# CLAUDE ROUND 10 FIX PROMPT — GTAHUB THE BLOCK

You are receiving the Round 9 GTAHUB scaffold.

The product direction is approved:
- realistic weapon names/roles
- blood FX
- content warning
- selectable virtual controllers

Do NOT remove or cartoonify these features unless a specific technical reason requires it.

The objective is to make the multiplayer implementation professional-grade underneath them.

## Read first

1. `02_round10_audit/ROUND10_AUDIT.md`
2. all source under `01_round9_scaffold/`

## Priority 1 — Realtime security

Convert The Block to a private Supabase Realtime channel.

Add Realtime Authorization policies so:
- authenticated active players may subscribe
- authenticated active players may publish
- anonymous, suspended and banned users may not

Add deterministic tests.

## Priority 2 — Validate every Realtime payload

Add runtime schemas for:
- presence metadata
- movement
- chat
- hit
- hp update
- KO
- pickup

Malformed/unknown payloads must be ignored safely.

Never index `WEAPONS[payload.weapon]` before validating the enum.

## Priority 3 — Fix combat trust bug

Current `isPlausibleHit()` uses `hit.attackerX/Y`, which are supplied by the attacker.

Fix it so the target checks the attacker's position from the target's own tracked world state.

Then design the next step toward a trusted authoritative room service.

## Priority 4 — Bind actor identity

Do not trust arbitrary `userId`, `attackerId`, `username` fields as identity.

Create a room-session design where actor identity is derived from authenticated/trusted state.

## Priority 5 — Fix migration 0004

Make it safe when old Round 8 KO rows exist.

The SQL and comments must agree.

## Priority 6 — Professional combat architecture

Implement as much as is practical in this pass, and provide a concrete migration path for the remainder.

Target model:

client input intent
-> trusted room authority
-> validation
-> accepted state broadcast
-> trusted KO persistence

The trusted authority should eventually own:
- position
- health
- inventory
- pickups
- cooldown
- friendly-fire rule
- KOs
- respawns

Do not attach competitive value to self-reported KO rows.

## Priority 7 — UX cleanup

Add:
- Full / Reduced / Off blood preference
- visible error handling for controller preference save
- implement or visibly disable Interact/Emote
- report/mute hooks for The Block

## Required deliverables

Return a new ZIP containing:
- modified project
- `ROUND10_CHANGELOG.md`
- `ROUND10_TEST_RESULTS.md`
- `WORLD_AUTHORITY_DESIGN.md`

For every fixed item include:
- finding id
- files changed
- exact behavior changed
- test proving it

Do not claim "professional-scale" solely because the channel is private. Private Realtime authenticates access; it does not by itself make client-reported combat authoritative.
