docs(runtime): close exact world host ownership

docs/research/2026-07-15-retail-portal-space-pseudocode.md

@@ -661,6 +661,30 @@ destination.
 - The portal object is synthetic and never enters `LiveEntityRuntime`, world
   picking, collision, radar, or server GUID ownership.
 
+## Modern-runtime host projection mapping (Slice J6)
+
+The accepted retail sequence remains authoritative; Slice J6 changes only
+which process-local owner proves each edge:
+
+```text
+Runtime accepts exact generation + destination
+App prepares destination resources
+App acknowledges typed readiness to Runtime
+Runtime advances materialization / simulation availability
+App projects that exact generation into graphical state
+App acknowledges simulation release
+App releases the exact destination reservation
+App acknowledges reservation release
+App observes the normal viewport for that generation
+App acknowledges terminal projection
+Runtime may retire the completed host record
+```
+
+The Runtime token includes both generation and destination cell. A callback
+failure leaves the exact unacknowledged suffix live; a superseding portal
+cannot consume it. This is ownership bookkeeping around the existing retail
+order, not a timer, asynchronous UI queue, or alternate portal behavior.
+
 ## Cross-reference notes
 
 - `references/WorldBuilder` supplies the extracted setup/GfxObj mesh and modern

docs/research/2026-07-26-slice-j6-4-host-acknowledgement.md

@@ -0,0 +1,99 @@
+# Slice J6.4 closeout — exact graphical-host acknowledgement
+
+**Status:** COMPLETE
+**Production commit:** `18d17d8bb17ed9ff3ed01da8273e2948abe6398b`
+**Exact rollback:** `git revert 18d17d8bb17ed9ff3ed01da8273e2948abe6398b`
+
+## Result
+
+`RuntimeWorldTransitState` now owns the complete presentation-independent
+login/portal lifetime, including the exact work still owed by a graphical or
+headless host. App no longer infers completion from local booleans. Instead,
+Runtime issues one `RuntimeWorldHostProjectionToken` for the exact reveal
+generation and destination cell and records the remaining typed
+acknowledgements:
+
+1. host projection registered;
+2. simulation release projected;
+3. destination reservation released;
+4. terminal completion projected.
+
+Wrong-generation, wrong-cell, duplicate, empty, composite, reordered, and
+post-terminal acknowledgements are rejected. Cancellation and supersession
+retain the exact remaining suffix. Session reset refuses to erase an
+outstanding host obligation.
+
+`WorldRevealCoordinator` is now a strict graphical adapter. Its local records
+contain only App resource receipts associated with a Runtime token. The drain
+is serialized and re-entrancy safe: callback failure leaves the exact suffix
+retryable, while a callback that starts or cancels another reveal cannot
+overwrite or leak the prior destination reservation. `WorldGenerationQuiescence`
+uses the same edge-before-callback rule and converges audio to the newest
+desired state after failure or re-entrancy.
+
+Normalized runtime traces and connected checkpoints now expose both canonical
+ownership ledgers:
+
+- `RuntimeWorldEnvironmentOwnershipSnapshot`;
+- `RuntimeWorldTransitOwnershipSnapshot`, including host projection and
+  pending-host-acknowledgement counts.
+
+The connected gate rejects a stable checkpoint unless the environment owner is
+initialized with one active day group and all transit/host obligations have
+converged to zero.
+
+## Retail ordering preserved
+
+The ownership change preserves the already accepted retail order documented in
+`2026-07-15-retail-portal-space-pseudocode.md` and
+`2026-07-16-portal-completion-pseudocode.md`:
+
+- destination identity is accepted before placement;
+- readiness remains latched once accepted;
+- simulation is released only after materialization;
+- the normal viewport is observed before terminal completion;
+- incomplete destinations remain in the authored portal tunnel;
+- presentation resources retire after their final consumer edge.
+
+No portal timer, forced-ready path, alternate animation, additional frame
+queue, or new retail divergence was introduced.
+
+## Automated evidence
+
+- Focused Runtime host/ownership fixtures: 58 passed.
+- Focused App reveal/quiescence fixtures: 52 passed.
+- `AcDream.Runtime.Tests`: 365 passed.
+- `AcDream.App.Tests`: 3,716 passed / 3 skipped.
+- `dotnet build AcDream.slnx -c Release`: passed, zero errors.
+- Complete Release solution: 8,642 passed / 5 skipped.
+- Dependency/source guards prove the direct Runtime host loads no
+  App/UI/Silk/OpenAL/Arch/ImGui assembly and that App has no replacement
+  transit-authority field.
+- Failure-injection fixtures cover registration, simulation release,
+  reservation release, terminal completion, audio projection, reset, and
+  callback re-entrancy. Every ownership ledger converges to zero.
+
+The direct Runtime-only fixture completes login, portal, cancellation, and
+reset without constructing `GameWindow` or loading a graphical/audio backend.
+
+## Connected exact-binary evidence
+
+Report:
+`logs/connected-world-gate-20260726-182805/report.json`
+
+- exact commit:
+  `18d17d8bb17ed9ff3ed01da8273e2948abe6398b`;
+- capped route: login → Aerlinthe → Rynthid → Facility Hub → Holtburg →
+  Aerlinthe revisit;
+- uncapped route: fresh-process reconnect;
+- seven stable checkpoints;
+- both processes exited gracefully with code zero;
+- zero failures and only the expected world-edge landblock-miss warning;
+- every checkpoint reports `DayGroupDefinitionCount = 20`,
+  `ActiveDayGroupCount = 1`, `IsSessionIdle = true`,
+  `HostProjectionCount = 0`, and
+  `PendingHostAcknowledgementCount = 0`.
+
+This closes J6.4 and J6.5. Slice J6 has one Runtime environment owner, one
+Runtime transit/reveal owner, an exact host acknowledgement protocol, and no
+remaining App reconstruction of portal authority.