docs(headless): close K0 and activate K1

Pin the tested Windows/Linux portability boundary, exact rollback, dependency audit, and synchronized architecture and roadmap state before starting the production single-session host.

Co-authored-by: Codex <noreply@openai.com>

AGENTS.md

@@ -116,7 +116,7 @@ user-gated. Deterministic world-lifecycle automation protects fresh login,
 outdoor/world-edge/dungeon travel, same-location revisit, exact graceful
 disconnect, and uncapped fresh-process reconnect with JSON/PNG artifacts.
 Release builds; the current performance-program checkpoint passes
-3,718 App tests / 3 skips and 8,591 complete-solution tests / 5 skips.
+3,731 App tests / 3 skips and 8,708 complete-solution tests / 5 skips.
 
 **M4 feature work order (paused while the authorized performance program
 executes):** the six-slice pre-M4 world-interaction completion
@@ -350,7 +350,12 @@ no-window hosts share one `GameRuntime`, one retryable canonical-generation
 reset transaction, and one gameplay-owner graph. Its 395 Runtime tests, 3,731
 App tests / 3 skips, 8,696 complete Release tests / 5 skips, exact-binary
 lifecycle/reconnect route, and canonical nine-stop route pass. Slice K
-Linux headless/multi-session implementation is active.
+Linux headless/multi-session implementation is active. K0 completed at
+`aada8a37`: `AcDream.Headless` references only Runtime, strict no-connect
+validation and dependency/loaded-assembly guards pass, and the local Ubuntu
+closure passes 600 Core.Net, 119 Content, 395 Runtime, and 12 Headless tests.
+K1 portable paths, redacted credentials, and the production single-session
+host are active.
 J0's rollback is
 `git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
 J1's rollback is
@@ -407,6 +412,8 @@ J7.2/J7.3's rollback is
 `git revert ce41efb9e5938f79a7580476b949d172f52a1e69`.
 J8's rollback is
 `git revert a9a822f206cc6021bc099988144488f3bd7c397b`.
+K0's rollback is
+`git revert aada8a37c1e933f9f0a3f41dc4f05615b01023bc`.
 Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
 work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
 passes. Slice I is closed in
@@ -435,7 +442,8 @@ closeout is
 `docs/research/2026-07-26-slice-j6-4-host-acknowledgement.md`. J7 closeout is
 `docs/research/2026-07-26-slice-j7-game-runtime-root-cutover.md`; J8/Slice-J
 closeout is
-`docs/research/2026-07-27-slice-j8-no-window-closeout.md`; Slice K executes
+`docs/research/2026-07-27-slice-j8-no-window-closeout.md`; K0 closeout is
+`docs/research/2026-07-27-slice-k0-portability-boundary.md`; Slice K executes
 from `docs/plans/2026-07-26-modern-runtime-slice-k.md`. The exact G4 visual
 rollback
 is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or

CLAUDE.md

@@ -114,7 +114,7 @@ user-gated. Deterministic world-lifecycle automation protects fresh login,
 outdoor/world-edge/dungeon travel, same-location revisit, exact graceful
 disconnect, and uncapped fresh-process reconnect with JSON/PNG artifacts.
 Release builds; the current performance-program checkpoint passes
-3,718 App tests / 3 skips and 8,591 complete-solution tests / 5 skips.
+3,731 App tests / 3 skips and 8,708 complete-solution tests / 5 skips.
 
