# DISPATCH — worker_iter4

**Identity**: `worker_iter4`
**Role**: Implementation & Remediation Worker
**Archetype**: `teamwork_preview_worker`
**Working Directory**: `c:\Projects\FreeExile\.agents\teamwork\worker_iter4\`
**Parent**: `orchestrator_18` (`75463099-5538-440a-8ff9-91c183526f7a`)

## MANDATORY INTEGRITY WARNING
> DO NOT CHEAT. All implementations must be genuine. DO NOT hardcode test results, create dummy/facade implementations, or circumvent the intended task. A auditor will independently verify your work. Integrity violations WILL be detected and your work WILL be rejected.

## Context & Assignment
Milestone 1 Gate failed due to Forensic Audit Integrity Violation (path traversal in `tools/serve_web_pc.py` and test error masking in `tests/e2e/test_pc_desktop_client_e2e.py`) and runtime exceptions caught by Challengers/Reviewers (`#badge-iframe` null classList error, `sfxEngine.playWeaponSlash` missing method, and Space dodge charge double-decrement).

The 3 Explorers (`explorer_18_1`, `explorer_18_2`, `explorer_18_3`) have performed root cause isolation and designed drop-in code diffs. Your mission is to implement all 6 remediation items, run all verification tests and linters, and document results in `handoff.md`.

## File Write Ownership
You exclusively own and may modify:
1. `tools/serve_web_pc.py`
2. `client/web_pc/index.html`
3. `client/web_pc/js/pc_main.js`
4. `client/web_pc/js/pc_input_controller.js`
5. `tests/e2e/test_pc_desktop_client_e2e.py`
6. `tests/unit/test_pc_web_client.py`

STRICT CONSTRAINT: You MUST NOT modify any file inside `client/webapp/`.

## Input Documents (READ FIRST)
1. `c:\Projects\FreeExile\.agents\teamwork\ORIGINAL_REQUEST.md` (header `## 2026-10-02T05:17:43Z`)
2. `c:\Projects\FreeExile\.agents\teamwork\explorer_18_1\handoff.md` (Server Security & Test Rigor diffs)
3. `c:\Projects\FreeExile\.agents\teamwork\explorer_18_2\handoff.md` (DOM & Audio Aliasing diffs)
4. `c:\Projects\FreeExile\.agents\teamwork\explorer_18_3\handoff.md` (Capture listener & Space dodge diffs)

## Step-by-Step Implementation Instructions
1. **Unlock Blast Radius**:
   Execute `python tools/analysis/blast_radius.py --target tools/serve_web_pc.py --ack`
2. **Patch `tools/serve_web_pc.py`**:
   Apply `_is_safe_child` and strict containment in `_resolve_static_path` per `explorer_18_1/handoff.md § 4`.
3. **Patch `client/web_pc/index.html`**:
   Add `<div id="badge-iframe" class="hidden px-1.5 py-0.5 rounded bg-stone-800 text-stone-300 border border-stone-600 font-mono text-[9px]">I-FRAME</div>` inside `#hud-char-status-card` or telemetry bar per `explorer_18_2` & `explorer_18_3`.
4. **Patch `client/web_pc/js/pc_main.js`**:
   Add `sfxEngine.playWeaponSlash = function(...args) { return this.playBladeSlash(...args); }` on `SFXEngine.prototype`, `sfxEngine`, and `window.sfxEngine` per `explorer_18_2/handoff.md § 4`.
5. **Patch `client/web_pc/js/pc_input_controller.js`**:
   Use capture phase for keydown listener (`true`), stop immediate propagation on Space, add `if (window.player && window.player.isIFrame) return;`, remove duplicate `triggerUiCooldown` in the main branch, and only call it in fallback per `explorer_18_3/handoff.md § 4`.
6. **Patch `tests/e2e/test_pc_desktop_client_e2e.py`**:
   - In `test_tier1_zero_console_javascript_errors`: purge filters for `"404"`, `"keys is not defined"`, `"hudOrbs"`, `"api/map"`, assert `len(errors) == 0`.
   - Add `test_tier1_server_path_traversal_prevention`.
   - Add `test_tier2_spacebar_dodge_charge_accounting_and_iframe_lifecycle`.
7. **Patch `tests/unit/test_pc_web_client.py`**:
   Assert `id="badge-iframe"` is present in `client/web_pc/index.html`.

