technical notes

• Dotted writes into a scripted material merge instead of gutting it: setObjectProperty(id, "material.params.X", v) now preserves the script ref and every sibling param (r-3fb1c3c8, ravi's dig 4f5f3ff8, dump e3b929c6; 5.2.34 rider). The dotted machinery already merged correctly — buildDottedPropertyMerge deep-sets into the property reader's flat echo, script included — but normalizeMaterialSpec only recognized the AUTHORED scripted spelling ({kind:"scripted", script:"scripts/x.js"}); the shape the engine itself emits — the reader's echo and the persisted mirror, {key:"Scripted", script:{ref, params}} — fell to the standard branch, where script and params are interpreted flat keys the override collector drops. So every dotted material write on a scripted material handed the writer a value it silently gutted to {key, params:{X}}: script ref gone, all sibling params gone, and a script-less key:"Scripted" renders as the Std/PBR default. That is exactly the merge properties.ts's flat-echo comment promises the echo exists to serve ("Readers feed dot-path writers … dotted setObjectProperty merges"), and the same lossless round-trip contract material-utils.ts pins for standard materials (ledger #173). It hit Savi three times in one session across spellings (material.params.* twice, material.script.params.*) — dump e3b929c6 carries five shaft-n-* prisms persisted as {"key":"Scripted","params":{"gain":1.5}} after the v116 receipts show the full 8-param scripted material: jacob's solid violet slabs. Two changes, one mechanism: (1) normalizeMaterialSpec round-trips both scripted spellings — object-shaped script.ref accepted, top-level params folded over script-carried params (the top level is always the newer write, since dot-path writers deep-set the spec spelling there) — which also repairs the tween-evaluator and god-mode gesture-commit lanes that re-apply the flat read-back through the same normalizer; (2) the dotted grammar canonicalizes material.params.* → material.script.params.* when the current material carries an object script (the model.materials → parts move), so the merge lands beside its siblings, the mirrored spec stays in the one persisted shape, and getProperty("material.params.X") answers what the write landed (read/write parity, both halves share canonicalScriptedMaterialSubPath). Whole-material assignment is untouched — replace stays its meaning. Red-first: the three dotted spellings, the v116→v119 persisted-spec fixture (full material before, dotted write, full material after minus only the addressed leaf), the whole-replace pin, and the mirrored-shape reload path (applySpec re-applying {key:"Scripted", script:{ref, params}}), all red on the old normalizer. Not touched here: a gutted legacy {key:"Scripted", params} with no ref anywhere still folds key-only (no ref to recover), and the b2 half of the dig (reversed smoothstep edges emitted verbatim to WGSL) stays open.
• The merge contract is now pinned for EVERY dotted subtree, not just material (jacob, in-thread 1787363264: "that foot gun is insane. remove it for all cases not just this one"). The general contract: a dotted setObjectProperty("<parent>.<leaf>", v) changes ONLY the addressed leaf of the parent's echo — every sibling the reader echoes survives — while whole-subtree assignment stays a replace. New census suite (dotted-write-merge-census.test.ts) probes 17 families generically (read echo → dotted-write one leaf → read again → after must equal before with only that leaf deep-set): feetPosition, scale, primitive, material (echo-space), text, sprite, sign, light, audio, particles, fx, physics, visibleRange, jiggle, layout, npc, mixer — plus the families pinned in their own suites (rotation euler leaves, model parts/materials, animated3DCharacter part materials). Census verdict: buildDottedPropertyMerge merges by construction — clone the reader's echo, deep-set the leaf, hand the whole parent to the writer — so the replace-instead-of-merge class only exists where a writer's normalizer refuses the reader's echo and drops what it doesn't recognize; the scripted material was the one live instance in the registry, and the census pins each family against that asymmetry returning. Named bound on the census: attachment (writes ride the parent verb), scatter (template arrays — dotted indices are not part of the taught grammar), ik (channel values carry no sibling records), spline (writer runs the preview pipeline a bare test world doesn't host).
• setParent/attachTo grow a keepWorld: true option (r-0752ba7b, jacob's brazier dig 3acd7d3f §2) — the world-preserving adopt, three.js attach() semantics. Unspecified position/rotation/scale now default to the local values that keep the child's current world pose under the new parent (rotation/scale invert the parent frame up front; the position leg converts through resolveWorldFeetPositionWrite after the link lands, so pivot folds and socket/part anchors peel exactly as the hierarchy solve composes them). The snap default is unchanged — the equipment idiom and the spec parent write lane both rely on it. Frames with no honest conversion (bone attachments, camera subtrees, ~zero parent scale axes) refuse loudly before any mutation.
• The private-transport port's admission bar fails OPEN on an absent generation stamp — the port-protocol skew class dies structurally (dig d75f7599, 2557's second lane). The worker's PrivateClientTransport gate (row 2515, 37f6a0c080) was fail-closed on ANY mismatch — if (message.generation !== this.dialGeneration) return; — but the headless room-host shell BAKES the bridge into the container image and DOWNLOADS the worker per room pin, so the two halves of a protocol designed as one bundle can ship from different builds. The pinned b5f063f48e-era image's pre-stamp bridge posted {type:"open"} with no generation; 5.2.31+ workers read that as undefined !== 1 and silently dropped every open/message/messageBatch/close — open never flipped, the hello could never leave, the 4408 close never reached the reconnect ladder, and the summons parked 180s to exit 6. 24 apps wedged for 4 days; no engine pin could fix it (every post-2515 worker carried the bar, and the stale bridge couldn't answer it). The cure per the dig's fix-shape: generation !== undefined && generation !== this.dialGeneration (staleGeneration) — an absent stamp proves the far side predates stamping and is delivered; a mismatched stamp is still a superseded dial's late flush and still drops. The 2515 protection stands whole: in browsers both halves ride one bundle so absence never occurs, and the stale flushes the stamp exists to kill only ever arrive STAMPED from a post-2515 bridge. Red-first: unstamped open/message/messageBatch/close from a hand-posted legacy bridge reach the client (red on the fail-closed bar), a mismatched stamp still drops, a matching stamp passes (room-transport-bridge.test.ts). The protocol doc now names the reader-leniency law: every wire-shape change owes the question "what does the OTHER era's half do with this message?". Ships with the trigger half of the same PR: container-build.yml's auto-advance path filter (and container-image-drift.yml's lineage twin, lockstep) now watches the baked↔downloaded port-protocol seam roots, so a protocol change recooks the image instead of drifting under the pin.
• Player-behavior api.sql on relay-hosted singleplayer rooms no longer dies at the relay egress' dead-lane drop — the forward gate is tri-state honest (ledger 2438 P1, medivhus's Cardhouse; field kin: the Grind95 save write lost in a host-flap window, 08-19). The forwarded GameDB door's eligibility gate (tome/api/game-db-forward.ts isGameDbForwardEligible) read the 2-state live wire sniff (clientWireMode !== "relay"), and the sniff's "undetermined" hold — the first-frame window AND every between-sockets redial (rejoin, suspend/overflow re-bootstrap, host-election flap) — stayed forward-ELIGIBLE by documented design. Every behavior api.sql issued in a hold enqueued a SqlRequest the egress deferred, and the welcome proving relay dropped the whole backlog typed at the dead-lane drop (game-db-forward.ts rejectDroppedForwardedGameDbCall — "GameDB door forward has no lane on this wire"). On Cardhouse (singleplayer pin, relay-hosted dev room-1) the window read permanently open across three engine versions: 100% of player-behavior SQL dropped while the DB sat provisioned and healthy (migrate_applied=1134), so the creator's all-truth-in-SQL game ran stateless for players. The cure per the row's own prescription: the gate now reads clientRelayWireTruth (the pin-04da3c48 pattern netcode's travel-authority forks already use) — the live sniff when determinate, else the welcome-edge stamp (ClientRelayWireModeResource). A stamped-relay world in the hold falls through to the relay lane, whose posture is composable there (the relay identity survives socket bounces) and whose pre-send park (ledger 2381) holds the call replay-safe until the session opens — hold what can be held. Fresh worlds whose wire never proved relay (stamp absent) and kernel-stamped reconnects keep today's path exactly; the egress dead-lane drop stays as defense-in-depth and now fires only on a fresh world's pre-first-welcome window or a resolution regression. The security boundary is unmoved: relay wires still carry no control-channel door, and the diverted calls ride the relay player lane's existing digest-and-verified-identity argument (or the room_host lane on a credentialed seat). Red-first in game-db-forward.test.ts: the between-sockets fixture (stamp relay, sniff undetermined) resolves the relay lane, parks, and SENDS when the wire opens — nothing touches the dead control lane; the kernel-stamped hold keeps the forward lane.
• Road width arrays are honored per-point — the schema's existing promise, kept instead of averaged (ravi's vocabulary datum from the #13374 teaching-child; 5.2.34 rider). SplineSpec.width has always typed number | number[], but resolveRoadVisualWidth (spline.ts:1142) silently averaged an array to one scalar — Savi writes width: [2, 8, 2], gets a uniform road, no error (the #13371 build was fooled exactly this way; ravi's fix-forward taught around it in world-composition.md, now reverted). The road surface now lofts a per-frame half-width: width[i] rides points[i] (clamped to the last entry, like rolls) and interpolates linearly by arc distance between them, through the same buildPerPointDistanceSamples parameterization the rolls channel uses — one mechanism, two per-point channels. Roadside features track the varying edge (edge lines, sidewalks, hedges, and lamp posts all take their lateral offset from widthAt(distance)), and the collider is definitionally the same mesh (custom-primitive physics reuses the surface's BespokeGeometry), so collision follows the taper — the lie can't move. Scalar and uniform-array roads are byte-stable: a cross-revision dump of a full-roadside scalar road (16 generated entities, 8 geometries, curving 3D centerline) diffed byte-identical against master. Invalid array entries fall back to the average of the valid ones; an all-invalid array keeps DEFAULT_ROAD_WIDTH — the behavior arrays always had. Red-first pins in spline-road-per-point-width.test.ts: [2, 8, 2] narrow-wide-narrow at the authored points plus an interpolated midpoint, scalar ≡ uniform array, edge lines hugging the varying edge, and the collider-is-the-mesh agreement.
• A confirmed spec save is now a head claim — the stale-refold resurrection class dies (ledger 2599 P1, cal's god-mode resurrections: thread 1540752985330819262, dig 1580caec). On relay rooms, the spec-save confirm (kiln:spec-save-result ok) splices the batch out of pending custody (relay-spec-save.ts onResult) — the instant the fold-rebase overlay stops protecting the write — but DISCARDED result.version: nothing recorded "my write is folded into every durable version ≥ N". A client on the F3 heartbeat-beacon fallback lane (relay-join.ts onHeartbeatPointer — which re-states the RELAY's checkpoint, one version behind the client's own just-confirmed write by construction, and cal's ONLY spec lane: 31/31 SPEC frames missed on the ring) would then fetch and fold the PRE-write doc, and applySpec's spawn pass re-materializes any spec row with no live entity (interpreter.ts: !world.hasEntity → spawn). Tree deleted at v21943; the beacon folded v21942; tree back ~3s later — on tape twice in the ECS capsule (two #delete:click destroys of the same id, 3s apart, zero inputs between). The cure per the row: the ok verdict's saved version now feeds the SAME spec-claim door SPEC frames and the F3 beacon share (RelaySpecSaveScheduler.onConfirmedSavedVersion → netcode → transport relayNoteSpecSaveConfirmed → relayJoin hooks → RelayJoinCoordinator.onSpecSaveConfirmed → armSpecClaim), so the client never folds a doc older than its own confirmed write: an older beacon can never displace the claim, an in-flight older fetch discards on resolve (the existing supersede check), and once the confirmed version folds the adopted head covers everything below it forever. Claim lifetime is untouched — room-lineage scope, survives socket bounces, dies at resetForNewRoom — and at-or-below-head confirms are covered no-ops, so the ordinary lane (own SPEC frame already folded the post-write doc) fetches nothing. Red-first against a real tome world (real fold-rebase, real applySpec spawn pass): the tape (delete confirms at vN, the beacon names vN−1 — the entity must not respawn), the crossed sub-ordering (pre-write fetch in flight when the confirm lands — resolve discarded), folds above the claim passing untouched, and resetForNewRoom clearing the claim (relay-spec-confirm-refold.test.ts; scheduler-side verdict pins in relay-spec-save.test.ts).

technical notes

• A failed boot-critical dynamic import gets ONE cache-busted retry before boot death (tiger's onboarding dig 5b47a1e5, fix 1; 5.2.33 cargo). The client entry's engine-chunk imports (worker-browser-host, client-sight-frame in loadCreateBrowserAppHost) now run through importBootChunk: on a module-fetch rejection (Chromium/Firefox/WebKit shapes matched by message), wait a 250–500 ms jitter, then re-import the failed URL with ?retry=1 appended — a request no poisoned intermediary cache (and no memoized module-map failure) has ever seen. WebKit's URL-less rejection falls back to re-invoking the same specifier once. A second failure rethrows with " (after retry)" appended, so the [kernel] Startup failed console line distinguishes retried-death from one-shot-death; evaluation errors (module loaded, then threw) are never retried. Exactly one retry, no loops — the burden of proof (the dig's receipts: transient edge 502s, ~10 events/3 sessions/day, same URL 200 seconds before and after, always a first open) lives on the helper.
• Child transform ownership: a parented child's Local* is AUTHORED truth and the client local-transform projection can no longer overwrite it. The projection's default flipped from "re-derive Local from World for every parented child, minus four excused guards" to two explicit jobs — SEED a Local lane whose row hasn't arrived yet (wire ordering), and OWN the lanes of dynamic-bodied children, where physics writes the world pose and local is genuinely derived (physicsOwnsPose, one rule shared with the hierarchy solve). The god-mode-drag, stand-rider, and bone-subtree guards are deleted — each was one more authored-row case discovered the hard way, and the default now covers them (the stand-parent seam test flipped from negative control to positive pin). Root cause this kills: one tick of parent/child frame incoherence (a reload's journal-restored hull vs its spec-seeded children) was divided into the child's local offset and became permanent — vehicles reloaded scattered and rode rigidly-wrong forever (reload-scatter-repro.test.ts, red pre-fix with the exact predicted arithmetic).
• A translate drag's x/z base is the press-time LIVE feet, never the spec row's (tucker's drag-teleport, walk thread 6:07pm 2026-08-20; 5.2.33 cargo, the 5.2.32 cut predates it). The translate pad and the spline spline:move pad based their slide on the spec row's terrain-anchor x/z (authoredTerrainAnchorFeet → getObjectSpec). On a relay client the doc row only advances when a save's fold echoes back — release commits ride the accumulator → flush → kiln, never the local doc — so the row lags the hand by a whole save round trip, and every translate drag writes the terrain form { x, z, y: { terrain } }, arming the anchor read. Once the first save echo landed (~3–5s into a drag chain), every later press captured the LAST SAVE's x/z as the slide base and the first drag frame teleported the object there + ray delta — degraded for the rest of the session ("EVERY time you drag and release it will like teleport … snaps back roughly to where the save was"). The authored anchor now supplies ONLY the vertical pin (offset + write form), which is all cal's Final Abyss burial fix ever needed from it; the commit seam's zero-move rule (GESTURE_LIVE_FEET_KEY) already keeps an idle touch from baking the f32 live base, so no ulp-smudge returns. Pinned by drag-chain-release-commit.test.ts: the full relay-client loop (god-mode gestures + persist flush cadence + forward recency + simulated kiln fold/echo) runs a six-gesture drag chain with saves landing mid-drag — red on the old base (release at x=8 lands at 4: the stale anchor 2 + drag delta), green now, with every release's save minting and live/doc/durable converging on the drag's end. Named residual, same family, out of this pin's scope (self-healing in one round trip): a stale echo landing un-held after the recency horizon expires transiently reverts the live position until the client's own save echoes back.
• Geometry fit re-solves on the hostship-gain edge (ledger 2566 — the 45.7m giants on every post-boot place expansion; live-verified in 46bfb1da's rig on master and 5.2.31). On a relay client the boot applySpec builds EVERY place's entities (client mode has no residency filter), and the fit drain runs before the election names this client host of anything — the observer gate consumes the TomeLayout dirty marks as bookkeeping (correct: no local GeometryScale write while another realm simulates). But nothing re-marked when hostship arrived: the header's promised rescue ("the first host's hydration seed re-marks and solves it") did not exist on the relay tier — the only seed runs at feature mount, long before hostship — so entities built while observing NEVER solved fit after the client became host, rendering at raw × authored scale (local=3.808, geom=NULL, world=3.808 for the whole session). The cure is the fit half of scatter-host-redrive's gain edge (ledger 2194's detector — one edge detector, two redrives, no second WeakMap family): on the edge where a place is GAINED, remarkGeometryFitForHostGain marks every fit-bearing entity and the same tick's drain solves it. Over-marking is free — writeGeometryScale identity-skips values the replicated rows already answer, observer marks are consumed as bookkeeping next drain, and on the gain edge this realm IS the simulator, so the single-writer treaty holds. The false header sentence is corrected in the same diff. Pinned red-first in geometry-fit-host-gain.test.ts (apply while hosting nothing → drain → GeometryScale correctly absent → TomePlaceHosts names the local client → tick → GeometryScale 0.2251).
• api.updatePlace's live application now applies { merge: true, chunks, removedChunks } field deltas with the same incremental arithmetic both durable folds use (spec-mutation-fold's mergeFieldChunks, now shared by import) instead of installing the delta as the whole field — a partial-update-shaped write no longer wipes the live field while the stored copy stays correct (dig 5d20101b, ledger 2583).
• Middle-mouse edges reach the ring (r-83fc347c dig on @jissi/blood-and-mead 660e9c3e — five Savi hardening rounds proved the script maximally defensive before the dig found both seams engine-side; 5.2.33 cargo). Two seams in raw-capture.ts, red-first in middle-mouse.test.ts. (1) The r-c5a11032 claim extends to middle: a game binding middle — on: "Mouse1" or a requiredMouseButtons combo modifier — claims the button's browser defaults for the session: preventDefault on pointerdown/up + compat mousedown/mouseup + auxclick (Windows-Chromium autoscroll engages off the unprevented compat MOUSEDOWN, auxclick carries its own defaults — paste, link-in-new-tab — and the pointer event's cancellation reaches neither), gated only on the claim, never on target or mode. Unbound middle keeps every browser default; the side-button claim rides unchanged under the renamed deriveClaimedMouseButtons/setClaimedMouseButtons. (2) The pointer-lock-loss desync closes: handlePointerLockChange cleared heldButtons/mouseButtonsHeld on unlock without appending MOUSE_BUTTON_UP, so the sim's mouseButtonsDown kept the button until the next RESET — the physical release over UI died on releaseMouseButtonIntent's !heldButtons.has gate, a hold binding wedged (works/stops/works-again by construction — chat/blur un-wedged it), and syncMouseButtonsFromMask couldn't heal it because the main-thread set was already empty. Held buttons now SURVIVE the unlock and the real release flows through the paths that already exist: the canvas-begun-drag carve-out (an up over UI passes while heldButtons has the button), the buttons-mask heal, pointercancel, and the blur/visibility RESETs. Deliberately neither alternative: a synthesized UP fires activeOn:"keyup" bindings (processMouseButtonUp pulses unconditionally — Esc toggling the lock would fire actions the player never released), and a silent RESET sweeps held movement keys whose keyups still arrive (lock loss keeps key focus). Rider: the docs generator's InputActionDef prose line finally lists "mouse4" | "mouse5" — the r-c5a11032 tokens never joined it. Teaching-lane note (the spec is the creator's, not ours to edit): Savi's field patch comment in blood-and-mead's carry.js teaches a false engine model — "the engine honors one source per action" — buildDefaultBindings compiles keys AND mouse AND gamepad each to a live binding for the same action; every future dump read of that comment re-teaches the wrong shape until corrected.
• Rescue-class world-lane writes unparent first (the OOB writer contract — golf-pack 2af2f101 flag 1 on #13317; 5.2.33 cargo). The two engine writers that teleport possibly-parented bodies — the out-of-bounds respawn (respawnBodyAt, tome/systems/out-of-bounds.ts) and the terrain chunk-rescue (setRescuedFeetPosition, terrain-systems-shared.ts) — now detach the target's TomeParent edge immediately after the world write, so the detach rebases Local* to the rescued pose itself. A bare world write onto a still-parented rider never meant "rescued": the client local-transform projection divided it into a parent-relative Local* (the respawn point re-read as a seat offset — the Purr Putt dump f16eccb2 cat welded under the buggy), and under #13317's seed-missing ownership rule the same write becomes a silent no-op (the next hierarchy solve recomposes World from parent ⊗ local). Unparent-first is upstream of that divider, so the contract holds under both projections. The detach is one primitive, extracted from ObjectAPI setParent(null)'s null branch into tome/hierarchy-detach.ts — one implementation behind the script lane and both rescue writers, resolve-tolerant for the engine-only worlds the chunk-rescue also runs in.
• The platform's pointer-lock cursor dot (kiln's FakeCursor — host chrome's stand-in for the hardware cursor while the game iframe holds the lock) is now hidden-until-movement: a fresh overlay attach re-anchors it at viewport center INVISIBLE, and it renders only once the player actually mouses the overlay while visible-eligible (overlay open + locked). Motion means the player needs the pointer; lock-and-look crosshair games never move it, so their players never see a platform dot over the game's own reticle (savi platform-gap r-990382a0, app e742374d). No authored key — the earlier camera.pointerLockDot draft was withdrawn because authored-off would blind the overlay's only pointer in exactly the state it exists for; the default is now right structurally. The movement gate reads only the engine-relayed movement deltas (computed inside the engine's own accumulated cursor space), so the attach re-center and the unlocked snap-to-real-coordinates — re-anchors, not motion — can never fake a reveal, and the reveal rides the same call stack as the first qualifying move (no added latency). Lock loss and overlay close reset the gate: every re-anchor returns to hidden-until-movement.
• The relay's cross-mode-room join refusal becomes a client reload verdict (#13303 residual; 5.2.33 cargo). The split-brain belt refuses a LIVE-surface join addressed at the dev-coordinate twin of its room (a prefix-less legacy id whose live- form kiln's rooms.mode registry names a real live room) with RELAY_CLOSE.crossModeRoom (4412). The one honest producer of that address is a stale pre-13303 kiln PARENT bundle — fresh loads normalize at buildWebSocketUrl, and disconnect-rejoin remounts the iframe, never the parent that mints the URL — so nothing inside the iframe can heal it. The engine client maps 4412 as never-retry (room-runtime's close table: every redial re-asks the same stale parent for the same wrong URL), and the host answers with two moves: spawn:kernel:reload-verdict to the parent page (kiln's reload-verdict relay performs a full window.location.reload(), loop-breaker bounded — the reload picks up the fixed bundle AND lands the session in the live room) and an error wall carrying terminalBootCondition: stale-bundle-reload for parents that predate the handler (boot-stall stands its remount ladder down; the copy names the manual reload). Pinned by room-runtime.test.ts (4412 never retried, reported willReconnect:false) and relay-side by marker-door.workerd-test.ts (refusal + relay.cross_mode_join_refused + fail-open on an unregistered twin).
• God-mode undo/redo commits on the relay tier (dig 32d6b57b — Cal's hollowmass, hm-pen-16). undo()/redo()'s client branch was prediction-only by design: on the kernel tier the server world drains the same replicated god:undo input and runs the authority branch, so the client's ECS-only apply is exactly a prediction. The relay tier has no server world — the relay-wire client IS the god-mode persist authority (isGodModePersistAuthority) — so the prediction was the only run and no structural undo ever reached the doc: every ctrl-z restore of a deleted object vanished on reload (game_specs receipts: the delete sweep landed at v21840, zero re-adds ever). Now a relay-wire client takes the authority branch — full spec-mirror bookkeeping plus the mutation enqueue, which leaves through drainTomeSpecMutationQueue's relay forward and kiln's fold, batched (undo of an N-row cascade is one enqueued batch, chunked by the existing 8192-count forward), and the restore carries the FULL captured row: behavior, state blob, tags, model. Kernel-tier clients keep the prediction-only branch byte-for-byte (a local enqueue would double-record against their server's run). Also fixed in the same seam: the authority branch's durable respawn mutation is now place-stamped (mirror of durableSpawnSpec/commitObjectIntoSpec) — the captured row is place-stripped by mirror convention and kiln's fold resolves a placeless NEW row to defaultPlace, so an undo (or redo of a spawn) in any other place restored the row into the wrong map on reload, on every tier.
• Relay client worlds simulate NOTHING before Ready (ledger 2557's root-cause cure — the crownfall zombie-simulator dig 998860d4; 5.2.33 cargo). A wedged builder-body summon is a full engine client by construction, and its pre-Ready world holds only checkpoint/journal fossils — a host table naming its own stable clientId at a dead epoch, a suspension row still stamping a player who is live elsewhere. The simulate-when-unknown authority defaults let that world adopt hostship from the fossil table and (through the stale suspension row skipping the owned-by-client exclusion) a LIVE player's whole envelope: a stale simulator for up to its 180s watchdog window, on a summon loop, whose state writes fan to the room as ordinary keyed heads — seele's four divergent player copies. The cure flips the default at the two derivation sites: getLocallyHostedPlaces answers empty on a relay client world that has never applied its relay Ready grant (so the exclusion word can never read host-simulated — simulation now requires a POSITIVE authority fact: own envelope, local client-realm spawn, sim lease), and shouldSimulatePlaceHere's no-local-player mode-both lane is closed on the same worlds (that lane is the container/harness affordance). The Ready latch is the welcome-edge wire stamp (ClientRelayWireModeResource, written per determined Loaded welcome and kept across socket churn — a Ready world keeps its scope through reconnect outages); the realm test is the transport's live wire fact (ClientWireModeResource, moved to the netcode-transport leaf beside its type so control-utils can read it without a cycle through relay-world-sync). Kernel/container tiers, singleplayer, and bare harness worlds keep their semantics byte-for-byte; the legitimate suspension takeover is untouched (relay hostship is only AUTHORED at session-live, past Ready — the takeover test pins the post-Ready lane still granting).
• Sim-cost attribution reaches the exec seat on player-hosted relay rooms (r-f67665bf — Savi's platform-gap from Nine Heavens 330e6aea; 5.2.33 cargo, the 5.2.32 cut predates it). Three pieces, all routing existing measurements: (1) behavior-update's timing gate widens to multiplayer client-auth tabs — under client-auth every update a tab runs is its own simulation duty, so the elapsed the watchdog machinery already shapes now feeds SimAttributionResource there too (per-script rings, keyed by script file name; the budget watchdog stays authority-gated — attribution never parks anything). (2) The client perf report (engine.perfAttribution) carries per-script cumulative window ms (sim.top[].totalMs), the behavior-crossing census (behavior: totalEntities/updatedEntities/scheduleSkippedEvery/scheduleSkippedNear — behavior-update's existing per-tick debug resource, one get per report), and hostedPlaces (whose sim the rows attribute). (3) A relay lane (relay-perf-attribution.ts, the client-sight idiom): getPerformanceSnapshot()'s arm fans an EPHEMERAL perfmeasure-request to every member, each arms its own bounded reporter and remembers the asker, and reports return as DIRECTED EPHEMERAL frames consumed into the asker's local mirror through the same validate + rate-limit door the kernel command lane runs — engine.perfAttribution's relay lane flips "none" → "local" (consumed at egress, never journals, nothing sends while nobody asks). Kin 2422 (getClientHealth self-only on relay rooms) is the same lane shape — an always-on sibling would fan engine.clientHealth the same way.
• Worker self-stall no longer reads as wire silence (dig 8e92f5ac: playtest-3/tophat — a 33.7s sim tick on a starved CPU minted close 4440 and remounted the iframe twice). The runtime worker's sim-health monitor now remembers its most recent blocking tick (lastSelfStall), and the upload ack-liveness heal consults it beside the existing row-2515 page-thread hold: a self-stall of at least one heartbeat cadence that ended within the current bound means the measured ack silence was unobservable (our own loop couldn't send heartbeats or process acks), so the verdict HOLDs and re-arms instead of closing. A real ack death still condemns one full bound after the wake, judged on observable time only.
• The texture bake watchdog discriminates starved from wedged before killing (same dig: three kill-all waves = 46 bake retry-failures on one starved session whose scripts baked clean minutes later). Zero progress across BAKE_WATCHDOG_MS is now a PROBE, not a verdict: the transport pings the worker, and only a ping unanswered for BAKE_WATCHDOG_PING_GRACE_MS (10s) is a wedge — a starved worker answers late (the bake pumps one budget slice per macrotask, so its loop stays alive) and just gets a re-armed window. A genuine kill fails ONLY the wedged bake; queued bakes carry across to the fresh worker instead of mass-failing.
• Back-face grass shades like the carpet again: the two-sided normal flip no longer touches terrain-sampled normals (dig f78408c1, jacob's dark-grass thread 1787353911; 5.2.33 rider). Grass/sprite decoration cards deliberately shade with the placement sampler's terrain up-normal (decorationSamplesTerrainNormal — the classic "grass shades like the ground" trick), but the decoration fragment applied its two-sided GEOMETRIC flip (N *= select(1.0, -1.0, !front)) to every variant — so each back-facing blade pixel was lit with a normal pointing straight DOWN: zero sun at dot(N, L) ≤ 0, the ambient hemisphere at its darkest direction (the sky-v2 starter's SH probe IS the ambient), black blades salted through the meadow that swapped sides with look direction (tucker's view-dependence datum). Fixed in both lanes: the fixed lane forks at WGSL emission (variant.terrainNormal ⇒ no flip; geometric variants keep it — compile-time, zero runtime cost), and the scripted lane — where the normal choice is per ITEM at runtime (item.fx.w; one shader serves the whole layer) — gates the assemble.ts flip in the fragment via the new vertex-path keepBackNormalWgsl seam (frontFacing || (item.fx.w > 0.5)), with the item uniform made fragment-visible in the scripted group-3 layout. Red-first receipts: WGSL emission pins (decorations.test.ts, decorations-scripted.test.ts — red on master's emission), plus the new real-device gate scripts/verify-decor-backface (verify-terrain-jitter mold, production pipeline + card geometry + record ABI on the L4): on master's flip the back-face blade reads centerLuminance 0.0037 vs front 0.3857 (the black blade, on silicon); post-fix 0.3827 ≈ front (the carpet property), and the geometric control (0.278, lit only BY the flip) held in both worlds — the fork's other side keeps its viewer-facing flip.
• Game UI can save files: allow-downloads graduates onto the realm iframe sandbox (r-19dfda8a — Savi's platform gap, Story Builder ee0eeb9f; 5.2.33 cargo). REALM_IFRAME_SANDBOX lacked the token, so the sandboxed-downloads flag refused every authored export — Story Builder's Export window (Blob → URL.createObjectURL → a[download] → click inside a real user click) SILENTLY no-opped: no throw, no event, no file, nothing script-observable (the silent-no-op family). The graduation is one token; the security shape is measured, not assumed, in the new browser-gate suite tests/browser/suites/realm-download.pw.ts (chromium + webkit): (1) under the byte-exact sandbox a real click's Blob export fires the browser's own download — user-visible, cancellable, riding the browser's download pipeline; (2) a control frame with the token stripped stays download-free on the same real click, proving the token is load-bearing and pinning master's exact pre-fix no-op (red-first receipt: on master's tokens the suite reds with a 15s download-event timeout off a real click); (3) a documented-verdict SENTINEL: a first NO-activation programmatic click currently fires the download in BOTH engines — the HTML "allowed to download" check makes gesture-gating UA-optional and neither engine takes the option — pinned so a flip in either direction re-opens the decision. The jsdom pin in realm-manager.test.ts holds the exact token set (allow-scripts allow-modals allow-downloads) so every future sandbox edit is deliberate. Named residual (the filing's ask-2): a browser-refused download is UNOBSERVABLE from inside the frame — the click returns void, no error event exists, the refusal lives only in the browser's console — so no loud-failure machinery is buildable frame-side; the graduation itself removes the one refusal lane we controlled.

