docs(runtime): close J3.5 and plan J3.6

Record the canonical entity/object delta cutover, full Release and exact-binary connected evidence, rollback, and the adversarial zero-owner J3.6 execution contract. Synchronize architecture, roadmap, milestones, and agent guidance.

Co-authored-by: Codex <codex@openai.com>

AGENTS.md

@@ -225,8 +225,14 @@ live `ClientObjectTable`; App, routing, interaction, and UI borrow the exact
 instances. Runtime tests pass 118/118, App tests pass 3,762/3 skips, the
 complete Release suite passes 8,453/5 skips, and the exact-binary
 seven-checkpoint gate passes with graceful exits, zero failures, zero
-render-shadow mismatches, and zero pending deltas. J3.5 ordered canonical
+render-shadow mismatches, and zero pending deltas. J3.5 is complete at
-entity/object deltas and direct borrowed views are next. J0's rollback is
+`ce3ac310`: Runtime issues identity before App hydration, publishes entity and
+inventory commits through one per-generation sequence, and supplies the same
+direct borrowed views to graphical and no-window hosts. Runtime tests pass
+134/134, App tests pass 3,765/3 skips, the complete Release suite passes
+8,472/5 skips, and the exact-binary seven-checkpoint gate passes with graceful
+exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
+J3.6 adversarial lifetime and zero-owner closeout is active. J0's rollback is
 `git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
 J1's rollback is
 `git revert 854d9e9cd13092bd5aaa3cf025d73eeb4600e9f8`.
@@ -239,12 +245,14 @@ J3.3's rollback is, newest first,
 `git revert 420e5eea70fd2c29cf9c8614e6298a1f84d64045`.
 J3.4's rollback is
 `git revert 5ef8b5371d8990f0380acd939e71cd711289d429`.
+J3.5's rollback is
+`git revert ce3ac310d92722ffb637e81cb1957458874dd220`.
 Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
 work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
 passes. Slice I is closed in
 `docs/plans/2026-07-25-modern-runtime-slice-i.md`; the coherent Slice J campaign
-executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.5 starts at
+executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 starts at
-`docs/plans/2026-07-26-modern-runtime-slice-j3-delta-stream.md`. The exact G4 visual rollback
+`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. The exact G4 visual rollback
 is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or
 the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-h-closeout.md` and
@@ -260,7 +268,8 @@ the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-j2-session-lifetime-closeout.md` and
 `docs/research/2026-07-25-slice-j3-2-canonical-entity-directory-closeout.md` and
 `docs/research/2026-07-25-slice-j3-3-exact-projection-store.md` and
-`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`.
+`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md` and
+`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
 
 **Structural prerequisite before new M4 subsystem work:** all eight
 behavior-preserving `GameWindow` decomposition slices and the automated

CLAUDE.md

@@ -223,8 +223,14 @@ live `ClientObjectTable`; App, routing, interaction, and UI borrow the exact
 instances. Runtime tests pass 118/118, App tests pass 3,762/3 skips, the
 complete Release suite passes 8,453/5 skips, and the exact-binary
 seven-checkpoint gate passes with graceful exits, zero failures, zero
-render-shadow mismatches, and zero pending deltas. J3.5 ordered canonical
+render-shadow mismatches, and zero pending deltas. J3.5 is complete at
-entity/object deltas and direct borrowed views are next. J0's rollback is
+`ce3ac310`: Runtime issues identity before App hydration, publishes entity and
+inventory commits through one per-generation sequence, and supplies the same
+direct borrowed views to graphical and no-window hosts. Runtime tests pass
+134/134, App tests pass 3,765/3 skips, the complete Release suite passes
+8,472/5 skips, and the exact-binary seven-checkpoint gate passes with graceful
+exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
+J3.6 adversarial lifetime and zero-owner closeout is active. J0's rollback is
 `git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
 J1's rollback is
 `git revert 854d9e9cd13092bd5aaa3cf025d73eeb4600e9f8`.
@@ -237,12 +243,14 @@ J3.3's rollback is, newest first,
 `git revert 420e5eea70fd2c29cf9c8614e6298a1f84d64045`.
 J3.4's rollback is
 `git revert 5ef8b5371d8990f0380acd939e71cd711289d429`.
+J3.5's rollback is
+`git revert ce3ac310d92722ffb637e81cb1957458874dd220`.
 Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
 work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
 passes. Slice I is closed in
 `docs/plans/2026-07-25-modern-runtime-slice-i.md`; the coherent Slice J campaign
-executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.5 starts at
+executes from `docs/plans/2026-07-25-modern-runtime-slice-j.md`; J3.6 starts at
-`docs/plans/2026-07-26-modern-runtime-slice-j3-delta-stream.md`. The exact G4 visual rollback
+`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. The exact G4 visual rollback
 is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or
 the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-h-closeout.md` and
@@ -258,7 +266,8 @@ the portal-warmup corrections. Evidence:
 `docs/research/2026-07-25-slice-j2-session-lifetime-closeout.md` and
 `docs/research/2026-07-25-slice-j3-2-canonical-entity-directory-closeout.md` and
 `docs/research/2026-07-25-slice-j3-3-exact-projection-store.md` and
-`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`.
+`docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md` and
+`docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
 
