fix(modules): bump modules for spec 015 image pins and close Phase 9 docs

specs/015-top-steam-game-modules/engine-matrix-resolved.md

@@ -14,48 +14,48 @@ No module is assigned `cli` pending maintainer ruling on its semantics (T005).
 
 | Module Identifier | Status | Real `rcon.protocol` | `consoleMode` | Declared Ports (`spec.ports`) | `spec.storage.mountPath` | `spec.capabilities.lifecycle.stop` | CI Classification | CI Classification Justification |
 |---|---|---|---|---|---|---|---|---|
-| `cs2` | Existing | `source` | `rcon` | `game` (27015/UDP), `query` (27015/UDP), `rcon` (27015/TCP) | `/home/steam/cs2-dedicated` | `["quit"]` | `bot-heavy` | 60Gi disk required; exceeds GitHub runner disk capacity |
-| `palworld` | Existing | `palworld` | `rcon` | `game` (8211/UDP), `query` (27015/UDP), `rest` (8212/TCP), `rcon` (25575/TCP) | `/palworld` (OD 7.1) | `["Save", "DoExit"]` | `bot-heavy` | 20Gi storage + multi-GB first boot download |
+| `cs2` | Existing | `source` | unset | `game` (27015/UDP), `rcon` (27015/TCP), `gotv` (27020/UDP) | `/home/steam/cs2-dedicated` | `["quit"]` | `bot-heavy` | 60Gi disk required; exceeds GitHub runner disk capacity |
+| `palworld` | Existing | `palworld` | unset | `game` (8211/UDP), `query` (27015/UDP), `rest-api` (8212/TCP) | `/palworld` (OD 7.1) | `["save", "shutdown 1"]` | `bot-heavy` | 20Gi storage + multi-GB first boot download |
 | `fivem` | New | `rest` | `rcon` | `game` (30120/UDP), `http` (30120/TCP), `txadmin` (40120/TCP) | `/server-data` | `["quit"]` | `bot-heavy` | >5Gi storage, embedded database + txAdmin supervision |
-| `rust` | Existing | `websocket` | `rcon` | `game` (28015/UDP), `query` (28015/UDP), `rcon` (28016/TCP), `app` (28082/TCP) | `/steamcmd/rust` (OD 7.2) | `["server.save", "server.writecfg"]` | `bot-heavy` | 10Gi storage + 4Gi memory requests |
-| `project-zomboid` | Existing | `source` (OD 2) | `rcon` | `game` (16261/UDP), `rcon` (27015/TCP) | `/home/steam/Zomboid` (OD 7.3) | `["save", "quit"]` | `bot-heavy` | 15Gi storage + 4Gi memory requests |
-| `team-fortress-2` | New | `source` | `rcon` | `game` (27015/UDP), `query` (27015/UDP), `rcon` (27015/TCP) | `/home/steam/tf-dedicated` | `["quit"]` | `bot-heavy` | SteamCMD download (>15Gi storage) |
-| `dayz` | Existing | `battleye` | `rcon` | `game` (2302/UDP), `query` (27016/UDP), `rcon` (2306/UDP) | `/data` (OD 7.4) | `[]` (OD T086) | `bot-heavy` | 40Gi storage + >10GB SteamCMD download |
+| `rust` | Existing | `websocket` | `rcon` | `game` (28015/UDP), `rcon` (28016/TCP) | `/steamcmd/rust` (OD 7.2) | `["server.save", "quit"]` | `bot-heavy` | 10Gi storage + 4Gi memory requests |
+| `project-zomboid` | Existing | `source` (OD 2) | unset | `game` (16261/UDP), `direct` (16262/UDP), `rcon` (27015/TCP) | `/home/steam/Zomboid` (OD 7.3) | `["save", "quit"]` | `bot-heavy` | 15Gi storage + 4Gi memory requests |
+| `team-fortress-2` | New | `source` | `rcon` | `game` (27015/UDP), `rcon` (27015/TCP), `sourcetv` (27020/UDP) | `/home/steam/tf-dedicated` | `["quit"]` | `bot-heavy` | SteamCMD download (>15Gi storage) |
+| `dayz` | Existing | `battleye` | `rcon` | `game` (2302/UDP), `query` (27015/UDP), `rcon` (2305/UDP) | `/data` (OD 7.4) | `[]` (OD T086) | `bot-heavy` | 40Gi storage + >10GB SteamCMD download |
