docs(runtime): record J7 root cutover gates

Capture the exact production rollback, complete automated evidence, connected route results, and the still-active physical-display acceptance without declaring J7 closed early.

Co-authored-by: OpenAI Codex <codex@openai.com>

docs/plans/2026-07-25-modern-runtime-slice-j.md

@@ -384,6 +384,17 @@ mid-portal disconnect traces match; the graphical screenshots remain accepted.
 
 ### J7 — one `GameRuntime` composition root
 
+J7.1 completed at `96ddd165`; J7.2/J7.3 completed at
+`ce41efb9e5938f79a7580476b949d172f52a1e69`. Production now owns one
+`GameRuntime`, App borrows its children, and shutdown is one ordered root
+transaction. All focused, complete Release, exact-binary lifecycle/reconnect,
+and canonical nine-stop automated gates pass. The physical-display visual gate
+is active; J7 remains open until the user accepts radar, paperdoll,
+Use/approach, combat facing, and both recall paths. Detailed evidence:
+[`2026-07-26-modern-runtime-slice-j7.md`](2026-07-26-modern-runtime-slice-j7.md)
+and
+[`../research/2026-07-26-slice-j7-game-runtime-root-cutover.md`](../research/2026-07-26-slice-j7-game-runtime-root-cutover.md).
+
 - Compose all moved lifetime groups into one instance-scoped `GameRuntime`.
 - Make `GameWindow`/App own exactly one Runtime instance plus presentation
   adapters.
@@ -395,6 +406,12 @@ mid-portal disconnect traces match; the graphical screenshots remain accepted.
 Gate: graphical connected lifecycle/resource routes pass with no mirrored
 state, no extra update latency, and no performance regression.
 
+Exact J7.2/J7.3 rollback:
+
+```text
+git revert ce41efb9e5938f79a7580476b949d172f52a1e69
+```
+
 ### J8 — no-window integration and Slice J closeout
 
 - Build a transport/content test host that constructs Runtime directly.

docs/plans/2026-07-26-modern-runtime-slice-j7.md

@@ -1,6 +1,6 @@
 # Modern runtime Slice J7 — one `GameRuntime` composition root
 
-**Status:** ACTIVE
+**Status:** AUTOMATED GATES COMPLETE — PHYSICAL-DISPLAY VISUAL GATE ACTIVE
 **Parent:** `2026-07-25-modern-runtime-slice-j.md`, J7
 **Authorization:** the user approved Slices F–L, including the J gameplay-owner
 gates, on 2026-07-24
@@ -106,6 +106,9 @@ construction path until J7.2 performs the isolated cutover.
 
 ### J7.2 — production composition cutover
 
+**Complete 2026-07-26 at
+`ce41efb9e5938f79a7580476b949d172f52a1e69`.**
+
 - Construct one root in `GameWindow`.
 - Make `UpdateFrameClock` borrow the root clock.
 - Make `WorldEnvironmentController` and `WorldGenerationAvailabilityState`
@@ -122,8 +125,19 @@ construction path until J7.2 performs the isolated cutover.
 Gate: App composition/failure-injection tests prove one exact root and no
 partial publication or borrowed-owner disposal.
 
+Result: production `GameWindow` constructs and stores one `GameRuntime`.
+Every App composition record receives that root and borrows its session,
+clock, environment, transit, identity, gameplay, entity, and movement
+children. The former App view/event reconstructions are deleted. Source guards
+prove that no production App site constructs an independent Runtime child.
+
 ### J7.3 — one shutdown transaction
 
+**Complete 2026-07-26 in the same coherent production cutover
+`ce41efb9e5938f79a7580476b949d172f52a1e69`.** J7.2 and J7.3 are one
+bisectable ownership change because publishing the root without replacing the
+old child-by-child shutdown would create two incompatible lifetime graphs.
+
 - Replace individual Runtime roots in `GameWindowShutdownRoots` with
   `GameRuntime`.
 - Quiesce its session at the existing ingress barrier.
@@ -135,8 +149,18 @@ partial publication or borrowed-owner disposal.
 Gate: every shutdown fault point converges on retry; no subscriber, route,
 entity, physics, gameplay, transit, or session debt remains.
 
