docs(runtime): close canonical entity object lifetime

AGENTS.md

@@ -232,7 +232,14 @@ direct borrowed views to graphical and no-window hosts. Runtime tests pass
 134/134, App tests pass 3,765/3 skips, the complete Release suite passes
 8,472/5 skips, and the exact-binary seven-checkpoint gate passes with graceful
 exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
-J3.6 adversarial lifetime and zero-owner closeout is active. J0's rollback is
+J3.6 is complete at `119b7c11`: exact teardown receipts precede fallible
+callbacks, re-entrant commits retain one monotonic synchronous stream,
+accepted-channel versions reject displaced callbacks, and reset/direct
+disposal converge the complete ownership ledger to zero. Runtime tests pass
+146/146, App tests pass 3,765/3 skips, the complete Release suite passes
+8,484/5 skips, and both the exact lifecycle/reconnect and canonical nine-stop
+routes pass with graceful zero-code exits and no failures. J3 is closed; J4
+gameplay-state lifetime groups are active. J0's rollback is
 `git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
 J1's rollback is
 `git revert 854d9e9cd13092bd5aaa3cf025d73eeb4600e9f8`.
@@ -247,12 +254,15 @@ J3.4's rollback is
 `git revert 5ef8b5371d8990f0380acd939e71cd711289d429`.
 J3.5's rollback is
 `git revert ce3ac310d92722ffb637e81cb1957458874dd220`.
+J3.6's rollback is
+`git revert 119b7c115107245546180b2f5cb3cb44c7d5476a`.
 Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
 work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
 passes. Slice I is closed in
 `docs/plans/2026-07-25-modern-runtime-slice-i.md`; the coherent Slice J campaign
-executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 starts at
+executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 closeout
-`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. The exact G4 visual rollback
+is `docs/research/2026-07-26-slice-j3-6-lifetime-closeout.md`. The exact G4
+visual rollback
 is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or
 the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-h-closeout.md` and
@@ -269,7 +279,8 @@ the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-j3-2-canonical-entity-directory-closeout.md` and
 `docs/research/2026-07-25-slice-j3-3-exact-projection-store.md` and
 `docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md` and
-`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
+`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md` and
+`docs/research/2026-07-26-slice-j3-6-lifetime-closeout.md`.
 
 **Structural prerequisite before new M4 subsystem work:** all eight
 behavior-preserving `GameWindow` decomposition slices and the automated

CLAUDE.md

@@ -230,7 +230,14 @@ direct borrowed views to graphical and no-window hosts. Runtime tests pass
 134/134, App tests pass 3,765/3 skips, the complete Release suite passes
 8,472/5 skips, and the exact-binary seven-checkpoint gate passes with graceful
 exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
-J3.6 adversarial lifetime and zero-owner closeout is active. J0's rollback is
+J3.6 is complete at `119b7c11`: exact teardown receipts precede fallible
+callbacks, re-entrant commits retain one monotonic synchronous stream,
+accepted-channel versions reject displaced callbacks, and reset/direct
+disposal converge the complete ownership ledger to zero. Runtime tests pass
+146/146, App tests pass 3,765/3 skips, the complete Release suite passes
+8,484/5 skips, and both the exact lifecycle/reconnect and canonical nine-stop
+routes pass with graceful zero-code exits and no failures. J3 is closed; J4
+gameplay-state lifetime groups are active. J0's rollback is
 `git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
 J1's rollback is
 `git revert 854d9e9cd13092bd5aaa3cf025d73eeb4600e9f8`.
@@ -245,12 +252,15 @@ J3.4's rollback is
 `git revert 5ef8b5371d8990f0380acd939e71cd711289d429`.
 J3.5's rollback is
 `git revert ce3ac310d92722ffb637e81cb1957458874dd220`.
+J3.6's rollback is
+`git revert 119b7c115107245546180b2f5cb3cb44c7d5476a`.
 Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
 work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
 passes. Slice I is closed in
 `docs/plans/2026-07-25-modern-runtime-slice-i.md`; the coherent Slice J campaign
-executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 starts at
+executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 closeout
-`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. The exact G4 visual rollback
+is `docs/research/2026-07-26-slice-j3-6-lifetime-closeout.md`. The exact G4
+visual rollback
 is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or
 the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-h-closeout.md` and
@@ -267,7 +277,8 @@ the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-j3-2-canonical-entity-directory-closeout.md` and
 `docs/research/2026-07-25-slice-j3-3-exact-projection-store.md` and
 `docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md` and
-`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
+`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md` and
+`docs/research/2026-07-26-slice-j3-6-lifetime-closeout.md`.
 