 | `farming-simulator-25` | New | `rest` | `none` | `game` (10823/UDP), `web` (8080/TCP) | `/data/My Games/FarmingSimulator2025` | `["save"]` | `bot-heavy` | Headless Wine/Proton layer + >20Gi storage |
 | `euro-truck-simulator-2` | New | `none` | `pty` | `game` (27015/UDP), `query` (27016/UDP) | `/home/steam/.local/share/Euro Truck Simulator 2` | `["exit"]` | `bot-heavy` | SteamCMD download (>10Gi storage) |
-| `garrys-mod` | Existing | `none` (T009) | `none` | `game` (27015/UDP), `query` (27015/UDP) | `/home/gmod/server/garrysmod/data` (OD 7.5) | `[]` (T009, no capabilities) | `bot-fast` | Pre-baked container image; fits in fast CI bucket |
-| `mount-and-blade-2-bannerlord` | New | `none` | `pty` | `game` (7210/UDP), `query` (7211/UDP) | `/serverdata` | `[]` (Match-based) | `bot-heavy` | SteamCMD download (>15Gi storage) |
+| `garrys-mod` | Existing | `none` (T009) | unset | `game` (27015/UDP), `game-tcp` (27015/TCP), `client` (27005/UDP) | `/home/gmod/server/garrysmod/data` (OD 7.5) | `[]` (T009, no capabilities) | `bot-fast` | Pre-baked container image; fits in fast CI bucket |
+| `mount-and-blade-2-bannerlord` | New | `none` | `pty` | `game` (7210/UDP), `query` (7211/UDP) | `/data` | `[]` (Match-based) | `bot-heavy` | SteamCMD download (>15Gi storage) |
 | `terraria` | Existing | `none` | `pty` | `game` (7777/TCP) | `/opt/terraria/config` (OD 7.6) | `["exit"]` | `bot-fast` | Lightweight .NET runtime, <1Gi storage |
-| `7-days-to-die` | Existing | `none` (T009) | `none` | `game` (26900/UDP), `query` (26900/UDP), `telnet` (8081/TCP) | `/home/sdtdserver/.local/share/7DaysToDie` (OD 7.12) | `[]` (T009, no capabilities) | `bot-heavy` | 55Gi combined storage requirement |
-| `tmodloader` | New | `none` | `pty` | `game` (7777/TCP) | `/root/.local/share/Terraria/tModLoader` | `["exit"]` | `bot-fast` | Lightweight Terraria-based mod runtime, 4Gi storage |
-| `beammp` | New | `none` | `pty` | `game` (30814/UDP), `auth` (30814/TCP) | `/server/Root` | `[]` | `bot-fast` | Standalone C++ binary, 2Gi storage, no SteamCMD |
-| `ark-survival-ascended` | Existing | `source` | `rcon` | `game` (7777/UDP), `query` (7777/UDP), `rcon` (27020/TCP) | `/home/gameserver` (OD 7.7) | `["SaveWorld"]` | `bot-heavy` | 30Gi persistent storage requirement |
+| `7-days-to-die` | Existing | `none` (T009) | unset | `game` (26900/TCP), `game-udp` (26900/UDP), `game2` (26901/UDP), `game3` (26902/UDP), `telnet` (8081/TCP) | `/home/sdtdserver/.local/share/7DaysToDie` (OD 7.12) | `[]` (T009, no capabilities) | `bot-heavy` | 55Gi combined storage requirement |
+| `tmodloader` | New | `none` | `pty` | `game` (7777/TCP) | `/opt/terraria/config` | `["exit"]` | `bot-heavy` | Lightweight Terraria-based mod runtime, 4Gi storage |
+| `beammp` | New | `none` | `pty` | `game` (30814/UDP), `auth` (30814/TCP) | `/server/Root` | `[]` | `bot-heavy` | Standalone C++ binary, 2Gi storage, no SteamCMD |
+| `ark-survival-ascended` | Existing | `source` | unset | `game` (7777/UDP), `peer` (7778/UDP), `rcon` (27020/TCP) | `/home/gameserver` (OD 7.7) | `["SaveWorld", "DoExit"]` | `bot-heavy` | 30Gi persistent storage requirement |
 | `left-4-dead-2` | New | `source` | `rcon` | `game` (27015/UDP), `query` (27015/UDP), `rcon` (27015/TCP) | `/home/steam/l4d2-dedicated` | `["quit"]` | `bot-heavy` | SteamCMD download (>12Gi storage) |
-| `factorio` | Existing | `source` (OD 2) | `pty` | `game` (34197/UDP), `rcon` (27015/TCP) | `/factorio` (OD 7.8) | `["/server-save"]` | `bot-fast` | Fast boot and lightweight memory/storage |
