Release ledger

What's new in SimDeck

A version-by-version record of the improvements, mirrored from the SimDeck release ledger in Linear.

Version 0.54

July 16, 2026

Send approvals recheck every prerequisite inside the transaction

Teacher approval now repeats sender, recipient, same-game, and card-policy checks inside the atomic decision, so participant or policy drift cannot move the card or close the request.

Why it matters

- David cannot approve a send after its requesting student or classmate recipient became ineligible, even if the approval page still shows the older state.
- A student moved to another class or a changed card-template destination rule stops approval before either the card or pending request is mutated.
- A valid approval still moves the exact card version and closes the exact unresolved request together in one Appwrite transaction.

Verification

- All 477 unit tests pass across 48 files, including sender, recipient, relationship, and policy drift after preflight plus successful transactional approval.
- Critical-source coverage passes at 85.73% statements, 72.97% branches, 96.17% functions, and 94.68% lines; actions remain at 95.46% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The complete live pending-send decision verifier and full production integrity audit pass without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.54 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Repeated current requesting-student, optional classmate-recipient, and card-template reads through the same transaction used for the approval writes.
Required exact same-game relationships and current student eligibility before the first mutation in that transaction.
Reapplied the template's destination policy to the current recipient and added the original card-template id to the card compare-and-set guard.
Expanded the production pending-send verifier to classify every current decision from live student, card, request, and template records without writing classroom data.

Version 0.53

July 16, 2026

Every Activity link is checked before history is written

SimDeck now enforces one same-game relationship rule at the central Activity writer, so no action can attach an orphan or cross-class card or student to classroom history.

Why it matters

- David's Activity history cannot gain a false card or student link because one caller forgot to repeat a relationship check.
- Atomic card actions validate new or updated rows through the same Appwrite transaction before the history row is inserted.
- Intentionally unlinked safety history remains valid, including blocked attempts whose optional card could not be trusted.

Verification

- All 472 unit tests pass across 48 files, including valid, intentionally unlinked, orphan, cross-game, transactional, rollback, and copied-reference cases.
- Critical-source coverage passes at 85.71% statements, 72.85% branches, 96.17% functions, and 94.70% lines; the new relationship guard is included in the protected set and actions remain at 95.50% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The complete live Activity relationship verifier and full production integrity audit pass without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.53 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Added one central relationship guard to the Activity insertion path for every optional card and student reference.
Scopes relationship reads by id and game and also checks the returned game defensively before allowing the insert.
Uses the caller's active Appwrite client so staged card creation or updates are visible and any validation failure rolls back the whole classroom action.
Added complete read-only production proof across every live Activity row, not only selected action types.

Version 0.52

July 16, 2026

Blocked attempts cannot forge card history

When student use or sending is disabled, SimDeck now attaches a card to the blocked-attempt Activity row only after proving it is that student's active card in the same game.

Why it matters

- A crafted blocked action cannot create an orphan or cross-class card link in David's Activity history.
- Normal blocked attempts still retain useful card context when the submitted card is genuinely the student's active card.
- Missing, moved, inactive, cross-game, or lookup-failed cards still produce the established safety feedback without making a false relationship claim.

Verification

- All 465 unit tests pass across 46 files, including valid, forged or missing, and lookup-failed card references for both blocked student use and blocked student send.
- Critical-source coverage passes at 85.69% statements, 72.68% branches, 96.16% functions, and 94.69% lines; actions reach 95.50% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The live read-only blocked-Activity verifier and full production integrity audit pass without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.52 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Added one optional card lookup scoped by card, game, current student, student ownership, and active status before blocked-attempt logging.
Stores a null card relationship when verification does not succeed and never copies the raw submitted card ID into metadata.
Marks new blocked rows with whether their optional card relationship was verified while remaining compatible with existing history.
Added a focused read-only production invariant for blocked use/send Activity relationships and marker consistency.

Version 0.51

July 16, 2026

Pending sends reserve the card before they queue

Approval-required student sends now reserve the exact card version and create the pending request together, so stale or simultaneous submissions cannot leave an invalid or duplicate decision for David.

Why it matters

- Two nearly simultaneous send submissions for the same card cannot both become pending decisions.
- A card change that wins the race leaves no stale approval request behind.
- A failed reservation, duplicate recheck, Activity write, or transaction commit leaves no partial classroom state.

Verification

- All 459 unit tests pass across 46 files, including exact reservation filters, reserved-version metadata, losing-reservation no-write behavior, an in-transaction duplicate race, and commit-conflict rollback.
- Critical-source coverage passes at 85.56% statements, 72.50% branches, 96.15% functions, and 94.52% lines; actions reach 95.17% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The production complete transfer-request and card reads confirm every unresolved request is unique, versioned, and tied to its current live active student-owned card snapshot without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.51 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Conditionally updates only the exact active student-owned card version, preserving its owner and status while making the card the Appwrite transaction conflict key.
Snapshots the reserved card version in the request and stages that request inside the same transaction.
Repeats the complete indexed pending-request scan inside the transaction while retaining the fast precheck and its existing student-facing duplicate guidance.
Scopes both the initial card read and reservation by card, game, current student, student ownership, active status, and rendered version.