 **Structural prerequisite before new M4 subsystem work:** all eight
 behavior-preserving `GameWindow` decomposition slices and the automated

docs/architecture/acdream-architecture.md

@@ -213,9 +213,11 @@ src/
       RuntimeEntityDirectory.cs -> sole GUID/incarnation/local-ID authority
       RuntimeEntityRecord.cs  -> presentation-free accepted entity state
       RuntimeEntityObjectLifetime.cs -> one entity/object lifetime root
+      RuntimeEntityObjectEventStream.cs -> canonical ordered entity/object deltas
+      RuntimeEntityObjectViews.cs -> direct allocation-free borrowed views
       InboundPhysicsStateController.cs -> retail timestamp/snapshot authority
       ParentAttachmentState.cs -> generation-exact parent relations
-    -> J3.1-J3.4 complete; J3.5 ordered deltas/direct borrowed views next
+    -> J3.1-J3.5 complete; J3.6 adversarial lifetime closeout active
     -> may reference Core, Core.Net, Content, and Plugin.Abstractions only
     -> must never reference App, UI, Silk.NET, OpenAL, Arch, or ImGui
   

docs/architecture/code-structure.md

@@ -477,7 +477,7 @@ useful ordering seam, but its ownership status is **partial**.
 | Selection/interaction | **Complete** | `WorldSelectionQuery` owns read-only picking/classification/range queries; `SelectionInteractionController` owns selection intent, Use/PickUp transport, exact-incarnation queues, and auto-walk deferral; `ItemInteractionController` owns ItemHolder policy plus the shared retail inventory-request transaction. `GameWindow` retains construction and narrow lifecycle forwarding only. |
 | Landblock presentation | **Complete** | `LandblockBuildFactory` owns the captured-origin DAT transaction; concrete render/physics/DAT-static publishers and `LandblockPresentationPipeline` own typed-meter publication and exact retryable retirement. `StreamingController` owns stable destination/control/unload/Near/Far queues and destination reservation. CPU mesh-cache restaging requires an exact live owner. `StreamingOriginRecenterCoordinator` serializes old-window retirement with teleport/session origin lifetimes. `GameWindow` retains construction and one pipeline field only (`c79d0a49`, closeout `4a205a3e`; Slice E closeout `91e82c3c`). |
 | Render-frame orchestration | **Complete** | `RenderFrameOrchestrator` owns the GPU-flight, resource, world/PView/shared-alpha, private-presentation, diagnostics, screenshot, and recovery graph. `GameWindow.OnRender` takes one logical window-size snapshot and performs one immutable handoff (`9d7df1bf`). |
-| Unified `GameEntity` | **Slice J active** | Canonical identity and retained-object lifetime now share one Runtime owner while exact graphical sidecars stay in App. J3.5 next replaces App-reconstructed entity/inventory views and events with one committed Runtime delta stream; later J4–J7 move coherent gameplay lifetime groups before one Runtime composition root. |
+| Unified `GameEntity` | **Slice J active** | Canonical identity, retained-object lifetime, direct views, and the ordered entity/object delta stream now share one Runtime owner while exact graphical sidecars stay in App. J3.6 adversarially closes that lifetime group; later J4–J7 move coherent gameplay lifetime groups before one Runtime composition root. |
 
 ### 4.3 Revised extraction sequence
 

docs/plans/2026-04-11-roadmap.md

@@ -1699,8 +1699,13 @@ port in any phase — no separate listing here.
 > Runtime tests, 3,762 App tests / 3 skips, 8,453-test / 5-skip complete
 > Release suite, and exact-binary seven-checkpoint gate pass with graceful
 > exits, zero failures, zero render-shadow mismatches, and zero pending deltas.
-> J3.5 ordered canonical entity/object deltas and direct borrowed views are
+> J3.5 is complete at `ce3ac310`: one per-generation Runtime stream now
-> next.
+> publishes canonical entity and inventory commits, identity is issued before
+> App hydration, and graphical/no-window hosts borrow the same direct views.
+> Its 134 Runtime tests, 3,765 App tests / 3 skips, 8,472-test / 5-skip
+> complete Release suite, and exact-binary seven-checkpoint gate pass with
+> graceful exits, zero failures, zero render-shadow mismatches, and zero
+> pending deltas. J3.6 adversarial lifetime and zero-owner closeout is active.
 > The historical exact cutover
 > rollback remains
 > `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`. Slice H is complete:

