erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs(runtime): close J3.5 and plan J3.6

Browse source 
Record the canonical entity/object delta cutover, full Release and exact-binary connected evidence, rollback, and the adversarial zero-owner J3.6 execution contract. Synchronize architecture, roadmap, milestones, and agent guidance.

Co-authored-by: Codex <codex@openai.com>
This commit is contained in:
Erik 2026-07-26 06:54:47 +02:00
parent ce3ac310d9
commit 84954c8b77
12 changed files with 405 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

19
AGENTS.md
View file

@ -225,8 +225,14 @@ live `ClientObjectTable`; App, routing, interaction, and UI borrow the exact
instances. Runtime tests pass 118/118, App tests pass 3,762/3 skips, the
complete Release suite passes 8,453/5 skips, and the exact-binary
seven-checkpoint gate passes with graceful exits, zero failures, zero
render-shadow mismatches, and zero pending deltas. J3.5 ordered canonical
entity/object deltas and direct borrowed views are next. J0's rollback is
render-shadow mismatches, and zero pending deltas. J3.5 is complete at
`ce3ac310`: Runtime issues identity before App hydration, publishes entity and
inventory commits through one per-generation sequence, and supplies the same
direct borrowed views to graphical and no-window hosts. Runtime tests pass
134/134, App tests pass 3,765/3 skips, the complete Release suite passes
8,472/5 skips, and the exact-binary seven-checkpoint gate passes with graceful
exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
J3.6 adversarial lifetime and zero-owner closeout is active. J0's rollback is
`git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
J1's rollback is
`git revert 854d9e9cd13092bd5aaa3cf025d73eeb4600e9f8`.
@ -239,12 +245,14 @@ J3.3's rollback is, newest first,
`git revert 420e5eea70fd2c29cf9c8614e6298a1f84d64045`.
J3.4's rollback is
`git revert 5ef8b5371d8990f0380acd939e71cd711289d429`.
J3.5's rollback is
`git revert ce3ac310d92722ffb637e81cb1957458874dd220`.
Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
passes. Slice I is closed in
`docs/plans/2026-07-25-modern-runtime-slice-i.md`; the coherent Slice J campaign
executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.5 starts at
`docs/plans/2026-07-26-modern-runtime-slice-j3-delta-stream.md`. The exact G4 visual rollback
executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 starts at
`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. The exact G4 visual rollback
is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or
the portal-warmup corrections. Evidence:
`docs/research/2026-07-25-slice-h-closeout.md` and
@ -260,7 +268,8 @@ the portal-warmup corrections. Evidence:
`docs/research/2026-07-25-slice-j2-session-lifetime-closeout.md` and
`docs/research/2026-07-25-slice-j3-2-canonical-entity-directory-closeout.md` and
`docs/research/2026-07-25-slice-j3-3-exact-projection-store.md` and
`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`.
`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md` and
`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
**Structural prerequisite before new M4 subsystem work:** all eight
behavior-preserving `GameWindow` decomposition slices and the automated

19
CLAUDE.md
View file

@ -223,8 +223,14 @@ live `ClientObjectTable`; App, routing, interaction, and UI borrow the exact
instances. Runtime tests pass 118/118, App tests pass 3,762/3 skips, the
complete Release suite passes 8,453/5 skips, and the exact-binary
seven-checkpoint gate passes with graceful exits, zero failures, zero
render-shadow mismatches, and zero pending deltas. J3.5 ordered canonical
entity/object deltas and direct borrowed views are next. J0's rollback is
render-shadow mismatches, and zero pending deltas. J3.5 is complete at
`ce3ac310`: Runtime issues identity before App hydration, publishes entity and
inventory commits through one per-generation sequence, and supplies the same
direct borrowed views to graphical and no-window hosts. Runtime tests pass
134/134, App tests pass 3,765/3 skips, the complete Release suite passes
8,472/5 skips, and the exact-binary seven-checkpoint gate passes with graceful
exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
J3.6 adversarial lifetime and zero-owner closeout is active. J0's rollback is
`git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
J1's rollback is
`git revert 854d9e9cd13092bd5aaa3cf025d73eeb4600e9f8`.
@ -237,12 +243,14 @@ J3.3's rollback is, newest first,
`git revert 420e5eea70fd2c29cf9c8614e6298a1f84d64045`.
J3.4's rollback is
`git revert 5ef8b5371d8990f0380acd939e71cd711289d429`.
J3.5's rollback is
`git revert ce3ac310d92722ffb637e81cb1957458874dd220`.
Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
passes. Slice I is closed in
`docs/plans/2026-07-25-modern-runtime-slice-i.md`; the coherent Slice J campaign
executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.5 starts at
`docs/plans/2026-07-26-modern-runtime-slice-j3-delta-stream.md`. The exact G4 visual rollback
executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 starts at
`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. The exact G4 visual rollback
is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or
the portal-warmup corrections. Evidence:
`docs/research/2026-07-25-slice-h-closeout.md` and
@ -258,7 +266,8 @@ the portal-warmup corrections. Evidence:
`docs/research/2026-07-25-slice-j2-session-lifetime-closeout.md` and
`docs/research/2026-07-25-slice-j3-2-canonical-entity-directory-closeout.md` and
`docs/research/2026-07-25-slice-j3-3-exact-projection-store.md` and
`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`.
`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md` and
`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
**Structural prerequisite before new M4 subsystem work:** all eight
behavior-preserving `GameWindow` decomposition slices and the automated