Send approvals recheck every prerequisite inside the transaction

Teacher approval now repeats sender, recipient, same-game, and card-policy checks inside the atomic decision, so participant or policy drift cannot move the card or close the request.

Why it matters

- David cannot approve a send after its requesting student or classmate recipient became ineligible, even if the approval page still shows the older state.
- A student moved to another class or a changed card-template destination rule stops approval before either the card or pending request is mutated.
- A valid approval still moves the exact card version and closes the exact unresolved request together in one Appwrite transaction.

Verification

- All 477 unit tests pass across 48 files, including sender, recipient, relationship, and policy drift after preflight plus successful transactional approval.
- Critical-source coverage passes at 85.73% statements, 72.97% branches, 96.17% functions, and 94.68% lines; actions remain at 95.46% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The complete live pending-send decision verifier and full production integrity audit pass without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.54 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Repeated current requesting-student, optional classmate-recipient, and card-template reads through the same transaction used for the approval writes.

Required exact same-game relationships and current student eligibility before the first mutation in that transaction.

Reapplied the template's destination policy to the current recipient and added the original card-template id to the card compare-and-set guard.

Expanded the production pending-send verifier to classify every current decision from live student, card, request, and template records without writing classroom data.

Every Activity link is checked before history is written

SimDeck now enforces one same-game relationship rule at the central Activity writer, so no action can attach an orphan or cross-class card or student to classroom history.

Why it matters

- David's Activity history cannot gain a false card or student link because one caller forgot to repeat a relationship check.
- Atomic card actions validate new or updated rows through the same Appwrite transaction before the history row is inserted.
- Intentionally unlinked safety history remains valid, including blocked attempts whose optional card could not be trusted.

Verification

- All 472 unit tests pass across 48 files, including valid, intentionally unlinked, orphan, cross-game, transactional, rollback, and copied-reference cases.
- Critical-source coverage passes at 85.71% statements, 72.85% branches, 96.17% functions, and 94.70% lines; the new relationship guard is included in the protected set and actions remain at 95.50% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The complete live Activity relationship verifier and full production integrity audit pass without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.53 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Added one central relationship guard to the Activity insertion path for every optional card and student reference.

Scopes relationship reads by id and game and also checks the returned game defensively before allowing the insert.

Uses the caller's active Appwrite client so staged card creation or updates are visible and any validation failure rolls back the whole classroom action.

Added complete read-only production proof across every live Activity row, not only selected action types.

Blocked attempts cannot forge card history

When student use or sending is disabled, SimDeck now attaches a card to the blocked-attempt Activity row only after proving it is that student's active card in the same game.

Why it matters

- A crafted blocked action cannot create an orphan or cross-class card link in David's Activity history.
- Normal blocked attempts still retain useful card context when the submitted card is genuinely the student's active card.
- Missing, moved, inactive, cross-game, or lookup-failed cards still produce the established safety feedback without making a false relationship claim.

Verification

- All 465 unit tests pass across 46 files, including valid, forged or missing, and lookup-failed card references for both blocked student use and blocked student send.
- Critical-source coverage passes at 85.69% statements, 72.68% branches, 96.16% functions, and 94.69% lines; actions reach 95.50% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The live read-only blocked-Activity verifier and full production integrity audit pass without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.52 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Added one optional card lookup scoped by card, game, current student, student ownership, and active status before blocked-attempt logging.

Stores a null card relationship when verification does not succeed and never copies the raw submitted card ID into metadata.

Marks new blocked rows with whether their optional card relationship was verified while remaining compatible with existing history.

Added a focused read-only production invariant for blocked use/send Activity relationships and marker consistency.

Pending sends reserve the card before they queue

Why it matters

- Two nearly simultaneous send submissions for the same card cannot both become pending decisions.
- A card change that wins the race leaves no stale approval request behind.
- A failed reservation, duplicate recheck, Activity write, or transaction commit leaves no partial classroom state.

Verification

- All 459 unit tests pass across 46 files, including exact reservation filters, reserved-version metadata, losing-reservation no-write behavior, an in-transaction duplicate race, and commit-conflict rollback.
- Critical-source coverage passes at 85.56% statements, 72.50% branches, 96.15% functions, and 94.52% lines; actions reach 95.17% line coverage.
- All 465 public smoke and accessibility cases pass across Chromium, Firefox, WebKit, Mobile Chrome, and Mobile Safari; the five credential-gated teacher cases skip as designed.
- The production complete transfer-request and card reads confirm every unresolved request is unique, versioned, and tied to its current live active student-owned card snapshot without classroom or Auth writes.
- Typecheck, full lint, zero-warning static security lint, production build, backendless demo, 10 skeleton states, theme contrast, npm audit with zero vulnerabilities, and git diff validation pass.
- The Version 0.51 draft was recorded on PI-213 before this public page entry; the canonical ledger follows exact staging proof.

Source: Linear release ledger document, PI-213

Conditionally updates only the exact active student-owned card version, preserving its owner and status while making the card the Appwrite transaction conflict key.

Snapshots the reserved card version in the request and stages that request inside the same transaction.

Repeats the complete indexed pending-request scan inside the transaction while retaining the fast precheck and its existing student-facing duplicate guidance.

Scopes both the initial card read and reservation by card, game, current student, student ownership, active status, and rendered version.