docs/plans/2026-05-12-milestones.md

@@ -175,9 +175,15 @@ residency is `0/0/0` at every stable checkpoint and teardown converges. Slice I
   Runtime tests, 3,762 App tests / 3 skips, 8,453 full Release tests / 5 skips,
   and exact-binary seven-checkpoint connected gate pass with graceful exits,
   zero failures, zero render-shadow mismatches, and zero pending deltas.
-  J3.5 ordered canonical entity/object deltas and direct borrowed views are
+  J3.5 is complete at `ce3ac310`: Runtime issues identity before App
-  next under
+  hydration, publishes entity and inventory commits through one
-  [`2026-07-25-modern-runtime-slice-j.md`](2026-07-25-modern-runtime-slice-j.md).
+  per-generation sequence, and supplies the same direct borrowed views to
+  graphical and no-window hosts. Its 134 Runtime tests, 3,765 App tests / 3
+  skips, 8,472 full Release tests / 5 skips, and exact-binary
+  seven-checkpoint connected gate pass with graceful exits, zero failures,
+  zero render-shadow mismatches, and zero pending deltas. J3.6 adversarial
+  failure and zero-owner closeout is active under
+  [`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md).
 Slice-I closeout evidence is
 [`../research/2026-07-25-slice-i7-closeout.md`](../research/2026-07-25-slice-i7-closeout.md).
 Slice-J2 closeout evidence is
@@ -188,6 +194,8 @@ Slice-J3.3 closeout evidence is
 [`../research/2026-07-25-slice-j3-3-exact-projection-store.md`](../research/2026-07-25-slice-j3-3-exact-projection-store.md).
 Slice-J3.4 closeout evidence is
 [`../research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`](../research/2026-07-26-slice-j3-4-canonical-object-lifetime.md).
+Slice-J3.5 closeout evidence is
+[`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`](../research/2026-07-26-slice-j3-5-canonical-delta-stream.md).
 The historical exact G4 visual rollback remains
 `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`.
 

docs/plans/2026-07-24-modern-runtime-architecture.md

@@ -2,14 +2,15 @@
 
 **Date:** 2026-07-24
 
-**Status:** Slices A–I and J0–J3.4 are complete. Flat-authoritative collision, zero-
+**Status:** Slices A–I and J0–J3.5 are complete. Flat-authoritative collision, zero-
 allocation resolve scratch, parsed-graph removal, connected correctness/
 lifetime acceptance, and Slice-I closeout landed 2026-07-25. Slices F–L were
 explicitly approved 2026-07-24. Slice J0–J1 established the enforced Runtime
 boundary and borrowed contract seam; J2 moved canonical session/transport
-lifetime and ordered inbound routing; J3.1–J3.4 moved canonical entity identity
+lifetime and ordered inbound routing; J3.1–J3.5 moved canonical entity identity
-and object-table lifetime to Runtime and exact graphical projection identity
+and object-table lifetime to Runtime, exact graphical projection identity to
-to App. J3.5 is the active execution point.
+App, and one ordered canonical entity/object stream plus direct views to all
+hosts. J3.6 adversarial lifetime closeout is the active execution point.
 
 **Scope:** Reconcile and sequence the existing Modern Pipeline (`MP`) and
 Linux/headless (`LH`) tracks using the 2026-07-24 connected performance audit.
@@ -1250,13 +1251,16 @@ gameplay before removing every production parsed collision graph. Slice I7
 passes 8,413 Release tests / 5 skips plus both exact-binary connected routes;
 every stable checkpoint reports zero retained parsed collision graphs. J1 is
 complete with borrowed contracts, and J2 owns canonical session/transport
-lifetime plus ordered inbound routing in Runtime. J3.1–J3.4 are complete:
+lifetime plus ordered inbound routing in Runtime. J3.1–J3.5 are complete:
 Runtime owns the only entity GUID/incarnation/local-ID directory, and App's
 materialized sidecars plus spatial/presentation worksets carry exact
 `RuntimeEntityKey`. One `RuntimeEntityObjectLifetime` also owns the exact live
-`ClientObjectTable`; App is a synchronous borrower. J3.5's ordered canonical
+`ClientObjectTable`; App is a synchronous borrower. Exact `ce3ac310` adds the
-entity/object delta stream and direct borrowed views are the current execution
+one per-generation canonical entity/object delta stream, issues Runtime
-point.
+identity before App hydration, and gives graphical/no-window hosts the same
+direct borrowed views. Its 8,472-test / 5-skip Release suite and exact-binary
+seven-checkpoint connected route pass. J3.6 adversarial failure and zero-owner
+closeout is the current execution point.
 Evidence:
 [`../research/2026-07-25-slice-g5-production-profile.md`](../research/2026-07-25-slice-g5-production-profile.md)
 and
@@ -1272,6 +1276,8 @@ and
 and
 [`../research/2026-07-25-slice-j3-3-exact-projection-store.md`](../research/2026-07-25-slice-j3-3-exact-projection-store.md)
 and
+[`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`](../research/2026-07-26-slice-j3-5-canonical-delta-stream.md)
+and
 [`2026-07-25-modern-runtime-slice-j.md`](2026-07-25-modern-runtime-slice-j.md).
 
