fix: presence, profile edits, outfit menu and RecNetResult writes for the 2023 client

Every change below was checked against the 2023-03-21 client disassembly;
file:line evidence is in the code comments and in
docs/recroom-2023-client-api-complete.md.

Presence
- matchmake/none means "online, in no room" (its only caller is
  TryGoToOfflineRoom, which ignores the reply). The server used to keep the
  old room or invent a dorm, so the next heartbeat looked out of sync and
  the client cancelled its load to chase that room.
- The join watchdog no longer clears presence 30 s into a long room load;
  it is a 3 minute backstop that drops the room only.
- One fan-out (PresenceBroadcastService) for every transition: deferred
  joins, matchmake/none, logout, failed joins, visibility changes, SignalR
  connect/disconnect. isOnline is sent on its own; pushes never go to the
  subject, because a self push moves the player.
- Online-status visibility (Public / Friends / Favorites / Appear offline)
  is stored and honoured by GET /player and by the live pushes.

Profile
- PUT account/me/{emoji,personalpronouns,identityflags,bannerimage} were
  404; added with the client's real form keys and persisted (new Players
  columns plus migration). Every account read now returns them, and edits
  push AccountUpdate to everyone.

Outfit menu
- Saved outfits kept OutfitSelectionsV2 and CustomAvatarItems, so loading a
  slot restores what was saved instead of a stale outfit.
- isCreationAllowedForAccount answers the {Success, Error} envelope the
  client parses; minPriceForPublicItem is a bare int; gifts/generate accepts
  form bodies; lockeditems returns the full owned-item shape; colourways no
  longer share their base item's AvatarItemId.

RecNetResult writes
- About 40 writes look status-only but parse the body as {Success, Error}.
  An empty 200 showed "Failed to ..." after the server applied the change,
  and a body without Success threw "Error message cannot be null". Clubs,
  announcements, keepsakes, comments/read, subscriptions, purchase offers
  and privacy settings now answer RecNetResult.
- Login token and device-code grants are real; remoteauth approves the
  device code; createlogintoken returns a bare string.
- New: incentivizedreferrals/referrals, account/bulk/{email,phone},
  GET strings, account/me/confirmphone, PlayMenuCarouselOrdering_1.
  Route inventory and coverage test extended to match.

README now describes the 2023 branch.

DorkNet.Server/Controllers/API/Account/AccountApiController.cs

@@ -57,17 +57,7 @@ public class AccountApiController(
         {
             Success = true,
             Error = string.Empty,
-            Account = new RecNetAccount
-            {
-                AccountId = (int)player.Id,
-                RawUsername = player.Username,
-                Username = player.Username,
-                DisplayName = player.DisplayName ?? player.Username,
-                ProfileImage = string.Empty,
-                TreatAsJunior = false,
-                HasBirthday = true,
-                Platforms = 1,
-            },
+            Account = AccountDtos.Public(player),
         });
     }
 
@@ -77,22 +67,7 @@ public class AccountApiController(
     {
         var player = await GetCurrentPlayerAsync();
         if (player is null) return Unauthorized();
-        return Ok(new RecNetSelfAccount
-        {
-            AccountId = (int)player.Id,
-            RawUsername = player.Username,
-            Username = player.Username,
-            DisplayName = player.DisplayName ?? player.Username,
-            ProfileImage = player.ProfileImageName ?? string.Empty,
-            TreatAsJunior = false,
-            HasBirthday = true,
-            Platforms = 1,
-            Email = player.Email ?? string.Empty,
-            Phone = string.Empty,
-            Birthday = new DateTime(2000, 1, 1),
-            JuniorState = 0,
-            ParentAccountId = null,
-        });
+        return Ok(AccountDtos.Self(player));
     }
 
     /// <summary>

DorkNet.Server/Controllers/API/Avatar/V2/AvatarGiftsController.cs

@@ -50,7 +50,18 @@ public class AvatarGiftsController(
         return Ok(rows.Select(ToWire));
     }
 
-    public sealed record GenerateGiftRequest(int? GiftContext, bool? IsGameGift, int? AlternateGiftContext, string? Message);
+    /// <summary>Body keys are the client's AFGEDDANEKP param literals
+    /// (GiftContext / IsGameGift / AlternateGiftContext / Message). A class
+    /// with settable properties, not a positional record, because
+    /// <see cref="Binding.FormOrJsonModelBinder"/> constructs it empty and
+    /// fills it.</summary>
+    public sealed class GenerateGiftRequest
+    {
+        public int? GiftContext { get; set; }
+        public bool? IsGameGift { get; set; }
+        public int? AlternateGiftContext { get; set; }
+        public string? Message { get; set; }
+    }
 
