduce repeated production work during page loads.
• Moved exposed backup files out of the Cobra Helix webroot so public requests no longer serve them.
• Purged the production error log after review so new issues are easier to spot.
• Fixed the anonymous /likes/ error on production and smoke-tested the page afterward.
• Ran production timing checks across the home page and game pages to identify the heavier game-load targets for follow-up.