[gnuser]

Summary

Add the browser Studio alongside the CLI, with account-owned projects, persistent jobs, version restore/publishing, marketplace ratings, and a bounded game production pipeline. Includes image imports/generation/batches, study courses, optional Privy login, referrals and disabled-by-default PayPal credit purchases.

Studio request → ownership / quota / idempotency checks → persistent worker
  game → fixed plan → playable slice → read-only review → frozen browser checks → version
  image → validated PNG / grouped batch → immutable gallery version
  study → bounded extraction → question bank → saved practice progress

Review fixes upgrade Next.js to 16.4.3 and Studio Sharp to 0.35.5, correct lint configuration and React hook dependencies, preserve draft fields during polling, and add Studio type/unit checks to the existing workspace CI command. The diff includes two pre-existing local commits plus previously uncommitted Studio work and research notes.

Evidence

• Before: production build stopped on the Next.js security advisory; Studio was absent from test:ci, and lint rejected its Node tests and public Next.js entry points.
  After: production build, repository build/typecheck/lint, and lockfile validation passed. Studio checks now run in workspace CI.
• npm run test:ci: 6,536 passed, 10 skipped across CLI, core, SDK, Studio and script tests. Initial run lacked the legacy CLI Sharp native binary; rebuilt it and the rerun passed.
• Studio: 53 unit tests; 63 isolated PostgreSQL integration tests; 6 Docker runtime tests; 1 real-browser Web Audio test passed. Two Linux-only generator sandbox tests skipped on macOS.
• Included Studio/docs formatting checked; manifest-pinned regression fixtures/checkers and Next-generated declarations are excluded. Full lint excluded preserved unrelated local output/, tmp/, sites/, and tools/ directories.
• macOS, Node 22.12.0 and Docker. Builds retain optional Privy wallet/Farcaster dependency warnings; wallet login is disabled. Live Privy/PayPal flows were not exercised; payment tests simulate provider responses. Production payments remain disabled pending sandbox acceptance.
• npm run preflight was not invoked verbatim because it deletes installed dependencies and formats the whole dirty workspace; build, lint, typecheck and test checks were run separately. No production deployment or new metered model generation was performed in this review.

Merge Danger

Door: two-way for code before payment activation; database additions persist. After sales start, do not roll back to code that ignores paid-credit accounting.

Blast Radius: Studio

New SQL tables/columns, worker behavior and web dependencies. Core/CLI source is unchanged. Private generated output, temporary scripts, the unrelated traffic-monitor utility and nested site repository remain local and uncommitted. Research notes include local evidence links under output/; those artifacts are not part of this PR. Model-written acceptance cases and visual reviews are limited evidence, not proof of complete gameplay or audio quality.

No linked implementation issue: this PR delivers the user's explicit request to review existing work; creating a separate tracking issue was not authorized by automatic approval review. Leave open and unmerged.

Final PR review

Reviewed head: 9ac67c0040017e7a741ddb8a49d216c85ab7d17c; base remains c9bea37786af524bf3bbe802f2b67d23816fa5c0. All 229 GitHub file entries and blob hashes match the reviewed local diff. GitHub refuses the combined diff because it exceeds 20,000 lines; the per-file API was used to verify it. No merge conflicts or review comments were present.

Remote CI is blocked: Qwen Code CI run reports action_required, with zero jobs started. An upstream maintainer must resolve the workflow action/approval requirement. Local checks are green, but missing remote checks are not a CI pass and this PR is not yet declared merge-ready.