     /// <summary>POST <c>api/avatar/v2/gifts/generate</c> — the end-of-
     /// activity gift box (chest). For a game/quest gift (IsGameGift) the
@@ -64,8 +75,13 @@ public class AvatarGiftsController(
     // POST 404'd, breaking reward chests on that path). Same request body.
     [HttpPost("api/avatar/v2/gifts/generate")]
     [HttpPost("api/avatar/v3/gifts/generate")]
+    // The client adds each field with AFGEDDANEKP (FFFIMAGLKEG.txt:1930-2013,
+    // POST = ordinal 2), which goes out form-urlencoded: a live trace showed
+    // `GiftContext=12000&IsGameGift=True&Message=…` answered 415 while this
+    // was [FromBody]. The form-or-JSON binder accepts either encoding.
     [Consumes("application/json", "application/x-www-form-urlencoded", "multipart/form-data")]
-    public async Task<IActionResult> Generate([FromBody] GenerateGiftRequest? req)
+    public async Task<IActionResult> Generate(
+        [ModelBinder(typeof(DorkNet.Server.Binding.FormOrJsonModelBinder))] GenerateGiftRequest? req)
     {
         var pid = this.RequireCurrentPlayerId();
         var isGameGift = req?.IsGameGift ?? false;

DorkNet.Server/Controllers/API/Avatar/V3/AvatarSavedOutfitsController.cs

@@ -4,16 +4,21 @@ using Microsoft.EntityFrameworkCore;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using DorkNet.Server.Auth;
+using DorkNet.Server.Controllers.API.Avatar.V2;
 using DorkNet.Server.Data;
 using DorkNet.Server.Data.Entities;
 
 namespace DorkNet.Server.Controllers.API.Avatar.V3;
 
 /// <summary>
-/// api.rec.net/api/avatar/v{2,3}/saved — saved-outfit slots. Wire
-/// type <c>RecNet.SavedOutfit</c> (per agent ISIL extraction):
-/// <c>Slot(int), PreviewImageName(string), OutfitSelections(string),
-/// FaceFeatures(string), SkinColor(string), HairColor(string)</c>.
+/// api.rec.net/api/avatar/v{2,3}/saved — saved-outfit slots. Client wire
+/// type BEPMJICDNDD, whose converter IMMOJHBENFI registers exactly
+/// <c>Slot, PreviewImageName, OutfitSelections, OutfitSelectionsV2,
+/// FaceFeatures, SkinColor, HairColor, CustomAvatarItems</c>
+/// (RecNet.Runtime/IMMOJHBENFI.txt:587-766 reader, :781-910 writer).
+/// CustomAvatarItems is a list of BGNNOMBFMLH
+/// <c>{CustomAvatarItemId, BodyPart}</c>, the same element the avatar
+/// settings (<c>api/avatar/v2</c>) use.
 ///
 /// State persists in <see cref="AvatarEntity.SavedOutfitsJson"/> as
 /// a JSON list of <see cref="SavedOutfitDto"/> records keyed by
@@ -38,12 +43,27 @@ public class AvatarSavedOutfitsController(DorkNetDbContext db) : ControllerBase
     }
 
     /// <summary>POST <c>v3/saved/set</c> — upsert one outfit by Slot.
-    /// Body is the SavedOutfit shape directly.</summary>
+    /// Verb ordinal 2 = POST with a raw JSON body of one serialised
+    /// BEPMJICDNDD (RecNet.Runtime/FFFIMAGLKEG.txt:4071-4095, NCILAADFJMM).
+    ///
+    /// Parsed by hand rather than <c>[FromBody] SavedOutfitDto</c>: the old
+    /// DTO silently dropped OutfitSelectionsV2 and CustomAvatarItems, and the
+    /// 2023 client wears OutfitSelectionsV2 whenever it is non-empty
+    /// (BEPMJICDNDD.NLGCNDMLACA, BEPMJICDNDD.txt:237-266, falls back to
+    /// OutfitSelections only when V2 is empty). Loading a saved slot
+    /// therefore restored a stale V1 selection (or nothing) and lost every
+    /// custom shirt in it.</summary>
     [HttpPost("api/avatar/v3/saved/set")]
     [HttpPost("api/avatar/v2/saved/set")]
-    public async Task<IActionResult> Set([FromBody] SavedOutfitDto body)
+    public async Task<IActionResult> Set()
     {
+        string raw;
+        using (var reader = new StreamReader(Request.Body))
+            raw = await reader.ReadToEndAsync();
+
+        var body = ParseOutfit(raw);
         if (body is null) return BadRequest("missing body");
+
         var pid = this.RequireCurrentPlayerId();
         var avatar = await db.Avatars.FirstOrDefaultAsync(a => a.PlayerId == pid);
         if (avatar is null)
@@ -59,6 +79,7 @@ public class AvatarSavedOutfitsController(DorkNetDbContext db) : ControllerBase
             if (list.Count >= MaxSlots) return BadRequest($"max {MaxSlots} saved outfits per player");
             list.Add(body);
         }
+        list.Sort((a, b) => a.Slot.CompareTo(b.Slot));
         avatar.SavedOutfitsJson = JsonSerializer.Serialize(list);
         avatar.UpdatedAt = DateTime.UtcNow;
         await db.SaveChangesAsync();
@@ -81,12 +102,91 @@ public class AvatarSavedOutfitsController(DorkNetDbContext db) : ControllerBase
         return Ok();
     }
 
