docs(performance): close modern runtime slice H

docs/ISSUES.md

@@ -362,7 +362,7 @@ retained typed snapshots instead of arrays. Evidence:
 
 ## #239 — Inbound net path allocates 3-4 arrays/objects per packet
 
-**Status:** OPEN
+**Status:** DONE — 2026-07-25, Modern Runtime Slice H-c
 **Severity:** LOW
 **Filed:** 2026-07-24
 **Component:** net
@@ -375,10 +375,15 @@ byte[], a second full copy into `Packet.BodyBytes`
 fragment count, which dominates during active play. The audit named only
 the outbound `ToArray()` copy.
 
-**Root cause / status:** 2026-07-24 audit review finding. In scope for plan
-Slice H-c (requires the §0.3 freeze authorization); invariants pinned in
-the plan amendment (single outstanding receive, arrival order,
-ack-per-packet).
+**Resolution:** One cancellable pooled receive owner now preserves kernel
+arrival order while packet headers, optionals, checksum verification, and
+single-fragment dispatch borrow the queued datagram. Only multi-fragment state
+whose lifetime crosses datagrams is copied. Warm production decode allocates
+zero bytes; the 500,000-packet differential benchmark improved throughput
+8.666x and removed approximately 400 bytes per packet. Direct recurring sends
+also frame into caller storage with zero warmed allocation. Connected
+login/portal/dungeon/reconnect and exact graceful disconnect pass. Evidence:
+`docs/research/2026-07-25-slice-h-closeout.md`.
 
 **Files:** `src/AcDream.Core.Net/NetClient.cs:63-78`;
 `src/AcDream.Core.Net/Packets/PacketCodec.cs:58,64`;

docs/plans/2026-04-11-roadmap.md

@@ -1631,7 +1631,14 @@ port in any phase — no separate listing here.
 > records the post-E decision evidence, exact owner boundary, non-drawing
 > shadow referee, production cutover, and acceptance matrix. The user
 > explicitly approved Slices F–L, including the F/G and J gates, on
-> 2026-07-24. Slice F is active from pre-runtime rollback anchor `e7d9d6fa`.
+> 2026-07-24. Slice F and G0–G4 are implemented; 46,599 automated G4
+> comparisons have zero mismatches. Its physical-display visual gate and G5
+> old-path deletion remain pending, with exact rollback
+> `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`. Slice H is complete:
+> retained UI/frame work, exact bounded light selection, and
+> pooled/borrowed/direct network I/O pass 8,292 Release tests / 5 skips and the
+> connected lifecycle/reconnect gate. Slice I is active from
+> [its detailed plan](2026-07-25-modern-runtime-slice-i.md).
 
 **Spec:** `docs/superpowers/specs/2026-07-05-modern-pipeline-design.md` (the
 umbrella design — read it first). **Goal:** smoothness first (no frame over

docs/plans/2026-05-12-milestones.md

@@ -107,10 +107,15 @@ on exact binary `91e82c3c`; all checkpoints converge with no stranded
 publication, retirement, upload, warmup, or resource backlog. Capped/uncapped
 CPU p99 is 34.7%/30.4% below Slice A and maximum frame allocation is
 84.7%/82.2% lower. The user explicitly approved Slices F–L, including both
-the F/G ECS and Slice J gameplay-owner gates, on 2026-07-24. Slice F is active
-from rollback anchor `e7d9d6fa`, using the implementation-ready post-E
-ownership, shadow-comparison, cutover, and acceptance contract in
-[`2026-07-24-modern-runtime-slices-f-g-render-scene.md`](2026-07-24-modern-runtime-slices-f-g-render-scene.md).
+the F/G ECS and Slice J gameplay-owner gates, on 2026-07-24. Slice F and
+G0–G4 are implemented; G4's automated gate has zero mismatches while its
+physical-display visual gate and G5 deletion remain pending. Slice H is
+complete: retained UI/frame work, exact bounded light selection, and
+pooled/borrowed/direct network I/O pass 8,292 Release tests / 5 skips and the
+seven-checkpoint connected lifecycle/reconnect gate. Slice I is active under
+[`2026-07-25-modern-runtime-slice-i.md`](2026-07-25-modern-runtime-slice-i.md).
+The exact G4 visual rollback remains
+`git revert ef1d263337997bb030eadb7b8e71d73dc659907a`.
 
 Slice 1's 18-cell favorite-spell overflow bar is user-accepted. Slice 2's
 status hand selected-object availability and existing