4
docs/architecture/acdream-architecture.md
View file

@ -213,9 +213,11 @@ src/
RuntimeEntityDirectory.cs -> sole GUID/incarnation/local-ID authority
RuntimeEntityRecord.cs -> presentation-free accepted entity state
RuntimeEntityObjectLifetime.cs -> one entity/object lifetime root
RuntimeEntityObjectEventStream.cs -> canonical ordered entity/object deltas
RuntimeEntityObjectViews.cs -> direct allocation-free borrowed views
InboundPhysicsStateController.cs -> retail timestamp/snapshot authority
ParentAttachmentState.cs -> generation-exact parent relations
-> J3.1-J3.4 complete; J3.5 ordered deltas/direct borrowed views next
-> J3.1-J3.5 complete; J3.6 adversarial lifetime closeout active
-> may reference Core, Core.Net, Content, and Plugin.Abstractions only
-> must never reference App, UI, Silk.NET, OpenAL, Arch, or ImGui

2
docs/architecture/code-structure.md
View file

@ -477,7 +477,7 @@ useful ordering seam, but its ownership status is **partial**.
| Selection/interaction | **Complete** | `WorldSelectionQuery` owns read-only picking/classification/range queries; `SelectionInteractionController` owns selection intent, Use/PickUp transport, exact-incarnation queues, and auto-walk deferral; `ItemInteractionController` owns ItemHolder policy plus the shared retail inventory-request transaction. `GameWindow` retains construction and narrow lifecycle forwarding only. |
| Landblock presentation | **Complete** | `LandblockBuildFactory` owns the captured-origin DAT transaction; concrete render/physics/DAT-static publishers and `LandblockPresentationPipeline` own typed-meter publication and exact retryable retirement. `StreamingController` owns stable destination/control/unload/Near/Far queues and destination reservation. CPU mesh-cache restaging requires an exact live owner. `StreamingOriginRecenterCoordinator` serializes old-window retirement with teleport/session origin lifetimes. `GameWindow` retains construction and one pipeline field only (`c79d0a49`, closeout `4a205a3e`; Slice E closeout `91e82c3c`). |
| Render-frame orchestration | **Complete** | `RenderFrameOrchestrator` owns the GPU-flight, resource, world/PView/shared-alpha, private-presentation, diagnostics, screenshot, and recovery graph. `GameWindow.OnRender` takes one logical window-size snapshot and performs one immutable handoff (`9d7df1bf`). |
| Unified `GameEntity` | **Slice J active** | Canonical identity and retained-object lifetime now share one Runtime owner while exact graphical sidecars stay in App. J3.5 next replaces App-reconstructed entity/inventory views and events with one committed Runtime delta stream; later J4–J7 move coherent gameplay lifetime groups before one Runtime composition root. |
| Unified `GameEntity` | **Slice J active** | Canonical identity, retained-object lifetime, direct views, and the ordered entity/object delta stream now share one Runtime owner while exact graphical sidecars stay in App. J3.6 adversarially closes that lifetime group; later J4–J7 move coherent gameplay lifetime groups before one Runtime composition root. |
### 4.3 Revised extraction sequence