 **Structural prerequisite before new M4 subsystem work:** all eight
 behavior-preserving `GameWindow` decomposition slices and the automated

docs/architecture/acdream-architecture.md

@@ -217,7 +217,7 @@ src/
       RuntimeEntityObjectViews.cs -> direct allocation-free borrowed views
       InboundPhysicsStateController.cs -> retail timestamp/snapshot authority
       ParentAttachmentState.cs -> generation-exact parent relations
-    -> J3.1-J3.5 complete; J3.6 adversarial lifetime closeout active
+    -> J3 complete; J4 gameplay-state lifetime groups active
     -> may reference Core, Core.Net, Content, and Plugin.Abstractions only
     -> must never reference App, UI, Silk.NET, OpenAL, Arch, or ImGui
   

docs/architecture/code-structure.md

@@ -470,14 +470,14 @@ useful ordering seam, but its ownership status is **partial**.
 | Startup options | **Complete** | `RuntimeOptions` owns startup configuration (`eda936dc`). Remaining direct environment reads are legacy runtime diagnostics, not startup configuration. |
 | Network session | **Complete Runtime ownership** | `RuntimeLiveSessionController` owns the sole `WorldSession` generation and resolve/create/Connect/selection/EnterWorld/Tick/stop/reconnect/disposal transaction. Runtime route owners preserve exact inbound/outbound ordering and retryable teardown. App supplies immutable options, graphical/domain callbacks, and one borrowed inertable UI command projection—no mirrored session or reset plan (`75930787`). |
 | World environment | **Complete ownership** | `WorldEnvironmentController` solely owns WorldTime, the loaded DAT sky, current day group, Weather, server synchronization, AdminEnvirons bridging, and debug time/weather cycles. `GameWindow` keeps ABI-compatible readonly aliases to the same clock/weather instances and composes one render source plus the two live-session callbacks. TS-54/TS-55 register the remaining centered UI sound and full fog/ambient/radar behavior gaps. |
-| Live identity/lifetime | **J3.4 complete** | `RuntimeEntityObjectLifetime` owns the sole `RuntimeEntityDirectory` and live `ClientObjectTable`. The directory owns canonical GUID/incarnation/local-ID identity, accepted snapshots/timestamps, parent state, operation versions, and tombstones. `LiveEntityProjectionStore` owns App graphical sidecars by exact `RuntimeEntityKey`; hydration, presentation components, `GpuWorldState` residence/visibility, and retryable teardown preserve that key without another authority (`f46ddb5c`, `420e5eea`, `e937cc36`, `5ef8b537`). Authoritative delete removes retained object state; dormant projection pruning does not. |
+| Live identity/lifetime | **J3 complete** | `RuntimeEntityObjectLifetime` owns the sole `RuntimeEntityDirectory`, live `ClientObjectTable`, direct views, and ordered entity/object stream. The directory owns canonical GUID/incarnation/local-ID identity, accepted snapshots/timestamps, parent state, operation versions, and tombstones. `LiveEntityProjectionStore` owns App graphical sidecars by exact `RuntimeEntityKey`; hydration, presentation components, `GpuWorldState` residence/visibility, and retryable teardown preserve that key without another authority. Exact receipts precede fallible callbacks, re-entrant commits drain synchronously in sequence, and stable reset/disposal must converge the complete ledger to zero (`f46ddb5c`, `420e5eea`, `e937cc36`, `5ef8b537`, `ce3ac310`, `119b7c11`). |
 | Inbound/object-frame order | **Complete App orchestration** | `UpdateFrameOrchestrator` owns the complete typed host phase graph; `RetailInboundEventDispatcher`, `RetailLiveFrameCoordinator`, `LiveObjectFrameController`, `LiveSpatialPresentationReconciler`, streaming/input/teleport/player-mode/camera owners preserve the accepted order. `GameWindow.OnUpdate` is one profiler-scoped handoff (`e91f3102`). |
 | World reveal | **Complete** | `WorldRevealCoordinator` owns login/portal readiness, generation quiescence, and the exact streaming destination reservation. Login auto-entry and portal completion close only their active generation; stale completion cannot clear its replacement. Delayed portals retain the authored tunnel and centered retail wait notice rather than force-revealing incomplete content. Quiesced destination projections may become spatially resident for renderer preparation while all availability-gated gameplay consumers stay closed. |
 | Retained gameplay UI | **Mostly complete feature ownership** | `RetailUiRuntime` and focused panel/controllers own layout and behavior. `GameWindow.OnLoad` still performs substantial service composition, which is allowed until the final composition cleanup. |
 | Selection/interaction | **Complete** | `WorldSelectionQuery` owns read-only picking/classification/range queries; `SelectionInteractionController` owns selection intent, Use/PickUp transport, exact-incarnation queues, and auto-walk deferral; `ItemInteractionController` owns ItemHolder policy plus the shared retail inventory-request transaction. `GameWindow` retains construction and narrow lifecycle forwarding only. |
 | Landblock presentation | **Complete** | `LandblockBuildFactory` owns the captured-origin DAT transaction; concrete render/physics/DAT-static publishers and `LandblockPresentationPipeline` own typed-meter publication and exact retryable retirement. `StreamingController` owns stable destination/control/unload/Near/Far queues and destination reservation. CPU mesh-cache restaging requires an exact live owner. `StreamingOriginRecenterCoordinator` serializes old-window retirement with teleport/session origin lifetimes. `GameWindow` retains construction and one pipeline field only (`c79d0a49`, closeout `4a205a3e`; Slice E closeout `91e82c3c`). |
 | Render-frame orchestration | **Complete** | `RenderFrameOrchestrator` owns the GPU-flight, resource, world/PView/shared-alpha, private-presentation, diagnostics, screenshot, and recovery graph. `GameWindow.OnRender` takes one logical window-size snapshot and performs one immutable handoff (`9d7df1bf`). |
-| Unified `GameEntity` | **Slice J active** | Canonical identity, retained-object lifetime, direct views, and the ordered entity/object delta stream now share one Runtime owner while exact graphical sidecars stay in App. J3.6 adversarially closes that lifetime group; later J4–J7 move coherent gameplay lifetime groups before one Runtime composition root. |
+| Unified `GameEntity` | **Slice J active at J4** | Canonical identity, retained-object lifetime, direct views, and the ordered entity/object delta stream share one failure-safe Runtime owner while exact graphical sidecars stay in App. J4–J7 now move the remaining coherent gameplay lifetime groups before one Runtime composition root. |
 
