Decouple the simulation from the DOM, and lock the boundary

[FiddlyDigital]

Makes the game logic independent of the renderer and browser, so the render layer can be swapped or the mechanics reused in another shell (server, native app, different render stack) — and makes that separation structural rather than a convention.

The codebase was already ~95% of the way there: tests run in environment: 'node' with no jsdom, GameCallbacks/UIState carry no DOM types, and game.ts imported no DOM module. This closes the remaining gaps and fits them with guards.

Four phases, one commit each

1/4 — Move particles out of the sim (9241942)

Particle/ParticlePool lived in entities.ts next to Player and Monster, but Particle.draw() takes a CanvasRenderingContext2D and resolves sprite-atlas coordinates. That made entities.ts import SpriteService — the only simulation→DOM import in the repo. Moved verbatim to src/particles.ts. Pure file move: game.ts only ever imported Player/Monster/StatMath, and renderer.ts was the sole consumer of ParticlePool.

2/4 — Inject the cross-run stash as a port (2e2a078)

The sim reached for localStorage via StorageService in two places (Game's constructor inheriting past gold, and the Sídhe coffer). New StashPort (load/add/clear) injected via new Game(cb, { stash }):

• MemoryStash is the default, so the sim runs with zero host wiring.
• BrowserStash is the localStorage implementation, wired once by main.ts.

The port is deliberately a dumb store — the Sídhe's tithe (waystation.stashRecoveryPct) is game balance and moved into Game where it belongs (behaviour preserved, including clearing a stash too small to yield anything). stash added to SAVE_SKIP so the scalar sweep can't replace the live port with a plain object on restore.

3/4 — Inject the clock (ba8094d)

performance.now() in the line-clear combo window was the last ambient global. Now an optional now in the Game options, defaulting to a guarded performance.now() → Date.now() fallback. Bonus: combo timing is deterministically testable, with a new test driving a fake clock across the 2s window.

4/4 — Lock the boundary (26d49f2)

Two guards so this can't quietly regress:

1. no-restricted-imports in .oxlintrc.json — default-deny across all of src, switched off only for host-layer files and tests. Any new simulation file is protected automatically; a stray host import fails npm run lint with a message pointing at GameCallbacks/UIState/ports.
2. npm run headless (scripts/headless.mjs, now part of verify) — bundles the sim via Vite's SSR build, arms traps on document/window/localStorage/navigator/requestAnimationFrame, boots a real Game in plain Node, plays 1500 turns of weighted random input, then round-trips serialize() → applySave(). The round-trip also asserts the injected ports survive restore rather than being clobbered.

Both were tested against deliberate regressions: an added import './sprites' in waystation.ts is caught by the lint rule; a localStorage.getItem in the Game constructor is caught by the harness.

The rule found a leak the manual audit missed

views/inspect.ts imported SpriteService to build Geasa: <icon>×2 markup. The audit grepped for './sprites' and never saw '../sprites' from a subdirectory. The sim now emits an [[icon:<key>]] token that UIManager expands — matching the existing contract where InspectInfo.icon is already a key the host renders. No visual change.

Resulting architecture

Layer	Rule
Simulation — game.ts, entities.ts, systems/**, views/**, dataLoader.ts, content.ts, balance.ts, stash.ts, composed subsystems	No DOM, no canvas, no localStorage, no ambient globals. Runs in plain Node.
Host — main.ts, renderer.ts, ui.ts, input.ts, audio.ts, sprites.ts, particles.ts, tutorial.ts, haptics.ts, keybinds.ts, components/**, storage.ts	Owns every browser API.

Three seams between them, and nothing else: GameCallbacks (events out), UIState (view model), and injected ports (StashPort, now()). Sprite keys stay opaque strings the host resolves.

README documents the layers, the seams, and both guards.

Verification

npm run verify green: 440/440 tests, coverage ~84.5% stmts / 76.1% branches / 84.2% funcs / 87.6% lines (above thresholds), lint + validate-data + headless + build + smoke all pass. No behaviour or visual changes intended anywhere in this PR.

🤖 Generated with Claude Code

---

Generated by Claude Code