fix(physics): bind a parented child to the parent's live incarnation (#319)
A player-parented child never received a canonical cell. Its FullCellId stayed 0 for its whole attached lifetime, so it could not follow the player across a boundary. Scope was wider than the local player: every REMOTE player's equipment too. ROOT CAUSE. EquippedChildRenderController hardcoded ParentInstanceSequence: 0 for a parented CreateObject. Correct for creatures and statics, which really are sequence 0; wrong for players, whose ObjectInstance is Character.TotalLogins (ACE Player_Networking.cs:37). The relation filed under (playerGuid, 0) while the record carried TotalLogins, so both route-7 write sites — D1's attach re-cell and D2's propagation lookup — keyed on an incarnation that never matched. TryCommitParent did not validate the sequence, so the attach succeeded and printed normally. Silent. A ROUTE 7 REGRESSION (cd3129e9) that un-masked a latent bug: the TickChild call route 7 deleted was keyed on the child guid alone and was structurally immune to a wrong parent key. THE FIX IS TO STOP TREATING PLAYERS DIFFERENTLY, not to special-case them. Retail's attach path is guid-only end to end — PhysicsDesc::get_parent_id @0x00558a18 -> CObjectMaint::GetObjectA @0x00558a2d -> set_parent @0x00558a3e, with SetChildren @0x00509370 hash-walking by guid — and neither set_parent overload (@0x00515A90, @0x00515B50) nor enter_cell @0x00510ED0 contains any player test or instance-sequence read. Our player/non-player split was purely an artifact of keying relations by (guid, incarnation) against a wire message that carries no parent incarnation. Late-binding to whoever currently holds the guid is retail's own semantics. Fixed at BOTH producers: OnSpawn and OnCreateParentAccepted, the second carrying the byte-identical defect and not named in the contract's scope line. THE INVARIANT IS EQUALITY, NOT FRESHNESS. The contract rejected both framings I offered: every one of the 45 FullCellId liveness predicates excludes a committed child on a NON-cell clause first, so the child inherits only the parent record's existing staleness, which is already present today with no symptom. The key fix alone restores child-equals-parent for every parent class. TWO SITES GATED, inert only because the cell was zero and would have woken wrongly: the hydration candidate loop (a nonzero-cell child would take the legacy RebucketLiveEntity -> CommitRebucket, a second canonical writer — route 7's exact defect class) and RestoreShadow (would install a broadphase row for the weapon, the #184 shape, contradicting route 7's P4). Retail anchor: update_object's parent != 0 early-out @0x00515D40 — children are never independently re-placed. THREE MAJORS WERE FIXED BY DELETION. The first pass added a deferral queue for an unaddressable parent, carrying a missing child-freshness gate (A2), a sentinel-0 collision with the generation filters (A3), and unbounded accumulation (A5). Both reviewers then proved the deferred branch unreachable for BOTH producers — RegisterEntityCore defers the entire CreateObject one layer above, reading the same ?? chain, and CreateParentUpdate is produced only inside AcceptCreateCore, after that gate passes. The machinery was deleted rather than repaired, and the diff SHRANK to 76 added / 13 removed from 91/24 while gaining the A1 fix. Retail confirmed the deletion does not diverge: acdream's real port of retail's per-guid replay (QueueBlobForObject) is a different, untouched layer, and the deleted queue was a third redundant one downstream of it. THE GUARD MUST NOT TEAR WHAT IT PROTECTS. The first pass threw InvalidOperationException AFTER the canonical half had committed, so the one time it fired it left the child parented with no committed relation and a staged one blocking Resolve — a torn transaction, the exact outcome the contract pinned against. Now a pure CanCommitIncarnation precondition checked BEFORE the commit at both sites, with a logged refusal instead of a throw. Route 3's N3 principle (do not make a transient fatal on a host that must survive 30 sessions x 2 hours) reinforces it, but the tearing argument stands alone. TEST QUALITY, the recurring lesson in its most refined form. The A1 test initially passed sabotage FOR THE WRONG REASON: a mismatched ChildPositionSequence meant TryCommitParent's own gate refused in either ordering, so the three