Route BONanza rehearsal output privately to the host

[maghuro]

Summary

• release BONanza v1.5.9
• keep Rehearsal / Debug fully non-monetary, but route userscript output privately to the host instead of suppressing it
• preserve intended-recipient context when a rehearsal output would normally have been a private reply
• keep public chat clean during rehearsal
• add regression coverage for the recursion-safe private-output path
• rename docs/runbooks/bonanza-incident.md to docs/runbooks/bonanza-operations.md and update it as the operational host guide
• rebuild the deterministic single-file userscript

Safety invariants

• winner gifts remain simulated in rehearsal
• sponsor refunds remain simulated in rehearsal
• BON Pool contributions remain simulated in rehearsal
• only the explicit internal rehearsal PM path may bypass chat suppression, and it emits a /msg <host> ... command
• modular sources and the committed single-file bundle are byte-for-byte consistent

Scope

No changes to settlement math, sponsor accounting, staff permissions or payout-shape controls.

[maghuro]

@codex review

Please review this as a safety-sensitive follow-up to the BONanza hardening work. Focus especially on:

• Rehearsal / Debug must still move zero BON
• rehearsal output must never hit public chat and must go only to the authenticated/current host via /msg
• the rehearsalPrivateOutput bypass must not create a recursion loop or a generic path that can leak public output
• existing Silent Mode/private reply behavior must remain unchanged outside rehearsal
• modular source and generated userscript consistency
• the renamed operations runbook accurately describes the behavior

[maghuro]

@codex review

The previous CI failure was an outdated invariant test that looked for the old exact if (REHEARSAL_MODE) suppression branch. The implementation itself passed syntax/bundle checks and the new host-PM test. I updated that invariant to assert the new rehearsal-routing guard precedes the API send path.

Please review current head, especially whether the explicit rehearsalPrivateOutput bypass is sufficiently narrow and cannot leak a rehearsal message into public chat.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 96d45a9aa4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Please review the current head after addressing your ownership-propagation finding. In particular, confirm that requireExclusiveGiveawayOwnership is preserved through the rehearsal private /msg reroute, that the rehearsalPrivateOutput bypass remains narrowly scoped, and that no rehearsal path can move BON or leak userscript output to public chat. CI is green and the modular sources match the generated userscript.

[maghuro]

@codex review

Please re-review the current head after the ownership-propagation fix. In particular, verify that Rehearsal / Debug private host output cannot bypass requireExclusiveGiveawayOwnership, and check for any remaining regressions before merge.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 1b45ad54fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".