docs(runtime): detail Slice J no-window closeout

Pin the single-root fixture host, full deterministic lifecycle, fault and isolation matrix, and J7 visual entry gate before implementation begins.

Co-authored-by: OpenAI Codex <codex@openai.com>

docs/plans/2026-07-26-modern-runtime-slice-j8.md

@@ -0,0 +1,217 @@
+# Modern runtime Slice J8 — no-window integration and Slice J closeout
+
+**Status:** PLANNED — J7 PHYSICAL-DISPLAY ACCEPTANCE IS THE ENTRY GATE
+**Parent:** `2026-07-25-modern-runtime-slice-j.md`, J8
+**Authorization:** the user approved Slices F–L, including the J gameplay-owner
+gates, on 2026-07-24
+**Purpose:** prove that the exact `GameRuntime` graph now used by the graphical
+client can run a complete deterministic client lifecycle without App, a
+window, rendering, retained UI, audio, or backend assemblies.
+
+## 1. Entry state
+
+J7.1 created the root at `96ddd165`. J7.2/J7.3 cut the graphical host and
+shutdown transaction over to it at
+`ce41efb9e5938f79a7580476b949d172f52a1e69`. Focused, complete Release,
+connected lifecycle/reconnect, and canonical nine-stop automated gates pass.
+J8 may begin production/test implementation only after the user accepts J7's
+physical-display radar, paperdoll, Use/approach, combat-facing, and recall
+matrix.
+
+Existing direct tests prove the individual pieces, but not the complete root:
+
+- `RuntimeLiveSessionNoWindowTests` proves a direct session can connect, enter,
+  and stop.
+- `RuntimeSimulationFixtureHostTests` proves movement, use, attack, cast, and
+  projectile behavior over separately constructed Runtime owners.
+- `RuntimeWorldTransitDirectHostTests` proves login, portal, cancellation, and
+  host acknowledgements over a separately constructed transit owner.
+- `GameRuntimeTests` proves root construction, isolation, lazy events, leases,
+  rollback, and terminal disposal.
+
+J8 replaces those disconnected proofs with one end-to-end root-host proof. It
+does not remove the focused tests.
+
+## 2. Fixed boundary
+
+The integration host lives in `AcDream.Runtime.Tests` and references only
+`AcDream.Runtime` and its existing transitive Core/Core.Net/Content contracts.
+It is a test host, not the Slice-K CLI.
+
+It constructs:
+
+- one `GameRuntime`;
+- one explicit no-window host lease;
+- one `LiveSessionHost` borrowing `GameRuntime.Session`;
+- one deterministic `ILiveSessionOperations` fixture with a real
+  `WorldSession` and in-memory transport;
+- one generation-scoped inbound route;
+- one generation-scoped outbound command route;
+- one immutable fixture-content catalog for spell and world metadata;
+- one `RuntimeTraceRecorder`.
+
+It must not construct an App adapter, duplicate entity directory, duplicate
+object table, duplicate gameplay owner, second clock, second transit owner, or
+second session controller.
+
+The host applies already-decoded deterministic packets through the same Runtime
+owner APIs that the graphical session route uses. Core.Net parser correctness
+remains covered by Core.Net wire fixtures; J8 verifies ownership, ordering,
+commands, state, generation, and teardown after decode. Test reflection may
+raise a `WorldSession` event only where the public event source deliberately
+has no injection API; no production test-only hook is added.
+
+## 3. Scenario and exact ordering
+
+One canonical scenario runs in this order:
+
+1. Construct the root and host; capture the empty checkpoint.
+2. Start generation 1 through `LiveSessionHost`.
+3. Bind inbound before connect, select the first fixture character, install
+   exact local identity, enter world, and activate outbound commands.
+4. Deliver decoded inbound fixtures:
+   - local-player CreateObject;
+   - one hostile creature;
+   - one usable world object;
+   - one container and one inventory item;
+   - one inventory/container mutation;
+   - one system chat line and one local speech line;
+   - one vital/character update;
+   - one environment/time update.
+5. Advance the instance clock and execute through the root's exact owners:
+   - movement;
+   - selection plus use;
+   - combat mode plus attack;
+   - learned-spell cast;
+   - one projectile simulation commit.
+6. Drive one accepted teleport destination through typed destination
+   readiness, materialization, host projection acknowledgements, world-visible
+   acknowledgement, and completion.
+7. Capture and compare the ordered Runtime event/checkpoint trace.
+8. Stop generation 1; prove the old inbound and outbound routes are inert.
+9. Reconnect as generation 2 in the same process.
+10. Reuse one server GUID with a new incarnation; prove no generation-1
+    identity, command, packet, event sequence, inventory, physics, or portal
+    state leaks into generation 2.
+11. Stop, release the no-window lease, dispose the root, and require
+    `GameRuntimeOwnershipSnapshot.IsConverged`.
+
+The fixture trace records lifecycle, entity, inventory, chat, movement,
+portal, command, and checkpoint rows. Sequence numbers must be strictly
+increasing within a generation and restart only when the generation changes.
+
+## 4. Execution
+
+### J8.1 — one direct root host
+