## Verification Commands (Execute All)
1. Path traversal exploit test:
   `python -c "import urllib.request, urllib.error, socketserver, threading, sys; sys.path.insert(0, '.'); from tools.serve_web_pc import FreeExilePCRequestHandler; s = socketserver.TCPServer(('127.0.0.1', 0), FreeExilePCRequestHandler); port = s.server_address[1]; threading.Thread(target=s.serve_forever, daemon=True).start(); [assert urllib.request.urlopen(f'http://127.0.0.1:{port}{p}') for p in []]"` (verify 404 on `win.ini`, `.git/config`).
2. Primary attack sfx check:
   `python .agents/teamwork/reviewer_18_2/test_do_primary.py` (Must output `OK`).
3. Space dodge charge accounting & i-frame test:
   `python .agents/teamwork/challenger_18_1/test_targeted_findings.py` (Charges = 2, Errors = []).
4. Run full unit suites:
   `pytest tests/unit/test_pc_input_controller.py tests/unit/test_pc_web_client.py tests/unit/test_pc_web_client_layout.py tests/unit/test_mobile_webapp_config.py -v`
5. Run full E2E test suite:
   `pytest tests/e2e/test_pc_desktop_client_e2e.py -v`
6. Run linters:
   `python tools/lint/check_code_and_doc_hygiene.py`
   `python tools/lint/check_i18n_hygiene.py --strict`

Document all command outputs in `handoff.md` and report completion back to parent.

## 2026-10-02T07:18:30Z
[Message] timestamp=2026-10-02T07:18:30Z sender=75463099-5538-440a-8ff9-91c183526f7a priority=MESSAGE_PRIORITY_HIGH content=You are worker_iter4, Implementation & Remediation Worker.
Your working directory is: c:\Projects\FreeExile\.agents\teamwork\worker_iter4\
Read your dispatch instructions at: c:\Projects\FreeExile\.agents\teamwork\worker_iter4\DISPATCH.md
Read the authoritative user request at: c:\Projects\FreeExile\.agents\teamwork\ORIGINAL_REQUEST.md (header ## 2026-10-02T05:17:43Z)
Read PROJECT.md at: c:\Projects\FreeExile\.agents\teamwork\orchestrator_16\PROJECT.md
Read explorer_18_1 handoff at: c:\Projects\FreeExile\.agents\teamwork\explorer_18_1\handoff.md
Read explorer_18_2 handoff at: c:\Projects\FreeExile\.agents\teamwork\explorer_18_2\handoff.md
Read explorer_18_3 handoff at: c:\Projects\FreeExile\.agents\teamwork\explorer_18_3\handoff.md

MANDATORY INTEGRITY WARNING:
> DO NOT CHEAT. All implementations must be genuine. DO NOT hardcode test results, create dummy/facade implementations, or circumvent the intended task. A auditor will independently verify your work. Integrity violations WILL be detected and your work WILL be rejected.

File write ownership:
1. tools/serve_web_pc.py (Unlock with python tools/analysis/blast_radius.py --target tools/serve_web_pc.py --ack first!)
2. client/web_pc/index.html
3. client/web_pc/js/pc_main.js
4. client/web_pc/js/pc_input_controller.js
5. tests/e2e/test_pc_desktop_client_e2e.py
6. tests/unit/test_pc_web_client.py
STRICT CONSTRAINT: DO NOT modify any file inside client/webapp/!

Implement all 6 remediation items per the Explorer handoff reports. Run all verification tests and linters. Write your handoff report to c:\Projects\FreeExile\.agents\teamwork\worker_iter4\handoff.md and notify parent with a concise message.