Fake Whiteout Survival

memoryTechnical Depth 7/10

Solid Babylon.js performance work driven by measurement, not templates: the BackStack module draws 200 stacked meat slabs on the player's back via one thin-instance mesh with a hand-written Float32Array matrix buffer (zero-allocation hot path), while tree-field.ts documents reverting thin instances back to InstancedMesh because per-tree frustum culling won. Zombie pool built lazily, static meshes frozen, Draco 24→11 MB self-hosted. No LOD, no spatial partitioning — collisions are brute-force O(n·m).

stadia_controllerGame Design 7/10

A complete loop with a real mid-game pivot: economy phase → automation phase (dog / hunter / cashier) → 30-wave tower-defense endgame with bosses every 3 waves and a pure-slow tower. Git history shows genuine design iteration — house-HP was cut for a more readable breach mechanic (10 zombies inside = loss). Weak spots: the upgrade tree has exactly one entry, no mid-run save, and the run is short.

securityBackend & Security 6/10

Above-average defenses: parameterized SQL, IP-based D1 rate limits (4–8 s per action), profanity filtering, wave clamped to 30 with 'claimed clear below wave 30 recorded as not cleared', ADMIN_KEY in Pages Secrets. Then the hole: the frontend hardcodes debug password '19840501' and its comment admits it equals the admin key — anyone reading the bundle can wipe the board and open the cheat panel. Rate limiter has a SELECT-then-UPSERT race; the rate table is never cleaned.

codeCode Quality 6.5/10

Strict TS with zero any in the whole codebase, vue-tsc forced before build, parameters centralized in a 349-line commented config.ts. The counterweight: game.ts is 3,837 lines — one createGame() closure containing nearly all logic, with the 'stand-in-zone payment' block copy-pasted six times and the attack block twice.

experimentTesting 1.5/10

Zero automated tests, no test dependencies, no CI. The only gate is type-checking inside the build — though DEVLOG records a real 'typecheck before every build' discipline.

verifiedCompleteness 8/10

Near-full spec for a hobby game: live with global leaderboard, nested-reply message board, 7-day online chart, server-wide stats, 11 achievements (with a commit that verified all are triggerable), 5-track synthesized BGM, four docs (README / BACKEND / DEVLOG pitfall collection / README_AI), and graceful degradation everywhere — model-load fallbacks, offline localStorage mode, fire-and-forget community calls.

emoji_objectsOriginality 4.5/10

The premise is knowingly derivative — recreating a game that only exists in scam ads — and that meta joke is genuinely clever. Mechanically, though, it is an assembly of two very mature genres (arcade idle + TD); the breach rule, slow-tower and social layer are its own, but no new mechanic is invented.