docs(runtime): record J7 root cutover gates

Capture the exact production rollback, complete automated evidence, connected route results, and the still-active physical-display acceptance without declaring J7 closed early.

Co-authored-by: OpenAI Codex <codex@openai.com>

docs/research/2026-07-26-slice-j7-game-runtime-root-cutover.md

@@ -0,0 +1,97 @@
+# Slice J7 — graphical `GameRuntime` root cutover evidence
+
+**Production commit:**
+`ce41efb9e5938f79a7580476b949d172f52a1e69`
+
+**Status:** automated gates complete; the physical-display visual gate is
+active.
+
+## Outcome
+
+`GameWindow` now constructs and stores exactly one presentation-independent
+`GameRuntime`. App composition records and graphical adapters borrow that
+root's session, clock, identity, entity/object/physics, gameplay, movement,
+environment, and transit owners. They no longer construct or reconstruct
+parallel Runtime owners.
+
+The synchronous frame contract is unchanged: input, commands, simulation, UI
+projection, and rendering still execute in the existing host frame. The
+cutover adds no command queue, worker hop, snapshot copy, or frame of latency.
+
+## Ownership and teardown
+
+- `LocalPlayerIdentityState`, `UpdateFrameClock`, and
+  `WorldEnvironmentController` are graphical wrappers over root children.
+- Live presentation borrows the root transit owner.
+- Session composition borrows the root session.
+- The superseded App view and event adapters are deleted.
+- The graphical host owns one explicit root lease.
+- Shutdown first stops session ingress, then retires App UI/render borrowers,
+  releases the host lease, and disposes the root once.
+- The terminal gate verifies that `GameRuntime.CaptureOwnership()` converges.
+
+Construction and shutdown failure tests prove App rollback does not dispose a
+borrowed root, callback re-entrancy retains the exact retryable suffix, and no
+route, subscription, publication, entity, physics, gameplay, transit, session,
+or host-lease debt survives terminal disposal.
+
+## Automated gates
+
+- Runtime: 383 passed.
+- App: 3,717 passed / 3 skipped.
+- Release solution build: passed.
+- Complete Release suite: 8,661 passed / 5 skipped.
+- Connected lifecycle/reconnect:
+  `logs/connected-world-gate-20260726-190919/report.json`.
+  - exact source and binary commit match;
+  - six capped checkpoints in 242.324 seconds;
+  - one fresh uncapped reconnect checkpoint in 61.332 seconds;
+  - both processes exit gracefully with code zero;
+  - all seven stable checkpoints have zero host projections, pending host
+    acknowledgements, live teardowns, and landblock retirements.
+- Canonical nine-stop route:
+  `logs/connected-r6-soak-20260726-191605.report.json`.
+  - all destinations, movement, jump, combat, revisit, portal, and graceful
+    shutdown gates pass;
+  - no shutdown convergence, host-lease, retry, or abandoned-work diagnostic
+    appears.
+
+Against the last J5.7 canonical baseline
+`logs/connected-r6-soak-20260726-161406.report.json`, median turn
+CPU/GPU/update p95 improves from 22.9/9.7/2.3 ms to 16.4/1.3/0.7 ms, and turn
+allocation p50 improves from 5,812.9 to 75.1 KiB. Median stationary
+CPU/GPU/update p95 improves from 21.4/7.0/1.3 ms to 15.2/1.1/0.6 ms. Peak
+working set falls about 16%, from 2,326.8 to 1,953.2 MiB; peak private bytes
+remain effectively flat.
+
+The route retained only bounded diagnostics already covered by the existing
+performance and DAT-VFX ledgers: a two-landblock Caul visibility variation,
+one additional tracked texture (40,960 bytes), a transient 27-particle
+difference, 32 known DAT-driven VFX diagnostics, and 25 expected world-edge
+load misses.
+
+## Visual gate
+
+Captured physical-display login, facility-hub, Holtburg-after-dungeon, and
+fresh reconnect frames are intact. Final acceptance remains the user's live
+physical-display check of:
+
+- radar objects and coordinates;
+- inventory paperdoll;
+- near and distant Use/approach;
+- combat facing before bow fire;
+- `/ls` and spell-recall tunnel, materialization, and exit presentation.
+
+J7 must not be declared closed until this live gate passes.
+
+## Retail and divergence audit
+
+This is an ownership/composition refactor. It changes no AC algorithm, packet
+ordering, input semantics, simulation cadence, or visual effect. No new retail
+divergence is introduced, so the divergence register requires no new row.
+
+## Exact rollback
+
+```text
+git revert ce41efb9e5938f79a7580476b949d172f52a1e69
+```