RC-5

TESTING.md

@@ -319,3 +319,25 @@ go test ./internal/webui ./internal/core ./internal/auth ./internal/artifact ./i
 - Complete a task and verify its successor inherits `nft_style_reference`.
 - Generate a RIFT winner card and inspect the multipart OpenAI edit request: `image[]` must contain two files in this order: `character_anchor.png`, then the task style reference. Provider metadata should contain `reference_mode=character-plus-task-style`, the character-anchor hash and the style-reference hash.
 - Use **AUF DEFAULT ZURÜCK** and verify the task DB reference is empty and generation falls back to `internal/artifact/assets/style_reference.jpg` without deleting shared content-addressed style files.
+
+
+## V3.1 — Admin cleanup for stale non-winner profiles
+
+- In Admin → RUNTIME set e.g. `30 Tage` and click **PRÜFEN**. Verify the preview reports only clients whose `clients.last_seen` is older than the cutoff, that are not currently connected, and that have never appeared as `tasks.winner_client_id`.
+- Keep an old client connected via WebSocket: it must be reported as **aktuell verbunden geschützt** and never be deleted.
+- Create an old winner identity: it must be reported as **Gewinner geschützt** and never be deleted, regardless of age.
+- Confirm deletion and verify the client row is removed together with cascading `task_points`, `client_unlocks`, and `client_task_selection` rows.
+- Verify a recent non-winner remains untouched.
+- Verify WebSocket connect and disconnect update `clients.last_seen`, so a long-running session starts its inactivity window at disconnect rather than at its original login.
+- The API rejects cleanup windows shorter than one hour.
+
+Relevant automated tests: `internal/data/profile_cleanup_test.go` and `internal/server/profile_cleanup_test.go`.
+
+## V3.5 Random Guess Lottery
+
+1. Admin → RUNTIME: `Lotterie-Zeitfenster (s)=20`, `Max. gezogene Tipps je Task/Fenster=2` setzen und speichern.
+2. Mindestens drei Clients mit demselben Task verbinden und innerhalb desselben Fensters je einen Tipp absenden lassen.
+3. Bis zum Fensterende müssen die Requests auf die Losziehung warten. Danach dürfen höchstens zwei Clients `Tipp gezogen & geprüft` sehen; übrige Clients sehen `Tipp diesmal nicht gezogen`.
+4. Admin-Telemetrie: `Reject/s` steigt für nicht gezogene Tipps; `Guess/s` zählt nur tatsächlich gezogene/ausgewertete Tipps.
+5. Mit `Max. gezogene Tipps je Task/Fenster=0` speichern: Tipps müssen wieder ohne Lotterie-Verzögerung normal verarbeitet werden.
+6. Bei mehreren aktiven Tasks prüfen, dass jeder Task sein eigenes Kontingent erhält.