v0.0.25: atomic turn lifecycle, input hardening & deterministic plugin state

[ackness]

Summary

v0.0.25 hardens Covel's complete default game flow, from choosing a world and running setup plugins through narrative execution, post-turn extraction, persistence, and client recovery.

Atomic turn lifecycle

• Buffer runtime messages and domain proposals in a transaction-scoped execution journal, committing them together with the turn result.
• Roll back the whole finalize transaction when interaction persistence fails, and emit an explicit failed SSE terminal event so the Web client clears optimistic streamed text.
• Synchronize the full local-session contract before activation, including plugins, locale, model overrides, and lore overrides.

Input and concurrency hardening

• Parse /api/actions as discriminated payloads with bounded identifiers, locale, model, and action-specific fields.
• Validate form submissions against the committed interaction schema, reject malformed fields and options, and make repeat submissions idempotent.
• Serialize plugin RPC actions through the session lock to preserve per-session write ordering.

Deterministic plugin state

• Pass world-init schemas to character setup through same-execution outputs instead of uncommitted store reads.
• Refresh authoritative context after commit before memory updates, including localized character labels and current-turn form values.
• Give core-quest durable ids and semantic merge behavior so repeated extraction does not duplicate or reset quests.
• Make world-init guards inspect the execution write buffer and keep all writes on the proposal/commit path.

Observability and release metadata

• Harden server log tee and desktop logging behavior, with focused regression coverage and a desktop logging self-check.
• Add the framework audit remediation plans and synchronize the architecture and reference documentation with the implemented contracts.
• Bump all 47 published workspace packages to 0.0.25, add the v0.0.25 changelog, and update the English and Chinese README release pointers.

Why

The audit found several paths where setup data was only visible after commit, turn writes could survive a failed finalization, malformed boundary input could surface as server errors, and post-turn plugins could observe stale or unstable state. These fixes make the default flow atomic, explicit, deterministic, and recoverable across the framework and bundled plugins.

Validation

• Full workspace pnpm lint
• Full workspace pnpm test
• pnpm release:preflight
• pnpm check:i18n
• Focused suites: runtime 50, server 58, Web 10
• ego browser E2E: Emberback world selection → 15 default plugins → character form → opening continuation → first playable turn → character, memory, and quest panels

Notes for reviewers

• The highest-risk contracts are the execution journal/finalize transaction boundary, failed SSE rollback, and same-execution setup data flow.
• The E2E run used the configured live model, so narrative wording varies while the verified framework and plugin state transitions remain deterministic.