Glossary

A workflow where an AI agent edits, runs and verifies code in a loop while a human directs. Evidence throughout: Claude co-authorship on ~100% of game commits, READMEs addressed to 'the next AI', debug hooks built for headless AI self-verification.

A version string appended to an asset URL (`?v=1.5.8`) so a CDN or browser cannot serve a stale copy. yakyulife applies one to every ES-module import specifier — 173 of them — which guarantees a consistent module graph but has to be updated by hand at every release.

Automation that builds and tests every change. Absent from all six repos in any meaningful form — the shared blind spot of this entire audit.

Serverless functions attached to a static Pages deployment — the backend runtime for all five games' leaderboards. Free tier: 100k requests/day, shared across an account, which drove several redesigns in this series.

An HTTP header whitelisting what a page may load or execute — a strong second line against XSS. The angry-pig/baseball pair ships a strict script-src 'self' CSP via _headers.

Cloudflare's serverless SQLite database. Stores every leaderboard, message board and presence table in this audit; also abused as a rate-limiter store (with check-then-write races as the cost).

Google's geometry-compression codec for 3D meshes. Cuts GLB asset size dramatically (24→11 MB in one project); the games vendor the decoder locally to avoid CDN dependency.

End-to-end testing that drives the real app (here: puppeteer-controlled headless Chrome). Angry Baseball's smoke bot actually plays full games — but asserts nothing, making it a verification harness rather than a regression suite.

Running physics at a constant tick (e.g. 1/60 s) with an accumulator, decoupled from render frame rate — the correct way to keep physics deterministic across devices.

One function or file that owns far too much state and logic (1,315–3,837 lines in this series). Works — until testing, onboarding or refactoring is needed. The single most consistent code-quality finding across the five games.

FPS shooting implemented as an instantaneous ray test rather than a simulated projectile. DUCK STRIKE pairs it with separate head/body hitboxes for headshot logic.

Engine-managed mesh instancing: each instance is still an object (can be culled or picked individually) while sharing geometry. fake-whiteout-survival reverted trees from thin instances back to InstancedMesh because per-tree frustum culling won.

A Cloudflare Pages file that routes paths away from Functions. Used in the fake-whiteout quota incident as a reversible circuit breaker: /api/* went static, the game survived on localStorage, and the rollback was documented in the commit.

Swapping simpler models in at distance to save GPU work. Notably absent from all five games — one of the recurring 'technical ceiling' findings.

The aerodynamic force that makes spinning balls curve. Angry Baseball applies a simplified per-tick version so breaking pitches actually break.

A Python static-site generator for documentation. ssd extends it unusually far: custom build hooks, 12 template overrides, a privacy plugin localizing third-party assets, and llms.txt output.

Tuning a game by simulating thousands of complete playthroughs and reading the resulting distribution, rather than by feel. yakyulife re-anchored its whole career-evaluation ladder this way — targeting 'Hall of Fame = 15% of all players' — after simulation showed the old thresholds sat above any reachable player.

A precomputed walkable-surface graph used for AI pathfinding. DUCK STRIKE deliberately skips it, using layered greedy avoidance instead — effective in one small arena, unscalable beyond it.

Pre-allocating a fixed set of objects (bullets, enemies, particles) and recycling them instead of creating/destroying at runtime — avoids garbage-collection hitches. Used pervasively in all five games.

Passing user input to SQL as bound parameters instead of string concatenation, eliminating SQL injection. All six projects get this right — everywhere.

Server-side sanity bounds on submitted scores (e.g. killCap = wave²·3+150). A soft anti-cheat: it blocks absurd values but cannot stop a client that lies within the bounds.

A sabermetric correction that credits harder defensive positions (catcher, shortstop) and debits easier ones (first base, DH) when comparing player value. yakyulife implements it in run units and rescales it to each league's real season length instead of a hardcoded 162 games.

Attacking an AI workflow by smuggling instructions into content it reads (tool results, web pages). DUCK STRIKE's SECURITY_INCIDENT.md is a rare first-hand log of such attempts during development.

Capping how often a client may hit an endpoint. The series evolved from none (zombie-survivors) to IP-keyed D1 limits with fail-open design (later games) — one of the clearest skill-growth arcs in the audit.

When a value taken from the URL is written into the page as markup instead of text, a crafted link can inject elements into another visitor's page. yakyulife reads `?seed=` unsanitized and renders it through an `innerHTML` assignment on the retirement screen — the same feature built for sharing links.

A deterministic pseudo-random generator whose whole sequence is fixed by one starting string, so the same seed plus the same choices replays an identical run. Both life-sims use a mulberry32-style generator this way, which turns the seed into a shareable artifact — and makes bug reports reproducible from a seed plus a choice list.

Partitioning space into grid cells keyed by hashed coordinates so neighbor queries check only nearby cells instead of every object — turning O(n²) proximity tests into near-linear work.

The auto-attack horde-survival subgenre popularized by Vampire Survivors (2022), now a recognized category with its own Wikipedia entry. zombie-survivors is an admitted 3D entry in this lineage.

A Babylon.js technique that draws thousands of copies of one mesh in a single draw call by feeding the GPU a raw matrix buffer. Cheapest possible instancing — but no per-instance culling or picking.

Hosting a site inside the Tor network for anonymous, censorship-resistant access. ssd serves its curriculum over an onion address and advertises it with per-page onion-location headers — practicing what it teaches.

Cloudflare's CAPTCHA alternative for proving a human/browser is present. DUCK STRIKE added it server-side but never wired the client — so it silently allows everything.

Cross-site scripting: injected content executing as code. The defense is escaping user strings before DOM insertion — these projects consistently do both server sanitization and client escaping.