+    /// <summary>Read one outfit object, matching keys case-insensitively
+    /// (the client reader accepts Pascal/camel/lower spellings, so any of
+    /// them is a valid write). String fields tolerate null; a nested
+    /// object/array is kept as its raw JSON text, mirroring how
+    /// <c>avatar/v2/set</c> treats the same fields. Returns null for a body
+    /// that is not a JSON object.</summary>
+    internal static SavedOutfitDto? ParseOutfit(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return null;
+        try
+        {
+            using var doc = JsonDocument.Parse(raw);
+            var root = doc.RootElement;
+            if (root.ValueKind != JsonValueKind.Object) return null;
+
+            var dto = new SavedOutfitDto();
+            foreach (var prop in root.EnumerateObject())
+            {
+                switch (prop.Name.ToLowerInvariant())
+                {
+                    case "slot":
+                        if (prop.Value.ValueKind == JsonValueKind.Number && prop.Value.TryGetInt32(out var slot)) dto.Slot = slot;
+                        else if (prop.Value.ValueKind == JsonValueKind.String && int.TryParse(prop.Value.GetString(), out slot)) dto.Slot = slot;
+                        break;
+                    case "previewimagename": dto.PreviewImageName = AsString(prop.Value); break;
+                    case "outfitselections": dto.OutfitSelections = AsString(prop.Value); break;
+                    case "outfitselectionsv2": dto.OutfitSelectionsV2 = AsString(prop.Value); break;
+                    case "facefeatures": dto.FaceFeatures = AsString(prop.Value); break;
+                    case "skincolor": dto.SkinColor = AsString(prop.Value); break;
+                    case "haircolor": dto.HairColor = AsString(prop.Value); break;
+                    case "customavataritems": dto.CustomAvatarItems = AsCustomItems(prop.Value); break;
+                }
+            }
+            return dto;
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    private static string AsString(JsonElement v) => v.ValueKind switch
+    {
+        JsonValueKind.String => v.GetString() ?? string.Empty,
+        JsonValueKind.Null or JsonValueKind.Undefined => string.Empty,
+        _ => v.GetRawText(),
+    };
+
+    /// <summary>BGNNOMBFMLH list. Elements without a parseable guid are
+    /// dropped instead of failing the whole save.</summary>
+    private static List<CustomAvatarItemRefDto> AsCustomItems(JsonElement v)
+    {
+        var result = new List<CustomAvatarItemRefDto>();
+        if (v.ValueKind != JsonValueKind.Array) return result;
+        foreach (var el in v.EnumerateArray())
+        {
+            if (el.ValueKind != JsonValueKind.Object) continue;
+            Guid? id = null;
+            byte bodyPart = 0;
+            foreach (var p in el.EnumerateObject())
+            {
+                if (p.Name.Equals("CustomAvatarItemId", StringComparison.OrdinalIgnoreCase)
+                    && p.Value.ValueKind == JsonValueKind.String
+                    && Guid.TryParse(p.Value.GetString(), out var g))
+                    id = g;
+                else if (p.Name.Equals("BodyPart", StringComparison.OrdinalIgnoreCase)
+                    && p.Value.ValueKind == JsonValueKind.Number
+                    && p.Value.TryGetByte(out var b))
+                    bodyPart = b;
+            }
+            if (id is { } guid) result.Add(new CustomAvatarItemRefDto { CustomAvatarItemId = guid, BodyPart = bodyPart });
+        }
+        return result;
+    }
+
     private static List<SavedOutfitDto> ParseList(string? json)
     {
         if (string.IsNullOrWhiteSpace(json)) return new();
         try
         {
-            return JsonSerializer.Deserialize<List<SavedOutfitDto>>(json) ?? new();
+            var list = JsonSerializer.Deserialize<List<SavedOutfitDto>>(json) ?? new();
+            // Rows written before CustomAvatarItems existed carry no key;
+            // keep the wire array non-null.
+            foreach (var o in list) o.CustomAvatarItems ??= new();
+            return list;
         }
         catch { return new(); }
     }
@@ -97,7 +197,14 @@ public sealed class SavedOutfitDto
     [JsonPropertyName("Slot")] public int Slot { get; set; }
     [JsonPropertyName("PreviewImageName")] public string PreviewImageName { get; set; } = string.Empty;
     [JsonPropertyName("OutfitSelections")] public string OutfitSelections { get; set; } = string.Empty;
+    /// <summary>The selection the 2023 client actually wears when non-empty
+    /// (BEPMJICDNDD.NLGCNDMLACA). Rows saved before this field existed
+    /// deserialize to "" and the client falls back to OutfitSelections.</summary>
+    [JsonPropertyName("OutfitSelectionsV2")] public string OutfitSelectionsV2 { get; set; } = string.Empty;
     [JsonPropertyName("FaceFeatures")] public string FaceFeatures { get; set; } = string.Empty;
     [JsonPropertyName("SkinColor")] public string SkinColor { get; set; } = string.Empty;
     [JsonPropertyName("HairColor")] public string HairColor { get; set; } = string.Empty;
+    /// <summary>Custom shirts worn in this slot. Always an array on the wire
+    /// (the client's ctor allocates an empty list, BEPMJICDNDD.txt:321-360).</summary>
+    [JsonPropertyName("CustomAvatarItems")] public List<CustomAvatarItemRefDto> CustomAvatarItems { get; set; } = new();
 }

