Updates

Arcade risk and session hardening follow-up

• Added a shared risk layer that groups claim activity by hashed device, network, and browser signals without storing raw IP addresses or raw user-agent strings.
• Added server-issued game-session tokens for Sky Knight, Pong, Ninja Run, Helix Rift, Cobra Defender, Cobra Cup, and Helix Block Drop, with audit-safe mode for newly tokenized games.
• Added admin review tables for recent claim decisions, cap hits, session records, reasons, risk scores, and payout context under the Games admin area.
• Changed fast but verified Helix Block Drop runs to store a pending claim with capped millix instead of hard-blocking the run, while keeping the full score available for score and competition context.

Cobra Doom controls and sandbox restores

• Updated the Cobra Doom beta wrapper with modern controls, pointer-lock mouse turning, Cobra Pause on Escape, Classic Menu access, and local quick settings for sensitivity, screen size, and audio.
• Followed up with input hotfixes that use direct strafe controls, explicit sensitivity buttons, and shorter mouse-turn hold windows for a more predictable playtest feel.
• Added WP Admin installer paths with backups for the Cobra Doom beta files and later input hotfixes so sandbox changes can be deployed without replacing unrelated theme files.
• Restored the BattleDAG sandbox wrapper so approved testers can reach the bundled BattleDAG build from the private sandbox route again.

Sandbox beta roster expansion

• Prepared Cobra Cup as a playable browser football beta with a public game page, sandbox dashboard card, shared claim flow, and rolling arcade-cap participation.
• Polished Cobra Cup with low-poly footballer meshes, visible goalkeeper treatment, better camera framing, fullscreen and theater controls, and a keyboard/mobile controls modal.
• Added Cobra Xonotic as a native sandbox playtest with gated tester access and downloadable launcher, ladder, and branding packages.
• Added Cobra Wing as a private sandbox playtest with a side-scrolling canvas build, manual tester feedback, and lightweight wp-admin telemetry for run events.

Cobra Doom private sandbox launch

• Added the gated Sandbox hub and a private Cobra Doom playtest page for approved testers.
• Added per-user sandbox access controls in WP Admin so admins can grant tester access without making the build public.
• Added private Sandbox Feedback storage for tester notes, ratings, blocker reports, referer, browser, and user context.
• Routed the public Cobra Doom path into the private sandbox page while preserving query parameters for purchase and checkout handoffs.

Security and payout safety hardening

• Blocked public access to sensitive backup archives, SQL dumps, logs, readme/license files, XML-RPC, and executable files inside writable content paths.
• Disabled legacy public game-option AJAX endpoints that could expose game settings without an authenticated admin flow.
• Added nonce checks and rate limiting around wallet validation, and moved reCAPTCHA secret verification into POST request bodies.
• Expanded hourly arcade cap coverage and added final payout-worker allowlists, maximum payout gates, HTTPS enforcement, and quarantine handling for unsafe pending rows.

Broadcast score games and games library refresh

• Onboarded Hextris and Cobra Defender to the Broadcast2 current-mode view as score-mode live competition games.
• Added clean Broadcast2 current URLs with root-absolute assets so game-specific OBS paths load JavaScript and CSS correctly.
• Gave Hextris a game-specific broadcast score scene with the familiar colored block palette, live score, player identity, and run stats.
• Prepared the redesigned Games page and competition cover artwork mapping so the arcade library and scheduled events use the newer game cover system.

Arcade behavior review tools

• Added a read-only admin review table for stored game claims so suspicious earning patterns can be reviewed before taking action.
• Added filters and CSV export for cap-pressure patterns, high claim velocity, repeated payout amounts, single-game dominance, and quarantined rows.
• Added a cap matrix for the shared hourly cap and per-game caps so admins can compare active earning limits in one place.
• Added configurable review thresholds while keeping the tool framed as an evidence queue, not an automatic enforcement system.

AdSense coverage and arcade cleanup

• Added a controlled fallback AdSense placement for standard site pages so normal pages can serve an ad even when they do not have a custom template slot.
• Kept cart, checkout, account, statement, broadcast, and active game experiences protected from disruptive automatic ad injection.
• Preserved existing manual game-page ad rails and footer slots while avoiding duplicate fallback ads on templates that already include an ad.
• Removed the Neon Void Runner prototype from the arcade routing, labels, cap lists, assets, and documentation after review.

