engine: an item action has to survive the wire, not just a loopback (RFC 0021 follow-up)

[campavao]

Follow-up to #2284 (RFC 0021). The feature works in-process and does not work between two machines; this is the one line that was missing, plus the test that would have caught it.

The bug

opts.items puts the turn's item on the wire as { type = "action", kind = "item", item, index, move }. Wire.sanitize rebuilds every inbound message field by field from SCHEMAS[type] and drops anything the schema does not name, and SCHEMAS.action names only kind, slot and index. So item and move were stripped on the way in.

What the peer then receives is an item action with no item in it: LinkItems.apply returns {}, the turn is still spent, nothing is printed, and the two simulations part by one heal with nothing on either screen to say so — until a per-turn hash several turns later blames the wrong turn.

SCHEMAS.spectate calls the same sanitize, so a spectator was drifting for the same reason and is fixed by the same line.

Why #2284's tests are green

tests/engine/link_items.lua, and every other in-process link test, pairs the two sides with Net.loopbackPair, which hands the message table straight across. sanitize runs only on the way through Session, which is every real transport. The gap is invisible to a loopback pair by construction.

Found by a downstream mod's two-client harness on the first real duel with items on: the guest healed its lead 12 → 18 and the host watched its copy of that same Pokémon go 12 → 6.

The change

• src/link/Wire.lua — SCHEMAS.action gains item (a string id) and move (clamped to 1..MAX_MOVES), beside slot and index.
• tests/engine/link_items.lua — pins the schema directly: an item action through sanitize, the same through a spectate wrapper, and a move action that carries no item. A check a loopback pair cannot make.
• docs/rfcs/0021-link-battle-items.md — a section saying a new field on an existing message type is invisible until SCHEMAS names it, and describing the failure mode, so the next person adding one does not repeat it.

Verification

• luajit tests/run_link_tests.lua — ALL LINK TESTS PASSED
• luajit tests/engine/link_items.lua — 28/28
• luajit tests/run_engine.lua — 572/584, the same twelve reds as origin/dev with this branch stashed (audio device, shell-script scan, curl env, version dev identity and friends; none link-related)
• Two real clients over a local relay: the bag opens in a duel, the POTION rides the wire, the other machine applies the heal to its copy and prints it, and the fight keeps resolving turns afterwards.

[github-actions]

CI build artifacts

• Windows: gen1recomp-win64.zip
• Linux x86_64: gen1recomp-linux-x86_64.AppImage
• Android: gen1recomp-android.apk
• RG34XXSP: gen1recomp-rg34xxsp-stockos64-mod.zip
• Linux ARM SBC: gen1recomp-sbc-portmaster.zip

Commit: #e3ee1f7
Build Time: 2026-09-16 14:43:54 UTC

_{This comment was automatically generated. View workflow run}