refactor(settings): own two-phase runtime settings

Move pre-window loading, startup application, live settings mutation, toon context, quality reapply, and SettingsVM loans behind one RuntimeSettingsController. Preserve retail command behavior, ordered target publication, draft semantics, and retryable failure convergence while removing duplicate GameWindow state and feature bodies.

Co-authored-by: Codex <codex@openai.com>

docs/architecture/acdream-architecture.md

@@ -829,11 +829,15 @@ Current movement/collision ownership:
   routers; Slice 4 moved hydration, teardown, inbound authority, network
   updates, and reusable motion-runtime policy over canonical
   `LiveEntityRuntime`. Slices 5–7 complete landblock presentation and the
-  update/render frame graphs. Slice 8 checkpoints A–F now own the native
+  update/render frame graphs. Slice 8 checkpoints A–G now own the native
   callback shell, live-session composition, world environment, reversible
   input/pointer lifetime, physical framebuffer publication, the sole gameplay
-  action-priority graph, typed commands, and the retained-root item-drop edge.
-  Two-phase runtime settings is the next checkpoint. The reconciled ledger and sequence live in
+  action-priority graph, typed commands, the retained-root item-drop edge, and
+  two-phase runtime settings. `RuntimeSettingsController` is the sole settings
+  persistence/current-state owner, supplies the immutable pre-window snapshot,
+  applies startup pacing/display/FOV/audio once, and later borrows complete
+  runtime targets without replay. Explicit resource ownership and frame slots
+  are the next checkpoint. The reconciled ledger and sequence live in
   `docs/architecture/code-structure.md`. This decision does not reclassify the
   remaining L.2 conformance work or Track LH.
 

