Prepare an independently authored browser game for WHXTEVER. Work in the existing repository and preserve unrelated files. WHXTEVER hosts creator/open-source games and does not offer AI game creation: adapt/package the supplied game, and create new gameplay only if its creator has separately requested that work. Do not publish, claim creator ownership, weaken the sandbox or mark review passed. This instruction prepares a hosted package, not a remote listing. Unlimited remote listings are separate from hosted capacity; do not download or repackage a remote game merely to list its URL. The local hosted flow permits one free selected game or three total with a valid server-issued VIP entitlement. Drafts and updates do not consume additional hosted slots. Public creator hosting and subscription purchase are not open yet; local preparation does not reserve a public slot. 1. Read public/core.mjs parseCatalog, scripts/creator-intake.mjs, docs/creator-intake.md, scripts/inspect-intake.py and scripts/export-static.mjs. These are the current schema, preparation, byte-check and host authorities. Read design-review/product-lab-platform-v2/DOMAIN_AND_FLOWS.md for the proposed companion art contract. Check git status and existing owner before changing files. Requirements: Node22+ and Python3 as python. 2. Identify the exact upstream HTTPS repository, lowercase40-hex commit, author, source license and every shipped dependency/image/font/audio permission. Use actual licensed assets or creator-owned assets. Preserve copyright and required notices. Current v1 source-license labels are MIT, Apache-2.0, BSD-3-Clause, CC0-1.0 and GPL-3.0-only. For unsupported labels stop that admission and explain the needed policy/schema decision, never relabel. GPL requires a safe inventoried corresponding-source ZIP with the actual source/modifications/build instructions. Rights review is separate from structural ZIP acceptance. 3. Prepare a small already-built static runtime folder with relative asset paths, index entry, usable start/restart, stable keyboard focus and demonstrated controls. Review upstream scripts before running; never run deployment scripts. Exclude trackers, credentials, dependency trees, unrelated source and unnecessary remote requests/service workers. Opaque sandbox storage may fail: handle it safely. Avoid autoplay audio, release pointer/key state on blur, resize within the play area and dispose ongoing effects on unload. Use min viewport/device/input declarations you can actually prove. Touch controls need usable targets and real testing; a touch flag is not a feature. Player counts describe real play, not planned multiplayer. Respect reduced-motion users if declaring support. 4. Create metadata from the real template using a new scratch/output location: node scripts/creator-intake.mjs template Replace games[0] identity/source/support/discovery/entry/readiness fields with this game. Root is exactly {schemaVersion:1,games:[game]} with one game. Game keys are id,version,title,description,instructions,roughness,source,review,support,discovery,bundle,entry,readySelector,files, plus optional branding. Branding accepts cover, horizontalLogo, or both, for example {cover:"assets/cover.webp",horizontalLogo:"assets/logo.webp"}. Each is a relative PNG/WebP file in the built folder and hashed inventory, nonempty and at most 2,000,000 bytes; no external URLs or SVG. Prefer a 2:3 portrait cover with centered artwork and a transparent 3:1 horizontal wordmark. Missing/broken covers use neutral artwork for new games; missing/broken logos use the title. Omit branding when neither is supplied. Use lowercase-dash id; version1-64 alphanumeric/dot/hyphen; title<=80; description<=240; instructions<=500 and must explain how to start and use every declared input; integer roughness0-100; bundle games//. Source keys url,revision,author,license,licensePath,assets, plus sourceArchivePath only for GPL-3.0-only. Review keys safety/license/assets/moderation/playability all pending. Support keys devices,inputs,themes,minWidth,minHeight,reducedMotion,age; devices desktop/tablet/phone; inputs keyboard/pointer/touch; themes light/dark with at least one value; age everyone/restricted. Discovery keys categories,players,session; categories action/arcade/puzzle/strategy/party/chill; players min/max1-16; session quick/standard. Read the parser for current exact limits. Do not add poster/screenshot/avatar/score/owner/remote-embed keys. 5. Provide a readiness selector that appears only after the playable initial state and required assets are ready. Use the platform's injected whx:guest:1 bridge/export integration. Current init/ready/error messages bind exact parent/frame, opaque origin, session and release; do not add a permissive postMessage handler or same-origin iframe permission. Current protocol does not report scores/wins/pause/saves. Keep an honest game-internal lifecycle; propose a versioned SDK contract separately if those host features are needed. A rendered canvas alone is not play proof. 6. Include optional cover and horizontal logo files in the runtime ZIP and manifest inventory as described in step 4; list their actual rights in source.assets. Prepare 1-4 actual gameplay screenshots separately (target 1280 × 720 landscape or faithful portrait dimensions). Optimize raster assets, declare actual width/height/bytes/SHA256/alt/credit/license and preserve original evidence. Never fabricate gameplay. Profile avatar belongs to account media, not the game. Provide proposed game-presentation.v1.json following DOMAIN_AND_FLOWS.md, bound to gameId/gameVersion and SHA256 of final prepared manifest bytes. This separate screenshot/companion folder is review material only: current prepare/check do not validate or upload it. 7. From repo root, with an existing parent and a new output folder outside the runtime folder: node scripts/creator-intake.mjs prepare node scripts/creator-intake.mjs check /manifest.json /bundle.zip Optionally reserve exact locally checked bytes only when requested: node scripts/creator-intake.mjs validate /manifest.json /bundle.zip prepare inventories files/hashes, resets reviews pending and packages without executing gameplay. check is non-writing. validate creates local unserved quarantine with owner:null. None authenticates/uploads/publishes. Maximum 300 runtime files, 262144 manifest bytes, 20,000,000 compressed package bytes and 20,000,000 cumulative expanded bytes including required nested source bytes. Cover/logo files count toward the package totals. Include nonempty entry and UTF8 license; safe relative paths only, no links/reparse/special files/case collisions or extra enclosing directory. Preserve existing/incomplete output or reservations. Changed quarantined bytes require a new version. 8. Prove the game in the real isolated player: first usable frame, start, meaningful input and play, restart, desktop/phone/tablet as claimed, orientation/resize, touch/keyboard, loading failure, Next/exit teardown, no unintended requests and reduced motion as claimed. Measure startup transfer separately from source ZIP size. Keep unsupported devices excluded. Run: node --test --test-concurrency=1 test/creator-prepare.test.mjs test/creator-intake.test.mjs npm run check Coordinate with the current Build owner before altering catalogue/admission. Do not treat packaging checks as rights or playability approval. Deliver exact source revision, derivative patch summary, all notices, prepared manifest+ZIP including any declared cover/logo, separate screenshots/companion review files, hashes, commands/results, actual device/input coverage, browser screenshots and remaining limits. Embed visual proof in the handoff. Distinguish prepared-local, checked-local, quarantined-local, reviewed and published. Do not claim a full platform or deployed game from local evidence.