+Result: ingress quiesces the root session, App retires every graphical
+borrower, and only then releases the graphical host lease and disposes the
+root. Construction rollback and shutdown-fault tests prove the borrowed root
+is never disposed by App rollback and that the terminal root ledger converges
+without route, publication, entity, physics, gameplay, transit, session, or
+host-lease debt.
+
 ### J7.4 — validation and closeout
 
+**Automated portion complete 2026-07-26; physical-display visual acceptance
+is active.**
+
 - Focused Runtime and App tests.
 - Release solution build.
 - Complete Release suite.
@@ -147,6 +171,33 @@ entity, physics, gameplay, transit, or session debt remains.
 - Update architecture, code structure, milestone, roadmap, parent/umbrella
   plans, AGENTS/CLAUDE, divergence ledger, and durable memory.
 
+Automated evidence:
+
+- 383 focused Runtime tests pass.
+- 3,717 App tests pass / 3 skip.
+- Release solution build passes.
+- 8,661 complete Release tests pass / 5 skip.
+- Exact-binary lifecycle/reconnect report
+  `logs/connected-world-gate-20260726-190919/report.json` passes at the exact
+  production SHA. The capped process crosses six checkpoints in 242.324
+  seconds; the fresh uncapped reconnect completes in 61.332 seconds. Both exit
+  gracefully. All seven checkpoints retain zero host projections, pending host
+  acknowledgements, live teardowns, and landblock retirements.
+- Exact-binary canonical route
+  `logs/connected-r6-soak-20260726-191605.report.json` passes all nine
+  destinations, movement, jump, combat, portal, revisit, and graceful-exit
+  gates. Against the J5.7 canonical baseline, median turn CPU/GPU/update p95
+  improves from 22.9/9.7/2.3 ms to 16.4/1.3/0.7 ms; turn allocation p50
+  improves from 5,812.9 to 75.1 KiB. Median stationary CPU/GPU/update p95
+  improves from 21.4/7.0/1.3 ms to 15.2/1.1/0.6 ms. Peak working set falls
+  from 2,326.8 to 1,953.2 MiB while peak private bytes remain effectively flat
+  at 1,732.1 MiB.
+- Captured physical-display login, facility-hub, Holtburg-after-dungeon, and
+  reconnect frames are intact. The live user gate covers radar, paperdoll,
+  near/distant Use, combat facing, `/ls`, spell recall, portal tunnel, and
+  portal exit before J7 is declared closed.
+- No AC behavior changed and the divergence audit found no new row to add.
+
 ## 5. Adversarial matrix
 
