acdream/docs/reviews/2026-08-18-r3-test-truth-ledger.md

# R3 test-truth and cleanup ledger

Status: **active**

Branch: `codex/release-stabilization`

Starting commit: `8e884679e0b6ce3dc1c84004ba9c5c8e3ff91d2a`

This is the cross-session authority for R3. The historical all-file audit remains
in [`test-quality-audit.md`](test-quality-audit.md); this ledger reconciles that
baseline against current source and records each cleanup decision before code is
removed. R3 does not change product behavior.

## Current executable baseline

The clean R2 gate at implementation commit `c38f6b88` built all 44 maintained
projects with zero warnings and ran every default test assembly once:

- 12 test assemblies;
- 14,742 passed;
- 77 reported skipped;
- 0 failed; and
- one redundant Core theory row discarded by xUnit discovery before the totals.

The six-case reduction from the earlier 14,748-pass headline is understood:
seven launcher editor-focus theory rows were consolidated into one fact that
still executes all seven variants in a single Avalonia application session.

## Fresh reproducible syntax inventory

`tools/audit-test-inventory.ps1` now regenerates the complete attributed-method
manifest from tracked C# test sources with Roslyn:

```powershell
pwsh ./tools/audit-test-inventory.ps1
```

The generated JSON lives under ignored `artifacts/test-audit/`; it is not a
second 6.8 MB checked-in source of truth. The script and this reviewed ledger
are durable, while paths and line numbers regenerate after every batch. The
inventory at commit `8f490240` reports:

| Syntax signal | Current count |
|---|---:|
| Tracked/parsed C# test files | 1,256 / 1,256 |
| Attributed test methods (not expanded theory cases) | 11,455 |
| Methods containing at least one empty `return;` | 399 |
| Empty-return sites | 426 |
| Prerequisite-return candidates | 282 |
| Mechanical output-only candidates | 47 |
| Methods directly using `Thread.Sleep` / `Task.Delay` | 20 / 23 |
| Methods directly reading environment variables | 47 |
| Methods directly reading `.cs` source text | 63 |

The 282 prerequisite-return count is intentionally a review candidate set, not
a claim that all 399 methods are broken. It comprises 109 App, 125 Core, 29
Content, 12 Launcher.Core, three Core.Net, three Bake, and one Headless method.
The classifier includes external-asset, opt-in, and platform gates; behavioral
early exits inside callback tests remain outside that candidate set. Every
candidate still requires source inspection because `Directory.Exists`, for
example, can also be the behavior under test.

The output-only classifier follows same-file helper calls, but it cannot decide
whether an assertion merely establishes probe setup. The reviewed diagnostic
set is therefore 51 methods: the 47 mechanical candidates plus
`OptionsPanelLiveMountProbeTests.ProbeLiveMountShapes`,
`DoorSetupGfxObjInspectionTests.HoltburgCottage_CellPortals_DatInspection`, and
the two already classified tower diagnostics. Relative to T-011's historical
51-method table, delete the removed PVS scaffold and add
`TowerAscentReplayTests.Diagnostic_TowerAscent_PerStepTable`; all other entries
remain. Those 51 methods expand to 70 discovered cases (28 App, 42 Core).

## Exact 77-skip reconciliation

The latest clean-gate TRX files account for every reported skip:

| Classification | Count | Current source | R3 decision |
|---|---:|---|---|
| Installed retail DAT lane | 73 | `InstalledDatFactAttribute` across nine files | Retain the contracts, replace the campaign-specific shared reason with prerequisite- and suite-specific identity, and report this lane separately. Batch B assigns all nine classes to `Lane=InstalledDat`. |
| Manual fixture generation | 2 | `ChatLayoutFixtureGenerator.GenerateChatFixture`; `RadarLayoutFixtureGenerator.GenerateRadarFixture` | Delete both redundant generators: the existing comprehensive `RetailLayoutFixtureGenerator` already owns their chat and radar outputs. Assign that generator to the explicit Manual lane. |
| Empty future scaffold | 1 | `PvsConformanceTests.Pvs_CottageInterior_MatchesRetailCellDrawList` | Delete the test. Preserve its retail oracle and capture recipe here and in the existing P0 plan. |
| Known product failure | 1 | `TowerAscentReplayTests.TowerAscent_StaircaseStaysConeVisible_EveryStep` | Do not pretend this is unavailable coverage. Keep the oracle and move it to an explicitly reported known-failure/non-blocking lane until #119 is fixed. |