 ### 4.3 Revised extraction sequence
 

docs/plans/2026-04-11-roadmap.md

@@ -1,6 +1,6 @@
 # acdream — strategic roadmap
 
-**Status:** Living document. Updated 2026-07-24. **M3 landed; M4 is active.** M3's retail casting/UI, R6 locomotion/collision/projectile/teleport/radar rebaseline, deterministic fresh-login/portal world lifecycle, and final two-client portal observer flow are user-gated. All eight slices of the behavior-preserving ownership campaign in [`docs/architecture/code-structure.md`](../architecture/code-structure.md), their automated closeout, and the user's connected visual matrix are complete. Issue #225's lifestone/particle alpha comparison remains a separate rendering visual gate.
+**Status:** Living document. Updated 2026-07-26. **M3 landed; M4 is active.** M3's retail casting/UI, R6 locomotion/collision/projectile/teleport/radar rebaseline, deterministic fresh-login/portal world lifecycle, and final two-client portal observer flow are user-gated. All eight slices of the behavior-preserving ownership campaign in [`docs/architecture/code-structure.md`](../architecture/code-structure.md), their automated closeout, and the user's connected visual matrix are complete. Modern Runtime J3's canonical entity/object lifetime is also closed; J4 gameplay-state lifetime groups are active. Issue #225's lifestone/particle alpha comparison remains a separate rendering visual gate.
 **Purpose:** One source of truth for where the project is and where it's going. Every observed defect or missing feature has a named phase that owns it; when something looks wrong in-game, look here to find the phase that'll address it. Implementation details live in per-phase specs under `docs/superpowers/specs/`, not in this file.
 