assertions carrying A1's meaning passed both ways and only an incidental staging assertion failed. It failed on stranding, not tearing. Corrected, the sabotage now names line 925 — Assert.Null(snapshot.ParentGuid), with the parent's guid in it — proving the canonical mutation happened before the catch. "Fails under sabotage" is necessary, not sufficient; WHICH assertion fails is the real question. The dual parent-class matrix (player 0x5… incarnation > 1 vs creature 0x8… incarnation 0, identical outcomes, sabotage-verified in both directions) is the structural fix for how this survived a full dual review and two connected sessions: every prior test and both captured gate logs used sequence-0 parents. Register: AP-142 clause (f); AP-132 amended to distinguish the two producers; new row AP-146 for the local player's coarse canonical cell (retail writes it per tick at SetPositionInternal @0x00515330 — which, per the retail review, ALSO walks this->children writing each child's objcell_id @0x005153AE-@0x005153D8, so retail's per-tick child propagation lives in the same function). That divergence had no row at all, a standing rule-1 violation now corrected. Follow-up #320 filed for making the player's cell track ordinary movement — deliberately excluded here: it touches the landblock-preserve contract, the Rebucketed cadence, route-2/4b-3 classification inputs AP-136/AP-138 spent four review rounds pinning, and the portal-space frozen-source-cell race. Two dual review rounds; 6 architecture MAJORs and 2 retail MAJORs closed. Diagnostic refusals are latched per child guid and the latch clears on Clear()/RemoveChild, so a recycled guid's next incarnation still logs rather than being silently suppressed. Complete Release suite MEASURED at 11,112 passed / 4 skipped / 0 failed (baseline 11,090 at52175aa1, +22). Neither known flake fired. STILL OWED: the connected gate, with the CORRECTED positive criterion — assert the equipped child's FullCellId EQUALS the parent's after a crossing (a zero is a failure, not a silence), run with BOTH a player and a creature parent, plus the new step carrying an armed creature across a landblock unload/reload. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Erik
parent
af828a8a2a
commit
392c1e22c1
19 changed files with 3076 additions and 20 deletions
|
|
@ -35,6 +35,223 @@ public sealed class ParentAttachmentStateTests
|
|||
Assert.Equal(parentGuid, child.ParentGuid);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// #319 A1 (architecture review, 2026-08-05). Dual-parent-class matrix:
|
||||
/// <see cref="ParentAttachmentState.CanCommitIncarnation"/> is a PURE,
|
||||
/// side-effect-free precondition - it must refuse a mismatch without
|
||||
/// mutating ANY state, so a caller can check it before either half of a
|
||||
/// commit runs (never a throw; the original shape threw from inside
|
||||
/// <see cref="ParentAttachmentState.CommitProjection"/>, reached only
|
||||
/// after the canonical commit had already landed, tearing the
|
||||
/// transaction).
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[InlineData(0x50000210u, (ushort)5)]
|
||||
[InlineData(0x70000211u, (ushort)0)]
|
||||
public void CanCommitIncarnation_MismatchedIncarnation_RefusesWithoutMutatingState(
|
||||
uint parentGuid,
|
||||
ushort liveParentIncarnation)
|
||||
{
|
||||
const uint childGuid = 0x70000212u;
|
||||
var relations = new ParentAttachmentState();
|
||||
var wrongRelation = new ParentAttachmentRelation(
|
||||
parentGuid,
|
||||
childGuid,
|
||||
ParentLocation: 0,
|
||||
PlacementId: 0,
|
||||
ParentInstanceSequence: (ushort)(liveParentIncarnation + 1),
|
||||
ChildPositionSequence: 1);
|
||||
relations.AcceptCreateObjectRelation(wrongRelation);
|
||||
|
||||
Assert.False(relations.CanCommitIncarnation(
|
||||
wrongRelation,
|
||||
guid => guid == parentGuid ? liveParentIncarnation : (ushort?)null));
|
||||
// Purely a read - the relation is untouched, still staged, no
|
||||
// committed parent exists.
|
||||
Assert.True(relations.TryGetStagedProjection(childGuid, out ParentAttachmentRelation staged));
|
||||
Assert.Equal(wrongRelation, staged);
|
||||
Assert.False(relations.TryGetCommittedParent(childGuid, out _, out _));
|
||||
|
||||
// A NULL resolver (parent not currently addressable) must not
|
||||
// refuse - the tripwire only fires "whenever the parent is
|
||||
// active" (contract F1).