Installed-DAT skip distribution:

| Test class | Count |
|---|---:|
| `ChargenPreviewControllerTests` | 10 |
| `CharacterCreationLiveDatTests` | 42 |
| `CharacterManagementLiveDatTests` | 3 |
| `DatStringEscapeSweepTests` | 1 |
| `LayoutImporterMediaBearingChildSweepTests` | 3 |
| `MapHousePanelLiveDatMountTests` | 1 |
| `MapNoteLiveDatTests` | 3 |
| `TooltipLiveDatTests` | 7 |
| `UiButtonCorpusSweepTests` | 3 |

There are also 11 source sites that throw `SkipException.ForSkip` conditionally.
They are not part of the current 77 because their prerequisites happened to be
available on the R2 gate machine. R3 must retain their per-test reason and
assign them to the installed-DAT, prepared-package, system-font, or other
explicit prerequisite lane; a future machine may report them as additional
skips.

The lane vocabulary is deliberately orthogonal:

- `Lane` states the execution environment (`InstalledDat`, `PreparedPackage`,
  `Live`, or `Manual`);
- `Purpose=Diagnostic` marks output/investigation apparatus that cannot add to
  the contract-test pass count; and
- `Status=KnownFailure` keeps a named executable oracle visible without making
  a green release claim.

The default gate excludes all three dimensions. An explicitly selected lane
must fail clearly when its prerequisite is missing; it may not pass through an
empty return. The 73 custom installed-DAT facts retain discovery-time skips
when their opt-in is absent so each unavailable contract and reason remains
identifiable in the lane report.

## Finding disposition

| Finding | Current disposition | Evidence / next action |
|---|---|---|
| T-001 launcher lock inversion | resolved in R1 | Deterministic captured-callback regression and bounded full gate. |
| T-002 physics tautology | high-confidence cleanup batch A | Compare old-model and new-model reflection decisions, as the surrounding contract states. |
| T-003 duplicate theory row | high-confidence cleanup batch A | Remove literal `0x41000012`, which is identical to `MotionCommand.Crouch`; remove the temporary analyzer suppression. |
| T-004 warning mismatches | resolved in R2 | Clean rebuild is zero-warning with repository-wide warnings-as-errors. |
| T-005 unreachable panel stack | requires production reachability proof | Do not delete 52 meaningful tests until the dead presentation surface and any supported plugin compatibility promise are verified together. |
| T-006 misleading installed-DAT reason | resolved in batch B | Shared opt-in is now `ACDREAM_RUN_INSTALLED_DAT_TESTS=1` (legacy switch retained), the reason names the lane, and all nine owners carry `Lane=InstalledDat`. |
| T-007 271 silent passing gates | lane classification complete in batch D; body cleanup active | Of 282 current candidates, 280 are true prerequisite gates and now have an explicit lane. The two unlaned methods are reviewed false positives that assert the current Windows/Linux branch before returning. Empty-return removal remains, lane by lane. |
| T-008 incapable-of-failing diagnostics | batch A plus diagnostic lane work | Delete the literal wiring smoke test; repair the GPU contract tautology; later re-home output-only apparatus. |
| T-009 wall-clock double-click tests | resolved in batch E | Four sleeps were replaced by a deterministic test clock behind an internal factory overload. The production factory still reads `Environment.TickCount64` exactly as before. |
| T-010 two useless cases | high-confidence cleanup batch A | Delete `SmokeTest.TestProject_IsWired` and `ChaseCameraTests.ImplementsICamera`; compilation already proves both claims. |
| T-011 51 output-only methods | classified in batch C | The reviewed current set is 51 methods / 70 cases. All carry `Purpose=Diagnostic`, preserving the apparatus while removing it from release pass totals. Contract-shaped names remain explicitly flagged until a stable oracle exists. |
| T-012 source-text freezes | requires semantic replacement map | Retain whole-tree dependency rules; remove exact-text freezes only when an equivalent semantic/behavioral guard is identified. |
| T-013 controller self-comparison | high-confidence cleanup batch A | Capture the first controller next to the first body and compare every retry with that reference. |
| T-014 seven load-sensitive tests | six mechanisms repaired in batch F; one product defect classified | Virtual/wall-clock mixing, tiered-JIT allocation noise, a live controller clock, and a ThreadPool-start timing oracle were removed without weakening behavioral contracts. `DatSoundCache` #321 is a real in-flight-entry race and now runs as `Status=KnownFailure` pending a product fix. |
| T-015 four non-prerequisite skips | resolved in batches A/B | PVS scaffold deleted with rationale preserved; redundant chat/radar generators deleted in favor of the comprehensive Manual lane; tower oracle is `Status=KnownFailure`. |
| T-016 historical test taxonomy | open | Rename/re-home only after each test's durable owner and oracle are established. |
| T-017 Avalonia ownership | reopened and closed in batch D | The full gate exposed the same compositor ownership class between six newer `MainWindowViewTests` facts. Their six named assertion phases now run in one owned Avalonia application session; 25 fresh-process stress iterations and the complete gate pass. |
| T-018 stderr observer race | resolved in R2 | Live reader shares writes/deletes; 25 focused repetitions plus the complete gate. |