 **M4 feature work order (paused while the authorized performance program
 executes):** the six-slice pre-M4 world-interaction completion
@@ -348,7 +348,12 @@ no-window hosts share one `GameRuntime`, one retryable canonical-generation
 reset transaction, and one gameplay-owner graph. Its 395 Runtime tests, 3,731
 App tests / 3 skips, 8,696 complete Release tests / 5 skips, exact-binary
 lifecycle/reconnect route, and canonical nine-stop route pass. Slice K
-Linux headless/multi-session implementation is active.
+Linux headless/multi-session implementation is active. K0 completed at
+`aada8a37`: `AcDream.Headless` references only Runtime, strict no-connect
+validation and dependency/loaded-assembly guards pass, and the local Ubuntu
+closure passes 600 Core.Net, 119 Content, 395 Runtime, and 12 Headless tests.
+K1 portable paths, redacted credentials, and the production single-session
+host are active.
 J0's rollback is
 `git revert b632672e5ccabfb44c551e08f1c411ab2669c44a`.
 J1's rollback is
@@ -405,6 +410,8 @@ J7.2/J7.3's rollback is
 `git revert ce41efb9e5938f79a7580476b949d172f52a1e69`.
 J8's rollback is
 `git revert a9a822f206cc6021bc099988144488f3bd7c397b`.
+K0's rollback is
+`git revert aada8a37c1e933f9f0a3f41dc4f05615b01023bc`.
 Slice H's retained UI/frame, bounded-light, and pooled/borrowed/direct network
 work is complete; the exact seven-checkpoint connected lifecycle/reconnect gate
 passes. Slice I is closed in
@@ -433,7 +440,8 @@ closeout is
 `docs/research/2026-07-26-slice-j6-4-host-acknowledgement.md`. J7 closeout is
 `docs/research/2026-07-26-slice-j7-game-runtime-root-cutover.md`; J8/Slice-J
 closeout is
-`docs/research/2026-07-27-slice-j8-no-window-closeout.md`; Slice K executes
+`docs/research/2026-07-27-slice-j8-no-window-closeout.md`; K0 closeout is
+`docs/research/2026-07-27-slice-k0-portability-boundary.md`; Slice K executes
 from `docs/plans/2026-07-26-modern-runtime-slice-k.md`. The exact G4 visual
 rollback
 is `git revert ef1d263337997bb030eadb7b8e71d73dc659907a`; do not revert G3 or

docs/README.md

@@ -38,11 +38,11 @@ banner cannot silently override the current program state.
 - **Active engineering track:** Slice J's presentation-independent runtime,
   composition root, shared generation reset, and no-window closeout are
   complete. Build the approved Linux/headless multi-session host in Slice K.
-  J8's exact rollback is
+  K0 is complete and K1 is active. K0's exact rollback is
-  `git revert a9a822f206cc6021bc099988144488f3bd7c397b`.
+  `git revert aada8a37c1e933f9f0a3f41dc4f05615b01023bc`.
 - **Divergence audit:** 178 active rows — IA 17, AD 37, AP 85, TS 34,
   and UN 5 — plus the retained retired TS-37 history note.
-- **Latest automated baseline:** Release build succeeds; 8,696 tests pass and
+- **Latest automated baseline:** Release build succeeds; 8,708 tests pass and
   five are intentionally skipped. The exact J8 lifecycle/reconnect and
   canonical nine-stop gates match embedded binary/source commit, converge
   every backlog, and complete with graceful zero-code exits and zero failures.

docs/architecture/acdream-architecture.md

@@ -245,6 +245,12 @@ src/
     -> Slice J complete; graphical and no-window hosts share one GameRuntime
     -> may reference Core, Core.Net, Content, and Plugin.Abstractions only
     -> must never reference App, UI, Silk.NET, OpenAL, Arch, or ImGui
+
+  AcDream.Headless/          Linux/Windows no-window production host
+    Program.cs               -> CLI entry only
+    Configuration/           -> strict versioned process/session config
+    -> references Runtime only; no presentation/backend package
+    -> K0 complete; K1 single-session host active
   
   AcDream.Plugin.Abstractions/  Layer 5: plugin interfaces
     IAcDreamPlugin.cs         -> done

