feat: responsive portrait-first drive-by loadout (#197)

[BrandDead]

Player outcome

The existing DRIVE app now uses two original GPT Image 2.5 nighttime car/street plates, a responsive DOM HUD, portrait-first seats, member condition and truthful carried-item panels. This is the drive-by loadout, not the separate desktop ATTACK legacy shooter.

Implements the #197 art, seat-eligibility and portrait/HUD slice. Keep #197's broader passenger-firing acceptance open until #201 proves named-member firing and result attribution.

Gameplay contract

• Driver may be an active dealer, recruit, shooter, or dedicated driver. A shooter assigned as driver occupies a non-shooter seat and receives no post-mission shooter XP. Only active shooters may take front/rear passenger seats; at least one shooter passenger is required, with up to two other empty passenger seats permitted. Legacy engine limitation: DriveByEngine has not yet received the chosen CarCrew, so bullets are not attributed to individual passengers or carried weapons. This deeper rule is tracked in Bind DRIVE mini-game shots and rewards to passenger shooters, never the driver #201; do not count it complete from selector eligibility.
• Duplicate, injured, missing or role-changed occupants are rejected again at launch (not merely at initial assignment); no new world-writer or combat-result path was introduced.
• A driver shooting after explicit dismount is a future separate block-attack rule on Beta gate: desktop ATTACK and OPS Planner bypass canonical encounter #192; this PR does not claim to implement dismount or merge legacy/canonical routes.
• Member-specific stored portrait URLs are tried first; role art is a clearly labeled fallback, not claimed to be a personalized likeness. Health and carried items absent from a roster are labeled not recorded, not invented as full health or an empty loadout.

Art and QA

Two prompt-generated original plates, landscape and mobile, were optimized by the merged #199 exact-source asset processor and added to the existing runtime manifest, preserving all 110 existing entries. New WebPs: 138,152 + 201,184 bytes; runtime 7.70 MB of a 20 MB budget. Masters retained outside git in ignored art-src/. ASSETS.md documents provenance. All seat buttons, stats, target search and launch copy are accessible DOM, not baked image text. No founder photograph, private likeness, real address or paid asset committed.

Local validation, Node 24, reviewed head cb8408f: red→green regression cases for driver/passenger roles, stale seat assignment, portrait precedence/fallback (including broken private URLs), real cargo and unknown/max-health data, responsive plate URLs and existing target handoff; focused car selector 12/12. Full npm run validate passed (1,033 frontend tests, 4 skipped; 91 files, lint 0 errors, TypeScript clean, asset audit 0 warnings, package audit); npm run build passed; backend pytest 95 passed. Local demo was clicked from the age gate → desktop DRIVE app → select dealer driver + shooter passenger → launch at 375×812, 390×844 and 1440×900. No page exceptions, CTA/hint overlap or horizontal overflow; both plates load from manifest. This proves a local demo path, not authenticated saved-game persistence or a production beta.

Deliberately out of scope / launch blockers

• Prove authenticated saved-game continuity on isolated staging #175 isolated two-fictional-user authenticated saved-game continuity and RLS proof remains open.
• Beta gate: desktop ATTACK and OPS Planner bypass canonical encounter #192 canonical ATTACK/OPS route, explicit driver dismount and one authoritative result path remain open; draft Scope the legacy topdown assignedRoles bypass #194 is characterization, not integration.
• Custom photo recruit returns stock art; require truthful private likeness flow #195 real custom photo generation / Weezy likeness remains blocked until the provider-backed private flow is proven; no credentials or private photo in this PR.
• Bind DRIVE mini-game shots and rewards to passenger shooters, never the driver #201 named passenger-shooter firing and reward attribution is not wired in the existing DRIVE engine; Reconcile offline launch pack with integrated single-player loop #189 offline-pack reconciliation, Nightfall tactical encounter: one live art proof, then resolver-backed package #190 Nightfall live proof, Restore an approved release from the protected default branch to production #171 deployment/release gate are not satisfied by UI/art alone. Do not publish a beta or claim launch-ready based on this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
slide	Ready	Preview	Oct 1, 2026 3:28am UTC

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d6e32d68-6398-4854-9941-c3cbd5b1f688)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T03:24:02.765206Z	a3b1cba	PR opened
🔒 Security Review	✅ Completed 2026-10-01T03:22:25.884172Z	a3b1cba	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[BrandDead]

Integration caveat under independent review: DriveByGame passes only targetBlock to DriveByEngine, not the selected CarCrew. The selector requires an eligible shooter passenger and DriveByGame omits the driver from XP updates, but the current first-person engine does not attribute individual bullets to a named passenger or their carried weapon. Therefore this PR is truthful about seat eligibility and portrait/HUD, not proof of per-member firing/equipment modifiers; this legacy engine gap remains a separate launch follow-up (tracked under #192 or a dedicated issue). Do not describe this change as comprehensive combat-member binding.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_18dea559-3161-4acd-8efe-97349ecafde0)

[BrandDead]

Independent review follow-up on head cb8408f: (1) failed stored-photo URLs now set a visible role-art fallback label in both picker and focused manifest; red→green regression added; (2) health with missing maxHealth now shows recorded current health plus “max not recorded,” never a fabricated /100; red→green regression updated. Focused selector 12/12, full frontend 1,033 passed / 4 skipped (91 files), lint 0 errors, typecheck/build/asset audit/package audit green, backend 95 passed. Final real demo 375×812, 390×844, 1440×900 seat→mission replay passes with no CTA/hint overlap or horizontal overflow. #201 separately tracks the legacy engine’s absent named-passenger firing/weapon/reward binding; #197 remains open for that broader acceptance. Await exact new-head GitHub CI and review threads before merge.