# Slice J5.2 — canonical interaction transactions

**Date:** 2026-07-26
**Production commit:** `f5f7b4177f449ebcad9724bfea263ef73ab60255`
**Parent plan:** `docs/plans/2026-07-26-modern-runtime-slice-j5.md`

## Result

Interaction transaction authority now lives beneath the canonical Runtime
action root. `RuntimeInteractionTransactionState` owns:

- retail's strict 200-ms local use throttle;
- last ordinary or targeted-use source/target identity;
- pending and current appraisal identity;
- the typed frame-ordered Activate/Use/Pickup FIFO;
- the exact pending pickup identity, inventory-placement token, and
  post-arrival movement token;
- reset, disposal, failure, and ownership accounting.

It borrows the exact `RuntimeInventoryState.Transactions` instance. There is no
second busy counter, inventory request, object table, or pending-pickup
authority.

App remains the graphical adapter. It performs world picking, selection
lighting, approach installation, wire transport, toasts, retained drag/drop,
and pending-slot drawing. The former App `OutboundInteractionQueue` and the
use/appraisal/pickup transaction fields in App controllers are deleted.

## Retail order preserved

The implementation preserves the named-retail order recorded in
`docs/research/2026-07-26-slice-j5-owner-and-retail-order-inventory.md`:

- `ItemHolder::UseObject @ 0x00588A80` applies the strict local use gate,
  emits ordinary Use immediately after policy accepts it, and transfers one
  shared UI-busy reference to the server completion;
- `ClientUISystem::Handle_Item__UseDone @ 0x00564900` releases exactly one
  busy reference;
- targeted Use stores the source until a compatible target is acquired, then
  emits the exact source/target pair;
- pickup alone retains the existing local approach transaction and sends once
  after the exact natural completion token.

No new polling, background thread, asynchronous command seam, speculative
approach for ordinary Use, or frame of gameplay latency was introduced.

## Lifetime and failure behavior

- Queued work carries server GUID, optional exact Runtime local ID, and
  optional exact `ClientObject` identity.
- Hidden cancels every queued/deferred transaction for that server object.
- Deletion cancels only the removed local incarnation, so GUID reuse cannot
  erase or execute replacement work.
- A captured frame drains in FIFO order; re-entrant additions wait for the
  next frame.
- Re-entrant reset/disposal stops the captured suffix and cannot resurrect
  targeted-use or pickup state.
- Appraisal transport failure rolls back only the busy reference acquired by
  that exact request.
- A dispatched ordinary Use remains busy until authoritative UseDone; later
  movement cancellation, Hidden, or deletion cannot retract or duplicate its
  packet.
- Runtime action disposal precedes inventory disposal because the transaction
  child borrows the exact inventory gate.

## Automated gates

All commands ran in Release:

- `dotnet test tests/AcDream.Runtime.Tests/AcDream.Runtime.Tests.csproj`:
  197 passed.
- `dotnet test tests/AcDream.App.Tests/AcDream.App.Tests.csproj`:
  3,775 passed / 3 fixture-generator skips.
- `dotnet build AcDream.slnx -c Release --no-restore`: passed.
- `dotnet test AcDream.slnx -c Release --no-build --no-restore`:
  8,561 passed / 5 established skips.
- `git diff --check`: passed.

Focused tests cover the 199/200-ms throttle boundary, ordinary and targeted
Use, UseDone, appraisal replacement/refresh/failure, typed FIFO and re-entrant
drain, Hidden/delete cancellation, exact approach completion, transport
failure, pending-slot acceptance/failure, GUID reuse, reset/disposal, and
two-instance isolation.

## Exact-binary connected gate

Report:
`logs/connected-world-gate-20260726-111330/report.json`.

The report identifies exact source/binary commit
`f5f7b4177f449ebcad9724bfea263ef73ab60255` and passes:

- six capped login/outdoor/world-edge/dungeon/revisit checkpoints;
- one fresh uncapped-process reconnect checkpoint;
- 7/7 complete reveal/readiness checkpoints;
- zero invariant failures and zero render-scene mismatches;
- 243.534-second capped and 61.619-second reconnect sessions;
- graceful logout and code-zero exit for both processes;
- zero failures;
- one expected warning covering 25 empty world-edge landblocks.

## Divergence audit

This is an ownership-only move of accepted retail-faithful behavior. It adds
no approximation, alternate algorithm, polling mirror, or asynchronous seam.
No divergence-register row was added or retired.

## Rollback

```text
git revert f5f7b4177f449ebcad9724bfea263ef73ab60255
```

Revert J5 sub-slices in reverse order. Do not revert J4's canonical inventory
owner or Slice I's flat-collision cutover to mask a later action-owner defect.

## Next boundary

J5.3 moves combat attack and spell-cast intent into Runtime. App continues to
own the combat/spell widgets, camera tracking, animations, audio, particles,
DAT catalog/icon/formula presentation, and response text.