Split BONanza Gist update metadata and clarify rehearsal output

[maghuro]

Summary

• publish a separate DarkPeers_BONanza_Giveaway.meta.js beside the full userscript in the public Gist
• point @updateURL to the minimal metadata file while keeping @downloadURL on the full .user.js
• generate the update manifest automatically from the canonical userscript header so the version is never duplicated manually
• verify both Gist files after publication
• move both @homepageURL and @namespace away from the development repository to Maghuro's DarkPeers profile
• intentionally treat v1.5.10 as a fresh userscript identity rather than preserving the pre-1.5.10 namespace
• make rehearsal statements and settlement output explicitly say simulated/no BON sent instead of presenting dry-run success as a live transfer
• bump BONanza to v1.5.10 and add regression coverage

Generated update manifest

The workflow deliberately publishes only:

• @name
• @namespace
• @version
• @updateURL
• @downloadURL

The generated manifest contains no reference to the development repository.

Identity change

The @namespace change is intentional. The maintainer explicitly accepts treating this as a new userscript install/identity rather than requiring an in-place identity migration from pre-1.5.10 copies.

Rehearsal semantics

Rehearsal still returns internal success for suppressed money-moving operations so the full settlement state machine can be exercised. User-visible output now distinguishes that from a real confirmation:

• statement mode is explicitly REHEARSAL / SIMULATION
• simulated gifts are labelled simulated (no BON sent)
• simulated BON Pool legs are labelled simulated only
• pool confirmation PMs say no BON was sent
• zero-entry full-pot rehearsal settlement follows the same semantics

Validation performed

• reconstructed the bundle from all 15 source parts and verified it matches the committed .user.js exactly
• parsed the resulting userscript successfully after each final change
• generated the intended minimal .meta.js from the current metadata and verified the update/download targets
• verified the public userscript metadata contains no development-repository reference
• inspected both publication and validation workflows after the changes

GitHub Actions remains the authoritative full test run for the PR.

[maghuro]

@codex review

Please review this specifically as a userscript distribution/update change, not only as a generic workflow diff.

Could you check:

1. whether Tampermonkey/Violentmonkey-style update semantics are correct with @updateURL pointing to a minimal .meta.js and @downloadURL pointing to the full .user.js;
2. whether the five-field generated metadata manifest is sufficient and safe, or whether any additional metadata field is materially required for update compatibility;
3. whether changing @namespace and @homepageURL to https://darkpeers.org/users/maghuro creates any update/identity migration problem for already-installed copies;
4. whether the Gist PATCH + post-publish verification can fail incorrectly or leave the two files out of sync;
5. whether any public-facing reference to the development GitHub repository still leaks through the userscript metadata/distribution path;
6. whether the workflow/test changes have any YAML, regex, quoting, or edge-case issue.

Please call out concrete fixes only if they are useful; this PR is intentionally narrow.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69b7bd88c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

The previous P1 about changing @namespace was correct and is now addressed: the legacy namespace is restored and documented as a permanent stable userscript identity, while only @homepageURL points to the DarkPeers profile.

The PR also now includes a rehearsal-output fix discovered from today's live-site rehearsal: dry-run BON Pool/gift success remains internally successful so the settlement state machine can be exercised, but statements and private settlement output must never describe simulated transfers as live "confirmed/paid" operations.

Please review the current head 279656946b95, especially:

1. update compatibility with the preserved legacy namespace;
2. whether the generated five-field .meta.js is sufficient for Tampermonkey/Violentmonkey update checks;
3. whether the Gist workflow can publish/verify the .meta.js and .user.js safely;
4. whether every changed rehearsal statement/pool path now distinguishes simulated success from a real DarkPeers confirmation without weakening live settlement logic;
5. zero-entry rehearsal pool handling and statement wording;
6. regression-test correctness and any YAML/regex/quoting issue.

Please flag concrete correctness or safety issues only.

[maghuro]

@codex review

Please review the current head 29c4a66c0e77.

Important scope clarification: the maintainer explicitly accepts the @namespace change as a fresh userscript identity/new install. The pre-1.5.10 identity does not need to be preserved. Therefore, please do not treat the namespace change itself as a defect unless there is a consequence beyond the expected new-install behavior.

Please focus on:

1. whether the five-field .meta.js is sufficient for Tampermonkey/Violentmonkey-style update checks for the new identity;
2. whether @updateURL -> .meta.js and @downloadURL -> .user.js are correctly paired;
3. whether the Gist workflow atomically enough publishes and verifies both files, with no quoting/YAML/API edge case;
4. whether the public metadata now contains no development-repository reference;
5. whether rehearsal statements and private settlement output consistently distinguish simulated gifts/BON Pool contributions from live confirmed transfers;
6. whether the normal live settlement path is unchanged semantically;
7. zero-entry rehearsal handling and the new regression tests.

Concrete correctness/safety findings only, please.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 29c4a66c0e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[maghuro]

@codex review

Current head: 7c1ff21dcb5f.

I addressed both findings from your review of 29c4a66c0e:

• P1: final statement finalization now derives one finalPoolStatus that preserves poolResult.dryRun, so rehearsal cannot be rewritten to "confirmed directly in BON Pool"; the no-winner-gift verification path also preserves rehearsal semantics.
• P2: statements without an explicit rehearsalMode are inferred from their storage context. Legacy v1.5.9 rehearsal statements are additionally sanitized on read so old "confirmed directly in BON Pool" / "all gifts confirmed in DarkPeers" / "nothing to verify" text cannot be presented as live evidence.

Please re-review these fixes and, in the same pass, cover the still-relevant points from the earlier review requests:

1. whether the five-field .meta.js is sufficient for Tampermonkey/Violentmonkey-style update checks for this intentionally new userscript identity;
2. whether @updateURL -> .meta.js and @downloadURL -> .user.js are correctly paired;
3. whether the Gist PATCH/publish verification has any correctness, ordering, quoting, YAML, or partial-update issue worth fixing;
4. whether public userscript metadata is now free of development-repository references;
5. whether rehearsal statements/messages are consistently simulated while the live settlement path remains semantically unchanged;
6. whether the legacy rehearsal normalization could ever misclassify a live statement or otherwise mutate evidence incorrectly;
7. whether the new regression tests adequately cover both findings.

As before, the @namespace change is intentional and is accepted as a fresh install/identity. Concrete correctness/safety findings only, please.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 7c1ff21dcb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".