diff --git a/docs/research/2026-09-01-overhaul/474-publication-repair-contract.md b/docs/research/2026-09-01-overhaul/474-publication-repair-contract.md index 497dd9586..b2d9e24a0 100644 --- a/docs/research/2026-09-01-overhaul/474-publication-repair-contract.md +++ b/docs/research/2026-09-01-overhaul/474-publication-repair-contract.md @@ -1,6 +1,6 @@ # #474 bounded repair — destination backend before restore acknowledgement -Status: lead contract, round0, 2026-09-05. Diagnosis/evidence base +Status: lead contract, round0 amendment A, 2026-09-05. Diagnosis/evidence base `3a9d5b01a881e56bd93211a5f78a80ea2767a7c0`. This is the immediate S5/G4 blocker; C1c and section45 geometry work remain preserved/unmodified. @@ -20,9 +20,11 @@ Expected production scope: - `src/AcDream.App/Streaming/GraphicalRemotePlacementServiceWindow.cs`; - `src/AcDream.App/Composition/SessionPlayerComposition.cs`. -`LandblockPhysicsPublisher.cs` is allowed only if required to preserve its -post-engine cancellation/acknowledgement lifecycle, with an exact test. -No other production file without a lead contract amendment. +Amendment A excludes `LandblockPhysicsPublisher.cs` and changes to the +cancellation API: the asserted controller cancellation path was disproved +below. Remove only this chunk's temporary cancellation edits with an explicit +patch; preserve all other work. No other production file without a lead +contract amendment. Tests: concrete-pipeline, controller-readiness and remote-service-window tests; one focused new test/fixture file if sharing the real Runtime/sink composition cannot be cleanly expressed in the existing concrete fixture. @@ -66,20 +68,31 @@ commit; this ordering is an explicit async adaptation, not a retail algorithm. reserve work twice, bypass the meter from a Settings/reset callback, repeat static scripts or report completion while an exact suffix is outstanding. -### Cancellation hole that MUST be exercised +### Reset/recenter lifecycle — amendment A corrects the original assumption The engine transfer can succeed just as the meter expires BEFORE the early -spatial helper runs. A later recenter/reset calls CancelPendingPublications; -`LandblockPhysicsPublication.TryCancel` sets CancellationRequested and Runtime -then waits on the same restore ACK. Ordinary AdvanceCompleteOne refuses a -cancelled publication. Therefore testing only cancellation AFTER the backend -is installed is insufficient. Explicitly cover cancellation between engine -transfer and backend activation, including a yielded/throwing activation. -Keep the committed engine; resume only the required metered backend/ACK suffix -under exact retained ownership, then let the existing retirement flow detach -and clean it. No post-engine rollback, unmetered hidden resume or leaked -ready fence. If this needs a broader owner/API change, report the exact seam -to the lead before making it. +spatial helper runs. The original contract incorrectly asserted that a later +ordinary reset/recenter cancels this retained transaction. Both production +controller paths first call `AdvanceGeneration`, which returns false until +`ConvergePendingPublications` finishes every retained publication. Only then +can they reach `CancelPendingPublications`. The intervening production +`LandblockStreamer.ClearPendingLoads` posts a worker `ClearLoads` job; it +does not create a pipeline publication. Thus the normal controller reaches +cancellation with no retained publication, not with this post-engine receipt. +The lead and implementer independently checked both callers and the binding +in `SessionPlayerComposition` against the unchanged contract-base source. + +Test that ACTUAL reset/recenter convergence before and after early backend +activation, including a yielded/throwing activation. Keep the committed engine; +resume the metered backend/ACK suffix before the existing retirement flow +detaches and cleans it. No post-engine rollback, unmetered hidden resume or +leaked ready fence. Do not add cancellation machinery or manipulate private +controller flags solely to satisfy the disproved mechanism. The existing +`LandblockPhysicsPublisherTests.ReplacementYieldsAtHeldWithdrawAndPlaceWithoutPostEngineReseal` +already exercises direct `TryCancel` before/after its exact Place ACK; rerun +it unchanged, and label that evidence separately from real controller coverage. +If a genuine production cancellation counterexample is found, report its +exact caller/state before widening this repair. ## 3. Mandatory discriminating regressions @@ -102,11 +115,13 @@ predicate alone does not prove the regression. - **T3 metering:** small entity budget and deterministic clock exhaustion at the post-engine/pre-backend edge. Next admissible frame must make progress; limits hold, engine transfer and completed prefix effects never repeat. -- **T4 cancellation/retry:** both before and after backend activation after +- **T4 reset/recenter/retry:** both before and after backend activation after engine transfer; include an injected activation/reconciliation failure. Preserve no-rollback, exact suffix retry, balanced pins/scripts and eventual - withdrawal/retirement. Test the real controller cancellation path where the - meter/retained publication interaction matters, not only `TryCancel` alone. + withdrawal/retirement. Test the real controller convergence path where the + meter/retained publication interaction matters, for both reset and recenter; + do not relabel it as cancellation. Also rerun the existing direct `TryCancel` + lifecycle regression without changing that API. - **T5 admission controls:** unpublished/pending-only/Far remains rejected; completed Near accepted; incomplete unrelated landblock does not block the selected destination; complete presentation with later replay/recovery diff --git a/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md b/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md index b12532cba..cb27b2e16 100644 --- a/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md +++ b/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md @@ -4415,12 +4415,29 @@ No merge main before G4. regressions. It permits the existing observer-atomic spatial operation after engine commit but before restore acknowledgement, while retaining the original physics/static-plugin completion order and explicit readiness/service-window -fences. It calls out cancellation after engine transfer but before a metered -backend step as a mandatory test, and requires a real cross-prefix seam control +fences. Its original cancellation-path assumption is corrected by amendment A +below; actual reset/recenter convergence after engine transfer but before a +metered backend step remains mandatory. It requires a real cross-prefix seam control before claiming broader closure. The lead independently verified the named landscape initialization order against the paired PE; the modern receipt split remains an AD-2 adaptation. Contract committed31960039b; round0 implementation DISPATCHED to one OpenAI agent in fresh `C:\Users\erikn\source\repos\acdream\.claude\worktrees\s5-474-openai-impl`, branch`codex/s5-474-openai-impl`, at that exact base. No implementation result, -review or gate is yet claimed. C1c's nine-file return remains untouched. +review or gate was claimed at dispatch. C1c's nine-file return remains untouched. + +### Round0 amendment A — lifecycle assumption disproved + +Before independent review, the lead and implementer independently verified +that BOTH production reset/recenter paths call `AdvanceGeneration` and fully +`ConvergePendingPublications` before `CancelPendingPublications`; the intervening +worker-inbox clear cannot create a publication. The original contract assumed +a normal post-engine cancellation path that does not execute. Correct the +contract rather than build machinery around that assumption: remove this +chunk's temporary publisher/cancellation API edits, test the actual metered +reset/recenter convergence and activation-failure retry, and rerun the existing +direct `TryCancel` regression unchanged. This is a contract correction, not a +new retail behavior/deviation or a completed review pass. T1 has a discriminating +old-order missing-backend failure and a green repair run; the implementer's +T1–T3 checkpoint is 3/3. Remaining mandatory cases, final review and graphical +gate are still outstanding; no broad completion is inferred from those tests.