- Remove package.json / package-lock.json. The only dependency was
claude-flow (dev tooling, never loaded by the game), which pulled in
49 known vulnerabilities (2 critical, 28 high) and could be installed
by the Cloudflare Pages build.
- Self-host the Outfit variable font (latin + latin-ext woff2, SIL OFL)
in fonts/ instead of loading it from Google Fonts. This removes the
last third-party origins from the CSP (style-src / font-src are now
'self' only), stops sending visitor IPs to Google, and makes the font
work offline.
- Precache the font files in the service worker and bump CACHE_NAME to
tortugotchi-v18.
Pause the ocean decay/aging/hazard loops and ambient audio whenever the tab is
hidden or the window loses focus, and resume untouched on return. Remove the
offline catch-up decay so a turtle left alone freezes instead of dying, letting
turtles live and grow over a long real-world span.
Gate the playmate greeting/farewell voice clips (letsPlay/swimSafe) to the
green species whose text they match; loggerhead and leatherback play silently.
Also keep glub out of the ambient loop while a voice line plays. Bump SW to v17.
Joel Brock