 The intended order is therefore:
@@ -1286,7 +1292,7 @@ honest metrics + committed baselines        (A — exit criteria block C)
   -> delta GPU submission                   (G)
   -> residual frame cleanup                 (H-a, H-b, H-c)
   -> flat collision assets                  (I — COMPLETE)
-  -> presentation-independent runtime       (J — CURRENT at J3.5)
+  -> presentation-independent runtime       (J — CURRENT at J3.6)
   -> Linux/headless/multi-session           (K)
   -> evidence-gated GPU jobs                (L)
 ```

docs/plans/2026-07-25-modern-runtime-slice-j.md

@@ -1,7 +1,7 @@
 # Modern runtime Slice J — presentation-independent runtime
 
-**Status:** J0–J2 COMPLETE; J3.1–J3.4 COMPLETE; J3.5 ordered canonical
+**Status:** J0–J2 COMPLETE; J3.1–J3.5 COMPLETE; J3.6 adversarial lifetime
-entity/object deltas and borrowed views are next
+hardening and zero-owner closeout are active
 **Parent:** `2026-07-24-modern-runtime-architecture.md`, Slice J
 **Authorization:** the user approved Slices F–L, including the otherwise-frozen
 Slice J gameplay-owner moves, on 2026-07-24
@@ -183,17 +183,20 @@ git revert 75930787741db40a83eab8663e4464dce8d687ba
 **Detailed execution plan:**
 [`2026-07-25-modern-runtime-slice-j3.md`](2026-07-25-modern-runtime-slice-j3.md).
 
-**Current checkpoint:** J3.1–J3.4 are complete. Runtime owns accepted entity
+**Current checkpoint:** J3.1–J3.5 are complete. Runtime owns accepted entity
 wire state and the only canonical identity/incarnation/local-ID directory.
 App's `LiveEntityProjectionStore` and every materialized presentation/spatial
 workset are keyed by exact `RuntimeEntityKey`; the temporary GUID-shaped
 compatibility view is deleted. `RuntimeEntityObjectLifetime` now owns the
 exact entity directory and live `ClientObjectTable`; App, routing, interaction,
-and UI borrow both. The J3.4 binary `5ef8b537` passes 8,453 Release tests / 5
+and UI borrow both. Exact J3.5 binary `ce3ac310` now publishes one committed
-skips and the exact seven-checkpoint connected gate at
+per-generation Runtime entity/object delta stream, issues identity before App
-`logs/connected-world-gate-20260726-055713/report.json`. J3.5 now publishes
+hydration, and supplies direct allocation-free views to graphical and
-one committed Runtime entity/object delta stream and replaces App-reconstructed
+no-window hosts. App reconstructs neither entity nor inventory state/events.
-entity/inventory views and events.
+Its 8,472 Release tests / 5 skips and exact seven-checkpoint connected gate at
+`logs/connected-world-gate-20260726-064324/report.json` pass. J3.6 now
+failure-injects the complete lifetime and proves every reset/disposal owner
+converges to zero.
 
 - Strip renderer, particle, Wb, and streaming components from the canonical
   record into an App projection store keyed only by local identity/incarnation.

docs/plans/2026-07-25-modern-runtime-slice-j3.md

@@ -1,6 +1,6 @@
 # Modern runtime Slice J3 — canonical identity, properties, and object table
 
-**Status:** ACTIVE — J3.1–J3.4 COMPLETE; J3.5 NEXT
+**Status:** ACTIVE — J3.1–J3.5 COMPLETE; J3.6 ACTIVE
 **Parent:** `2026-07-25-modern-runtime-slice-j.md`, J3
 **Production base:** `9496c01b`
 **J2 production commit:** `75930787741db40a83eab8663e4464dce8d687ba`
@@ -14,21 +14,21 @@
 | J3.2 canonical Runtime entity directory | complete | `f46ddb5cdb1e145752bea49aeb1d62bfe71284d3`; 8,441 Release tests / 5 skips and `logs/connected-world-gate-20260725-200749/report.json` pass |
 | J3.3 App projection store | complete | `420e5eea70fd2c29cf9c8614e6298a1f84d64045` + `e937cc36df39cf6ea1eaba2f9c0243d1929da702`; 8,444 Release tests / 5 skips and `logs/connected-world-gate-20260725-221008/report.json` pass |
 | J3.4 canonical object-table ownership | complete | `5ef8b5371d8990f0380acd939e71cd711289d429`; 118 Runtime tests, 3,762 App tests / 3 skips, 8,453 complete Release tests / 5 skips, and `logs/connected-world-gate-20260726-055713/report.json` pass |
-| J3.5 ordered deltas and borrowed views | next | [`2026-07-26-modern-runtime-slice-j3-delta-stream.md`](2026-07-26-modern-runtime-slice-j3-delta-stream.md): one committed Runtime entity/object stream and direct borrowed views for graphical and no-window hosts |
+| J3.5 ordered deltas and borrowed views | complete | `ce3ac310d92722ffb637e81cb1957458874dd220`; 134 Runtime tests, 3,765 App tests / 3 skips, 8,472 complete Release tests / 5 skips, and `logs/connected-world-gate-20260726-064324/report.json` pass |
+| J3.6 adversarial hardening and closeout | active | [`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md): failure-inject every lifetime boundary and prove zero owners after reset/disposal |
 
-J3.4 passes the Release solution build, 118 Runtime tests, 3,762 App tests with
+J3.5 passes the Release solution build, 134 Runtime tests, 3,765 App tests with
-three skips, and 8,453 complete tests with five expected skips. Its exact-
+three skips, and 8,472 complete tests with five expected skips. Its exact-
 binary seven-checkpoint connected lifecycle/reconnect route also passes with
 graceful exits, zero render-shadow mismatches, and zero pending deltas. Runtime
-now owns one entity/object lifetime root containing both the sole
+now issues canonical identity before graphical hydration, publishes entity and
-GUID/incarnation/local-ID authority and the sole live `ClientObjectTable`.
+inventory commits through one per-generation sequence, and exposes the same
-Graphical presentation and UI borrow those exact instances. Authoritative
+direct borrowed views to graphical and no-window hosts. App no longer
-delete removes retained object information; dormant/offscreen pruning does
+reconstructs those views or events. No frame queue, backend dependency, or
-not. No frame queue, backend dependency, allocation-order change, or gameplay
+gameplay behavior change was added. The exact rollback for J3.5 is:
-behavior change was added. The exact rollback for J3.4 is:
 
