[maghuro]

Why

DarkPeers permits giveaways of 1–45 whole minutes. Previously the form and !addtime / !time add could extend giveaways beyond that limit. A reliable hard cap must also survive delayed opening messages, reloads, concurrent tabs, and partial settlement without risking real BON.

User-visible behavior

• Enforce 1–45 whole minutes in the form, direct start path, and saved presets (including DOM tampering).
• Enforce an absolute deadline of public opening + 45 minutes. Anchor the hard deadline conservatively before awaiting the opening POST; no delayed HTTP response may extend it. Invalid/missing opening anchors fail closed.
• !addtime and !time add reject over-limit extensions instead of silently changing the deadline. In ordinary mode, authorized chat-command feedback uses the public reply path.
• In Silent Mode, all routine command replies (including host/staff confirmations and errors) are private. Explicit !reminder and scheduled reminders still broadcast to Main Chat.
• In Rehearsal Mode, script-generated output routes privately to the host and BON transfers, gifts, refunds and pool contributions are simulated.

Recovery and real-BON safety

• Persist a recoverable pending-opening checkpoint BEFORE POST, recording the exact prepared message, authenticated chat cursor, pre-send time and bounded publication window. Reconcile against authoritative Main Chat by exact author/ID/text and entire server timestamp-resolution bucket; an ambiguous API response must not trigger a duplicate opening.
• Keep the hard deadline independent of the verified sponsor eligibility window. Fail closed on uncertain Gift History clock offsets, timestamp buckets, boundary gifts and final canonical accounting rather than inflating live payouts.
• Re-read and validate the latest full snapshot under exclusive Web Lock, including after waiting for another tab. Preserve settlement and paid-gift ledger state; never restore stale pre-lock flags or overwrite a newer checkpoint. Guard BFCache/pagehide and pre-opening preflight.
• Inspect both namespaced and legacy recovery slots. Unreadable, malformed, empty, hostless/non-string or conflicting same-host records block automatic restore/new starts and are preserved for manual review. Byte-identical same-host copies or positively identified foreign-host records are handled safely. Under the exclusive restore lock, verify and retire an identical legacy duplicate before confirming a pending opening checkpoint; verify unchanged bytes and successful removal to prevent crash/reload recovery conflicts. Migrate single legacy slots only under the lock; verify namespaced write and unchanged old bytes, and confirm old-key deletion via read-back before proceeding, so silent storage failures cannot strand diverging checkpoints.
• Pre-checkpoint legacy snapshots lacking provable publication or conservative timing remain manual-review only, without automatic entry reopening or BON settlement. Preserve committed or latched settlements instead of re-drawing or discarding payout evidence.

Source, documentation and validation

• Update the 15 ordered userscripts/giveaway/src/*.js fragments and regenerate the committed Tampermonkey DarkPeers_BONanza_Giveaway.user.js from scripts/build-bonanza.mjs. Do not edit the generated script directly.
• Update AGENTS.md, component README and the BONanza runbook. Bump the userscript to 1.5.15.
• Latest Validate BONanza CI at f8831d4: 133 tests passed, 0 failures, source/bundle consistency and syntax checks passed.

Deployment: This is a PR only. The publish-to-Gist workflow runs after eligible pushes to main, not from this PR. Do not merge, release or publish until the final independent Codex review is assessed.

This userscript enforces the 45-minute rule for its own users; only DarkPeers server-side enforcement can prevent violations by other or modified clients.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T05:14:59.863920Z	f8831d4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54d3e12e25

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d8f4e07ff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please perform a fresh, full review of the entire PR at its latest HEAD, not only the latest diff or previously reported lines. Review the source fragments, regenerated Tampermonkey userscript, tests, AGENTS.md and README/workflow integration. In particular, scrutinize:

• The absolute 45-minute limit across initial configuration, saved presets, host/staff time commands and legacy snapshot restore.
• Reminder scheduling across recovered snapshots, past/due reminders and subsequent time adjustments.
• Stale-snapshot expiration, committed or latched settlement, crash/reload and any possibility of unintended BON transfers or duplicate payouts.
• Generated file consistency, publishing behavior and regressions.

Both prior findings have been fixed and their threads resolved. CI passed with 58 tests, 0 failures, including bundle freshness and syntax checks. Please report any remaining actionable issues, even outside the modified reminder lines.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 609d7d5609

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please perform another independent, adversarial review of the ENTIRE PR at HEAD c998a343d276b996ec44b514af92c8350eb8a3f8, including all 15 source fragments, persisted state, time boundaries, commands, settlement, tests, workflow and generated .user.js. Do NOT restrict the review to the latest diff or previously resolved threads, and do NOT merge/publish.