-| `the-isle` | New | `source` | `rcon` | `game` (7777/UDP), `query` (7778/UDP), `rcon` (8888/TCP) | `/serverdata/TheIsle/Saved` | `["save"]` | `bot-heavy` | SteamCMD download, UE4 (>20Gi storage) |
-| `dont-starve-together` | Existing | `none` | `pty` | `game` (10999/UDP), `query` (27018/UDP) | `/data` (OD 7.9) | `["c_save()", "c_shutdown(true)"]` (OD 4) | `bot-heavy` | Multi-shard master/caves overhead |
-| `valheim` | Existing | `none` | `pty` | `game` (2456/UDP), `query` (2457/UDP) | `/config` (OD 7.10) | `["save"]` | `bot-heavy` | >12GB SteamCMD download on first boot |
-| `satisfactory` | Existing | `satisfactory` | `rcon` | `game` (7777/UDP), `api` (7777/TCP) | `/config` (OD 7.11) | `["SaveGame"]` | `bot-heavy` | 25Gi storage + multi-GB SteamCMD download |
-| `ark-survival-evolved` | New | `source` | `rcon` | `game` (7777/UDP), `query` (27015/UDP), `rcon` (27020/TCP) | `/serverdata/ShooterGame/Saved` | `["SaveWorld"]` | `bot-heavy` | SteamCMD download, cluster travel (>30Gi storage) |
-| `arma-reforger` | New | `none` | `pty` | `game` (2001/UDP), `query` (17777/UDP) | `/home/steam/.local/share/ArmaReforgerServer` | `["save"]` | `bot-heavy` | SteamCMD download, Enfusion engine (>25Gi storage) |
+| `factorio` | Existing | `source` (OD 2) | `pty` | `game` (34197/UDP), `rcon` (27015/TCP) | `/factorio` (OD 7.8) | `["/server-save"]` | `bot-heavy` | Fast boot and lightweight memory/storage |
+| `the-isle` | New | `source` | `rcon` | `game` (7777/UDP), `query` (7778/UDP), `rcon` (8888/TCP) | `/data` | `["save"]` | `bot-heavy` | SteamCMD download, UE4 (>20Gi storage) |
+| `dont-starve-together` | Existing | `none` | `pty` | `game` (10999/UDP), `query` (27018/UDP), `caves` (11000/UDP), `steam1` (12346/UDP), `steam2` (12347/UDP) | `/data` (OD 7.9) | `["c_save()", "c_shutdown(true)"]` (OD 4) | `bot-heavy` | Multi-shard master/caves overhead |
+| `valheim` | Existing | `none` | `pty` | `game` (2456/UDP), `game2` (2457/UDP), `game3` (2458/UDP), `status` (80/TCP) | `/config` (OD 7.10) | `["save"]` | `bot-heavy` | >12GB SteamCMD download on first boot |
+| `satisfactory` | Existing | `satisfactory` | `rcon` | `game` (7777/UDP), `game-tcp` (7777/TCP), `messaging` (8888/TCP) | `/config` (OD 7.11) | `["SaveGame"]` | `bot-heavy` | 25Gi storage + multi-GB SteamCMD download |
+| `ark-survival-evolved` | New | `source` | `rcon` | `game` (7777/UDP), `query` (27015/UDP), `rcon` (27020/TCP) | `/data` | `["SaveWorld", "DoExit"]` | `bot-heavy` | SteamCMD download, cluster travel (>30Gi storage) |
+| `arma-reforger` | New | `none` | `pty` | `game` (2001/UDP), `query` (17777/UDP) | `/reforger` | `["save"]` | `bot-heavy` | SteamCMD download, Enfusion engine (>25Gi storage) |
 | `hell-let-loose` | New | `source` | `rcon` | `game` (7787/UDP), `query` (27165/UDP), `rcon` (22222/TCP) | `/serverdata/HLL/Saved` | `[]` (Match-based) | `bot-heavy` | SteamCMD download (>30Gi storage) |
-| `squad` | New | `source` | `rcon` | `game` (7787/UDP), `query` (27165/UDP), `rcon` (21114/TCP) | `/serverdata/Squad/Saved` | `[]` (Match-based) | `bot-heavy` | SteamCMD download (>35Gi storage) |
+| `squad` | New | `source` | `rcon` | `game` (7787/UDP), `query` (27165/UDP), `rcon` (21114/TCP) | `/data` | `[]` (Match-based) | `bot-heavy` | SteamCMD download (>35Gi storage) |
 