 ```text
-git revert 5ef8b5371d8990f0380acd939e71cd711289d429
+git revert ce3ac310d92722ffb637e81cb1957458874dd220
 ```
 
 ## 1. Objective
@@ -299,6 +299,7 @@ failure; record and revert only the exact failing J3 commit.
 J3 sub-slices are independently reversible:
 
 ```text
+git revert ce3ac310d92722ffb637e81cb1957458874dd220
 git revert 5ef8b5371d8990f0380acd939e71cd711289d429
 git revert e937cc36df39cf6ea1eaba2f9c0243d1929da702
 git revert 420e5eea70fd2c29cf9c8614e6298a1f84d64045
@@ -306,6 +307,6 @@ git revert f46ddb5cdb1e145752bea49aeb1d62bfe71284d3
 git revert f7442d13e9ae7d5b077ffecb1f8a10899ad46edd
 ```
 
-Revert J3.4 before J3.3. Revert J3.3's exact-spatial correction before its
+Revert J3.5 before J3.4. Revert J3.4 before J3.3. Revert J3.3's exact-spatial
-main projection-store commit. Revert J3.3 before J3.2, and J3.2 before J3.1,
+correction before its main projection-store commit. Revert J3.3 before J3.2,
-when rolling back more than one sub-slice.
+and J3.2 before J3.1, when rolling back more than one sub-slice.

docs/plans/2026-07-26-modern-runtime-slice-j3-delta-stream.md

@@ -1,6 +1,6 @@
 # Modern runtime J3.5 — committed entity/object deltas and borrowed views
 
-**Status:** READY
+**Status:** COMPLETE — `ce3ac310d92722ffb637e81cb1957458874dd220`
 **Parent:** `2026-07-25-modern-runtime-slice-j3.md`
 **Required production base:** `5ef8b5371d8990f0380acd939e71cd711289d429`
 **Prior closeout:** `docs/research/2026-07-26-slice-j3-4-canonical-object-lifetime.md`
@@ -297,18 +297,21 @@ a visible inventory, selection, radar, paperdoll, or world-object symptom.
 
 ## Rollback
 
-Record the exact J3.5 production commit here before its connected gate. J3.4
+J3.5 is independently reversible:
-remains independently reversible:
 