## Preserved rationale for removals in batch A

### PVS scaffold

The empty PVS fact has no executable oracle and must not remain a permanent
skip. Its useful note is preserved here: retail
`PView::ConstructView(CEnvCell*)` at `0x005a57b0` produces the ordered
`cell_draw_list` for a `(viewer_cell, eye)` input. A future conformance test
requires a retail trace captured around `PView::DrawCells`/`cell_draw_list`.
The intended invariants were: the PVS root equals `physics CurrCell.Id`; a cell
seen through two portals appears once per slice; and dungeon
`outside_view == 0`. The complete original scaffold and capture plan remain in
`docs/superpowers/plans/2026-06-03-p0-conformance-apparatus.md`.

### Compile-only smoke cases

`SmokeTest.TestProject_IsWired` contains only `Assert.True(true)`.
`ChaseCameraTests.ImplementsICamera` assigns `ChaseCamera` to `ICamera` and
calls `ToString()` without an oracle. Removing them discards no runtime
contract: the test project build and the remaining camera behavior tests are
strictly stronger evidence.

## Batch protocol

Each cleanup batch must:

1. update this ledger before or with the change;
2. preserve useful historical rationale in a plan, issue, or this ledger;
3. run the directly affected test projects without retries;
4. run a clean warning-as-error build when analyzer/discovery shape changes;
5. commit one coherent classification/fix group; and
6. run the complete local Release gate before R3 closeout.

Ambiguous cases stay open in this ledger and are presented to the user rather
than being deleted by inference.

## Batch A verification

The first high-confidence batch was verified before commit:

- complete non-incremental Release rebuild: 44 projects, 0 warnings, 0 errors;
- Core: 4,795 passed / 0 skipped / 0 failed;
- App: 5,511 passed / 76 skipped / 0 failed; and
- Runtime: 1,756 passed / 0 skipped / 0 failed.

The count delta is intentional and classified: Core removed the two useless
compile-only cases and the skipped PVS scaffold; App gained one case by
splitting the old mixed/tautological depth-stencil test into two independently
named contracts. Core emitted no duplicate-case discovery warning.

## Preserved rationale for removals in batch B

The chat- and radar-only fixture generators were not the sole way to recreate
their committed JSON. `RetailLayoutFixtureGenerator` already includes retail
layout IDs `0x2100006F` and `0x21000074` and writes the same
`chat_2100006f.json` and `radar_21000074.json` destinations as part of its
complete 20-layout run. Deleting the two permanently skipped duplicates removes
two false test entries without losing the regeneration recipe or retail notes;
the comprehensive generator and `docs/release-gate.md` now own that workflow.

The tower staircase oracle is not unavailable or useless. Its former static
skip documents issue #119 and the exact failing steps. Batch B keeps the
executable assertion under `Status=KnownFailure`, separates two output-only
methods with `Purpose=Diagnostic`, and makes missing installed DATs a clear lane
prerequisite failure instead of a passing early return.

## Batch B verification

The lane-classification batch was verified without changing product code:

- App Release build: 0 warnings, 0 errors;
- hermetic App lane, isolated: 5,505 passed / 0 skipped / 0 failed;
- Installed-DAT contract lane without opt-in: 3 passed / 73 individually named
  skips / 0 failed (the local tower DAT prerequisite was available);
- known-failure discovery: exactly one tower staircase oracle; and
- Manual discovery: exactly one comprehensive fixture generator.

