# Summer and Forbidden Ways

Local CSS imports, reviewed 8 October 2026. These are the KSF BSP variants of the requested maps. They use converted original artwork and compiled collision geometry. This document records a browser adaptation, not a claim of complete Source entity-system or private KSF server parity.

| Course | Author | Main course | Tier | BSP SHA-1 |
|---|---|---|---|---|
| surf_summer_ksf | Hardex & Tioga060 / JSurf Studios | 11 stages | 2 | 53ba357a9b4b64b3eab6351aa7334a5c618f0405 |
| surf_forbidden_ways_ksf | Krusty | Linear, 6 checkpoints | 2 | 2592c054432a1effbeecb7b8b96c8947f8c59a30 |

## Sources and reproduction

Summer's [author upload](https://gamebanana.com/mods/137916) offers the lighter KSF edition alongside the full map. Credits also include Juxtapo, Guadalupe, Mark C., not_a_zombie, Fnatic sponsorship and Ferry Gouw artwork. The captured page lists CC BY-NC-ND 4.0. The original soundtrack is not imported. Forbidden Ways' author, tier and main-course count are corroborated by its [CSS66t KSF page](https://ksf.surf/maps/surf_forbidden_ways_ksf?game=66t&mode=fw). No new redistribution permission is asserted.

The downloader pins the decompressed size and SHA-1 in `scripts/fixtures/new-maps-sources.json`. Summer is 323,004,133 bytes; Forbidden Ways is 13,588,440 bytes. BSP inputs stay in the ignored `node_modules/.map-imports` cache. The installed CSS directory supplies missing stock assets read-only.

```text
python scripts/download_new_maps.py
python scripts/import_new_maps.py summer --game-dir "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source"
python scripts/import_new_maps.py forbidden-ways --game-dir "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source"
python scripts/import_boreas_visuals.py node_modules/.map-imports/surf_summer_ksf.bsp --slug summer --map-id surf_summer_ksf --author "Hardex & Tioga060" --game-dir "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source" --texture-format lossless-webp --compressed-textures
python scripts/import_boreas_visuals.py node_modules/.map-imports/surf_forbidden_ways_ksf.bsp --slug forbidden-ways --map-id surf_forbidden_ways_ksf --author Krusty --game-dir "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source" --texture-format lossless-webp --compressed-textures
node --import tsx scripts/decode-summer-forbidden-replays.ts
node --import tsx scripts/decode-summer-route.ts
python scripts/audit-summer-forbidden.py
node --import tsx scripts/validate-classic-five-reference.ts summer forbidden-ways
node --import tsx scripts/plan-classic-five-routes.ts summer --canonical
node --import tsx scripts/build-forbidden-ways-route.ts
node --import tsx scripts/validate-new-maps.ts summer forbidden-ways
npm run build
```

Visual conversion preserves both native S3TC textures and decoded lossless-WebP fallbacks. `scripts/capture-summer-forbidden-previews.ts` renders original assets through the production renderer. With `UI_BASE_URL` pointing to the local development server, it captures 22 Summer and 14 Forbidden Ways views without browser errors. These reference camera poses establish rendering only, not successful player traversal. Full game QA uses the built preview server with `node --import tsx scripts/browser-summer-forbidden-qa.ts` and the same environment variable.

## Geometry, stages and local timer rules

Summer retains 7,683 convex brushes, 179,008 displacement collision triangles and 2,032 rendered displacement surfaces. Its real `s1` through `s11` destinations and momentum-preserving portals are retained. Stage checkpoints use each next stage's authored `stageN_start` convex union. Native bookmarks corroborate the arrival order. Portal contact must not substitute for arrival: clipping the timer sweep at an oblique teleport face can otherwise lose a checkpoint numerically. The start and finish use authored `stage1_start` and `stage11_end` hulls. All 11 practice destinations settle without a reset.

Forbidden Ways retains 3,149 brushes and its three main-course momentum-preserving portals. Start and finish are authored `start` and `end` convexes. The six corridor checkpoint gates are explicitly local: independent native bookmarks identify their order and location, but private KSF timer boxes have not been recovered. Main failure volumes reset to the canonical spawn. Bonus routes are not registered as timed courses.

Summer's legacy contradictory bevel brushes use the same explicit compiled-axial-bounds fallback already used by Ace and Legends. The eight broadphase vertices do not replace any collision plane. Every affected brush and its original planes is retained in `fixtures/summer-forbidden-entity-review.json`.

Two importer defects were corrected. Displacement ordering now follows Valve's nearest-corner selection without an arbitrary 0.1-unit rejection; the compiled corners themselves remain unchanged. Summer has three ordering hints approximately 0.102–0.120 units from their nearest corners. Vector `$detailscale` now retains both UV axes in the renderer; equal-component vectors are accepted for scalar material factors. Regression tests exercise both cases. No shared movement, timer or collision implementation was changed by these importer/rendering fixes.