 ---
 
 ## 2. 13 New Modules Classification Summary
 
-- **`bot-fast` (2 modules)**:
-  - `tmodloader`: Terraria modding framework, 4Gi storage, fast start, lightweight CPU/RAM.
-  - `beammp`: BeamNG multiplayer server, lightweight standalone C++ binary, 2Gi storage, zero external downloads.
-- **`bot-heavy` (11 modules)**:
-  - `fivem`, `team-fortress-2`, `farming-simulator-25`, `euro-truck-simulator-2`, `mount-and-blade-2-bannerlord`, `left-4-dead-2`, `the-isle`, `ark-survival-evolved`, `arma-reforger`, `hell-let-loose`, `squad`.
-  - All require multi-GB SteamCMD game installations or complex emulation layers (Wine/Proton) exceeding standard GitHub Actions runner disk (<14GB free) and memory budgets.
+- **`bot-fast` (0 modules)**: none of the 13 new modules runs in CI's `bot-fast` bucket.
+- **`bot-heavy` (13 modules)**:
+  - `fivem`, `team-fortress-2`, `farming-simulator-25`, `euro-truck-simulator-2`, `mount-and-blade-2-bannerlord`, `tmodloader`, `beammp`, `left-4-dead-2`, `the-isle`, `ark-survival-evolved`, `arma-reforger`, `hell-let-loose`, `squad` (`test/e2e/buckets.sh`, `bucket_bot_heavy`).
+  - All need multi-GB downloads, large volumes or emulation layers (Wine/Proton) beyond a GitHub Actions runner's disk and memory, so the bucket is hand-run only.
 
 ## 3. Distinction Between `fastGameSet` and CI Buckets
 
 - `fastGameSet` (`test/e2e/gamebot_helpers_e2e_test.go:29`) controls the **local / default developer filter** when `GAMEPLANE_E2E_GAMES` is unset.
 - `bucket_bot_fast` and `bucket_bot_heavy` in `test/e2e/buckets.sh` control **CI runner job segmentation**.
 - For the 13 new modules:
-  - `tmodloader` and `beammp` are added to `fastGameSet` in `gamebot_helpers_e2e_test.go` and bucketed in `bucket_bot_fast`.
-  - The 11 heavy modules are added to `heavyGameSet` in `gamebot_helpers_e2e_test.go` and bucketed in `bucket_bot_heavy` with explicit CI-exclusion justification comments.
+  - `tmodloader` and `beammp` are in `fastGameSet` (`test/e2e/gamebot_helpers_e2e_test.go`) for local runs, but are bucketed in `bucket_bot_heavy`, not `bucket_bot_fast`.
+  - The other 11 are in `heavyGameSet` and bucketed in `bucket_bot_heavy` with CI-exclusion justification comments.
+
+Table values above (protocol, `consoleMode`, ports, mount path, stop, CI bucket) were re-read from the shipped `modules/<game>/template.yaml` files and `test/e2e/buckets.sh` on 2026-10-11 (T143); the templates are authoritative. "unset" means the template leaves `consoleMode` to its default. The justification column is unchanged.

specs/015-top-steam-game-modules/plan.md

@@ -126,12 +126,16 @@ docs/
 
 ## Known Gaps (found during the 2026-10-09 refresh)
 
-These were found by comparing the shipped templates with this plan. They are not resolved here; each needs a fix or a maintainer ruling before the feature is closed out (T126).
+These were found by comparing the shipped templates with this plan. **Resolved 2026-10-11** by Phase 9 (T132-T146), except `hell-let-loose`, whose image ruling is still pending (T133, T138); see the note under each gap.
 