 ---
@@ -1705,7 +1705,13 @@ port in any phase — no separate listing here.
 > Its 134 Runtime tests, 3,765 App tests / 3 skips, 8,472-test / 5-skip
 > complete Release suite, and exact-binary seven-checkpoint gate pass with
 > graceful exits, zero failures, zero render-shadow mismatches, and zero
-> pending deltas. J3.6 adversarial lifetime and zero-owner closeout is active.
+> pending deltas. J3.6 is complete at `119b7c11`: the exact canonical
+> entity/object owner now survives callback failure and re-entrancy, retains
+> every incomplete teardown suffix, and converges the complete reset/disposal
+> ledger to zero. Its 146 Runtime tests, 3,765 App tests / 3 skips, 8,484-test
+> / 5-skip complete Release suite, exact lifecycle/reconnect gate, and
+> canonical nine-stop route pass. J4 gameplay-state lifetime groups are
+> active.
 > The historical exact cutover
 > rollback remains
 > `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`. Slice H is complete:

docs/plans/2026-05-12-milestones.md

@@ -181,9 +181,15 @@ residency is `0/0/0` at every stable checkpoint and teardown converges. Slice I
   graphical and no-window hosts. Its 134 Runtime tests, 3,765 App tests / 3
   skips, 8,472 full Release tests / 5 skips, and exact-binary
   seven-checkpoint connected gate pass with graceful exits, zero failures,
-  zero render-shadow mismatches, and zero pending deltas. J3.6 adversarial
+  zero render-shadow mismatches, and zero pending deltas. J3.6 is complete at
-  failure and zero-owner closeout is active under
+  `119b7c11`: exact teardown receipts precede fallible callbacks, re-entrant
-  [`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md).
+  observers retain one monotonic synchronous stream, accepted-channel
+  versions prevent displaced callbacks, and reset/direct disposal converge
+  the complete owner ledger to zero. Its 146 Runtime tests, 3,765 App tests /
+  3 skips, 8,484 full Release tests / 5 skips, exact lifecycle/reconnect gate,
+  and canonical nine-stop route pass. J4 gameplay-state lifetime groups are
+  active under
+  [`2026-07-25-modern-runtime-slice-j.md`](2026-07-25-modern-runtime-slice-j.md).
 Slice-I closeout evidence is
 [`../research/2026-07-25-slice-i7-closeout.md`](../research/2026-07-25-slice-i7-closeout.md).
 Slice-J2 closeout evidence is
@@ -196,6 +202,8 @@ Slice-J3.4 closeout evidence is
 [`../research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`](../research/2026-07-26-slice-j3-4-canonical-object-lifetime.md).
 Slice-J3.5 closeout evidence is
 [`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`](../research/2026-07-26-slice-j3-5-canonical-delta-stream.md).
+Slice-J3.6 closeout evidence is
+[`../research/2026-07-26-slice-j3-6-lifetime-closeout.md`](../research/2026-07-26-slice-j3-6-lifetime-closeout.md).
 The historical exact G4 visual rollback remains
 `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`.
 

docs/plans/2026-07-24-modern-runtime-architecture.md

@@ -2,15 +2,16 @@
 
 **Date:** 2026-07-24
 
-**Status:** Slices A–I and J0–J3.5 are complete. Flat-authoritative collision, zero-
+**Status:** Slices A–I and J0–J3 are complete. Flat-authoritative collision, zero-
 allocation resolve scratch, parsed-graph removal, connected correctness/
 lifetime acceptance, and Slice-I closeout landed 2026-07-25. Slices F–L were
 explicitly approved 2026-07-24. Slice J0–J1 established the enforced Runtime
 boundary and borrowed contract seam; J2 moved canonical session/transport
-lifetime and ordered inbound routing; J3.1–J3.5 moved canonical entity identity
+lifetime and ordered inbound routing; J3.1–J3.6 moved canonical entity identity
 and object-table lifetime to Runtime, exact graphical projection identity to
 App, and one ordered canonical entity/object stream plus direct views to all
-hosts. J3.6 adversarial lifetime closeout is the active execution point.
+hosts and closed the failure-safe owner ledger. J4 gameplay-state lifetime
+groups are the active execution point.
 