DorkNet.Server/Controllers/API/Avatar/V4/AvatarItemsController.cs

@@ -173,7 +173,12 @@ public class AvatarItemsController(
                 {
                     AvatarItemType = item.AvatarItemType,
                     AvatarItemDesc = ToWatchDesc(entry.FullDesc),
-                    AvatarItemId = item.AvatarItemId,
+                    // Hash the FULL desc, as the toggle-on path does: a
+                    // player can own the base item and several colorways of
+                    // it at once (entries dedupe by FullDesc), and reusing the
+                    // base id made them collide in the client's id-keyed
+                    // wardrobe.
+                    AvatarItemId = StableAvatarItemIdFull(ToWatchDesc(entry.FullDesc)),
                     PlatformMask = item.PlatformMask,
                     FriendlyName = item.FriendlyName,
                     Tooltip = item.Tooltip,
@@ -328,20 +333,19 @@ public class AvatarItemsController(
                 owned.Add(guid);
         }
 
+        // The client parses this as List<IFNGBPJGINL> — the SAME element as
+        // v4/items (FFFIMAGLKEG.txt:3222-3465, NBLIDNCEELM), read by
+        // CLIANCNHNIE which registers TagList / AvatarItemId /
+        // IsBaseAvatarItem too (CLIANCNHNIE.txt). The old 5-key subset left
+        // every locked row at AvatarItemId 0 with a null TagList, so ship
+        // the full catalog DTO.
         var catalog = _catalog.Value.Items;
         var rows = requested
             .Where(guid => !owned.Contains(guid))
             .Distinct(StringComparer.OrdinalIgnoreCase)
             .Select(guid => catalog.TryGetValue(guid, out var item) ? item : null)
             .Where(item => item is not null)
-            .Select(item => new
-            {
-                item!.AvatarItemType,
-                item.AvatarItemDesc,
-                item.FriendlyName,
-                item.Tooltip,
-                item.Rarity,
-            })
+            .Select(item => item!)
             .ToArray();
         return Ok(rows);
     }
@@ -561,9 +565,8 @@ public class AvatarItemsController(
     /// <summary>Stable, deterministic, non-zero 31-bit id for an owned
     /// avatar item, derived from its base GUID (FNV-1a). The 2023 client
     /// keys the wardrobe by <c>AvatarItemId</c>, so it must be unique per
-    /// item and stable across restarts. Colored variants reuse their base
-    /// item's id (a player owns the base OR a variant, never both in the
-    /// list), so no collision.</summary>
+    /// item and stable across restarts. Colored variants must NOT use this — a player can own the base and
+    /// several colorways together; see <see cref="StableAvatarItemIdFull"/>.</summary>
     public static int StableAvatarItemId(string? avatarItemDescOrGuid)
     {
         var guid = (avatarItemDescOrGuid ?? string.Empty).Split(',')[0];

DorkNet.Server/Controllers/API/Comments/CommentsController.cs

@@ -268,8 +268,11 @@ public class CommentsController(DorkNetDbContext db) : ControllerBase
     /// <see cref="UnreadCounts"/> return non-zero numbers for everyone else).
     ///
     /// <c>OPELMBNJHNO.MCOIDIBFHIP(Int64 roomId, Int64 commentId)</c>
-    /// (OPELMBNJHNO.txt:1375) returns the status-only <c>LDGADANDBIO</c>, not a
-    /// DTO — the body is never parsed, only the status code. Verb is <b>PUT</b>
+    /// (OPELMBNJHNO.txt:1375) returns the untyped <c>LDGADANDBIO</c> promise, but
+    /// it is built from the body parsed as a RecNetResult: the continuation
+    /// <c>&lt;UpdateLatestReadComment&gt;b__9_1(DJMHAFPGLLN)</c>
+    /// (OPELMBNJHNO_NestedType___c.txt:333) null-derefs an empty body and
+    /// rejects on <c>Success</c>=false — see <see cref="RecNetResults"/>. Verb is <b>PUT</b>
     /// (rdx=3 at instr 059, OPELMBNJHNO.txt:1637); both ids are path segments
     /// formatted into "comments/read/{0}/{1}" (:1627) and no field is added, so
     /// the request carries no body at all.
@@ -280,7 +283,7 @@ public class CommentsController(DorkNetDbContext db) : ControllerBase
     {
         await SetLastReadAsync(Me, roomId, commentId);
         await db.SaveChangesAsync();
-        return Ok();
+        return RecNetResults.Ok();
     }
 