+- Add a reusable test-only `NoWindowGameRuntimeHost`.
+- Move the existing J5 direct-host scenario onto `host.Runtime` rather than
+  separately constructing six owners.
+- Borrow root identity, session, entity/object, inventory, character,
+  communication, action, movement, environment, transit, clock, and event
+  source.
+- Acquire and release one named host lease.
+- Prove the test assembly/process loads no App, UI, Silk.NET, OpenAL, Arch,
+  ImGui, or renderer/audio/window type.
+
+Gate: the direct root host constructs, captures a checkpoint, and converges
+without a presentation assembly or duplicate owner.
+
+### J8.2 — deterministic transport/content lifecycle
+
+- Build deterministic session operations and in-memory transport.
+- Bind the exact session lifecycle order:
+  reset → attach inbound → connect → select identity → enter → activate
+  outbound.
+- Install immutable spell/world fixture metadata before its dependent packet.
+- Route decoded entity, object, inventory, chat, character, environment, and
+  transit fixtures into the root.
+- Execute movement, use, attack, cast, and projectile work through root-owned
+  state.
+- Complete one portal using the same typed host acknowledgement contract as
+  App.
+- Stop and reconnect, then verify generation isolation and GUID reuse.
+
+Gate: one normalized golden trace proves all state and commands share the same
+root, accepted ordering is stable, and old-generation routes are inert.
+
+### J8.3 — cancellation, faults, isolation, and credentials
+
+- Cancel during connect, after inbound attach, during portal readiness, and
+  with a host acknowledgement pending.
+- Inject route-construction, route-detach, observer, projection
+  acknowledgement, and terminal callback failures.
+- Retry the exact retained suffix and require convergence.
+- Run two roots simultaneously with different credentials, clocks, GUIDs,
+  inventory, chat, combat, spell, projectile, and portal state.
+- Assert logs contain endpoint/user context only where intended and never
+  contain the password, credential record, or exception text that embeds it.
+- Prove a disposed/old route cannot mutate the new generation.
+
+Gate: every fault converges; two roots remain isolated; diagnostics are
+credential-safe.
+
+### J8.4 — complete Slice J gate
+
+- Run focused Runtime tests.
+- Run the Release solution build.
+- Run the complete Release suite.
+- Run exact-binary connected graphical lifecycle/reconnect.
+- Run the canonical graphical nine-stop route.
+- Reconfirm the accepted J7 physical-display matrix.
+- Audit dependency closure, presentation assembly loads, duplicate
+  constructors, mutable statics, retail divergences, and teardown ledgers.
+- Update architecture, code structure, milestones, roadmap, parent and
+  umbrella plans, AGENTS/CLAUDE, and durable memory.
+
+Gate: graphical and no-window hosts use the same root and owner graph; packet
+and command ordering remains stable; terminal ownership converges; no
+presentation/backend assembly enters the direct process. Slice J is then
+closed and Slice K may add the Linux multi-session CLI and scheduler without
+extracting gameplay again.
+
+## 5. Adversarial matrix
+
+- missing credentials and no characters;
+- connect failure before and after route attachment;
+- duplicate Start, stale Start, Stop, and Reconnect generations;
+- inbound packet before selection and after Stop;
+- command before world entry and after route retirement;
+- duplicate CreateObject and GUID reuse across reconnect;
+- observer throws during entity, inventory, chat, command, movement, or portal
+  dispatch;
+- route creation succeeds but activation fails;
+- detach throws once, then succeeds;
+- portal cancellation before readiness, after readiness, and with each host
+  acknowledgement outstanding;
+- projectile projection callback throws;
+- host lease retained during root disposal;
+- root terminal disposal retries after each stage;
+- two roots use the same server GUID without sharing local IDs;
+- password-shaped marker absent from trace, logs, exception messages, and
+  test output;
+- App/UI/Silk/OpenAL/Arch/ImGui assemblies absent from the loaded-assembly set.
+
+## 6. Non-goals
+
+- No Linux executable or bot scheduler; those are Slice K.
+- No hidden graphical process.
+- No renderer, audio, UI, particle, camera, selection-marker, or portal-tunnel
+  stub.
+- No new network parser or alternate packet order.
+- No asynchronous command queue or extra frame boundary.
+- No gameplay-state mirror, facade dictionary, service locator, or test-only
+  production injection API.
+- No retail behavior change and therefore no divergence row unless the audit
+  discovers a pre-existing unregistered difference.
+
+## 7. Commit and rollback discipline
+
+J8 implementation lands as one test/integration closeout commit after the J7
+visual entry gate, followed by one documentation closeout commit if needed.
+The full production SHA and exact `git revert <sha>` are recorded here before
+Slice K starts. J8 must not modify the J7 rollback point:
+
+```text
+git revert ce41efb9e5938f79a7580476b949d172f52a1e69
+```