 **Scope:** Reconcile and sequence the existing Modern Pipeline (`MP`) and
 Linux/headless (`LH`) tracks using the 2026-07-24 connected performance audit.
@@ -1251,16 +1252,20 @@ gameplay before removing every production parsed collision graph. Slice I7
 passes 8,413 Release tests / 5 skips plus both exact-binary connected routes;
 every stable checkpoint reports zero retained parsed collision graphs. J1 is
 complete with borrowed contracts, and J2 owns canonical session/transport
-lifetime plus ordered inbound routing in Runtime. J3.1–J3.5 are complete:
+lifetime plus ordered inbound routing in Runtime. J3.1–J3.6 are complete:
 Runtime owns the only entity GUID/incarnation/local-ID directory, and App's
 materialized sidecars plus spatial/presentation worksets carry exact
 `RuntimeEntityKey`. One `RuntimeEntityObjectLifetime` also owns the exact live
 `ClientObjectTable`; App is a synchronous borrower. Exact `ce3ac310` adds the
 one per-generation canonical entity/object delta stream, issues Runtime
 identity before App hydration, and gives graphical/no-window hosts the same
-direct borrowed views. Its 8,472-test / 5-skip Release suite and exact-binary
+direct borrowed views. J3.6 at `119b7c11` retains exact teardown receipts
-seven-checkpoint connected route pass. J3.6 adversarial failure and zero-owner
+before fallible callbacks, serializes re-entrant observation within the
-closeout is the current execution point.
+committing call, protects every accepted channel by mutation version, and
+requires reset/direct disposal to converge the complete ownership ledger to
+zero. Its 8,484-test / 5-skip Release suite, exact-binary lifecycle/reconnect
+gate, and canonical nine-stop route pass. J4 gameplay-state lifetime groups
+are the current execution point.
 Evidence:
 [`../research/2026-07-25-slice-g5-production-profile.md`](../research/2026-07-25-slice-g5-production-profile.md)
 and
@@ -1278,6 +1283,8 @@ and
 and
 [`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`](../research/2026-07-26-slice-j3-5-canonical-delta-stream.md)
 and
+[`../research/2026-07-26-slice-j3-6-lifetime-closeout.md`](../research/2026-07-26-slice-j3-6-lifetime-closeout.md)
+and
 [`2026-07-25-modern-runtime-slice-j.md`](2026-07-25-modern-runtime-slice-j.md).
 