docs/architecture/code-structure.md

@@ -34,6 +34,7 @@ after Slice 7 draw-frame cutover           4,666 lines / 196 fields /  70 method
 after Slice 8 checkpoint D                 4,330 lines / 192 fields /  67 methods
 after Slice 8 checkpoint E                 4,266 lines / 194 fields /  65 methods
 after Slice 8 checkpoint F                 4,057 lines / 198 fields /  54 methods
+after Slice 8 checkpoint G                 3,663 lines / 162 fields /  37 methods
 ```
 
 `GameWindow` is the single object that:
@@ -195,8 +196,9 @@ documentation, not an exhaustive allowlist):
   shared root and sibling controls.
 - `DevToolsFramePresenter -> DevToolsPanelSet -> panel/ViewModel bindings` for
   the optional developer UI.
-- `WorldRenderFrameBuilder -> RuntimeWorldFrameSettingsPreview -> SettingsVM`
-  for the live settings draft preview applied before world drawing.
+- `WorldRenderFrameBuilder -> RuntimeWorldFrameSettingsPreview ->
+  IRuntimeSettingsPreviewSource -> RuntimeSettingsController -> optional
+  SettingsVM` for the live settings draft preview applied before world drawing.
 - `LocalPlayerPortalViewport -> LocalPlayerTeleportController ->
   GameplayInputFrameController -> InputDispatcher.Fired -> GameWindow` for the
   canonical portal/input lifetime and the host's input-action subscription.
@@ -692,7 +694,7 @@ slices. `OnClosing` delegates to the existing retryable shutdown transaction.
 Silk callbacks become narrow calls into the input, update, render, resize,
 focus, and shutdown owners.
 
-Checkpoints E and F are complete. `CameraPointerInputController` owns raw pointer,
+Checkpoints E, F, and G are complete. `CameraPointerInputController` owns raw pointer,
 camera cursor/focus/scroll/sensitivity behavior; `FramebufferResizeController`
 alone publishes physical framebuffer changes. All Silk, dispatcher, retained
 UI, and optional devtools device edges are reversible, transactional, and
@@ -705,8 +707,18 @@ subscriber and preserves the accepted input-priority graph. Focused combat,
 diagnostic, and general command owners replace the remaining window command
 bodies. The retained-root item-drop edge has one reversible owner, while its
 deferred toolbar targets become inert before session retirement. `GameWindow`
-is now 4,057 raw lines / 198 fields / 54 methods. Checkpoints G–L remain
-active, with two-phase runtime settings next.
+now has no settings-store construction, duplicate settings loads, persisted
+settings mirrors, or display/quality feature bodies. `RuntimeSettingsController`
+is constructed before `Window.Create`, owns the one immutable startup snapshot
+and current/toon settings state, applies startup display/pacing/FOV/audio once,
+then borrows late-bound runtime targets without replay. Saved FOV now applies at
+startup even when devtools are disabled; this is a deliberate correction of the
+old accidental SettingsVM gate. The controller also preserves unrelated unsaved
+Gameplay draft fields when combat preferences change. `GameWindow` is now 3,663
+raw lines / 162 fields / 37 methods. Checkpoints H–L remain active, with explicit
+resource ownership and frame slots next. The Checkpoint G production App build
+is warning-free, all three corrected-diff reviews are clean, and the complete
+Release suite passes 7,553 tests / 5 intentional skips.
 
 ### 4.4 Exit criteria
 

docs/architecture/retail-divergence-register.md

@@ -107,7 +107,7 @@ accepted-divergence entries (#96, #49, #50).
 
 ---
 
-## 3. Documented approximation (AP) — 87 active rows
+## 3. Documented approximation (AP) — 88 active rows
 
 Wave-0 UI ledger repair (2026-07-10) retired stale AP-38, resolved the AP-84
 collision, restored overwritten paperdoll rows as AP-92/AP-93, and registered
@@ -217,6 +217,7 @@ AP-94..AP-112 for the confirmed retail-UI completion gaps.
 | AP-118 | An AutoWield transaction begun in active combat preserves the ready mode implied by the requested weapon. After authoritative `WieldObject`, a mode that settled without a blocker transition clears immediately; local ACE's observed pre-wield transition plus `ready -> NonCombat`, or post-wield `NonCombat -> ready -> NonCombat`, causes one normal `ChangeCombatMode` request from the trailing notice. Explicit user combat input cancels settlement. Retail's client does not need this extra request against the retail server. | `src/AcDream.App/UI/AutoWieldController.cs`; production binding in `GameWindow.cs` | Local ACE queues a trailing NonCombat callback during primary-weapon replacement and rejects an earlier request while the shuffle is busy; responding to the authoritative notice that completes that exact sequence orders the ordinary request after it without suppressing any server state | A non-ACE server that emits a different intermediate sequence can retain the settlement until a later explicit combat request, replacement, or logout clears it; peace-mode equips send none | `CPlayerSystem::AutoWield @ 0x00560A60`; `ACCWeenieObject::ServerSaysMoveItem @ 0x0058DBB0`; ACE `Player_Inventory.TryShuffleStance` / `TryDequipObjectWithNetworking` |
 | AP-119 | Equal-generation CreateObject refresh applies the packet's complete `PhysicsDesc` to the existing `EntityEffectProfile`, including replacing its network sound/PES-table/default-script description. Retail's equal-`INSTANCE_TS` branch applies the individual ObjDesc/Parent-or-Position/Movement/State/Vector/WeenieDesc tail and does not call `CPhysicsObj::set_description` again. | `src/AcDream.App/Physics/LiveEntityNetworkUpdateController.cs` (`ILiveEntitySameGenerationUpdateSink.OnDescription`); `LiveEntitySameGenerationUpdateRouter.cs` | Existing spell/projectile/portal VFX tests and connected behavior were accepted with this refresh. Slice 4 records and isolates it rather than silently changing DAT-effect ownership during an architecture extraction. | A same-generation CreateObject whose PeTable/sound/default-script fields differ from the original can replace effect lookup state where retail would retain the original table, producing a different later typed effect. | `SmartBox::HandleCreateObject @ 0x00454C80`; `CPhysicsObj::set_description @ 0x00514F40`; `docs/research/2026-07-13-retail-projectile-vfx-pseudocode.md` |
 | AP-120 | `ObjectTableWiring.ApplyEntitySpawn` publishes the CreateObject's WeenieDesc/item state before the same-generation physics update tail. Retail applies WeenieDesc after ObjDesc, Parent-or-Position/Pickup, Movement, State, and Vector. | `src/AcDream.Core.Net/ObjectTableWiring.cs` (`ApplyEntitySpawn`); `src/AcDream.App/World/LiveEntitySameGenerationUpdateRouter.cs` | Core.Net owns item-table ingestion before App callbacks and the current single-thread FIFO prevents a second network packet from interleaving; changing publication order crosses the Core.Net/App ownership boundary and requires a separately tested event transaction. | A synchronous item-table observer can see the refreshed WeenieDesc while the same object's physics/parent/state still reflects the prior snapshot; retail observers see the completed physics tail first. | `SmartBox::HandleCreateObject @ 0x00454C80`; `ACCObjectMaint::CreateObject @ 0x00558870` |
+| AP-121 | The `/framerate` command persists acdream's live ShowFps value in the modern `settings.json` Display bag after performing retail's live toggle/notice behavior. The named retail `DoFrameRate` body itself only flips `fShowFramerate` and sends `SetFramerateDisplay`; no equivalent persistence write occurs in that command body. | `src/AcDream.App/Settings/RuntimeSettingsController.cs` (`ToggleFrameRate`) | This preserves acdream's shipped L.0 cross-launch display preference while keeping the live retail mechanism and SmartBox visibility result exact; it changes no gameplay or wire state | A relaunch can retain FPS visibility where the named retail command body alone would not; a future port of retail's wider preference owner must avoid double-persisting or applying conflicting startup state | `ClientCommunicationSystem::DoFrameRate @ 0x005707D0`; `CM_UI::SendNotice_SetFramerateDisplay @ 0x0047A050`; `gmSmartBoxUI::RecvNotice_SetFramerateDisplay @ 0x004D65E0` |
 
 ## 4. Temporary stopgap (TS) — 38 active rows + TS-37 historical note (TS-20 retired 2026-07-16 — the later named-retail audit disproved the proposed DrawingBSP polygon filter; TS-37 is a retired-row historical note, not an active count; TS-39 retired R5-V3 — sticky seams bound to the ported PositionManager/StickyManager, radii threaded; TS-45 retired 2026-07-07 — hand-rolled `SphereCollision` replaced by the faithful CSphere family port, fixing the player-vs-monster crowd wedge; TS-3 retired 2026-07-07 — `frames_stationary_fall` accounting ported in the #182 verbatim UpdateObjectInternal rebuild, fixing the airborne falling-animation wedge; TS-41 retired 2026-07-07 — SERVERVEL synth-velocity remote body-drive replaced by the retail interp catch-up + unconditional MovementManager::UseTime, the remote-creature de-overlap #184; TS-42 retired 2026-07-19 — semantic animation completion now precedes the ordered Target/Movement/PartArray/Position tail; TS-44 narrowed again 2026-07-19 — complete orientation joined interpolation, only during-stick enqueue suppression remains)