technical notes

• Geometry-wait parks re-arm on renderer-pause exit (dig 5b3d86d5 — derrf's hidden-tab rework). Three moves on the #713/#983 wait tracker, deleting the "creator returns to invisible walls until someone hand-nudges each one" class: (1) the report clock FREEZES while the renderer is paused (BespokeGeometryWaitTracker.pause()/resume() on the visibility edges + the boot-hidden path) — throttled-flow browsers keep delivering ~1Hz hidden rAF ticks through the mesh handler's collect (which runs above the present gate), so the 10-attempt/~3-minute report budget burned into frames nobody drew while the sim worker was itself throttled too slow to heal anything; hiding pauses the clock, never rewinds it (the frame-budget guard's law). (2) Renderer-pause EXIT (tab return) is a re-arm edge: one unpark-all sweep gives every parked wait — budget-spent and sim-verdict alike — a fresh report budget, because a hidden window is exactly when reworks land unobserved (a plausibly-changed cause, the tracker's own doctrine); a wrongly re-armed unhealable wait re-parks within ~one report cycle (ecs-sync re-classifies per report and re-sends the verdict at-least-once). (3) The parked population gets a getLogs face: a park episode raises one aggregated bespoke-geometry-parked diagnostic ("N generated mesh(es) are parked undelivered on this player's screen", full roster in data) — previously the budget-exhaustion park was console-only on the affected player's machine, reachable solely by per-entity identify_object interrogation, which is why it read as "the stale copy is served from spawn's side".
• An accepted god-wire spawn's live half is completed at the fold seam (dig 2431 — the #12074 mirror; 7 field specimens plus the multiwriter net's catch). The container room folds an accepted forwarded SpecMutations batch doc-only — foldSpecMutationsIntoWorld advances and persists the doc, deliberately running no applySpec, because the contract assumes the sender's simulating world uploads the created entities via StateDeltas. A thin wire client (anything that writes the wire without a simulating world — the harness gods, and any thin sender) never does, and every applySpec trigger downstream is foreign-gated (kiln skips echo-poking the author room, the self-echo stamp guard skips consecutive self-persists, and every doc-level compare is structurally blind to world↔doc divergence since the fold already advanced the doc) — so a doc-present/world-missing object stayed invisible to every joiner until the next foreign-authored write or a room recycle, unboundedly when neither came. Mirroring reapForwardedDestroyTargets ("the seam that authorized the destroy finishes it", row 2005/#12074): after fold+persist, every accepted spawn still missing a live entity after the same-flush grace (SPEC_MUTATION_SOURCE_GRACE_TICKS — a real sender's create row lands at preUpdate, before the −150 ingest, so real clients no-op) is BUILT by the server via a scheduled real applySpec of the folded head, whose reconcile spawns every doc-present/world-missing row — the exact cascade a foreign write used to deliver by accident. Idempotent both directions: entity exists → the hold resolves silently; server builds first → a late create row lands in the existing create-collision class (owner-idempotent update / host reparent). The invariant restored: a version the room stamps as self-authored is fully represented in its world.
• draggable="false" no longer reads as an interactive surface (ledger 2527 — Idle Homestead's dead desktop clicks on 5.2.30/.31). INTERACTIVE_SELECTORS matched bare [draggable] by attribute presence, so the ubiquitous anti-drag idiom on sprite/cursor images — an element declaring itself LESS interactive — entered the pointer-events grant walk. Since row 2437's whole-body 500ms rescue cadence (tap-actions INTERACTIVE_GRANT_SCAN_INTERVAL_MS) that walk reaches body-mounted elements, and makeElementInteractive stomped the game's mouse-tracking cursor sprite (<img draggable=false style="pointer-events:none"> on document.body) to pointer-events:auto — an interceptor glued under the pointer hotspot by construction, eating EVERY mouse press in the game (authored buttons and world taps both) while HUD, state, frames, and the control grant all stayed healthy. The selector is now [draggable="true"] — the only drag-positive form of the enumerated attribute, and already the engine's own vocabulary (frame/styles.ts exempts exactly img[draggable="true"] from -webkit-user-drag:none). Drag-interactive elements keep their grant; anti-drag sprites keep their authored pointer-events. The dead-link dim inherits the same narrowing (cursor sprites no longer dim as "controls").
• A model's death certificate must be earned (ledger 2395, dig abb254af — iz's wardrobe imported clean in 21s and was SERVING while the session read it terminally dead). The model lane minted terminal verdicts off ONE read-side transient: a single 502-without-Retry-After or a lone dead 4xx flipped the placard to "dead" (modelLoadVerdict) and put the asset in the eye's failed bucket, whose caption dressed it as "a receipted death, not a guess" — the confession instrument overclaiming (ledger 2306's verdict-honesty family, inverted face). The retry ladder was already the N-spaced-re-probes machinery; the defect was verdicts minted at attempt 1. Now "dead" requires earned evidence: the server's own fingerprinted terminal cook-kill tombstone (terminalParked), or a dead 4xx that answered EVERY spaced re-probe across the give-up window (deadParked — 10 dead answers over ~5 minutes). Anything short of that stays "waiting": the ladder keeps probing and a serving asset heals it on the next read. The unready atom names its evidence class (failedFact: "server-verdict" | "read-failure", plus failedAttempts — the measured N), and the scene-view note tells only what was measured: read-failure atoms get "could not be READ from the asset host — N reads have failed so far: a measured fetch failure, NOT the server's verdict on the asset … do NOT regenerate or rename", while the receipted-death/rename teaching is reserved for server-verdict atoms. Statuses are unchanged (no settle-gate shifts); the 2306 temporary split (retryInMs) is untouched. The attempt-5 retry-ladder diagnostic rides the same honesty (codex review): at that point no verdict can be earned, so it now teaches a measured read failure — loading placeholder, engine keeps retrying, "do NOT regenerate or rename it off this alone" — instead of claiming a "Couldn't spawn" placard and prescribing regeneration against the scene note's own words. When the read-failure bucket holds more than one asset, each name carries its own measured failed-read count (codex review: one shared maximum was a false sentence for every asset below it).
• Caster/mask model WGSL compiles on the gpu's latched survivor arm (dig row 2560 — filing d5efc458, app d8a0fb4a on 5.2.31). getModelShadowPipeline keyed models/shadow/static/depth16unorm/spull and declared the storage arm's layouts, but built the WGSL with the builder's DEFAULT vertex arm — which consumes @location(6) lumeSurvivorAttr: u32 with no attribute behind it. The GPU refuses the pipeline (WebKit: "vertex descriptor creation failed !matchesFormat(attribute(6)…)"), three attempts park it, and every static-model caster draw on a convicted device silently skips — shadows from unskinned GLB models missing while everything else renders. Only static-kind model content on the storage arm hits it (convicted WebKit/AGX devices with indirect-first-instance granted); getModelMaskPipeline carried the identical drift (no production caller today; fixed for consistency). Same commit fixes the draw-side twins that invalidated the encoder instead (rigid-child caster binding + identitySurvivorBuffer gaining STORAGE usage). Red-first class pin: survivor-arm.test.ts — for every pipeline the models family registers (3 kinds × color/caster/mask, both arms), every @location the compiled WGSL consumes must be provided by the descriptor's vertex layouts with a matching format class.
• No-op spec patches never enter the persist pipe (ledger 2551). Every patch-class spec verb already computed a no-op verdict (specDocChanged / the effective-view compare) and used it to fire specPatchNoOpWarning — but called recordMutation unconditionally, so a value-identical patchTerrain (the specimen: a behavior re-patching terrain to its current value, ~1 row/24s for 8 hours, app 3ad02cb1) rode relay-spec-save into a kiln version mint whose only diff was the __appliedSpecSaveRowIds ring: version history churned for hours and Savi's eye tools went EYE-STALE seconds after any read. The verdict now gates the recorder at every site whose verdict baseline IS the durable fold's baseline — applyTerrainSpecWrite (patchTerrain + the material/mark/structure verbs), patchPlayer, patchCamera, patchInputs, patchGodMode, patchUi, patchEngine, patchRouting, updateBuyable, updateJob, updatePlace (including the keyed-map objects branch, which now skips value-identical row upserts exactly like the whole-list branch always did) — each counting through the ledger-1157 noteSuppressedNoopScriptMutation receipt. The warn still fires: the no-op is told, it just isn't persisted. patchAtmosphere stays deliberately UNGATED: its no-op verdict is judged on the session-merged view (base + overrides) while the durable fold applies the patch onto the head's base alone, so an override pre-populated by a behavior would make a tracked bake-in read as a no-op and starve spec.atmosphere forever; behaviors never reach its recorder (no behaviorPersistSourceId), so no tick-loop churn reopens, and the kiln route floors its value-identical mints on the correct baseline. The kiln half (relay spec-save route: mutations mode gets the no-op refusal mirroring doc mode's identicalToHead — an all-no-op batch answers applied: 0 with no ring append and no mint, while one real change in a batch of no-ops still mints once) ships with the next web promote, giving older engine bundles the same floor server-side.
• The applied-generation record captures its residency/instance keys at expansion time — place re-entry survives interleaved applies (ledger 2145 leg-1 cure defeat, dump a812611d — Alliance of Darkness's black-box prologue). #12599's cure broke the delta-0 binding at unload (place-cleanup drops TomeAppliedGenerationResource), but any later apply re-records it — and the record's top-level residencyKey/instancePlacesKey were recomputed at RECORD-WRITE time while every other capture (the derive-gate inputs, the record's own expansion field) reads expansion time. A hook running inside that apply — onSpawn → api.enterPlace, the prologue session-script idiom routing every joiner — marks the unloaded place resident AFTER expansion skipped it, so the completed apply stamped a key claiming a place it never expanded: the parked placeResident re-apply (the re-entry's only materialization trigger) then hit the delta-0 short-circuit and the place came back permanently empty — residency marked, api.spawn landing without a not-resident warn, authored skeleton/state defaults/onSpawn all absent. The record now stores expansionResidencyKey/expansionInstancePlacesKey: mid-apply residency drift reads as a delta-0 veto, the drain full-passes, and the reconcile's missing-entity spawn materializes exactly what expansion skipped. A re-entry that accepts a traveler materializes the place. Pinned red-first in place-reentry-interleaved-apply.test.ts (the mid-apply defeat shape plus the unload→interleave→re-enter orderings).
• Render frame-rate cap primitive (creator ask r-8691b70e — Sangre y Vitral on an Adreno 619 at ~82ms/frame). engine.graphics.maxFps (integer 5..240, live on patch, null clears) is a ceiling the renderer paces presents to: a deadline pacer (renderer/frame-rate-cap.ts) gates the frame body exactly like the governor's 120 Hz half-rate pacing — steady spacing by schedule-anchored deadlines, stall re-anchor instead of catch-up bursts, sim tick untouched (determinism untouched). It min-composes with the player's own explicit cap (new resolved player-settings lane perf.maxFps, sanitizer-clamped 5..240; boot seed on the renderer init's playerPerf snapshot, live via set-player-max-fps — players may always go lower, never higher), and the quality governor's judged refresh target folds the same cap (setFrameRateCap, the maxRefreshTargetHz min): a 30-capped session is budgeted against 33.3ms — quality sheds only when the device can't make the CAPPED rate, up-probes stay live, and the capped cadence can never read as the environmental-throttle signature. Spec rail is the renderResolution grammar end-to-end: zod contract in tome-schemas, spec-sync → draw/frame-rate-cap client-plane singleton → renderer handler; the in-game FPS-slider menu itself stays the creator's script — the primitive is the whole engine surface.
• The synthetic-transform ordered rebuild buckets by depth (#13264 — the streaming-load sort term). getOrderedRecords re-sorted ALL records whenever orderDirty, with recordDepth walking the parent chain inside the sort comparator — O(N log N × depth) per streaming frame (504ms of an 11.2s load capture vs 39ms settled, renderer worker). Depth is bounded by MAX_PARENT_DEPTH, so the rebuild now buckets records by one O(depth) walk each — no comparator at all — and the ingest touched-sort memoizes depth into a scratch map before sorting. Ordering is unchanged: stable within a depth by map iteration order, parents still before children. Bench (scripts/bench-synthetic-order-sort.ts, 10k records in chains 3-5 deep, 120Hz frames): dirty-sort term 5.68 → 0.51 ms/frame; the settled path is untouched (early return unchanged).
• The HUD stale-compile heal and its receipt key on the whole require() closure, not the entry source alone (ledger 2426 face 3 — the lib-dep hot-reload miss). Row 2186's heal re-keys the game HUD's compile slot on the live doc's ui.render source and recompiles when the serving graph's uiSource lags it — but a save to a scripts/lib/*.js module the entry requires moves NO byte of the entry, so under a stalled apply lane the guard read converged, the compile receipt pinned sinceMs at mount asserting health, and the HUD deduped the old panel forever (Apartment 6B 26d489f5: three saves to scripts/lib/ui-directory.js under an unchanged ui.js, 52k+ dedups on one frozen sig, compile ok). CompiledSpec now stamps uiDependencySignature (the tracked dep closure's per-source signature, from the same dependency sets the compile already records — a Map hit, never a re-walk), the controller compares it beside uiSource and heals through the same content-keyed cache, and the receipt's sourceHash folds the dep signature in so sinceMs re-stamps on lib edits too — the receipt can no longer assert health while a dep-shaped edit serves stale. Graphs minted before the field existed read as "unknown — never heal on deps alone", so no healthy mount confesses a stall that never was. Pinned red-first in worker-controller.test.ts (the lib-dep stall shape plus the pre-field no-spurious-heal control).

