# Collaborative browser roster editor

October18,2026 UTC. The user replaced the desktop-editor plan with a collaborative web editor, selected private owner/edit/view links, then registered `openhoops.io` in Cloudflare and authorized hosting there. Browser delivery supersedes further native macOS/Linux editor builds. Historical desktop source/builds and existing public downloads remain preserved. The game remains Windows-first; this change is editor-only.

## Implemented source

Canonical app: [roster-editor/web](../roster-editor/web/README.md), version0.2.0.dev1. Initial accepted writer/source54h archive SHA256 `d0e7bee54a36350cd41d091abbf2e6ccbd863cecc27e82cb226004f6d466b7ca`; [manifest](../analysis/roster-web54/source54h-manifest.json). It uses the shared standalone ROS writer, not a new game engine or a RED MC executable modification.

All39 native tables and91 optional standard college fields are available. The grid combines native, college and existing custom data with typed cells, enum choices, RGB controls, column/group search, metadata/native sort and filters, page/range selection, spreadsheet copy/paste and all/filtered/selected global edits. Metadata unset and explicit unknown remain separate. Mixed CSV is bound to the native ROS hash. Roster/season fields, arbitrary namespaced scalars, clone/import/move/delete, reference checks, health, original/other-file comparison, bounded TURK, comments/history and validated ZIP export use the proven writer. Unsafe native transforms and other game-mode formats remain refused.

The web snapshot writer additionally refuses native Team Division10–15 using the prior [conference dispatch evidence](COLLEGE-CONFERENCES.md); college division/conference declarations remain metadata. This is a scoped editor guard, not a native conference expansion or a new game test. Standard metadata is still not consumed by the hook/API. No redshirt fields or presentation work was added.

Cloudflare Worker/static assets serve the UI/API; one SQLite Durable Object per project enforces roles and serializes commits. R2 stores immutable original/version snapshots and patches. A separate Cloudflare managed container executes the stateless Python writer. A tested local adapter runs the same Worker/SQLite/R2 on the Dell against the independently unpacked production writer payload. Production has no Dell dependency in its configuration.

Cell commands check row epochs and original values; unrelated-cell edits can merge, same-cell changes conflict atomically. Bulk/structural actions require exact revision. Durable command IDs/payload hashes prevent repeated writes after retries. R2 objects are written before the head/receipt SQL transaction. Undo checks current values; owner version restore appends history and changes the epoch. Presence is ephemeral; display names are unverified. Capability hashes are stored server-side; revocation blocks HTTP and live sockets. No public project listing or anonymous upload exists.

## Acceptance and remaining gates

[Source54h tests](../analysis/roster-web54/tests54h.json):170 Dell passes, comprising148 existing writer/preparation/college and22 web-engine/grid tests. Local service acceptance exercises two actual WebSocket clients, roles/revocation, same-cell conflict/different-cell merge, retries, undo/restore, comparisons and export with the independently assembled writer. Large-file acceptance uses905teams/13,665players/3,779uniforms; highest-index team/player metadata,13,665-cell global edit and export/fresh parsing pass. Optimizing repeated scope checks reduces that Dell bulk edit from17.9seconds to1.2seconds. This is not a production latency guarantee.

Service restart preserves the saved head, metadata and immutable retry receipt. Original private fixtures retain their hashes. No game, production API, shared desktop input or MVP process/file is part of these tests. No native DLL or public ZIP was built/promoted. The Mac was used for editing, storage, existing Wrangler login and SSH/Paseo browser control; verified official portable Node24.22.0 and project-local web dependencies were added only on the Dell.

Paseo browser functional checks exercise owner project creation, file-input upload/browser compression, table navigation, typed class entry, rectangular multirow college paste, global edit and roster-season controls. The host returns `screenshot_no_frame` / “tab has not painted” even after reload/resize, so pixel inspection remains unverified; DOM/interaction results do not close that gate. No alternative browser was substituted.

Cloudflare authorization subsequently completed from the user's phone. The active openhoops.io zone belongs to Lane Holding Group LLC; Workers, R2 and Containers are available. Existing Worker/domain bindings and public website DNS were checked before deployment; unrelated Workers, buckets and hosting were untouched. No billing plan was changed. The new private R2 bucket is openhoops-roster-projects, with no public bucket endpoint. OAuth and creation/owner secrets remain in private configuration, outside public assets and source archives.

Current live editor: https://openhoops.io/rostereditor. The user reserved the homepage for the future OpenHoops site; it now serves a small placeholder. Runtime source54k archive0323990ff20e6e4acfc39b1e978825cbc51fd2d83f645f251b465580d195af93 deploys Worker versiona0638bae-9089-43ce-bd46-583cb30410c3. Its Python payload is byte-identical to accepted54h:0b5a9ac26df28485b2290d30e098f9c59aedbe40577e0c6a1145e4784ee549fb. Native writer/grid inputs retain the170-test scope. New assets, API/WebSockets and share links live under /rostereditor; existing /p links redirect with capability fragments preserved and /api remains a compatibility alias.

Actual Cloudflare production passes28 collaboration checks on the original54h service, then28 again through the prefixed API on54k. This exercises real managed Python startup, private ROS intake, two WebSockets, conflict/merge behavior, durable receipts/undo, roles, revocation, comparisons and export. [Prefix acceptance](../analysis/roster-web54/path54k.json) passes12 routing/access checks, including preserved original owner project/access and404 behavior. The initial54j asset index lookup caused a307 folder redirect;54k uses the internal folder URL and resolves it. Keep that failed evidence.

Paseo follows an original /p owner invite through the redirect to /rostereditor/p, strips the access fragment, reads owner access and establishes Saved r0 over the prefixed socket. The user workspace remains empty and ready for a supplied roster. The live browser screenshot still returns screenshot_no_frame. Its strict CSP also blocks the browser tool's string evaluation; ordinary external app scripts and native snapshot/navigation work. Do not loosen CSP to accommodate automation. Pixel inspection and physical cross-browser certification remain unverified; production HTTP/WebSocket/container operation is now verified within the stated cases. No fallback Dell server hosts the production editor.

See [deployment/recovery](../roster-editor/web/DEPLOYMENT.md) and the separate [collaboration service contract](../roster-editor/web/API.md). It is not the in-game HTTPv1 API. Private API51/ABI26/event4/profile4/court3 and stable35/restored50/public API36/editor dev7 stay unchanged. Presentation, real mod/custom-art acceptance and gamepad hardware remain deferred; mid-game save/resume remains deprioritized.
