arch(runtime): establish presentation-independent boundary

Create the dependency-only Runtime project before moving any gameplay owner, enforce its direct, transitive, source, and load-time closure, and pin coherent lifetime-group extraction plus retryable teardown ordering. No production behavior changes in J0.

Validated by the four focused Runtime boundary tests, a zero-error Release solution build, and 8,406 passing Release tests with five pre-existing skips.

Co-authored-by: Codex <codex@openai.com>

docs/plans/2026-07-24-modern-runtime-architecture.md

@@ -2,8 +2,11 @@
 
 **Date:** 2026-07-24
 
-**Status:** Slices A–H and I0–I3 are complete. Slices F–L were explicitly
-approved 2026-07-24; Slice I4 is active.
+**Status:** Slices A–H are complete. Slice I6's flat-authoritative production
+cutover is committed and awaits the final user collision/visual gate before
+parsed-graph deletion. Slices F–L were explicitly approved 2026-07-24. Slice
+J0's dependency-boundary preparation is complete without moving gameplay
+owners. J1 remains behind the I6/I7 user collision/visual closeout.
 
 **Scope:** Reconcile and sequence the existing Modern Pipeline (`MP`) and
 Linux/headless (`LH`) tracks using the 2026-07-24 connected performance audit.
@@ -499,6 +502,41 @@ It exposes:
 - Deterministic `Tick`.
 - Retryable, complete shutdown.
 
+#### 9.2.1 Structural teardown protocol
+
+Every graphical or headless host follows one retryable, generation-scoped
+teardown transaction. New runtime owners register through the same
+`CompositionAcquisitionScope` lease discipline already used by the graphical
+composition root; release order is encoded by leases and acknowledgements,
+never remembered by callers.
+
+1. **Cancel scheduler generations.** Make commands inert, cancel the active
+   session/runtime generation, stop new receive publication, and prevent any
+   timer, bot, plugin, or worker callback from creating more work for it.
+2. **Drain or poison journals and queues.** Detach inbound producers, drain
+   already-accepted ordered events through the generation boundary, then
+   poison every command/event/delta queue so delayed callbacks fail against
+   their exact generation instead of entering a replacement session.
+3. **Unpublish presentation.** The graphical host consumes the final ordered
+   withdrawals and acknowledges that the render scene, retained gameplay UI,
+   audio/effect projections, selection, radar, and private viewports no longer
+   expose the runtime generation. Headless hosts acknowledge this stage
+   immediately because they construct no presentation owners.
+4. **Release residency after fences.** Withdraw content owners, finish
+   streaming/landblock retirement, and allow GPU-backed stores to retire only
+   after their existing frame-flight fences signal. A failed fence or release
+   retains the exact unfinished lease and resumes without replaying completed
+   stages.
+5. **Release the shared `ContentStore` last.** Session-scoped collision/content
+   leases go away before the runtime instance. The immutable mapped content
+   store outlives every runtime and presentation host and is disposed only by
+   the process host after all registered sessions have acknowledged teardown.
+
+Logout, session reset, mid-portal disconnect, reconnect replacement, ordinary
+window close, and construction rollback all use this protocol. No stage may
+clear another generation's state, and no teardown failure may be converted
+into a best-effort purge.
+
 ### 9.3 Hosts
 
 `GraphicalGameHost` provides input, camera, rendering, UI, audio, frame pacing,