 ```text
-git revert 5ef8b5371d8990f0380acd939e71cd711289d429
+git revert ce3ac310d92722ffb637e81cb1957458874dd220
 ```
 
-Do not revert J3.4 as a shortcut for a J3.5 failure.
+Do not revert J3.4 as a shortcut for a J3.5 failure. Automated and connected
+evidence is recorded in
+`../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`.
 
 ## Next boundary
 
-J3.6 failure-injects the complete canonical entity/object lifecycle and proves
+J3.6 executes from
+[`2026-07-26-modern-runtime-slice-j3-hardening.md`](2026-07-26-modern-runtime-slice-j3-hardening.md).
+It failure-injects the complete canonical entity/object lifecycle and proves
 zero records, tombstones, projections, resources, container entries, parent
 candidates, subscriptions, or pending deltas after reset and disposal. That
 closeout is required before J4 moves chat, inventory transactions, vitals,

docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md

@@ -0,0 +1,196 @@
+# Modern runtime J3.6 — adversarial lifetime hardening and closeout
+
+**Status:** READY
+**Parent:** `2026-07-25-modern-runtime-slice-j3.md`
+**Required production base:** `ce3ac310d92722ffb637e81cb1957458874dd220`
+**Prior closeout:** `../research/2026-07-26-slice-j3-5-canonical-delta-stream.md`
+
+## Objective
+
+Close the canonical entity/object lifetime group under failure, re-entrancy,
+reset, and disposal before J4 moves another gameplay owner.
+
+This slice adds no feature, queue, retry timer, renderer fallback, or gameplay
+behavior. It proves that Runtime's canonical identity/object owner and App's
+exact-key graphical projection either complete each transaction or retain one
+explicitly retryable suffix, and that every terminal path converges to zero.
+
+## Fixed boundary
+
+- Runtime remains the sole GUID/incarnation/local-ID, accepted-wire,
+  parent-relation, object-table, direct-view, and entity/object-event owner.
+- App remains an exact-key projection and resource host.
+- The server remains authoritative.
+- Existing synchronous retail ordering remains unchanged.
+- J4 chat, vitals, enchantments, spells/components, cooldowns, and
+  ViewModel-facing revisions do not enter this slice.
+- A failure test may expose a production ownership defect. Fix the owning
+  transaction at its commit/acknowledgement boundary; do not add a suppression
+  flag, timer, retry loop, or symptom guard.
+
+## Execution
+
+### 1. Pin the complete ownership ledger
+
+Create one assertion helper that reports every J3 owner:
+
+- active Runtime records;
+- teardown Runtime records and claimed local IDs;
+- accepted snapshot/timestamp and parent-relation entries;
+- active and teardown App projections;
+- materialized world entities and graphical resource registrations;
+- spatial loaded/pending projection keys;
+- animation, remote-motion, projectile, root-object, effect, light, script,
+  and equipped-child bindings;
+- object-table objects, containers, pending moves, and replacement state;
+- Runtime stream subscriptions, dispatch failures, and pending work.
+
+The helper must distinguish an intentionally retained retry receipt from a
+leak. A stable terminal checkpoint permits neither.
+
+### 2. Failure-inject canonical registration and hydration
+
+Exercise failures and re-entry:
+
+- before and after Runtime active-record/local-ID commit;
+- same-incarnation refresh;
+- generation replacement while prior App teardown succeeds or fails;
+- projection sidecar creation;
+- world-entity factory;
+- resource registration before commit and after partial commit;
+- resource rollback before and after commit;
+- animation/physics/effect/relationship/ready publication stages;
+- observer replacement, delete, and session clear during each callback.
+
+Prove that a still-active Runtime incarnation never loses its key, a failed
+partial owner remains reachable by one exact teardown receipt, and retry
+cannot replay create-time resources already committed.
+
+### 3. Failure-inject accepted updates and placement
+
+Cover ObjDesc, motion, vector, state, position, parent, pickup, explicit
+rebucket, withdrawal, and child-NoDraw:
+
+- stale/equal/new/wrapped timestamps;
+- loaded-to-loaded, loaded-to-pending, pending-to-loaded, and cellless
+  transitions;
+- projection callback failure before and after the graphical mutation;
+- observer delete/recreate or same-record newer update;
+- parent event before the parent, before the child, and across GUID reuse;
+- malformed or missing-object updates.
+