Arcade cap and Total Earned fixes

• Tightened the rolling hourly arcade cap so it only counts pending and paid hosted-game claims from the last rolling hour.
• Updated header and profile Total Earned calculations so newer arcade games and paid rows without transaction IDs are included correctly.
• Added clearer paid and pending earned breakdowns across profile, leaderboard, and per-game arcade summaries.
• Polished the header earned block so pending millix can appear without shifting the layout.

Official broadcast channel preparation

• Prepared permanent official broadcast paths for game-specific competition streams, including clean OBS-friendly URLs.
• Added a read-only official broadcast endpoint that can select active, recently ended, or next upcoming official competitions for a game.
• Restricted official channel selection to administrator-created competitions and thecobra-created competitions while leaving regular competition creation unchanged.
• Added tests around official channel selection, standby payloads, countdown refresh behavior, and author gating.

Competition repeat scheduling workflow

• Built an admin Repeat this schedule workflow for creating future competition occurrences from a source event.
• Added weekday defaults, occurrence limits, exact-date parsing, and a live preview so schedules can be reviewed before creation.
• Copied competition terms, featured images, prize settings, broadcast settings, and payout configuration while skipping volatile payout and editor state.
• Separated the stream scheduler dashboard into Live Now, Scheduled Future Streams, and Past Streams, with a stale live-session cleanup control.

ads.txt availability fix

• Published a static ads.txt file at the WordPress web root so the public ads.txt URL returns a plain text 200 response.
• Added the durable local ads.txt copy with the current Google publisher entry.
• Verified the live ads.txt response headers and body after the fix so AdSense can re-check the site successfully.

CobraCast live broadcast reliability pass

• Tuned the live Pong broadcast path for faster state delivery while keeping the WebSocket rail heartbeat and REST mirror available as backup paths.
• Buffered broadcast visuals so ball trails, plasma hits, collision effects, and score changes line up with the delayed live playfield.
• Improved active-game switching so laggy games can stay visible in the row without taking over the featured view, and ended games drop out of Live Now rotation.
• Updated competition broadcast timers so the remaining-time display continues ticking locally between rail packets and REST refreshes.

Pong and broadcast test coverage

• Expanded live Pong payloads with sequence data, plasma state, ball trail state, last-hitter details, and visual event markers for broadcast rendering.
• Kept competition broadcast data authoritative from the event REST feed while using live rail packets for gameplay motion.
• Added rail-side checks for publish cadence, rate-limit headroom, packet sequencing, signaling messages, buffered effects, profile hydration, and competition authority.

Arcade mobile controls and ad layout cleanup

• Added mobile controls and small-screen layout hardening for Helix Rift, including touch movement, fire, bomb controls, compact HUD spacing, and safer claim-panel placement.
• Reworked Blaster with enhanced and classic modes, mobile pointer controls, upgraded HUD/sidebar layout, powerups, and a clearer wallet-required claim path.
• Wrapped more game pages in controlled ad rail and footer slots so desktop ads can sit beside the playfield while mobile screens keep the game area clear.
• Kept the game-page AdSense scrubber focused on removing disruptive injected ads while preserving the theme-controlled placements.

Profile, wallet, and payout maintenance

• Polished the profile settings page so saved email, social, about, profile image, and wallet values remain visible after reload instead of relying on placeholders.
• Added a profile-avatar edit shortcut for profile owners that jumps directly to the profile image section in settings.
• Hardened wallet validation so recognized provider addresses can avoid false shared-provider conflicts and remote checks use WordPress HTTP requests with timeouts.
• Prepared the game payout worker path with batch locking, transaction logging, and duplicate-processing protection for reviewed payout runs.

CobraCast live broadcast default

• Updated /broadcast/ so the general CobraCast page now shows active live games by default instead of rotating through inactive showcase games.
• Added a cleaner standby state that says "Waiting for live games" when no live games are active.
• Added an admin OBS button for grabbing the clean live-only broadcast URL, while keeping rotation=all available as an explicit showcase/operator view.
• Documented the broadcast links and handoff notes for future CobraCast work.

