Enforce invisibility online-only and redact laser paths for concealed opponents

server/battle-tanks-rooms.js

@@ -118,6 +118,12 @@ class BattleTanksRooms {
         // Health remains public, but no positional or aiming property crosses the trust boundary.
         state.tanks[opponent] = { health: room.game.tanks[opponent].health, concealed: true };
         if (state.activePlayer === opponent) state.announcement = 'Opponent concealed.';
+        // Rays resolve synchronously, so their complete path must be removed just
+        // like a projectile that has not crossed the disclosure boundary. Impact
+        // history contains the same path and must not provide a second side channel.
+        if (state.laserPath?.owner === opponent) state.laserPath = null;
+        state.impacts = state.impacts.map(impact => impact.type === 'laser' && impact.owner === opponent ? { ...impact, path: null } : impact);
+        if (state.lastImpact?.type === 'laser' && state.lastImpact.owner === opponent) state.lastImpact = { ...state.lastImpact, path: null };
         const projectile = room.game.projectile;
         if (projectile?.owner === opponent) {
             const barrier = room.game.arena.barrier;

tests/battle-tanks-page.test.js

@@ -60,6 +60,13 @@ test('Battle Tanks collects pickups along local pointer-drag movement', () => {
     assert.match(app, /pointermove[\s\S]*?tank\.y=tankYAt\(state,tank\);collectPickup\(state,state\.activePlayer\);sync\(\)/);
 });
 
+test('Battle Tanks disables online-only power-ups in local matches and guards activation', () => {
+    const app = read('battle-tanks/scripts/app.js'), core = require('../battle-tanks/scripts/game');
+    assert.equal(core.POWER_UP_CATALOG.invisibility.onlineOnly, true);
+    assert.match(app, /button\.disabled=locked\|\|unavailable/);
+    assert.match(app, /if\(!item\|\|item\.onlineOnly&&mode!==['"]online['"]\)return/);
+});
+
 test('Battle Tanks exposes an accessible, queued, local-only acquisition card', () => {
     const page = read('battle-tanks/index.html'), app = read('battle-tanks/scripts/app.js'), styles = read('battle-tanks/styles.css');
     assert.match(page, /id="power-card"[^>]*role="dialog"/); assert.match(page, /id="dismiss-power-card"[^>]*aria-label="Dismiss power-up card"/); assert.match(page, /id="power-card-live"[^>]*aria-live="polite"/);