     /// <summary>Deletes a comment.

DorkNet.Server/Controllers/API/Config/V1/ConfigController.cs

@@ -129,14 +129,19 @@ public class ConfigController(ConfigService configService) : ControllerBase
     /// Returns a broad default set so the picker is populated.</summary>
     [HttpGet("/emojiConfig/whitelistedEmojis")]
     [Microsoft.AspNetCore.Authorization.AllowAnonymous]
-    public IActionResult WhitelistedEmojis() => Ok(new[]
+    public IActionResult WhitelistedEmojis() => Ok(WhitelistedEmojiList);
+
+    /// <summary>The emoji allow-list served above. Also the validation set
+    /// for <c>PUT account/me/emoji</c>, so a player can only pick an emoji
+    /// the client's own picker offered.</summary>
+    public static readonly IReadOnlyList<string> WhitelistedEmojiList = new[]
     {
         "😀", "😁", "😂", "🤣", "😊", "😇", "🙂", "😉", "😍", "😘",
         "😜", "🤪", "😎", "🤩", "🥳", "😏", "😢", "😭", "😡", "🤯",
         "😱", "😴", "🤔", "🤗", "🙄", "😬", "👍", "👎", "👏", "🙌",
         "🙏", "💪", "✌️", "🤞", "👋", "🤝", "❤️", "🔥", "⭐", "✨",
         "🎉", "🎊", "💯", "😈", "👻", "🤖", "🎮", "🏆",
-    });
+    };
 
     /// <summary>GET <c>api/config/v1/freegiftbutton</c> — the
     /// 2020.12 client deserializes this endpoint as a raw Boolean.

DorkNet.Server/Controllers/API/CustomAvatarItems/CustomAvatarItemsController.cs

@@ -371,11 +371,22 @@ public class CustomAvatarItemsController(
         var allowed = player is not null
             && !player.IsJunior
             && (player.BannedUntil is null || player.BannedUntil <= DateTime.UtcNow);
-        // Bare JSON boolean, like the two sibling gates below: the client's
-        // issuing method is FGLDKEJLAKB<System.Boolean> GGMDLMLJDDK()
-        // (RecNet.Runtime/MPBLNLMCEDL.txt:6048, route literal on :6205), so an
-        // object body threw and the can-create gate blocked shirt creation.
-        return Content(allowed ? "true" : "false", "application/json");
+        // NOT a bare boolean, unlike the two sibling gates below. The issuing
+        // method GGMDLMLJDDK (RecNet.Runtime/MPBLNLMCEDL.txt:6048, route on
+        // :6205) parses the body as DJMHAFPGLLN — {Boolean @0x10, String} —
+        // (generic token 0x188477F70 at :6216; Func<DJMHAFPGLLN,…> at :6223)
+        // and its success continuation HONEEPBHNLB reads the bool at +0x10
+        // (:9155-9216).
+        // DJMHAFPGLLN's converter LMCCNLLHLCJ registers exactly the keys
+        // "Success" and "Error" (LMCCNLLHLCJ.txt:191-254). A bare `true`
+        // failed that parse, so the client logged "Failed to query if local
+        // account can create Custom Avatar Items: An error occurred" and
+        // treated the account as unable to create shirts.
+        return Ok(new Dictionary<string, object?>
+        {
+            ["Success"] = allowed,
+            ["Error"] = allowed ? null : "Custom avatar item creation is not available for this account.",
+        });
     }
 
     [HttpGet("isCreationEnabled")]
@@ -386,22 +397,17 @@ public class CustomAvatarItemsController(
     [AllowAnonymous]
     public IActionResult IsRenderingEnabled() => Content("true", "application/json");
 