Production home and ad placement cleanup

• Promoted the new Cobra Helix home page to production with the arcade grid background, live arena panels, competitions list, top scores strip, and full game directory.
• Backed up the prior home template before the swap so the older landing page can be restored if needed.
• Removed the hardcoded global AdSense loader and disabled the Site Kit frontend Auto Ads snippet so Google should no longer inject the horizontal ad above the navigation bar.
• Kept explicit theme-controlled ad placements available for pages that intentionally include them.

Cobra Helix visual system rollout

• Carried the maintenance-page visual direction into the home page, including the dark grid, red glow, cyan and gold accents, and stacked glassy panels.
• Added the centered Cobra Helix identity stack with the animated cobra mark, white wordmark, and Paid to Play graphic.
• Reworked the games area so top scores sit above the playable game list instead of competing with the game-selection heading.
• Applied the new home background treatment to competitions, games, leaderboard, and public profile surfaces for a more consistent arcade feel.

Pong mobile polish pass

• Started the mobile-playability review with Pong and tightened the small-screen layout around the canvas, controls, and claim flow.
• Improved responsive spacing and interaction affordances so Pong can be evaluated on phones before expanding the same review to the rest of the arcade.
• Kept the broader mobile badge/device-detection work parked until each game is tested for real playability instead of only technical responsiveness.

Livestream competition broadcast upgrades

• Added stream competition scheduling so multiple timed prize events can be prepared in advance while OBS stays pointed at the same broadcast URL.
• Reworked the broadcast scene around real competition data, including live rankings, current leader, active attempts, featured run, prize, countdown, and final results.
• Added a stronger end-of-event presentation with winner, podium, prize status, and payout messaging for livestream wrap-ups.
• Improved automatic winner payout handling so eligible competitions can queue payout at event end with duplicate-processing protection.
• Added public display-name editing so players can update how they appear on leaderboards and broadcast scenes without changing their username or profile URL.

Livestream prize event system

• Added timed Pong prize competitions where players can start, stop, and retry during the live window while their best verified score counts.
• Built an OBS-ready broadcast scene with countdown, prize, leaderboard, current leader, winner area, and automatic cycling through active live game feeds.
• Expanded livestream player cards with avatar, verified badge, username, global rank, and room for eight-figure millix scores.
• Added admin event controls, event score tracking, and Pagado payout review support so the winner can be verified before payment.

Profile pages and leaderboard identity polish

• Rebuilt public user profiles around arcade stats, leaderboard rank, recent activity, and cleaner public labels.
• Linked leaderboard and top-player names to their user profiles so player identity is easier to follow across game pages.
• Tightened profile responsiveness for desktop and mobile, including wrapped header controls, safer stat grids, and compact mobile spacing.

Registration wallet and email allowlist cleanup

• Kept millix.com wallet identifiers restricted while separating the Pagado identifier path so Pagado addresses are accepted correctly.
• Corrected the restricted-wallet message to reference tangled.com and the Tangled browser consistently.
• Expanded the registration email allowlist so tangled.com addresses can register.

Pong multiplayer production pass

• Reviewed and repaired the multiplayer invite flow so invite links prepopulate the room code for the joining player.
• Improved live match handling so the main ball and remote paddle state stay playable instead of feeling stalled or overly jerky.
• Ran production checks around the multiplayer page, room handoff, and claim-related safety paths.

Sudoku hard payout pool expansion

• Expanded the seeded Sudoku catalog so each difficulty, including hard, now has a much larger rotation of verified boards instead of a tiny pool that could be exhausted quickly.
• Updated the Sudoku claim UI to clearly mark a run as practice-only when an account has already claimed every seeded board for that difficulty, instead of surfacing a confusing late \"already claimed\" dead end.
• This should unblock hard-mode players who were running into repeated duplicate-claim messages after burning through the original board set.

Blaster post-claim tray cleanup

• Cleared the Blaster claim tray after a successful reCAPTCHA submission so the page no longer invites a duplicate claim on the same finished run.
• Now resets the reCAPTCHA widget after success and swaps the tray into a completed state instead of leaving the live claim button visible.
• This keeps the visible page state aligned with the successful millix award confirmation shown on the game canvas.