technical notes

• The a3dc gait shim honors the seat contract (census 449f52a6 — kevin's walk-while-driving). Animated3DCharacterLocomotionFeature — the gait writer for every default player avatar — measured speed from world position deltas, so a rider parented to a moving hull (whose WorldFeetPosition hierarchy-solve rewrites from the hull every tick) read as running and got weight-1 walk/run channels rewritten against the script's seat clip; and it never read properties.npc.locomotion, so the documented seated-character switch worked on npc-loco bodies but not the player's own avatar. Now a parented entity gaits from its LOCAL feet-position delta (a mounted seat is stationary; a walk across a moving deck gaits as a walk — moving platforms and elevators come along free), the world-frame PhysicsBodyState read is skipped while parented, mount/dismount/re-parent frame changes forget prev-pos (no phantom sprint — the frame is the parent id, so a seat swap between two mounts forgets too), and locomotion: false releases the shim's idle/walk/run channels once and stops all of its writes — facing included — until re-enabled. The channel release is the shared releaseA3dcLocomotionChannels, one home with the model-write retire path.
• The renderer serves the base model where animated variants can't bake (kevin's local-dev orb, thread 1787165428). In an environment with no ardy motion transport, kiln answers every ?animations= cook with the structured config-absent 503 (base-flow ARDY_UNCONFIGURED_*, Retry-After 1h) — and the renderer parked the URL on that verdict, so the character never resolved: orb placeholder forever, in an environment where the base model serves fine. The 503 body now carries a machine-readable class (reason: animated_variant_unavailable, kiln ARDY_UNCONFIGURED_REASON); the engine's probe reads reason off 5xx bodies onto MagicCdnFetchError.rejectionReason and replays it through the verdict tombstone (a second consumer of the same URL classifies with zero network); and the renderer's model load, on exactly that class (isAnimatedVariantUnavailable — the structured reason, never the teaching prose), retries the same URL stripped of ?animations= with one honest warn line. Scope pinned by negative controls: an ordinary 503 keeps today's ladder, a dead 404 on the base model still fails honestly (one fallback attempt, no loop), and cold-cook 202s (the 2320 family) never trigger the fallback. Prod (variant available) is untouched — the fallback only exists behind a verdict prod never mints.
• Client-sight frame answers carry the room-feed freshness stamp (verdict d29f361d — the client-sight EYE-STALE hole). Scene-view already stamps every capture with the room-feed fact (ledger 2266; appliedSpecVersion since 2337), but the client-sight lane discarded it at the capture provider and ClientSightAnswer had no field to carry it — so the EYE-STALE belts that protect look/identify could not cover capture_client_frame, and an attached-but-frozen feed answered frozen pixels captioned "THEIR actual screen" with a fresh capturedAtMs. The stamp now rides the whole lane: ClientSightViewportCapture.feed → the main→worker hop outcome → ClientSightFramePayload.feed, sanitized at the wire door like every other untrusted field (a malformed stamp drops to the old-engine shape, never poisons the frame). The tool side (cf-studio-chat) refuses a stale-stamped frame with the eye_stale verdict — the transport face (feed state ≠ attached, with its age) and the version face (applied spec version lagging the doc head past the fan-out beat) — exactly the gates look and identify already run. Stamp absent (engines predating this) keeps the old behavior byte-identical.
• The row-2437 tap rescue is touch-only, and the interactive grammar never adopts a plane (row 2527 — msweep4 verdict 397ec807, ejthebae's Idle Homestead; his own A/B: same head spec, 5.2.21 works / 5.2.30 dead). 2437's five legs widened the pointerdown overUi verdict geometrically so the touch arbiter yields over authored controls — but the same overUi bit rides to the mouse lane, where it means "eat the world press" (raw-capture pressMouseButtonIntent returns on overUi before the ring append; the worker PointerState marks the press UI), and a desktop mouse has no claim bands to yield: the widening bought desktop nothing and killed pointer-only games' click lanes wherever any authored-grammar rect sat. Container-shaped matches made it total: a delegation wrapper (wrapper.onclick = fn), a cursor:pointer scaffold, or onMount delegation on the viewport-spanning game mount matched the widened grammar at plane scale, so every desktop press in the game read overUi:true — and the grant cadence then healed such wrappers to pointer-events:auto, turning them into native full-screen UI hits that ate the world lane for every pointer type. Three cuts: (1) input-forward's geometric DOWN widening applies to pointerType === "touch" only — mouse/pen presses keep the target-based verdict (5.2.21's classification, byte-identical); (2) tap-actions' fall-through adoption is touch-only (the rescue compensates the touch arbiter's theft and user-agent cancel claims — diseases a mouse never catches; script-wired controls still become mouse-clickable through the grant cadence), and the adoption heal skips delegation containers; (3) the grammar/grant walk never adopts a plane — engine UI planes (data-input-capture="ignore") are never authored controls, and the script-wired grant forms (handler properties, inline cursor:pointer, self-opts — the forms 2437 added) grant leaves only: a script-wired element containing other authored controls is a delegation container, its real controls are granted individually, and clicks still bubble to the delegated handler. Attribute-form grants (INTERACTIVE_SELECTORS) keep their since-forever behavior. All of 2437's own pins stay green: touch adoption, the iOS pointercancel verdict, the grant cadence, the arbiter yield over authored touch surfaces, and bare-canvas presses staying the movement stick's.
• A spec apply never stomps the spatial keys of a gesture-held entity (iz's rotate-then-move revert, thread 1786720296.462559, round 3). The interpreter's updateObject re-asserted authored feetPosition/rotation/scale over a live god-mode drag: a REPLACE apply unconditionally (rotationSpecChanged = replaceRestore || …), a normal apply whenever the incoming row differed from the applied generation. On a singleplayer client every other protection is structurally off at once — the ObjectAPI hold guard fires only on multiplayer SERVER worlds (gesture-hold.ts), the pending-edit overlay and flush-confirm rail arm only in room-runtime (the client is not the persist authority), and spec-sync's local-sim write mask is explicitly !isSingleplayerWorld — so an incoming apply landing inside the move-drag window (GOD_MODE_PERSIST_IDLE_SECONDS = 1 puts the rotate's persist round-trip exactly there) snapped the just-committed rotation back mid-drag; the drag closure re-writes feet every frame, so ONLY rotation visibly reverted. Now updateObject consults the gesture hold (resolveRefusingGodModeGestureHold, gated by an anyGodModeGestureHeld whole-world probe so gesture-free applies pay one store lookup) before the three authored-transform writes, on every world: the LIVE write is skipped while the hand holds the entity, the doc keeps the incoming value, the release commit persists the hand's pose for the keys the gesture owns, and the gesture's own updateObject calls (spline preview re-loft) pass through the withGodModeGestureWriter bracket. Pinned by rotate-then-move-apply-stomp.test.ts — replace and non-replace stomp lanes red pre-fix (180→90 and 180→45), with a non-held sibling restoring in the same apply and the post-release replace reset (ledger #296) as controls.
• The fresh-key annihilation fold (row 2493, the W5 wall's named follow-up — composes with spawner-churn-rebirth-lane-and-tomb-fold). The tomb-prefix fold left one standing tomb per dead cycle in the un-acked outbox, so a sustained fresh-key spawner still accumulated unfoldable entries toward the cap. foldOutbox now ANNIHILATES a whole lifecycle: a CREATE and its own DESTROY both still inside the un-acked window bracket an entity the wire never saw — nothing of it acked, so nothing of it journaled under this client's msgIds that a welcome retransmit could resurrect — and the birth, every intermediate row, and the death fold to NOTHING. Never across an ack boundary: the candidate test requires the entity's oldest in-window row to be its own create (e:{id}:@c), so an acked/departed birth keeps the destroy traveling (the wire saw the birth; it must see the death — the minimal tomb, with intermediates still folding under it). Whole-entry honesty runs to a fixed point: a family annihilates only while every entry carrying one of its rows folds entirely, so a family row stranded in a surviving batch keeps its tomb. Keyless barriers (commands, events, member-avatar rows) still confine everything to one segment — annihilation can never un-birth an entity a command was enqueued beside, and membership truth is structurally untouchable (member rows are keyless by the fold constitution). Rows that never journal never earn restatement promotion either — the flood dies at the source. Named residual: un-acked is not un-sent, so a create journaled with its ack in flight at socket death can lose its annihilated tomb; the orphan is a keyable non-member entity, exactly the class world-sync's liveIds sweep reconciles — the same crashed-author residual motion's restatement contract accepts.
• Pointer-lock loss is visible to behaviors (r-19126e01 — iz's Duskfall, savi platform-gap fceba168). The browser exits pointer lock on Escape and swallows the keydown, so the loss never reached gameplay code: PointerStateResource.isLocked was engine-internal, raw-capture handled pointerlockchange without synthesizing anything script-facing, and setCamera({pointerLock}) was a write-only lever — "first Esc opens the pause menu" was unauthorable (players pressed Esc twice). Two engine-injected primitives now ride the existing input lanes, no new wire vocabulary: the pointerLocked axis (1 in every sampled frame while the aim is the crosshair — the browser lock, or the touch aim pin; absent unlocked, where the input proxy reads 0) and the pointerLockLost action (pulses in the first frame sampled after the lock releases — every exit: Esc, releasePointer(), focus loss, cursor-needing UI). Both are injected by input resolution's buildFrame from the same pointer-resource read that already gates pointer coordinates off locked frames, so state, transition, and coordinates can never disagree within a frame; the pulse rides the frame's actions, so client dispatch, the server's permissive action lane, and client-auth resim all see it identically. Uncontrolled samples consume the edge (a loss with nobody to deliver to never synthesizes a stale pulse later). pointerLocked joins ENGINE_INTERNAL_AXES (mod-alias stripping, undefined-input notifier exemption), pointerLockLost joins ENGINE_ACTIONS.
• The place election's null-rank window is closed: an in-place real player outranks the headless builder shell even while its folded rank is null (ledger 2525 — the 2464-family's #13176 survivor; dump 4edec9f7). The #13176 cure ranked shells behind resident players by comparing rank streaks, so it never fired when the player carried rank:null — a folded hidden edge whose journaled visible heal was lagging (under the 2524-adjacent journal flood, for minutes) — and the shell's stale streak won the claimant tier unopposed. Exec routing follows the seat, so Savi's run_script landed on the shell's headless sim: 25-minute shell-held windows, builds into a world the creator could not see, four field incidents in one jam day. Now electWinner carries a PERSONHOOD tier between ranked residents and claimants: a real (non-standing-session), host-eligible resident wins the place over every claimant regardless of rank — the rank is a tiebreak among players, never a gate on personhood. The tier is judged by the same connectivity/tick overlays, and the tick gate is the working arbiter for the genuinely parked tab: beats are EPHEMERAL and never journaled, so they stay truthful when the fold lags — an audibly ticking resident holds the seat, one that decays past the 15s liveness window yields the place to the shell exactly as before, and its returning beat re-takes it. The shell still hosts every place EMPTY of real players (#13176's headless-builder case, pinned as the negative control). Room-truth mode closes the same window fold-purely (electTruthWinner personhood tier ranked by m:_ head seq; hasEligibleRealResident no longer requires a live rank, so an h:_ row assigning the shell over a rank-null resident degrades to the derived seat). Pinned by relay-place-elect-null-rank-window.test.ts end to end, exec lane included.
• Relay music no longer dies on head re-delivery (row 2504 — lazydev's "music got killed in the first second", dump 05485279). Every relay delivery of the TomeMusicState head re-rebases layer.startTick into the receiver's clock (relay-music-lane.ts translateMusicEntry), so a re-delivered anchor (journal restatement, world-sync) or a fresh publish (rematch duck, volume ramp) shifts it by a few ticks of rebase jitter — and music-client.ts applyLayer keyed the layer instance off (epoch, clip, startTick), beyond the component's own documented contract. A shifted anchor read as a new song: the live track retired, a same-clip replacement minted under a new voice key. On the stream lane (clips priced over the 16 MiB decode budget — every long track) the replacement shares the clip's ONE HTMLAudioElement and MediaElementAudioSourceNode, so the old voice's vanished-key teardown paused, rewound, and disconnect()ed the voice that had just started — ~0.2 s of music, then silence while music.now() (tick-derived) kept saying playing. Two structural halves: (a) instance identity is (clip, epoch) only, honoring music-components.ts's contract — a startTick delta lands as position truth through the existing per-frame deriveSeekSec re-stamp, never a retire+mint; (b) stream elements transfer across voice keys the way same-key retrigger already transfers release — only the element's CURRENT owner may pause/rewind it on teardown, and a voice severs only its own edge out of the shared source node (disconnect(node) instead of bare disconnect()). Class bounds: relay multiplayer × stream-lane music; singleplayer never rebases and buffered voices own independent source nodes (their suites unchanged-green). Kin: 2061 (relayAnchor), 2131 (relay free-run ticks), 2183 (the decode-budget size rail).
• Fresh-key spawner churn stops re-earning the restatement lane (row 2493 — the idle-zoo journal flood, tide's read after review 12302a2f disproved the juice hypothesis). The earned-restatement detector keys streaks per (entity, component), so a spawner minting short-lived entities at fresh keys re-paid the earn tax on every cycle — 2 journal rows per component per rebirth plus the create and the tomb, forever (~196k journal rows in one idle zoo session; the wall-5 saturation sawtooth that starved place claims and movers). Now a lane that died with a BORN-YOUNG entity (created and deleted inside RELAY_CHURN_REBIRTH_WINDOW_TICKS, 300 publish ticks) hands off by component name: the next entity CREATED inside the window inherits the earned lane on its first write. Both ends must be newborn — an entity of unknown or old birth re-earns from scratch (one-shot immunity holds for bystanders and organic lives), and only EARNED streaks (≥ RELAY_CHURN_PROMOTE_STREAK) hand off, never partials. Durability is unchanged in kind: inherited writes ride the same EPHEMERAL lane whose keyed create carries initial values and whose rest stamp journals final values on quiescence. Harness meter: a steady-state single-component cycle journals 2 rows (create + tomb), down from 4.
• The wall-5 fold learns the tomb's own reach (tide's named backstop). foldOutbox folded only same-key rows, so fresh-key churn — where no two cycles ever share a key — could never fold and pinned the un-acked outbox at the cap, closing admission on every real journal-bound publish. Now an older keyed row folds under a NEWER tomb whose prefix covers its key: exactly the supersession the relay itself applies when the tomb lands (journal.ts's TEXT-range prefix retire), one hop earlier. The tomb itself NEVER folds (every observer still learns the death; peers that never saw the folded create skip the unknown-id delete by design), keyless barriers still stop the fold, retag carriers still never fold, and a create's scrub prefix deliberately does NOT supersede — folding a despawn under a same-id rebirth would hide the death from live peers holding the first life (create-apply is an upsert, not a reset). Harness meter: 150 fresh-key spawn+despawn cycles under a black-holed uplink leave 177 outbox frames (one tomb per death + live world) instead of saturating at 256 with admission closed.
• Cold-atlas sprite swaps hold the last-good frame on every swap path — the loading rings render only where there is no prior frame to hold (seele's Ironbloom "flashy white", ravi's tape r-7246111b shape 1). A sprite quad already showing real texels must never route to the >2s pending-texture placeholder (the bright spinning rings, lume/sprites/shader.ts) when its clip/facing swap points at a still-cooking atlas — with gen-on-demand cooks the mixer multiplies the exposure (4 facings × 5 clips per unit kind). The draw/sprite path already held (the mid-fetch hold in applyComposedSprite — in every 5.2 engine since the lume port; ledger 1817 upgraded it on 07-28 from holding the texture atom to the WHOLE tuple, and either form keeps the lease bound, so no rings) and is now pinned by a mixer-shaped regression test (resolved-overlay ?animated= swap past the anti-flash window: held batch keeps resolvedMix 1, zero placeholder census). The hole was draw/sprite-instances: a swarm texture swap re-keyed every member onto a lease-less batch immediately, flashing the rings over quads that were already painted. applyInstanceSpriteSwap now gives the instances path the same hold — showing-resolved + cold target ⇒ keep the ENTIRE last-good draw value, subscribe once, apply the latest driver value whole when the texture lands; a swap reverted while cooking abandons its subscription so the late arrival can't flip the swarm. First paints never enter the hold (no lease to hold), so the loading affordance and the 2s SPRITE_PLACEHOLDER_ANTI_FLASH_MS window are byte-identical for genuinely new quads (sprites-store.test.ts anti-flash test unchanged).
• Texture-script refs never hydrate as sprite atlases (ledger 2520 — Route Zero, bran's image-load filing r-86d3cafc). A scripts/tex-*.js ref's frame/fps/clip truth is the script's own sheet declaration, pushed by the renderer bake (assets.scriptedSpriteAtlas) — there is no file to probe, so every probe fired at one could only fail, and its terminal report taught "regenerate under a different name", which mints a fresh scripts/ name that fails again (Route Zero climbed to ~60 dead names following that advice). The sim's atlas hydration door (SpriteAnimationFeature.ensureSpriteAtlasHydration — the intent lane behind sprite.animation, the frame-event dispatch, and both mixer lanes) now carries the same isTextureScriptRef guard its two siblings already had (sprite-metadata-hydration, the renderer worker's hydration door — the latter pinned by test, unchanged). The guard also kills the smart-inference fallback faking a 4×4/16-frame grid over baked texels for scripts/x.js?…&animated= refs (every mixer targetUrl composes that shape). Both resolveMixerClipTiming twins (client feature + getChannel/ObjectAPI) answer the honest nominal fallback for script-ref sprites instead of a fake-grid clock, a null-forever timing wedge, or the getChannel twin's doomed raw assetFetch that 404'd and latched failedAt for the whole session. The rename advice in the terminal atlas report is now unreachable for scripts/ refs (it remains correct for real magic-cdn names). Latch state was in-memory per worker session, so already-latched rows clear on the next reload/engine pin — no manual clear needed.
• State handles are forever-live — one entity, one proxy (ravi's kitty read, report 92a51b07 §3). The tracked-state membrane cached its proxy BY STORED BAG, so every whole-bag replacement — patchState's merge (state-merge.ts mints a new object), replaceState/setState, the changes-nothing gate's neighbors, replication ingest — silently froze every handle a script already held: reads served pre-patch values forever, writes no-opped (the old markUpdated closure checked current === state). Savi's Let's Go Kitty double-death was this bug (the revive patch's own s.invT read answered 0 on the very tick the mercy window was written; 73 edits never caught it), and the corpus models the const s = getState() top-grab 38 times. Now the cache is keyed PER ENTITY and the root proxy's traps resolve the CURRENT stored bag at trap time (a store-writeVersion stamp keeps read loops on a one-integer-compare fast path; overlay worlds resolve honestly per trap since staged writes never move the base store). Nested writes into containers that survive a merge also replicate now (the mark is no longer gated on the dead root bag). Terminal edge preserved: a despawned entity's handle freezes on its last bag. Bench (interleaved A/B medians, TRACKED_STATE_BENCH=1): getState() 179→159 ns (−11%), root write 200→192 ns (−4%), root read 70.7→74.6 ns (+3.8ns — the stamp check), nested read 115→125 ns. Pinned by tracked-state-forever-live.test.ts (double-death repro, replaceState/ingest faces, suppression-gate and identity negative controls).
• Client-realm scope reap is edge-driven instead of an every-tick world sweep (row 2537, leo's 470ms/tick sim). tome/client-realm-scope-reap used to walk every (TomeRealm, TomeSpawnedBy) row per tick and ask the authority-verdict cache — which clears on every epoch bump, i.e. on ANY spawn/despawn — so a 13k-entity world under active building cold-rewalked the whole ownership graph every tick (470ms of a 650-976ms sim). Scope exit has exactly three edges (wake handback, host revoke, owner AOI exit) plus birth, and every one is observable at write time: candidates now index themselves under every id their verdict walks through (spawner chain + link controllers), coordination-table writes (TomeSuspendedSessions/TomePlaceHosts/TomeSimLeases) re-judge all candidates, a despawn/spawn or authority-component write on a chain key re-judges exactly its dependents, and the non-component inputs (control set, local player/session, hosted-places identity) are O(1) compares per tick. clientSpawn materializations and god-mode tooling (direct tome/client-spawn root — a depth-1 permanent in-scope verdict) never enter the index at all. Verdicts are unchanged: dirty candidates are judged by the same isClientAuthLocallySimulatedEntity, so the ORBIT-17 orphan class stays dead. Bench (scripts/bench-scope-reap.ts, 10k static decor + 32 candidates under per-tick spawn/despawn churn): mean 8.20ms → 0.004ms per tick; at 13k, 10.74ms → 0.003ms.
• Verdict-close redial backoff (dig 31760db2 — the leo-class wedge loop's join-rate lever). The authenticated attach resets reconnectAttempts (the ledger-716 budget reset), so a session that attached and then died to one of the client's own self-heal verdicts — 4435 silence-watchdog, 4439 redial-fresh/ingress-overflow, 4440 upload ack-silence — redialed at the flat 1s base delay forever; the A1 escalation (ledger 2198) covers only pre-attach bootstrap failures. ClientRoomRuntime now keeps a short-lived-session streak: an authenticated session that dies to a verdict close while younger than VERDICT_CLOSE_SHORT_SESSION_WINDOW_MS (30s; the dig's wedge cycles measured openForMs≈11s) increments it, and scheduleReconnect floors the ladder's exponent on the streak with failRelayJoin's exact arithmetic (base 1000ms × 1.5^streak, capped at RELAY_JOIN_FAILURE_BACKOFF_ATTEMPT_CAP ≈ 25.6s, ±20% jitter) — downstream of the attach reset and the watchdog's fresh-budget reset, so neither flattens a wedge's cadence. A session that survives past the window resets the streak; a new room starts clean. Healthy paths are untouched: a one-off half-open condemn is a streak of 1, exponent 0, base delay. Expected effect under a wedge: the redial cadence walks 1s → 25.6s instead of holding flat — ~10-25x fewer joins against the same wedged room.
• The sandbox Math shim never quantizes ARGUMENTS — results-only f32 (tide's dig + fix 92a40e5bde; ledger 2317/2319's third face: the relay pen freeze, thread 1787035501). Math.sin(t * speed) with t from the relay tier's epoch-anchored room tick puts the argument near 2^35, where f32's ulp is 4096 radians — the old quantize-the-argument wrapper made sin a piecewise-constant plateau (~205s per value at speed 20). The script then wrote the SAME value every tick, same-value ECS writes are silent no-ops, and the zoo's kinematic movers froze on every client, twitching once per ulp crossing (witness v3 bit-exact closure: run-2 held y=2.974238872528076, stepped to 2.5244932174682617 at scriptTick 53615760384 — the model reproduces both bit-exactly, step time +48.2s predicted vs +47.96s measured). Arguments are f64 bit-identical cross-realm already (exact literals, correctly rounded native arithmetic, f32 replicated state, f32 shim outputs), so argument quantization bought zero determinism. Results of implementation-approximated members keep their f32 quantization; abs/sign/sqrt/max/min join the spec-exact native family floor/ceil/round/trunc already ride (ledger 2317).

technical notes

• The singleplayer save destroy/respawn storm is gone: one spec-apply domain per world (dig 28aafd23, row 2445; engine-bug dump db83ebcd). The singleplayer glue mounts BOTH spec-apply lanes on the one authority world — tome/spec-sync (client, netIngest 20) and tome/spec-sync-server (simulation −950) dedup by name only. Per save (revision bump, zero content delta) the client lane applied a filterSpecForPlaced doc over a world that is the simulation authority for ALL places: every non-kept authored place's objects emptied, place instances expanded over the shrunken view to ~0 objects, and the reconcile diff destroyed the difference (302 destroyed in the dump — onDestroy hooks fired, spawn-owned children cascaded), then the server lane's whole-doc apply respawned it all (307) the same tick. The fix: when the doc being applied resolves singleplayer, the client lane applies the WHOLE merged doc and removes TomeUnfilteredSpecResource (its absence is the established "not place-filtered" contract — presence also keyed the effective-places expansion into emptying non-kept INSTANCE places, and spec-update/reset into re-filtering). Both lanes are now content-identical, so applySpec's delta-0 gate short-circuits whichever runs second — the population is written once and never fought over. Place travel on a singleplayer world stops tearing down the place left behind for the same reason (the authority world holds every place; rendering already place-scopes via the renderer's PlaceMembership include-filter). Multiplayer clients are byte-identical: the filter, the unfiltered record, and every downstream consumer keep their exact shapes.

• The interactive grammar reads script-wired controls, and the touch arbiter yields over every authored interactive surface (row 2437 — DJ's affected games; dumps 3238173e, 07242235, 18bbbfa7). The defect class: a pure-DOM control wired by script (el.onclick = fn, el.onpointerdown = fn) never matches the attribute-based interactive-opt grammar (INTERACTIVE_SELECTORS), so it never gets the pointer-events grant — its presses fall through to <body>, forward with overUi:false, and the host touch arbiter's geometric claim bands take the touch (stick spawn, look drag, world press) out from under the visible control; it presents as z-order eating taps, and inputs.touch.enabled:false "fixes" it only by killing the arbiter's claims. Five legs: (1) the grammar widens — isAuthoredInteractiveElement reads handler PROPERTIES (onclick/ondblclick/onpointerdown/onpointerup/onmousedown/onmouseup/ontouchstart/ontouchend), inline cursor:pointer, and inline self-opts (pointer-events:auto) beside the attribute selectors, and INTERACTIVE_SELECTORS gains the missing [ondblclick]/[onpointerup]/[ontouchend] attribute forms; (2) the DOWN verdict widens geometrically — a fall-through press whose point sits on a visible authored interactive control (findAuthoredControlAt) forwards overUi:true, so the arbiter yields (onCanvas: !pass.overUi) while bare-canvas presses keep overUi:false (movement sticks still win empty space); (3) the tap machine adopts fall-through gestures — the activation fires on the control (synthetic click at finger-up, iOS pointercancel verdict included) and the element heals (makeElementInteractive) so later gestures ride the native path, plus a 500ms grant cadence over the frame body heals controls wired after the morph walk (property assignment fires no mutation event); (4) the tap-rescue lane widens from the sendAction corpus to every authored interactive element — pure-DOM onclick toggles get the same guaranteed in-budget delivery; (5) lifecycle game mounts carry the data-input-capture="ignore" UI-plane marker the render container always had, so a mounted element that opted itself in reads overUi:true instead of being double-delivered (control AND engine stick). makeElementInteractive now preserves authored inline touch-action (a hand-rolled stick's touch-action:none is intent).

• The relay ingress-age self-heal no longer misfires on the parked-drain trickle (dig 81ce11e4, row 2434) — parked time is not staleness, and the predicate gets a depth floor. Fix 2364's heal fired on age alone at the drain edge, but the ingress drain runs on the sim frame loop, which PARKS while the tab is hidden (shouldSelfScheduleWorkerRuntimeFrames) — so every ≥30s tab-hide over a dev room's background STATE trickle (~0.3–0.7 rows/s; the misfire ring: 40 heals in one creator's evening, 16–438 rows across 31s–1300s hides) read as a wedged drain and bought the lane's most expensive remedy: close 4439, the "Connection lost" overlay at the exact tab-return instant, and a resume=0 keyed-heads refold of a multi-MB spec to avoid draining a few hundred rows. Two guards, one per false class: (1) the visibility-resume edge re-stamps every queued relay.peer.frame row's arrivedAtMs (rebaseRelayIngressArrivalsOnResume — the staleness clock measures a RUNNING drain that failed to consume, so it restarts when consumption becomes possible; a drain genuinely wedged AFTER resume re-ages past the bound and still heals), and (2) the heal now requires material depth beside age — RELAY_INGRESS_STALE_REPLAY_MIN_ROWS = 2048, one relay journal self-compaction window (JOURNAL_SELF_COMPACT_ROWS), because a replay deeper than that is history the relay itself would have folded away for a fresh joiner while anything shallower drains in one gulp for less than the refold costs. Depth is a floor, never a trigger: a deep-but-young queue of distinct keys is honest load and drains normally (tide's fix-2364 law, kept). The true-fire class is untouched — fix 2364's motivating specimen (11.7k rows aged past 30s) heals exactly as before.

• The self-addressed rail never forwards, and the relay-wire stamp is tri-state honest (pin 04da3c48, row 2430 — enfeul's every-join breakage). On a relay wire whose welcome-edge stamp (ClientRelayWireModeResource) read stale-FALSE, enterPlace took the kernel forward branch for the client's OWN avatar — but the relay excludes a sender from its own fan-out and the traveler's only simulator IS the sender, so the forwarded rail.enterPlace had zero appliers anywhere: id returned, membership never moved, structurally undeliverable. Three legs: (1) STRUCTURAL — the enterPlace relay fork now reads call-time wire truth (clientRelayWireTruth: the transport's live wireMode(), stamp fallback for reader-less worlds and the sniff hold) and widens self-apply to the receiving applier gate's own predicate (isClientAuthLocallySimulatedEntity ∪ the existing forward-gate admissions ∪ god-parked), so a traveler this seat would apply for is never forwarded; (2) THE STAMP — applyWelcome no longer writes wireMode()==="relay" as FALSE off an "undetermined" hold (first-frame sniff, between-sockets churn): an undetermined welcome PARKS the whole tier edge (stamp + uploader baseline adopt + world-sync arm) and the ingress drain completes it the tick the sniff resolves; a genuine relay↔kernel flip logs one rate-bounded line; (3) VISIBILITY — dump capsules now carry a wire stamp (live transport wireMode + welcomeStamp) via the netcode.wire worker debug door, so this class never needs a 13.5MB capsule dig again. E2E twin: relay join with the welcome applied inside the undetermined hold (the fresh-redial + backoff churn shape) → own-avatar enterPlace(createIfMissing) → membership moves and the minted instance expands on every fold.

• playSound gains follow: true (row 2037, dig 55122dec). A positioned one-shot that names it mirrors its SOURCE entity's WorldFeetPosition while the voice lives — the primitive-not-pipeline fix for self-emitted movement sounds (installation-03's footsteps: spatial plays pinned at boot-plant positions trail opposite the mover's velocity for the life of every clip; bystanders hear correct physics, the mover hears their own boots behind them). Mechanism is the one loops already use: audio/prep re-reads emitter positions per frame, so the fix is a position mirror on the pooled carrier — spawnPlaySound records follow + the source entity in the one-shot registry (OneShotSoundEntitiesResource), and a new client system (tome/one-shot-sound-follow, renderPrep −110, ahead of audio/prep at −100) copies source→carrier each frame, making a follow voice exactly as fresh as an audio: loop on the mover itself. A source that despawns mid-clip stops mirroring and the voice finishes at its last position (one-shots outlive their emitter, by design). Version boundary pinned red-first: flag absent = byte-identical wire and behavior (unset one-shots stay world-pinned); the option rides the wire only on positioned non-loop plays that named true (unpositioned follow teaches once and lowers — non-spatial plays are already ear-locked; loops lower silently — tracking loops are the audio: component's lane). Pins: tome/__tests__/playsound-follow.test.ts (wire shape + client mirror, both halves).

• Audio listener basis prefers the renderer's displayed camera (row 2036, dig 55122dec). readListenerTransform/readCameraTransform (engine/audio/prep.ts) now build the listener pose from viewState.rendererTransform (pos + rot) when renderer feedback exists, falling back to the script-authored viewState, then the entity transform — the exact preference the aim basis has used since camera-derived-axes' resolveViewState. Closes the latent audible-camera ≠ visible-camera seam: undeclared mouse-orbit rigs discard authored rot for display, so a camera script with missing or convention-flipped rotation writes produced wrong/mirrored audio with flawless visuals and correct aim, silently. Explicit AudioListener.forward overrides (the 2D fixed-basis law) still beat every camera-derived basis. Pinned red-first in engine/audio/__tests__/prep.test.ts (renderer-preferred, authored fallback, explicit-forward precedence, DrawCamera fallback path).

• Savi surfaces: follow in the playSound/playSoundAt option types + @tomeapi doc (api-reference regen), and the audio skill's world-sound section names the trap and both exits (follow for self-feedback, or non-spatial).

• AudioParam writes now go through a dedupe + suspend gate at the renderer seam (Safari P0, #w-rendering 2026-08-01). Every AudioParam write — including plain .value = — inserts a WebKit timeline event (AudioParamTimeline::insertEvent, one heap allocation each); prep re-sends full state every frame (≥16 inserts/frame with zero voices, ~6 more per voice), and while the destination is autoplay-suspended nothing consumes the timeline — measured ~12 MB/s WebContent growth until the machine swaps to death. Now a write whose target equals the last value actually written is skipped (per-param last-written cache; epsilon for ramp targets), and while ctx.state !== "running" no per-frame param write lands at all — desired state parks and the statechange back to running flushes one converging refresh. Ramps still schedule normally while running (no zipper-crackle regression); bounded one-shot writes (node creation, cull fades, duck ramps, vibe edits) stay ungated. Pinned by renderer-param-timeline.test.ts (red on the old renderer, 9/9 green now).

• The erase brush clears EVERY painted material at once (jacob's punch list, #inventors 1785628548). Erase on a material brush was a sign flip on the armed field only — erasing "dirt" left sand and grass paint standing, so returning ground to its natural look took one erase pass per palette material. An erase dab (Alt, the Mode chip, or negative-strength armBrush) now runs the paint script over every authored terrain:material:* field in the place — enumerated from the fields that actually hold paint, so orphaned fields whose material left the palette clear too. Material fields ONLY: marks, terrain:height, decor:*, and the generator's natural weights are untouched — erase returns the texel to its natural generated look. The expansion is per-dab and never persisted (brush.fields stays the armed field); commit/undo bookkeeping now iterates the stroke's touched-field ledger, so one undo restores every field the erase cleared.

• Replace mode: paint that wins. New third Mode on material brushes (chip: Paint / Replace / Erase; session flag replace; armBrush({ replace: true })). A replace dab paints the armed field exactly like additive paint (max(current, amount), amount = falloff × strength) and additionally scales every sibling painted material field by (1 − min(1, amount)) — engine math in the session, so the paint-script contract stays one-field and overridden material scripts inherit the mode. All siblings scale by the same factor (their relative mix is preserved as they fade); at strength 1 a single core dab zeroes them. Natural generator weights still compose underneath (chunk-build's additive law is unchanged), so strength remains the lever against natural coverage: replace-at-2 visibly dominates. Default stays additive — jacob ruled additive correct; replace is the opt-in.

• Cursor label gains "Replacing"; the Mode chip label gains the same. Non-material brushes keep the two-option chip (no sibling family to lower).

• Pinned in brush-material-erase-replace.test.ts: erase clears all painted material fields (armed-or-not) and leaves height/decor alone, emptied fields drop from the spec, one undo restores them all; replace scales siblings proportionally (1.0/0.5 → 0.5/0.25 at strength 0.5) and compounds across dabs; Alt-erase beats an armed replace; additive-without-the-option writes no sibling chunks at all; the chip index contract; the armBrush surface.