9
docs/plans/2026-04-11-roadmap.md
View file

@ -1699,8 +1699,13 @@ port in any phase — no separate listing here.
> Runtime tests, 3,762 App tests / 3 skips, 8,453-test / 5-skip complete
> Release suite, and exact-binary seven-checkpoint gate pass with graceful
> exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
> J3.5 ordered canonical entity/object deltas and direct borrowed views are
> next.
> J3.5 is complete at `ce3ac310`: one per-generation Runtime stream now
> publishes canonical entity and inventory commits, identity is issued before
> App hydration, and graphical/no-window hosts borrow the same direct views.
> Its 134 Runtime tests, 3,765 App tests / 3 skips, 8,472-test / 5-skip
> complete Release suite, and exact-binary seven-checkpoint gate pass with
> graceful exits, zero failures, zero render-shadow mismatches, and zero
> pending deltas. J3.6 adversarial lifetime and zero-owner closeout is active.
> The historical exact cutover
> rollback remains
> `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`. Slice H is complete:

14
docs/plans/2026-05-12-milestones.md
View file

@ -175,9 +175,15 @@ residency is `0/0/0` at every stable checkpoint and teardown converges. Slice I
Runtime tests, 3,762 App tests / 3 skips, 8,453 full Release tests / 5 skips,
and exact-binary seven-checkpoint connected gate pass with graceful exits,
zero failures, zero render-shadow mismatches, and zero pending deltas.
J3.5 ordered canonical entity/object deltas and direct borrowed views are
next under
[`2026-07-25-modern-runtime-slice-j.md`](2026-07-25-modern-runtime-slice-j.md).
J3.5 is complete at `ce3ac310`: Runtime issues identity before App
hydration, publishes entity and inventory commits through one
per-generation sequence, and supplies the same direct borrowed views to
graphical and no-window hosts. Its 134 Runtime tests, 3,765 App tests / 3
skips, 8,472 full Release tests / 5 skips, and exact-binary
seven-checkpoint connected gate pass with graceful exits, zero failures,
zero render-shadow mismatches, and zero pending deltas. J3.6 adversarial
failure and zero-owner closeout is active under
[`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md).
Slice-I closeout evidence is
[`../research/2026-07-25-slice-i7-closeout.md`](../research/2026-07-25-slice-i7-closeout.md).
Slice-J2 closeout evidence is
@ -188,6 +194,8 @@ Slice-J3.3 closeout evidence is
[`../research/2026-07-25-slice-j3-3-exact-projection-store.md`](../research/2026-07-25-slice-j3-3-exact-projection-store.md).
Slice-J3.4 closeout evidence is
[`../research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`](../research/2026-07-26-slice-j3-4-canonical-object-lifetime.md).
Slice-J3.5 closeout evidence is
[`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`](../research/2026-07-26-slice-j3-5-canonical-delta-stream.md).
The historical exact G4 visual rollback remains
`git revert ef1d263337997bb030eadb7b8e71d73dc659907a`.