Blaster live session claim check

• Changed Blaster game-over payout routing to ask WordPress live whether the current player is logged in and has a wallet address, instead of trusting cached page-localized flags alone.
• Eligible runs now show a visible checking state first, then open either the claim prompt or the wallet modal based on the live session response.
• This protects the claim handoff when production page cache serves anonymous script data to an otherwise logged-in player.

Blaster claim handoff simplification

• Removed the extra post-game Blaster AJAX gate and now use the page-level logged-in and wallet state directly to decide the next payout step.
• Eligible logged-in runs now open reCAPTCHA immediately when a wallet is present, or open the add-wallet path immediately when one is missing.
• This cuts out the silent handoff failure that was leaving qualifying game-over screens stranded with no visible claim action.

Blaster claim flow hardening

• Switched Blaster claim eligibility checks to use the actual in-game final score first, so a qualifying run does not depend on the sidebar score text staying in sync at game over.
• Made the post-game claim tray force itself visible instead of relying only on the hidden attribute toggle, which gives the payout guidance a much more reliable entrance.
• Auto-opened the right next step for eligible runs, sending claim-ready players to reCAPTCHA and wallet-missing players straight to the wallet-address modal.

Blaster claim tray hardening

• Moved the Blaster post-game claim guidance into a fixed on-screen tray so eligible payout actions stay visible right after a run ends.
• Added button focus and escape-close behavior around the live claim prompt to make the next step easier to reach from keyboard play.
• Removed the leftover inline AdSense block from Blaster to cut one more source of page noise and startup friction.

Blaster claim visibility repair

• Added a visible post-game claim panel beneath the Blaster canvas so eligible runs always surface the next payout step in normal page UI.
• Wired direct open actions for the wallet modal and the reCAPTCHA claim prompt instead of relying only on the older hidden trigger link.
• Kept the claim path reachable even if the legacy modal handoff is slow or fails to surface clearly after game over.

Blaster claim prompt repair

• Fixed the Blaster score-claim handoff so eligible runs can open the live reCAPTCHA claim prompt again instead of stalling on a dead AJAX response.
• Added a visible minimum-score note on the Blaster page so players can see the claim threshold before and after a run.
• Improved the post-game messages for wallet-address and claim-prompt edge cases so the payout flow is easier to understand.

Hextris share link cleanup

• Repointed the live Hextris share actions from the old third-party Hextris domains to the Cobra Helix production game URL.
• Replaced insecure legacy share URLs with current HTTPS endpoints for Twitter and Facebook.
• Removed a small but real off-site dependency from the visible game-over sharing flow so Hextris better matches the current production site.

Stack payout hardening

• Moved Stack onto the shared arcade claim validator so claims now require a nonce, login, wallet address, reCAPTCHA, and encrypted score payload.
• Added the rolling hourly arcade cap to Stack claims and returned explicit success or failure responses for the live frontend flow.
• Wired a dedicated Stack claim nonce into the frontend so the production claim path no longer relies on the old unguarded handler.

Game-wide production ad cleanup follow-up

• Ran a production sweep across all live Cobra Helix game pages to verify public availability, load status, and lingering ad-recovery risk.
• Confirmed every current public game page returns successfully on production after the earlier cleanup.
• Extended the game-page AdSense scrubber so embedded adsbygoogle push calls are stripped even when they appear inside larger inline scripts, covering the Hextris edge case.

Blaster production startup sync

• Deployed the current Blaster startup fix to production so Enter, Space, and the Start button all trigger the first run correctly.
• Aligned the live Blaster asset with the local theme after production was found to still be serving the older keypress-only startup script.
• Disabled AdSense loading on game pages so active runs are not interrupted by the site-wide allow-ads message or related ad recovery overlays.

Radius Raid safety review

• Disabled the legacy Radius Tangled direct-payout endpoint so raw posted scores can no longer trigger the old external payment path.
• Hardened Radius Raid startup so corrupted saved browser stats cannot crash the game before it loads.
• Removed the old js13kgames.com credits button route and pointed that action back to the Cobra Helix games page.
• Made the legacy Tangled-specific Radius script safe to open in Chrome when the Tangled browser bridge is unavailable.
• Removed redundant legacy Radius module scripts from the page load; the bundled Radius script now loads without the old namespace errors.

