# Slice J7 — graphical `GameRuntime` root cutover evidence

**Production commit:**
`ce41efb9e5938f79a7580476b949d172f52a1e69`

**Status:** automated gates complete; the physical-display visual gate is
active.

## Outcome

`GameWindow` now constructs and stores exactly one presentation-independent
`GameRuntime`. App composition records and graphical adapters borrow that
root's session, clock, identity, entity/object/physics, gameplay, movement,
environment, and transit owners. They no longer construct or reconstruct
parallel Runtime owners.

The synchronous frame contract is unchanged: input, commands, simulation, UI
projection, and rendering still execute in the existing host frame. The
cutover adds no command queue, worker hop, snapshot copy, or frame of latency.

## Ownership and teardown

- `LocalPlayerIdentityState`, `UpdateFrameClock`, and
  `WorldEnvironmentController` are graphical wrappers over root children.
- Live presentation borrows the root transit owner.
- Session composition borrows the root session.
- The superseded App view and event adapters are deleted.
- The graphical host owns one explicit root lease.
- Shutdown first stops session ingress, then retires App UI/render borrowers,
  releases the host lease, and disposes the root once.
- The terminal gate verifies that `GameRuntime.CaptureOwnership()` converges.

Construction and shutdown failure tests prove App rollback does not dispose a
borrowed root, callback re-entrancy retains the exact retryable suffix, and no
route, subscription, publication, entity, physics, gameplay, transit, session,
or host-lease debt survives terminal disposal.

## Automated gates

- Runtime: 383 passed.
- App: 3,717 passed / 3 skipped.
- Release solution build: passed.
- Complete Release suite: 8,661 passed / 5 skipped.
- Connected lifecycle/reconnect:
  `logs/connected-world-gate-20260726-190919/report.json`.
  - exact source and binary commit match;
  - six capped checkpoints in 242.324 seconds;
  - one fresh uncapped reconnect checkpoint in 61.332 seconds;
  - both processes exit gracefully with code zero;
  - all seven stable checkpoints have zero host projections, pending host
    acknowledgements, live teardowns, and landblock retirements.
- Canonical nine-stop route:
  `logs/connected-r6-soak-20260726-191605.report.json`.
  - all destinations, movement, jump, combat, revisit, portal, and graceful
    shutdown gates pass;
  - no shutdown convergence, host-lease, retry, or abandoned-work diagnostic
    appears.

Against the last J5.7 canonical baseline
`logs/connected-r6-soak-20260726-161406.report.json`, median turn
CPU/GPU/update p95 improves from 22.9/9.7/2.3 ms to 16.4/1.3/0.7 ms, and turn
allocation p50 improves from 5,812.9 to 75.1 KiB. Median stationary
CPU/GPU/update p95 improves from 21.4/7.0/1.3 ms to 15.2/1.1/0.6 ms. Peak
working set falls about 16%, from 2,326.8 to 1,953.2 MiB; peak private bytes
remain effectively flat.

The route retained only bounded diagnostics already covered by the existing
performance and DAT-VFX ledgers: a two-landblock Caul visibility variation,
one additional tracked texture (40,960 bytes), a transient 27-particle
difference, 32 known DAT-driven VFX diagnostics, and 25 expected world-edge
load misses.

## Visual gate

Captured physical-display login, facility-hub, Holtburg-after-dungeon, and
fresh reconnect frames are intact. Final acceptance remains the user's live
physical-display check of:

- radar objects and coordinates;
- inventory paperdoll;
- near and distant Use/approach;
- combat facing before bow fire;
- `/ls` and spell-recall tunnel, materialization, and exit presentation.

J7 must not be declared closed until this live gate passes.

## Retail and divergence audit

This is an ownership/composition refactor. It changes no AC algorithm, packet
ordering, input semantics, simulation cadence, or visual effect. No new retail
divergence is introduced, so the divergence register requires no new row.

## Exact rollback

```text
git revert ce41efb9e5938f79a7580476b949d172f52a1e69
```