## Independent evidence and its limits

Primary Summer reference: Caff's CSS66t forward/main record, `replay_css_3161_0_340931_1689750457.rec`, SHA-256 `9d7d67b86d7477b0bb411fe749c23f0eaba07d8a5b33ffe8764052eba5a4585c`. Primary Forbidden Ways reference: `replay_css_1188_0_16530_1611588572.rec`, SHA-256 `1e3b97b9ed5ae436afacdad7de243f9128682c74b7f70d808208579752611c11`. Complete public URLs, record attribution, captured page hashes and native file lengths are in `fixtures/summer-forbidden-source-metadata.json`. Both references are v2 recordings: analog command magnitudes and native contact flags are not available.

`scripts/validate-classic-five-reference.ts summer forbidden-ways` performs independent one-step comparisons at fixed tolerances of 0.002 units and 0.002 units/second. Summer passes 10,077 of 10,103 comparisons; Forbidden Ways passes 3,186 of 3,194. The reports retain all 26 and 8 discrepancies. These comparisons are separate from continuous command-route verification; inferred analog commands are not used to inflate the independent results. The native Forbidden Ways capture begins already moving and demonstrates a boosted start that is not explained by a stationary canonical spawn under the existing capped-start rule. It must not be injected as a ranked initial state.

Summer's complete command route starts at the real canonical spawn, walks to an independently observed stationary deck pose, then completes all 10 checkpoints. It uses 10,582 ordinary commands and finishes in 147.756668 seconds under the server verifier. The planning reference is the separately preserved rank-6 recording `replay_css_3161_0_449650_1596798508.rec`, stationary frame 39. Bounded yaw adjustments are recorded in `fixtures/summer-planned-commands.json`; they alter commands, never geometry or player state. The full result is in `fixtures/summer-command-validation.json`, including identical states, contacts and timer results at 30/60/144/240 FPS schedules. This is an automated possibility witness, not a human run or native-world-record reproduction.

Forbidden Ways' complete route uses 3,839 ordinary commands from its actual canonical spawn and finishes in 56.594172 seconds. It passes all six checkpoints and all three main-course portals without a reset. Offline input search used the native path as a guide and retained enough ramp speed to complete the gaps under the unchanged capped-start rules. `fixtures/forbidden-ways-planned-commands.json` preserves the accepted inputs; `scripts/build-forbidden-ways-route.ts` reconstructs the entire run without loading any intermediate state, requires server acceptance, and checks identical states, contacts and timing at 30/60/144/240 FPS. `fixtures/forbidden-ways-command-validation.json` records the hashes and results. No start boost, velocity injection, ramp modification or reset-volume exception was added to make this route pass.

## Remaining adaptation limits

Summer's source package lacks three texture files (`devneons/orange_neon`, `fnatic/pier2/white_neon`, `metal/drtrime`) and three prop-local `toolsnodraw` material files. Their warnings are preserved; no replacement artwork is presented as original. Forbidden Ways reports no missing visual resources. Summer's converted asset set is substantially larger than the existing small classics.

The texture integrity check verifies all 513 Summer and 32 Forbidden Ways decoded images against their source pixels, plus all 498 and 13 native compressed textures against the source blocks. `scripts/browser-summer-forbidden-textures.ts` also renders both maps through the native and decoded packed-loader paths without browser errors. Reports are in `fixtures/summer-forbidden-visuals/`. Summer's native visual download is approximately 101.93 MiB over 53 requests (144.59 MiB / 45 requests for decoded fallbacks); Forbidden Ways is 3.60 MiB / 4 requests (4.12 MiB / 4). These totals include the visual manifest and selected compressed packs, not collision or application files. No texture resizing or lossy recompression was introduced.

The existing runtime supports continuous player push volumes and mapped no-jump effects. It does not implement arbitrary Source entity I/O. Summer's jetski push class filters and the waterpark's class-filtered `AddOutput basevelocity` shortcuts remain outside independently verified entity parity; the latter are not traversed by the accepted complete route. Moving scene machinery, Source soundscapes/music, private timer plugins and timed bonus courses are also outside this import's scope. Main-course completion must not be described as verification of those unimplemented effects.

## Release boundary

The final local validation passed the production build, all 496 application tests, all 21 importer tests and the room-worker type check. Both complete command routes also passed in the production browser build with exact final-state and checkpoint agreement, actual keyboard and Pointer Lock input, restart, practice starts, responsive menus and persisted map selection. `fixtures/browser-new-map-results-summer-forbidden-local.json` records both completed routes and no browser errors. These checks used local services; they do not establish deployed service behavior.