 The intended order is therefore:
@@ -1292,7 +1299,7 @@ honest metrics + committed baselines        (A — exit criteria block C)
   -> delta GPU submission                   (G)
   -> residual frame cleanup                 (H-a, H-b, H-c)
   -> flat collision assets                  (I — COMPLETE)
-  -> presentation-independent runtime       (J — CURRENT at J3.6)
+  -> presentation-independent runtime       (J — CURRENT at J4)
   -> Linux/headless/multi-session           (K)
   -> evidence-gated GPU jobs                (L)
 ```

docs/plans/2026-07-25-modern-runtime-slice-j.md

@@ -1,7 +1,6 @@
 # Modern runtime Slice J — presentation-independent runtime
 
-**Status:** J0–J2 COMPLETE; J3.1–J3.5 COMPLETE; J3.6 adversarial lifetime
+**Status:** J0–J3 COMPLETE; J4 gameplay-state lifetime groups are active
-hardening and zero-owner closeout are active
 **Parent:** `2026-07-24-modern-runtime-architecture.md`, Slice J
 **Authorization:** the user approved Slices F–L, including the otherwise-frozen
 Slice J gameplay-owner moves, on 2026-07-24
@@ -183,20 +182,21 @@ git revert 75930787741db40a83eab8663e4464dce8d687ba
 **Detailed execution plan:**
 [`2026-07-25-modern-runtime-slice-j3.md`](2026-07-25-modern-runtime-slice-j3.md).
 
-**Current checkpoint:** J3.1–J3.5 are complete. Runtime owns accepted entity
+**Completed 2026-07-26.** Runtime owns accepted entity
 wire state and the only canonical identity/incarnation/local-ID directory.
 App's `LiveEntityProjectionStore` and every materialized presentation/spatial
 workset are keyed by exact `RuntimeEntityKey`; the temporary GUID-shaped
 compatibility view is deleted. `RuntimeEntityObjectLifetime` now owns the
 exact entity directory and live `ClientObjectTable`; App, routing, interaction,
-and UI borrow both. Exact J3.5 binary `ce3ac310` now publishes one committed
+and UI borrow both. Exact J3.5 binary `ce3ac310` publishes one committed
 per-generation Runtime entity/object delta stream, issues identity before App
 hydration, and supplies direct allocation-free views to graphical and
 no-window hosts. App reconstructs neither entity nor inventory state/events.
-Its 8,472 Release tests / 5 skips and exact seven-checkpoint connected gate at
+J3.6 at `119b7c11` makes every canonical commit, callback, teardown receipt,
-`logs/connected-world-gate-20260726-064324/report.json` pass. J3.6 now
+reset, and direct disposal failure-safe and proves the full owner ledger
-failure-injects the complete lifetime and proves every reset/disposal owner
+converges to zero. Its 8,484 Release tests / 5 skips, exact seven-checkpoint
-converges to zero.
+lifecycle/reconnect gate, and canonical nine-stop route pass. Evidence:
+[`../research/2026-07-26-slice-j3-6-lifetime-closeout.md`](../research/2026-07-26-slice-j3-6-lifetime-closeout.md).
 
 - Strip renderer, particle, Wb, and streaming components from the canonical
   record into an App projection store keyed only by local identity/incarnation.
@@ -213,6 +213,8 @@ match current traces; App has no server-GUID ownership.
 
 ### J4 — chat, inventory, magic, and gameplay-state services
 
+**Active 2026-07-26.**
+
 - Move canonical chat history/channel state, inventory transactions, spell and
   component state, enchantments, vitals, skills/attributes, and gameplay
   cooldown state by coherent owner groups.
@@ -224,6 +226,23 @@ match current traces; App has no server-GUID ownership.
 Gate: deterministic command/response traces and graphical ViewModel revisions
 match; no Runtime type references UI abstractions.
 
+Detailed execution begins with a source-ownership inventory. Move one coherent
+lifetime group at a time in this order:
+
+1. chat history/channel/command state;
+2. inventory transaction and gameplay item-use state that is not already
+   canonical in `RuntimeEntityObjectLifetime`;
+3. learned spells, formulas/components, enchantments, and cast/cooldown state;
+4. vitals, skills, attributes, advancement, and target/combat gameplay state;
+5. plugin/bot borrowed views and typed commands over those same owners;
+6. delete every replaced App owner/adapter, then run the combined no-window,
+   graphical parity, teardown, Release, lifecycle/reconnect, and nine-stop
+   gates.
+
+Panel trees, text layout, icons, 3-D paperdolls, status bars, and animation/VFX
+remain App presentation. The inventory object collection already moved in J3;
+J4 must borrow it rather than create another inventory model.
+
 ### J5 — movement, physics, interaction, and combat group
 
 - Move presentation-free movement interpretation, authoritative/predicted

docs/plans/2026-07-25-modern-runtime-slice-j3.md

@@ -1,6 +1,6 @@
 # Modern runtime Slice J3 — canonical identity, properties, and object table
 
-**Status:** ACTIVE — J3.1–J3.5 COMPLETE; J3.6 ACTIVE
+**Status:** COMPLETE 2026-07-26
 **Parent:** `2026-07-25-modern-runtime-slice-j.md`, J3
 **Production base:** `9496c01b`
 **J2 production commit:** `75930787741db40a83eab8663e4464dce8d687ba`
@@ -15,7 +15,7 @@
 | J3.3 App projection store | complete | `420e5eea70fd2c29cf9c8614e6298a1f84d64045` + `e937cc36df39cf6ea1eaba2f9c0243d1929da702`; 8,444 Release tests / 5 skips and `logs/connected-world-gate-20260725-221008/report.json` pass |
 | J3.4 canonical object-table ownership | complete | `5ef8b5371d8990f0380acd939e71cd711289d429`; 118 Runtime tests, 3,762 App tests / 3 skips, 8,453 complete Release tests / 5 skips, and `logs/connected-world-gate-20260726-055713/report.json` pass |
 | J3.5 ordered deltas and borrowed views | complete | `ce3ac310d92722ffb637e81cb1957458874dd220`; 134 Runtime tests, 3,765 App tests / 3 skips, 8,472 complete Release tests / 5 skips, and `logs/connected-world-gate-20260726-064324/report.json` pass |
-| J3.6 adversarial hardening and closeout | active | [`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md): failure-inject every lifetime boundary and prove zero owners after reset/disposal |
+| J3.6 adversarial hardening and closeout | complete | `119b7c115107245546180b2f5cb3cb44c7d5476a`; 146 Runtime tests, 3,765 App tests / 3 skips, 8,484 complete Release tests / 5 skips, exact lifecycle/reconnect gate, and canonical nine-stop route pass |
 
 J3.5 passes the Release solution build, 134 Runtime tests, 3,765 App tests with
 three skips, and 8,472 complete tests with five expected skips. Its exact-
@@ -31,6 +31,16 @@ gameplay behavior change was added. The exact rollback for J3.5 is:
 git revert ce3ac310d92722ffb637e81cb1957458874dd220
 ```
 
+J3.6 closes the group under callback failure, re-entrancy, retained teardown,
+reset, GUID reuse, and direct disposal. Its complete owner ledger converges to
+zero and both exact-binary connected routes pass. Evidence:
+[`../research/2026-07-26-slice-j3-6-lifetime-closeout.md`](../research/2026-07-26-slice-j3-6-lifetime-closeout.md).
+The exact rollback for J3.6 is:
+
+```text
+git revert 119b7c115107245546180b2f5cb3cb44c7d5476a
+```
+
 ## 1. Objective
 