-    /// <summary>The client DTO (IHLMDLKOLNB) is an object with exactly one
-    /// Int32 property, but its accessor name (GFGCCNBDKAK) appears nowhere
-    /// else in the dump, so — unlike Price/BaseAvatarItemId/Color, which are
-    /// pinned by accessors shared with NOAAFNFJPFB — the JSON key is NOT
-    /// recoverable. All four spellings below are UNPROVEN hedges; Newtonsoft
-    /// ignores the ones that don't match, and a total miss falls back to the
-    /// DTO's static default (IHLMDLKOLNB.txt:75-117) rather than throwing.</summary>
+    /// <summary>Bare JSON integer. The client's IHLMDLKOLNB pricing config is
+    /// built CLIENT-side: HCBOHHEACPK sends through FDKKOPAPDGF&lt;Int32&gt;
+    /// (RecNet.Runtime/MPBLNLMCEDL.txt:6922 — the same generic token
+    /// 0x18847B0B8 as the bare-Int32 itemOwnershipLimit call at :2981) and
+    /// continues with <c>&lt;GetPricingConfig&gt;b__69_0(Int32 minimumPrice)</c>
+    /// (MPBLNLMCEDL_NestedType___c.txt:286). An object body failed the Int32
+    /// parse, so the designer's public-price floor never loaded.</summary>
     [HttpGet("minPriceForPublicItem")]
     [AllowAnonymous]
-    public IActionResult MinPriceForPublicItem() => Ok(new
-    {
-        MinPrice = MinPublicItemPrice,
-        Price = MinPublicItemPrice,
-        MinimumPrice = MinPublicItemPrice,
-        MinPriceForPublicItem = MinPublicItemPrice,
-    });
+    public IActionResult MinPriceForPublicItem()
+        => Content(MinPublicItemPrice.ToString(System.Globalization.CultureInfo.InvariantCulture), "application/json");
 
     /// <summary>GET api/customAvatarItems/v1/design — hand back the caller's
     /// saved in-progress shirt design. Verb ordinal 0 = GET

DorkNet.Server/Controllers/API/IncentivizedReferrals/IncentivizedReferralsController.cs

@@ -34,6 +34,58 @@ public class IncentivizedReferralsController(DorkNetDbContext db, LevelService l
         });
     }
 
+    /// <summary>The caller's referred players, paged.
+    ///
+    /// <c>FGLDKEJLAKB&lt;GPJIMAHMAIO&gt; EGEEFJHAGAM(Int32? take, String continuationToken)</c>
+    /// (RecNet.Runtime/LINKIECPDML.txt:337) builds this through the URL builder
+    /// LPPEFJMCJFN ("api/incentivizedreferrals/" + "referrals", :677-701, with
+    /// <c>take</c> and <c>continuationToken</c> query params at :716/:737) — which
+    /// is why the plain route-literal sweep never saw it — and issues a GET
+    /// (:164-170). Reply formatter KOEEACLMAFE.txt:203-238:
+    /// <c>{Referrals: [...], ContinuationToken: string}</c>; each entry
+    /// (ADAFNGNADFH.txt:279-346) is <c>{InviteeAccountId: Int32, CreatedAt:
+    /// DateTime, VerifiedAt: DateTime?}</c>.
+    ///
+    /// A referral is recorded when a brand-new player redeems the caller's
+    /// referral code (LinkController.CreditReferralAsync), and that redemption
+    /// is what counts it, so it is verified at the moment it is created. The
+    /// continuation token is the next offset; null once the list is exhausted.</summary>
+    [HttpGet("referrals")]
+    public async Task<IActionResult> Referrals([FromQuery] int? take, [FromQuery] string? continuationToken)
+    {
+        var size = Math.Clamp(take ?? 20, 1, 100);
+        var offset = int.TryParse(continuationToken, out var parsed) && parsed > 0 ? parsed : 0;
+        var prefix = $"referral:credited:{Me}:";
+
+        var rows = await db.PlayerSettings
+            .Where(s => s.Key.StartsWith(prefix))
+            .OrderByDescending(s => s.Id)
+            .Skip(offset)
+            .Take(size + 1)
+            .Select(s => new { s.PlayerId, s.Value })
+            .ToListAsync();
+
+        var page = rows.Take(size).Select(r =>
+        {
+            var at = DateTime.TryParse(r.Value, null,
+                System.Globalization.DateTimeStyles.RoundtripKind, out var credited)
+                ? credited
+                : DateTime.UnixEpoch;
+            return new
+            {
+                InviteeAccountId = (int)r.PlayerId,
+                CreatedAt = at,
+                VerifiedAt = (DateTime?)at,
+            };
+        }).ToList();
+
+        return Ok(new
+        {
+            Referrals = page,
+            ContinuationToken = rows.Count > size ? (offset + size).ToString() : null,
+        });
+    }
+
     // Client contract: the claim response deserializes as a top-level
     // List<RewardSelection> where each entry is
     // { rewardSelectionId: long, rewardType: string } (RecNet.Runtime