 - construction failure after every child owner;
@@ -178,5 +229,11 @@ J7.1 exact rollback:
 git revert 96ddd16539e670a5ce9b1f86677530e3fbc3f635
 ```
 
+J7.2/J7.3 exact rollback:
+
+```text
+git revert ce41efb9e5938f79a7580476b949d172f52a1e69
+```
+
 No compatibility owner, service locator, asynchronous command queue, timeout,
 forced-ready path, or alternate headless behavior is permitted.

docs/research/2026-07-26-slice-j7-game-runtime-root-cutover.md

@@ -0,0 +1,97 @@
+# Slice J7 — graphical `GameRuntime` root cutover evidence
+
+**Production commit:**
+`ce41efb9e5938f79a7580476b949d172f52a1e69`
+
+**Status:** automated gates complete; the physical-display visual gate is
+active.
+
+## Outcome
+
+`GameWindow` now constructs and stores exactly one presentation-independent
+`GameRuntime`. App composition records and graphical adapters borrow that
+root's session, clock, identity, entity/object/physics, gameplay, movement,
+environment, and transit owners. They no longer construct or reconstruct
+parallel Runtime owners.
+
+The synchronous frame contract is unchanged: input, commands, simulation, UI
+projection, and rendering still execute in the existing host frame. The
+cutover adds no command queue, worker hop, snapshot copy, or frame of latency.
+
+## Ownership and teardown
+
+- `LocalPlayerIdentityState`, `UpdateFrameClock`, and
+  `WorldEnvironmentController` are graphical wrappers over root children.
+- Live presentation borrows the root transit owner.
+- Session composition borrows the root session.
+- The superseded App view and event adapters are deleted.
+- The graphical host owns one explicit root lease.
+- Shutdown first stops session ingress, then retires App UI/render borrowers,
+  releases the host lease, and disposes the root once.
+- The terminal gate verifies that `GameRuntime.CaptureOwnership()` converges.
+
+Construction and shutdown failure tests prove App rollback does not dispose a
+borrowed root, callback re-entrancy retains the exact retryable suffix, and no
+route, subscription, publication, entity, physics, gameplay, transit, session,
+or host-lease debt survives terminal disposal.
+
+## Automated gates
+
+- Runtime: 383 passed.
+- App: 3,717 passed / 3 skipped.
+- Release solution build: passed.
+- Complete Release suite: 8,661 passed / 5 skipped.
+- Connected lifecycle/reconnect:
+  `logs/connected-world-gate-20260726-190919/report.json`.
+  - exact source and binary commit match;
+  - six capped checkpoints in 242.324 seconds;
+  - one fresh uncapped reconnect checkpoint in 61.332 seconds;
+  - both processes exit gracefully with code zero;
+  - all seven stable checkpoints have zero host projections, pending host
+    acknowledgements, live teardowns, and landblock retirements.
+- Canonical nine-stop route:
+  `logs/connected-r6-soak-20260726-191605.report.json`.
+  - all destinations, movement, jump, combat, revisit, portal, and graceful
+    shutdown gates pass;
+  - no shutdown convergence, host-lease, retry, or abandoned-work diagnostic
+    appears.
+
+Against the last J5.7 canonical baseline
+`logs/connected-r6-soak-20260726-161406.report.json`, median turn
+CPU/GPU/update p95 improves from 22.9/9.7/2.3 ms to 16.4/1.3/0.7 ms, and turn
+allocation p50 improves from 5,812.9 to 75.1 KiB. Median stationary
+CPU/GPU/update p95 improves from 21.4/7.0/1.3 ms to 15.2/1.1/0.6 ms. Peak
+working set falls about 16%, from 2,326.8 to 1,953.2 MiB; peak private bytes
+remain effectively flat.
+
+The route retained only bounded diagnostics already covered by the existing
+performance and DAT-VFX ledgers: a two-landblock Caul visibility variation,
+one additional tracked texture (40,960 bytes), a transient 27-particle
+difference, 32 known DAT-driven VFX diagnostics, and 25 expected world-edge
+load misses.
+
+## Visual gate
+
+Captured physical-display login, facility-hub, Holtburg-after-dungeon, and
+fresh reconnect frames are intact. Final acceptance remains the user's live
+physical-display check of:
+
+- radar objects and coordinates;
+- inventory paperdoll;
+- near and distant Use/approach;
+- combat facing before bow fire;
+- `/ls` and spell-recall tunnel, materialization, and exit presentation.
+
+J7 must not be declared closed until this live gate passes.
+
+## Retail and divergence audit
+
+This is an ownership/composition refactor. It changes no AC algorithm, packet
+ordering, input semantics, simulation cadence, or visual effect. No new retail
+divergence is introduced, so the divergence register requires no new row.
+
+## Exact rollback
+
+```text
+git revert ce41efb9e5938f79a7580476b949d172f52a1e69
+```