 Move the one canonical server-object identity/incarnation owner, accepted
@@ -307,6 +317,7 @@ git revert f46ddb5cdb1e145752bea49aeb1d62bfe71284d3
 git revert f7442d13e9ae7d5b077ffecb1f8a10899ad46edd
 ```
 
-Revert J3.5 before J3.4. Revert J3.4 before J3.3. Revert J3.3's exact-spatial
+Revert J3.6 before J3.5. Revert J3.5 before J3.4. Revert J3.4 before J3.3.
+Revert J3.3's exact-spatial
 correction before its main projection-store commit. Revert J3.3 before J3.2,
 and J3.2 before J3.1, when rolling back more than one sub-slice.

docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md

@@ -1,6 +1,6 @@
 # Modern runtime J3.6 — adversarial lifetime hardening and closeout
 
-**Status:** READY
+**Status:** COMPLETE 2026-07-26 at `119b7c115107245546180b2f5cb3cb44c7d5476a`
 **Parent:** `2026-07-25-modern-runtime-slice-j3.md`
 **Required production base:** `ce3ac310d92722ffb637e81cb1957458874dd220`
 **Prior closeout:** `../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`
@@ -10,8 +10,10 @@
 Close the canonical entity/object lifetime group under failure, re-entrancy,
 reset, and disposal before J4 moves another gameplay owner.
 
-This slice adds no feature, queue, retry timer, renderer fallback, or gameplay
+This slice adds no feature, cross-frame/background queue, retry timer,
-behavior. It proves that Runtime's canonical identity/object owner and App's
+renderer fallback, or gameplay behavior. Its synchronous re-entrant dispatch
+drain preserves one observer-visible sequence within the committing call. It
+proves that Runtime's canonical identity/object owner and App's
 exact-key graphical projection either complete each transaction or retain one
 explicitly retryable suffix, and that every terminal path converges to zero.
 
@@ -179,18 +181,26 @@ J3 is complete only when:
 
 ## Rollback
 
-J3.5 remains independently reversible:
+J3.6 is independently reversible:
 
