Version 1.42.1 Released

Version 1.42.1 is a dedicated stability release built from the full deep-code audit of v1.42.0.

Rather than adding new content, this update focuses on save integrity, browser storage, multi-tab safety, offline progression, Arcade persistence and itch.io package hardening.

All 19 findings from the audit have been addressed: 3 Critical, 5 High, 5 Medium and 6 Light.

Stronger Save Integrity

The primary save payload is now treated as authoritative when the save itself is structurally valid, preventing stale or damaged sidecar metadata from incorrectly rejecting a newer valid save.

Under IndexedDB, the main save and its metadata are now written together in one atomic read/write transaction. The game only considers the write durable after the transaction has successfully completed.

Injected transaction-failure testing confirmed that an interrupted write leaves the previous save and metadata together instead of producing a torn save pair.

Safer Multi-Tab Saving

Writer ownership between multiple browser tabs has been hardened.

IndexedDB writer-lease acquisition now uses a single transactional read → check → write operation, preventing two persistent tabs from simultaneously believing that both own the save.

In the dedicated concurrency test, exactly one of two competing writers acquired the lease.

IndexedDB Lifecycle Hardening

Several browser-storage race conditions have also been eliminated:

• delayed IndexedDB initialization can no longer replace a fallback storage mode after timeout
• cached values update only after successful transaction completion
• BroadcastChannel notifications are emitted only after committed writes
• main-save reconciliation is restricted to the Knights of Crystalis save namespace

Arcade Save Protection

The three Crystalis Arcade games now merge standalone and Knights of Crystalis progress instead of blindly replacing one save with the other.

This applies to:

• Pixel Sweep
• Monster Roamer
• Magic Puzzle Ball

Higher progression is preserved, persistent discoveries are merged, and best valid stage times are retained.

Offline & Mobile Resume Fixes

Stronghold offline progression can no longer reuse the same excess offline backlog repeatedly.

A 24-hour-away test with an 8-hour Stronghold capacity correctly produced 16 cycles on the first processing pass and 0 additional cycles on an immediate repeated tick.

The global trusted-clock ceiling has also been raised from one hour to 24 hours so individual systems can correctly enforce their own offline caps.

Mobile resume handling now reconciles monotonic timing with bounded wall-clock hidden duration, improving behavior on browsers that suspend timers while the app is backgrounded.

Import & Rendering Hardening

Imported card and inventory identifiers are now validated against a bounded safe identifier format before normalization and rendering.

Critical HTML data-attribute contexts receive additional escaping protection.

Save imports also wait for the asynchronous persistence queue before reporting durable success.

itch.io Package Hardening

The public build is now generated from an explicit runtime allowlist.

Only required game files and runtime assets are included. Historical QA reports, design notes, audit artifacts, fixture runners and .kocsave.json files are excluded from the public package.

Release metadata, PatchHerald, News defaults, boot text and cache metadata have also been synchronized to v1.42.1.