|
||||
Assert.True(relations.CanCommitIncarnation(wrongRelation, _ => null));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// #319 A1. <see cref="ParentAttachmentState.CommitProjection"/> itself
|
||||
/// must be non-tearing for ANY caller (not just the two production call
|
||||
/// sites that also pre-check): a mismatch returns false and mutates
|
||||
/// nothing, never throws.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[InlineData(0x50000213u, (ushort)5)]
|
||||
[InlineData(0x70000214u, (ushort)0)]
|
||||
public void CommitProjection_MismatchedIncarnation_ReturnsFalseWithoutThrowingOrMutating(
|
||||
uint parentGuid,
|
||||
ushort liveParentIncarnation)
|
||||
{
|
||||
const uint childGuid = 0x70000215u;
|
||||
var relations = new ParentAttachmentState();
|
||||
var wrongRelation = new ParentAttachmentRelation(
|
||||
parentGuid,
|
||||
childGuid,
|
||||
ParentLocation: 0,
|
||||
PlacementId: 0,
|
||||
ParentInstanceSequence: (ushort)(liveParentIncarnation + 1),
|
||||
ChildPositionSequence: 1);
|
||||
relations.AcceptCreateObjectRelation(wrongRelation);
|
||||
|
||||
Assert.False(relations.CommitProjection(
|
||||
wrongRelation,
|
||||
guid => guid == parentGuid ? liveParentIncarnation : (ushort?)null));
|
||||
Assert.False(relations.TryGetCommittedParent(childGuid, out _, out _));
|
||||
Assert.True(relations.TryGetStagedProjection(childGuid, out ParentAttachmentRelation staged));
|
||||
Assert.Equal(wrongRelation, staged);
|
||||
|
||||
// A matching resolver commits normally.
|
||||
Assert.True(relations.CommitProjection(
|
||||
wrongRelation,
|
||||
guid => guid == parentGuid
|
||||
? (ushort)(liveParentIncarnation + 1)
|
||||
: (ushort?)null));
|
||||
Assert.True(relations.TryGetCommittedParent(
|
||||
childGuid,
|
||||
out uint committedParent,
|
||||
out ushort committedInstance));
|
||||
Assert.Equal(parentGuid, committedParent);
|
||||
Assert.Equal((ushort)(liveParentIncarnation + 1), committedInstance);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// #319 contract §6 test 9 (ledger convergence) - BLOCKS per the
|
||||
/// architecture review, since a stranded/accumulating relation is
|
||||
/// precisely a ledger-convergence defect. Dual-parent-class matrix.
|
||||
/// Removing the CHILD must zero every one of
|
||||
/// <see cref="ParentAttachmentState"/>'s four tables
|
||||
/// (staged/recovery/committed/unresolved), not just the committed
|
||||
/// entry.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[InlineData(0x50000900u, (ushort)3)]
|
||||
[InlineData(0x70000901u, (ushort)0)]
|
||||
public void LedgerConvergence_ChildRemoval_ZeroesEveryTable(
|
||||
uint parentGuid,
|
||||
ushort parentIncarnation)
|
||||
{
|
||||
const uint childGuid = 0x70000902u;
|
||||
var relations = new ParentAttachmentState();
|
||||
var relation = new ParentAttachmentRelation(
|
||||
parentGuid,
|
||||
childGuid,
|
||||
ParentLocation: 0,
|
||||
PlacementId: 0,
|
||||
parentIncarnation,
|
||||
ChildPositionSequence: 1);
|
||||
relations.AcceptCreateObjectRelation(relation);
|
||||
Assert.True(relations.CommitProjection(relation));
|
||||
// MarkProjected(Recovery) simulates a completed realize/render
|
||||
// pass, which clears the retry-candidate bookkeeping - the
|
||||
// permanent committed record in _lastAcceptedByChild is untouched
|
||||
// by it, which is the table this test cares about.