 ```text
-git revert ce3ac310d92722ffb637e81cb1957458874dd220
+git revert 119b7c115107245546180b2f5cb3cb44c7d5476a
 ```
 
-Record J3.6's exact production commit before its connected gates. Never revert
+J3.5 remains independently reversible with
-J3.4 or J3.3 to mask a J3.6 failure.
+`git revert ce3ac310d92722ffb637e81cb1957458874dd220`. Never revert J3.4
+or J3.3 to mask a later failure.
+
+## Closeout evidence
+
+The complete failure matrix, zero-owner ledger, 8,484-test Release result,
+exact-binary lifecycle/reconnect gate, canonical nine-stop route, divergence
+audit, and rollback are recorded in
+`../research/2026-07-26-slice-j3-6-lifetime-closeout.md`.
 
 ## Next boundary
 
-After J3.6 closes J3, execute J4 from
+J3 is closed. Execute J4 from
 `docs/plans/2026-07-25-modern-runtime-slice-j.md`: move the remaining
 presentation-independent gameplay-state owners in coherent lifetime groups,
 with direct/graphical parity and zero-mirror deletion after every group.

docs/research/2026-07-26-slice-j3-6-lifetime-closeout.md

@@ -0,0 +1,123 @@
+# Modern runtime J3.6 — canonical lifetime closeout
+
+**Status:** COMPLETE
+**Production commit:** `119b7c115107245546180b2f5cb3cb44c7d5476a`
+**Parent plan:** `../plans/2026-07-26-modern-runtime-slice-j3-hardening.md`
+
+## Result
+
+J3 now has one failure-safe entity/object lifetime from canonical Runtime
+registration through graphical projection, accepted mutation, authoritative
+delete, session clear, and direct disposal.
+
+`RuntimeEntityObjectLifetime` retains the exact active or teardown receipt
+before invoking fallible host callbacks. A callback can therefore fail,
+delete/recreate the same GUID, clear the session, or commit a newer mutation
+without making an owner unreachable or applying an older callback to a newer
+incarnation.
+
+The shared entity/object stream retains a synchronous in-call drain for
+re-entrant commits. This is not a background or cross-frame queue: the outer
+commit still completes synchronously, but every observer sees one monotonic
+sequence even when an earlier observer commits another fact while dispatch is
+in progress.
+
+Per-channel mutation versions protect ObjDesc, motion, vector, state,
+position, parent, pickup, rebucket, withdrawal, and child-NoDraw callbacks.
+Rejected or stale work consumes no sequence. A graphical acknowledgement
+failure cannot erase an already committed canonical fact.
+
+Direct disposal now executes the same retryable clear/retirement transaction
+as session shutdown, detaches borrowers, and requires the complete ownership
+ledger to converge before the stream is disposed.
+
+## Ownership ledger
+
+The closeout snapshot covers:
+
+- active and retained-teardown Runtime records and claimed local IDs;
+- accepted snapshots/timestamps, parent relations, and operation versions;
+- live object-table objects, containers, equipment owners, and pending moves;
+- Runtime stream subscribers, dispatch failures, and synchronous drain state;
+- exact-key App projections, spatial residence, presentation resources,
+  effects, lights, scripts, projectiles, shadows, and equipped children.
+
+Stable delete, reset, GUID reuse, and disposal fixtures require every field in
+that ledger to equal zero. Retained receipts are permitted only while an
+injected failure remains incomplete; retry or disposal must retire them
+exactly once.
+
+## Automated evidence
+
+- Runtime lifetime/stream suite: 146 passed.
+- Core `ClientObjectTable` focused suite: 86 passed.
+- Core.Net object-table wiring suite: 7 passed.
+- Focused App ownership, hydration, projection, adapter, and stress matrix:
+  161 passed.
+- Complete App suite: 3,765 passed / 3 established skips.
+- Complete Release solution: 8,484 passed / 5 established skips.
+- Release build: pass, zero errors. A clean rebuild reports 17 pre-existing
+  Core test warnings; the J3.6 production diff introduces none.
+- `git diff --check`: pass.
+
+The failure matrix covers registration/hydration failure, callback failure
+after commit, same-channel and cross-domain re-entrancy, rejected updates,
+optimistic object moves and rollback, authoritative removal, replacement,
+clear, delete/recreate, live direct disposal, and 96-owner
+churn/delete/reuse/reset cleanup.
+
+## Exact-binary connected evidence
+
+`logs/connected-world-gate-20260726-071554/report.json` passed on
+`119b7c115107245546180b2f5cb3cb44c7d5476a`:
+
+- six capped checkpoints and one fresh-process uncapped reconnect checkpoint;
+- 244.146-second capped route and 61.734-second reconnect route;
+- two graceful server-confirmed exits with code zero;
+- zero failures, render-shadow mismatches, pending render deltas, live
+  teardowns, retirements, staged uploads, or composite warmup.
+
+Its one warning is the route's established 25 world-edge empty-landblock
+probes.
+
+`logs/connected-r6-soak-20260726-072153.report.json` also passed on the exact
+same source and embedded binary commit:
+
+- all nine canonical world checkpoints and 18 movement/turn samples;
+- Caul, Sawato, Rynthid, Aerlinthe, Sawato revisit, Holtburg, Caul return,
+  Sawato plateau, and Caul plateau;
+- movement, jump, combat, repeated-location, portal, and long-lived churn
+  exercises;
+- 515.229 seconds total, graceful exit, code zero, and zero failures;
+- zero render-scene mismatches, pending render deltas, live teardowns,
+  landblock retirements, staged uploads, or streaming backlog at the final
+  checkpoint.
+
+The route's warnings are its population-sensitive revisit observations,
+known DAT-driven missing VFX diagnostics, and established world-edge probes.
+They are not invariant failures and do not identify a J3 ownership leak.
+
+## Retail and divergence audit
+
+J3.6 hardens commit, observation, retry, and teardown boundaries only. It does
+not alter an AC packet, timestamp rule, object-table rule, gameplay algorithm,
+visual path, input timing, or intended retail divergence. No divergence
+register row was added or retired.
+
+## Rollback
+
+Revert J3.6 only:
+
+```text
+git revert 119b7c115107245546180b2f5cb3cb44c7d5476a
+```
+
+Do not revert J3.5, J3.4, or J3.3 to mask a later gameplay-owner regression.
+
+## Next boundary
+
+J4 is active. Move chat, inventory/gameplay transactions, magic/effects,
+vitals/advancement, and cooldown state as coherent lifetime groups into
+Runtime. Each group must preserve the current graphical trace, expose the same
+borrowed state to no-window hosts, and delete its superseded App ownership
+before the next group begins.