docs/plans/2026-07-25-modern-runtime-slice-h.md

@@ -1,6 +1,6 @@
 # Modern runtime Slice H execution plan
 
-**Status:** ACTIVE  
+**Status:** COMPLETE (2026-07-25)
 **Parent plan:** `2026-07-24-modern-runtime-architecture.md`, Slice H  
 **Prerequisite state:** Slice G4 production cutover is automated-gated; its
 user visual gate remains pending.
@@ -204,3 +204,27 @@ fixtures are committed under `docs/research/` or the matching test project.
   measured after H-a and scheduled only if still material.
 - Slices I–L start only after Slice H is measured and documented, but no
   additional authorization is required.
+
+## 7. Closeout
+
+All H-a, H-b, and H-c implementation units are complete. The Release build
+and complete solution pass 8,292 tests with 5 skips. The connected
+login/portal/dungeon/revisit/graceful-disconnect/fresh-process-reconnect gate
+passed on commit `41c1a593927fcf71ef83b4825c659a4970e9b858` with all seven
+checkpoints ready, no invariant or transport failure, and both sessions
+closing through the normal logout path.
+
+The connected automation deliberately constructs the retained G4 current-path
+oracle, so its scene-sized per-frame allocation is comparison-instrumentation
+cost and not representative of production. A separate normal uncapped Release
+session, with neither lifecycle automation nor the oracle composed, stabilized
+at 25.6 KiB/frame and roughly 500 presented frames/second under RDP. Allocation
+stack attribution identifies the remaining dominant production owners as
+`Transition` query scratch (Slice I) and the retained current partition/referee
+path (G5). The H-owned packet decode and recurring outbound framing paths
+independently allocate zero bytes when warm. The program-wide 4 KiB/frame
+target therefore remains an end-of-G5/Slice-I acceptance condition rather than
+being misreported as achieved by H alone.
+
+Closeout evidence:
+[`../research/2026-07-25-slice-h-closeout.md`](../research/2026-07-25-slice-h-closeout.md).

docs/research/2026-07-25-slice-h-closeout.md

@@ -0,0 +1,103 @@
+# Modern runtime Slice H closeout
+
+## Result
+
+Slice H's scoped work is complete:
+
+- retained UI report layout, visible cooldown participation, changed-only
+  attachment reconciliation, and retained frame scratch;
+- exact bounded global-light selection;
+- one pooled cancellable receive owner, borrowed packet decode, and direct
+  recurring outbound framing.
+
+No retail gameplay, packet-ordering, acknowledgement, heartbeat, visibility,
+light-membership, or UI-presentation rule changed.
+
+## Automated conformance
+
+At production commit `41c1a593927fcf71ef83b4825c659a4970e9b858`:
+
+- `dotnet build AcDream.slnx -c Release`: pass, with the 16 already tracked
+  test-project warnings;
+- complete Release solution: 8,292 passed / 5 skipped;
+- network-focused suite: 600 passed;
+- receive decode differential: all optional fields, login, fragment,
+  malformed-packet, and ISAAC-state cases pass;
+- recurring send differential: exact bytes, checksum, sequence, and ISAAC
+  consumption pass.
+
+Warm microbenchmarks:
+
+| Path | Before | After | Result |
+|---|---:|---:|---:|
+| 500,000 borrowed 48-byte packet decodes | 246.372 ms / 200,000,040 B | 28.431 ms / 40 B timer overhead | 8.666x throughput; production decode 0 B |
+| 500,000 recurring 44-byte sends | 137.206 ms / 176,000,040 B | 12.551 ms / 0 B | 10.932x throughput; direct framing 0 B |
+
+## Connected lifecycle gate
+
+Command:
+
+```powershell
+tools/run-connected-world-lifecycle-gate.ps1 `
+  -Repository <repo> `
+  -SkipBuild `
+  -SessionTimeoutSeconds 420
+```
+
+Raw local evidence:
+`logs/connected-world-gate-20260725-060344/report.json`.
+
+Result: PASS.
+
+- Capped session: login, Aerlinthe, Rynthid, Facility Hub, Holtburg after
+  dungeon, and Aerlinthe revisit all reached a complete visible reveal.
+- Fresh uncapped process: reconnect reached a complete visible reveal.
+- 7/7 checkpoints were ready with render, composite, and collision readiness.
+- No reveal invariant failure, packet/transport failure, `WeenieError`,
+  `ObjectDisposedException`, or receive-owner death occurred.
+- Both sessions issued graceful logout, received authoritative confirmation,
+  exited through `WM_CLOSE`, and ACE observed `PacketHeader Disconnect`.
+- The only warning was 25 expected world-edge landblock misses.
+
+This was an RDP run. It proves correctness, ordering, ownership, cleanup, and
+reconnect behavior; its absolute CPU/GPU/frame-time numbers are not accepted
+as hardware performance evidence.
+
+## Production allocation check
+
+The connected gate enables lifecycle screenshots and therefore constructs the
+G4 current-path comparison oracle. That oracle fingerprints and sorts the
+complete visible projection set each frame and intentionally allocates in
+proportion to scene size. Its 3.9-10.5 MiB/frame outdoor readings are
+automation observer cost, not the normal production composition.
+
+A separate uncapped Release login was captured with no UI probe, automation
+artifact directory, or current-path oracle:
+
+```text
+cpu_ms p50=1.9-2.0, p95=2.5-2.8
+gpu_ms p50=1.2-1.3, p95=1.5
+alloc_kb p50=25.6
+```
+
+The RDP timing is diagnostic only. The allocation measurement is valid:
+allocation-tick stacks attribute the remaining production bytes primarily to
+the existing `Transition` collision scratch and retained current render
+partition, followed by smaller animation/UI iterators. Those owners are
+explicitly scheduled for Slice I and G5. The H-owned warmed receive and send
+paths themselves are zero-allocation.
+
+Accordingly, H closes its scoped owners without weakening the program-level
+target: steady production allocation at or below 4 KiB/frame remains a
+mandatory G5/Slice-I closeout gate.
+
+## Exact retained visual rollback
+
+The G4 production draw-source visual gate is still pending. If it fails on a
+physical display, revert only:
+
+```text
+git revert ef1d263337997bb030eadb7b8e71d73dc659907a
+```
+
+Do not revert G3 or the `129dd77d` / `03b10183` portal-warmup corrections.