# Local technical verification — 2026-10-03

Verified with **Node v25.8.0**, standard library only.

```sh
node --test core.test.mjs server.test.mjs
node --check core.mjs
node --check server.mjs
node --check app.mjs
```

Observed result: **17 tests passed, 0 failed** (13 core tests and 4 HTTP integration tests). All three syntax checks exited successfully.

## Actual HTTP concurrency receipt

The integration test opened an ephemeral loopback listener, submitted two concurrent `POST /api/actions` requests with different student IDs for `w1`, and read `GET /api/state`:

- Response statuses sorted: **`[201, 409]`**.
- One winning student owned the washer; exactly **one** `turn` event existed.
- Retrying the winner's identical request key returned **201**, `replayed: true`, and still only one turn event.
- Reusing that key to request a different washer returned **409**, `REQUEST_KEY_REUSED`.
- A real API no-show scenario advanced an injected clock to the two-minute deadline; the queued student received the washer and the expired holder's late start returned **403**.
- A body larger than 16 KiB returned **413**. Malformed JSON and non-string action returned **400**. A foreign-origin write returned **403**. No washer changed owner in the invalid-input scenario.
- Repeating a demo time-advance key moved time once; the reset endpoint cleared the room.

Each temporary API server was closed in `finally`. The tests did not use a browser, request HTML, access an external service, or start the persistent preview on port 4193.

## Core behavior covered

Exclusive arrival deadline, successive missed turns during large time jumps, FIFO restoration, duplicate student prevention, unavailable reports, preserving an affected holder's original priority, manual completion even after an estimate expires, owner checks, request deduplication, reset retry behavior, and protection against mutating returned snapshots or the exported student registry.

## Scope of this evidence

An independent source review found that switching fictional students after a connection failure could re-enable stale controls. The root agent added a persistent connection flag, disabled actions and demo controls until a successful state read, and repeated syntax/static checks. The revised source hashes are in `verification.json`. This fix has not been exercised in a browser.

This proves selected behavior of the current **single-process local prototype**. It does not establish distributed concurrency, authentication, physical machine status, user comprehension, accessibility, deployed reliability, student benefit, demand, or competition eligibility. No visual or browser QA was performed. No real user test or production deployment was performed.