24
docs/plans/2026-07-24-modern-runtime-architecture.md
View file

@ -2,14 +2,15 @@
**Date:** 2026-07-24
**Status:** Slices A–I and J0–J3.4 are complete. Flat-authoritative collision, zero-
**Status:** Slices A–I and J0–J3.5 are complete. Flat-authoritative collision, zero-
allocation resolve scratch, parsed-graph removal, connected correctness/
lifetime acceptance, and Slice-I closeout landed 2026-07-25. Slices F–L were
explicitly approved 2026-07-24. Slice J0–J1 established the enforced Runtime
boundary and borrowed contract seam; J2 moved canonical session/transport
lifetime and ordered inbound routing; J3.1–J3.4 moved canonical entity identity
and object-table lifetime to Runtime and exact graphical projection identity
to App. J3.5 is the active execution point.
lifetime and ordered inbound routing; J3.1–J3.5 moved canonical entity identity
and object-table lifetime to Runtime, exact graphical projection identity to
App, and one ordered canonical entity/object stream plus direct views to all
hosts. J3.6 adversarial lifetime closeout is the active execution point.
**Scope:** Reconcile and sequence the existing Modern Pipeline (`MP`) and
Linux/headless (`LH`) tracks using the 2026-07-24 connected performance audit.
@ -1250,13 +1251,16 @@ gameplay before removing every production parsed collision graph. Slice I7
passes 8,413 Release tests / 5 skips plus both exact-binary connected routes;
every stable checkpoint reports zero retained parsed collision graphs. J1 is
complete with borrowed contracts, and J2 owns canonical session/transport
lifetime plus ordered inbound routing in Runtime. J3.1–J3.4 are complete:
lifetime plus ordered inbound routing in Runtime. J3.1–J3.5 are complete:
Runtime owns the only entity GUID/incarnation/local-ID directory, and App's
materialized sidecars plus spatial/presentation worksets carry exact
`RuntimeEntityKey`. One `RuntimeEntityObjectLifetime` also owns the exact live
`ClientObjectTable`; App is a synchronous borrower. J3.5's ordered canonical
entity/object delta stream and direct borrowed views are the current execution
point.
`ClientObjectTable`; App is a synchronous borrower. Exact `ce3ac310` adds the
one per-generation canonical entity/object delta stream, issues Runtime
identity before App hydration, and gives graphical/no-window hosts the same
direct borrowed views. Its 8,472-test / 5-skip Release suite and exact-binary
seven-checkpoint connected route pass. J3.6 adversarial failure and zero-owner
closeout is the current execution point.
Evidence:
[`../research/2026-07-25-slice-g5-production-profile.md`](../research/2026-07-25-slice-g5-production-profile.md)
and
@ -1272,6 +1276,8 @@ and
and
[`../research/2026-07-25-slice-j3-3-exact-projection-store.md`](../research/2026-07-25-slice-j3-3-exact-projection-store.md)
and
[`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`](../research/2026-07-26-slice-j3-5-canonical-delta-stream.md)
and
[`2026-07-25-modern-runtime-slice-j.md`](2026-07-25-modern-runtime-slice-j.md).
The intended order is therefore:
@ -1286,7 +1292,7 @@ honest metrics + committed baselines (A — exit criteria block C)
-> delta GPU submission (G)
-> residual frame cleanup (H-a, H-b, H-c)
-> flat collision assets (I — COMPLETE)
-> presentation-independent runtime (J — CURRENT at J3.5)
-> presentation-independent runtime (J — CURRENT at J3.6)
-> Linux/headless/multi-session (K)
-> evidence-gated GPU jobs (L)
```

19
docs/plans/2026-07-25-modern-runtime-slice-j.md
View file

@ -1,7 +1,7 @@
# Modern runtime Slice J — presentation-independent runtime
**Status:** J0–J2 COMPLETE; J3.1–J3.4 COMPLETE; J3.5 ordered canonical
entity/object deltas and borrowed views are next
**Status:** J0–J2 COMPLETE; J3.1–J3.5 COMPLETE; J3.6 adversarial lifetime
hardening and zero-owner closeout are active
**Parent:** `2026-07-24-modern-runtime-architecture.md`, Slice J
**Authorization:** the user approved Slices F–L, including the otherwise-frozen
Slice J gameplay-owner moves, on 2026-07-24
@ -183,17 +183,20 @@ git revert 75930787741db40a83eab8663e4464dce8d687ba
**Detailed execution plan:**
[`2026-07-25-modern-runtime-slice-j3.md`](2026-07-25-modern-runtime-slice-j3.md).
**Current checkpoint:** J3.1–J3.4 are complete. Runtime owns accepted entity
**Current checkpoint:** J3.1–J3.5 are complete. Runtime owns accepted entity
wire state and the only canonical identity/incarnation/local-ID directory.
App's `LiveEntityProjectionStore` and every materialized presentation/spatial
workset are keyed by exact `RuntimeEntityKey`; the temporary GUID-shaped
compatibility view is deleted. `RuntimeEntityObjectLifetime` now owns the
exact entity directory and live `ClientObjectTable`; App, routing, interaction,