• Engine diagnostics adopt jacob's DM taxonomy (#inventors 1785635891): everything in logs; errors and storms ping. Every client-reported diagnostic still lands in getLogs() the moment it arrives (unchanged). Each of the 98 rail codes in engine-diagnostics.ts now carries a class: error (broken/wedged/terminal — script compile/runtime faults, renderer crashes, exhausted self-heals, physics corpses, engine parks of authored content) DMs Savi once per episode on first occurrence, with repeats counted to the log; warning (renders degraded-but-playable, placeholder shows, self-heals, teaching, environmental — texture/model load failures, missing clips, slot exhaustions, quota parks, schema skew) never DMs per instance. Either class escalates ONE storm DM when a single code accumulates ≥25 reports inside a 5-minute window ("N reports of this kind… something systemic; getLogs has every instance"). The old trailing "+N more" rollup flush — one hidden Savi model turn per active code per window — is deleted, along with its timer machinery and budget-carry branches; the perf-pointer lane (#235 hourly categories) and the room-global 5-DM/min budget are untouched. Class table pinned in engine-diagnostics.test.ts.

• Query iteration SoA component VALUES are flyweights (ruled 2026-08-04, squeeze hunt ECS core). The engine-internal QueryResult iterator contract narrows: soa3f32/soa4f32 columns (WorldFeetPosition, BodyPosition, WorldScale, WorldRotation, LocalFeetPosition, LocalRotation, LocalScale) now hand out ONE reused value object per column per QueryResult, refilled per row inside fillRow — the last per-row mint #12093 left standing (one {x,y,z} per SoA row per pass; a 20k-row soa3 query paid 20k mints per iteration, now 1 per column per QueryResult). toArray() keeps fresh mints per row and stays the retain-safe form. Audit receipts (bound: every .query( call site across apps/cf-kernel/src including tests and benches; positive control: the known SoA-tuple site tome/api/query-utils.ts:554 and the flyweight row-identity pins were both hit): exactly one non-test SoA-tuple iteration exists (query-utils.ts emitFullScanMatches — consumes in-loop, scalar emit, no retention), all test SoA queries use toArray(), no import aliases of the seven SoA components, no multiline query calls, no generic wrapper passes SoA tokens into world.query. Zero retainers found, so no consumer migration was needed. The script-facing boundary stays fresh-mint by construction and is now named in the QueryResult doc: api.query builds its own results (query-utils.ts buildQueryResult captures scalars and lazily mints an escaping Vec3), the exec overlay's query builds its own rows from staged values, and world.get mints per call — the flyweight never crosses the ECS layer. This change is invisible to behavior scripts and run_script.

• Pin flip (documented per the ruling's duties): the retain-safety pin was documentary — the QueryResult interface doc ("SoA columns a fresh object per row", world.ts) plus a comment in determinism-pins.test.ts; no executable assertion pinned value freshness. Both texts now state the flyweight contract, and a NEW executable pin ("SoA column values are per-column flyweights during iteration; toArray mints fresh values", determinism-pins.test.ts) asserts one reused value object per column with correct per-row contents, and fresh distinct objects from toArray().

• drainEventAdds returns a shared frozen empty array when nothing fired (the common case for its ~11 per-tick/per-frame drain sites — juice ×3, sound-loop ×3, purchase prompt, renderer particle burst, audio prep/deriver: ~400-800 throwaway arrays/s per session at rest, now 0), and its declared return type is readonly StickyEventAdd[] so tsc enforces the read-only caller contract mechanically (all 7 production call sites audited read-only; a caller pushing onto an empty drain now throws in strict mode instead of silently cross-contaminating drains). sound-loop-ingest processes its three juice drains in place instead of spread-concatenating them into a fourth array per server tick.

• Replication drains refill a persistent changedComponentIds scratch in place instead of minting Array.from(set).sort(freshClosure) per drain — both the ECS-level drain (engine/ecs/replication.ts) and its production twin (runtime/replication/room-replication.ts, one drain per AOI-bucket class per egress tick). Consistent with the delta-is-reused-scratch contract already documented in replication-delta.ts; consumers (room-wire-codec frame encode) read synchronously within the same frame build.

• behavior-update's per-tick debug readout (TomeBehaviorUpdateDebugResource) mutates one engine-owned resource object in place (ensure-once + six field assignments at all four system exit paths) instead of minting a fresh object literal per tick per world. Reader census: the sim-probe markers handler (structured-cloned at post time), tests, and the behavior bench all re-read the resource per observation; none diff object identity across ticks; behavior-update never runs inside an exec overlay.

• New bench coverage for the two blind spots the sweep named: ecs/query gains query/1-soa3 (an soa3f32 population — the storage class every transform/pose query actually iterates; the old fresh-mint path measured 283µs/pass vs 254µs flyweight at 20k rows, mint kill 20k→1 per pass) and a churn/commit+churn/query pair (one spawn+despawn per iteration invalidates every cached query shape; measured ~2ms/churny-iteration of snapshot-rebuild tax at 20k entities across 3 shapes — the receipt for the still-open query-snapshot-rebuild-under-churn row, which this PR deliberately does NOT implement: incrementally-maintained snapshots need lend-bit copy-on-write across every store×shape pair plus a mass-churn fallback to hold snapshot identity byte-identical, a design project with engine-wide blast radius, skipped honestly per its own P verdict).

• The game document can no longer paint a scrollbar (tiger, #inventors 1785641498). The engine page's html/body had no overflow guard, so any in-flow element that outgrew 100svh by a few px — in tiger's session, a transient during an art cook, frame-coincident with the kiln "Spawning art" chip — painted a full-height document scrollbar over the game's right edge on always-visible-scrollbar setups, and window.scrollTo could slide the whole canvas (measured: 8px in-flow overflow → scrollHeight 892 in an 884px viewport, scrollTop movable). Root overflow: clip now propagates to the viewport as hidden (CSS Overflow §3.3): no document scrollbar, ever, regardless of what transient DOM appears. In-game scroll surfaces are untouched — realm UI already scrolls inside its own overflow: hidden chrome-host container, and the kiln page's own scrollers (chat, settings) live in the parent document. Pinned by game-document-overflow.test.ts.

• The stalled-spec-lane HUD freeze dies at the sample boundary (row 2186 — pinball 65cc2257/4af4094d, Dayspring aa6bb90d). The game HUD's compile slot now keys on CONTENT, not mount time: CompiledSpec.uiSource records the exact source ui.render compiled from, and the HUD receipts' compile breadcrumb carries sourceHash (the live doc's resolved render-source hash), so compile.sinceMs re-stamps when the authored content moves — "pinned at boot" can no longer read identically for a healthy lane and a wedged one. When the live doc's ui source diverges from the compiled fn's content key for a sustained window (~3s at 30Hz, the same bar as the compile-missing confession — far past any legitimate apply→compile gap), the controller recompiles the render from the live doc through the same content-keyed cache a real apply uses (a later apply of that content is a cache hit on the healed fn), swaps it into the serving graph in place, and confesses once on the fault rail naming the stalled apply lane. A source that fails to compile keeps the old render serving, reports through the ordinary compile reporter, and re-arms on the next edit. Field signature this ends: compile ok/sinceMs pinned at boot across ui.js v696→v708 while sibling edits applied, sent frozen, deduped past 88k, restart-rooms as the only cure.

• The input-binding validator stops billing Savi for entries the platform wrote (r-20a666a8, ravi's 08-01 playtest dig 3c3d2509). Every 3D game minted from the starters carries lookX/lookY/aimYawSin/aimYawCos/aimPitchN in inputs.axes — the starter template ships them — and the #11518 validator flagged all five as "engine-internal axis … Remove this entry" on the merged map, so EVERY patchInputs (including ones that never touched axes, including writes that later rolled back) drew 5 warning lines for entries Savi never wrote. During the 08-01 playtest the noise drowned the real schema errors in a 19-second terrain thrash. The condition was both provenance-blind and factually wrong for two of the five names.

• lookX/lookY leave the scold entirely — they were never "engine-internal" in the claimed sense. They are binding-fed axes with an engine DEFAULT (buildDefaultBindings injects the mouse binding only when undeclared — the hasOwnProperty guard exists precisely so declarations override, and gamepad-look treats explicit rightStick → lookX/lookY bindings as the look gesture). Declarations now validate like any axis: a remap is silent, a junk source names itself, and an EMPTY lookX: {} — the one genuinely hazardous shape, since it suppresses the default and binds nothing — gets an honest teach ("replaces the engine's default mouse-look binding with nothing … remove the entry to restore the default") instead of a false one.

• Engine-computed axes (aim*, cam*, pointer*, touchActive) warn only on the genuinely-wrong shape: a declared hardware source. input-resolution seeds each axis from the engine's setAxis write, then keyboard bindings override it and mouse/gamepad deltas add to it — so aimYawSin: { keys: "q/e" } really does fight the camera-derived value, and still warns (with the true mechanism named). A sourceless {} declaration compiles to nothing, blocks nothing, and is exactly what the platform's own templates planted — it is now silent everywhere (patchInputs rail and spec-sync console lane both ride collectInputBindingFaults).

• Multiplicity: one line per patch, never one per axis. All sourced engine-computed axes in a map collapse into a single fault line naming them together — the 5× per-write fanout shape is structurally gone.

• The planting stops (structural elimination). The five declarations are deleted from packages/game-starters/starter-3d.ts, cf-kernel's DEFAULT_GAME_SPEC, and kiln's DEFAULT_ADVENTURE_GAME_SPEC (behavior-identical: the engine injects the same mouse-look binding when undeclared, and the aim basis never read declarations at all). The teaching corpus stops teaching the shape: the camera skills' "Required Inputs" JSON and the @tomeapi-example camera SPEC-REQUIREMENTS lines now say these axes are engine-provided reads, declared only to remap look. The starter drift fixture is regenerated in this commit.

• BREAKING: query results and object summaries hand out the live tracked state proxy (ruled 2026-08-04, supersedes #12092's detached snapshot). buildQueryResult and getObjectSummary (tome/api/query-utils.ts) return .state from the shared per-(world, bag) proxy cache in the new tome/api/tracked-state.ts — the exact object getObject()/getState() return. Reads are 0-alloc off the stored bag (the per-read {...state} spread + read-tracking wrap chain is deleted); writes mark the component updated, replicate, and ride the client-auth intent rail; a retained result observes live state. getMergedTomeState/getMergedTomeStateByIndex (state-utils.ts) and trackClientAuthSnapshotState (intent-context.ts, the detached cross-writer snapshot wrapper + its per-call WeakMap/JSON.stringify path cache) are deleted — the tracked proxy's own traps record reads/keys/has-probes into the ACTIVE invocation at trap time (same dynamic attribution, plus the toJSON-probe basis exclusion the snapshot tracker had).

• BREAKING at one seam: native structuredClone of a result's .state throws (proxies are not structured-cloneable). Scripts are unaffected — their structuredClone is the unwrapping bridge (script-value-clone.ts; every tracked proxy mint now registers in its proxy registry). The exec result boundary (exec/engine.ts finishOutcome) unwraps registered proxies before the reply crosses, so return api.query(...)/return api.getObject(id) from run_script now arrive as plain data (getObject views previously DEGRADED into a serialization note — fixed by the same unwrap). api.job args gain the same membrane unwrap as the property-write lanes.

• Tracked-proxy write path (row: tracked-proxy-write-double-materialization): the set trap stores to the TARGET directly and fires the recorder itself, instead of receiver-routed Reflect.set re-entering the defineProperty trap — one quantize walk, one markComponentUpdated, zero descriptor mints per write (was 2 traps + 2 quantizes + 2 marks; object-valued writes paid the whole container copy twice). Recorder emission stays the single funnel, after the local apply. Bench (this box, micro): getState mutate top-level 321→170ns, nested 319→163ns; object-valued assign 277ns single-copy.

• patchState/patchObjectState/deleteState (row: patchstate-triple-whole-bag-walk): an O(patch) write verdict (statePatchChangesStoredState, the deepMergeState mirror under the column write's own fastDeepEquals law) runs BEFORE the merge — a changes-nothing patch skips the {...current} merge copy, the full-tree sanitize walk, and the full-width equals walk (cross-writer intent emission and the ledger-1157 durable-mirror suppression contract are preserved verbatim; the specValuesEqual persist verdict stays its own law). Changed patches take the new trusted pre-sanitized lane — world.setResolvedByIndexPresanitized / setObjectMapPatch(..., presanitizedChanged) — which skips sanitize (merged bag is wire-safe by induction: sanitized stored bag + membrane-quantized patch values) and the equals gate (verdict already proved the write lands). Raw engine world.set callers keep the full sanitize net. Bench: patchState 2-key vs 50-key bag 1053ns, no-op 193ns, 2-key vs 100-key nested bag 2267ns (new cases).

• getObjectSummary (row: get-object-summary-eager-materialization) rebuilt on the lazy-accessor literal: id eager; tags/feetPosition/state memoizing accessors — contact/interact/voxel payloads stop paying the whole-state spread + tags copy + position mint when the hook reads only other.id, and land on the SAME final shape as query results. The missing-position {0,0,0} default still skips the physics-quantize check (hadPos capture); present positions keep the read-time pose-driven check.

• Script-transaction overlay (row: overlay-entity-walk-per-query): currentEntityIds is memoized against the overlay's own membership funnel (spawnEntity/despawn — the base world is frozen for the overlay's lifetime), the O(spawned×N) includes scan is gone, and query-row iteration memoizes on a staged-write epoch (bumped by every setComponentPatch and membership mutation; rows embed references, so in-place read-clone mutation needs no edge). Bench (new case, no pre-change twin): 50 staged spawns + 50 entity enumerations over 3k entities = 272µs total (~5µs per enumeration); the deleted term was O(N + spawned×N + N log N) per enumeration — ≥ 150k includes compares + a 3k sort each, at this shape.

• Flipped pins, each one the ruling's own semantics: query-lazy-results.test.ts "state stays a detached snapshot: result writes never reach the world" → "state is LIVE: result writes land"; its native-structuredClone parity pin → script-bridge clone + native-throw pin; new pins for door identity (query result / summary / tracked door alias one proxy) and live retention. client-auth-intents.test.ts rewired from the deleted getMergedTomeState door to getObjectSummary(...).state (all basis-recording expectations unchanged — get/has/ownKeys/JSON recording now comes from the tracked proxy's traps); its native structuredClone-of-snapshot assertions flipped to the script bridge. query-fast-path.test.ts reference impl reads the tracked door. New exec pin: returned query results/views cross the wire as plain data (clone-fallback.test.ts).

• Behavior-preserving invariants pinned by the untouched suites: client-auth e2e + intents (basis order, inc/set classification, revert inverses), script-transaction overlay + tx-spatial query parity, exec snapshot withholding drift pin, determinism pins. Caches name their invalidation edges at the definition site (tracked-state.ts header; overlay memo comments).

• An in-place player always outranks the standing (headless builder) session in the per-place host election (ledger 2464, incident f466014b — Blob Wars). A room_host-class session never ranks at resident tier: its body residence folds as one more body-independent claim (relay-place-elect claimAnchor), so any eligible real client standing in a place takes that place's seat — in the v5 fold, the room-truth derived election, and the fold's honoring gate for relay h:* assignments (a relay predating the rule can still journal a shell seat; the fold degrades to the derived election and seats the resident player). cf-relay's own seat brain carries the same rule: host-session:* candidates rank behind every real client in pickWinner, and a SITTING shell yields at the first qualifying real-client beat — the one carve-out from first-eligible-never-migrate besides graded health. The shell still hosts every place that is empty of players — that is its job, and the fail-closed floor (weak/cooling/shell beats hostless) is untouched. Before this, the shell — present whenever Savi runs world probes — could win a place a live player stood in and host it with no physics runtime and no terrain definition: raycasts answered null, placements parked, bots embedded in the floor, while the player's own sim-health read green.

• restart-rooms verdict honesty on client-hosted rooms (the same incident's rider). A relay world reset that WENT OUT with only its receipt missing now answers the structured verdict reset_sent_unconfirmed — never degraded — and the message says what was done: the reset was sent to the client-hosted room, there are no server rooms to restart by design (architecture, not failure). The field reset provably landed (journal + heads cleared, host re-elected) while the old verdict read 'degraded / no server-hosted rooms', teaching Savi her one remedy fails.

• The physics-anchor chunk-residency guarantee lives with the collider-assembling pass (ledger 2373 re-land of #13063). LOD0 chunks now mint under every dynamic body the local realm simulates — awake vehicles unconditionally with velocity lookahead — in every world class that assembles colliders: singleplayer, multiplayer client-auth clients (the class that was dead), zero-player rooms (spawn-fallback streaming), and seat-holding container-tier servers. The guarantee was keyed on isSoleClientStreamerWorld (client && singleplayer), so no pass ever minted the chunk under a far body in a client-auth room and the chunk-rescue fought each ballistic re-fall forever (dig 525e1a23: 1,942 fires in one session). The stationary-player coords fast path and the server idle-skip signature fold in the anchor CELLS, so a vehicle crossing a chunk boundary under a stationary player busts the cache while an anchor moving within its chunk keeps it. Anchors are owner-scoped in multiplayer (the physics step's own follower boundary), so N clients never pay N× chunk builds under each other's followers.

• What the revert demanded, cured structurally: #13063 was reverted (2ef614ede4) because its static streaming.ts → @/tome/client-auth import closed a cycle through client/netcode (streaming.ts is inside netcode's own graph via netcode-transport → relay-peer-apply → edit-wire → tilemap), breaking vi.mock module identity — KernelTests shard-2/3 red on master (client-auth-intent-deferral, relay-terrain-edit-lane; the ledger-752 class recorded on netcode.ts's relay-tome-consumers seam). The re-land injects the server ownership predicate through a leaf seam (physics-anchor-scope.ts) wired at module scope by terrain-systems-shared.ts, which already legally imports client-auth; streaming.ts gains no tome/client-auth edge. Both formerly-red suites are green with the fix applied (51/51).

• Held seats gate the server pass, never the declaration (codex P1 on #13063): includePhysicsAnchors and the idle-skip signature's anchor gather key on hasAnyServerHostedPlace, not isServerPlaceHostWorld — a declared place-host world whose seats are all client-held has a dormant sim stack and pays no per-tick body traversal for anchors it never owes.

• chunk_rescue_remediation_failed with chunkEntity=missing is a RESIDENCY verdict ("streaming never reached here") with a structured verdict field, instead of blaming rebuild requests that were never submitted.

• Placeholder concept images keep their aspect (tiger's squashed shinobi, dump ad7dcd12). The mcdn placeholder ladder's image rung stretched the decoded preview across the full square hologram quad (packPlaceholders packs one scalar drawn size; UV spanned the whole quad), so a 1024×1536 portrait humanoid card rendered 1.5× too wide. packPlaceholders now packs a contain-fit rect (placeholderPreviewFit — the fitted rect as a per-axis fraction of the quad, computed from the decoded texture's own dims) into the instance's two free pad floats, and the preview shader letterboxes the image to that rect — centered horizontally, bottom edge at the entity's feet, fragments in the letterbox margins discarded exactly like the BiRefNet-cut alpha. Quad size, pick volumes, crossfade, and TAA velocity behavior are unchanged; procedural/failed instances keep byte-identical instance data.

• World touches in the authored realm survive the browser's pan-slop — the mobile touch stick stops vanishing on slight movements (incident 300a3b65, Savi-filed; enigmatic1's report, 08-01). When a game has live authored UI, the realm frame iframe is the viewport-wide hit target for every touch, and a fall-through press (target <body>/<html> — the pointer-events law) is the world's: the platform stick, look-drag, and world gestures. The frame document shipped with no touch-action posture, so the browser's touch gesture disambiguator was free to claim those presses for a pan at its ~10px slop — pointerdown → pointercancel, no pointerup — and Chrome cancels even when nothing in the chain can actually scroll (browser-gate receipt: non-scrollable host, non-scrollable frame, micro-drag still cancelled). The arbiter then correctly ends the analog claim, so the stick died ~10px into every drag — forever under its own 8.16px deadzone, which is exactly Savi's filed observable (touchActive:1 with moveX:0/moveZ:0 while the player holds the stick, "the stick widget vanishes when pressed or nudged slightly"). The shell now pins touch-action: none + overscroll-behavior: none on the frame's html/body: a world press can never start a browser pan, so its pointer stream stays the platform's from down to up. Same law, third layer — the canvas has carried it since day one (browser-host/dom.ts), kiln's game routes carry it (game.css), and the frame the UI actually lands touches on now does too.

• Pinned by tests/browser/suites/world-touch-stick.pw.ts (real shell + real frame bundle, CDP touch): the micro-drag world press delivers down → moves → up with zero pointercancel under a scrollable ancestor chain AND when the frame's own root scroller has extent (body touches pan neither); mobile-authored-ui-actions.pw.ts's scroll-stays-scroll matrix pins that authored scrollers still really scroll (CDP flick moves #shop-list). Arbiter-level law pinned in arbiter.test.ts: an analog claim has no slop-cancel — sub-slop micro-moves plus a hold past every gesture window keep the claim alive to the lift.

• api.replaceAcrossScripts(search, replacement, opts?) — the bulk-rename verb (r-a6e3cbe4, derrf's town rename). Multi-file find-and-replace across every game script: literal text by default; opts { regex?, caseSensitive? (default true), includeScripts?/excludeScripts? (glob or exact-path list), dryRun? }. dryRun: true returns the full report — {script, line, before, after} rows plus per-file match counts — with ZERO writes; the wet run returns the same report with applied: true. Each changed script stages through the existing setScript lane (one spec swap + one recorded setScript mutation per file), so persistence, forwarding, and undo ride machinery that already exists; the report carries a per-file verdict instead of promising all-or-nothing. Zero matches is an empty report, never an error. memory/ and skills/ keys are never candidates, so a sweep cannot even attempt the writes those lanes reject.

• Replace mode fully replaces — natural ground included (jacob's 50/50 crop, #inventors 1785628548). Replace previously zeroed painted siblings only; the generator's natural weights still composed underneath, so replace-at-1 over natural grass landed at 50/50 — "it's NOT winning it's merging". Natural coverage is derived (materialAt re-evaluates per texel), so there was nothing stored to write down; the suppression now persists in its own channel, terrain:natural-mask (0–1). A replace dab raises it to amount (max-composed, clamped to 1) alongside the sibling scale; chunk-build scales the generator's material result by (1 − mask) BEFORE marks and paints compose — a full-strength core is pure painted material. An erase dab writes the mask back down (subtract, like the material script's signed erase), so one erase gesture returns replaced ground to its natural look and the emptied mask drops from the spec. The mask rides the stroke's touched-field ledger: one undo restores paint, siblings, and suppression together. Marks stay outside the mask — they're authored decoration, the same boundary erase draws.

• The mask is an ordinary field: readField/writeField see it (documented in the ObjectAPI field docs), the scatter material matcher applies it (ground the renderer shows as pure painted material reads as that material for material-conditioned beds), and the terrain inputs hash carries it name-keyed beside the painted material fields.

• Texture transitions sharpened (the blendWidth follow-up #11801 deferred). The pbr weight resolve's crossfade window was floored at TERRAIN_HEIGHT_BLEND_DEPTH (0.18) — as wide as the ±0.18 texture-height bias that decides which layer wins each texel, so across a whole transition band the losing layer rendered THROUGH the winner: 2:1 and 50/50 paint ratios both read as a translucent ghost-merge. The window floor is now its own constant, TERRAIN_BLEND_SHARP_WIDTH = 0.06 — the height bias still carves which texels each material wins (grass blades between stones), but the loser fades out within a texel-scale band: dominant paint reads as dominant-with-speckle, partial rims dither instead of washing. Non-pbr paths (dither, tier ≥ 1 winner-take-all) are untouched. The verify-terrain-blend device gate is re-pinned to the sharpened character.

• Pinned in brush-material-erase-replace.test.ts (mask raised proportionally, erased back down, spec-dropped when emptied, restored by one undo, untouched by additive paint) and terrain-jobs.test.ts (a full-mask texel composes as painted material alone; the mask changes the inputs hash).

• Perf: flyweight set-event dispatch for motion-class SoA components (speed-of-light row soa-dispatch-flyweight, ruled 2026-08-04). A new SoA-only schema opt-in transientSetEvents routes setSoA3/setSoA4 subscriber dispatch through one pooled event object (+ pooled previous/value vecs) per store instead of minting three fresh objects per dispatching write — the top steady-state GC feeder at 3k-moving-entity scale (~270–500k objects/s → ~0).

• BREAKING (engine-internal subscriber contract only): for the seven opted-in components — transform/world-feet-position, transform/world-rotation, transform/world-scale, physics/body-position, tome/local-feet-position, tome/local-rotation, tome/local-scale — an onComponentSet event object retained past the callback is overwritten in place by the component's next dispatch. Every in-tree subscriber of these components was audited (spatial-index, hierarchy-solve, hierarchy-render-solve, local-transform-projection, rapier/sync, aoi-index, sprite-raycast, perception, nav-grid, overlap-probe-cache) and reads fields synchronously; onComponentSet is not reachable from creator scripts or any run_script/ObjectAPI surface, so no session-facing behavior changes and no banked-claim falsification exists for this change. Re-entrant same-component writes fall back to fresh mints; dev-mode mutation tracing forces fresh mints throughout. Contract: src/engine/ecs/contract.md (Subscriptions), pins: src/engine/ecs/__tests__/soa-dispatch-flyweight.test.ts. No pre-existing test pinned the old fresh-object identity for these components, so no pins were flipped — the new pins are additions. Savi-latency cluster (squeeze-hunt round 2 — the apply path's second act after the changed-set-first visit filter): a non-short-circuited applySpec re-derived spline/room lowering for the WHOLE world on BOTH diff sides, re-ran ~6 whole-spec derive/library sync walks ungated, rebuilt every per-apply container, and every attributed ObjectAPI/fold spec write copied the ENTIRE object-diff-signature map to evict a handful of keys.

• Per-row lowering memo (src/tome/lowering-memo.ts): generative-spline (road/powerline/stairs/coaster/preset/fence/hedge/pipe) and room rows reuse their lowering products by reference when the source row (by identity), place mode, installed terrain definition token, and the composed terrain:height chunk-version fold over the entry's padded bounds are all unchanged. The field token is the SAME fold the spline redrape watcher re-lofts on (shared helper), so "the ground moved" can never mean two things. Scripted-kind splines, generator-script-bearing rows, scatter rows, and lookAt rotations are excluded and re-lower fresh every apply, exactly as before. Eviction edges: identity replacement (ObjectAPI/COW-fold writers), the spline drag preview's sanctioned in-place row write (explicit evict beside the diff-signature one), terrain def/field tokens, per-apply pruning to the final new-side expansion, whole-memo drop on a failed apply.

• Old-side expansion reuse (TomeAppliedGeneration.expansion): under the delta-0 gate's own completed-apply binding (specRef === live doc) plus expansion-time keys (residency, place-instance content, player-body derivation inputs — a new computePlayerBodyDerivationKey covering active players and session-parent liveness — and the unfiltered-record identity), the next apply's old diff side reuses the previous apply's FINAL new-side expansion whole, containers included (flat list, byId, placeById, id set). Omitted whenever a survived-destroy retry row diverged the recorded doc from what was expanded. Old-side lowering failures stop double-reporting (the recording apply's new side already reported them once).

• Caller-mutation guard: everything recorded past an apply (memo source rows, expansion defs) is re-bound to the ENGINE-owned clonedSpec row twins — "row identity ⇒ content unchanged" holds for immutable-by-replacement engine docs, not for a caller's own doc mutated in place and re-applied (the pinned in-place scatter-count editor pattern stays a full visit).