DorkNet.Server/Controllers/API/Keepsakes/KeepsakesController.cs

@@ -208,8 +208,10 @@ public class KeepsakesController(DorkNetDbContext db, DomainConfig domain) : Con
     /// <c>DELETE api/keepsakes/{guid}</c> - <c>NCCLEJPIABA.JBKENCNIEPA(System.Guid)</c> builds
     /// <c>String.Format("{0}/{1}", "api/keepsakes", guid)</c> and passes verb 4 (DELETE) to the
     /// BNDIAONDFFF ctor (NCCLEJPIABA.txt:1544, 1687-1698 - <c>Move rdx, 4</c>). Its return type is
-    /// the non-generic <c>LDGADANDBIO</c> promise, so no response body is deserialised; a bare 200
-    /// is enough. Client-side the tool refuses unless the caller is at least a room co-owner
+    /// the non-generic <c>LDGADANDBIO</c> promise, but that promise comes from
+    /// <c>BFDGEKKNAPB.PEFKBAEAOPD</c> (ExpandRecNetResult) — the body IS parsed, as a
+    /// <c>{success,error}</c> RecNetResult, and an empty 200 null-derefs into a failed delete.
+    /// See <see cref="RecNetResults"/>. Client-side the tool refuses unless the caller is at least a room co-owner
     /// ("Must be at least a room co-owner to modify keepsakes.",
     /// RecRoom.Keepsakes.Runtime/PDFJLLECNBE.txt:3363), which we re-check server-side.
     /// </summary>
@@ -235,7 +237,7 @@ public class KeepsakesController(DorkNetDbContext db, DomainConfig domain) : Con
         db.Keepsakes.RemoveRange(orphanedCollections
             .Where(k => TryParseCollectionKey(k.EventKey, out _, out var id) && id == keepsakeInstanceId));
         await db.SaveChangesAsync();
-        return Ok();
+        return RecNetResults.Ok();
     }
 
     /// <summary>

DorkNet.Server/Controllers/API/PlayerEvents/PlayerEventsController.cs

@@ -1145,10 +1145,17 @@ public class PlayerEventsController(
         extras.SupportMultiInstanceRoomChat =
             await ReadBoolFieldAsync("supportsMultiInstanceRoomChat", "supportMultiInstanceRoomChat",
                 "SupportMultiInstanceRoomChat") ?? false;
-        extras.DefaultBroadcastPermissions =
-            await ReadIntFieldAsync("defaultBroadcastPermissions", "DefaultBroadcastPermissions") ?? 0;
-        extras.CanRequestBroadcastPermissions =
-            await ReadIntFieldAsync("canRequestBroadcastPermissions", "CanRequestBroadcastPermissions") ?? 0;
+        // These two are boxed enums (typeof(AKFCIMLMAKA) at
+        // CBKANFIOBCF_NestedType_EONGJBMLEFO.txt:117-165), and a boxed non-string
+        // field goes through Object.ToString (BNDIAONDFFF.txt:947, ISIL 107-110),
+        // so they arrive as member NAMES. int.TryParse failed on every one and
+        // the settings were always stored as 0.
+        extras.DefaultBroadcastPermissions = ParseBroadcastPermissions(
+            await ReadStringFieldAsync("defaultBroadcastPermissions", "DefaultBroadcastPermissions"))
+            ?? extras.DefaultBroadcastPermissions;
+        extras.CanRequestBroadcastPermissions = ParseBroadcastPermissions(
+            await ReadStringFieldAsync("canRequestBroadcastPermissions", "CanRequestBroadcastPermissions"))
+            ?? extras.CanRequestBroadcastPermissions;
 
         await SaveExtrasAsync(evt, extras);
         return Ok(await WrapperAsync(evt));
@@ -1437,6 +1444,33 @@ public class PlayerEventsController(
             : null;
     }
 
+    /// <summary>Broadcast-permission mode as a number. Members per the
+    /// 2023.06.21 dump (enum KJJFEBEMPKM, mapped by
+    /// EventsConfig.BroadcastPermissionsModeFriendlyNameMapping): None = 0,
+    /// RoomOwners = 256, All = Int32.MaxValue. Accepts the number itself (JSON
+    /// bodies send numbers), a member name, or a comma-joined flags string.
+    /// Null when the value is absent or unrecognised, so the stored setting is
+    /// kept rather than silently zeroed.</summary>
+    public static int? ParseBroadcastPermissions(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return null;
+        if (int.TryParse(raw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var n)) return n;
+        var total = 0;
+        foreach (var part in raw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            int? value = part.ToLowerInvariant() switch
+            {
+                "none" => 0,
+                "roomowners" => 256,
+                "all" => int.MaxValue,
+                _ => null,
+            };
+            if (value is null) return null;
+            total |= value.Value;
+        }
+        return total;
+    }
+
     private async Task<int?> ReadIntFieldAsync(params string[] names)
     {
         var value = await ReadStringFieldAsync(names);