docs/architecture/code-structure.md

@@ -480,6 +480,7 @@ useful ordering seam, but its ownership status is **partial**.
 | Landblock presentation | **Complete** | `LandblockBuildFactory` owns the captured-origin DAT transaction; concrete render/physics/DAT-static publishers and `LandblockPresentationPipeline` own typed-meter publication and exact retryable retirement. `StreamingController` owns stable destination/control/unload/Near/Far queues and destination reservation. CPU mesh-cache restaging requires an exact live owner. `StreamingOriginRecenterCoordinator` serializes old-window retirement with teleport/session origin lifetimes. `GameWindow` retains construction and one pipeline field only (`c79d0a49`, closeout `4a205a3e`; Slice E closeout `91e82c3c`). |
 | Render-frame orchestration | **Complete** | `RenderFrameOrchestrator` owns the GPU-flight, resource, world/PView/shared-alpha, private-presentation, diagnostics, screenshot, and recovery graph. `GameWindow.OnRender` takes one logical window-size snapshot and performs one immutable handoff (`9d7df1bf`). |
 | Unified `GameEntity` | **Slice J complete** | Canonical identity, retained-object lifetime, direct views, ordered entity/object deltas, gameplay state, action/combat/magic/movement/physics/remote/projectile simulation, world environment, reveal/transit truth, and host acknowledgement share failure-safe Runtime owners while exact graphical sidecars stay in App. One `GameRuntime` composes the graph. `RuntimeGenerationReset` is the sole retryable canonical-generation reset for graphical and no-window hosts; the deterministic direct host proves lifecycle, commands, portal, reconnect, GUID reuse, fault recovery, isolation, and terminal convergence without presentation assemblies (`a9a822f2`). |
+| Headless host | **Slice K0 complete; K1 active** | `AcDream.Headless` references only Runtime. Its strict CLI validator, dependency closure, loaded-assembly guard, and Windows/Ubuntu CI establish a production process that cannot acquire App, UI, GL, native-window, or audio ownership (`aada8a37`). |
 
 ### 4.3 Revised extraction sequence
 

docs/plans/2026-04-11-roadmap.md

@@ -1,6 +1,6 @@
 # acdream — strategic roadmap
 
-**Status:** Living document. Updated 2026-07-27. **M3 landed; M4 is active.** M3's retail casting/UI, R6 locomotion/collision/projectile/teleport/radar rebaseline, deterministic fresh-login/portal world lifecycle, and final two-client portal observer flow are user-gated. All eight slices of the behavior-preserving ownership campaign in [`docs/architecture/code-structure.md`](../architecture/code-structure.md), their automated closeout, and the user's connected visual matrix are complete. Modern Runtime J3 canonical entity/object lifetime and J4 gameplay-state ownership are closed at `89e6b207`; J5.1 canonical selection/combat/target-mode ownership is closed at `b298f99f`, J5.2 interaction transactions at `f5f7b417`, J5.3 combat/magic intent at `20df9d15`, J5.4 local movement/outbound cadence at `aa3f4a60`, J5.5 per-session physics/remote simulation at `7e6033d0`, J5.6 projectile simulation at `2aee3356`, and J5.7 combined simulation closeout at `cdee7a4b`. J6.1 world-environment ownership is closed at `902076c0`; J6.2 canonical reveal generation and typed destination readiness is closed at `a6860d55` plus `acb845d8`; J6.3 exact F751/Position destination correlation is closed at `6a063a27`; J6.4 exact graphical-host acknowledgement and owner cleanup is closed at `18d17d8b`. J7's one graphical `GameRuntime` root is closed at `ce41efb9`, including the user's 2026-07-27 exact post-cutover visual acceptance. J8 closed Slice J at `a9a822f2` with one shared graphical/no-window root and generation-reset transaction. Slice K Linux headless/multi-session work is active. Issue #225's lifestone/particle alpha comparison remains a separate rendering visual gate.
+**Status:** Living document. Updated 2026-07-27. **M3 landed; M4 is active.** M3's retail casting/UI, R6 locomotion/collision/projectile/teleport/radar rebaseline, deterministic fresh-login/portal world lifecycle, and final two-client portal observer flow are user-gated. All eight slices of the behavior-preserving ownership campaign in [`docs/architecture/code-structure.md`](../architecture/code-structure.md), their automated closeout, and the user's connected visual matrix are complete. Modern Runtime J3 canonical entity/object lifetime and J4 gameplay-state ownership are closed at `89e6b207`; J5.1 canonical selection/combat/target-mode ownership is closed at `b298f99f`, J5.2 interaction transactions at `f5f7b417`, J5.3 combat/magic intent at `20df9d15`, J5.4 local movement/outbound cadence at `aa3f4a60`, J5.5 per-session physics/remote simulation at `7e6033d0`, J5.6 projectile simulation at `2aee3356`, and J5.7 combined simulation closeout at `cdee7a4b`. J6.1 world-environment ownership is closed at `902076c0`; J6.2 canonical reveal generation and typed destination readiness is closed at `a6860d55` plus `acb845d8`; J6.3 exact F751/Position destination correlation is closed at `6a063a27`; J6.4 exact graphical-host acknowledgement and owner cleanup is closed at `18d17d8b`. J7's one graphical `GameRuntime` root is closed at `ce41efb9`, including the user's 2026-07-27 exact post-cutover visual acceptance. J8 closed Slice J at `a9a822f2` with one shared graphical/no-window root and generation-reset transaction. Slice K Linux headless/multi-session work is active; K0's tested no-presentation Windows/Linux boundary closed at `aada8a37` and K1 is active. Issue #225's lifestone/particle alpha comparison remains a separate rendering visual gate.
 **Purpose:** One source of truth for where the project is and where it's going. Every observed defect or missing feature has a named phase that owns it; when something looks wrong in-game, look here to find the phase that'll address it. Implementation details live in per-phase specs under `docs/superpowers/specs/`, not in this file.
 