• Diff-signature eviction side index (object-diff-signature-invalidation.ts + TomeObjectDiffSignatureIndexResource): a root-id → key bucket index built once per apply beside the signatures map makes attributed spec-write eviction O(touched roots) with in-place deletes, replacing the per-write whole-map copy + full key scan. Unbound index (any non-apply map identity) falls back to the historical O(N) scan-into-fresh-map path.

• Derive-pass skip gate (TomeDeriveSyncInputsResource): the six library syncs (materials, field-feed demand, authored clips, looks, textures, warm hints), the spec-shape warn rail, and the asset-manifest merge are skipped when every raw subtree they read (scripts/places/assets/camera/player identities) plus the row-derivation keys match the last completed apply — with per-pass derived-component presence checks so projection resets (which recreate the tome/spec entity bare) always re-derive. Runtime ensure-hooks, the renderer join-watchdog force lane, and TomeSpec reset hooks call the sync functions directly and never see the gate.

• Container floor: buildObjectDiffSignatures returns the previous map by identity on a 100% hit (consumers pair every signature lookup with an oldObjectById lookup, so a superset map is safe); the reused old side ships its containers from the generation record.

Bench (spec-fold-cost.test.ts, new apply-path case: 1,060 source objects — 20 roads + 10 powerlines + 10 fences + 20 rooms + 1,000 flat — through the fold lane): delta-1 apply median 51.5ms → 12.4ms (expand-old 15.3→0.4ms, expand-new 14.8→0.4ms, signatures-new 15.2→2.6ms); 200-write burst 439µs → 112µs per write. Anchor (ecs/soa read-ts-plain) 13,107ns.

Named residues, deliberately not built here: the compiler's second child re-expansion per apply (compileSpec runs before expansion — reordering is its own change); pooling of genuinely apply-local scratch (small, and reentrancy-sensitive); the rebind-candidate query walk. Resident-memory note: the generation record now retains one expansion's containers and the memo retains lowering products between applies — bounded by the currently-expanded world, released on prune/replacement.

• GLB texture payloads stop pinning whole files (jetsam cluster, round 2). parseGlb minted texture bytes as views over the GLB input buffer, so any retained parse pinned 100% of the file — geometry, JSON, and texture payload — for the retainer's lifetime. Three cuts along one seam: (1) GLB-embedded image bytes are now OWNED exact-size copies, so the fetch buffer collects after parse (renderer-side retained drops from whole-file to texture-payload-only; the budget estimator's texture term becomes honest by construction); (2) the sim asset service parses with retainTextureBytes: false — the sim worker never decodes or uploads textures (reader census: zero sim-side consumers), so the texture share (often 50–80% of a textured GLB) never becomes resident in the worker-lifetime modelsById cache at all; (3) the renderer models registry releases parsed.textures[].bytes once every decode for the asset settles — the GPU copy is the source of truth, device loss is a terminal reload wall (recovery re-fetches + re-parses), and assets are created once per modelId per scene, so no in-session reader remains. Receipt (8MB-texture synthetic GLB, reachable-backing-buffer arithmetic): old = whole file pinned per retained parse; owned-copy = texture payload only, input unpinned; sim flag = ~0; post-settle release = ~0.

• Render-channel writer scratch sheds its burst high-water. The spill-encode scratch doubles toward MAX_ARENA_BYTES (512MiB) during boot/backlog bursts and was never re-minted smaller — the high-water stayed resident for the session (the transport-residency stack named in ecs-sync's collapse-gate comment; PR #12099 iPhone-16 jetsam kills). It now re-mints at its 256KB rest size after ~30s of active sim ticks with zero spill demand and an empty pending backlog (frames never alias scratch — pushScratchFrame copies). Re-materialization is the existing cold-path shape: the next spill's ensureScratch(16MiB). New getScratchCapacityBytes() observability getter.

• Preload-hint derivation survives metadata-only spec landings. collectSpecPreloadHints memoized on whole-spec identity, so every asset-metadata landing (bounds batches, the per-analyzed-model triangle stamp, socket/parts rails — dozens per boot, plus every landing mid-session) paid ~5–7 regex passes over the entire script corpus plus place/object walks to re-derive an identical answer. The four metadata writers now land through one shared helper that forwards the memo when every derivation input identity is preserved (input set positively bounded: collectSpecAssetEntries reads places/terrain/atmosphere/objects/player/scripts and never spec.assets; sprite-warm-variants reads scripts/places/objects/player) — a hit returns the IDENTICAL array, so the fast path's previousRefs delta stays a no-op.

• Sidecar host-derive rails stop walking the world. Both rails' ~1s scans iterated every TomeParent-bearing entity (the whole parented population) on every metadata-authority client — including all singleplayer sessions — even with zero socket/part attachments. A hook-fed per-world attachment index (TomeParent add/set + one-time seed; the BoundsPrefetchFeature needs-set shape) makes the scan O(attached-children), i.e. zero for the overwhelming majority of games; stale ids prune on visit. Riders: the per-tick completed.splice(0) empty-array mint is gated on length; the authority resolution (place-hosts read + session query walk) is skipped entirely on ticks with nothing to scan or dispatch; tombstoned entries now cost two boolean checks per tick instead of nested spec probes (resolved-entry cleanup — including a tombstone's cap seat — rides the scan-cadence sweep, with a dispatch-due re-check so a resolved pair is never fetched).

• Perf: squeeze round-2 jetsam cluster (half A) — budgets and eviction for decoded media, behavior-preserving (sol-table .tmp/squeeze-hunt-2026-08-04/round2-rows.json). Decoded audio PCM gets the aggregate budget MAX_BUFFERED_CLIP_BYTES never was: the resource service keeps a raw-decoded-bytes ledger in LRU-touch order and, when a decode crosses the per-device budget (AUDIO_DECODED_PCM_BUDGET_BYTES in perf-static-data.ts — 128/64/48 MiB by the texture/model keep-alive facts, the table's third instance), releases oldest-touched buffers first, pinning the WebAudio renderer's live voices + pending starts (and the just-decoded clip, so one over-budget clip can never decode-loop). Only handle.buffer drops — handles, stream elements, duration memory, and failure/park budgets survive, so an evicted clip re-decodes on demand through the exact paths that loaded it; the re-decode latency on a cold retrigger is the traded term. getStats().decodedPcmBytes is the gauge. The video warm cache's flat 64 MiB budget becomes device-tiered through BOTH construction sites (the shared main-thread cache and the tome-UI frame warm lane): VIDEO_WARM_BUDGET_BYTES 64/32/16 MiB — a mobile miss is the module's own documented designed degradation (plain JIT streaming). Renderer-side: runModelEviction gains an exact O(1) early-out (running totalCachedModelBytes maintained at the cache's set/delete/clear seams; unreferenced ⊆ cached, so under-budget frames skip the per-frame walk + sort + array mint — getModelEvictionStats().cachedModelBytes pins drift). fx particle rasters stop being a session cache: they release by poll recency (every consumer — pack compositor, content-scale measurement — polls per frame until it settles, so 5s of silence IS the settled signal; "unavailable" tombstones stay as the refetch-storm guard), and a composited pack drops its captured per-layer CPU rasters instead of pinning them for the pack's lifetime. PipelineCache gains pipeline-key retention: material instances retain the variant keys they mint and release them on destroy, so an edited-away scripted material's driver-compiled PSOs leave the cache with the record (scripted-lane idle-LRU eviction, tilemap/decoration scripted retire, booth cleanup — all one seam) instead of living to device loss; drops bump generation so draw-memo pipeline-handle memos re-request (a map hit for survivors), a booth previewing a live material holds its own retain, and un-retained keys (fixed shaders, post chain, lanes) keep session lifetime exactly.

• Named residuals: the audio ledger counts raw PCM only — a looping clip's conditioned copy rides the raw buffer's lifetime and roughly doubles its true cost (the budget is deliberately conservative against it). A raster whose pack died mid-fetch stays resident for one grace window before the sweep drops it.

• Perf: speed-of-light squeeze wave 3, tick spine + timers (sol-table .tmp/squeeze-hunt-2026-08-04/2026-08-04-v2-whole-sim.md). The client runtime finishes the server's sharedCtx shape: per-system SystemContext objects, state closures, and push/pop run closures are cached at rebuildPhaseLists (tick/dt/jobs re-stamped per run), ctx.rng becomes a per-run lazy getter deriving the identical (epoch, tick, phase, name) fnv seed on first read, per-phase reduction stagers are prebuilt like the server's stagerByPhase (killing the per-phase flatMap and its reductions ?? [] empty-array mints), and Diagnostics.runWrapped writes a pooled verdict object — the ~6-7-alloc-per-system-run mint chain drops to ~0 and the 120-no-op-system spine bench (runtime/client-spine, new) goes 146.8µs → ~11µs/tick as measured during the hunt (loaded box); the #12166 adversarial re-derivation measured the identical paired bench at merge-base vs head on a quiet box as 79.2µs → 21.4µs (~3.7x) — the win is real, the headline ratio is measurement-conditioned. LastReductionStager memoizes its Proxy + boundFnCache (stable world identity for reduction-declaring systems across ticks — pinned by reduction.test.ts) and takes a prebuilt Set for the reducible-membership probe. Timer dispatch drains a (dueTick, id) binary-heap index (tome/timer-heap.ts; armTomeTimer is the one arm gate) instead of scanning every armed timer per tick — cancels/reaps stay map-only deletes dropped lazily at pop, holds/spills re-queue under their original key, fire order stays byte-identical ((dueTick, id) pins added to timer-dispatch-budget.test.ts), and the 5k-armed idle-tick scan collapses 6.1µs (reconstructed-old) → ~70ns (~90x; new bench case) — the #12166 re-derivation measured the real old scan at 88.8µs on the merge-base tree, so the paired ratio is ~897x, an order better than the reconstruction suggested. Small kills ride along: the server's per-tick sharedCtx/noop-jobs/placeholder-rng mints hoist to module/runtime scope, sim attribution keys per-kind maps by raw name (no per-sample NUL-template string), the client sim-step timing window becomes parallel Float64 rings (no per-tick sample objects, no Array.shift), and the worker's controlled-entity change probe compares retained expanded lists via scratch arrays instead of minting fingerprint strings per frame.

• Named residuals: a dead owner's timer now reaps at its dueTick (dispatch's hasEntity gate) instead of eagerly per tick — closure retention until due is bounded, and the spill breadcrumb's armedTotal counts such timers until then (log payload only). Reduction proxies are stable across ticks by design — the identity-per-tick pin in reduction.test.ts flipped to a stability pin. Static-body rotation ordering (ledger 2028, savi filing 61538a0c / Streetwork): under replication an entity's components arrive as individual rows, and chunked bursts + flood-budget re-delivery put tick boundaries anywhere in the row set — so a static body can materialize from its physics/body-config row before its transform/world-rotation row arrives, born wearing identity. The dig's churn repro (adopted here) shows current master converges those orderings, but only through a stack of four mutually-covering accidents (the write-back's cache-unchanged guard, the #550 transform-replace compare, the state re-align before dispose, dispose clearing caches). This change replaces the accident stack with an invariant: a static body's rotation is a pure function of its replicated WorldRotation — physics never authors it, and every (re)materialization derives from it.

• initializeBodyState: statics read WorldRotation (the author row) before PhysicsBodyState.rotation (the physics echo) — the previous precedence rebuilt statics at whatever stale orientation the last write-back caught unless the caller remembered to re-align state first. Dynamic/kinematic precedence unchanged (physics owns their rotation; state stays first). Engine-managed statics with no WorldRotation (terrain chunks, tilemap colliders) keep their state-seeded behavior.

• applyStateToComponents: statics no longer write WorldRotation back to ECS. The write-back used to mint WorldRotation=identity onto a mid-adoption static, occupying the author's replicated slot with an echo — upload fabric for ownership write-fights on client-auth hosts, and one component-sourced cache seed away from permanently blinding the transform-replace compare. The rotation cache still records the realized body pose (it is exactly the "realized" side staticTransformReplaceNeeded compares the author row against).

• getOrCreateHandle (signature-change swap): a static whose colliders are about to be re-created first gets its body pose re-written from the author components (WorldRotation, feet-first translation), so the fresh colliders index at the true pose — the swap used to inherit whatever pose the body was born with, so a signature row (scale, config re-delivery) co-arriving with a late rotation re-indexed fresh colliders at the wrong orientation and re-marked the signature fresh, permanently. The swap itself deliberately stays in place (no dispose+recreate: a removed-and-reborn body is not query-visible until the next step — a one-tick hole for raycasts and CC grow probes — and terrain edits pin handle identity); character capsule-grow holds and the mesh-not-ready hold are untouched.

• Static birth pose is author-derived end to end: the body desc and initializeBodyState both resolve a static's translation feet-first (WorldFeetPosition is the authored surface; BodyPosition is the realization echo, stale across a component-written move) — previously a static rebuilt after a component feet-move could be born at the stale center whenever the slept-pose coherence check didn't fire, and its colliders spent the rest of the tick indexed at the birth pose.

• seedPhysicsCachesFromECS: never seeds a static's rotation cache from ECS components (that is the one writer that could make cache == component while the body wears something else, silencing the compare forever). Currently test-only; guarded so it stays safe if resurrected.

• Suite: dig2028-rotated-static-box.test.ts — the dig's two straight-path probes (drive across the world AABB unblocked / into the oriented face blocked), the staged churn repro (config-first adoption → reap → re-adopt, rapier cuboid halfExtents + body rotation inspected at every stage), and the signature-co-arrival poisoning case. The no-phantom-mint assertions are red on master before this change.

Named residues, deliberately not built here: (a) the synthetic feet-delta contact.normal savi burned probe cycles on — already eliminated by the fabricated-contact fix (ledger 2022, #12153, landed); (b) the owned-entities write-fight (~38k fenced rows in the filing room — netcode/command-dispatch vs the hosting client over tome/owned-entities) — the environment that tears adoptions mid-entity and can fence the rotation row out entirely; rows 2016/2017 ownership family. When the rotation row never lands in ECS, no physics-layer fix can dress the body correctly — this change guarantees the body converges to whatever the author row says the moment it exists, and that physics never fights the author for the slot.

• Terrain textureScale adopts meters-per-tile (the object-material semantics). The heightmap material pack conversion (features/terrain/config/factory.ts) previously computed shader repeats-per-meter as 0.4 × textureScale — a repeat-frequency multiplier inverted from object materials' "meters each tile covers", ~1000× denser for the same small value; the knob-name collision burned a creator world authored at 0.05–0.08 (thread 1785625835). Now metersPerTile = textureScale (clamped ≥ 0.001), shader repeats/m = 1 / metersPerTile. No stored-value conversion (jacob's ruling, ts 1785626860). Defaults and tile-only materials pack byte-identical values to pre-flip; savi docs (api-reference §TerrainDef, heightmap-terrain skill) carry the flip note + conversion.
• Held keys no longer survive focus/mode transitions (row 2480, the phantom-movement strand). raw-capture's overlay gate (shouldCaptureKeyEvent) drops keyups the instant the input mode reaches "overlay", so a key pressed mid-stride and released over the chat box never delivered its KEY_UP — the sim's keysDown kept the key and the character self-walked until something else happened to fire a RESET. Document blur could never be that something: the overlay runs on proxied events and the iframe keeps focus. The sweep now fires at the CAPTURE transition itself — raw-capture subscribes to input-mode changes for the life of the capture session and runs the same silent RESET the blur/visibility/text-entry-focus seams use (no synthesized release edges, so no activeOn:"keyup" binding fires from opening the chat; a key held straight through the overlay stays dead until re-pressed). tab-held deliberately does not sweep: keyups still capture there, and a Tab chord mid-stride must not stop the walk (#13173's tab-timing lane).
• God-mode exit clears held input, mirroring the entered edge. applyWorkerGodModeExited now runs the same clearInputState the entered edge always ran — keys held while flying the god camera no longer walk the player the instant control retargets.
• The gamepad overlay park collapses into the transition sweep. parkGamepadForOverlay's own RESET + axis-cache drop were the per-source copy of exactly what the sweep now does at the transition; the poll can't reach overlay mode with un-swept held state (state only accumulates while the poll emits, the poll parks before emitting in overlay mode, and every entry into overlay runs the sweep), so the park reduces to the overlay early-return and the gamepadOverlayParked flag is deleted. Pad park semantics are byte-identical: one silent RESET at overlay entry, axis levels re-emit on exit, button edges never refire.
• A non-takeover engine exit's unlock event is now itself a reconcile edge (dig 62093b4f, row 2479 — kent's 64s dead mouse-look, jacob's stuck moment). The pointer-lock reconcile is edge-triggered and never polls, so an engine-counted exit whose unlock EVENT landed after every relock-bearing edge had already fired — overlay flap → exit issued → mode returns to game (reconcile no-ops against the still-true lock mirror) → unlock delivers — left a lock-preferring game with dead mouse-look until the next overlay cycle. The unlock of a counted exit now reconciles: the exit was ours, the browser permits the silent re-request, and canAcquireLock re-checks desired state so an exit whose reason still holds (open cursor UI, withdrawn intent) stays out. TAKEOVER exits — touch release and parent break, which hand the pointer to another owner against desired state — are flagged in flight (takeoverExitInFlight) and keep today's behavior: their own unlock never relocks, the next reconcile trigger decides. User exits and browser revokes still arm the gesture gate, untouched.
• The relock decision on every game-mode unlock ships to DD (probe #1 from the dig). The Lock changed edges always shipped; WHY no re-request followed was the blind spot. One [pointer-lock] Unlock decision (mode: game): … debug line names the outcome — re-requesting, gesture gate armed, authored intent withdrawn, cursor UI needs pointer (N surface(s)), takeover exit, not lock-capable, page hidden — so the live-watch query for the wedge signature closes on a reason instead of an absence.
• mouse4/mouse5 join the input-binding vocabulary (r-c5a11032, kent's tactical shooter; tucker's independent "No thumb buttons?"). inputs.actions.*.mouse (and modifiers) accept the side/thumb buttons: token mouse4 = MouseEvent.button 3 (back), mouse5 = button 4 (forward); aliases mb4/mb5/back/forward. The internal names follow the DOM index (Mouse3/Mouse4 — input-resolution's generic Mouse\d+ lane and raw-capture's BUTTON_MASK already carried buttons 3/4), so the engine half is pure vocabulary + the nav claim below. mouse3 deliberately resolves to nothing: DOM numbering says back, gamer numbering says middle, and an ambiguous token that guesses wrong rebinds someone's weapon. Side buttons also work as held combo modifiers (MOUSE_BUTTON_NUMBERS 3/4).
• Bound side buttons suppress browser history navigation. A game that binds mouse4/mouse5 claims the button for the session: raw-capture preventDefaults the pointer events AND the compat mousedown/mouseup (Blink keys the navigation off the unprevented mouseup) for exactly the claimed buttons — derived from the installed bindings in installInputClient, the same wiring as the gamepad right-stick claim. Unbound side buttons keep browser back/forward untouched. Known residual: the authored-realm forwarded lane (realm iframe, unlocked pointer) does not yet suppress; pointer-locked play — the tactical-shooter shape — delivers natively and is covered.

