- Config 'Update', 'Commit Mission', lock, and clearupdate now use db.php
helpers with bound params (were injectable via ~20 raw $_GET values incl.
nummercs and playerid). Pod toggles collapsed into a 16-iteration loop.
- Commit Mission runs under the shared queue lock and one transaction so a
registration can't slip into the mission mid-commit.
- dev/migrations/002: pqs_currentmission + pqs_pastmissions -> InnoDB so the
commit's snapshot/archive roll back with the queue delete (uses DELETE not
TRUNCATE to stay in the transaction).
Verified: commit moves players to current/past, empties queue, marks completed
with nummercs; config update writes pods + settings; no errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Strip DEBUG echoes. The 'call is set' line was prefixing the updateinfo JSON
response, breaking JSON.parse on the display walls so the info-panel
auto-refresh silently never fired.
- Parameterize updatemerc (was SQL-injectable via $_GET[playerid]).
- Use includes/db.php helpers; set JSON content-type on updateinfo.
Verified: updateinfo returns clean "0"/"1"; updatemerc add/remove flips the
flag; empty response on merc toggle.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Completes the overfill-race fix (item #1). New queue.php functions, all under
the same GET_LOCK + transaction and self-healing numplayers:
- pqs_add_player_to_mission (staff 'new' -> registration.php)
- pqs_add_player_to_missions (staff 'add to N missions' -> registration.php)
- pqs_enqueue_group (kiosk group leader -> callsign.php)
- pqs_claim_group_slot (kiosk group member -> callsign.php)
callsign.php and registration.php now call these instead of their own
non-atomic read-check-insert blocks.
Verified on the local stack: scenario test (leader/member/staff paths) and
120 mixed concurrent solo+group writers x3 -> zero overfill, zero drift;
HTTP smoke of leader/member/new paths all seat correctly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The pod query result was never fetched, so $pod01..16 (and their $_SESSION
copies) read a stale row - silent on PHP 5, noisy warnings on PHP 8. Add the
missing mysqli_fetch_array. Behavior otherwise unchanged.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- dev/migrations/001-innodb.sql: convert pqs_queue + pqs_mission to InnoDB.
- includes/queue.php: pqs_enqueue_player() seats a player in the next open
mission (creating one if needed), serialized with GET_LOCK and wrapped in a
transaction; capacity judged by real COUNT(*), numplayers rewritten from it
so the counter self-heals and can't drift.
- callsign.php: normal registration path now calls pqs_enqueue_player instead
of the non-atomic read-check-insert.
Verified on the local stack: 140 concurrent registrations -> 24 missions,
zero overfill, zero counter drift.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CydandClaude Opus 4.8