and UI borrow both. The J3.4 binary `5ef8b537` passes 8,453 Release tests / 5
skips and the exact seven-checkpoint connected gate at
`logs/connected-world-gate-20260726-055713/report.json`. J3.5 now publishes
one committed Runtime entity/object delta stream and replaces App-reconstructed
entity/inventory views and events.
and UI borrow both. Exact J3.5 binary `ce3ac310` now publishes one committed
per-generation Runtime entity/object delta stream, issues identity before App
hydration, and supplies direct allocation-free views to graphical and
no-window hosts. App reconstructs neither entity nor inventory state/events.
Its 8,472 Release tests / 5 skips and exact seven-checkpoint connected gate at
`logs/connected-world-gate-20260726-064324/report.json` pass. J3.6 now
failure-injects the complete lifetime and proves every reset/disposal owner
converges to zero.
- Strip renderer, particle, Wb, and streaming components from the canonical
record into an App projection store keyed only by local identity/incarnation.

29
docs/plans/2026-07-25-modern-runtime-slice-j3.md
View file

@ -1,6 +1,6 @@
# Modern runtime Slice J3 — canonical identity, properties, and object table
**Status:** ACTIVE — J3.1–J3.4 COMPLETE; J3.5 NEXT
**Status:** ACTIVE — J3.1–J3.5 COMPLETE; J3.6 ACTIVE
**Parent:** `2026-07-25-modern-runtime-slice-j.md`, J3
**Production base:** `9496c01b`
**J2 production commit:** `75930787741db40a83eab8663e4464dce8d687ba`
@ -14,21 +14,21 @@
| J3.2 canonical Runtime entity directory | complete | `f46ddb5cdb1e145752bea49aeb1d62bfe71284d3`; 8,441 Release tests / 5 skips and `logs/connected-world-gate-20260725-200749/report.json` pass |
| J3.3 App projection store | complete | `420e5eea70fd2c29cf9c8614e6298a1f84d64045` + `e937cc36df39cf6ea1eaba2f9c0243d1929da702`; 8,444 Release tests / 5 skips and `logs/connected-world-gate-20260725-221008/report.json` pass |
| J3.4 canonical object-table ownership | complete | `5ef8b5371d8990f0380acd939e71cd711289d429`; 118 Runtime tests, 3,762 App tests / 3 skips, 8,453 complete Release tests / 5 skips, and `logs/connected-world-gate-20260726-055713/report.json` pass |
| J3.5 ordered deltas and borrowed views | next | [`2026-07-26-modern-runtime-slice-j3-delta-stream.md`](2026-07-26-modern-runtime-slice-j3-delta-stream.md): one committed Runtime entity/object stream and direct borrowed views for graphical and no-window hosts |
| J3.5 ordered deltas and borrowed views | complete | `ce3ac310d92722ffb637e81cb1957458874dd220`; 134 Runtime tests, 3,765 App tests / 3 skips, 8,472 complete Release tests / 5 skips, and `logs/connected-world-gate-20260726-064324/report.json` pass |
| J3.6 adversarial hardening and closeout | active | [`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md): failure-inject every lifetime boundary and prove zero owners after reset/disposal |
J3.4 passes the Release solution build, 118 Runtime tests, 3,762 App tests with
three skips, and 8,453 complete tests with five expected skips. Its exact-
J3.5 passes the Release solution build, 134 Runtime tests, 3,765 App tests with
three skips, and 8,472 complete tests with five expected skips. Its exact-
binary seven-checkpoint connected lifecycle/reconnect route also passes with
graceful exits, zero render-shadow mismatches, and zero pending deltas. Runtime
now owns one entity/object lifetime root containing both the sole
GUID/incarnation/local-ID authority and the sole live `ClientObjectTable`.
Graphical presentation and UI borrow those exact instances. Authoritative
delete removes retained object information; dormant/offscreen pruning does
not. No frame queue, backend dependency, allocation-order change, or gameplay
behavior change was added. The exact rollback for J3.4 is:
now issues canonical identity before graphical hydration, publishes entity and
inventory commits through one per-generation sequence, and exposes the same
direct borrowed views to graphical and no-window hosts. App no longer
reconstructs those views or events. No frame queue, backend dependency, or
gameplay behavior change was added. The exact rollback for J3.5 is:
```text
git revert 5ef8b5371d8990f0380acd939e71cd711289d429
git revert ce3ac310d92722ffb637e81cb1957458874dd220
```
## 1. Objective
@ -299,6 +299,7 @@ failure; record and revert only the exact failing J3 commit.
J3 sub-slices are independently reversible:
```text
git revert ce3ac310d92722ffb637e81cb1957458874dd220
git revert 5ef8b5371d8990f0380acd939e71cd711289d429
git revert e937cc36df39cf6ea1eaba2f9c0243d1929da702
git revert 420e5eea70fd2c29cf9c8614e6298a1f84d64045
@ -306,6 +307,6 @@ git revert f46ddb5cdb1e145752bea49aeb1d62bfe71284d3
git revert f7442d13e9ae7d5b077ffecb1f8a10899ad46edd
```
Revert J3.4 before J3.3. Revert J3.3's exact-spatial correction before its