technical notes

• Past the 32,768-heads join wall, the room-host seat now joins on the player lane's scoped bootstrap instead of dying at the budget refusal forever (ledger 2198 — abbi/Animalia, the fifth walled app and the first a creator felt). The typed budget refusal (RelayIngestVerdict fatal-join) now carries headsWall: { heads, budget } structurally; when a receive-all pinned dial (room-host shell / wisp / instrument) draws it, the runtime latches a per-room scoped fallback: the redial's hello drops the aoiRecv=all rider (grant kept — emission stamping stays armed; never-declare kept — the relay's 10s declare-timeout backstop must owe the seat the FULL drain), so the join is the scoped globals-only bootstrap players already ride in prod (p50 21 heads rows vs the ~35k-row/4.4MB unscoped drain that died at the wall), the seat goes live in seconds, and the backstop bulk-loads the withheld world paced and bracketed. While warming, the session's aoiScope() answers a REAL coverage-gated claim instead of the pin's null — a partial-world host must answer world-sync only for bracket-receipted places (a false coverage claim reaps peers' entities); the "*" backstop receipt flips it receive-all in fact. Under-budget rooms never see the refusal and never latch — byte-identical joins, pinned by test. One loud structured line (room.relay_join_budget_wall_fallback) names the world-size fact for the shell/savi: the room outgrew the join budget, nobody's code is at fault, and no reset heals it while heads ≈ world size.
• A1: consecutive relay JOIN failures earn exponential backoff with jitter. Every welcome legitimately resets the general retry budget (first authenticated message), so a join that failed AFTER its welcome redialed at the flat base delay forever — the 1.2s no-backoff storm (986 refusals/40min at abbi's room) that ground the DO and starved the humans' sockets (153 session drops in 3.5h). failRelayJoin now escalates the ladder's exponent to the bootstrap-failure streak (which already survives socket generations and resets on join success / new room), capped at RELAY_JOIN_FAILURE_BACKOFF_ATTEMPT_CAP = 8 (default ladder ceiling ≈ 25.6s) so escalation alone never exhausts maxRetries — a walled room paces at the ceiling instead of dying terminal — and arms a ±20% jitter consumed by exactly that one schedule; every other reconnect trigger keeps today's deterministic delays.
• A2: the bounded container-tier fallback rides IN-BAND across the private-transport seam. ?hostTier=container (r-72d60fe1 M3) was a URL decoration minted in the worker realm, and the bridge redials the fixed signed URL — so the fallback was dead code on every real client (field receipt: the falling-back warn, then 22 more relay dials). It now travels the bootId pattern exactly: lifted off the pseudo-URL into a structured connect field, sanitized in the trusted realm (only the literal container ever rides), re-appended to the signed dial.
• Join-scope semantics: every seat class now declares what its join fetches (the move-2 SCOPE half of "no seat drains O(room) at join"). The seat classes are derived from the code's three connect shapes and mapped in one home (_entry/client/relay-join-scope.ts): the PLAYER dial's scope is "place" (declared place heads + global heads now, other places on declare-place demand — the prod-proven p50-21-rows bootstrap, unchanged); the pinned receive-all-destined seats (room-host shell, helper walking sessions, wisps, instruments) declare "world-bootstrap" — the scoped globals-only join plus a full "" bulk drain the relay owes IMMEDIATELY, bracketed and paced through the per-DO drain queue. This generalizes #13022's heads-wall fallback (ledger 2198) from a refusal-latched exception into the scope the seat requests at every join: cheap join, live in seconds, world bulk-loaded behind the live flip, with aoiScope() answering the same coverage-gated claim while warming (the "" receipt flips it receive-all in fact).
• The protocol addition is version-gated (the versions law — old pins keep receive-all). The request rides the hello's aoiRecv: "bootstrap"; the relay's aoiRecv decode is a fail-closed whitelist, so the client sends it only when the hello-invite adverted accepts ≥ RELAY_INGEST_ACCEPTS_AOI_BOOTSTRAP (the new rung 3). Below the rung — old relays, URL-advert dialers — pinned seats keep aoiRecv: "all" and the legacy full in-join drain byte-identically, and old pinned engines keep it forever. One room-scoped exception: once a room's seat rode any scoped bootstrap (requested, or wall-latched), a later generation meeting a pre-bootstrap invite (relay rollback mid-room) drops the rider entirely — the #13022 fallback hello shape — instead of claiming receive-all over a possibly-partial world.
• The no-places-world caveat, declared honestly: in a world whose heads never tag places, the global set IS the whole world — scope cannot shrink that fetch, only declare it truthfully; the drain half's paging (#13051 — paced heads drain, both join-size refusals deleted) is what carries its size. The two halves compose: scope shrinks the fetch, paging makes any fetch safe at any size. This half deliberately leaves the drain internals and pacing untouched.
• Relay side: relay.aoi_bootstrap_drain (info) names the owed drain as the seat's declared scope working as designed — never the backstop's wedged-client warn; the debt rides the same settled-only-after-drain attachment bookkeeping, so an eviction between enqueue and drain restores still-owed and the wake-time backstop covers it (over-delivery, never blindness).
• Chunk-coord lookups ride a writeVersion-memoized index — the 5.2.28 voxel sim regression (both backends) dies at its multiplier (#13130; tucker's 08-17 walk, thread 1787004469). The resident-grid deslop (c2accb5bd6 — in 5.2.28's cargo, not in 5.2.26) made every chunk install re-derive base (+) journals for the owner and its 26-cell halo — 27 getTerrainChunkEditsState calls per install — and that function's "rare" fallback, findTerrainChunkEntityByCoord, is a full scan of EVERY TerrainChunkKey entity with a raw PlaceMembership world.get per entity. The fallback fires for exactly the common cases of a streaming walk: an un-edited chunk (canonical entity exists, no TerrainChunkEdits) and a not-yet-resident halo neighbor (no entity at all) — tucker's walk traces put the sim worker 94% busy on Rapier / 71% on Mantle, ~81% inclusive under terrain/client-build's install lane, with EntityWorld.get alone at 40.9% self-time. The fix removes the scan's preconditions instead of gating its callers: findTerrainChunkEntityByCoord answers from a coordKey→entities map memoized on the TerrainChunkKey store's writeVersion (the place-membership-read.ts pattern; buckets in lexicographic EntityId order so every pre-index tie-break — edits-carrier first, then canonical, then first fallback — is unchanged); getTerrainEntityPlaceId rides the memoized readEntityPlaceIdRaw instead of a raw per-call world.get; and voxel-field's journalOf delegates to getTerrainChunkEditsState (call-time, not init-time — the module sits on an import cycle with edits.ts) instead of duplicating its body. Red-first: the new chunk-identity.test.ts perf pin (5400 miss lookups over 2000 chunk entities — the halo-at-the-frontier shape) measures 1137ms on the pre-index code and fails its 500ms bound; indexed, the whole 8-test file runs in 21ms, and the 7 semantics tests pass on both shapes.
• Relay-tier ingress overflow self-heals by AGE — a thawing client abandons a stale queued replay for the F10 fresh fold (fix 2364, dig 60e20d09 lane 2). The kernel tier self-heals a stalled simulation at 64 queued StateDeltas (room-runtime.ts handleIngressOverflow), but relay peer frames never touched that counter: pushRelayPeerFrameIngress rows had no cap and no heal, so a client whose sim stalled for minutes thawed into the ENTIRE queued replay (field specimen: 11.7k rows ≈ 3.5 minutes of arrivals applied in one gulp) — re-adjudicating every peer fact from a stale world and generating not_owner / stale-host-stamp drops at peers the whole time. Now every ingress drain checks the OLDEST queued relay.peer.frame arrival stamp; past RELAY_INGRESS_STALE_REPLAY_MAX_AGE_MS (30s — under one relay journal self-compaction window at the arrival rates where receive-side backlogs form: JOURNAL_SELF_COMPACT_ROWS = 2048 at the specimen's ~55 payloads/s ≈ 37s, and above the election's own 20s despawn-grace staleness tolerance) the queued replay is dropped wholesale and the session ROUTES to the existing redial-fresh machinery: prepareFreshRedial parks the failed-resume posture (cursor 0, keyed outbox pruned — now the shared home with handleWelcome's F10 verdict) and the socket closes RELAY_REDIAL_FRESH_CLOSE_CODE for the ordinary reconnect ladder, whose fresh dial claims resume=0 and receives the keyed-heads fold; a stall that outlived its socket skips the close and lets the already-running ladder redial fresh. Age, not rows: motion already coalesces latest-wins per (author, stream, cell), so a deep queue of DISTINCT keys is honest load and drains normally — coalesce always, expire by age, and the bound is its own backoff. Deliberately never failRelayJoin: a routine self-heal must not count toward the container-tier bootstrap fallback. The kernel tier's 64-cap heal is untouched.
• The relay ingress coalescer keeps latest-wins under mixed traffic: barrier-watermark + tombstone supersession replace the per-barrier index clear (fix 2365, dig 60e20d09 lane 2b). The live-motion coalescing index (room-runtime.ts pushRelayPeerFrameIngress, #11733's receive-side latest-wins) was cleared whole by EVERY non-motion ingress row, so interleaved chat/state/journaled traffic stranded one more stale motion row per stream per barrier — exactly the restatement-storm shape where a slow drain needs the queue to hold one row per stream, not minutes of superseded poses (abbi's session: 2.48M promoted rows fanned out uncoalesced into an 11.7k backlog). Now non-motion pushes advance a barrier watermark instead of clearing the index: a queued motion row indexed AFTER the last barrier still replaces in place (byte-identical to before), and a row stranded BEHIND a barrier is tombstoned in place while the fresh restatement lands at the tail — remove-old + push-at-tail, the same rule the relay's own join buffer applies on the fan-out half (fanout.ts), so no pose ever applies ahead of a journaled row it followed on the wire and the queue holds at most ONE motion row per (author, stream, cell) regardless of interleaving. Pure-motion streams, catchup-phase replay (never coalesced — history, not restatement), and the drain/teardown/compactor index lifecycle are unchanged.
• Nobody-stamped frames park, never drop (tide's ruling generalizing tucker's fold-never-drop veto; envelope-dig lane 3, r-b035693c). The relay host-stamp gate (relay-peer-apply.ts translatePeerStateDeltas) used to drop a live host-stamped message whenever this fold's replicated table disagreed — including when the table named NOBODY (mid-election, or a fold behind the seat fact), which manufactured desync: a deposed/incumbent host's last hosted-remainder truth (bots, props, NPCs) vanished on exactly the observers whose fold was behind, unrecoverable if the host went quiet. The unadjudicable case now PARKS (relay-host-stamp-park.ts): frames wait keyed by the sender's session until the stamp becomes adjudicable — the election fact folds and the table names someone, either seat, either verdict — then re-enter the same gated pipeline (a confirmed stamp applies ahead of the sender's next live frame; a refuted one refuses exactly like a live straggler). The quiet-stamper case drains from the netcode ingress tick sweep. A table naming ANOTHER client keeps today's refuse — that verdict is real and LWW-corrected. The park's bound is the session: the membership tomb (and the late-join orphan sweep) reaps a dead sender's park whole; there is no TTL and no eviction, and a park that grows past the sanity line (256 frames) confesses on the governor channel (host-stamp-park, why-class backlog) instead of silently ballooning.
• The paged join's fold-completeness fact is readable: the budgeted ingress drain publishes its deferred backlog (ClientNetcodeIngressBacklogResource), and the relay e2e harness's settle() holds until every stack's fold completes (the shard-1 CI intermittent, runs 31974390857/31979604866). The completeness gate lives at ONE place — applied-through-catchupThroughSeq, the welcome's single ceiling — and pages are INTENTIONALLY partial until the cursor reaches the ceiling (#13051 kept one welcome/one ceiling as the sole settlement truth). Every presence-shaped proxy is wrong by construction: worldBaselined flips at the self-spawn edge BEFORE the drain finishes (relay-join.ts maybeFinalize, grant-before-drain), and the test harness's settle() keyed "done" on hub quiescence, which goes silent the moment the relay finishes DELIVERING — while the #12973 budgeted drain (8ms/tick, 128-message floor) is still APPLYING the fold across ticks. On a contended CI tick the wall-clock budget expires inside every tick's minimum batch, the fold pages, settle's quiet-exit fired mid-fold, and the terrain-compaction test read partial heads — undefined where the last-seq head (cell 0's dirt overwrite) hadn't applied yet. Solo it passed by a zero margin: 561 rows against exactly 5 quiet-exit ticks × 128. Now the drain stamps its carry remainder (on change only — a never-deferring world never writes), the harness exposes it per stack (ingressBacklog() = transport queue + deferred carry), settle() counts backlog as work, and the terrain test pins the paged shape deterministically (700 cells > 5×128, ingressDrainBudgetMs: 0 = the contended-runner model). The ingress-budget suite's hand-rolled carry flush ("settle's quiet-exit cannot see a stack-local backlog") is deleted — the gate sees it now. Engine behavior on the wire is unchanged; production terrain already converges reactively as pages fold (client-terrain-system remeshes in the tick an edit lands).
• GameDB door calls PARK through wire-not-send-ready windows instead of burning (ledger 2381, dig a04bde80). Every relay boot has a deterministic window where the world ticks — and onPlayerConnected fires — before the wire session reaches live (relay-wire-session.sendRpc refuses until then), and sendDoorCall was fail-fast: a creator's api.sql at boot burned its bounded retries sub-second and landed on defaults (Duskfall's progress table, 3 tries at ticks 16–18), and the engine's own terrain-edit restore (_spawn_chunks row census) died on the same window on every relay-hosted authority (the headless room_host shell, the SP client authority on a relay wire). A PRE-send refusal now parks at the door (game-db-relay.ts): nothing crossed the wire and nothing executed, so the park is replay-safe by construction; the tick sweep drains the park FIFO the moment the session opens (the reply clock starts at the SEND), and a wire that never opens hits a bounded 30s ceiling (RELAY_GAME_DB_PARK_MS) and dies typed with the one verdict a post-send timeout can never offer: this call was NEVER sent — safe to retry. Post-send failures keep the fail-fast contract untouched (the park is not an outbox; a call that crossed the wire is never re-sent), calls issued while anything is parked queue behind it so the window never reorders, parked calls count against the in-flight cap, and a room reset answers them with the never-sent honesty. The engine's terrain census and the room-state resume ride the same park unchanged — the boot read now lands on the live edge instead of warning and waiting out a retry cadence.
• Governor confessions: engine governors that reduce work now confess it as a structured fact (r-2fe97ac9; the r-da0b1dbe governor-legibility class). New channel engine/renderer/governor-confessions.ts — a per-worker ledger (the diagnostics-sink pattern) where a governor reports engage / level-change / release with a closed why-class vocabulary; facts carry which governor, how much, since when, and why. State changes dedupe, the transition ring is rate-bounded, and a session where no governor ever engages pays nothing (the snapshot is null and every surface omits the block — absence IS "nothing governed"). The renderer worker's ledger rides the existing 1 Hz perf-sample relay; the sim worker's client-health reporter merges it with its own ledger into a new governors block on the engine.clientHealth snapshot (server-side re-validated: why-classes/events allowlisted, strings sanitized, arrays bounded), and api.getClientHealth() answers with a per-client governorSummary line plus the full block. First wired face: the frame-budget park machine — parks, staged unparks, futility restores, and probe re-parks all update one fact derived from the park registry itself, with the distinction that survives ledger 2353's probation redesign structural instead of prose: parked materials auto-probe back (parked/refs), a parked look that delivered never auto-returns this session (look: "parked"). Build-failure parks never confess — a broken script is the script's story, not a governor move.
• Governor confessions: the five remaining governor faces confess (r-da0b1dbe residue; #13040's channel, no new plumbing). Every face is one confessGovernor call at its own shed/pace/kill site, folding into the existing governors block on engine.clientHealth (sim-worker ledger directly; renderer-worker ledger via the perf-sample relay). (1) Tick shed (sim-health.ts): the ticker's backlog clamp confesses shed count + shed ms + the cause window as host-overload, releasing after a full clean window — bounded slow motion stops reading as "the game is slow for no reason". (2) Relay ingest (relay-ingest-confession.ts, judged at room-runtime's drain edge; ledger 2331's 13k→48k unbounded-queue dump): latest-wins motion coalescing volume or raw queue depth past their lines confesses backlog with the measured counts, releasing after a clean window. (3) Chunk-build pacing (client-terrain-system.ts; the ledger-2012 starvation class): liveness-starved chunk builds (stuck/canceled — no job throughput) confess backlog derived from the failure registry every tick; deterministic build-error failures and terminal parks never confess (the content's story, the build-failure-park rule). (4) Exec timebox (tome/exec/host.ts; ledger 2325): a watchdog kill now measures the host's own tick cadence while the exec was in flight — the watchdog's starvation is the evidence — and confesses host-overload/"host-overloaded" (avg tick gap ≥ 100ms) vs rate-cap/"script-exceeded"; the caller's error string carries the same verdict, so an overloaded host no longer teaches "likely a busy loop — split your work" for innocent scripts. Released when the next exec settles. (5) Texture residency (lume/assets/service.ts): keep-alive-budget evictions confess memory-pressure with cumulative pressure-eviction and thrash-reload counts (page-derived housekeeping retirements never confess), releasing after 600 under-budget frames.
• Over-cap authored-UI mounts confess and heal instead of dying silently (row 2399 — derrf's Loop Machine, incidents 44324169/761406fa/9e47956e). A game-HUD/creator-panel lifecycle mount ships its entry module plus the whole require closure to the sandboxed authored realm, and the realm channel guard refuses any mount over REALM_SIZE_CAPS — correct against hostile traffic, but the refusal was a frame-side silent drop: the worker's receipts read "sent", lastMountKey advanced, and the previously mounted code stayed live across reloads while the creator's lib grew underneath it (262 modules crossed the old 256 sourceCount cap at under half the byte budget; the blank minute was the crossing). Four moves: (1) the worker controller preflights every mount with measureLifecycleMountCaps — the guard's own predicate, exported from realm/protocol.ts so admit⇔accept parity is pinned by test — and refuses loudly on the fault rail (ui.mount, once per mount key) naming the binding cap, the measured closure (count/chars/largest module), and the fix; (2) the HUD pipeline ledger carries a lifecycle-delivery verdict (sent / dropped-over-cap with reason), so receipts can no longer read "delivered" for a mount that never ran, and the debug-dump summary prints it; (3) a refused or send-failed lifecycle command never advances the resolver's cursor (the game mount key / creator panel id commits only after postMessage returns — the lastSignature refusal, mirrored), so shrinking the closure below the cap mounts on the next sample with no unrelated edit; (4) sourceCount rises 256 → 4096 — it is a decode-abuse ceiling, and the byte caps (1MB/module, 8MB total) now always bind first for real module graphs.
• A missing __spline__ child id names its root instead of blaming "array indices" (ledger 2338's secondary wart). api.query legitimately returns spline/scripted expansion children (<root>__spline__…) — they are real, measurable, tag-bearing objects — but their lifetime is coupled to their root: a root destroy cascades them and the apply pass re-mints them, so a query-then-sweep destroy loop reaches ids that died with the root moments earlier. Both zero-match mouths (the behavior warn rail's emitMissingTargetTeach and the exec seat's describeMissingDestroyTarget throw) told that loop not found — call ignored. Use entity IDs (e.g. "my-object"), not array indices — a wrong theory about an id the engine itself handed out (Denmark By's script noise, 08-15). Both mouths now detect the generated-child marker (inferSplineGeneratedOwnerId) and answer with the coupling: root live → "generated children die (and re-mint) with their root — destroy the root instead"; root gone → "this child died with its root; generated ids never need their own destroy call".
• Cross-place mutations confess instead of silently no-oping (r-c79a5004; the sumo-volleyball "engine limitation" specimen, mavi's dig 4fcf89aa). A script in place A mutating an entity in place B no-opped with the generic missing-target teach ("not found — call ignored … not array indices") — a wrong-cause verdict for an entity the spec provably declares in another place; creators built workarounds around the silent drop and Savi built typo theories at authoring time. The miss rail (emitMissingTargetTeach — one seam under setObjectProperty, patchObjectState, deleteObjectState, the physics verbs, …) now checks the unfiltered+effective spec view: a target declared under places.<B> while the caller stands in places.<A> gets the structured verdict — "cross-place write dropped: <entity> lives in places.<B>, this script runs in places.<A> — writes only apply within the calling place" — delivered where the writer reads (the runtime-log ring for behavior scripts, attributed to the writing entity; the exec sink verbatim for run_script). Zero behavior change on the write itself — apply semantics stay the separate design track. Conservative by construction: findSpecObject prefers the caller's place, so a cross-place duplicate whose local copy died keeps the plain miss teach, and destroy never reaches this rail for spec-declared ids (its clientDestroy fan-out is the delivery path). Same-place writes and unknown-id / dead-local-id teaches pinned byte-for-byte.
• getChannel resolves authored-clip duration from the minted library entry (ledger 2384 — Nine Heavens' unfalsifiable railDead probe, dig 1c219e7d). An authored-clip play writes only the identity STRING into the mixer channel — the minted AuthoredClipEntry (with its duration) lives in the derived AuthoredClips library, and nothing ever wrote it back into the channel — so getChannel().duration read null FOREVER for authored-clip channels (finished never fired, progress stuck at 0), on every engine version, healthy or dead. Nine Heavens latched railDead on exactly this probe and spent eight rounds of pose work building GLB-puppet workarounds around an unfalsifiable artifact. The read lane now answers what the write lane minted: when the channel's clip resolves in the AuthoredClips library, duration = entry.duration / |speed| — one lookup — and finished/progress derive from it consistently. A caller-supplied channel duration still wins, and sprite-atlas timing is untouched (both pinned in get-channel-timing.test.ts).
• A bare canonical Magic CDN filename is now a loadable model reference, and a loader-refused id can never wear the receipted-death caption (row 2405, dig 82a978a9 — iz's charzoo m20). A spec ref of public.<b64>.glb — the canonical tagged-import identity minus its two-character /cdn/ prefix — was refused by startLumeModelLoad (not in manifest, not URL-shaped), and the refusal then flowed through getUnreadySceneAssets as failed, whose scene-note clause teaches "the asset host itself answered a terminal verdict … a receipted death, not a guess" — for a request that was never made, about a file that was serving 302/ready the whole time. That caption sent Savi and two digs hunting server-side status doors. Two halves: (1) the primitive — synthesizeModelUrl extends the loader's existing URL-shaped synthesis to bare canonical public.<b64>.<ext> filenames (shape-tested by BARE_CANONICAL_MAGIC_CDN_FILENAME; the kiln grammar owns validity, a malformed payload earns the CDN's own teaching 400), used by both startLumeModelLoad and resolveModelLodId, so the two-missing-characters failure class stops existing; (2) the truth surface — ids the loader still refuses (neither URL-shaped nor canonical-shaped) report the new unfetchable status, whose clause states the actual truth: "not a fetchable reference … no request was ever made, so nothing failed and nothing is generating," with the /cdn/ prefix teach. The refusal console line now says the same. (Companion kiln change, same PR: the geowire fail-open row marker rewords failed-open:<reason> → degraded-serving-original:<reason> — the bookkeeping bits stay, the death-prime on a serving row dies.)
• Renderer/client engine diagnostics reach Savi on relay rooms — the egress fold (ledger 2380, dig 292859c6). engine.diagnostic Commands (the scripted-look/material/texture-script fault family, renderer crash rails, mutation warns — every client-reported code in tome/engine-diagnostics.ts) had ONE terminus: the kernel server's command registry. On the relay tier — the default room host — every report died at the egress dead-lane drop (relay-command-lanes.ts lane "none") with no fold anywhere: the seam note claimed "the local runtime log carries it" while nothing did, so Savi was structurally blind to every renderer-side creator-fixable fault. The dig's specimen: five named scripted-look-compile-failed errors fired (a creator's one-line TDZ) while Savi filed a phantom engine bug twice. The row is { lane: "local", consumer: "diagnostic" } now: the egress consumes the command into the SAME validate → sanitize → dedupe → runtime-log → DM-class machinery the kernel server runs (foldEngineDiagnosticLocally), against the LOCAL client world — the ring row lands where getLogs and incident dumps read, and the error-class first-occurrence DM rides the EXISTING tome.dm.notify forward the same egress already consumes into the "dm" RPC lane (never a new pipeline; kiln's notify door holds the durable once-key dedup, and the spec-version-scoped key means N clients folding the same condition cost one Savi turn). Warning/info classes stay logs-only; storms and budgets are the kernel terminus' own. One known redundancy, accepted as honest: mutation-warn now lands twice in a relay ring (the local sink's raw row + the fold's framed copy), both cooldown-gated. Perf-category pointer DMs (notifyPerfDm) still no-op on client worlds — their log bodies now land, the hourly pointer remains kernel-only.
• Scene RPC answers stamp the APPLIED spec version — the attached-but-frozen eye is convictable by version (ledger 2337, 2266's residue face, incident c24dc25b). The 2266 room-feed stamp moves only on TRANSPORT edges (room-feed-state.ts: connect/attached/reconnecting/detached), so a socket that stays "attached" while receiving/applying NOTHING passed every EYE-STALE gate — the field specimen answered camera-responsive identify/look RPCs from spec v2 for ~15 minutes while the room's doc head was v14, and Savi burned the window on restarts, terrain rewrites, and a false engine-fault filing. RoomFeedSnapshot now carries appliedSpecVersion — the world's applied TomeSpec.dbVersion (the same number run_script results carry as specVersion), recorded at the worker→parent telemetry relay hop worker-browser-host already owns (noteAppliedSpecVersionFromTelemetry, beside the viewport injection) — so every scene-view/identify answer names the world version it was rendered from and the tool side can compare it against the doc head it already holds. Deliberately a stamp fact, never a state edge: the transport machine is untouched (its job is transport). Absent until the first telemetry tick names a dbVersion — old engines and version-less worlds keep today's stamp byte-identical.
• The frozen-feed recovery directive — the tab that never processed a welcome can now be cured from outside (ledger 2342, the eye-integrity family's fourth face). The 2342 class: a realm frozen at join (applied spec stuck at v2/v3) that keeps answering camera-responsive scene RPCs, restart-immune (a relay rooms reset forces fresh welcomes and the field tab stayed at v3), invisible to every transport gate (heartbeat echoes keep the silence watchdog green) and past every in-worker self-heal lane (884/945/987/1509/F3/F4 — all present on the field engine). Two faces: worker room-session ingress dead behind a live MessagePort bridge, and an orphaned realm serving eye+telemetry with no transport. The chat side convicts on the applied-vs-head stamp (ledger 2337) sustained across the engine's own five-heartbeat silence standard, captures a frozen-tab debug dump FIRST (three field specimens yielded zero), then directs recovery over the kiln page channel — the one path the conviction proved alive. Engine half (this changeset): a recover_room_feed client RPC (room-feed-recovery.ts, spawn.ts's lazy-import law). Rung 1 condemns the REAL room socket from the page realm that owns it (BrowserWebSocketClientTransport.condemn — the chunk-failure pattern: raw-socket close so the close event reaches the runtime; new CLIENT_EYE_RECOVERY_CLOSE_CODE = 4437 so the server's close row says why), converting the freeze into the existing close→reconnect→reattach→fresh-baseline lane. Rung 2 recycles the realm: the client session boot is now a named re-invocable (startClientSession), so the directive disposes the host — terminating the runtime worker and both renderers — and reboots into the current room through the same connect machinery the authored nav.room swap uses; single-flight by construction. No new detector rides the engine: the conviction edge lives tool-side, outcome-keyed, and old chat deploys simply never send the directive.