+Assert the shared stream publishes only committed canonical facts, consumes
+no sequence for rejected packets, never emits renderer visibility as a
+withdrawal, and never applies a displaced callback to a replacement
+incarnation.
+
+### 4. Failure-inject object-table transactions
+
+Run the exact object-table behavior through the Runtime stream:
+
+- create/add versus update;
+- optimistic container move;
+- confirmation;
+- rejection rollback;
+- wield/container replacement;
+- stack/value/property refresh;
+- unknown-object move;
+- authoritative entity delete;
+- dormant/offscreen delete;
+- clear and next-generation reuse;
+- callback mutation of the same object or containing container.
+
+Verify callback order, exact removed generation, immediate borrowed-view
+visibility, and no second retained inventory collection.
+
+### 5. Prove reset, retry, and disposal convergence
+
+Inject a failure at every App teardown stage, then repeatedly invoke the
+existing retryable teardown entry until it completes. Exercise:
+
+- ordinary authoritative delete;
+- delete/recreate with the same GUID;
+- session reset during create, update, object callback, and teardown callback;
+- logout;
+- transport replacement;
+- mid-portal disconnect;
+- Runtime and App disposal;
+- repeated subscription disposal and disposal from inside dispatch.
+
+At convergence assert the complete ownership ledger is zero, the retired
+generation cannot publish, the next generation starts at sequence one, and
+later object-table mutations cannot reach disposed observers.
+
+### 6. Runtime-only end-to-end fixture
+
+Without loading App, UI, Silk.NET, OpenAL, Arch, or ImGui:
+
+1. construct Runtime;
+2. bind a generation and frame clock;
+3. register several conflicting entity/object shapes;
+4. apply properties, motion/vector/state/position, parent/container moves,
+   Hidden, pickup, delete/recreate, and clear;
+5. visit direct views after each commit;
+6. record the exact shared delta stream;
+7. reset and reconnect;
+8. dispose.
+
+Run the same normalized input script through the graphical harness and require
+exact equality. Assert the Runtime assembly load closure remains backend-free.
+
+### 7. Closeout gates
+
+Run, in order:
+
+1. focused Runtime lifetime/stream failure matrix;
+2. Core `ClientObjectTable*` and `ObjectTableWiring*`;
+3. focused App hydration, projection, update, parent, rebucket, delete,
+   session-reset, selection, inventory, and paperdoll suites;
+4. Runtime-only versus graphical normalized parity;
+5. all Runtime tests;
+6. all App tests;
+7. `dotnet build AcDream.slnx -c Release`;
+8. `dotnet test AcDream.slnx -c Release --no-build`;
+9. exact-binary connected lifecycle/reconnect;
+10. canonical nine-stop connected world route;
+11. documentation, divergence, dependency, and source-ownership audit.
+
+A user visual pause is required only if automated or connected evidence shows
+a visible inventory, selection, radar, paperdoll, portal, or world-object
+symptom.
+
+## Acceptance
+
+J3 is complete only when:
+
+- every canonical mutation and terminal path has adversarial coverage;
+- direct and graphical traces remain exact;
+- rejected/stale work consumes no event sequence;
+- no callback can mutate a superseded incarnation;
+- every partial acquisition remains reachable and retryable;
+- every stable reset/disposal checkpoint has zero records, tombstones, keys,
+  projections, resources, container entries, parent candidates,
+  subscriptions, and pending deltas;
+- Runtime-only construction and lifecycle load no presentation/backend
+  assembly;
+- full Release and both exact-binary connected routes pass;
+- architecture, roadmap, milestones, AGENTS/CLAUDE, durable memory, and exact
+  rollback are synchronized.
+
+## Rollback
+
+J3.5 remains independently reversible:
+
+```text
+git revert ce3ac310d92722ffb637e81cb1957458874dd220
+```
+
+Record J3.6's exact production commit before its connected gates. Never revert
+J3.4 or J3.3 to mask a J3.6 failure.
+
+## Next boundary
+
+After J3.6 closes J3, execute J4 from
+`docs/plans/2026-07-25-modern-runtime-slice-j.md`: move the remaining
+presentation-independent gameplay-state owners in coherent lifetime groups,
+with direct/graphical parity and zero-mirror deletion after every group.

docs/research/2026-07-26-slice-j3-5-canonical-delta-stream.md

@@ -0,0 +1,109 @@
+# Slice J3.5 closeout — canonical entity/object deltas
+
+**Date:** 2026-07-26
+**Production commit:** `ce3ac310d92722ffb637e81cb1957458874dd220`
+**Status:** COMPLETE