One concurrent three-host verification attempt reproduced T-014 rather than
being hidden: the hermetic host failed the portal-clipping zero-allocation test
at 6,904 bytes while the Installed-DAT and discovery hosts ran beside it. The
same unmodified hermetic command then passed 5,505/5,505 in isolation. This is
evidence for removing cross-host allocation sensitivity; it is not grounds to
weaken the assertion or claim a clean concurrent result.

## Batch C diagnostic classification

Batch C assigns the reviewed 51-method diagnostic set to
`Purpose=Diagnostic`. No body, output, historical comment, or fixture is
removed. This resolves the misleading release accounting without pretending
that every investigation has a stable regression oracle.

The 15 contract-shaped methods called out by T-011 now have a `Diagnostic_`
prefix: four facility-hub scenarios, six stair/camera sweeps, two ambient-slot
inventories, production-emission replication, and two drawn-polygon reports.
Their current output and historical method references are preserved, while the
new names no longer imply an asserted oracle. Promoting them back into the
hermetic lane requires an asserted expected result; R3 will not invent those
values.

Batch C verification:

- App Release build: 0 warnings, 0 errors;
- Core Release build, serialized after App: 0 warnings, 0 errors;
- hermetic App: 5,479 passed / 0 skipped / 0 failed;
- hermetic Core: 4,753 passed / 0 skipped / 0 failed; and
- diagnostic discovery: 28 App + 42 Core = 70 cases from 51 methods.

An attempted parallel App/Core build collided on the shared
`AcDream.Plugin.Abstractions` intermediate DLL. The repository gate serializes
projects, so the authoritative verification is the two isolated clean builds
above; no code or assertion was changed in response to that tooling collision.

## Batch D prerequisite lanes and Avalonia ownership

The reviewed prerequisite map classifies every true candidate without deleting
its existing guard:

| Lane | Attributed methods | Prerequisite |
|---|---:|---|
| `InstalledDat` | 336 | Installed retail DAT directory; includes the 73 custom installed-DAT facts and whole DAT-backed investigation classes. |
| `PreparedPackage` | 2 | Installed DATs plus validated `acdream.pak`. |
| `Live` | 3 | Explicit live handshake opt-in and reachable service. |
| `Manual` | 1 | Explicit fixture-regeneration opt-in. |
| `Windows` | 7 | Windows-only filesystem/process/timer behavior. |
| `Linux` | 10 | Linux permission/signal/monotonic-clock behavior. |
| `SystemFont` | 2 | A host system TTF available to the BitmapFont path. |

Class-level traits legitimately cover some additional methods that share the
same fixture owner, so the 336 installed-DAT method count is larger than the
280 syntax candidates. The only candidate methods without a lane are
`GraphicalHostPlatformServicesTests.CurrentPlatformOwnsPathsPacingAndNativeClosure`
and
`LinuxMonotonicFramePacingWaiterTests.PlatformFactorySelectsCurrentOperatingSystem`.
Both are hermetic cross-platform branch tests: on Windows or Linux they assert
the matching branch and return only after the assertion. They are not silent
prerequisite passes.

The 11 conditional `SkipException.ForSkip` source sites are also reconciled.
They serve 12 test methods: installed-DAT asset contracts, one prepared-package
contract, and two system-font contracts. xUnit v2 reports that exception shape
as a failure rather than a dynamic skip, but the owning lanes now keep them out
of the hermetic total. A later body-cleanup batch will replace the misleading
skip wording/exception with explicit prerequisite failure or discovery-time
lane behavior.

The first complete Batch D gate correctly failed in Launcher cleanup after
14,396 passes: the six `MainWindowViewTests` Avalonia facts could start and
destroy isolated thread-affine compositors on different xUnit workers. The
assertion bodies were preserved as six named private phases under one
`CompiledMarkupAndEveryModalFocusPathRunInOneOwnedAvaloniaSession` fact. The
focused two-case class then passed in 25 consecutive fresh processes (50/50
results), and the same full-gate context passed.

Batch D verification:

- complete 44-project Release build: 0 warnings, 0 errors;
- final syntax manifest: 11,450 attributed methods, 51 diagnostics, one known
  failure, 282 prerequisite-return candidates, and only the two reviewed
  cross-platform false positives unlaned;
- complete hermetic Release gate: 14,392 passed / 0 skipped / 0 failed across
  all 12 test assemblies in 131.518 seconds; and
- Launcher view stress: 25 fresh processes, 2/2 cases per process, no cleanup
  or ownership failures.