main projection-store commit. Revert J3.3 before J3.2, and J3.2 before J3.1,
when rolling back more than one sub-slice.
Revert J3.5 before J3.4. Revert J3.4 before J3.3. Revert J3.3's exact-spatial
correction before its main projection-store commit. Revert J3.3 before J3.2,
and J3.2 before J3.1, when rolling back more than one sub-slice.

15
docs/plans/2026-07-26-modern-runtime-slice-j3-delta-stream.md
View file

@ -1,6 +1,6 @@
# Modern runtime J3.5 — committed entity/object deltas and borrowed views
**Status:** READY
**Status:** COMPLETE — `ce3ac310d92722ffb637e81cb1957458874dd220`
**Parent:** `2026-07-25-modern-runtime-slice-j3.md`
**Required production base:** `5ef8b5371d8990f0380acd939e71cd711289d429`
**Prior closeout:** `docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`
@ -297,18 +297,21 @@ a visible inventory, selection, radar, paperdoll, or world-object symptom.
## Rollback
Record the exact J3.5 production commit here before its connected gate. J3.4
remains independently reversible:
J3.5 is independently reversible:
```text
git revert 5ef8b5371d8990f0380acd939e71cd711289d429
git revert ce3ac310d92722ffb637e81cb1957458874dd220
```
Do not revert J3.4 as a shortcut for a J3.5 failure.
Do not revert J3.4 as a shortcut for a J3.5 failure. Automated and connected
evidence is recorded in
`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
## Next boundary
J3.6 failure-injects the complete canonical entity/object lifecycle and proves
J3.6 executes from
[`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md).
It failure-injects the complete canonical entity/object lifecycle and proves
zero records, tombstones, projections, resources, container entries, parent
candidates, subscriptions, or pending deltas after reset and disposal. That
closeout is required before J4 moves chat, inventory transactions, vitals,

196
docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md Normal file
View file

@ -0,0 +1,196 @@
# Modern runtime J3.6 — adversarial lifetime hardening and closeout
**Status:** READY
**Parent:** `2026-07-25-modern-runtime-slice-j3.md`
**Required production base:** `ce3ac310d92722ffb637e81cb1957458874dd220`
**Prior closeout:** `../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`
## Objective
Close the canonical entity/object lifetime group under failure, re-entrancy,
reset, and disposal before J4 moves another gameplay owner.
This slice adds no feature, queue, retry timer, renderer fallback, or gameplay
behavior. It proves that Runtime's canonical identity/object owner and App's
exact-key graphical projection either complete each transaction or retain one
explicitly retryable suffix, and that every terminal path converges to zero.
## Fixed boundary
- Runtime remains the sole GUID/incarnation/local-ID, accepted-wire,
parent-relation, object-table, direct-view, and entity/object-event owner.
- App remains an exact-key projection and resource host.
- The server remains authoritative.
- Existing synchronous retail ordering remains unchanged.
- J4 chat, vitals, enchantments, spells/components, cooldowns, and
ViewModel-facing revisions do not enter this slice.
- A failure test may expose a production ownership defect. Fix the owning
transaction at its commit/acknowledgement boundary; do not add a suppression
flag, timer, retry loop, or symptom guard.
## Execution
### 1. Pin the complete ownership ledger
Create one assertion helper that reports every J3 owner:
- active Runtime records;
- teardown Runtime records and claimed local IDs;
- accepted snapshot/timestamp and parent-relation entries;
- active and teardown App projections;
- materialized world entities and graphical resource registrations;
- spatial loaded/pending projection keys;
- animation, remote-motion, projectile, root-object, effect, light, script,
and equipped-child bindings;
- object-table objects, containers, pending moves, and replacement state;
- Runtime stream subscriptions, dispatch failures, and pending work.
The helper must distinguish an intentionally retained retry receipt from a
leak. A stable terminal checkpoint permits neither.
### 2. Failure-inject canonical registration and hydration
Exercise failures and re-entry:
- before and after Runtime active-record/local-ID commit;
- same-incarnation refresh;
- generation replacement while prior App teardown succeeds or fails;
- projection sidecar creation;
- world-entity factory;
- resource registration before commit and after partial commit;
- resource rollback before and after commit;
- animation/physics/effect/relationship/ready publication stages;
- observer replacement, delete, and session clear during each callback.
Prove that a still-active Runtime incarnation never loses its key, a failed