• Entity residency reconciles sim↔renderer — the tilemap sweep (#12968) generalized to the entity forward/release lane (ledgers 2382/2338/2376). The sim→renderer entity lane has no delivery guarantee either: stream-reset recovery discards buffered frames, a poisoned reader drops queued ones undecoded, and the lane can wedge wholesale while both endpoints stay alive (2382: the renderer answered RPCs and timed frames while every create/destroy/material after some T never materialized; 77a6fe7f: 12 spec-present houses invisible until restart). A silently lost frame on an otherwise-live channel left the renderer's applied set diverged forever — spawns that never materialized, and destroys whose release never landed: 2338's orphans drawn forever, their fx populations with them (2376). Now the renderer reports its applied entity set (RenderChannelReader.entityResidencyCensus — the reader's own liveEntities, cached per membership revision) on the same 1Hz perf-sample relay the tilemap census rides, and the sim's sweep (entity-residency-reconcile.ts, run from render/ecs-sync after the delta path) diffs it against sentEntities and repairs exactly the delta: missing entities re-forward FULL live state through the include-reconcile encoder (SPAWN + every forwardable component — draw, materials, fx programs — re-derived from world truth), and sim-dead ghosts get a delete frame whose DESPAWN reaps their fx populations with their carrier (handlers/particles.ts → removeParticleEntity). Pacing is the tilemap sweep's own — same quiet window, consume-once censuses, repairs re-stamping their own ids — with one forced adaptation: the quiet gate is per entity id (last lifecycle write), because entity churn is continuous in exactly the games this class hits (2338's belt spawns every hit) and a place-wide gate would starve forever, while a per-id gate leaves an untouched orphan judgeable regardless of churn elsewhere. Deferred (never discarded) while the channel is delivering, reset wholesale on writer swap / recovery snapshot / place transition / initial snapshot, and idempotent by construction: a misjudged in-flight forward re-states identical live values (never a despawn, never flicker), so a wrong judgment costs wire bytes, not correctness. The tilemap lane's synthetic ids are exempt in both directions — its own sweep governs that seam.
• Client debug dumps carry the applied entity set. EngineBugRenderDiagnostics.entityResidency mirrors the census (count + space-joined applied entity ids, ids clipped at 4KB on ingest with count complete; {count: 0} is a positive empty-world receipt, null = pre-instrument). The applied set in dumps was previously ZERO — 2382's "everything after T never materialized" took a full dig to establish; it is now one count compare against the sim's entity table and one grep over entities.
• Ordinary saves retire the journal fossils they supersede — the #12821 fence's condition extended from REPLACE-class to per-key (row 2394 P1, dig c37047e0). The gap: a host's adoption restate journals every hosted keyable entity as a keyed head — a live-world snapshot — and an ordinary-write save (Savi's heal, a creator's edit) superseded the book's values for the objects it touched but retired NOTHING in the room's journal, because the replace fence keys on replace TRANSITIONS only. A static entity never sim-writes, so its stale head was never re-published; it lay dormant while the room stayed hosted, and the first UNHOSTED join bootstrapped from the healthy doc then refolded the fossil over it (iz's Northshire: 13,694 entities re-journaled at a new epoch, y=15.5 fossils clobbering the healed y=17.7). Now the save's writer names the keys it superseded: kiln's mutation funnels (game-specs mutations, spec-save mutation batches) extract the batch's touched object ids (supersededObjectIdsForMutations — O(batch), never a spec diff), the relay SPEC lane mints them into entity-key prefixes (e:{id}:, deduped, alphabet-checked, capped at the mirrored 128 with honest under-retire on overflow) and rides them as additive retire on the checkpoint marker; cf-relay range-retires LIVE client-authored heads at or behind the marker under exactly those prefixes, in the same transaction as the truncation, under the fence's proven discriminators (is_tomb = 0, author ≠ #relay) and §9.2 hold discipline. Untouched keys' heads park, never drop (runtime spawns are legitimately un-authored by the doc); heads above the marker survive (a post-save publish is newer than the doc); replace-class markers are unchanged (their fence already retires a strict superset). Old relays drop the unknown field — today's exact marker; old writers never send it. Whole-doc PUT surfaces send nothing (they cannot cheaply name a touched set) — honest today-behavior, not a guess.
• The reflection rails (rail.emit/rail.noise) go LIVE-only — journaled history stops being re-adjudicated and stops re-firing at joiners' folds (ledger 2363; kills the invisible-players rejoin class). emit/noise are keyless journaled STATE, replayed to every joiner until self-compaction rotates them out, and their peer translators ignored the frame's phase entirely: every fold-replayed row re-ran the senderOwnsSource ownership walk against the receiver's MID-FOLD world. At a join fold the author's avatar hasn't applied yet (drop), and after the author's own rejoin it never will — avatar ids are player/<clientId> and a rejoin mints a new identity, so old rows' sourceIds dangle forever — manufacturing not-owner:unresolved drop verdicts for settled history at exactly the rejoin that most needed silence. Worse, a fold-replayed emit that DID pass the walk synthesized a live event.fwd the wire apply core fires unconditionally — the room's emit journal stacking as join-storm stimuli at every join (noise.fwd feeding the NPC perception queues the same way). The cure is the #12915/#12937 phase discipline the terrain rails already carry, at the strength the delta-events law demands for stimuli: a reflection is a stimulus, not state — its live consumers heard it when it rode — so catchup/repair rows now translate to nothing, silently (no re-fire, no ownership re-judgment: history was adjudicated when it was live; replay is not a new claim), exactly the posture translatePeerStateDeltas takes on delta.events one lane over. Live-phase rows keep the ownership gate exactly as deliberate (forged sources still refuse loud), and the sender's egress loopback stays live by construction. Pinned red-first in relay-peer-apply.test.ts; the terrain rails' phase tests ride unchanged. Design word (tide, settled): place-scope acts adjudicate by MEMBERSHIP — ownership walks are for entity-owned rails — so the live-path membership migration for reflection rails is the named follow-up, deliberately not part of this change.
• getPlayers answers SESSION TRUTH — both faces of the tag-predicate contract die in one predicate (ledger 2350, dig 28ec3308; 2141's escaping class). Every getPlayers/getHelpers lane (behavior ObjectAPI, camera API, the exec lane's bare globals) enumerated tags: ["player"] over the per-place tag index — a GAME-MUTABLE surface. Face A: a session body wearing the wrong class tag counted as a player (the summoned builder shell impersonating a roster member — 2141's class escaping its #12572 fix). Face B: a connected creator's avatar, in-sim and answering api.query({ radius }), vanished from getPlayers for 44+ minutes because its class tag was gone/index-invisible — and "SessionOwner without the class tag" is a real engine state (spawnPlayer's own suspension-stamp defense names it) a tag predicate structurally omits. The fix: spawnPlayer stamps the VERIFIED session class (the same room_host-token-derived helper bit the tag is minted from — kernel auth.ts, relay runtime-worker.ts) as SessionAvatarClass (engine/components/session.ts): plane authoritative, clientAuthWrite: "never" (stripped from every kernel-tier upload), no ObjectAPI writer (scripts structurally cannot touch it), replicate "aoi" so it rides the relay self-spawn create and kernel AOI replication to every peer. One enumeration body (tome/session-avatars.ts → query-utils querySessionAvatarsInPlace) now serves all lanes: stamped entities are judged by the stamp ALONE (reads components directly, never the tag index — a wiped tag can't hide a player, a wrong tag can't promote a helper, a suspension-stamped avatar stays enumerable); avatars WITHOUT the stamp (a pre-stamp engine's spawn folded into a mixed-version relay room) keep the historical class-tag query verbatim, a legacy lane that dies out with pre-5.2.27 engines. Same session truth now backs resolveObjectId("player")'s active-player sweep, resetPlayerEntity's class re-mint (closing the "re-mint off already-wiped tags" escape lane the dig named on 2141), and the SP-mirror exec rebase's player population. Row shapes pinned red-first in getplayers-session-truth.test.ts, both lanes.
• The audio decode budget is enforced at the service chokepoint — an oversized clip demotes to the stream lane before any PCM is paid (#13021, the #12517 split; 2026-08-12 device forensics). The renderer priced forced-buffered starts before decoding, but every other decode — the preload warmer's spec sweep, a JIT start's park→prefetch poll — reached decodeAudioData unpriced, so one long track held its whole PCM resident (the measured 66 MiB single-clip specimen behind the iOS WebContent kills). Two rails give the service's own paths the verdict, cheapest first: pre-decode pricing via one element-metadata probe when the encoded size is suspicious (>1.5 MiB SUSPICIOUS_ENCODED_CLIP_BYTES — past which no plausible lossy encoding decodes under budget), and a decode-time backstop so an over-budget buffer is never RETAINED (the transient decode is paid at most once; the recorded duration prices every later session before it even fetches). Pricing failure is never load failure. Either rail demotes the clip to the HTMLAudioElement stream lane the renderer would have chosen, and both are loop-aware — the estimate counts loop-conditioning's second copy — so a LOOPING clip whose decoded PCM lands between 8 and 16 MiB (~22–43 s of 48 kHz stereo) now streams with a wrap seam where it used to slip through and hold double its PCM. ensureDecodedBuffer stays buffer-guaranteed by contract and never demotes.
• Naturally-ended voices detach their WebAudio node graph — the leak behind the residual phone jetsam kills. Device forensics (2026-08-12, iPhone 14 Pro Max) traced the remaining game-tab deaths to jetsam reason=highwater at WebContent's 1536 MB soft limit, and syslog showed the growth driver: 17,903 AudioNode constructions against ONE destruction over a 22-minute session — every combat SFX built a gain(+panner)+bufferSource triad whose natural-end path deleted the voice map entry but never disconnected the nodes, each leaked source also pinning its decoded AudioBuffer. Disconnects are now a shared per-node-guarded disconnectVoiceGraph (one throw can no longer strand the rest of the graph — a naturally-ended source's stop() throws, and the old single try/catch skipped every disconnect after it), and the natural-end onended path runs it unconditionally.
• Constrained tiers stop paying desktop memory sizing. KTX2 decode runs ONE worker on non-desktop tiers — each pool member pins a ~17 MiB Basis wasm heap for the session, and the pipeline byte budget already bounds decode parallelism, so the second worker bought memory without throughput — and the transcoder releases its fetched wasm binary after instantiation in every realm. The fx terrain-height mirror is priced per tier (fxTerrainCapacityForTier): mobile gets 1 M samples + 512 chunk slots (4 MiB CPU + 4 MiB GPU) for the standard streaming profile it actually runs, instead of the desktop extended-horizon 16 + 16 MiB; overflow degrades exactly as designed — skipped chunks sample as "no chunk", counted in stats().overflowedChunks. And baked pose palettes (~4.6 MB of CPU pose frames per horde-batched model) are released on model asset dispose — the acknowledged F13a retention closes.
• The per-frame upload blanket dies — unchanged bytes stop re-shipping to the GPU every frame. The fx pool's pop-table writers self-mark their own rows (markTablesDirty deleted — interface, implementation, and all four call sites), so a frame uploads exactly the rows something wrote instead of every population row at 60 Hz (~330 of a measured 348 MB/min was provably-unchanged bytes). Terrain's slot-major pool mirrors die outright: GPU uploads read the per-chunk records — the wire truth — deleting ~25 MB of duplicated renderer CPU mirrors at 1089 chunks, with one named ordering change: picking sees edited heights at op-apply instead of at visual sync, the same freshness ground sampling always had. And the decals, lighting, and scripted-arena upload sites change-gate on content — static decal stamps upload once instead of 106×/s, the lighting pass + cluster-cull uniforms merge into one buffer with settled light records gated by compare, and still entities stop restaging their matrices (UploadArena.writeIfChanged).
• Voxel chunk batches build per-chunk inside the sliced batch loop — the fused shared-field batch mesher and its LOD group key are gone (dump a887d221, forest-carved). buildVoxelChunkBatchData sampled ONE field over the batch's bounding box; the client packer picks its 8-chunk batches by streaming priority, not adjacency, so a priority-order pick strung along a column or row (the ring's tick-7715 batch spanned 1×3×14 chunks) sampled 42 chunk volumes for 8 chunks — 5-40× the sum of its members' single builds (measured on the reporter's generator: 55 ms per single chunk, 2.2 s / 4.7 s / 10 s per batch, 27 s for a spread pick), one synchronous task with no cancel point. The client's 10 s stuck window then reaped every batch unread while the worker kept computing, resubmitted it after backoff, and the treadmill never converged: 32 chunks a session failed outcome=liveness reason=stuck on a desktop whose per-chunk cost was healthy, holes and see-through ground where those chunks should stand. Now buildTerrainChunkBatchOutputs runs every generator through the same per-chunk loop: N chunks cost exactly N single builds (byte-identical outputs — pinned), no batch geometry can multiply the work, the loop yields at the slice budget, and a cancel lands between chunks. The packer's terrainChunkBatchGroupKey LOD lanes (PR #6713's mixed-batch precondition) die with the mesher — a batch is one bounded pack of the priority-sorted selection and may mix LODs. Ronnie's session batches build in 0.4-0.5 s on the same box.
• Math.floor/trunc/ceil/round are spec-exact native pass-throughs in the sandbox Math shim (ledger 2317 — savi-filed incident ae7bdf9e). unaryMath quantized the ARGUMENT through Math.fround before calling the native, so every integer above 2^24 changed before the op ran — fround(334350000) = 334350016, floored: Math.floor(n) === n reported false for good integers, floor-division indexing silently shifted, and an integer-only sim corrupted inside every deterministic compile unit (behaviors and require()'d scripts/lib/* modules alike — only ad-hoc run_script escaped, compiling with native Math). These four ops are correctly-rounded per ECMA-262, natively bit-identical across realms — f32 quantization bought zero determinism there — so they join imul/clz32 in the shim's deliberate native-bypass family (exactUnaryMath: ToNumber the arg, run the native, no quantization either side; the result is always an exact integer, which doubles represent exactly to 2^53). Everything implementation-approximated keeps the fdlibm table and the f32 in/out contract unchanged. Pinned on Savi's exact repro numbers, on Object.is bit-identity to the natives across the f32-unrepresentable range (±0/±Inf/NaN included), and through the real compiled sandbox. Pinned games keep their engine's math per the shim's compat law — the version boundary is the compat layer.
• Numeric literals in authored source are exact — the f32 literal-quantize pass is deleted (ledger 2319 — savi-filed incident f4451f3f, 2317's sibling). quantizeFloatLiterals wrapped every float-typed literal (decimal AND exponential notation) in _f32(...), so authored constants changed before any code ran — fround(6.674e-11) ≠ 6.674e-11 broke byte-identity to a research sim's published physics constants inside behaviors and require()'d modules alike, while integer literals were already exempt and ad-hoc run_script escaped (the same realm split as 2317). ECMA-262 numeric-literal → f64 conversion is exact rounding, identical in every realm, and IEEE f64 + − × ÷ are correctly rounded per spec — so quantizing literals bought zero determinism anywhere; the f32 contract belongs to the sandbox Math shim's implementation-approximated RUNTIME members (unchanged: fdlibm table, f32 in/out), never to source constants. The pass, the _f32 runtime member, and its injection binding are dead; every literal spelling (integer, decimal, exponential) now parses to the same bits as native JS, in every compile unit (behaviors, lib modules, generators, UI — the UI realm was already exact, so the realms now agree). Pinned games keep their engine's math per the shim's compat law — the version boundary is the compat layer.
• On phones, a lock-preferring camera aims from the crosshair — the touch aim pin (Jacob's shooter: "fire shoots from where I click the screen instead of the center"). The pointer transport (worker-browser-host.ts createPointerTransportHandlers) publishes every pointer's NDC to the renderer, which authors the canonical pointerOrigin*/pointerDir* ray from it each frame — and the only thing that ever pinned that NDC to (0,0) was document.pointerLockElement, which a finger can never hold. So under a first-person camera on a phone every touch — the fire chip, the move stick, a look drag — dragged the canonical ray to the thumb, and getInputRay(input) hitscan left the crosshair. The pointer-lock manager now exposes the lock's touch twin, isTouchAimPinned() = authored intent held AND no visible cursor-need UI (the desktop retention rule minus the browser: a data-modal frees the finger the way it frees the mouse, the pass-through canvas tap re-pins the way the rescuing click relocks; mode and visibility never enter, exactly as an engaged lock survives them). The transport reads it per touch event alongside the browser lock — NDC pinned to (0,0), isLocked reported, input.pointer absent — so the sim, the renderer, and getInputRay see one lock story on every device. Mouse/pen pointers and wheel read the browser lock alone (a hybrid keeps its acquire/release flow; a touch beside a locked mouse aims from the crosshair through the touch-release exit). God mode and cursor cameras arrive as authored intent false (resolvePointerLockWirePreference) so tap-select, god handles, and tap-the-world gestures keep the finger, press stamps included; pointerLock: "drag" never pins. InputState.pointer / getInputRay docs and the pointer-raycasting / camera-first-person / camera-third-person skills now say the same thing: phones follow the camera, not the finger.
• A key held when an authored text field takes focus no longer strands — the self-walk input latch is closed (ledger 2345). The latch: press Enter while W is held → the game's composer autofocuses → W's keyup targets the focused field → the realm frame withholds it (isTextEntryTarget gate, deliberate — typing must never fire activeOn:"keyup" bindings) → the host doesn't RESET on blur-into-realm (deliberate — resetting there wiped every world click) → keysDown clears only on KEY_UP or RESET → the axis stays latched and the character walks until the same key is re-pressed or the page restarts. Two games independently built script watchdogs against this seam (Animalia's chatTyping, Death Valley's RUN-OFF GUARD). The fix is the realm twin of the host's existing editable-focus reset: the frame posts a textentryfocus pass on focusin into a text-entry target (the exact complement of its keyup withhold — a readonly field's keyups still forward, so its focus doesn't reset), and the host runs the same silent handleInputReset (RESET clears held state without synthesizing release edges, so no keyup binding fires from focus movement). Both deliberate behaviors are pinned unchanged: typing stays withheld, and world clicks survive the blur carve-out — the reset rides focusin-into-text-entry, never blur.
• The summoned builder body spawns a conversational step OFF the spawn point — the face-inside-the-camera frame is unrepresentable (BT's Fortress Run QA, dumps 8d7d5182/260e69a8). Every joining session self-spawns at the place's ONE deterministic spawn point (lifecycle.ts configurePlayerEntity: defaultSpawnPoint → player feetPosition → implicit terrain default), and in a first-person game the player's camera sits exactly there — so every builder summon materialized Savi's body 0.0m inside the player's head, and the shell's post-hoc arrival teleport (arrival-position.ts) only corrected it ~1.3s later, once per summon, every summon (three "spawned 0.0m from player/…" placements in one QA day on one app). The helper class (the verified room_host token class — never game-declared) now spawns HELPER_SPAWN_OFFSET_M (3.25m, the arrival etiquette's conversational band) along the spawn facing and already turned around to face the spawn point: the spot the etiquette used to correct into, decided at placement so the coincident frame never exists. Slope-aware (the offset spot never lands below the terrain sample there), 3D places only (2D modes have no first-person camera and their axes carry different meaning), and the same placement rides resetPlayerEntity's helper re-mint, so game resets stop slamming the body back onto the spawn point too. The spawn is receipted (HelperSpawnPlacementResource → the new session.spawnPlacement debug answer, supported:true seam-marker idiom): the shell's arrival positioner stands down on the receipt (arrival: engine-placed on /healthz) instead of re-correcting a body the engine already placed — a post-hoc correction would anchor on the body's own offset spot and could step it right back onto the spawn point. Older pinned engines answer no marker and keep the legacy post-hoc teleport byte-for-byte. Player spawns are untouched.
• Seat-aware authority family: replaceSpecWithStarter (and the naive mode-as-authority guards) work on the relay tier's elected host (ledger 2314 — jacob's live repro; tide's census, thread 1786845973). Savi's run_script on relay rooms executes on the ELECTED HOST client — the room's real authority since R5 (#12739): it runs the sim, and the exec arrives through the trusted room_host writer class (relay-script-exec.ts). But mutation guards tested getWorldMode(world) !== "server" — a pre-R5 rule that knows only server worlds and singleplayer clients — so the exact seat that IS the authority was refused. The primitive family (object-api.ts, beside getWorldMode): isPlaceAuthorityHere(world, placeId) on the readPlaceHosts spine (kernel server TRUE even for client-hosted places — it persists/validates; SP true; a relay-wire client from its elected seat, handoff-safe via the table's write-version memo + the make-before-break barrier), isRoomAuthorityHere(world) = the ANY-held-seat form for place-less verbs (the exec lane's own election: an unstamped request runs at the defaultPlace host when one exists, and at the sorted-first held seat when every player has walked out of the default place — room code is room-scoped, so the whole-room predicate answers the same question), and isGodModePersistAuthority hoisted beside them from the god-mode edit accumulator (semantics unchanged). Swapped in this pass, per the census's naive-safe list: the replaceSpecWithStarter guard (the throw fix — jacob's repro; the swap's live-teardown choreography is a separate follow-up), the field-bound scatter refresh (refreshFieldBoundScattersForField), the apply-path scatter heal (the delta-0 short-circuit's pending-recovery veto + its bed-set collection), first-load scatter re-admission (readmitScatterBedsForModel, per-bed seat), and updateObjectSpec's persist axis (explicit persist on the place's elected host persists through the kiln mutation lane; every existing path keeps its default). Deliberately NOT swapped (each needs its own choreography, named so nobody naive-swaps them later): reset() (relay drain + peer convergence), emit (deferred-op), player-body minting (owner-client axis), the teach rails. Kernel-tier duties, the getWorldExecutionMode family, and the SP no-netcode carve-outs keep their mode reads — those really are mode questions. Original law preserved: spectator/non-host multiplayer clients refuse with the same teach verdicts. Pinned on the relay multi-client harness (exec-lane swap on the elected host, non-host teach refusal, election handoff re-answering) and unit-side beside the scatter-host-mint precedent.
• The shader shed's probation is backoff, never terminal — and CPU-fused frames can't burn it (ledger 2353, jace's Tab M11 no-recovery report). Two legs in the frame-budget park machine (frame-budget-report.ts). (a) A staged-recovery probe that re-offended used to re-park as "probe-reoffense" — one probation per ref per session, edit-only after — so on hardware where any single re-enabled material tips the 40ms fused line, every ref burned its one probe and the whole scripted lane converged to a reload-only shed. The terminal reason is deleted; a re-offender re-parks recovery-eligible ("frame-budget") and each re-offense doubles the stable stretch the next probe must wait for (×2…×4 capped, RungWalker.probeBackoff's proven shape; a probe that survives probation resets it). The backoff IS the flap protection — a ref the device can't afford converges to rare probes, never to a permanent park. (b) The driver-lane re-park judged the fused signal — max(cpu, gpu, interval) — so a CPU spike coincident with a probe permanently latched the material on evidence the machine's own attribution law (handleFrameBudgetEvent: parking GPU work cannot recover CPU-bound frames) classifies as non-evidence; laggy CPU-heavy combat on a Helio-G88 was exactly this shape. The re-park site now requires GPU-attributed evidence, same as the park that opened the episode; a CPU-fused over-line frame only restarts the probe's stable clock. Post-park baseline judging, relief verification, futility restore, and look-park semantics are unchanged; the repark diagnostic no longer claims "for this session".
• The boot gate's adapter-null verdict stops latching the Browser-Update wall (ledger 2352 — 500 adapter-null rows / 15 sessions in one day on one app, current-stable Android Chrome/151 told "Update your browser" by a wall updating could never clear). runWebGpuBootGate requests the engine's core-level adapter (featureLevel: "core" — lume's floor: cube texture views, per-stage storage budgets above the compat limit); on GLES-only/compat-mode Android GPUs that request resolves null, and the null latched WEBGPU_REQUIRED_ERROR_MESSAGE → kiln's update wall. The API's presence already proves the browser is current enough, so the gate now classifies instead: a one-shot featureLevel: "compatibility" reprobe (a classifier, never a render adapter — the ledger #294 same-adapter law is untouched) splits the class into (a) compat adapter answers → a real, working GPU below lume's core floor → the new webgpu-core-unsupported condition + cant-run copy (no update or setting fixes it; if lume ever grows a compat tier, this probe is where boot re-routes instead of walling), and (b) nothing answers at any level (acceleration off, blocklisted driver — ledger 144's population) → the existing webgpu-device-unavailable condition + honest no-adapter settings copy. Adapter-request rejections join (b). WEBGPU_REQUIRED_ERROR_MESSAGE now has exactly one producer: navigator.gpu absent — the one condition a browser update actually fixes. Both new messages ride the retries-cannot-heal condition rail (kiln walls by condition and stands its boot-stall auto-retry down) and match none of the wrong-class matchers on either side; console warns keep the "WebGPU adapter request returned null" stem the fleet's DD counting rides. device-perf.ts's ledger-895 comment claimed these devices "stop at the device wall" — corrected to the truth in the same diff. Kiln's routing half lands beside this: the core-unsupported condition renders the cant-run wall (jacob's #12893 copy family), adapter-unavailable messages from pinned engines render the settings wall instead of the update wall, and a requires-WebGPU message on a page whose own navigator HAS the API routes to the settings wall too — the retrofix for rooms pinned at ≤5.2.26, which keep latching the old message for weeks.
• Worker-side gpu-unavailable boot deaths carry terminalBootCondition: webgpu-device-unavailable (ledger 2316 — savi-filed incident 97ca7a7c, Shoguns Return on mobile). The renderer worker's own WebGPU acquisition can refuse when the page probe passed (lume device.ts adapter-null / OffscreenCanvas-context class — ledger 280's split, now common on phones), and that death routes through latchFatalRendererError → playerWordsForBootFatal, whose r-9f46c2eb copy mapping rewrites the raw diagnostic to the calm gpu-unavailable sentence. The mapping ERASED every raw string kiln's wall matchers key on (isWebGPUAdapterUnavailableError knows "webgpu adapter request returned null", never the mapped sentence), so kiln's recovery-verb passthrough rendered the reload chip for a deterministic capability refusal — reload re-earned the refusal forever. The fix carries the CLASS, not the words: latchFatalRendererError classifies the RAW diagnostic (the same GPU_UNAVAILABLE_DIAGNOSTIC the mapper uses) and latches the named WEBGPU_DEVICE_UNAVAILABLE_CONDITION beside the mapped copy — the rail kiln already reads end-to-end (isWebGPUDeviceUnavailableVerdict → guidance wall; boot-stall.ts latches the verdict and stands the auto-retry down). Sticky re-asserts keep the condition (a racing progress post used to be able to strip routing); reload-class faults (device-lost, generic worker deaths) stay conditionless on the reload lane — the ledger-206 boundary. Pinned on both sides: the producer's condition rides every re-assert, and kiln's wall routes on the condition under ANY copy, including a deliberately reworded one.

