Live validation log

All items tested live against production servers via packet capture, validating static analysis of a from-scratch third-party client.

Confirmed flows

RSA+AES GSL envelope, SFS2X framing, SFSObject codec — byte-for-byte. Guest auto-creation; guest→email-verified account (account.login.new); CrossServerLogin into established accounts. Resource collection (building.production.collect, building.camp.collect) — hundreds of collections, 14 building types; Armed Truck idle reward lw.pve.idle.reward. Visitor greeting visitor.operate; alliance help-all al.help.all; gift claims alliance.reward.allreceive; tech donation science.data.refresh + al.science.donate; mail read/claim (350-entry mailbox); VIP daily claims (errorCode=120289 when already claimed); zone-migration redirect following; token-rotation recovery (ec=28, ep=[E011]); GSL opt=refresh; gateway-list fallback; Alliance Duel reads (hero.event.info.get {activityId: "70000"}); build.ccd.m.new speed-ups; radar Help Teammates.

Incidents

• Reconnect wall — early attempts varied un/at/shumeiBoxId; root cause = identity mismatch (iOS-issued token vs Android presentation) plus a ta blob required for established accounts (confirmed 2026-10-13: a filled Android ta logged in with 160 buildings; empty {} → E005).
• Server merge APS783→APS8092 — three redirect bugs fixed: serverInfo nested under p:, port decoding as UTF string, unreachable retry branch; a fourth resolved host:0 connections.
• Token rotations: 2026-10-02 (also 2026-08-16 — 16 failed runs / ~42 h) changed both at and shumeiBoxId; fixed by recapture; at.time is issue time, not expiry.
• "Missing init" root cause: unimplemented Zstd decompression (~313 KB payload) + SFSObject array bugs — five unimplemented array tags (LONG=13, FLOAT=14, DOUBLE=15, BOOL=9, SHORT=11) and BYTE_ARRAY (tag 10) using a 4-byte length prefix instead of 2-byte.

Building table (collect confirmation)

Farmland 10201000, Iron Mine 10202000, Gold Mine 10207000, Smelter 10209000, Material Workshop 10211000, Training Base 10210000 (item 8001), Oil Well 10221000, Drone Parts Workshop 10233000, Component Factory 10214000 (item 630011), Spore Factories 842000–845000, Tactical Institute 10235000 (321 collections), Crystal Factory 10310000, Spore Factory Weekly Pass 846000. NOT production lines (always errorCode=602026): Tactical Center, Armament Institute, Truck Stations I–IV (10138000–10141000). Armed Truck = 10115000 LW_BUILD_BATTLE_HANGUP_REWARD, claimed account-wide, no uuid.

Odds & ends

Full Login param list from LoginMessage.CSSetData; SecurityCode = MD5(cmdBaseTime + "4d1c383ccbedf3d98320d6ea06d8dedc" + uid). Mail uses string-GUID uids, group type (2 report, 3 alliance, 4 activity, 5 system, 6 daily, 7 charge, 8 favor, 9 season). Donation rate limit maxNum=30, charges refill every 20 min; errorCode=120471 = exhausted. Marches fail "token error" (E000000) for third-party clients until login.ext is answered. E005 maps client-side to ERROR_MAINTENANCE; E011 to ERROR_LOGIN_ACCESS_TOKEN.

Open items

Minimal required ta content; iOS own-device bind (third-party report only); address drift after migrations; server-side token invalidation requiring recapture.