 1. **Placeholder image digests (FR-003, SC-002).** Ten of the 13 new modules pin `@sha256:0000…0000`: `ark-survival-evolved`, `arma-reforger`, `beammp`, `euro-truck-simulator-2`, `farming-simulator-25`, `fivem`, `hell-let-loose`, `mount-and-blade-2-bannerlord`, `squad`, `the-isle`. T119 (digest-pinning pass) is marked done, but these images were never pinned.
+   *Resolved (T141, T142):* nine of the ten now pin real digests (GameplanePanel/module#48); `validate.py` reports 0 errors across all 30 modules. `hell-let-loose` keeps its placeholder (a warning) until its ruling.
 2. **Images with no build source.** Six templates reference `ghcr.io/valgulnecron/gameplane/<game>` images that nothing in either repository builds: `mount-and-blade-2-bannerlord`, `the-isle`, `ark-survival-evolved`, `arma-reforger`, `hell-let-loose`, `squad`. `modules/build-images.sh` builds only the four images from research.md Decision 1. Either research.md Decision 1 widens to these six (with Dockerfiles), or the templates move to community images.
+   *Resolved (T133-T140, OPEN-DECISIONS §10):* `arma-reforger` moved to the ACE community image; `squad`, `the-isle`, `ark-survival-evolved` and `mount-and-blade-2-bannerlord` are built in this repo's `containers/games/` (#638), and the four original images moved there too (#651).
 3. **Stale registry owner.** All ten Gameplane-owned image refs use `ghcr.io/valgulnecron/gameplane/…`; the repositories moved to `GameplanePanel` in October 2026, and `build-images.sh`'s own usage example pushes to `ghcr.io/gameplanepanel/gameplane`.
+   *Resolved (T141):* every Gameplane-built ref now points at `ghcr.io/gameplanepanel/gameplane/…`, except `hell-let-loose`.
 4. **Planning matrix drift.** `engine-matrix-resolved.md` no longer matches several shipped templates, for example `palworld` stop (`save`, `shutdown 1`), `rust` stop (`server.save`, `quit`), `ark-survival-ascended` stop (`SaveWorld`, `DoExit`), `tmodloader` mount path (`/opt/terraria/config`), and the CI bucket for `tmodloader`/`beammp` (shipped in `bot-heavy`, matrix says `bot-fast`). The templates are authoritative.
+   *Resolved (T143):* `engine-matrix-resolved.md` was re-read from the shipped templates and `test/e2e/buckets.sh`.
 
 ---
 

specs/015-top-steam-game-modules/research.md

@@ -52,7 +52,7 @@ This research defines the architectural foundation, container configurations, pr
 - **Alternatives Considered**:
   - *Sourcing community images for all 26 games*: Rejected for the four auxiliary-service games because community images crash-loop when credentials are missing (violating FR-013) or fail to co-supervise required companion services in a single pod (violating FR-012).
   - *Building custom Gameplane base images for all 26 games*: Rejected because maintaining 26 bespoke upstream SteamCMD game downloaders introduces unnecessary maintenance overhead for standard games.
-- **Shipped state (2026-10-09)**: The four images are built from `modules/<game>/Dockerfile` + `entrypoint.sh` by `modules/build-images.sh`. Six further new modules (`mount-and-blade-2-bannerlord`, `the-isle`, `ark-survival-evolved`, `arma-reforger`, `hell-let-loose`, `squad`) also reference `ghcr.io/valgulnecron/gameplane/<game>` images, contrary to this decision, with no build source and placeholder digests. Whether this decision widens to cover them or they move to community images is open; see plan.md Known Gaps.
+- **Shipped state (2026-10-11, T133)**: Gameplane builds, publishes and cosign-signs eight images from `containers/games/<game>/` in GameplanePanel/Gameplane (`.github/workflows/images.yaml`) to `ghcr.io/gameplanepanel/gameplane/<game>`: the four above plus `squad`, `the-isle`, `ark-survival-evolved` and `mount-and-blade-2-bannerlord`, for which no suitable community image exists (OPEN-DECISIONS §10). `arma-reforger` uses the community `ghcr.io/acemod/arma-reforger`. `hell-let-loose` has no image yet; its ruling is pending.
 
 ### Decision 2: Single-Pod Auxiliary Service Supervision (Clarification Q1)