The 350-pass reduction from the clean R2 headline is exactly explained: batch A
netted minus one case; batch B removed six non-hermetic passes; batch C removed
68 newly classified diagnostic cases; batch D removed 270 prerequisite-lane
passes; and consolidating the six Avalonia sessions into one removed five case
IDs without removing any assertion phase. All 77 former default skips are also
accounted for by the PVS deletion and batch-B lane/deletion decisions.

## Batch E indirect gates and deterministic input time

The inventory now follows same-file helper calls when looking for prerequisite
returns. It found one additional path:
`LauncherSelfUpdateProcessTests.BackupJunctionOrSymlinkAfterCanonicalCrashCannotMutateOutsideOrLaunch`
calls `CreateDirectoryLink`, whose non-Windows branch creates the symbolic link
and then returns before the Windows `mklink /J` implementation. This is a
reviewed cross-platform control-flow branch, not a prerequisite gate or silent
pass. The combined direct/indirect candidate count is therefore 283: 280 true
lane-owned gates and three reviewed branch false positives.

The four `InputDispatcherDoubleClickTests` no longer sleep for 10 or 600 real
milliseconds. `InputDispatcher` has an internal, test-assembly-only factory
overload accepting the same millisecond tick delegate used by double-click
recognition. The public production factory remains wired directly to
`Environment.TickCount64`; only the tests use a manually advanced counter.
The focused class passes 4/4 in 17 ms with exact 10 ms and 600 ms virtual
intervals. The complete Release build then passed with 0 warnings/errors, and
the no-retry hermetic gate passed 14,392/14,392 with zero skips or failures.

## Batch F load-sensitive contracts

The seven cases in T-014 have now been separated into six unreliable test
mechanisms and one real product defect:

- #308 `NakEmissionTests.LossSoak...` no longer mixes its virtual transport
  clock with a 60-second `DateTime.UtcNow` cutoff and fixed sleeps. Its two
  convergence phases each permit exactly 120 half-second virtual steps and
  yield to the background receiver. The full 10,000-message oracle is intact;
  25 fresh-process repetitions pass.
- #302 and #346, the two `PortalProjectionTests` allocation contracts, now
  cross tiered-JIT/PGO thresholds before measuring and take the minimum of five
  warmed 1,000-operation batches. A linear result-array regression would
  allocate in every batch and still fail far above the existing ceilings.
- #336 `RuntimeCollisionReportingStateTests.WarmedSteadyContactRefreshDoesNotAllocate`
  now earns the word "warmed": it performs one complete 10,000-refresh warmup
  and requires at least one of five subsequent 10,000-refresh batches to
  allocate exactly zero bytes. It passes in 25 fresh processes.
- #340 `StreamingWorkBudgetTests.DestinationAndEmptyUnloadPriorityNeverBypassPublicationBudget`
  now supplies a frozen meter clock through an internal test-only constructor.
  The public production constructor still supplies `Stopwatch.GetTimestamp`
  and `Stopwatch.Frequency` exactly as before.
- #402 `LandblockBuildFactoryTests.Build_UsesTheSuppliedSharedReaderGate` now
  starts a dedicated thread and observes it in `WaitSleepJoin` on the held
  monitor before checking that no DAT read occurred. It no longer treats a
  ThreadPool start within two seconds or an arbitrary 100 ms wait as evidence.
- #321 `DatSoundCacheTests.GetWave_ConcurrentSameId_PublishesOneCanonicalWaveAndDecodesOnce`
  exposes a real race. A caller can pass the resident-cache check, pause, and
  reach `_inflight` after the winning caller has admitted the wave and removed
  its `Lazy`, producing a second decode. The assertion and rationale are
  preserved under `Status=KnownFailure`; R3 makes no cache behavior change.

The four changed App cases pass 100/100 across 25 fresh processes. The Runtime
allocation case passes 25/25, and the Core.Net loss soak passes 25/25. Complete
batch verification then passed: the 44-project Release build reports zero
warnings/errors, the refreshed inventory reports two explicit known-failure
methods and 15 remaining direct `Thread.Sleep` methods, and the no-retry
hermetic gate passed 14,391/14,391 with zero skips or failures. The one-pass
reduction is exactly #321 leaving the release lane.