# Harvesting lessons from Arabiya, Demon Attack, Ranitas, tlatoani.net, and Tillandsias v56.10.20.1

Date: 2026-10-25. Host: forge. Harness: antigravity.

The operator asked for a comprehensive update to macron.dev by reviewing the latest work in `8007342/arabiya`, `8007342/demon_attack`, `8007342/ranitas`, the updated `tillandsias` platform and `tillandsias.org` website, and the growing family of `tlatoani.net` projects (while noting that `8007342/kumbia-kombat` remains under construction). Keep the site welcoming to first-time Tillandsias users and non-technical readers figuring things out for the first time.

## What we could and could not reach from this forge

- Public repositories on GitHub (`arabiya`, `demon_attack`, `ranitas`, `tillandsias`, `tillandsias.org`, `atrapa`, `devxsd`, `funguy`, `cannonball`) answered `api.github.com` and cloned cleanly through the outbound proxy.
- `8007342/kumbia-kombat` and `8007342/lakanoa` returned HTTP 404 on unauthenticated GitHub API requests, and `git ls-remote` prompted for credentials because the enclave git mirror only exports `macron.dev` to this lane. This matches the private-repository boundary recorded on 2026-10-18: `kumbia-kombat` remains private and under construction, so we report its status honestly without inventing commit details.
- In this session, `.forge-startup-context.md` reported `push_state=can-push` for `macron.dev`, `hooks: pre_push=present pre_commit=absent`, `project-expert: ready`, and `inference_state=ready` (Ollama with eight warm models on an RTX A5000). Pillow was not pre-installed in the base image, and `pip install --user Pillow` installed it into user space in two seconds through the caching proxy.

## Findings from Arabiya (`8007342/arabiya`, `arabiya.tlatoani.net`)

Arabiya is a browser-first playable Flutter + Flame comic for learning to write Arabic, backed by a Cloudflare Worker and SQLite Durable Object:

1. **Grade letter formation, not pointer effort.** The early draft tracer rewarded pointer sample count and endpoint proximity, allowing a short scribble to pass and awarding whole-chapter mastery from a single multiple-choice question. The updated ink rubric (`lib/src/ink/`) checks stroke coverage, distinct dot count and placement, and extra-ink rejection across four constrained letters (ب ت ث ا), backed by adversarial tests (single tap, stationary samples, scribbles, missing or overlapping dots). Reading a chapter or using guided help no longer awards unprompted writing mastery.
2. **Generate neural voices offline and verify hashes at build time.** An earlier voice script truncated lines at 195 characters and cached by file size, leaving stale or cut-off audio when dialogue changed. Arabiya replaced 41 English and Spanish lines locally using Kokoro-82M (`kokoro-onnx`) and checks all 218 bundled MP3 files offline by SHA-256 content hashes during normal builds (`scripts/voice-pipeline.sh`), needing no paid cloud TTS key at build or runtime.
3. **Bundle Worker dependencies explicitly.** Managed local Wrangler (`4.42.0` on the host versus `4.151.2` pinned in the project) could not resolve `jose` from the checkout's `node_modules`. Bundling the Worker with `esbuild` into `build/worker/index.mjs` during `npm run build` made local preview self-contained.
4. **Honest save states and local-preview auth boundaries.** The UI separates local guest saves ("Saved on this device") from verified cloud sync, using Google's official Identity Services popup and stable `sub` account IDs. In the forge's local preview (`https://www.arabiya.localhost:18443`), `GET` routes returned 200, but browser `POST` requests to `/api/auth/google` returned 403 (`Same-origin request required`) because the proxy rewrote the origin seen by `request.url`. Furthermore, `tillandsias --cloudflare-login` on the host exposed read-only Cloudflare inspection to the forge, not Worker creation or deploy credentials. A `git push` is not a live Worker deployment.

## Findings from Demon Attack (`8007342/demon_attack`, `demonattack.tlatoani.net`)

Demon Attack is a five-tour pixel arcade remake in Flutter + Flame with a Cloudflare SQLite Durable Object Top-10 leaderboard:

1. **Compounding multipliers turn Wave 1 into a wall.** When route progression simultaneously scaled initial roster, reinforcement group count, per-group health, speed, and elite three-shot fans, the first Normal wave required 73 baseline hits across 22 enemies (9.1× the initial 8-hit roster), and Hard required 112 hits with 120 simultaneous hostile bullets.
2. **Audit every wave with a deterministic robot pilot.** The team built an automated analyzer across all 318 mode/route/sector/wave configurations (`tools/analyze_difficulty.dart`) and a deterministic real-shot campaign pilot (`tools/profile_difficulty.dart`). Sharing the parent wave's health blueprint across reinforcements and escorts, capping ordinary HP at 5, and bounding wave-wide elite births brought Wave 1 down to 17 hits on Normal and 21 on Hard, reducing full-campaign active time from 109.5 minutes to 47.6 minutes on Normal and peak hostile bullets from 120 to 12–15.
3. **Whole-number damage has discrete cliffs.** Keeping Powerful shots at 2 damage in Easy (instead of 3) prevented every 3-HP creature from collapsing into a one-shot kill, while widening splash radius (`32/30/28`) gave Easy players gentler help without breaking weapon identity. Similarly, layered enemies (shield + armor + hull) require `ceil(shield/d) + ceil(armor/d) + ceil(hull/d)` hits rather than `ceil(total/d)`.
4. **Teach with a 4.5-second illustrated card at the door.** Instead of an untimed Field Guide or pause-menu tutorial settings, first-wave arrivals show one 5-to-9-word actionable sentence paired with a pixel illustration for 4.5 seconds while enemies wait offscreen ("Absorb a hit, then grab another shield").

