docs(runtime): close J3.5 and plan J3.6

Record the canonical entity/object delta cutover, full Release and exact-binary connected evidence, rollback, and the adversarial zero-owner J3.6 execution contract. Synchronize architecture, roadmap, milestones, and agent guidance.

Co-authored-by: Codex <codex@openai.com>

docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md

@@ -0,0 +1,109 @@
+# Slice J3.5 closeout — canonical entity/object deltas
+
+**Date:** 2026-07-26
+**Production commit:** `ce3ac310d92722ffb637e81cb1957458874dd220`
+**Status:** COMPLETE
+
+## Result
+
+`RuntimeEntityObjectLifetime` now owns one synchronous entity/object commit
+stream in addition to the canonical entity directory and object table.
+Graphical and no-window hosts read the same allocation-free borrowed views and
+observe the same immutable deltas. App no longer reconstructs entity changes
+from renderer visibility or inventory changes from a second object-table
+subscription.
+
+Runtime now:
+
+- issues the exact local entity ID when the canonical record is registered,
+  before App hydration;
+- exposes direct `IRuntimeEntityView` and `IRuntimeInventoryView` instances;
+- stamps entity and inventory commits from one per-generation sequence;
+- publishes registered, updated, rebucketed, hidden, withdrawn, and deleted
+  entity edges after canonical mutation;
+- preserves added, updated, moved, removed, and cleared object-table order;
+- retains unknown-object move identity and placement;
+- isolates observer failures without interrupting canonical commits or later
+  observers;
+- revalidates the exact incarnation and operation after synchronous,
+  re-entrant callbacks;
+- detaches every observer and object-table callback on disposal.
+
+`LiveEntityRuntime` is now an App projection/acknowledgement owner. It delegates
+accepted CreateObject, ObjDesc, motion, vector, state, position, parent,
+pickup, rebucket, withdrawal, child-NoDraw, delete, and session-clear
+transactions to Runtime. Loaded/pending renderer visibility remains a
+presentation fact and does not emit a canonical gameplay withdrawal.
+
+## Deterministic and structural evidence
+
+- Direct Runtime and graphical-host fixtures execute the same create, object
+  placement, vector, Hidden, cross-cell position, pickup, and delete script;
+  their normalized generation, sequence, identity, cell, state, position, and
+  inventory traces are identical.
+- Re-entrant create/delete/replacement observers cannot resurrect or continue
+  a superseded operation.
+- Entity delete precedes retained-object removal in the shared sequence.
+- Session reset seals the old generation and the next generation restarts at
+  sequence one.
+- Runtime identity exists for pending, unhydrated, and direct-host entities.
+- Source guards reject a new App entity/inventory mirror, App sequencer,
+  direct directory mutation, or App-side entity publication.
+- The hard-recenter failure-order test now uses its existing generous
+  deterministic test budget. It no longer depends on whether cold JIT work
+  consumes the production two-millisecond streaming budget; production
+  scheduling is unchanged.
+
+## Automated gates
+
+On exact commit `ce3ac310d92722ffb637e81cb1957458874dd220`:
+
+- Release build: pass, zero warnings and zero errors;
+- Runtime tests: 134 passed;
+- App tests: 3,765 passed / 3 expected skips;
+- complete solution: 8,472 passed / 5 expected skips;
+- `git diff --check`: pass.
+
+## Exact-binary connected gate
+
+`logs/connected-world-gate-20260726-064324/report.json` passed:
+
+- six capped checkpoints plus one fresh uncapped reconnect checkpoint;
+- capped elapsed time 243.013 seconds;
+- reconnect elapsed time 61.316 seconds;
+- both processes exited gracefully with code zero;
+- zero failures;
+- zero render-shadow mismatches;
+- zero pending render deltas;
+- zero pending live teardowns, landblock retirements, staged uploads, or
+  composite warmup at every checkpoint.
+
+The one warning is the route's established 25 world-edge missing-landblock
+probes and is not a J3.5 regression.
+
+## Retail and divergence audit
+
+This slice moves ownership and observation boundaries only. It preserves the
+existing named-retail CreateObject, timestamp, parent, pickup, Hidden,
+exit-world, delete, and object-table behavior. No AC-specific algorithm,
+wire format, visual path, input timing, or intended retail divergence changed,
+so no divergence-register row was added or retired.
+
+## Rollback
+
+Revert J3.5 only:
+
+```text
+git revert ce3ac310d92722ffb637e81cb1957458874dd220
+```
+
+Do not revert J3.4 or J3.3 as a shortcut for a J3.5 failure.
+
+## Next boundary
+
+J3.6 is the adversarial hardening and zero-owner closeout in
+`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. It must prove
+that every injected failure, reset, disposal, GUID reuse, and callback
+re-entry leaves no canonical record, tombstone, App projection, resource,
+container entry, parent candidate, observer, or pending delta before J4 moves
+the remaining gameplay-state owner groups.