Blaster startup fix

• Fixed Blaster startup so the visible Start Game button and keyboard controls can start a run reliably.
• Prevented the first non-Enter keypress from locking the game into a not-started state.
• Added a fallback Blaster score value so early gameplay cannot produce invalid scores while the score setting request is still loading.

Helix Rift claim flow

• Added the missing Helix Rift claim panel so completed runs can surface claimable millix.
• Added nonce, login, wallet, reCAPTCHA, best-score delta, and hourly-cap checks to the Helix Rift claim endpoint.
• Verified submitted Helix Rift scores against the enemy kill breakdown before storing pending claims.

Removed legacy third-party button texture

• Replaced the old Skywarrior/GameAddict widgetback.png button texture with local CSS gradients.
• Removed the blocked third-party image request seen on Snake and Blaster production smoke tests.
• Bumped the child theme stylesheet version so browsers request the cleaned CSS.

Targeted game JS stability cleanup

• Hardened Helix Block Drop and Pong claim flows so delayed reCAPTCHA initialization cannot throw page-level errors.
• Fixed Snake and Blaster legacy jQuery startup handlers that could throw "$ is not a function" under production script loading.
• Removed Snake's generic purge global collision by moving its purge multiplier onto a snake-specific variable.
• Verified the updated production assets with syntax checks and targeted browser smoke tests for Helix Block Drop, Pong, Snake, and Blaster.

Ninja Run claim-flow hardening

• Reviewed Ninja Run production claim handling for nonce, login, wallet, reCAPTCHA, score cap, score formula, best-score delta, and hourly cap checks.
• Hardened the Ninja Run claim bridge so reCAPTCHA timing cannot throw errors while Google scripts are still initializing.
• Prepared a production smoke test pass for Ninja Run boot, canvas rendering, and page-level JavaScript errors.

Sudoku and Minesweeper readiness fix

• Fixed Sudoku startup so reCAPTCHA timing can no longer stop the board from rendering its 81 playable cells.
• Added the same defensive reCAPTCHA method checks to Minesweeper to prevent background claim-widget timing errors.
• Verified production Sudoku board render, keypad input, hint, and reset behavior.
• Verified production Minesweeper board render, reveal, reset, and desktop right-click flag behavior.

Game performance and payout safety pass

• Changed Ninja Run to load its embedded game frame eagerly so the playable area starts loading immediately instead of waiting for lazy-frame heuristics.
• Removed an unused global jquery-confirm CDN request from the child theme enqueue list to reduce extra JavaScript work on every page.
• Disabled the legacy raw-score multiplayer REST payout endpoint so pending payout rows must go through the newer nonce, login, wallet, encrypted-score, and cap-aware claim handlers.
• Repeated production timing checks after the Helix Rift spike; the page settled back near the other game pages after cache warm-up.

Updates page color refresh

• Reworked the Updates page onto a light canvas with white update cards, dark readable copy, and Cobra red accents.
• Scoped the page background so the global red site gradient no longer wraps the updates log.
• Bumped the child theme stylesheet version so production browsers request the refreshed CSS.

Hextris first-click fix and game stability pass

• Repositioned and enlarged the invisible Hextris start-button hitbox so the visible Play triangle and Play label start the game on the first click or tap.
• Fixed a Hextris script parse issue caused by adjacent bundled closures.
• Moved the Hextris purge state onto a Cobra Helix namespaced global to avoid collisions with cache or optimization tooling.
• Guarded the Radius modal binding so shared site JavaScript does not throw errors on pages without the Radius modal.
• Verified production Hextris in a browser: the visible Play button starts the game, desktop and mobile-size checks pass, and no page-level JavaScript errors were thrown.

Production performance and safety cleanup

• Added a short transient cache to the header spinner markup to reduce repeated production work during page loads.
• Moved exposed backup files out of the Cobra Helix webroot so public requests no longer serve them.
• Purged the production error log after review so new issues are easier to spot.
• Fixed the anonymous /likes/ error on production and smoke-tested the page afterward.
• Ran production timing checks across the home page and game pages to identify the heavier game-load targets for follow-up.