[BrandDead]

Outcome

Existing Flask combat and drive-by sessions are bound to their server-verified creator. Existing-session reads and mutations check that creator before session-derived work, while ordinary creator and offline development flows remain usable.

Scope

In: backend/python/api/combat.py, backend/python/api/driveby.py, a new backend/python/tests/test_encounter_session_ownership.py, a dated project-log entry and text verification under docs/evidence/2026-10-14-session-ownership/.

Reserved files: the three backend/test files above; project log is append-only. No frontend/renderer/store or other contributor's branch is changed.

Contracts preserved

• The creator is derived from authenticated server identity, never a submitted owner field.
• Existing-session checks happen before snapshot work, status/action processing or deletion.
• Missing, foreign and ownerless sessions share the existing not-found response and do not mutate state.
• Existing combat calculation, ordinary creator behavior and offline dev behavior remain unchanged.

Verification

• Regression-first request suite on unchanged 9eef5aa: 12 failed / 12 passed; corrected source: 24 passed.
• Full local backend: 131 passed, zero warnings; source inspected independently and full backend gate repeated by integration owner.
• The complete local candidate with fix: connect ATTACK planning to confirmed block responses #204/fix: render Nightfall role art and align tactical taps #205 and the separate auth repair passed 1,069 frontend tests / 4 existing skips, 131 backend tests and type/lint/build/assets/packages. This PR changes no browser behavior; request-level creator/denial/continuation is the direct integration proof.
• Exact published tree matches the verified local publication tree 28b2f64b89e854e5f7ccaf9009f5e5e057cf661b. Published exact-head CI passed on 8353d53: 1,033 unchanged-frontend tests passed / 4 existing skips; 131 backend tests passed; type/lint/assets/packages/build passed. Vercel preview status is Ready.

Limits

These legacy HTTP sessions remain in memory and are separate from the active solo renderer. This does not add live PvP, durable match state, roster authorization or full command validation. #175 live authenticated staging and wider gameplay/release gates remain open. No external-beta or multiplayer-readiness claim is made.

Operational impact

No migration, RLS, credentials, scheduler, production or deployment change. Source rollback is a focused PR revert; no database rollback is needed.

Integration notes

Independent of #206 auth, #204 ATTACK, #205 Nightfall, #202 DRIVE and #169 identity. Preserve all dated project-log additions during integration. Closes nothing. No merge or deployment is requested.

Review availability

Independent local review is complete. GitHub Codex code review is completed; security review is completed. No inline review threads were present at this check. Cursor Bugbot could not run because its usage/spend limit was reached; no budget setting was changed. This is not a merge or release approval.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
slide	Ready	Preview	Oct 15, 2026 2:22am UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T02:23:19.356187Z	8353d53	PR opened
🔒 Security Review	✅ Completed 2026-10-15T02:24:00.653816Z	8353d53	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 3e26873e-e069-494f-a928-b2dfd68b7e59)