+
+## Result
+
+`RuntimeEntityObjectLifetime` now owns one synchronous entity/object commit
+stream in addition to the canonical entity directory and object table.
+Graphical and no-window hosts read the same allocation-free borrowed views and
+observe the same immutable deltas. App no longer reconstructs entity changes
+from renderer visibility or inventory changes from a second object-table
+subscription.
+
+Runtime now:
+
+- issues the exact local entity ID when the canonical record is registered,
+  before App hydration;
+- exposes direct `IRuntimeEntityView` and `IRuntimeInventoryView` instances;
+- stamps entity and inventory commits from one per-generation sequence;
+- publishes registered, updated, rebucketed, hidden, withdrawn, and deleted
+  entity edges after canonical mutation;
+- preserves added, updated, moved, removed, and cleared object-table order;
+- retains unknown-object move identity and placement;
+- isolates observer failures without interrupting canonical commits or later
+  observers;
+- revalidates the exact incarnation and operation after synchronous,
+  re-entrant callbacks;
+- detaches every observer and object-table callback on disposal.
+
+`LiveEntityRuntime` is now an App projection/acknowledgement owner. It delegates
+accepted CreateObject, ObjDesc, motion, vector, state, position, parent,
+pickup, rebucket, withdrawal, child-NoDraw, delete, and session-clear
+transactions to Runtime. Loaded/pending renderer visibility remains a
+presentation fact and does not emit a canonical gameplay withdrawal.
+
+## Deterministic and structural evidence
+
+- Direct Runtime and graphical-host fixtures execute the same create, object
+  placement, vector, Hidden, cross-cell position, pickup, and delete script;
+  their normalized generation, sequence, identity, cell, state, position, and
+  inventory traces are identical.
+- Re-entrant create/delete/replacement observers cannot resurrect or continue
+  a superseded operation.
+- Entity delete precedes retained-object removal in the shared sequence.
+- Session reset seals the old generation and the next generation restarts at
+  sequence one.
+- Runtime identity exists for pending, unhydrated, and direct-host entities.
+- Source guards reject a new App entity/inventory mirror, App sequencer,
+  direct directory mutation, or App-side entity publication.
+- The hard-recenter failure-order test now uses its existing generous
+  deterministic test budget. It no longer depends on whether cold JIT work
+  consumes the production two-millisecond streaming budget; production
+  scheduling is unchanged.
+
+## Automated gates
+
+On exact commit `ce3ac310d92722ffb637e81cb1957458874dd220`:
+
+- Release build: pass, zero warnings and zero errors;
+- Runtime tests: 134 passed;
+- App tests: 3,765 passed / 3 expected skips;
+- complete solution: 8,472 passed / 5 expected skips;
+- `git diff --check`: pass.
+
+## Exact-binary connected gate
+
+`logs/connected-world-gate-20260726-064324/report.json` passed:
+
+- six capped checkpoints plus one fresh uncapped reconnect checkpoint;
+- capped elapsed time 243.013 seconds;
+- reconnect elapsed time 61.316 seconds;
+- both processes exited gracefully with code zero;
+- zero failures;
+- zero render-shadow mismatches;
+- zero pending render deltas;
+- zero pending live teardowns, landblock retirements, staged uploads, or
+  composite warmup at every checkpoint.
+
+The one warning is the route's established 25 world-edge missing-landblock
+probes and is not a J3.5 regression.
+
+## Retail and divergence audit
+
+This slice moves ownership and observation boundaries only. It preserves the
+existing named-retail CreateObject, timestamp, parent, pickup, Hidden,
+exit-world, delete, and object-table behavior. No AC-specific algorithm,
+wire format, visual path, input timing, or intended retail divergence changed,
+so no divergence-register row was added or retired.
+
+## Rollback
+
+Revert J3.5 only:
+
+```text
+git revert ce3ac310d92722ffb637e81cb1957458874dd220
+```
+
+Do not revert J3.4 or J3.3 as a shortcut for a J3.5 failure.
+
+## Next boundary
+
+J3.6 is the adversarial hardening and zero-owner closeout in
+`docs/plans/2026-07-26-modern-runtime-slice-j3-hardening.md`. It must prove
+that every injected failure, reset, disposal, GUID reuse, and callback
+re-entry leaves no canonical record, tombstone, App projection, resource,
+container entry, parent candidate, observer, or pending delta before J4 moves
+the remaining gameplay-state owner groups.