|
||||
relations.MarkProjected(relation, ParentProjectionCandidateKind.Recovery);
|
||||
|
||||
Assert.Equal(1, relations.CommittedRelationCount);
|
||||
Assert.Equal(0, relations.RecoveryRelationCount);
|
||||
Assert.NotEmpty(relations.ChildrenAttachedToParent(parentGuid, parentIncarnation));
|
||||
|
||||
relations.RemoveChild(childGuid);
|
||||
|
||||
Assert.Equal(0, relations.CommittedRelationCount);
|
||||
Assert.Equal(0, relations.RecoveryRelationCount);
|
||||
Assert.Equal(0, relations.StagedRelationCount);
|
||||
Assert.Equal(0, relations.UnresolvedRelationCount);
|
||||
Assert.Empty(relations.ChildrenAttachedToParent(parentGuid, parentIncarnation));
|
||||
Assert.False(relations.TryGetCommittedParent(childGuid, out _, out _));
|
||||
Assert.False(relations.HasCommittedParent(childGuid));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// #319 contract §6 test 9, the PARENT-removal companion. Dual-parent-
|
||||
/// class matrix. Removing the PARENT must converge the committed
|
||||
/// child's entry via <see cref="ParentAttachmentState.RemoveObject"/>'s
|
||||
/// parent-reference sweep.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[InlineData(0x50000920u, (ushort)2)]
|
||||
[InlineData(0x70000921u, (ushort)0)]
|
||||
public void LedgerConvergence_ParentRemoval_ZeroesEveryTable(
|
||||
uint parentGuid,
|
||||
ushort parentIncarnation)
|
||||
{
|
||||
const uint childGuid = 0x70000922u;
|
||||
var relations = new ParentAttachmentState();
|
||||
var relation = new ParentAttachmentRelation(
|
||||
parentGuid,
|
||||
childGuid,
|
||||
ParentLocation: 0,
|
||||
PlacementId: 0,
|
||||
parentIncarnation,
|
||||
ChildPositionSequence: 1);
|
||||
relations.AcceptCreateObjectRelation(relation);
|
||||
Assert.True(relations.CommitProjection(relation));
|
||||
relations.MarkProjected(relation, ParentProjectionCandidateKind.Recovery);
|
||||
|
||||
relations.RemoveObject(parentGuid);
|
||||
|
||||
Assert.Equal(0, relations.CommittedRelationCount);
|
||||
Assert.Equal(0, relations.RecoveryRelationCount);
|
||||
Assert.Equal(0, relations.StagedRelationCount);
|
||||
Assert.Empty(relations.ChildrenAttachedToParent(parentGuid, parentIncarnation));
|
||||
Assert.False(relations.HasCommittedParent(childGuid));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// #319 contract §6 test 9, full-teardown companion. Dual-parent-class
|
||||
/// matrix. <see cref="ParentAttachmentState.Clear"/> must converge every
|
||||
/// table to zero with a player-parented committed child AND a still-
|
||||
/// unresolved ParentEvent present simultaneously - the mid-session
|
||||
/// accumulation shape the architecture review's A5 finding was
|
||||
/// concerned with (now moot for the deleted deferred-CreateObject
|
||||
/// queue, but the pre-existing ParentEvent `_unresolvedByChild` queue
|
||||
/// this fix left untouched still needs its own convergence proof).
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[InlineData(0x50000930u, (ushort)9)]
|
||||
[InlineData(0x70000931u, (ushort)0)]
|
||||
public void LedgerConvergence_Teardown_ZeroesEveryTableWithMixedPendingState(
|
||||
uint parentGuid,
|
||||
ushort parentIncarnation)
|
||||
{
|
||||
const uint committedChildGuid = 0x70000932u;
|
||||
const uint unresolvedChildGuid = 0x70000933u;
|
||||
var relations = new ParentAttachmentState();
|
||||
var relation = new ParentAttachmentRelation(
|
||||
parentGuid,
|
||||
committedChildGuid,
|
||||
ParentLocation: 0,
|
||||
PlacementId: 0,
|
||||
parentIncarnation,
|
||||
ChildPositionSequence: 1);
|
||||
relations.AcceptCreateObjectRelation(relation);
|
||||
Assert.True(relations.CommitProjection(relation));
|
||||
relations.MarkProjected(relation, ParentProjectionCandidateKind.Recovery);
|
||||
relations.Enqueue(new ParentEvent.Parsed(
|
||||
parentGuid, unresolvedChildGuid, 0, 0, parentIncarnation, 1));
|
||||
|
||||
Assert.True(relations.CommittedRelationCount > 0);
|
||||
Assert.True(relations.UnresolvedRelationCount > 0);
|
||||
|
||||
relations.Clear();
|
||||
|
||||
Assert.Equal(0, relations.CommittedRelationCount);
|
||||
Assert.Equal(0, relations.RecoveryRelationCount);
|
||||
Assert.Equal(0, relations.StagedRelationCount);
|
||||
Assert.Equal(0, relations.UnresolvedRelationCount);
|
||||
Assert.False(relations.HasCommittedParent(committedChildGuid));
|
||||
Assert.Empty(relations.ChildrenAttachedToParent(parentGuid, parentIncarnation));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MultipleQueuedRelationsRemainOrderedAndNewestAcceptedWins()
|
||||
{
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue