acdream/docs/reviews/2026-08-18-r3-test-truth-ledger.md

# R3 test-truth and cleanup ledger

Status: **complete**

Branch: `codex/release-stabilization`

Starting commit: `8e884679e0b6ce3dc1c84004ba9c5c8e3ff91d2a`

This is the cross-session authority for R3. The historical all-file audit remains
in [`test-quality-audit.md`](test-quality-audit.md); this ledger reconciles that
baseline against current source and records each cleanup decision before code is
removed. R3 does not change product behavior.

## Current executable baseline

The clean R2 gate at implementation commit `c38f6b88` built all 44 maintained
projects with zero warnings and ran every default test assembly once:

- 12 test assemblies;
- 14,742 passed;
- 77 reported skipped;
- 0 failed; and
- one redundant Core theory row discarded by xUnit discovery before the totals.

The six-case reduction from the earlier 14,748-pass headline is understood:
seven launcher editor-focus theory rows were consolidated into one fact that
still executes all seven variants in a single Avalonia application session.

## Fresh reproducible syntax inventory

`tools/audit-test-inventory.ps1` now regenerates the complete attributed-method
manifest from tracked C# test sources with Roslyn:

```powershell
pwsh ./tools/audit-test-inventory.ps1
```

The generated JSON lives under ignored `artifacts/test-audit/`; it is not a
second 6.8 MB checked-in source of truth. The script and this reviewed ledger
are durable, while paths and line numbers regenerate after every batch. The
final closeout inventory at implementation commit `14d371a0` reports:

| Syntax signal | Current count |
|---|---:|
| Tracked/parsed C# test files | 1,254 / 1,254 |
| Attributed test methods (not expanded theory cases) | 11,414 |
| Exact duplicate-data rows | 0 |
| Reviewed body-equivalent groups / methods | 11 / 27 |
| Methods containing at least one empty `return;` | 138 |
| Empty-return sites | 143 |
| Direct / same-file-helper prerequisite-return candidates | 2 / 1 |
| Mechanical output-only candidates | 2 |
| Constant-truth assertion methods / sites | 0 / 0 |
| Reviewed syntactic self-comparison methods / sites | 4 / 5 |
| Reviewed diagnostic methods | 82 |
| Methods directly using `Thread.Sleep` / `Task.Delay` | 15 / 14 |
| Cancellable-infinite-only / elapsed-time methods | 5 / 24 |
| Methods directly reading environment variables | 47 |
| Methods directly / in total reading `.cs` source text | 21 / 22 |

The three remaining prerequisite-return candidates are all reviewed branch
false positives: the two Windows/Linux factory assertions and the launcher's
cross-platform directory-link helper. Every true prerequisite return found by
the inventory now fails explicitly inside its selected non-hermetic lane. The
remaining 143 empty returns are behavioral control flow, callback exits, or
the three platform branches; they are not missing-prerequisite passes.

The output-only classifier follows same-file helper calls, so an assertion used
only while constructing a probe can prevent an otherwise diagnostic method from
appearing in its two-candidate result. The reviewed `Purpose=Diagnostic` set is
therefore the authority: Batch C's 51 methods, six artifact/report writers from
Batch L, and 25 fixture-sanity-only investigations from Batch R, for 82 methods
and 103 discovered cases (35 App, 68 Core). Their investigative output and
historical rationale remain executable outside the release total.

The five syntactic self-comparisons are reviewed, not vacuous: two call a hash
twice to assert determinism, one reads the singleton twice, and two read the
same Runtime owner's properties twice to assert stable identity. The inventory
keeps these candidates visible separately from the now-zero constant-truth
assertions.

## Exact 77-skip reconciliation

The latest clean-gate TRX files account for every reported skip:

| Classification | Count | Current source | R3 decision |
|---|---:|---|---|
| Installed retail DAT lane | 73 | `InstalledDatFactAttribute` across nine files | Retain the contracts, replace the campaign-specific shared reason with prerequisite- and suite-specific identity, and report this lane separately. Batch B assigns all nine classes to `Lane=InstalledDat`. |
| Manual fixture generation | 2 | `ChatLayoutFixtureGenerator.GenerateChatFixture`; `RadarLayoutFixtureGenerator.GenerateRadarFixture` | Delete both redundant generators: the existing comprehensive `RetailLayoutFixtureGenerator` already owns their chat and radar outputs. Assign that generator to the explicit Manual lane. |
| Empty future scaffold | 1 | `PvsConformanceTests.Pvs_CottageInterior_MatchesRetailCellDrawList` | Delete the test. Preserve its retail oracle and capture recipe here and in the existing P0 plan. |
| Known product failure | 1 | `TowerAscentReplayTests.TowerAscent_StaircaseStaysConeVisible_EveryStep` | Do not pretend this is unavailable coverage. Keep the oracle and move it to an explicitly reported known-failure/non-blocking lane until #119 is fixed. |

Installed-DAT skip distribution:

| Test class | Count |
|---|---:|
| `ChargenPreviewControllerTests` | 10 |
| `CharacterCreationLiveDatTests` | 42 |
| `CharacterManagementLiveDatTests` | 3 |
| `DatStringEscapeSweepTests` | 1 |
| `LayoutImporterMediaBearingChildSweepTests` | 3 |
| `MapHousePanelLiveDatMountTests` | 1 |
| `MapNoteLiveDatTests` | 3 |
| `TooltipLiveDatTests` | 7 |
| `UiButtonCorpusSweepTests` | 3 |

The 11 source sites that conditionally threw `SkipException.ForSkip` were not
part of the R2 77 because their prerequisites happened to be available on that
machine. Batch G preserves their reasons but replaces the misleading dynamic-
skip exception with explicit lane-prerequisite failures. No static skip or
`SkipException.ForSkip` remains in current test source.

The lane vocabulary is deliberately orthogonal:

- `Lane` states the execution environment (`InstalledDat`, `PreparedPackage`,
  `Live`, `Manual`, `Windows`, `Linux`, or `SystemFont`);
- `Purpose=Diagnostic` marks output/investigation apparatus that cannot add to
  the contract-test pass count; and
- `Status=KnownFailure` keeps a named executable oracle visible without making
  a green release claim.

The default gate excludes all three dimensions. An explicitly selected lane
must fail clearly when its prerequisite is missing; it may not pass through an
empty return. The 73 custom installed-DAT facts retain discovery-time skips
when their opt-in is absent so each unavailable contract and reason remains
identifiable in the lane report.

## Finding disposition

| Finding | Current disposition | Evidence / next action |
|---|---|---|
| T-001 launcher lock inversion | resolved in R1 | Deterministic captured-callback regression and bounded full gate. |
| T-002 physics tautology | high-confidence cleanup batch A | Compare old-model and new-model reflection decisions, as the surrounding contract states. |
| T-003 duplicate theory row | high-confidence cleanup batch A | Remove literal `0x41000012`, which is identical to `MotionCommand.Crouch`; remove the temporary analyzer suppression. |
| T-004 warning mismatches | resolved in R2 | Clean rebuild is zero-warning with repository-wide warnings-as-errors. |
| T-005 dormant panel stack | resolved in batches P and V | No shipping code implements `IPanelRenderer`/`IPanelHost` or constructs `ChatPanel`, `DebugPanel`, or `VitalsPanel`, but the architecture explicitly preserves this first-party developer-panel contract for issue #258. Batch V removes exactly 26 fake-renderer self-tests and two compiler-generated `PanelContext` record tests while retaining `FakePanelRenderer` and all 23 executable panel behavior contracts. |
| T-006 misleading installed-DAT reason | resolved in batch B | Shared opt-in is now `ACDREAM_RUN_INSTALLED_DAT_TESTS=1` (legacy switch retained), the reason names the lane, and all nine owners carry `Lane=InstalledDat`. |
| T-007 271 silent passing gates | resolved in batch G | All 280 directly found gates plus three later-reconciled sites now fail explicitly when their selected lane lacks its prerequisite. The only three syntax candidates left are reviewed cross-platform branch false positives. |
| T-008 incapable-of-failing diagnostics | resolved in batches A, C, and L | The literal wiring smoke test was deleted, the GPU contract tautology was repaired, and the six remaining constant-truth diagnostic assertions were removed after their output was preserved under `Purpose=Diagnostic`. |
| T-009 wall-clock double-click tests | resolved in batch E | Four sleeps were replaced by a deterministic test clock behind an internal factory overload. The production factory still reads `Environment.TickCount64` exactly as before. |
| T-010 two useless cases | high-confidence cleanup batch A | Delete `SmokeTest.TestProject_IsWired` and `ChaseCameraTests.ImplementsICamera`; compilation already proves both claims. |
| T-011 diagnostic-only methods | resolved in batches C, L, and R | The reviewed current set is 82 methods / 103 cases. All carry `Purpose=Diagnostic`, preserving the apparatus while removing it from release pass totals. Batch R catches investigations whose only assertion validates fixture/DAT availability, which the original mechanical output-only scan could not distinguish from an oracle. |
| T-012 source-text freezes | direct-read map completed in batch I, helper-mediated gap corrected in batch U, and staged replacement active | Seventeen whole-tree architecture rules and five cross-artifact contracts stay. Batches W/X retire the first 15 literal implementation freezes beside stronger behavior or compiled-metadata evidence; 70 staged replacements remain. |
| T-013 controller self-comparison | high-confidence cleanup batch A | Capture the first controller next to the first body and compare every retry with that reference. |
| T-014 seven load-sensitive tests | six mechanisms repaired in batch F; one product defect classified | Virtual/wall-clock mixing, tiered-JIT allocation noise, a live controller clock, and a ThreadPool-start timing oracle were removed without weakening behavioral contracts. `DatSoundCache` #321 is a real in-flight-entry race and now runs as `Status=KnownFailure` pending a product fix. |
| T-015 four non-prerequisite skips | resolved in batches A/B | PVS scaffold deleted with rationale preserved; redundant chat/radar generators deleted in favor of the comprehensive Manual lane; tower oracle is `Status=KnownFailure`. |
| T-016 historical test taxonomy | resolved in batches J, Q, R, and T | Opaque AP/R/J/K/Slice and `SCRATCH` labels have been removed from maintained regression identities while provenance stays in comments and ledgers. The user approved retaining the 47 descriptive `Issue###` files because their IDs connect executable contracts to retail evidence. |
| T-017 Avalonia ownership | batch D's window cleanup was necessary but incomplete; runner lifetime fixed in batch S | Batch R's clean gate reproduced a compositor thread-affinity cleanup failure. The sole combined Avalonia fact still used the package's default per-test application isolation. Batch S explicitly owns one application/dispatcher for the assembly's one UI fact; 25 focused processes, 25 complete Launcher assemblies, and the complete gate pass. |
| T-018 stderr observer race | resolved in R2 | Live reader shares writes/deletes; 25 focused repetitions plus the complete gate. |
| T-019 remaining explicit waits | resolved in batches M–O | All nine fixed-delay negative oracles now use observed monitor/thread/lease/process state. The remaining 24 elapsed-time methods are the reviewed cancellation, real-time protocol, cooperative-yield, bounded-polling, and positive-timeout categories from Batch H. |
| T-020 exact duplicate bodies/data | resolved in batch K | Four redundant executions were removed. The remaining 11 body-equivalent groups are intentionally split theories with disjoint, meaningfully named datasets; the inventory enforces zero repeated rows within a theory or across body-equivalent theories. |
| T-021 suspicious assertion shapes | resolved in batch L | The inventory enforces zero `Assert.True(true)` / `Assert.False(false)` sites and reports syntactic self-comparisons for review. All five current self-comparisons assert meaningful determinism or stable identity. |

## Preserved rationale for removals in batch A

### PVS scaffold

The empty PVS fact has no executable oracle and must not remain a permanent
skip. Its useful note is preserved here: retail
`PView::ConstructView(CEnvCell*)` at `0x005a57b0` produces the ordered
`cell_draw_list` for a `(viewer_cell, eye)` input. A future conformance test
requires a retail trace captured around `PView::DrawCells`/`cell_draw_list`.
The intended invariants were: the PVS root equals `physics CurrCell.Id`; a cell
seen through two portals appears once per slice; and dungeon
`outside_view == 0`. The complete original scaffold and capture plan remain in
`docs/superpowers/plans/2026-06-03-p0-conformance-apparatus.md`.

### Compile-only smoke cases

`SmokeTest.TestProject_IsWired` contains only `Assert.True(true)`.
`ChaseCameraTests.ImplementsICamera` assigns `ChaseCamera` to `ICamera` and
calls `ToString()` without an oracle. Removing them discards no runtime
contract: the test project build and the remaining camera behavior tests are
strictly stronger evidence.

## Batch protocol

Each cleanup batch must:

1. update this ledger before or with the change;
2. preserve useful historical rationale in a plan, issue, or this ledger;
3. run the directly affected test projects without retries;
4. run a clean warning-as-error build when analyzer/discovery shape changes;
5. commit one coherent classification/fix group; and
6. run the complete local Release gate before R3 closeout.

Ambiguous cases stay open in this ledger and are presented to the user rather
than being deleted by inference.

## Batch A verification

The first high-confidence batch was verified before commit:

- complete non-incremental Release rebuild: 44 projects, 0 warnings, 0 errors;
- Core: 4,795 passed / 0 skipped / 0 failed;
- App: 5,511 passed / 76 skipped / 0 failed; and
- Runtime: 1,756 passed / 0 skipped / 0 failed.

The count delta is intentional and classified: Core removed the two useless
compile-only cases and the skipped PVS scaffold; App gained one case by
splitting the old mixed/tautological depth-stencil test into two independently
named contracts. Core emitted no duplicate-case discovery warning.

## Preserved rationale for removals in batch B

The chat- and radar-only fixture generators were not the sole way to recreate
their committed JSON. `RetailLayoutFixtureGenerator` already includes retail
layout IDs `0x2100006F` and `0x21000074` and writes the same
`chat_2100006f.json` and `radar_21000074.json` destinations as part of its
complete 20-layout run. Deleting the two permanently skipped duplicates removes
two false test entries without losing the regeneration recipe or retail notes;
the comprehensive generator and `docs/release-gate.md` now own that workflow.

The tower staircase oracle is not unavailable or useless. Its former static
skip documents issue #119 and the exact failing steps. Batch B keeps the
executable assertion under `Status=KnownFailure`, separates two output-only
methods with `Purpose=Diagnostic`, and makes missing installed DATs a clear lane
prerequisite failure instead of a passing early return.

## Batch B verification

The lane-classification batch was verified without changing product code:

- App Release build: 0 warnings, 0 errors;
- hermetic App lane, isolated: 5,505 passed / 0 skipped / 0 failed;
- Installed-DAT contract lane without opt-in: 3 passed / 73 individually named
  skips / 0 failed (the local tower DAT prerequisite was available);
- known-failure discovery: exactly one tower staircase oracle; and
- Manual discovery: exactly one comprehensive fixture generator.

One concurrent three-host verification attempt reproduced T-014 rather than
being hidden: the hermetic host failed the portal-clipping zero-allocation test
at 6,904 bytes while the Installed-DAT and discovery hosts ran beside it. The
same unmodified hermetic command then passed 5,505/5,505 in isolation. This is
evidence for removing cross-host allocation sensitivity; it is not grounds to
weaken the assertion or claim a clean concurrent result.

## Batch C diagnostic classification

Batch C assigns the reviewed 51-method diagnostic set to
`Purpose=Diagnostic`. No body, output, historical comment, or fixture is
removed. This resolves the misleading release accounting without pretending
that every investigation has a stable regression oracle.

The 15 contract-shaped methods called out by T-011 now have a `Diagnostic_`
prefix: four facility-hub scenarios, six stair/camera sweeps, two ambient-slot
inventories, production-emission replication, and two drawn-polygon reports.
Their current output and historical method references are preserved, while the
new names no longer imply an asserted oracle. Promoting them back into the
hermetic lane requires an asserted expected result; R3 will not invent those
values.

Batch C verification:

- App Release build: 0 warnings, 0 errors;
- Core Release build, serialized after App: 0 warnings, 0 errors;
- hermetic App: 5,479 passed / 0 skipped / 0 failed;
- hermetic Core: 4,753 passed / 0 skipped / 0 failed; and
- diagnostic discovery: 28 App + 42 Core = 70 cases from 51 methods.

An attempted parallel App/Core build collided on the shared
`AcDream.Plugin.Abstractions` intermediate DLL. The repository gate serializes
projects, so the authoritative verification is the two isolated clean builds
above; no code or assertion was changed in response to that tooling collision.

## Batch D prerequisite lanes and Avalonia ownership

The reviewed prerequisite map classifies every true candidate without deleting
its existing guard:

| Lane | Attributed methods | Prerequisite |
|---|---:|---|
| `InstalledDat` | 336 | Installed retail DAT directory; includes the 73 custom installed-DAT facts and whole DAT-backed investigation classes. |
| `PreparedPackage` | 2 | Installed DATs plus validated `acdream.pak`. |
| `Live` | 3 | Explicit live handshake opt-in and reachable service. |
| `Manual` | 1 | Explicit fixture-regeneration opt-in. |
| `Windows` | 7 | Windows-only filesystem/process/timer behavior. |
| `Linux` | 10 | Linux permission/signal/monotonic-clock behavior. |
| `SystemFont` | 2 | A host system TTF available to the BitmapFont path. |

Class-level traits legitimately cover some additional methods that share the
same fixture owner, so the 336 installed-DAT method count is larger than the
280 syntax candidates. The only candidate methods without a lane are
`GraphicalHostPlatformServicesTests.CurrentPlatformOwnsPathsPacingAndNativeClosure`
and
`LinuxMonotonicFramePacingWaiterTests.PlatformFactorySelectsCurrentOperatingSystem`.
Both are hermetic cross-platform branch tests: on Windows or Linux they assert
the matching branch and return only after the assertion. They are not silent
prerequisite passes.

The 11 conditional `SkipException.ForSkip` source sites are also reconciled.
They serve 12 test methods: installed-DAT asset contracts, one prepared-package
contract, and two system-font contracts. xUnit v2 reports that exception shape
as a failure rather than a dynamic skip, but the owning lanes now keep them out
of the hermetic total. A later body-cleanup batch will replace the misleading
skip wording/exception with explicit prerequisite failure or discovery-time
lane behavior.

The first complete Batch D gate correctly failed in Launcher cleanup after
14,396 passes: the six `MainWindowViewTests` Avalonia facts could start and
destroy isolated thread-affine compositors on different xUnit workers. The
assertion bodies were preserved as six named private phases under one
`CompiledMarkupAndEveryModalFocusPathRunInOneOwnedAvaloniaSession` fact. The
focused two-case class then passed in 25 consecutive fresh processes (50/50
results), and the same full-gate context passed.

Batch D verification:

- complete 44-project Release build: 0 warnings, 0 errors;
- final syntax manifest: 11,450 attributed methods, 51 diagnostics, one known
  failure, 282 prerequisite-return candidates, and only the two reviewed
  cross-platform false positives unlaned;
- complete hermetic Release gate: 14,392 passed / 0 skipped / 0 failed across
  all 12 test assemblies in 131.518 seconds; and
- Launcher view stress: 25 fresh processes, 2/2 cases per process, no cleanup
  or ownership failures.

The 350-pass reduction from the clean R2 headline is exactly explained: batch A
netted minus one case; batch B removed six non-hermetic passes; batch C removed
68 newly classified diagnostic cases; batch D removed 270 prerequisite-lane
passes; and consolidating the six Avalonia sessions into one removed five case
IDs without removing any assertion phase. All 77 former default skips are also
accounted for by the PVS deletion and batch-B lane/deletion decisions.

## Batch E indirect gates and deterministic input time

The inventory now follows same-file helper calls when looking for prerequisite
returns. It found one additional path:
`LauncherSelfUpdateProcessTests.BackupJunctionOrSymlinkAfterCanonicalCrashCannotMutateOutsideOrLaunch`
calls `CreateDirectoryLink`, whose non-Windows branch creates the symbolic link
and then returns before the Windows `mklink /J` implementation. This is a
reviewed cross-platform control-flow branch, not a prerequisite gate or silent
pass. The combined direct/indirect candidate count is therefore 283: 280 true
lane-owned gates and three reviewed branch false positives.

The four `InputDispatcherDoubleClickTests` no longer sleep for 10 or 600 real
milliseconds. `InputDispatcher` has an internal, test-assembly-only factory
overload accepting the same millisecond tick delegate used by double-click
recognition. The public production factory remains wired directly to
`Environment.TickCount64`; only the tests use a manually advanced counter.
The focused class passes 4/4 in 17 ms with exact 10 ms and 600 ms virtual
intervals. The complete Release build then passed with 0 warnings/errors, and
the no-retry hermetic gate passed 14,392/14,392 with zero skips or failures.

## Batch F load-sensitive contracts

The seven cases in T-014 have now been separated into six unreliable test
mechanisms and one real product defect:

- #308 `NakEmissionTests.LossSoak...` no longer mixes its virtual transport
  clock with a 60-second `DateTime.UtcNow` cutoff and fixed sleeps. Its two
  convergence phases each permit exactly 120 half-second virtual steps and
  yield to the background receiver. The full 10,000-message oracle is intact;
  25 fresh-process repetitions pass.
- #302 and #346, the two `PortalProjectionTests` allocation contracts, now
  cross tiered-JIT/PGO thresholds before measuring and take the minimum of five
  warmed 1,000-operation batches. A linear result-array regression would
  allocate in every batch and still fail far above the existing ceilings.
- #336 `RuntimeCollisionReportingStateTests.WarmedSteadyContactRefreshDoesNotAllocate`
  now earns the word "warmed": it performs one complete 10,000-refresh warmup
  and requires at least one of five subsequent 10,000-refresh batches to
  allocate exactly zero bytes. It passes in 25 fresh processes.
- #340 `StreamingWorkBudgetTests.DestinationAndEmptyUnloadPriorityNeverBypassPublicationBudget`
  now supplies a frozen meter clock through an internal test-only constructor.
  The public production constructor still supplies `Stopwatch.GetTimestamp`
  and `Stopwatch.Frequency` exactly as before.
- #402 `LandblockBuildFactoryTests.Build_UsesTheSuppliedSharedReaderGate` now
  starts a dedicated thread and observes it in `WaitSleepJoin` on the held
  monitor before checking that no DAT read occurred. It no longer treats a
  ThreadPool start within two seconds or an arbitrary 100 ms wait as evidence.
- #321 `DatSoundCacheTests.GetWave_ConcurrentSameId_PublishesOneCanonicalWaveAndDecodesOnce`
  exposes a real race. A caller can pass the resident-cache check, pause, and
  reach `_inflight` after the winning caller has admitted the wave and removed
  its `Lazy`, producing a second decode. The assertion and rationale are
  preserved under `Status=KnownFailure`; R3 makes no cache behavior change.

The four changed App cases pass 100/100 across 25 fresh processes. The Runtime
allocation case passes 25/25, and the Core.Net loss soak passes 25/25. Complete
batch verification then passed: the 44-project Release build reports zero
warnings/errors, the refreshed inventory reports two explicit known-failure
methods and 15 remaining direct `Thread.Sleep` methods, and the no-retry
hermetic gate passed 14,391/14,391 with zero skips or failures. The one-pass
reduction is exactly #321 leaving the release lane.

## Batch G honest prerequisite lanes

Batch G removes every true silent prerequisite pass found by the direct and
same-file-helper inventory. Across 101 test files, 283 lane-owned `return;`
sites now report a prerequisite failure when that lane was explicitly
selected: 261 installed-DAT, ten Linux, seven Windows, three Live, and two
prepared-package methods. Seventeen platform guards throw
`PlatformNotSupportedException`; the remaining gates use lane-specific
assertion failures. Production behavior and every contract assertion after the
guard are unchanged.

The eleven conditional `SkipException.ForSkip` sites now use explicit
prerequisite failures as well. Their asset, package, or font reason is retained,
but a selected lane can no longer look green by dynamically skipping the
contract. The refreshed syntax inventory finds zero true silent-prerequisite
candidates. Its three remaining candidates are the reviewed Windows/Linux
branch returns recorded in Batch E.

The focused installed-DAT run also exposed a taxonomy error rather than a
product failure: 19 interactive layout methods need a retail DAT directory but
are operator-driven probes, not automated DAT contracts. They now live under
`Lane=Manual`, divided into `ManualTask=LiveMountProbe` (13) and
`ManualTask=PowerbarProbe` (6). The comprehensive existing generator is
separately named `ManualTask=FixtureGeneration`, so selecting a probe cannot
rewrite committed fixtures. Current attributed-method lane ownership is:

| Lane | Methods |
|---|---:|
| `InstalledDat` | 317 |
| `PreparedPackage` | 2 |
| `Live` | 3 |
| `Manual` | 20 |
| `Windows` | 7 |
| `Linux` | 10 |
| `SystemFont` | 2 |

Focused verification before the complete gate:

- Release build of all 44 maintained projects: 0 warnings, 0 errors;
- installed-DAT contracts: 311/311 passed (App 150, Bake 3, Content 28,
  Core 130);
- prepared-package contracts: 2/2 passed against the validated local package;
- Windows contracts: 7/7 passed; system-font contracts: 2/2 passed;
- manual live-mount probes: 13/13 passed; manual powerbar probes: 6/6 passed;
- a Linux contract selected on Windows failed with the explicit wrong-host
  reason; and
- a Live contract selected without opt-in failed with the explicit
  `ACDREAM_LIVE=1`/reachable-server prerequisite reason.

The fixture-generation task was intentionally not executed: its documented
purpose is to rewrite fixture files, while this R3 batch is review/test-only.
The no-retry complete hermetic Release gate passed 14,391/14,391 with zero
skips or failures across all 12 test assemblies.

## Batch H explicit-wait classification

The syntax inventory now records every direct `Thread.Sleep` and `Task.Delay`
invocation instead of treating both method-level booleans as equivalent. The
38 attributed methods divide into six materially different groups:

| Wait purpose | Methods | R3 disposition |
|---|---:|---|
| Cancellable infinite suspension in a fake | 5 | Keep. `Task.Delay(Timeout.InfiniteTimeSpan, token)` advances only through the cancellation being tested and consumes no elapsed-time oracle. |
| Intentional real-time protocol/timeout contract | 4 | Keep with explicit bounds: two Live handshake race delays, the one-second net-probe cadence, and continuous unrelated shutdown drain. |
| Cooperative yield while virtual-clock/background transport work drains | 8 | Retain for now; prefer an observable receiver/worker signal when that seam exists. The virtual behavioral oracle does not derive from the sleep duration. |
| Bounded completion/readiness polling | 11 | Retain as integration polling with a terminal assertion and deadline; improve opportunistically with events, not by busy-spinning. |
| Fixed delay used to prove another operation is still blocked | 9 originally; 0 remain | Batches M–O replace all nine with observed monitor/thread/lease/process state. |
| Positive completion timeout guard | 1 | Keep. The two-second `WhenAny` in `RuntimeCharacterStateTests` fails only if the operation does not complete; it does not delay a passing run. |

The original nine fixed-delay negative oracles are:

1. `LiveSessionCommandRouterTests.ConcurrentDispose_WaitsForInFlightTransportThenMakesRouterInert`;
2. `HostQuiescenceGateTests.ExternalStopWaitsForAdmittedCallbackToReturn`;
3. both `SilkWindowCallbackBindingTests.ConcurrentDispose...` contracts;
4. `LandblockStreamerPoolTests.Dispose_JoinsEveryWorkerInThePool`;
5. `LandblockStreamerTests.DisposeAndConcurrentDisposeWaitForInFlightLoad`;
6. `HeadlessPluginSessionTests.LateSubscriberReplayQueuesConcurrentRegistrationExactlyOnceInOrder`;
7. `LauncherInstallerTests.IndependentInstallersSerializeAndWaitingCancellationTouchesNothing`; and
8. `LauncherInstallerTests.OrphanBakeCanNeverPublishAfterRestartRecovery`.

This classification is review evidence, not a claim that the remaining waits
are flaky. The inventory run at `6faeb4a1` parsed all 1,256 tracked C# test
files and reproduced 15 sleep methods, 23 delay methods, five cancellation-
only methods, and 33 methods with some elapsed-time wait.

## Batch I source-text replacement map

Batch I's first inventory found 63 attributed methods that directly read `.cs`
source text. Batch U later proved that count was incomplete: tests that called
a local `BuilderSource()`, `ReadSource(...)`, or method-group
`File.ReadAllText` helper were invisible to the direct body regex. The
corrected syntax inventory follows same-file helper calls, recognizes invoked
and method-group readers, and only treats actual string content—not comments
such as `GameWindow.cs:5893`—as a C# path signal. It finds 67 direct and 40
helper-mediated methods, 107 total.

Manual reconciliation assigns every candidate to one of three dispositions:

| Disposition | Methods | Owning test files |
|---|---:|---|
| Implementation-shape or test-model freeze; replace in stages | 85 | Thirty files across composition, input/physics/network wiring, graphical host/render ownership, Runtime gameplay-owner wiring, streaming, and frame orchestration; the exact stage manifest follows below. |
| Whole-tree architecture policy; retain, then make syntax/metadata-aware | 17 | `LinuxPlatformBoundaryTests`, `RenderSceneArchitectureTests`, `RuntimePhysicsOwnershipTests`, `RuntimeEntityOwnershipTests`, plus the whole-tree methods in `RuntimeActionOwnershipTests` and `RuntimeMovementOwnershipTests`, `RuntimeWorldTransitOwnershipTests`, and `RuntimeDatAccessArchitectureTests` |
| Source/project/artifact text is the actual cross-artifact contract; retain | 5 | `ParticleBindlessInstanceTests`, `PerformanceToolsTests`, `LauncherProjectBoundaryTests` |

The 85 implementation/test-model facts were useful during mechanical ownership
cutovers and defect investigations, but are not durable behavioral evidence.
They pin constructor spellings, local names, exact call fragments, regex-shaped
method bodies, or statement order; comments can satisfy many of their
`Contains` checks, while a harmless equivalent refactor can fail them. Their
intent is often valuable—single ownership, ordering, handoff, teardown,
absence of a parallel path, or continued validity of a synthetic test model—so
wholesale deletion would discard real notes and weaken some boundaries.

R3 therefore uses this replacement rule for those 85 facts:

1. preserve the ownership/order rationale in the architecture document or this
   ledger;
2. identify an existing behavioral, lifetime-ledger, project-reference, or
   reflection/Roslyn guard that proves the same claim;
3. add the semantic replacement first when none exists; and
4. remove the literal source freeze in the same small batch.

The 17 whole-tree rules remain valuable even before conversion: they ban
platform calls outside owners, enforce assembly/namespace containment, and
prevent duplicate Runtime entity, physics, movement, action, transit, and DAT
authorities. The five cross-artifact tests compare two independently consumed
artifacts (for example CPU/shader constants, launcher
project/workflow/markup, and CLI route tooling); reading text is appropriate
there.

No source-freeze fact is removed in this classification batch. The 85 staged
facts are an ambiguous architecture decision and will be presented for user
approval in behavior-owner groups rather than deleted from a numeric heuristic.

### Source-freeze approval groups

The 46 campaign-era facts are not equivalent. Their current semantic coverage
and safest replacement path divide into six owner groups:

| Owner group | Facts | What the literal checks still prove | R3 recommendation |
|---|---:|---|---|
| Composition-root wiring | 13 | `GameWindow` calls the intended phase objects and no longer contains the extracted construction bodies. Phase-local tests cover ordering and rollback inside each phase, but not every root-to-phase link. | Keep until one symbol-aware composition-graph guard proves the root links. Then remove the literal constructor/local-name checks. |
| Runtime root, graphical host, and lifetime | 24 | One canonical Runtime root/command surface, typed owner handoffs, run/render/status ordering, acquisition order, and native-window-last shutdown. Existing Runtime/lifecycle tests prove much of the behavior, but several sole-owner and transfer claims remain unique. | Replace with direct ownership receipts, terminal-ledger assertions, observable host traces, and metadata dependency guards before removing any source freeze. |
| Render delegation and cleanup | 9 | Rendering is delegated and `GameWindow` does not regain leaf draw branches or resource ownership; several tests also pin exact renderer/preparation statement order. The owning render suites already exercise the executor, frame builder, renderer, and resource disposal behavior. | Best first conversion: add a symbol-aware boundary guard for absence/delegation and observable fake traces for order, then remove the literal checks. |
| Streaming publication | 4 | The window does not own render/physics publication bodies, captured build origins flow through the extracted owners, and streamer teardown follows session reset. Publisher/build/origin suites already provide broad behavioral coverage. | Best second conversion: consolidate the absence claims into a whole-tree architecture guard and retain the behavioral origin/teardown contracts. |
| Live-entity composition | 2 | Typed sources replace window closures and reset closes every streaming/readiness owner. Lifecycle tests cover convergence, but the exact constructor-shape claim is still literal. | Replace with constructor/field metadata inspection plus the existing teardown ledger; do not delete alone. |
| Frame orchestration and resource preparation | 14 | Exact-once publication, frame/resource-stage order, adapter ownership, and a deliberately thin `OnUpdate`. These are high-value order rules, but exact statement fragments are the most brittle implementation specification in the set. | Replace order assertions with observable fake event traces and use a symbol-aware dependency guard for the thin-root rule. This is the largest conversion and should be last. |
| Input, physics, and network wiring | 9 | Typed owner entry points, retry/reset wiring, and local/remote branch ordering remain at exact source locations. Behavioral controller suites cover the operations, but not every production composition route. | Add symbol-aware call-graph boundaries and route the behavioral fixtures through the production entry seam before removing the text checks. |
| Runtime gameplay-owner wiring | 9 | UI/session/shutdown consumers borrow exact action, character, inventory, and movement owners without mirrors or second mutations. Runtime ledgers cover terminal ownership but several App consumer links are literal only. | Replace consumer links with metadata dependency checks and exact borrowed-instance integration assertions. |
| Test-model/source correspondence | 1 | The hand-called create-authority drift probe still models the executor's sole production advance site. | Expose an observable executor stage/receipt or re-derive the synthetic model before removing this explicit stale-model alarm. |

Approval should authorize this replacement sequence, not wholesale deletion:
render delegation, streaming, live entities, input/physics/network wiring,
composition roots, Runtime gameplay owners, Runtime/graphical-host lifetime,
frame orchestration, then the one test-model/source pin. If the semantic
replacement exposes a claim that exists only as historical campaign wording,
preserve the rationale and bring that individual deletion back for review.

The exact staged file manifest is:

| Stage | Facts | Complete owning-file set |
|---|---:|---|
| Render delegation and cleanup | 9 | `ResourceCleanupGroupTests`, `RetailPViewPassExecutorTests`, `WorldRenderFrameBuilderTests`, `WorldSceneRendererTests` |
| Streaming publication | 4 | `LandblockBuildOriginTests`, `LandblockPhysicsPublisherTests`, `LandblockRenderPublisherTests` |
| Live-entity composition | 2 | `GameWindowLiveEntityCompositionTests` |
| Composition-root wiring | 13 | `ContentEffectsAudioCompositionTests`, `FrameRootCompositionTests`, `HostInputCameraCompositionTests`, `InteractionRetainedUiCompositionTests`, `LivePresentationCompositionTests`, `SessionPlayerCompositionTests`, `WorldRenderCompositionTests` |
| Runtime root, graphical host, and lifetime | 24 | `GameWindowLiveSessionOwnershipTests`, `GameWindowCrashStatusTests`, `GameWindowRenderLeafCompositionTests`, `GameWindowHostBoundaryTests` |
| Frame orchestration and resource preparation | 14 | `UpdateFrameOrchestratorTests`, `RenderFrameResourceControllerTests` |
| Input, physics, and network wiring | 9 | `C3cF2AutoEntryWiringTests`, `C3cF1ProductionWiringTests`, `Issue270ProductionWiringTests`, `LiveEntityNetworkBranchRoutingTests` |
| Runtime gameplay-owner wiring | 9 | The non-whole-tree methods in `RuntimeActionOwnershipTests` and `RuntimeMovementOwnershipTests`, plus `RuntimeCharacterOwnershipTests` and `RuntimeInventoryOwnershipTests` |
| Test-model/source correspondence | 1 | `CreateAuthorityDriftModelSourcePinTests` |

This manifest accounts for all 85 methods exactly. It excludes the 17
whole-tree policy methods and five genuine cross-artifact text contracts.

## Batch P dormant panel reachability reconciliation

T-005's production-reachability half is now proved: repository-wide C# usage
contains no production `IPanelRenderer` or `IPanelHost` implementation and no
shipping construction of `ChatPanel`, `DebugPanel`, or `VitalsPanel`. The old
ImGui backend is gone; retained `UiHost`/`UiRoot` controllers are the sole
shipping presentation stack, and plugin UI uses
`IUiRegistry.AddMarkupPanel` rather than `IPanel`.

That does **not** make the complete abstraction useless. The architecture
document explicitly says `AcDream.UI.Abstractions` and the
`IPanel`/`IPanelRenderer` developer-panel contract survive intact for a future
host tracked by issue #258. `ChatVM` and `VitalsVM` are also live shared models
consumed by retained UI, so their model/parser/command tests are production
coverage and are outside T-005.

The dormant presentation-only subset currently contains 51 attributed methods
(57 expanded cases):

| Subset | Methods | Disposition |
|---|---:|---|
| `IPanelRendererWidgetTests` and `IPanelRendererMainMenuBarTests` | 26 | They exercise only `FakePanelRenderer`, not a production backend. Approved for removal in Batch V. |
| `PanelContextTests` | 2 | Only compiler-generated record round-trip/equality. Approved for removal in Batch V. |
| `ChatPanel` layout, input, focus, and colored-render behavior | 23 | Meaningful executable behavior for the explicitly preserved future developer-panel contract. Retain unless that architecture promise is intentionally retired. |

The earlier audit's recommendation to remove the whole stack was therefore too
broad. The maintainability problem is narrower: 28 harness/trivial contract
methods inflate release totals despite having no production renderer, while 23
panel behavior methods protect a deliberately dormant API. The UI framework
plan also has stale present-tense statements that ImGui remains permanent,
whereas the architecture authority correctly records its deletion; that is a
documentation-reconciliation item, not evidence that the old backend still
exists.

The proposed removal boundary is exact: all 17 methods in
`IPanelRendererWidgetTests.cs`, all nine in
`IPanelRendererMainMenuBarTests.cs`, and both in `PanelContextTests.cs`.
`FakePanelRenderer.cs` remains because the 23 retained `ChatPanel` behavior
methods use it as an observation seam. No production abstraction, panel,
ViewModel, parser, command test, or future-host rationale is in the removal
set. With no replacement cases, this decision alone would reduce the current
hermetic Release total from 14,379 to 14,351.

## Batch J descriptive test identities

The first T-016 naming batch changes no oracle or production behavior. It
renames eight opaque type/file identities and fifteen test methods whose AP,
R, J, K, C3c, or Slice labels described the implementation campaign rather
than the contract a maintainer needs to find:

| Former identity family | Durable identity |
|---|---|
| `GameWindowSlice8BoundaryTests` | `GameWindowHostBoundaryTests` |
| `Ap10WaterSemanticsTests`, `Ap71EntryRestrictionGateTests`, `Ap155StaticSpherePopulationMeasurementTests`, `Ap157SortingSphereFloodMeasurementTests` | `WaterSemanticsTests`, `EntryRestrictionGateTests`, `StaticSpherePopulationMeasurementTests`, `SortingSphereFloodMeasurementTests` |
| `ConnectedR6SoakContractTests` | `ConnectedWorldSoakRouteContractTests` |
| `C3cR1F3DriftModelSourcePinTests` | `CreateAuthorityDriftModelSourcePinTests` |
| `R5Host` / `R5ManagerHarness.cs` | `PhysicsObjHostStub` / `PhysicsManagerHarness.cs` |
| J4/J5 Runtime methods | gameplay-view, gameplay-command, checkpoint, simulation, and ownership-ledger names |
| K4/Slice-L/K1c/J9 methods | multi-session profile, unsupported-platform explanation, legacy keymap difference, and stop-speed behavior names |
| AP-135/AP-195 method names | placement-bookkeeping and authored-LED-sprite names |

Provenance is not discarded. AP-157 remains the row key in the retail
divergence register, the connected route keeps its established artifact name,
and historical audit/plan documents retain the old identifiers. Current
cross-references and test comments point to the new descriptive names. The
source-freeze class summary now states its R3 replacement status instead of
claiming to be a temporary Slice 8 checkpoint.

This batch intentionally does not rename the 47 `Issue###` files. Their
descriptive suffixes are often useful, and the issue number can be the shortest
path to a retail trace or reproduction. Re-homing those contracts by component
while retaining `Issue` provenance is an architecture/taxonomy choice for user
approval, not a mechanical cleanup.

Verification before the complete gate:

- all 44 maintained projects build in Release with 0 warnings and 0 errors;
- 102 focused App cases, 203 Core cases, 17 Runtime cases, 5 Headless cases,
  1 Launcher.Core case, and 10 UI.Abstractions cases pass; and
- the renamed installed-DAT population measurement passes 1/1 against the
  local retail DAT.

The no-retry complete hermetic Release gate passed 14,391/14,391 with zero
skips or failures across all 12 test assemblies.

## Batch K duplicate-body and theory-row truth

The inventory now fingerprints every attributed method body and compares
`InlineData` case-sensitively both within a theory and across theories with an
identical body. Case sensitivity prevents legitimate inputs such as `iris` /
`IRIS`, `Sunny` / `SUNNY`, and `0x` / `0X` from being mislabeled as duplicates.

The initial 14 body-equivalent groups contained four redundant executions:

- `VulkanCapabilityReportContractTests.TheReportFileNameIsTheOneTheWorkflowPathNames`
  duplicated the report-name assertion in `VulkanCapabilityGateTests` and did
  not inspect the workflow it named. The retained fact is now
  `TheReportFileNameRemainsStableForDiagnosticsAutomation`.
- `MotionInterpreterDoMotionFamilyTests.StopCompletely_NullPhysicsObj_Returns8`
  was byte-equivalent to the more descriptive
  `MotionInterpreterTests.StopCompletely_NullPhysicsObj_ReturnsNoPhysicsObject`.
- `CastSpellTests.ParseMagicUpdateSpell_RoundTrip` duplicated the same parser
  contract under `GameEventDispatcherTests`, the parser's durable owner.
- retail motion row `(0x0150, 0x10000150u)` appeared in both the recall-command
  theory and the generic anchor theory. It remains in the specifically named
  recall contract.

The other 11 groups are not useless duplicates. They deliberately reuse a
small assertion body while separating disjoint datasets by meaning: command
resolution, command argument shapes, valid chat tags, retail string escapes,
weenie error-message evidence, help text, invalid chargen ranges, ACE/retail
motion tables, character-option oracle sources, and environment-sound gaps.
Combining those rows would erase useful failure names without reducing the
assertion mechanism.

After cleanup the inventory reports 11,447 attributed methods, zero duplicate
rows, and 11 reviewed body-equivalent groups containing 27 methods. Verification
for the changed owners passes 46 App, 154 Core, and 32 Core.Net cases. The
complete 44-project Release build reports zero warnings and zero errors. The
no-retry complete hermetic Release gate passed 14,387/14,387 with zero skips or
failures across all 12 test assemblies. The four-case reduction is exactly the
three duplicate facts and one duplicate theory row removed above.

## Batch L vacuous diagnostic assertions

Six investigation methods still ended in an unconditional green assertion:

- three cellar-lip trajectory/replay artifact writers in
  `CellarLipWedgeTests`;
- two cellar-ascent trajectory reports in `CellarUpTrajectoryReplayTests`; and
- the installed-DAT front-approach probe in `DoorCollisionApparatusTests`.

These were useful tools but not regression tests. Batch L adds
`Purpose=Diagnostic`, removes the six `Assert.True(true, ...)` calls, preserves
the two reports that previously existed only as assertion messages by writing
them to captured console output, and leaves the existing `%TEMP%` artifacts and
probe logs intact. No historical investigation notes, fixtures, or probe logic
were deleted.

The durable inventory now recognizes `File.WriteAll*` / `File.AppendAll*` as
diagnostic-output signals and reports high-confidence constant-truth assertions
separately from syntactic self-comparisons. It reports zero constant-truth sites.
The five self-comparison sites were individually reviewed and retained:

- `Hash32Tests.Calculate_IsDeterministic` and
  `PacketHeaderTests.CalculateHeaderHash32_DeterministicForSameInput` execute
  the calculation twice and compare the results;
- `NullCommandBusTests.Instance_IsSingleton` reads the singleton twice; and
- `RuntimeEntityObjectLifetimeTests.Owner_ConstructsOneExactDirectoryAndObjectTablePerInstance`
  verifies repeated access to both owned objects returns the same instances.

Batch L verification:

- all six affected diagnostic methods pass, including the installed-DAT door
  probe;
- the refreshed inventory reports 11,447 attributed methods, 57 diagnostic
  methods, zero constant-truth assertions, and five reviewed self-comparison
  sites across four methods;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate passed 14,382/14,382 with zero
  skips or failures across all 12 test assemblies.

The five-case reduction from Batch K is exact: five formerly hermetic diagnostic
facts are now excluded by `Purpose=Diagnostic`; the sixth was already outside
the portable lane because its class requires installed DATs.

## Batch M observable monitor-wait contracts

Four concurrency tests used a 50–100 ms delay and then asserted that disposal
had not completed. That was only indirect evidence: a delayed or saturated
ThreadPool could satisfy the assertion before the disposal path had attempted
to enter its production monitor.

Batch M runs each competing disposal/stop operation on a named dedicated
thread, waits with a bounded `SpinWait` until the runtime reports
`ThreadState.WaitSleepJoin`, and then verifies the thread joins after the
controlled callback, transport send, or physical detach is released. This
changes no production code and preserves every existing completion, inertness,
and propagated-failure assertion. The converted contracts are:

- `HostQuiescenceGateTests.ExternalStopWaitsForAdmittedCallbackToReturn`;
- `LiveSessionCommandRouterTests.ConcurrentDispose_WaitsForInFlightTransportThenMakesRouterInert`;
- `SilkWindowCallbackBindingTests.ConcurrentDisposeWaitsForPhysicalDetachToComplete`;
  and
- `SilkWindowCallbackBindingTests.ConcurrentDisposeCannotHidePhysicalDetachFailure`.

Batch M verification:

- the four focused contracts pass;
- 25 fresh-process focused iterations pass, for 100/100 observed-wait cases;
- the refreshed inventory reduces direct `Task.Delay` methods from 23 to 19
  and elapsed-time methods from 33 to 29;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate remains 14,382/14,382 with zero
  skips or failures across all 12 test assemblies.

Five fixed-delay negative oracles remain: the landblock streamer and pool
disposal contracts, headless concurrent late-subscriber replay, and the two
launcher installer/recovery contracts.

## Batch N observable landblock-worker joins

The two landblock disposal contracts used 50–100 ms delays to infer that
`LandblockStreamer.Dispose` was waiting for its dedicated worker threads.
Batch N replaces those delays with direct observation of the disposer threads:

- `LandblockStreamerTests.DisposeAndConcurrentDisposeWaitForInFlightLoad`
  observes the primary disposer blocked in a worker `Join`, then observes the
  concurrent disposer blocked behind the disposal monitor; and
- `LandblockStreamerPoolTests.Dispose_JoinsEveryWorkerInThePool` observes the
  disposer blocked while all three controlled worker lanes remain in their
  loader callbacks.

Both tests then release the loaders, require every disposal thread to join
within the existing bound, and retain their exception and post-disposal
inertness checks. Production code is unchanged.

Batch N verification:

- both focused contracts pass;
- 25 fresh-process iterations of each pass, for 50/50 observed-wait cases;
- the refreshed inventory reduces direct `Task.Delay` methods from 19 to 17
  and elapsed-time methods from 29 to 27;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate remains 14,382/14,382 with zero
  skips or failures across all 12 test assemblies.

Three fixed-delay negative oracles remain: headless concurrent late-subscriber
replay and the two launcher installer/recovery contracts.

## Batch O final fixed-delay negative oracles

Batch O removes the last three timing-based absence-of-completion tests:

- `HeadlessPluginSessionTests.LateSubscriberReplayQueuesConcurrentRegistrationExactlyOnceInOrder`
  now runs registration on a dedicated thread and observes it enter
  `WaitSleepJoin` while Runtime's exact replay read lease is held;
- `LauncherInstallerTests.IndependentInstallersSerializeAndWaitingCancellationTouchesNothing`
  now waits until the second installer has actually encountered the held
  transaction lease before cancelling it; and
- both rows of
  `LauncherInstallerTests.OrphanBakeCanNeverPublishAfterRestartRecovery` now
  observe publication-lock contention where applicable and wait for the exact
  orphan child process to exit before checking that it cannot publish later.

The launcher observation points are internal callbacks on the existing
transaction/publication lease retry paths. They are unset in production, add no
new public API, and do not change lock, retry, cancellation, or publication
behavior. The former 150/200 ms delays and post-exit settle delay are gone.

Batch O verification:

- the one focused Headless fact and three focused Launcher cases pass;
- 25 fresh-process Headless iterations and 25 fresh-process Launcher iterations
  pass, totaling 100/100 exercised cases;
- the refreshed inventory reduces direct `Task.Delay` methods from 17 to 14
  and elapsed-time methods from 27 to 24;
- none of Batch H's nine fixed-delay negative-oracle methods contains a direct
  sleep or delay;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate remains 14,382/14,382 with zero
  skips or failures across all 12 test assemblies.

The 24 remaining elapsed-time methods retain their reviewed Batch H
classification: cancellation fakes, intentional real-time protocol behavior,
cooperative yields, bounded integration polling, or a positive timeout guard.

## Batch Q issue-number taxonomy review

The 47 `Issue###` files contain 155 attributed methods. They are not a hidden
duplicate or source-freeze family: none reads production source text and none
contains a direct timing wait. Forty-six methods are explicitly classified
`Purpose=Diagnostic`; the other 109 are executable regression contracts.
Ninety-four methods belong to the installed-DAT lane, overlapping both groups
where retail assets are the evidence prerequisite.

The issue prefix still has concrete navigation value. Every number maps to a
named section in `docs/ISSUES.md`, and the descriptive suffix already exposes
the owning behavior—for example `Issue334BspBoxCellMembershipTests` and
`Issue345SteepSlopeGlideTests`. A 47-file mass rename would discard that direct
evidence key, create large history churn, and would not make the individual
contracts materially easier to understand.

R3's recommendation is therefore to retain the current `Issue###` class/file
prefixes. Continue correcting individual method names whose oracle overclaims,
and keep diagnostic methods outside the release count, but do not re-home 109
useful regressions merely to erase their provenance. If the issue archive is
later split into component-owned records, a class-level `Issue` trait can
preserve filtering before any component-based file rename. The user approved
this recommendation before Batch V, closing T-016 without code churn.

## Batch R fixture-sanity-only diagnostics

The original output-only scan intentionally treated any assertion as a failure
signal. A final name/comment review found 25 more investigation methods whose
only assertions establish that the DAT, fixture, setup, or synthetic replay
loaded; none compares the report, sweep, or characterization named by the
method. Their own names or comments say `Diagnostic`, `Dump`, `Measure`,
`Characterize`, “always passes,” or “not a regression.”

The 25 methods (27 expanded cases) divide into:

- seven visibility/flood measurement reports across corner flood, house exit,
  issue #181, and issue #95;
- ten raw building/geometry dumps across issues #113, #119, #147, and #337;
  and
- eight physics transition traces across issue #112, cellar ascent, door
  collision, issue #108, and issue #265.

Batch R adds only `Purpose=Diagnostic`. It does not remove a body, fixture,
assertion, output line, retail/ACE citation, or historical comment. The
diagnostic inventory is now 82 methods / 103 cases: 35 App and 68 Core. The
explicit non-Manual diagnostic filters pass 27/27 App and 68/68 Core; the other
eight App cases remain in their separately selected Manual tasks.

The same pass corrected two inverse naming errors without changing their
oracles:

- `SCRATCH_BuyShapedFreshGuidCreateObjectThenContainId_FinalOrder` is a durable
  vendor-order regression and is now
  `BuyShapedFreshGuidCreateThenPlacementZeroEcho_InsertsAtRetailListHead`; and
- `Diagnostic_ExitDoorTopEdge_GateVsAperture` already enforces hard pixel
  bounds and is now
  `ExitDoorTopEdge_GateCoversLiftedApertureWithinPixelTolerance`.

Both focused regressions pass. Their detailed queue-order and doorway/scissor
rationale remains beside the tests. The only remaining unclassified method
names beginning `Reflect_` or `Dump` are real asserted collision/reflection or
environment-default contracts, not output apparatus.

Only three of Batch R's 27 newly classified cases had still been hermetic;
the other 24 already belonged to the installed-DAT lane. After Batch S's
ownership correction, the no-retry complete hermetic Release gate therefore
passes 14,379/14,379 with zero skips or failures, exactly three below Batch O.

## Batch S Avalonia application-session ownership

The first clean complete gate after Batch R did not pass: every non-Launcher
assembly passed, but `MainWindowViewTests` failed during Avalonia test cleanup
with `DefaultRenderLoop.Add` calling `Dispatcher.VerifyAccess` from a thread
that did not own the compositor. The gate reported 14,378 passes and one
failure. This was recorded and fixed rather than retried unchanged.

Batch D had closed and pumped every shown window and consolidated the six UI
assertion phases into one `[AvaloniaFact]`. That removed leaked-window overlap,
but it did not change Avalonia 12.1.1's default
`AvaloniaTestIsolationLevel.PerTest`: the runner still recreated and disposed
the application, dispatcher, and compositor around that one fact. The failure
occurred in that isolated application setup/cleanup path, before any product
assertion could explain it.

`AcDream.Launcher.Tests` contains exactly one Avalonia fact, and that fact owns
the complete real-window matrix. Batch S declares
`AvaloniaTestIsolationLevel.PerAssembly`, so the runner creates one
application/dispatcher on its dedicated session thread and lets the fresh test
process own its terminal cleanup. All individual windows still close and pump
their dispatcher in `finally`; no suite serialization, retry, product code, or
assertion was changed.

Verification:

- the focused Avalonia fact passes in 25/25 fresh processes;
- the complete 56-case Launcher assembly passes in 25/25 fresh processes;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate passes 14,379/14,379 with zero
  skips or failures across all 12 test assemblies.

## Batch T final campaign-label naming cleanup

A final class/method-name sweep found one campaign-labelled class and two
isolated slice-labelled methods whose names hid otherwise durable behavior.
Batch T makes naming-only changes:

- `OP2ReworkBlastRadiusConformanceTests` becomes
  `DormantDatWidgetConformanceTests`. Its eight contracts protect dormant
  Type-5/Type-8 DAT widget behavior, not the OP2 work sequence that discovered
  the blast radius. Research records retain the OP2 history and now point to
  the descriptive class name;
- `G2_VendorStackSelection_ThroughRealMaterializer_ShowsSplitSlider` becomes
  `VendorStackSelection_ThroughRealMaterializer_ShowsSplitSlider`; and
- `C4_VendorOwnedSplitExemptStackSelection_MatchesRetailsToolbarPresentation`
  becomes
  `VendorOwnedSplitExemptStackSelection_MatchesRetailsToolbarPresentation`.

The detailed G2/C4/AP-169 evidence comments remain beside the two selection
tests. No assertion, fixture, product code, or historical research statement
was removed. The broader short-label sweep also found complete scenario
matrices such as A1-A6/B1-B3/C1-C3/D1-D4; those labels remain because they
identify deliberate rows within a documented matrix rather than a stale
campaign identity.

Verification:

- the focused Batch T filter passes all 10 renamed contracts with zero skips
  or failures;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate passes 14,379/14,379 with zero
  skips or failures across all 12 test assemblies.

## Batch U helper-mediated source-text audit correction

Preparing the first semantic replacement exposed a material inventory gap:
`RetailPViewPassExecutorTests` and `WorldRenderFrameBuilderTests` contain tests
that read production source through local helpers, but Batch I's direct body
regex counted only the one method in each file that called
`File.ReadAllText(...)` itself. Parameterized helpers such as
`ReadSource("GameWindow.cs")` and method-group reads such as
`.Select(File.ReadAllText)` exposed two more missed forms.

Batch U corrects the audit tool, not any test or product behavior. It now:

- detects invoked and method-group `ReadAllText`/`ReadAllLines` syntax;
- follows the same-file helper graph already used for failure and prerequisite
  signals;
- follows the `.cs` path signal separately, allowing the caller to supply the
  filename while a helper performs the read; and
- derives the path signal only from string/interpolated-string content, so a
  comment such as `GameWindow.cs:5893` cannot classify an ordinary JSON-lines
  test as a source reader.

The corrected inventory reports 67 direct and 40 helper-mediated source-text
tests, 107 total. Manual method-by-method reconciliation assigns 85 to staged
semantic replacement, 17 to retained whole-tree architecture policy, and five
to retained cross-artifact contracts. The focused inventory assertions prove a
helper-mediated builder test is included, a method-group whole-tree test is
included directly, and the prior comment/path false positive is excluded.

Verification:

- all 1,256 tracked C# test files parse and the focused 67/107 count and three
  exemplar assertions pass;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate passes 14,379/14,379 with zero
  skips or failures across all 12 test assemblies.

## Batch V dormant panel self-test removal

The user approved Batch P's narrow recommendation. Batch V deletes exactly the
three self-test files in the approved boundary:

- `IPanelRendererWidgetTests.cs`: 17 tests whose oracle is the behavior of the
  test-only `FakePanelRenderer` recorder;
- `IPanelRendererMainMenuBarTests.cs`: nine more tests of that recorder; and
- `PanelContextTests.cs`: two tests of compiler-generated positional-record
  assignment and equality.

The useful boundary remains intact. `IPanel`, `IPanelRenderer`, `IPanelHost`,
and `PanelContext` remain public production contracts for issue #258;
`FakePanelRenderer.cs` remains as the observation seam for 22 `ChatPanel*`
methods plus the `ChatVMCombatTests` render-path method; and all 23 layout,
input, focus, color, and command behavior tests remain executable. No panel,
ViewModel, parser, command contract, product source, or historical rationale is
removed.

Verification:

- the retained 23 attributed panel behavior methods pass all 29 expanded cases;
- the complete UI-abstractions assembly passes 898/898, exactly 28 below its
  previous 926-case total;
- the complete 44-project Release build reports zero warnings and zero errors;
  and
- the no-retry complete hermetic Release gate passes 14,351/14,351 with zero
  skips or failures across all 12 test assemblies, exactly 28 below Batch U.

## Batch W render delegation and cleanup source-freeze replacement

Batch W retires the first nine of the 85 approved implementation-text freezes
without changing product code. Six test methods now inspect runtime behavior,
reflection metadata, or compiled call/new-object edges; three redundant source
tests are removed because an existing behavioral trace already asserts the
same contract more strongly.

The exact decisions are:

- `TextRendererConstructorOwnsExactlyOneDeviceResource` no longer counts
  constructor strings. `TextRendererConstructionCreatesAndDisposesOnlyOnePipeline`
  constructs the real renderer through `RecordingGpuDevice`, proves that only
  one pipeline is added (no buffer, texture, sampler, or texture slot), and
  proves that exact pipeline is disposed. The V4a/V6d rollback rationale stays
  beside the test. The recording device gained read-only created-resource lists
  solely so tests can observe those device calls.
- `Renderer_source_preserves_retail_stage_order_through_typed_operations` is
  removed. The existing outdoor and interior `DrawInside` tests already drive
  the real renderer and assert the typed operation sequence, including early
  and late landscape, particle flush, interior clear, masks, shells, and entity
  routes.
- `Production_uses_retained_routes_without_rebuilding_legacy_partition` is
  removed. The existing production-product test is renamed to state this
  contract and continues to prove one actual retained candidate with zero
  compare-only referee work. Exact private selector spellings are not a product
  oracle.
- `Production_builder_preserves_the_frame_preparation_order` is removed. The
  existing builder test already supplies recording implementations of every
  typed source and asserts the complete call order plus the borrowed result.
- executor reset/diagnostic bracketing, the one-executor/one-PView composition,
  lighting snapshot-before-UBO order, typed world-frame build, local frame-root
  composition, and GameWindow delegation now inspect compiled call/new-object
  edges and reflected owner fields. `CompiledCallGraph` is shared test-only
  infrastructure that parses the built method body; formatting, comments, local
  variable names, and source paths cannot satisfy or break these contracts.

Two mixed source assertions were deliberately narrowed rather than silently
carried forward. Absence of `Console.WriteLine` is an implementation-style
check with no output oracle and is not treated as render behavior. The old
world-scene source test also embedded a separate teardown-order claim; that
claim remains with the dedicated lifetime suite and is reconciled in the
approved host/lifetime replacement batch instead of coupling teardown to frame
construction.

Verification:

- the four directly affected App suites pass 39/39;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate passes 14,348/14,348 with zero
  skips or failures across all 12 test assemblies; the exact three-case
  reduction is the three redundant source tests above; and
- the regenerated 1,254-file inventory parses every file and reduces direct
  source readers from 67 to 63 and total direct/helper readers from 107 to 98.
  The remaining 98 reconcile to the 22 approved retained policies/contracts
  and 76 staged replacements.

## Batch X streaming publication and live-entity source-freeze replacement

Batch X converts the four approved streaming-publication freezes and both
live-entity composition freezes. No product source changes. The tests now
inspect the built dependency graph, execute the real origin publishers, or
assert the typed owner/reset calls instead of matching C# fragments.

The conversion found one materially misleading old assertion. The physics
publisher test rejected the literal strings
`_physicsDataCache.RemoveCellsForLandblock` and
`_physicsDataCache.RemoveBuildingsForLandblock`. Those fragments were absent,
but the real publisher correctly performs both removals through
`publication.StagingCache`; the test therefore passed without establishing its
intended generation-isolation rule. The replacement verifies the compiled
`AdvanceBeginOne` path obtains the staging cache before each removal, commits
through `RuntimePhysicsState.CommitCollisionGeneration`, does not restart the
retained-owner capture, and keeps the old publication bodies out of
`GameWindow`.

The other exact decisions are:

- the render publisher boundary now scans every compiled GameWindow method and
  constructor for forbidden terrain, cell-visibility, and EnvCell publication
  calls, and reflects the removed mesh-preparation/body ownership;
- the former umbrella origin test is narrowed to the claim its fixture could
  not observe: production `LivePresentationCompositionPhase` constructs the
  render, physics, and static publishers before the one presentation pipeline,
  while GameWindow retains only that pipeline. Captured origin itself remains
  covered by the real `LandblockBuildFactory.BuildFar` and
  `LandblockRenderPublisher.BeginPublication` behavior tests;
- recenter ordering is now its own named compiled-call contract: old-window
  retirement completion precedes `LiveWorldOriginState.Recenter`, which
  precedes destination commit. The extensive recenter transaction suite still
  owns retry, replacement, session-reset, and retirement behavior;
- the shutdown test reads the compiled operation manifest, including delegate
  targets, to prove Runtime session stop precedes streamer disposal. It also
  proves `GameRuntime.StopSession` disposes the live session before checking
  its completion barrier and retains the re-entrant diagnostic message;
- live animation/projectile composition now reflects the exact typed fields
  and proves `CompletePresentation` constructs `DatProjectileSetupResolver`
  before `ProjectileController`, with no window closure or remote-motion-view
  owner; and
- the session reset test follows compiled calls through
  `LiveSessionRuntimeFactory`, `PlayerModeController`, the network-update
  owner, and `LiveWorldOriginState`, rather than pinning four statement strings.

`CompiledCallGraph` gained reusable readers for every declared method,
delegate method targets, and compiled string literals. These are test-only
metadata facilities used when invoking the real process/window graph would
mutate external resources.

Verification:

- the four directly affected owner suites pass 111/111;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate passes 14,349/14,349 with zero
  skips or failures across all 12 test assemblies. The one-case increase is the
  newly separated recenter-order contract; and
- the regenerated 1,254-file inventory parses every file, reports 11,417
  attributed methods, and reduces direct/total source readers from 63/98 to
  57/92. The remaining 92 reconcile to 22 approved retained
  policies/contracts and 70 staged replacements.

## Batch Y input, physics, and inbound-network source-freeze replacement

Batch Y converts the nine approved source-text readers in the input/physics/
network wiring group. Seven remain as compiled-metadata architecture checks;
two redundant source assertions are removed. No product source changes.

The exact decisions are:

- the ForcePosition generic-tail suite now inspects the built
  `TryApplyGenericRemoteRenderPose` body for its one `WorldEntity.SetPosition`
  edge and proves the committed/deferred local-position observer call is
  immediately followed by a compiled return. The negative assertion that the
  already-deleted `LocalForcePositionTransaction` class name was absent is
  removed: the Runtime-owned transaction and its displaced-authority behavior
  are already exercised by
  `RuntimeAcceptedPositionDriveControllerTests`, while an absent identifier is
  not behavior;
- the contact-versus-walkability source assertion is removed. The dedicated
  `SteepContactBody_InterpolatesInsteadOfSnapping` and
  `FreeFlightBodyWithNoContact_StillSnaps` behavioral tests exercise the one
  discriminating state and the opposite boundary through the real routing
  method, so retaining a string check would add brittleness rather than
  coverage. The AP-140 retail rationale remains beside those behavioral tests;
- local inbound SetState routing now verifies the compiled controller graph has
  exactly one `PlayerMovementController.ApplyServerPhysicsState` edge and no
  direct `ApplyPhysicsState` edge;
- the #270 movement-stats contract reflects the single
  `StaminaExhaustionEdgeTracker` owner and follows the compiled Observe,
  ReportExhaustion, Reset, and two factory Apply edges. Existing tracker and
  Runtime movement-state behavior suites remain the behavioral oracle;
- remote spawn settling now identifies both compiled call sites
  (`DispatchRemoteInboundMotion` and `OnPosition`), verifies the repeated
  inbound route checks `PhysicsBody.InContact` before reseeding, and verifies
  the shared seed helper calls `SpawnPlacementSettler.TrySettle`;
- production auto-entry readiness now follows compiled calls to the published
  controller, live-record lookup, and physics-host view and verifies the exact
  `EntityPhysicsHost` type operand; and
- player presentation attachment now verifies compiled call order from the
  animation sink assignment through matched animation drain to the unmatched
  interpreter suffix drain.

`CompiledCallGraph` gained reusable instruction and type-reference readers.
They allow exact return and `isinst`/cast boundaries to be checked without
making comments, whitespace, local names, or source paths part of the oracle.

Verification:

- the directly affected and adjacent behavioral App suites pass 31/31, and
  the two Runtime owner suites pass 52/52;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate passes 14,347/14,347 with zero
  skips or failures across all 12 test assemblies. The exact two-case
  reduction is the two redundant source assertions above; and
- the regenerated 1,254-file inventory parses every file, reports 11,415
  attributed methods, and reduces total direct/helper source readers from 92
  to 83 while direct readers remain 57. The remaining 83 reconcile to the 22
  approved retained policies/contracts and 61 staged replacements.

## Batch Z composition-root source-freeze replacement

Batch Z converts 12 approved source-text readers across the seven graphical
composition-owner suites and removes one stale backend assertion. No product
source changes. The replacement tests use the built call graph, reflected
owner metadata, existing transactional fixtures, and typed composition results
instead of source fragments.

The exact decisions are:

- all seven phase-boundary tests now prove that `GameWindow` constructs exactly
  one instance of the relevant composition phase and does not directly
  construct the leaf owners that belong behind it. The phase and snapshot
  types are also checked for the absence of a retained `GameWindow` owner;
- the platform prelude now verifies the compiled `OnLoad` route through
  `AcquirePlatform` and `GameWindowCompositionPipeline.Run`, plus the single
  `GameWindowPlatformAcquisition.Acquire` and host/input/camera phase edges;
- the prepared-asset contract follows the production factory, world phase,
  `ObjectMeshManager`, `WbMeshAdapter`, and compiled shutdown manifest. It
  proves one `IPreparedAssetSource` owner, no DAT-reader constructor seam in the
  production mesh manager, prepared reads rather than live mesh building, and
  mesh/prepared-source/DAT release order;
- the frame-root test follows the compiled construction order from render
  resources and comparison state through the world/update roots, graph
  publication, window publication, and final ownership transfers. The
  lifecycle snapshot contract now verifies its exact `RenderFrameOutcome`
  input and its typed live-entity, GPU-memory, profiler, and landblock metrics;
- the session phase follows the compiled streamer/start/reveal route and the
  delegate target that constructs the request streamer. Its completion check
  follows hydration, inbound routing, input/player mode, portal transfer,
  session creation, command bindings, action attachment, and final publication
  in order. Character selection now verifies the graphical selector option,
  typed connect options, absence of automatic first-character selection, and
  retained-UI runtime bindings;
- the interaction, live-presentation, and world-render boundaries retain their
  existing behavioral phase fixtures while compiled metadata guards against
  construction leaking back into `GameWindow`; and
- `PortalSpaceIsComposedOnBothBackendArms` is removed as stale. Campaign V
  deleted the OpenGL backend, so a two-backend-arms source condition is no
  longer an architectural contract; its negative assertion named an already
  deleted null presentation. The valuable portal ownership rationale remains
  in the live/session composition code, the compiled portal transfer order,
  and the existing teleport/reveal behavior suites.

Verification:

- all 187 composition tests pass with zero skips or failures;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate passes 14,346/14,346 with zero
  skips or failures across all 12 test assemblies. The one-case reduction is
  the stale two-backend-arms assertion; and
- the regenerated 1,254-file inventory parses every file, reports 11,414
  attributed methods, and reduces direct/total source readers from 57/83 to
  44/70. The remaining 70 reconcile to the 22 approved retained
  policies/contracts and 48 staged replacements.

## Batch AA Runtime-root and crash-status source-freeze replacement

Batch AA converts the three approved Runtime-root/session-host freezes and the
three crash-status freezes. No product source changes and no test is removed.

The canonical-root checks now scan compiled App metadata rather than C# text:
`GameWindow` constructs exactly one `GameRuntime`, acquires its one host lease,
and constructs none of the displaced Runtime child roots; the entire App
assembly contains exactly one `LiveSessionCommandSurface` construction edge.
The character-creation status regression follows the compiled delegate targets
created by `LiveSessionRuntimeFactory.Create` and verifies the exact Guid/Name
and RawCode/Reason/AttemptedName property-to-writer call order. The existing
Runtime `SessionStatusWriter` suite remains the payload-shape oracle.

The #406 crash regression now inspects the built `GameWindow.Run` and
`ReportExited` methods. It proves the native frame-loop call precedes cleanup
retention, the `_runFailure` store precedes rethrow, the failure read precedes
all terminal paths, the three crash/graceful/incomplete writer calls and their
literals retain their order, and both shutdown exits funnel through the one
reporting method. Reflection verifies the nullable exception latch exists and
that neither constructor assigns it, preserving its default-null state.
`CompiledCallGraph` gained a reusable field-load/store reader so latch ordering
can be checked by IL offset without pinning field expressions or formatting.

Verification:

- all 15 focused Runtime-root/session-host/crash-status methods pass;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate remains 14,346/14,346 with zero
  skips or failures across all 12 test assemblies; and
- the regenerated 1,254-file inventory parses every file, remains at 11,414
  attributed methods, and reduces direct/total source readers from 44/70 to
  41/64. The remaining 64 reconcile to the 22 approved retained
  policies/contracts and 42 staged replacements.

## Batch AB render-leaf and frame-handoff source-freeze replacement

Batch AB converts all nine approved `GameWindowRenderLeafCompositionTests`
source readers. No product source changes and no test is removed.

Private presentation, resource preparation, world/private/diagnostic routing,
GPU measurement, and immutable outcome construction now follow compiled typed
calls in their production order. The portal-tunnel check follows the compiled
session transfer/bind/publication path, both local teleport factory targets,
the session-before-frame phase references in `OnLoad`, and the exact frame-root
borrower construction order. `OnRender` now proves its single
`GameFrameGraphSlot.Render` handoff and absence of the five displaced leaf
field reads directly from the built method.

The broad legacy-owner blacklist is narrowed to what it actually protects:
reflected `GameWindow` fields and methods reject the displaced owners, while
compiled composition metadata positively locates paperdoll, frame-resource,
weather, private-presentation, orchestrator, frame-pacing, and mouse-capture
ownership behind their focused types. Shutdown ordering uses the compiled
operation/stage labels. Terrain diagnostics are constructed with the scene
executor but not driven directly by the frame root.

The optional paperdoll contract is stronger than the old source-expression
match: compiled branch destinations prove that either a missing viewport or a
missing inventory frame jumps past `PaperdollFramePresenter` construction.
`CompiledCallGraph` gained a reusable branch-target reader for this kind of
optional-dependency guard.

Verification:

- all nine focused render-leaf methods pass;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate remains 14,346/14,346 with zero
  skips or failures across all 12 test assemblies; and
- the regenerated 1,254-file inventory parses every file, remains at 11,414
  attributed methods, and reduces direct/total source readers from 41/64 to
  39/55. The remaining 55 reconcile to the 22 approved retained
  policies/contracts and 33 staged replacements.

## Batch AC graphical-host and lifetime source-freeze replacement

Batch AC converts all nine approved `GameWindowHostBoundaryTests` source
readers. No product source changes and no test is removed.

Startup now follows the compiled settings snapshot, frame-pacing, native
window, callback-target, callback-binding, attachment, and frame-loop edges.
The callback delegate targets retain their exact load/update/render/closing/
focus/resize order without treating local names, comments, or nested argument
spelling as behavior. `OnLoad` phase ordering is recovered from its compiled
delegate targets, while frame-root and session-player completion checks follow
their typed construction, binding, attachment, publication, and transfer
edges.

The remaining owner checks reflect the one `WorldEnvironmentController` and
`RuntimeSettingsController`, reject their displaced window mirrors, and
follow environment routing, settings startup/runtime binding, terrain-atlas
acquisition, input-action attachment, and framebuffer-resize publication
through the built methods. Focus, update, render, close, and dispose are
verified as narrow handoffs. In particular, the render check uses semantic IL
execution order—window size, immutable input construction, then graph render—
rather than the misleading lexical order of a nested source expression.

Shutdown now uses reflected root types, field stores, built call order, and
the compiled manifest's stage/operation labels. It preserves the twenty-stage
dependency order, plugin transfer before startup, ingress cleanup ordering,
Runtime/UI/resource release boundaries, `TryComplete` before native-window
release, and the final `_window` clear after the shared shutdown funnel. A
label such as `input context` may legitimately identify both an operation and
its stage; the replacement therefore verifies dependency order instead of
mistaking duplicate human-readable labels for duplicate ownership.

The old checks for HostInputCamera local `if` spelling are retired rather than
translated. `HostInputCameraCompositionTests` already exercise the complete
production acquisition and every fault boundary; the names and arrangement
of compiler locals are not part of the host contract. All valuable ownership,
ordering, and cleanup rationale remains in the compiled guards above.

Verification:

- all nine focused graphical-host/lifetime methods pass;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors;
- the no-retry complete hermetic Release gate remains 14,346/14,346 with zero
  skips or failures across all 12 test assemblies; and
- the regenerated 1,254-file inventory parses every file, remains at 11,414
  attributed methods, and reduces direct/total source readers from 39/55 to
  32/46. The remaining 46 reconcile to the 22 approved retained
  policies/contracts and 24 staged replacements.

## Batch AD frame orchestration and resource-preparation replacement

Batch AD converts all fourteen approved source readers in
`RenderFrameResourceControllerTests` and `UpdateFrameOrchestratorTests`. No
product source changes and no test is removed.

The three render-resource checks now inspect built call and field-store order.
They preserve the texture/dispatcher/environment/portal/clip/terrain/lighting
begin sequence, mesh publication before reveal evaluation and particle begin,
and weather evaluation before the elapsed-clock commit. The existing recording
phase test continues to exercise the public prepare sequence and one GPU-slot
read behaviorally; source comments and local expressions are no longer part of
the oracle.

The update-frame replacements retain the full accepted phase graph and its
existing behavioral fake trace, then use compiled metadata only for production
wiring that cannot safely be invoked without a real session or window:

- the physics script clock has one typed publisher behind `FrameRootCompositionPhase`
  and no `GameWindow` publication edge;
- live-object, static-animation, effect, particle/script, and spatial-reconcile
  calls preserve their registered adaptation order and exact-once tails;
- streaming precedes the live coordinator, whose inbound session and placement
  retry precede command and spatial reconciliation on both available and
  quiesced behavioral paths;
- session/frame composition constructs the live-object, spatial, streaming,
  gameplay-input, teleport, liveness, auto-entry, camera, and update owners,
  while reflected fields and compiled window calls reject the displaced bodies;
- focus loss, player-mode exit, and teleport start retain their typed
  mouse-look cleanup edges, including freshness validation before input cleanup
  and Runtime transit commit afterward;
- player presentation attachment retains Runtime-publication validation,
  camera/shadow/host/mode order, and both cleanup routes; mouse filtering and
  typed movement-input seams are checked from method and constructor metadata;
  and
- camera sampling/reconciliation and the thin `OnUpdate` profile-to-graph
  handoff remain ordered, while live-session event and world-origin consumers
  stay behind their focused typed owners without `GameWindow` back-references.

Where construction happens inside acquisition or transfer delegates, the
tests follow the compiled delegate target before inspecting its child edge.
This preserves real execution ownership without reverting to lexical source
order across nested expressions.

Verification follows the user-approved proportionate policy for the remaining
R3 work:

- all 34 focused frame/resource methods pass;
- the complete `AcDream.App.Tests` hermetic lane passes 5,381/5,381 with zero
  skips or failures;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors; and
- a targeted scan confirms neither owning test file retains a source reader or
  its source-slicing helper. The final full inventory and twelve-assembly
  Release gate are intentionally deferred to the one R3 closeout run.

## Batch AE Runtime gameplay-owner wiring replacement

Batch AE converts the nine approved consumer-wiring source readers across
`RuntimeActionOwnershipTests`, `RuntimeCharacterOwnershipTests`,
`RuntimeInventoryOwnershipTests`, and `RuntimeMovementOwnershipTests`. No
product source changes and no test is removed. The two approved whole-tree
construction policies—one action-owner policy and one movement-owner policy—
remain source-aware by design and are not part of the 85 staged replacements.

The replacements use reflected fields, properties, constructor parameters,
compiled child access, and shutdown-root metadata to prove that:

- retained UI, session composition, graphical command adapters, and item
  interaction borrow the canonical action children and the exact Runtime
  transaction owner, with no App `InteractionState` or UI-side transaction
  construction;
- `GameWindow` owns one `GameRuntime`, constructs no character child root,
  and projects its Spellbook/LocalPlayer properties through
  `RuntimeCharacterState`; content installation, session routing, retained UI,
  options, and movement-skill updates all consume that owner;
- the deleted App character-option and movement-skill owner types remain
  absent, while Runtime's option replacement and movement-skill update edges
  remain live;
- `GameWindow` constructs none of the displaced inventory/item-mana/container/
  shortcut snapshot owners; retained UI and item interaction use the Runtime
  action transaction, session bindings use the Runtime shortcut store and use
  completion, and shutdown carries only `GameRuntime`;
- `ToolbarController` retains the exact `ShortcutStore` without constructing a
  mirror, provider delegate, or loaded-state latch, and spell UI has no second
  local mutation calls for filters, desired components, or favorites; and
- graphical input, both runtime adapters, and both shutdown roots borrow the
  exact `RuntimeLocalPlayerMovementState`, including its autorun and typed
  command execution edges.

`CompiledCallGraph.ReadOwned` was added as a test-only metadata facility. It
reads declared owner methods plus compiler-generated acquisition/callback
closures, so a typed dependency carried by a UI factory remains inspectable
without freezing the lambda's source spelling.

Verification follows the proportionate R3 policy:

- all 11 focused ownership methods pass, including the two retained whole-tree
  policies adjacent to the nine replacements;
- the complete `AcDream.App.Tests` hermetic lane passes 5,381/5,381 with zero
  skips or failures;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors; and
- a targeted scan finds source reads only in the two explicitly retained
  whole-tree policy methods. The final inventory and twelve-assembly Release
  gate remain deferred to closeout.

## Batch AF create-authority drift-model contract replacement

Batch AF converts the final approved test-model/source correspondence check.
`CreateAuthorityDriftModelSourcePinTests` is renamed to
`CreateAuthorityDriftModelContractTests`; its descriptive test method
`HandCalledDriftProbe_StillModelsTheExecutorDrainAdvance` is retained. No
product source changes and no test is removed.

The replacement no longer regexes two Runtime files. It inspects compiled
Runtime metadata and proves:

- `ApplyWeenieDescriptionAction` applies the accepted description, refreshes
  the canonical snapshot, advances create authority exactly once, and then
  advances the executor baseline in semantic execution order;
- `RegisterEntityCore` still has the named Boolean initial-residence input,
  refreshes the ordinary existing-generation snapshot, and places the one
  registration-time authority advance behind a conditional branch that skips
  over the call; and
- the Runtime assembly contains exactly those two call sites targeting
  `RuntimeEntityDirectory.AdvanceCreateAuthority`: the modeled executor drain
  and the gated ordinary registration route.

This is the stale-model alarm the source regex intended, but it now survives
comments, whitespace, local renames, and equivalent expression refactors.
The expectation-item 6/8 probe comments in the hydration and supersession
suites now say `metadata-pinned` and name the new contract class, preserving
the rationale without leaving misleading source-pin references.

Verification follows the proportionate R3 policy:

- the contract plus its hydration and supersession behavior suites pass 90/90;
- the complete `AcDream.App.Tests` hermetic lane passes 5,381/5,381 with zero
  skips or failures;
- the complete locked Release build covers all 44 projects with zero warnings
  and zero errors; and
- targeted scans find no source reader in the renamed contract and no stale
  source-pin comment in the affected tests. With this batch, all 85 approved
  replacements are implemented; final inventory reconciliation and the one
  complete Release gate follow next.

## R3 closeout

R3 closes on implementation commit `14d371a0`. The final Roslyn inventory and
the one complete Release gate both ran from that clean commit; this closeout is
the only later documentation change.

The final inventory parses all 1,254 tracked C# test files and attributes
11,414 test methods. It finds 21 direct source readers and 22 readers in total.
Those 22 reconcile exactly to the approved retained boundary:

| Retained disposition | Methods | Reconciled owners |
|---|---:|---|
| Whole-tree architecture policy | 17 | `LinuxPlatformBoundaryTests` (5), `RenderSceneArchitectureTests` (2), `RuntimePhysicsOwnershipTests` (4), `RuntimeEntityOwnershipTests` (2), and one each in `RuntimeActionOwnershipTests`, `RuntimeMovementOwnershipTests`, `RuntimeWorldTransitOwnershipTests`, and `RuntimeDatAccessArchitectureTests` |
| Cross-artifact source/project contract | 5 | `ParticleBindlessInstanceTests` (1), `PerformanceToolsTests` (1), and `LauncherProjectBoundaryTests` (3) |

The original corrected inventory's equation therefore closes without an
unclassified reader: 107 source readers = 85 replaced implementation/test-
model freezes + 17 retained architecture policies + 5 retained cross-artifact
contracts. Three of the 85 replacements removed a redundant test because an
existing stronger behavioral oracle already covered the claim; the other 82
kept a test and changed its evidence seam.

The other approved boundaries also reconcile:

- Batch V deleted exactly 28 attributed self-tests: 17 widget-recorder tests,
  nine main-menu-recorder tests, and two positional-record tests. All three
  approved files remain absent.
- `FakePanelRenderer` remains. The retained behavior boundary is exactly 23
  attributed methods and 29 expanded cases: 22 `ChatPanel` layout/input/focus
  methods plus the `ChatVMCombatTests` render-path method.
- The issue taxonomy remains descriptive: 47 `Issue###...Tests.cs` files and
  all 155 attributed methods remain, with every filename carrying a behavior
  suffix after its issue number.

R3 changed no product behavior. A diff from starting commit `8e884679` contains
eight `src/` paths, all previously reviewed testability/documentation seams:
two comment-only test-name updates; deterministic clock injection for input and
streaming whose public production construction still selects the same system
clock; nullable launcher contention callbacks that production leaves unset;
and one test-assembly `InternalsVisibleTo`. No shipping default, ownership,
algorithm, protocol, or presentation path changes.

Final verification at clean implementation commit `14d371a0`:

- locked Release restore and build: 44 projects, zero warnings, zero errors;
- complete hermetic Release gate: 14,346 passed, zero skipped, zero failed,
  across all 12 default test assemblies; and
- durable ignored evidence: `artifacts/test-audit/test-inventory.json` and
  `artifacts/release-gate/release-gate-summary.json`, with logs, TRX files,
  environment capture, and SHA-256 manifest beside the gate summary.

Every R3 decision is now represented by the batch ledger above, the final
inventory agrees with every approved count, and no cleanup item remains open.