partial owner remains reachable by one exact teardown receipt, and retry
cannot replay create-time resources already committed.
### 3. Failure-inject accepted updates and placement
Cover ObjDesc, motion, vector, state, position, parent, pickup, explicit
rebucket, withdrawal, and child-NoDraw:
- stale/equal/new/wrapped timestamps;
- loaded-to-loaded, loaded-to-pending, pending-to-loaded, and cellless
transitions;
- projection callback failure before and after the graphical mutation;
- observer delete/recreate or same-record newer update;
- parent event before the parent, before the child, and across GUID reuse;
- malformed or missing-object updates.
Assert the shared stream publishes only committed canonical facts, consumes
no sequence for rejected packets, never emits renderer visibility as a
withdrawal, and never applies a displaced callback to a replacement
incarnation.
### 4. Failure-inject object-table transactions
Run the exact object-table behavior through the Runtime stream:
- create/add versus update;
- optimistic container move;
- confirmation;
- rejection rollback;
- wield/container replacement;
- stack/value/property refresh;
- unknown-object move;
- authoritative entity delete;
- dormant/offscreen delete;
- clear and next-generation reuse;
- callback mutation of the same object or containing container.
Verify callback order, exact removed generation, immediate borrowed-view
visibility, and no second retained inventory collection.
### 5. Prove reset, retry, and disposal convergence
Inject a failure at every App teardown stage, then repeatedly invoke the
existing retryable teardown entry until it completes. Exercise:
- ordinary authoritative delete;
- delete/recreate with the same GUID;
- session reset during create, update, object callback, and teardown callback;
- logout;
- transport replacement;
- mid-portal disconnect;
- Runtime and App disposal;
- repeated subscription disposal and disposal from inside dispatch.
At convergence assert the complete ownership ledger is zero, the retired
generation cannot publish, the next generation starts at sequence one, and
later object-table mutations cannot reach disposed observers.
### 6. Runtime-only end-to-end fixture
Without loading App, UI, Silk.NET, OpenAL, Arch, or ImGui:
1. construct Runtime;
2. bind a generation and frame clock;
3. register several conflicting entity/object shapes;
4. apply properties, motion/vector/state/position, parent/container moves,
Hidden, pickup, delete/recreate, and clear;
5. visit direct views after each commit;
6. record the exact shared delta stream;
7. reset and reconnect;
8. dispose.
Run the same normalized input script through the graphical harness and require
exact equality. Assert the Runtime assembly load closure remains backend-free.
### 7. Closeout gates
Run, in order:
1. focused Runtime lifetime/stream failure matrix;
2. Core `ClientObjectTable*` and `ObjectTableWiring*`;
3. focused App hydration, projection, update, parent, rebucket, delete,
session-reset, selection, inventory, and paperdoll suites;
4. Runtime-only versus graphical normalized parity;
5. all Runtime tests;
6. all App tests;
7. `dotnet build AcDream.slnx -c Release`;
8. `dotnet test AcDream.slnx -c Release --no-build`;
9. exact-binary connected lifecycle/reconnect;
10. canonical nine-stop connected world route;
11. documentation, divergence, dependency, and source-ownership audit.
A user visual pause is required only if automated or connected evidence shows
a visible inventory, selection, radar, paperdoll, portal, or world-object
symptom.
## Acceptance
J3 is complete only when:
- every canonical mutation and terminal path has adversarial coverage;
- direct and graphical traces remain exact;
- rejected/stale work consumes no event sequence;
- no callback can mutate a superseded incarnation;
- every partial acquisition remains reachable and retryable;
- every stable reset/disposal checkpoint has zero records, tombstones, keys,
projections, resources, container entries, parent candidates,
subscriptions, and pending deltas;
- Runtime-only construction and lifecycle load no presentation/backend
assembly;
- full Release and both exact-binary connected routes pass;
- architecture, roadmap, milestones, AGENTS/CLAUDE, durable memory, and exact
rollback are synchronized.
## Rollback
J3.5 remains independently reversible:
```text
git revert ce3ac310d92722ffb637e81cb1957458874dd220
```
Record J3.6's exact production commit before its connected gates. Never revert
J3.4 or J3.3 to mask a J3.6 failure.
## Next boundary
After J3.6 closes J3, execute J4 from
`docs/plans/2026-07-25-modern-runtime-slice-j.md`: move the remaining
presentation-independent gameplay-state owners in coherent lifetime groups,