 ---

docs/plans/2026-05-12-milestones.md

@@ -280,6 +280,12 @@ residency is `0/0/0` at every stable checkpoint and teardown converges. Slice I
   lifecycle/reconnect route, and canonical nine-stop route pass. Slice K is
   active under
   [`2026-07-26-modern-runtime-slice-k.md`](2026-07-26-modern-runtime-slice-k.md).
+  K0 completed at `aada8a37`: `AcDream.Headless` has a hard no-presentation
+  dependency boundary, strict no-connect validation, and Windows/Ubuntu CI.
+  Local Ubuntu gates pass 600 Core.Net, 119 Content, 395 Runtime, and 12
+  Headless tests; the Windows Release solution passes 8,708 tests / 5 skips.
+  K1 portable paths, credentials, and the production single-session host are
+  active.
 Slice-I closeout evidence is
 [`../research/2026-07-25-slice-i7-closeout.md`](../research/2026-07-25-slice-i7-closeout.md).
 Slice-J2 closeout evidence is

docs/plans/2026-07-24-modern-runtime-architecture.md

@@ -27,7 +27,8 @@ generation/cell-scoped graphical-host acknowledgement suffix. J7 completed
 at `ce41efb9` with its automated gates and the user's 2026-07-27
 physical-display acceptance. J8 and Slice J closed at `a9a822f2`: graphical
 and direct hosts share one `GameRuntime`, one retryable generation-reset
-transaction, and one canonical gameplay-owner graph. Slice K is active.
+transaction, and one canonical gameplay-owner graph. Slice K is active; K0
+established the tested Windows/Linux headless boundary at `aada8a37`.
 
 **Scope:** Reconcile and sequence the existing Modern Pipeline (`MP`) and
 Linux/headless (`LH`) tracks using the 2026-07-24 connected performance audit.
@@ -1309,6 +1310,9 @@ its exact post-cutover visual matrix on 2026-07-27. J8 closed Slice J at
 `a9a822f2`; 395 Runtime tests, 3,731 App tests / 3 skips, 8,696 complete-
 solution tests / 5 skips, lifecycle/reconnect, and canonical nine-stop gates
 pass. Slice K is the current execution point.
+K0 completed at `aada8a37`: the no-App Windows/Ubuntu closure, strict
+no-connect validator, dependency/assembly guards, Release build, 8,708-test /
+5-skip complete suite, and local Ubuntu gates pass. K1 is active.
 Evidence:
 [`../research/2026-07-25-slice-g5-production-profile.md`](../research/2026-07-25-slice-g5-production-profile.md)
 and

docs/plans/2026-07-26-modern-runtime-slice-k.md

@@ -1,6 +1,6 @@
 # Modern runtime Slice K — Linux headless and multi-session host
 
-**Status:** ACTIVE 2026-07-27 — SLICE J ENTRY GATE PASSED
+**Status:** K0 COMPLETE; K1 ACTIVE 2026-07-27
 **Parent:** `2026-07-24-modern-runtime-architecture.md`, Slice K
 **Authorization:** the user approved Slices F–L on 2026-07-24
 **Purpose:** run efficient automated clients on Linux without a display, GPU,
@@ -212,6 +212,14 @@ soon as session teardown begins.
 