Three latest findings addressed with tests and documentation:

1. P1 stale restore races: after acquiring exclusive ownership, restore must reread the FULL, latest host-scoped persisted snapshot (with legacy migration only under the Web Lock), revalidate identity/mode, deadline, opening proof and expiry, then replace its pre-lock snap BEFORE any entry/sponsor/payout/settlement data are used. Concurrent tab may have committed new winners or paid BON while this tab waited. Challenge all races including BFCache, lock loss mid-await, legacy migration and fresh versus stale ledgers.
2. P1 empty legacy recovery values: only getItem() === null means absent. Empty string is corrupt but occupied and must block any new live opening without data loss. Check namespaced and old keys, read exceptions, malformed content, cross-account safety, migration failures.
3. P2 pre-lock writes: loadGiveawaySnapshot() is now read-only; legacy migration is deferred until the post-lock restore read. Expired snapshot loading also does NOT delete data outside ownership; __expiredBeyondGrace blocks auto-restoration and preserves manual recovery.

Prior invariants to challenge again: strict 45-minute public opening cap and bounded send window; durable pre-POST checkpoint and authoritative exact announcement verification; Gift History calibrated fractional uncertainty and uncalibrated fail-closed pot accounting; gift/payout idempotency and final reconciliation; Silent Mode command PM feedback, but explicit !reminder must be PUBLIC even in Silent Mode; Rehearsal Mode remains private/simulated and moves no real BON. Check for accidental deletion/overwrite of valuable persisted state, race conditions before/after network awaits, duplicate publication and duplicate real BON transfers.

Current Validate BONanza CI passed 124 tests, 0 failures, generated userscript and syntax verified. Please flag any remaining actionable correctness/safety findings anywhere in the whole PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c998a343d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please perform a NEW, INDEPENDENT, ADVERSARIAL FULL-PR review at HEAD fcb68b8735151d71bc25497e36ea3560abeca339, reviewing the entire 15-fragment BONanza runtime, generated userscript, persistence, test suite, AGENTS.md, README, and Gist-publishing workflow. Do not limit this review to the latest diff or previously resolved threads.

The most recent two findings were addressed:

1. P1: readActiveGiveawayRawForHost() now treats valid but hostless legacy JSON ({}, {"giveawayData":{}}, null, blank/missing host) as occupied and unreadable, without migrating/overwriting it; ONLY a positively identified different host is ignored. Both start preflight and post-lock reads must fail closed. New executable tests check raw preservation, no migration and foreign-host isolation.
2. P2: restoreGiveawayFromSnapshot() no longer validates a potentially stale pre-lock __expiredBeyondGrace, __legacyOpeningUnverified, opening proof or saved host. It validates the authenticated Main Chat context, acquires the Web Lock, then reads/migrates and validates the latest persisted recovery record BEFORE hydration, authoritative opening verification or any BON operation. A newer committed/latched settlement must not be stranded by old pre-lock data.

Please stress-test all interleavings: multi-tab races, Web Lock failures, BFCache/pagehide, localStorage unavailable/corrupt/malformed/hostless/foreign records, stale restore snapshots, ambiguous publication checkpoints, duplicate opening and payout/refund ledgers; verified sponsor boundaries with calibrated Gift History precision/clock uncertainty; 45-minute absolute deadline; chat !addtime / !time add, Silent Mode PM replies versus public explicit !reminder, and Rehearsal Mode's strict no-real-BON guarantee. Challenge test coverage as well as code.

Please report any remaining actionable P1/P2 safety or correctness issues, including outside the latest changes, and explain an exact reproduction scenario. DO NOT MERGE, RELEASE OR PUBLISH.

[maghuro]

@codex review

Final follow-up: please do another FULL, ADVERSARIAL review of this entire PR at HEAD 34ce04dc73bb5493877bfb32cb5c8bbe1ec6de27 (not only changed lines). The last two feedback threads (P1 unidentified/hostless legacy recovery and P2 stale pre-lock restore rejection) are fixed, replied to and resolved. Our first CI run surfaced three outdated source-assertion tests and a dangling diagnostic variable; all three were corrected at latest HEAD, and Validate BONanza passed all 126 tests, 0 failures, including syntax and generated-bundle consistency.

Please independently challenge recovery under Web Lock, host-scoped storage, old/corrupt/empty/missing-host JSON, concurrent tabs, BFCache, page lifecycle and asynchronous ownership handoffs. Review exact opening proof and absolute 45-minute cap, sponsor Gift History boundary calibration, uncertain gifts and final settlement idempotency, all BON gift/payout/refund routes, Silent Mode PM routing, public !reminder exception, and private/simulated Rehearsal behavior. Include every source fragment, tests, bundle, documentation and workflows; do not trust the test suite without tracing actual code behavior.

Report actionable safety/correctness findings with reproducible conditions. DO NOT MERGE, RELEASE OR PUBLISH.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34ce04dc73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please perform a FRESH, FULL, INDEPENDENT, ADVERSARIAL SECURITY AND CORRECTNESS REVIEW at the LATEST HEAD 42861041f27c50c88856850eb6c7316edff1be3a, across the entire BONanza runtime (all 15 source fragments), regenerated userscript, tests, docs, and CI/Gist publishing workflow. Do not restrict analysis to the newest diff or previously reported lines.