## Findings from Ranitas (`8007342/ranitas`, `ranitas.tlatoani.net`) and sibling `tlatoani.net` projects

Ranitas is a widescreen (`641×359` prime canvas inside `2557×1439` prime backdrops) pixel pond inspired by Intellivision's 1982 *Frog Bog*:

1. **Software that knows when to rest.** Ranitas has no scores, streaks, lives, menus, or loss states. Over a bounded 3–6 minute foreground session, dusk or dawn progresses monotonically across seven seeded biomes (`willow`, `blossom`, `cypress`, `maple`, `sanctuary`, `grotto`, `alpine`), and then both frogs swim home and curl up to sleep while the pond ambience continues.
2. **Tiny compiled priors beat remote inference for game companions.** The companion frog ("Rana Jade") combines 4 Hz analytical jump projection (`_evaluateJev`) with a 147-parameter neural network (`8→12→3`) compiled directly into Dart constants from 18,000 offline synthetic examples. Sibling game **Atrapa** (`8007342/atrapa`, `atrapa.tlatoani.net`) took the same local-first path further: a pure-Dart trainer (`packages/atrapa_train`) imitated a free-space teacher and ran 40 minutes of CPU REINFORCE self-play across 16 Dart isolates to ship a 71.8 KiB (`18,371`-parameter) policy that wins 79.5% of 1v1 matches against its teacher with zero cloud calls.
3. **Browser audio needs a synchronous gesture + release gate.** `web/ambience.js` synthesizes crickets, wind, reeds, rain, frogs, owls, and distant storm thunder in procedural Web Audio with zero audio downloads. To satisfy mobile browser autoplay rules without premature noise, capture-phase `pointerdown` / `keydown` unlocks a zero-gain `AudioContext` synchronously before Flutter handles the event, and sound fades in only after the matching release and first positive-richness simulation tick.
4. **Extra `tlatoani.net` workshop projects.** Alongside `lakanoa.tlatoani.net`, `arabiya.tlatoani.net`, `demonattack.tlatoani.net`, `ranitas.tlatoani.net`, and `atrapa.tlatoani.net`, the workshop now includes **Chandelier** (`8007342/devxsd`, a cylindrical portrait puzzle where clearing 18-block rings grows a Monstera through a 12-minute light cycle), **FunGuy** (`8007342/funguy`, an offline-first San Diego mushroom field guide with a content-versioned service worker and explicit separation between decorative art and DNA-verified specimen records), and **Cannonball** (`8007342/cannonball`, an early mobile racing scaffold).
5. **Three storage tiers in a forge (`atrapa` diagnostics).** A forge's project checkout is a ~1.5 GiB tmpfs that vanishes on teardown; `/tmp` is ~256 MiB tmpfs; and `~/.cache/tillandsias-project` is a persistent disk-backed volume shared with the sibling Flutter toolchain. Meanwhile, `flutter --version` prepares the host-managed Flutter image on first call (pausing at step 11/14 while downloading), and `--no-web-resources-cdn` keeps web builds from failing on blocked external font CDNs in the project-restricted browser.

## Findings from Tillandsias `v56.10.20.1` and `tillandsias.org`

The platform promoted stable `v56.10.20.1` on 2026-10-20, and `tillandsias.org` updated its five progressive explanation levels ("Like I'm 5", "Phone", "Power user", "Security", "MathWiz / Hacker") on 2026-10-24:

1. **Gentle resets across every OS.** All three installers (Linux, macOS, Windows) now run a soft `--reset-state` only: they rebuild derived runtime state while preserving the VM image, Vault secret store, sign-ins, and downloads. Only an explicitly approved macOS tray hard reset touches the secret store.
2. **Containerized browser and tmpfs secrets.** The agent browser tool now launches a framework container over Wayland (or headless) rather than searching for a host Chrome binary. Per-container runtime credentials and Vault unseal shares cross the host–container boundary as ephemeral tmpfs files rather than Podman secrets (whose file driver wrote plaintext to durable disk).
3. **Re-anchoring citations by verbatim quote.** `tillandsias.org` pins every architectural claim to a runtime source file and line range plus a verbatim quote. When a release lands, `release-refresh.sh` (`scripts/anchors.py`) automatically re-anchors footnotes whose line numbers shifted by matching the verbatim quote, and stops for human judgement (`ask:judgement:<n>`) only when a quote disappeared or changed. At `v56.10.20.1`, the `stable` tag on `8007342/tillandsias` also points directly to the promoted release commit.
4. **Reader-first writing.** `tillandsias.org` codified a rule that applies just as strongly here: write for the person using the tool, not the internal work queue. Explain the sealed room, the single doorman, and the post box in plain words before introducing terminal commands.