fix(physics): seal collision generations before activation

This commit is contained in:
Erik 2026-07-31 15:53:05 +02:00
parent be94bc9b06
commit d94145e6b8
15 changed files with 1556 additions and 410 deletions

View file

@ -488,14 +488,19 @@ What exists and is active:
- Landblock collision activation is generation-owned by
`RuntimePhysicsState`. Graphical and no-window hosts populate a private
`PreparedLandblockCollisionGeneration` over bounded cursors; its cache,
`CellGraph`, engine landblock, buildings, static shadows, and dynamic-owner
refloods are never visible through the borrowed live engine. Runtime validates
the exact admission plus every affected dynamic shadow-owner version, seals
the complete replacement, and commits it synchronously on the one update
thread before emitting `CollisionGenerationCommitted`. A moving, spawned, or
deleted owner makes the generation not-ready and returns only that dirty owner
to the cursor-budgeted refresh phase. Thus readers see the complete old
generation or complete new generation, never a mixed cell/cache/shadow world.
`CellGraph`, engine landblock, buildings, static shadows, and retained-owner
refloods are never visible through the borrowed live engine. Retained owners
comprise every non-suspended dynamic or adjacent-root static touching the
target prefix (including a withdrawn repair marker); target-root statics come
from the authored replacement. Runtime mutation-gates their exact capture,
refreshes each through the host work meter, and builds every cache/graph/
shadow replacement list through one-work-unit seal cursors. The final update-
thread activation performs one mutation-version check and installs the sealed
records without heap allocation before emitting
`CollisionGenerationCommitted`. Cancellation disposes only the named staging
generation and never withdraws the previous active world. Thus readers see
the complete old generation or complete new generation, never a mixed
cell/cache/shadow world.
- `ShadowObjectRegistry` gives movement a per-cell broadphase over nearby
objects and buildings. Streaming reflood is structurally part of the Runtime
collision-generation commit; there is no independent post-publication