fix: preserve Space Invaders taps between simulation frames

[zxxma]

Summary

Preserve completed Space Invaders fire taps until the fixed-step simulation consumes them. Previously pointer-up cleared the only fire state, so a tap between animation frames could be lost entirely. Polling on a high-refresh frame with no simulation step could also lose a press before the next step.

Separate non-consuming input reads from fixed-step acknowledgement and lifecycle reset. Coalesce completed taps into one bounded intent, preserve held firing, and avoid an extra release shot after a consumed hold. Cancellation/capture loss does not create a tap; normal release followed by implicit capture loss keeps an unconsumed tap. Pause, menu, new-run, blur/visibility and unmount boundaries clear stale input.

The engine, replay format, recorder and backend verifier are unchanged. Daily replay self-verification remains covered. The mobile regression now dispatches down/up in one browser task instead of relying on a 200ms hold; the original hidden assertion and timeout remain intact. No dependency, feature-flag, baseline or CI-policy changes.

Test plan

• Three deterministic regressions fail against the original application code and pass with this fix: between-frame tap, zero-step-frame polling, and exactly-once fire during play.
• Archived exact main 9500113c: iPhone and Pixel both fail the strengthened browser assertion with retries disabled.
• Fixed candidate: ten browser passes with retries disabled (five per platform).
• Space Invaders suite: 228 tests / 44 files, including cancellation, lifecycle reset and real daily replay self-verification.
• Clean lockfile installation, typecheck, lint, production build, bundle isolation, production/dev audits, attribution checks and byte-identical simulator-worker rebuild.
• Full Node20: 5,076 passed, one existing skip.
• Full Node22 coverage suite: 5,076 passed, one existing skip; statements 76.64%, branches 67.66%, functions 72.42%, lines 78.70%.
• Full Chromium: 229 passed, seven existing skips; desktop/iPhone/Pixel guardrails: 59 passed; unchanged visual snapshots: three passed. No retries.
• Backend module verification, native build, full race suite, lint and vulnerability gate; frozen workspace build/tests/audit and Buf lint/breaking checks.

Local Docker is unavailable; no shared daemon restart or settings changes attempted. Hosted image verification is required before merge. Native backend checks use the installed standalone compiler through a process-local setting, with no global toolchain change.

Merge before refreshing the proposed Dependabot sequence (#1190, #1189, #1192), so downstream checks inherit the deterministic mobile regression. #1191's incompatible historical Gno tag is excluded.

A separate, unpublished integration branch merged #1190 → #1189 → #1192 cleanly onto this fix. The combined dependency candidate passed native backend build/full race tests, frontend typecheck/lint/build/audits, and 319 focused transport/auth/multisig/privacy/game tests on each of Node20 and Node22. This compatibility evidence does not replace fresh exact-head CI and approval for each PR after its predecessor merges.

[netlify]

✅ Deploy Preview for memba-multisig ready!

Name	Link
🔨 Latest commit	99791fe
🔍 Latest deploy log	https://app.netlify.com/projects/memba-multisig/deploys/6aa8f986052445000860ceef
😎 Deploy Preview	https://deploy-preview-1201--memba-multisig.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 69 (🔴 down 6 from production) Accessibility: 97 (no change from production) Best Practices: 83 (no change from production) SEO: 90 (no change from production) PWA: 100 (no change from production) View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

The latest Buf updates on your PR. Results from workflow CI / proto (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 15, 2026, 7:53 AM

[zxxma]

Final validation — 99791feaec9aa01143bf89e8a71d7f4066bf1600

All hosted checks passed, including backend, Docker, both frontend runtimes, full Chromium, mobile guardrails, security/CodeQL, dependency review, Buf and workspaces. Final scoped code review found no actionable issue; no unresolved review threads remain. This is a validation report, not the required reviewer approval.

• Local frontend: 5,076 passed / one existing skip on each runtime. Hosted: 5,062 passed / 15 skipped on each runtime; fourteen optional Gno-dependent checks run locally but skip on the hosted runner.
• Chromium: 229 passed / seven existing skips; mobile/desktop guardrails: 59 passed. No hosted flaky result reported. Local unchanged visual snapshots: three passed.
• Exact Netlify deploy 6aa8f986052445000860ceef: ten game deep-link smoke passes, five fresh iPhone/WebKit and five Pixel/Chromium contexts, no retries. Writes and telemetry blocked; no wallet interaction.
• Preview limitations retained: an earlier root-to-game navigation probe was interrupted and home RPC access-control warnings occurred. The final result is for the game deep link, not a global navigation/network-health certification. The existing sale announcement appeared once in the final run and was dismissed normally; its configuration still needs a separate retirement follow-up.
• Existing total-JS and missing Lighthouse-artifact warnings remain. No thresholds, assertions, workflows or feature flags were weakened.

Ready for eligible reviewer approval and normal merge. Then refresh/revalidate #1190 → #1189 → #1192, each against its predecessor's merged main. Their local combined compatibility check passed and the order is documented on each PR. #1191 remains excluded because the historical Gno tag lacks required APIs. No mainnet deployment or protection bypass.