DorkNet.Server/Controllers/API/PlayerWarnings/PlayerWarningsController.cs

@@ -48,14 +48,18 @@ public class PlayerWarningsController(DorkNetDbContext db) : ControllerBase
             .Where(p => p.Id == me)
             .Select(p => (bool?)(p.IsAdmin || p.IsDeveloper || p.IsCommunityTeam))
             .FirstOrDefaultAsync();
+        // Both calls are read as DJMHAFPGLLN = {Success, Error} (the formatter,
+        // RecNet.Runtime/LMCCNLLHLCJ.txt:191-218, knows no "Message" key). A
+        // failure without Error reached Promise.Rejected(null) and threw
+        // "Error message cannot be null" instead of showing the reason.
         if (moderator != true)
-            return Ok(new { Success = false, Message = "not_authorized" });
+            return Ok(new { Success = false, Error = "not_authorized", Message = "not_authorized" });
 
         var target = warnedPlayerId
                      ?? (long.TryParse(Request.Query["WarnedPlayerId"].FirstOrDefault(), out var q) ? q : 0);
-        if (target <= 0) return Ok(new { Success = false, Message = "missing_player" });
+        if (target <= 0) return Ok(new { Success = false, Error = "missing_player", Message = "missing_player" });
         if (!await db.Players.AnyAsync(p => p.Id == target))
-            return Ok(new { Success = false, Message = "player_not_found" });
+            return Ok(new { Success = false, Error = "player_not_found", Message = "player_not_found" });
 
         // Same "warning:{id}|message|category|createdAt|acknowledged" layout the
         // GET list handler parses in ToWarningWire.
@@ -75,7 +79,7 @@ public class PlayerWarningsController(DorkNetDbContext db) : ControllerBase
                 "false"),
         });
         await db.SaveChangesAsync();
-        return Ok(new { Success = true, Message = string.Empty, WarningId = id });
+        return Ok(new { Success = true, Error = string.Empty, Message = string.Empty, WarningId = id });
     }
 
     /// <summary>The 2023-03-21 client's acknowledge call takes NO arguments —
@@ -104,19 +108,19 @@ public class PlayerWarningsController(DorkNetDbContext db) : ControllerBase
                 .OrderByDescending(s => s.Id)
                 .ToListAsync();
             row = rows.FirstOrDefault(s => !ToWarningWire(s).Acknowledged);
-            if (row is null) return Ok(new { Success = true, Message = string.Empty });
+            if (row is null) return Ok(new { Success = true, Error = string.Empty, Message = string.Empty });
         }
         else
         {
             row = await db.PlayerSettings
                 .FirstOrDefaultAsync(s => s.PlayerId == me && s.Key == $"warning:{id}");
-            if (row is null) return Ok(new { Success = true, Message = string.Empty });
+            if (row is null) return Ok(new { Success = true, Error = string.Empty, Message = string.Empty });
         }
 
         var parts = row.Value.Split('|');
         row.Value = string.Join('|', parts.Take(3).Append("true"));
         await db.SaveChangesAsync();
-        return Ok(new { Success = true, Message = string.Empty, WarningId = row.Key["warning:".Length..] });
+        return Ok(new { Success = true, Error = string.Empty, Message = string.Empty, WarningId = row.Key["warning:".Length..] });
     }
 
     private static WarningWire ToWarningWire(DorkNet.Server.Data.Entities.PlayerSettingEntity row)

DorkNet.Server/Controllers/API/RoomCurrencies/RoomCurrenciesController.cs

@@ -284,7 +284,11 @@ public class RoomCurrenciesController(DorkNetDbContext db, LevelService level) :
         offer.IsDeleted = true;
         offer.UpdatedAt = DateTime.UtcNow;
         await db.SaveChangesAsync();
-        return Ok(ToOfferWire(offer, currency));
+        // MIHKAJFMIPE.OHCONDGELJB hands this body to BFDGEKKNAPB.PEFKBAEAOPD
+        // (ExpandRecNetResult): it is a {success,error} RecNetResult, not the
+        // offer. The offer wire has no Success key, so it parsed as a failure
+        // with a null Error and the delete toast threw instead of closing.
+        return RecNetResults.Ok();
     }
 
     /// <summary>Both verbs are mapped on purpose: the client picks GET or POST at

DorkNet.Server/Controllers/API/Subscriptions/SubscriptionsController.cs

@@ -177,7 +177,10 @@ public class SubscriptionsController(
         }
 
         await db.SaveChangesAsync();
-        return Ok();
+        // The client reads this body as DJMHAFPGLLN, the {success,error}
+        // RecNetResult (FGLDKEJLAKB<DJMHAFPGLLN> at IKMMOCKDKAF.txt LPFOPPHGDHG,
+        // instr 098) — answer in that shape rather than an empty 200.
+        return RecNetResults.Ok();
     }
 
     /// <summary>