The P1 from the previous review on 34ce04dc has now been addressed: the recovery reader checks both namespaced and legacy storage slots before accepting a LIVE snapshot, including corrupt/empty/hostless/non-string legacy records despite an existing namespace. Same-host records must be byte-identical, otherwise pause automatic recovery without changing or deleting either snapshot; a positively identified foreign legacy host is safe to ignore. Single-slot legacy migration runs only under the lock, verifies read-back before deleting old storage. Related tests and documentation updated. The latest Validate BONanza CI is GREEN: 129 tests, zero failures; 15-part generated bundle and syntax verified.

Please independently search for remaining safety issues including interleaving of concurrent tabs, BFCache/pagehide, storage failures, ancient snapshots, settlement ledger/idempotency and pending transfers, ambiguous opening publication, conservative 45-minute cap, sponsor Gift History clock-calibration and bucket uncertainty, missing recovery proof, duplicate BON transfers or gifts, Silent Mode private command replies but PUBLIC !reminder, and fully simulated/private Rehearsal Mode. Challenge the assumptions of the tests and seek new P1/P2 findings, including outside modified fragments, with concrete reproduction steps.

DO NOT MERGE, RELEASE OR PUBLISH.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42861041f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please perform a FRESH, FULL, INDEPENDENT, ADVERSARIAL review of the ENTIRE BONanza PR at the latest HEAD 0ed1335b06b52f7a043694cb69544bde0e979e3d, not only this latest diff or previously resolved threads. All 15 source fragments, ordered generated Tampermonkey bundle, complete settlement/gift/entry logic, all test suites, documentation, GitHub Actions and Gist publishing behavior are in scope.

The last P2 at 42861041 identified a recoverability trap: byte-identical same-host legacy and namespaced snapshots could diverge if a pending opening was confirmed in the namespaced record before the duplicate legacy slot was removed. Fixed in 0ed1335: under the exclusive Web Lock, on migrateLegacy:true, verify BOTH copies still equal their initial validated bytes, remove the duplicate legacy key, and read back its absence before any pending-to-confirmed checkpoint write. Pre-lock loading remains read-only; conflicting/unidentified legacy state remains blocked; failed cleanup fails closed. Regression tests now simulate immediate crash after confirmation, pre-lock discovery, failed readback/removal and no-op deletion.

The latest Validate BONanza CI is GREEN: 131 tests, zero failures, 15-fragment regenerated bundle and syntax verified. Please look critically for P1/P2 issues anywhere, especially subtle cross-tab races and storage conflicts, loss of confirmed/committed settlement state, duplicate real BON payouts, ambiguous opening proof, conservative absolute 45-minute cap, Gift History timestamp uncertainty and uncalibrated fail-closed behavior, Silent Mode private replies versus PUBLIC explicit !reminder, and fully private/simulated Rehearsal Mode. Include exact reproduction steps and code references for any actionable issue.

DO NOT MERGE, RELEASE OR PUBLISH.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ed1335b06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please perform a fresh, rigorous but PRACTICALLY GROUNDED review of the complete PR at the NEW HEAD f8831d44efef76f4160571062f21b15432891cdb (all 15 source fragments, generated userscript, runtime behavior, tests, docs, and publishing workflow).

Review standard: prioritize real, reachable, consequential defects, NOT nitpicks or finding P2s merely for the sake of another review cycle. For each alleged P1/P2, give:

1. A plausible sequence of actions/events that can genuinely happen in DarkPeers/Tampermonkey on supported browsers (include concrete prerequisites).
2. The exact execution path and why existing Web Lock, storage checks, state guards, retries and safety invariants fail.
3. Actual user-visible impact: over-45-minute giveaway, lost/unrecoverable legitimate giveaway, privacy breach, wrong entries, duplicate/missing real BON movement or incorrect settlement.
4. A feasible reproduction/test using real browser/API contracts, not arbitrary monkey-patching of standard browser methods into impossible behavior unless that failure mode is independently justified by real browser behavior or a relevant extension/storage constraint.
5. A minimal, proportional fix if warranted.

The latest review flagged an omitted legacy deletion read-back in single-slot migration. We fixed it in f8831d4: locked migration now verifies the namespaced write, rechecks that the legacy bytes are unchanged, removes the legacy key, and confirms actual absence before allowing any pending-opening confirmation. Regression tests cover normal migration and immediate crash/reload, plus denied/no-op removal and safe retry. CI green: 133/133 tests, all 15 generated fragments verified. All prior actionable threads are answered/resolved.

Please examine the full behavior critically, including legitimate everyday workflows (normal starts, extending, reminders, sponsors, winners, reloading and multi-tab), and the serious failure modes of crash, network timeouts, delayed chat messages and settlement. Do not manufacture a finding from a contrived scenario with no credible production trigger. If there is no realistic actionable issue, explicitly say so or approve; don't insist on another P2.

Reminder of required behavior: 45-minute hard maximum, Silent Mode private routine replies but public explicit !reminder, Rehearsal Mode private and never transferring real BON, accurate publication/sponsor timing, preserved payout ledgers and idempotent settlement.

Do not merge, release, deploy or publish.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: f8831d44ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".