At this release, the catalog contained 17 maps. `fixtures/summer-forbidden-prior-online-catalog.json` pins all 15 prior entries, and the new regression test requires every prior board, geometry, configuration to remain identical (later runtime changes require a new compatibility certificate). The release completed on 8 October 2026. Two new Tier-2 boards were registered with 200 completion / 800 performance weights after a rollback rehearsal; the existing 18 database rows remained unchanged. The Vercel website and Cloudflare rooms received the same 17-map catalog. Both live browser routes passed, and brief guest connections confirmed all map and board IDs in EU and NA after propagation. The detailed release, rollback IDs and timings are in `fixtures/production-summer-forbidden-release-2026-10-08.json`. No existing records were modified.

## Reset investigation and finish visibility (local repair, 8 October 2026)

The reported multiplayer symptoms were reproduced with ordinary controls. This repair is local and has not been released. The live game remains at the 17-map Summer/Forbidden Ways release; the local 20-map build also contains Tendies, Derpis and Prelude.

The principal cause was shared movement, not remote-player collision or repeated R-key events. A player exactly touching a brush plane could receive an `allSolid` trace. Movement marked the tick `blocked`, and `GameSession.step` treated that flag as a full-map failure. Its `restart()` clears stage progress, timer and command history. On Summer, an authored failure portal could correctly return to the current stage before a subsequent boundary contact triggered that second, incorrect restart. One preserved stage-11 case returns at tick 411 and resets to stage 1 at tick 431. On Demise, holding forward from spawn repeatedly reset at tick 41 when the feet reached exactly Z=14976. The pre-fix 32-case Demise probe recorded 288 collision-triggered resets; the repaired probe recorded none. Ordinary authored failure triggers still work.

The repair in `src/physics/movement.ts` only activates on that all-solid movement path. A candidate must begin within 1/32 unit of a hull-expanded brush plane. Recovery searches at most 1/16 unit per axis and accepts only a completely clear full-player hull; it adds no velocity and continues the normal collision sweep. Deep embedding and too-narrow gaps remain blocked. The stair comparison now retains the blocked flag belonging to the selected path, so a rejected speculative path cannot poison a valid one. No map collision planes, stage destinations or failure volumes were moved.

A second bug existed in `synchronizeRoomMap`: welcome/state messages queued during a download could apply the same room epoch twice and restart the freshly loaded session. The queue now checks the applied epoch again after waiting. The browser regression reproduces one extra restart with that guard removed and zero with it installed. Same-epoch reconnection preserves progress; held R issues one deliberate restart. Tests use isolated room/API transports and never connect test players to live rooms.

Summer's final pool uses `teleport-26` to enter a separate black timer room. Its timer brush is 384 units wide, but the physical room is only 96 units wide; the generic floor outline was behind its walls and the central sign was overhead. The renderer now marks the actual pool entrance, outlines the water-level landing area and places compact signs inside the physical arrival room. These are visual markers only: the original timer/teleport hulls and finish tick are unchanged. Camera-only before/after renders are under `test-results/reset-investigation/finish-before` and `finish-after`.

Validation and reproducible evidence:

- `fixtures/reset-investigation/baseline.json`, `catalog.json` and `certificate.json` freeze the exact pre-fix local simulation and identity chain.
- `summer-walk-baseline.json` contains 10 boundary-reset cases; `summer-return-baseline.json` contains 14 longer cases, including failure-portal arrival followed by a second reset. The regression suite exercises the latter through and beyond the former failure tick.
- `scripts/audit-respawn-paths.ts` exercises 1,416 cases across every authored stage/canonical spawn in all 20 maps: 1,618,133 ticks and 2,612 portal returns, with zero collision-triggered full-map resets. This is broad finite coverage, not proof that every possible route is fault-free.
- `scripts/browser-reset-recovery-qa.ts` verifies delayed room loading, repeated same-epoch messages, real held-R and forward input on Demise, a socket reconnect, and an actual Summer stage-11 failure/return. `browser-fixed.json` records completion with no browser errors.
- `scripts/certify-reset-recovery.ts --check` reproduces 26 complete route comparisons and 101,272 identical ticks across all 20 maps. State, contacts, movement segments, events, timer and splits agree exactly; all canonical runs pass the server verifier.
- The production build, TypeScript check, 519 application tests and 21 importer tests passed. Built-browser route results are recorded separately in `fixtures/browser-new-map-results-reset-recovery-built.json`.

The current certificate deliberately retains the 17 live board IDs as a repair to previously aborted attempts. This is **not** a claim that the change is a no-op: previously aborted inputs can now continue, expanding the set of finishable trajectories. In the old runtime, every relevant blocked movement tick unconditionally restarted and discarded its command history; previously accepted complete attempts therefore did not traverse these recovery branches. The certificate records this review and the finite witness evidence explicitly. The published physics hash is `7b22d5508bc7f98703eb31a17eb0450a6da54885909c6d87e3c86658cefb6bdc`. Client and verifier must be released together. No existing records were deleted, rewritten or migrated.