 ### K0 — portability boundary and Linux CI
 
+**Complete at `aada8a37`.** The dedicated `AcDream.Headless` executable and
+test project reference only Runtime, strict no-connect configuration validation
+runs on Windows and Linux, dependency/loaded-assembly guards forbid graphical
+and audio backends, and the Windows/Ubuntu workflow builds/tests only the
+portable closure. Local Ubuntu 24.04 gates pass 600 Core.Net, 119 Content, 395
+Runtime, and 12 Headless tests. The exact Windows Release solution passes
+8,708 tests / 5 intentional skips.
+
 - Add `AcDream.Headless` and `AcDream.Headless.Tests`.
 - Add dependency-closure and loaded-assembly guards.
 - Add a normal GitHub Actions matrix for Windows and Ubuntu.
@@ -333,3 +341,9 @@ Land K0–K4 as separate buildable commits. Record the full production SHA and
 exact `git revert <sha>` after each complete focused/Release/Linux/connected
 gate. No later sub-slice begins while the prior exact rollback is absent from
 this plan.
+
+K0 exact rollback:
+
+```text
+git revert aada8a37c1e933f9f0a3f41dc4f05615b01023bc
+```

docs/research/2026-07-27-slice-k0-portability-boundary.md

@@ -0,0 +1,64 @@
+# Slice K0 portability boundary closeout
+
+## Outcome
+
+K0 completed at `aada8a37c1e933f9f0a3f41dc4f05615b01023bc`.
+The repository now has a dedicated `AcDream.Headless` executable and matching
+test project. The executable references only `AcDream.Runtime`; its transitive
+closure contains no App, UI, Silk.NET, OpenAL, Arch, ImGui, renderer, audio, or
+native-window assembly.
+
+Exact rollback:
+
+```text
+git revert aada8a37c1e933f9f0a3f41dc4f05615b01023bc
+```
+
+## Boundary
+
+- `--help` runs without constructing Runtime or loading presentation code.
+- `validate --config <path>` performs strict, case-sensitive, versioned JSON
+  validation without connecting.
+- Unknown properties, missing required fields, duplicate/empty session IDs,
+  unsupported versions, malformed files, and secret-shaped unknown fields fail
+  with deterministic exit codes.
+- Arbitrary command arguments and secret values are not reflected into
+  diagnostics.
+- Project, dependency-manifest, and loaded-assembly tests enforce the boundary.
+- Runtime's existing dependency-project test now resolves MSBuild paths on
+  Windows and Linux and remains valid under isolated artifact roots.
+
+## CI and local Linux proof
+
+`.github/workflows/headless-portability.yml` runs on Windows and Ubuntu. It
+builds Plugin.Abstractions, Core, Core.Net, Content, Runtime, and Headless,
+then tests only the presentation-free Core.Net, Content, Runtime, and Headless
+closures. Historical `AcDream.Core.Tests` App-integration fixtures remain in
+the complete-solution lane and are deliberately excluded from the no-App
+restore lane.
+
+Local Ubuntu 24.04 / .NET 10.0.302 evidence:
+
+- Plugin.Abstractions and Core build: pass.
+- Core.Net tests: 600/600.
+- Content tests: 119/119.
+- Runtime tests: 395/395.
+- Headless tests: 12/12.
+- Headless `--help`: exit 0.
+
+Exact Windows Release evidence:
+
+- solution build: pass (17 pre-existing Core-test warnings);
+- complete solution: 8,708 pass / 5 intentional skips;
+- Headless tests: 12/12;
+- Runtime tests: 395/395.
+
+## Audit
+
+- Windows-only UDP reset handling was already guarded by
+  `OperatingSystem.IsWindows()`.
+- CP-1252 registration is BCL/provider-based and Linux-safe.
+- immutable pak reading uses portable read-only memory mapping.
+- remaining wall-clock and diagnostic-call-site cleanup belongs to K2 timing
+  ownership, not the K0 process boundary.
+- no retail gameplay behavior changed and no divergence row was added.