with direct/graphical parity and zero-mirror deletion after every group.

109
docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md Normal file
View file

@ -0,0 +1,109 @@
# Slice J3.5 closeout — canonical entity/object deltas
**Date:** 2026-07-26
**Production commit:** `ce3ac310d92722ffb637e81cb1957458874dd220`
**Status:** COMPLETE
## Result
`RuntimeEntityObjectLifetime` now owns one synchronous entity/object commit
stream in addition to the canonical entity directory and object table.
Graphical and no-window hosts read the same allocation-free borrowed views and
observe the same immutable deltas. App no longer reconstructs entity changes
from renderer visibility or inventory changes from a second object-table
subscription.
Runtime now:
- issues the exact local entity ID when the canonical record is registered,
before App hydration;
- exposes direct `IRuntimeEntityView` and `IRuntimeInventoryView` instances;
- stamps entity and inventory commits from one per-generation sequence;
- publishes registered, updated, rebucketed, hidden, withdrawn, and deleted
entity edges after canonical mutation;
- preserves added, updated, moved, removed, and cleared object-table order;
- retains unknown-object move identity and placement;
- isolates observer failures without interrupting canonical commits or later
observers;
- revalidates the exact incarnation and operation after synchronous,
re-entrant callbacks;
- detaches every observer and object-table callback on disposal.
`LiveEntityRuntime` is now an App projection/acknowledgement owner. It delegates
accepted CreateObject, ObjDesc, motion, vector, state, position, parent,
pickup, rebucket, withdrawal, child-NoDraw, delete, and session-clear
transactions to Runtime. Loaded/pending renderer visibility remains a
presentation fact and does not emit a canonical gameplay withdrawal.
## Deterministic and structural evidence
- Direct Runtime and graphical-host fixtures execute the same create, object
placement, vector, Hidden, cross-cell position, pickup, and delete script;
their normalized generation, sequence, identity, cell, state, position, and
inventory traces are identical.
- Re-entrant create/delete/replacement observers cannot resurrect or continue
a superseded operation.
- Entity delete precedes retained-object removal in the shared sequence.
- Session reset seals the old generation and the next generation restarts at
sequence one.
- Runtime identity exists for pending, unhydrated, and direct-host entities.
- Source guards reject a new App entity/inventory mirror, App sequencer,
direct directory mutation, or App-side entity publication.
- The hard-recenter failure-order test now uses its existing generous
deterministic test budget. It no longer depends on whether cold JIT work
consumes the production two-millisecond streaming budget; production
scheduling is unchanged.
## Automated gates
On exact commit `ce3ac310d92722ffb637e81cb1957458874dd220`:
- Release build: pass, zero warnings and zero errors;
- Runtime tests: 134 passed;
- App tests: 3,765 passed / 3 expected skips;
- complete solution: 8,472 passed / 5 expected skips;
- `git diff --check`: pass.
## Exact-binary connected gate
`logs/connected-world-gate-20260726-064324/report.json` passed:
- six capped checkpoints plus one fresh uncapped reconnect checkpoint;
- capped elapsed time 243.013 seconds;
- reconnect elapsed time 61.316 seconds;
- both processes exited gracefully with code zero;
- zero failures;
- zero render-shadow mismatches;
- zero pending render deltas;
- zero pending live teardowns, landblock retirements, staged uploads, or
composite warmup at every checkpoint.
The one warning is the route's established 25 world-edge missing-landblock
probes and is not a J3.5 regression.
## Retail and divergence audit
This slice moves ownership and observation boundaries only. It preserves the
existing named-retail CreateObject, timestamp, parent, pickup, Hidden,
exit-world, delete, and object-table behavior. No AC-specific algorithm,
wire format, visual path, input timing, or intended retail divergence changed,
so no divergence-register row was added or retired.
## Rollback
Revert J3.5 only:
```text
git revert ce3ac310d92722ffb637e81cb1957458874dd220
```
Do not revert J3.4 or J3.3 as a shortcut for a J3.5 failure.
## Next boundary
J3.6 is the adversarial hardening and zero-owner closeout in
`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. It must prove
that every injected failure, reset, disposal, GUID reuse, and callback
re-entry leaves no canonical record, tombstone, App projection, resource,
container entry, parent candidate, observer, or pending delta before J4 moves
the remaining gameplay-state owner groups.