technical notes

• Catchup-phase rail.voxelEdit rows skip present-authority re-adjudication — settled terrain history applies at the joiner's fold (ledger 2268 fix 2, #12915). A journal row replayed at catchup was already admitted by every live observer when it rode, and the relay attested its sender — but the peer translator re-judged it through senderOwnsSource against the FOLDED PRESENT, where journal self-compaction has checkpointed away the prefix carrying the source's create and seat facts. A departed session's edits therefore resolved to nothing and settled terrain silently dropped at exactly the rejoin that most needed it (dig e5e315b8: 65 drop lines in 7d on one app). Catchup/repair rows now skip the re-adjudication; the skip stays visible (warnOnce rail.voxelEdit-catchup-skip when the folded view would have refused). Live-lane rows keep the authority gate byte-for-byte.
• Player-edited chunks jump the background remesh/collider queue (ledger 2268 fix 5, #12917). Dirty marks sourced from a TerrainChunkEdits mutation (owner + halo) carry an edit-touched flag, and both terrain build systems promote a bounded number of flagged chunks per tick ahead of the background rebuild ordering (residency sweeps, epoch-reset restates, connect backlogs), after the existing safety lanes: server promotions cap at max-submits−1 so a full tick always leaves a budgeted background submit; clients ride up to 6 promoted chunks/tick as single FULL-artifact jobs (mesh AND collider in one build) above already-queued batches. The live voxel-edit fast lane is untouched; beyond the cap a sustained edit storm competes at ordinary streaming rank, so background rebuild always progresses.
• Churn shield for the texture bake-budget park rail (ledger 2271, dig 51dda5db, #12921). The bake budget's wall-clock law (ledger 628) measured a starved worker's DESCHEDULING as script fault: at join crunch two false faults parked healthy texture scripts 30s, and the probation probe re-faulting under the same churn doubled it to 60s — the 2271 lava-over-invisible-ground 90-second window. Third shield of the family in renderer/scripted-texture.ts (worker startup never counts against the draw; the runaway watchdog re-arms per slice): a budget fault measured during host frame churn — a >250ms tick gap observed inside the attempt window, or the live clock mid-gap at settle — doesn't count toward TEXTURE_BUDGET_FAULTS_TO_PARK and doesn't double a probation delay; the ref retries on the quick 2s ladder until the host produces calm frames. Calm-measured faults keep the law exactly as written (a hot draw loop faults in every window, so ledger 628's park is intact — pinned by test). churnShielded receipt rides RetryState into getTextureResidencyDebug for incident dumps.
• destroy(root-id) reaps an orphaned derivation tree — and orphans are honestly destroyable (ledger 2275, savi filing 79255910, #12924). Gran Premio: spline roots spawned via run_script were destroyed, but their derived children (~788 live entities — spline segments, collision, posts, rails, kerbs) survived with NO destroy path left: destroy(root) hit the dead-target branch and read spec-absence + entity-absence as "already destroyed", and the persist half's skip receipt ("no object in the spec — destroy is idempotent") taught Savi the orphans were indestructible; the only cleanup was a room restart. A live derived child is now the counter-proof of "already destroyed": destroy(dead-root-id) reaps the live derivation tree before the zero-match warn — each stranded child through the full per-id destroy machinery (relay tomb routing, provenance, nested cascade), exactly what the live cascade would have done. destroyObjects catches the orphan shape and verdicts "destroyed" instead of "not_found" (the re-sweep is honestly not_found); the clientDestroy fan-out receiver reaps other worlds' locally-lofted derivation trees too; kiln's mutations-route skip copy now names the DOCUMENT half a no-op instead of saying "destroy is idempotent". Genuinely-absent ids keep the warn and their idempotent no-op unchanged, and the orphan enumeration is gated cheap-first (marker-column scan before the id-inference walk) so the missing-target hot loop never pays a hierarchy scan per miss.
• God-mode light markers draw x-ray, pick through walls, and mint for nested children (ledger 2264, dig 91d1634e, #12904). Three convicted mechanisms behind "lights with no icon, can't edit them" (cal's Final Abyss), fixed together because each half lies without the others: (1) markerMaterial gains depthTest: false, routing markers to lume's overlay lane — a depth-tested marker embedded in a wall plane rendered nothing from nearly every angle, and marker-only lights had zero visual presence (guides — range rings, beam edges — stay depth-tested); (2) commitTapSelection and resolveHoverTargets promote editor-visual ROOT hits above nearer world-geometry hits, in lockstep, so the x-ray icon the creator aims at receives the click even through a wall; (3) forEachSpecObject recurses into children (464 of 1040 Final Abyss lights are children — no marker ever minted), child ids mirroring the interpreter's expansion via the shared specChildEntityId so id-less children get the same child-{index} ids applySpec spawns. Depth-capped like the interpreter.
• The quality governor judges renderScale cuts by the SERVED scale, and health names the internal-resolution floor's fold (ledger 2261, dig 9b12cc1b, #12901). The governor's walk now folds through the same SceneScaleFoldFacts the frame seam consumes (renderer supplier → foldSceneScaleWithFacts), so relief and costHint charges for renderScale cuts are measured on served values: a rung the floor nulls is passed through instead of burning a settle window, and a partial fold charges only the pixel work it actually removes (the ≤1440px density-≤1.5 canvas class — ledger 2261's tablet). Client health gains renderScaleAsked beside the served renderScale, and describeClientQuality names the fold in words: "renderScale 1 (the ladder asked ×N; the internal-resolution floor keeps small canvases legible by design — planned, not a stuck cut)".
• Reap rails require a stalled sim, not a missing beat — the saturated-world treadmill is dismantled (ledger 2265, dig 50710955, #12907). On the 1-vCPU room host the relay beat rides the sim drain, so a world that saturates the sim budget starved the beat past the 15s window while the sim kept ADVANCING; stale-shell-reap and beatless-replace read that starvation as death, killed the working host, and re-paid a 2-3 minute hydrate per kill (103 summons in one day — the treadmill manufactured the outage it policed). advanceShellLiveness now folds worldTick into every answered probe (lastWorldTickAdvanceAtMs + an observed ms-per-tick receipt); decideShellLiveness holds the stale reap while an advance is inside SIM_SATURATED_HOLD_MS (10 min — a frozen sim stops bumping the stamp, so a corpse still reaps bounded); the beatless-replace gate reads the same facts off the ensure answer's shellLiveness rider and LEAVES an advancing sim alive past the cutoff, while a stalled/never-observed worldTick replaces exactly as before (pre-worldTick engines keep the old gate byte-for-byte).
• Overload confesses instead of mystifying. Beat proven absent + sim advancing slower than 2× budget mints a HostOverloadFact that run_script's terminal copy quotes — "this world saturates the host's sim budget (observed ~Xms per tick vs 33ms)" instead of relay_exec_no_host_tick mysteries; retired by the next ticking proof and by age, rate-gated so an egress fault never wears saturation copy. view_live_scene's connected-but-no-frame class (RPC-ladder timeouts, no-frame-yet, WebGPU readback teardown) is now booth-eligible with a caption naming the drowning tab instead of claiming "not connected". And a 401/403 on a server-realm /magic asset warm mints a 10-minute tombstone with retryAfterMs (an ungenerated Magic CDN variant needs an authorized surface the headless shell doesn't have) instead of re-asking every spec-sync forever; browser /cdn/* 401s and /magic 404s keep today's behavior exactly.
• Savi-placed todo markers leave the walked world (jacob's four-beat ruling, #inventors thread 1537819871167914064). Todo markers now carry placement provenance (author, stamped at creation — kiln's savi_todos.author, never inferred). Creator-placed notes render exactly as before, everywhere they did. Savi-placed todos are hidden from the walked world by default and materialize only while the creator is in god mode (the workshop view), spawning settled on the mode flip — no assemble storm. In god mode they are display-only: every _savi-todo/ entity resolves to null in resolveSelectionOwnerEntity, so god-mode controls (select, hover→drag, attach-pick, the server selection applier) pass through a spark like glass instead of grabbing it. The wire also accepts worldVisible: true per row — the creator-said-yes opt-in that renders a savi todo like a creator one (kiln-side storage for the flag is a follow-up; the engine contract is complete).
• The texture give-up park is a bounded 5-minute re-probe ceiling, not a terminal verdict (ledger 2267, chukinice's pink blocks, #12912). 15 anonymous transport failures used to park a texture {terminal, retryAfter +1h} — and revalidateResidency deliberately skips terminal parks, so a boot-window network flap stranded healthy voxel textures on the placeholder for the whole session, page refresh the only reliable cure. But the ladder reaches the give-up branch only WITHOUT a server verdict (tombstones, dead 4xxs, quota windows all classify first), so the 15-failure fact is about this session's transport, never the asset — terminal was the wrong shape. The crossing now settles the ladder on its ceiling: non-terminal, retryAfter = 5min (the existing long-cooldown family) + up-only jitter. The tick timer re-probes every ~5min forever (12/hr/client/asset), the visibility/projection recovery sweeps cut the clock like any transport backoff (the reporter's observed tab hide/show cure, now mechanical), and source changes / the cdn-session wake still clear immediately. Server-verdict parks (cook-kill tombstones, dead 4xxs, transport-less URLs) stay terminal — the tombstone-hammering class (dig 628c4096) stays closed.
• window.spawn.view.captureFrame() — game scripts photograph the calling player's own view (r-709895c6, #12913). Safari Islands' photo mechanic died on the authored-realm cutover: HUD JS lost spawn-canvas.toDataURL() and no realm lane handed game code the rendered frame. The primitive, not a pipeline: captureFrame resolves a JPEG Blob of the invoking player's own game-canvas frame (the same swapchain-readback core Savi's chat screenshots use — ≤1280px, encoded in the render worker); display is URL.createObjectURL, sharing is the already-allowlisted assets.uploadImage — capture→upload→use, each verb doing one thing. One capture in flight per realm; coded capture_unavailable verdicts. Own-view-only and canvas-only are structural, not policed: the responder runs on the capturing player's page, no protocol message addresses another client, and the capture reads the WebGPU swapchain — kiln chrome, the rail, and the HTML HUD cannot appear in the pixels. No pixels reach a server unless the script uploads. game-ui.md + the PHOTO_CAPTURE_UI tome example teach the compose.
• Shape-key drop at GLB parse warns once per file, honestly (ledger 2279, #12925). The lume parser's fixed vertex slots drop morph targets by design (jure holds the support door). The drop's only trace was a per-primitive "N morph target(s) skipped" line — parser jargon that a multi-material face minted once per primitive, flooding the 3-named cap on the model-parse-warnings diagnostic; a creator uploading a blinking face learned nothing. Now ONE file-level warning rides the same ParsedGltf.warnings lane (surfaced per-asset via reportModelParseWarnings, ledger 1862): "this model carries N shape keys (morph targets) — the engine does not support them yet; they were skipped, the rest of the model loaded". Counted from the raw JSON (primitives skipped for mode/Draco still count); per-mesh count is the max across primitives per the glTF spec, the file's is the sum across meshes. No behavior change otherwise — the drop stays, it stops being silent.
• Relay tier: authored function clips ratify again — the simulator mints, the save lane delivers (ledger 2280, #12930). Third specimen of the unported-server-organ family (after relay-reap-lane and relay-script-exec): the ratifier (ingestAuthoredClipOffers, a mode:'server' system) never got ported when the Aug-5 flip made relay the default room host, so every multiplayer app on engine ≥5.2.18 staged AuthoredClipOffers nothing in the room could ingest — assets.authoredClips stayed empty and every remote renderer held rest pose (Nine Heavens' 129 frozen NPC rigs, 4 reports). Relay needs no ratifier organ at all: kiln is the spec authority there, so the single-live-writer rule the offer leg respected dissolves. canMintAuthoredClips now answers true on relay wires (ClientRelayWireModeResource); the entity's simulator — the one machine that can sample the played closure — mints directly, and a new client-seat system (tome/authored-clip-relay-fold, self-gated relay-and-not-singleplayer) drains the same pending→fold path the kernel server runs: both spec views + TomeSpec push + one patchAssets row the mode-both drain forwards into the relay save lane; kiln folds it onto the durable head and the SPEC fan-out delivers the library to every member. The offer leg is structurally unreachable on relay; stale pre-fix offers retire through the existing client sweep the moment a re-play mints their identity. Kernel tier byte-identical (offer→ratify→sweep); non-editor simulators' mints stay session-local at the save lane's permission gate. E2e twin: relay-authored-clips.e2e.test.ts (verified red on the pre-fix gate).
• Savi todo markers own their prefix — untracked _savi-todo/ entities reap through the ordinary delete path (ledger 2278, dig 9b07936f, #12929). The marker reconcile despawned only what its own state.entries minted THIS session, so a fossil from any other origin — a prior session's copy restated by a relay journal head (the pre-2081 statement lanes journaled client-realm sparks as durable keyed heads), a peer's world-sync answer — was invisible to it from birth and stood forever once its todo row died: ress's 2,244 shards = 132 todos × 17 cubes, one full set per marker the app ever minted; raw-exec destroys were client-local and the journal restated every shard on the next visit. THE INVARIANT: the marker system OWNS _savi-todo/ — anything under the prefix the live entries did not mint is an orphan, reaped at every reconcile through the ordinary delete path (the ObjectAPI destroy verb): on a truth relay the ghost-destroy gate's provably-unowned lane tombs the journaled head on the reap lane, so a swept fossil cannot be restated at the next fold. Deterministic ids make the sweep exact; belt-and-braces, every minted spark entity (cubes + shockwave) now carries TomeSpawnedBy rooted at the live local avatar so client-realm-scope-reap covers the family by the standing lifecycle rule too.
• Mesh-kind occupancy stand-ins carry the local-bounds center (ledger 2282, #12931). api.overlapPoint/overlapSegment resolved convexHull/trimesh/bespokeMesh colliders to a bounds box centered at the BODY ORIGIN — but the 3D body factory attaches the raw vertices (plus the collider-desc translation) to the body untranslated, so geometry authored off origin (Savi's shared-anchor cave walls, ~30m from their own feet) probed at a ghost position: the drawn wall read empty, the empty feet read blocked. resolve2DMeshFallbackHalfExtents becomes resolveMeshFallbackLocalBounds — half-sizes plus the BODY-frame center (vertex-cloud midpoint composed with the collider-desc translation, resolved from the same sources makeColliderDescs builds colliders from). The occupancy OBB and the F3 mesh marker now sit at that center, rotated with the body (the box case's translation precedent). 2D consumers are untouched by construction: the 2D fallback CUBOID is origin-centered (makeColliderDescs / mantle parity), so the feet-offset, 2D collider-desc, and mantle paths keep reading half extents only. Rapier-truth pins verified red on pre-fix code (dig cff2411e): an offset-authored bespokeMesh answers at the DRAWN wall and stays silent at the feet-displaced ghost, both directions, with rapier ray receipts for where the vertices actually are; centered-mesh control unchanged. The approximate contract (a concave shell's box covers its interior) is documented behavior and unchanged.
• Relay tier: the loop-voice registry gets its wire — 4th specimen of the unported-server-organ family (ledger 2280 census). On relay rooms the registry (TomeSoundLoops, music-apex D3) had NO writer and NO wire lane: recordSoundLoopStart's gate (isSoundLoopAuthorityWorld) refused every multiplayer client, the ingest sweep is mode:'server' and never runs on the tier. So audio.playing().loops answered [] in every relay room (the census the audio skill teaches Savi to sweep with), the stopSound never-minted teaching lost its registry belt, and a late joiner had no standing-loop truth at all — loop starts are juice EVENT rows and relay catchup strips event rows as history (the join-storm-juice gate in relay-peer-apply). The port is the relay-music-lane pattern verbatim (same tome/spec entity, same free-running-clock problem, same journal): the play-executing client — the room's one machine that saw the verb — records into its LOCAL registry (isSoundLoopAuthorityWorld gains the ClientRelayWireModeResource arm, the #12930 mint-gate stamp), publishRelaySoundLoopsHeadIfChanged ships the head as one anchored tome/spec keyed row on both netcode egress edges, and the ingest half rebases every entry's startTick into the receiver's clock, strips the rider, and stamps the echo guard — LWW whole-map by the room's total order (the concurrent-jukebox posture, named in the lane doc). Scope, honestly: this delivers the CENSUS and with it the primitive creator code needs to replay standing loops for joiners (the D3 posture — the sweep stays creator code); no tier auto-replays registry entries audibly, a cross-tier pre-existing gap. E2e twin relay-sound-loop-lane.test.ts (mint gate both wires, anchored egress + quiet-tick dedupe, stop head, catchup rebase = the late-join delivery, round trip through the real parse gate, anchorless strip), verified red pre-fix: reverting the mint gate alone fails exactly the four mint-dependent pins.
• <a href> anchor clicks in authored game UI ride the openLink door-out lane — the third silently-dead external-link spelling dies (ledger 2286, savi filing ff51ce5b, Shogun's Return round two). The realm sandbox has no allow-popups and the shell owns navigation, so a target="_blank" anchor click died with no confirm, no window, and no error anywhere — and a default-target anchor would have navigated the realm document itself away, killing the game UI behind a frame-refused external page. A document-level bubble listener in the frame (realm/frame/open-link.ts) now consumes every external http(s) anchor/area click and routes it through the same openLink machinery as window.open: partner domains (exactly discord.gg) request the owning shell's confirm sheet naming the destination; anything else gets the readable refusal verdict plus the teaching line in getLogs; http refuses not_https loudly. Authored preventDefault() keeps the click (game code that owns its anchors is untouched); fragment/javascript:/unresolvable hrefs keep native in-frame behavior. Same allowlist, same confirm, same rate caps — no policy widening beyond jacob's 08-14 ruling.
• Character-controller tuning is now authorable from object physics (savi platform-gap filing 043591b0). PhysicsCharacterControllerConfigValue always had every field; the spec merge exposed only autostep. The merge (tome/physics.ts) now resolves the whole config from the spec: maxSlopeClimbAngle / minSlopeSlideAngle (DEGREES at the spec surface, clamped 0–90, radians on the config), slideEnabled, snapToGroundDistance (meters, non-negative, false = never snap), characterMass (kg, > 0), applyImpulsesToDynamicBodies, offset, normalNudgeFactor. Defaults unchanged — 45° climb, 0.4 m snap, slide on — so every existing game builds a byte-identical controller config. Wrong-typed/non-finite values drop per field so the default stands; filterGroups stays owned by collisionGroups, up/filterFlags/gravityScale stay non-spec (probe incoherence / raw backend bitmask / dead field). Authored values echo in getProperty('physics') (degrees/meters/false, only when differing from the defaults) and re-applying the read-back reproduces the identical config; removing an authored field resets it to the default on re-apply. The controller-config defaults now live in ONE home (tome/physics.ts DEFAULT_CONTROLLER_CONFIG; interpreter + ObjectAPI consume it), and spec re-applies value-compare (f32-tolerant) before writing so an unchanged re-apply no longer dirties replication.
• Chunk journal identity is a content hash, not the (revision, timestamp, count) triple — the rejoin stale-terrain hole (ledger 2268 fix 3's residual class). The chunk build cache key, the durable-baseline install's converged-skip, and the serialize-reuse fingerprint all identified a chunk's edit journal by appliedRevision:lastServerTimestamp:count — unique on ONE lineage, but a relay rejoin merges lineages (the container-era baseline rebases under the session journal, an answerer's world-sync statement is compacted into synthetic ids, a reorder wears the same stamps). Two journals of different content under one triple meant the cache answered the STALE inputsHash and the installed mesh passed as current — or the converging install was skipped as "already converged". terrainChunkEditsContentHash hashes the ordered editId sequence plus each command's bbox/payload, memoized per value object; all three fingerprints now include it. Pinned: same-triple journals with reordered/foreign ids/different payloads hash differently; a byte-identical re-statement stays the churn-free fixed point.
• The ownership walks are controller-aware on chain links — transferControl now moves a whole spawned subtree's authorship, not just the target's (ledger 2299, incident 9eca5c1d). Both owner walks — the server's resolveEntityOwnerClientId (tome/ownership.ts) and its client mirror walkReplicatedOwner (tome/api/control-utils.ts) — probe TomeController at EVERY link of the TomeSpawnedBy chain instead of only on the starting entity. Controller-blind, children of a member-driven vehicle resolved unowned: the place host claimed them into its hosted remainder and published them while the driver's envelope published them too — two writers on one hierarchy, and the host's stale/projection-poisoned child locals LWW-fought the driver's live stream (unbounded parented-child drift on every observer, made durable by the host-realm spec save). Now a driven hull's spawned children resolve to the driver's anchor: exactly one publisher, and host-driven vs member-driven vehicles behave symmetrically. Untransferred chains, stand-riders, and bone children are untouched (the walks never read TomeParent); a chain link's controller outside local AOI reads conservatively as maybe-owned, like every other dangle. The dead isEntityOwnedByClient export (zero callers) is deleted rather than left as a third controller-blind copy of the walk.
• A lost GPU device can no longer strand the headless capture rig — captures answer a structured renderer-restarting verdict (ledger 2292, savi filing bc24dd58, #12940). The Ashenreach dead hour: the capture rig's GPU device died and stayed dead ~1h — every free-camera capture surfaced the raw Dawn throw ("Failed to execute mapAsync on GPUBuffer: [Device "spawn renderer"] is lost"), viewport grabs claimed "the renderer has not produced a frame yet", and six wisps stayed blind continuously. Kernel half: after device.lost latches, the frame loop keeps ticking (WebGPU calls on a lost device are no-ops), so the capture admission gate saw a live loop and parked captures toward raw mapAsync throws. Now deviceLostPosted answers every capture ask immediately with the structured verdict (DEVICE_LOST_CAPTURE_ERROR — planned-events law: "this is a device/renderer failure, your content didn't cause it"), checked first in frameLoopPausedReason and translated at the three result funnels (scene view / object preview / pixel provenance) so even the in-flight capture racing the loss answers the verdict, never the raw driver text. The booth half (dead-eye retirement → reason 'renderer-restarting', the automatic renderer restart for headless sessions) deploys with the booth process, engine-version independent. Receipts: pre-fix red (3 failed) then 32/32 renderer-device-loss vitest green.
• The network ring names its own planned requests — designed opacity wears [probe]/[opaque], never failure vocabulary (ledger 2290, dig 63bce214, #12943). Every dump of every audio-playing game carried a wall of fake "[error] 0B" rows (~2k/day platform-wide): magic-cdn readiness probes answer opaqueredirect (status 0 / 0 bytes BY DESIGN), and payload fetches ride a 302 to spawnfile.io whose missing Timing-Allow-Origin zeroes sizes for fully successful 200s. The ring classified both as [error]/[stall], teaching every reader — Savi included — that audio was failing while the serving path was healthy end to end. A probe is field-identical to a genuine network error in every PerformanceResourceTiming attribute (verified empirically in Chromium: all-zeros either way — opaque-redirect filtering, not the TAO check, zeroes it), so the engine now names its own planned request: ensureMagicCdnAssetReady registers the URL with the ring (noteResourceProbeUrl, bounded) before the probe fires, and the matching all-zeros row labels [probe] — regardless of duration, replacing the <2ms carve-out that missed every network-served probe on a real-RTT link. A media element loading a registered URL reads the same designed zeros and labels [opaque]; the TAO-blinded successful fetch is detectable without registration (Chromium exposes responseStatus through a failed TAO check while zeroing sizes AND responseStart, so status 1-399 + zeroed sizes + responseStart 0 labels [opaque] — a TAO-passing cache hit keeps decodedBodySize/responseStart and can't match). Both labels ride the NORMAL TAIL, never the anomaly ring — designed opacity can't evict real failures. The honest-failure lane is untouched: status>=400 and unregistered same-origin all-zeros with wall time spent still label [status]/[error], and slow outranks opaque because duration survives TAO opacity. Verified end-to-end in real Chromium against real probe/no-TAO-redirect/socket-destroy traffic.
• identify_object and frame looks now carry the solid verdict — collision state is visible on the surfaces authors already use (ledger 2297, the Castle Oravelle forensics: 63% of a wisp-built castle carried no collider and every verification look passed the ghost walls). Each 3D identify match wears one field, solid — the entity's LIVE collider registration at query time, read off the sim's physics components (tome/solid-state.ts), never the spec's intent: <body>-<shape> in the physics spec's own vocabulary (static-mesh, static-box, dynamic-box, trigger-box, character-capsule, vehicle-box, …) or the one word none — no collider registered, players and physics pass through. view_live_scene's frame captures carry the same field for the framed object. The read rides the existing main↔sim debug rail as a new pure physics.solidState batch request (liveSpecDrift's sibling; the rail helper is now shared in _entry/client/sim-debug-rail.ts), fails OPEN (no rail / old worker ⇒ the field is absent, never an invented none), and skips terrain matches (terrain collides per-chunk under engine-local ids — a per-object none there would be a lie players stand on). No spawn default changed: omitted physics still means no collider — the census showed most omissions are correct (lights, fx, overhead vaults, banners); what was eliminable was their invisibility, not their existence.
• The lume texture service's live destroys (eviction, retired-handle sweeps, superseded repaint sources) now defer behind submit retirement: handles queue and destroy when device.queue.onSubmittedWorkDone resolves, so a destroy can never fire between a frame task's encode and its queue.submit — the "Destroyed texture used in a submit" validation class renderer.ts latches as an unrecoverable session (dump 718f34ef, ledger 2298). Handles released while a fence is in flight join its batch. Teardown (dispose(), device-lost recovery) destroys immediately — recovery never waits on a dead queue — and fence-less stub devices keep synchronous destroys.
• A null tilemap generator module must never silently empty a chunk (ledger 2283, savi filing — app af41454d "Ashenreach", dump group 28625c83, #12934). Any chunk touched by a runtime tile override (api.clearTile / api.setTile) repainted as a flat pale slab while the definition's generator module was transiently null (mid-edit broken script; the generator-module memo pins null per definition object): evaluateTilemapChunkCells silently evaluated overrides-only cells and the forward lane faithfully delivered the fabricated-empty chunk over standing content. The silent degrade dies: evaluateTilemapChunkCells returns null when the definition declares a generator but its module has no tileAt (compile failure, missing export, or a pinned transient) — it never fabricates empty cells for a generator-backed map. refreshDirtyChunk HOLDS on null: last-good cells and colliders stand, both cursors stay diverged so the sweep retries every tick, and the pending edit folds in the moment the module resolves or the next revision bump republishes wholesale. publishChunk degrades to overrides-only on null (a fresh publish has no last-good cells to hold; broken-from-install maps keep rendering their hand-painted setTile tiles — the documented posture). Either way the engine says so: a tilemap-generator-unavailable diagnostic, once per content version. Pure-override maps (no generator authored) evaluate exactly as before. Tests pin both directions: the constructed mid-edit null holds the chunk, says so once, and heals on restore (fails pre-fix with the exact silent-empty re-forward); the healthy same-sweep carve lane is pinned untouched; the broken-from-install degrade is pinned loud.
• Timer dispatch now HOLDS a due timer whose owner is simulated by NO world (a cold room's place-host election window, an unhosted or successorless-held place pause) instead of consuming it unfired — it fires on this world's first simulated-here tick at or after due, mirroring the authority-pause retention semantics. New predicate isEntitySimulatedNowhere (tome/simulation-authority.ts). One dispatch site covers the whole timer family: runInTicks, runInSeconds, runSchedule, onModelReady's poll, engine-owned cleanup timers.
• Voxel block textures stop stranding on the white placeholder — three causes in voxel-buckets, none of them the fetch ladder (ledger 2267, chukinice's World of Spawncraft, 117 materials). The pink/white-block class was fixed twice at the texture service's retry ladder, but the module that decides whether a voxel block gets a texture (lume/terrain/voxel-buckets.ts) had three defects, each sufficient alone: (1) rebuild severed texture→chunk tracking — syncTerrainVoxelChunk bound the fresh palette BEFORE removeVoxelBucketChunk deleted the chunk from chunksByTexture/chunksByPendingTexture, so every rebuilt chunk (edit remesh, forced remesh, LOD swap) referencing a still-loading texture was forgotten and wore layer 0 until an unrelated remesh — now split into removeVoxelBucketChunk (residency only, replace-in-place) and retireVoxelBucketChunk (left the scene); (2) a literal 64-layer albedo array, never grown, reservations never released — material 64+ of a 117-material world rendered flat tint forever; the array now grows by doubling (bounded by the device's granted maxTextureArrayLayers), copying resident layers on growth; (3) every mask verdict (uncompressed source, family/mip mismatch, ceiling) was silent — verdicts now land on rails dumps and Savi read.
• A null voxel generator module must never silently empty a chunk (ledger 2293, savi filings 9985add3/3c4ee508/933ef3c5 — app b2537c36 "Blockcraft: Coelho & Cobaia"). The voxel twin of the tilemap silent-empty law (ledger 2283): when the generator module resolved without materialAt (compile failure, or a transient pinned by the generator-module memo — never authored state; spec-apply refuses voxel definitions without a compiled materialAt), buildVoxelChunkData returned null and materializeVoxelChunkOutput minted a VALID EMPTY output — geometry renderDataState "omitted", colliders [], a real outputsHash. The job succeeded, tracking marked the chunk clean forever, later edits rebuilt through the same null and stayed empty, and nothing said so (the ledger-1771 failure-visibility lane only sees throws) — a contiguous canyon region rendered as a pure-black never-rendered mass on every client while host sim stayed healthy. The silent degrade dies, on the tilemap template: the build emits the OVERRIDE-ONLY degrade (an all-air grid with the chunk's voxel edits applied — hand-placed placeVoxel content keeps rendering) tagged generatorUnavailable, plus the anomaly-law voxel-generator-unavailable diagnostic once per content version. Consumers with a standing output HOLD: last-good mesh/colliders stand, the chunk routes into the ledger-1771/#597 failure lane (visible warns, doubling backoff, park on proven-deterministic with the park lifting on any inputs change), and heals the moment a build completes with the module resolved. Never-built chunks install the degrade — the broken-from-install posture — and later degrades keep installing so edits keep folding in while the generator is down. The generator-module memo's null pin stays: the hold makes it non-destructive. Tests pin both directions with pre-fix receipts; the healthy lane is pinned unchanged.
• Voxel material shading edits (color/texture/roughness/metalness/emissive) no longer rebuild every chunk — the voxel edition of the heightmap shading fast path (ledger 1324's split, voxel side). Palette-only fields were folded into the terrain signature, the definition revision, AND every chunk's definitionContentHash — so any patchTerrain touching a color or roughness re-keyed every resident chunk (~1500 on a desktop voxel world), marked the whole place dirty, dropped every fast-lane resident grid, and paid a full remesh + collider swap across the world. The split mirrors the heightmap classification: STRUCTURAL (id, opacity, transparent, liquidKind, surfaceInset, solid, cutout, collision, countsAsTerrainSurface, the block script + baked shapeTable — everything the mesher reads) keeps re-keying builds; SHADING-ONLY (color, texture, roughness, metalness, emissive, emissiveIntensity) rides the per-place TerrainPlaceVoxelMaterials library to buildVoxelMaterialOverrides with no chunk rebuild.
• The world-sync terrain statement ships journals verbatim — compaction there made every sync grow every edited chunk's journal and tear down its resident grid. The answerer compacted each chunk journal before stating it, but compaction mints synthetic terrain_compact_* ids that match NO live row, and the requester converges by editId — so every statement was a non-append: the journal grew one compact stamp per sync (probe receipt: 20 → 21 → 22 → 23 → 24 across four syncs), and the fast lane tore down every edited chunk's resident grid on every join/rebase. Compaction keeps earning its keep at the durable save/load seams (ledger 790) where its ids never meet a live journal; on the relay statement the payload is byte-budgeted per frame anyway and a verbatim statement over an identical journal is a no-op install. Pinned: a joiner holding the host's 20 edits sees three successive statements leave its journal byte-identical (red on the old compacted statement).
• view.captureFrame({ type?, quality?, maxSize? }) — the encode is the game's, and calls queue instead of dropping (chucky, incident 4ebda0e1 follow-up to #12913). The primitive shipped with its policy baked in (JPEG q0.92, ≤1280px — the chat-screenshot defaults) and one-in-flight semantics that dropped a rapid second press with capture_in_flight. toDataURL(type, quality) gave the Shutter Isles HUD both knobs; the realm verb now does too. The encode contract has one home (renderer/screenshot.ts resolveScreenshotEncode(w, h, options) — the same function every viewport capture rides: chat screenshots, SEO/savi-note thumbnails, scene views): type ∈ image/jpeg | image/png | image/webp, quality 0..1 (lossy codecs), maxSize = longest-side fit in px, never upscaled — the swapchain frame is the structural ceiling, no separate constant. Defaults are byte-identical to before. The responder validates the ask at the realm boundary (parseScreenshotOptions): a typo ('jpg', quality: 92, maxSize: 0) answers a bad_args verdict, never a throw across the port; the validated options travel realm → responder → renderer handle → capture-screenshot worker message (screenshotOptions) → the readback+encode. Captures now SERIALIZE per realm — each call awaits the one before it and takes its own frame, in order (a double-click is two photos), bounded by the sdk.call rate cap and the 15s host screenshot timeout; the chain does not hold the small asset lane, so a photo burst never starves audio/texture requests. capture_in_flight is gone from the code, the skill, and the tome example; capture_unavailable (no frame yet) and too_large (the 32MB relay cap — a structural backstop, unreachable for any real frame) remain. Renderer-side, pending screenshot requests carry their options and requests sharing an encode still share one readback+encode of the same frame.
• getSpec refuses list positions on id-keyed arrays — the read lane now answers the way the write lane treats the same handle (ledger 2307, ravi's teach-savi ruling; the ledger-1247 masquerade). The read lane used to RESOLVE places.main.objects.1922 (a numeric array position) with a warning while destroy/setObjectProperty refuse it — an inconsistent primitive that taught the wrong grammar: Savi learned the shape from read receipts and died at the writes (app 3ad02cb1 lost a session to destroy("1922") no-ops minted by exactly this read). At the shared resolver (readSpecPath, the one spec-path door — god-mode/inspector reads go through id-only findSpecObject), a numeric segment landing on an id-carrying array element now refuses: getSpec answers null — the same handle those verbs would ignore — with a teach verdict naming the durable id ("1922" is a list position, not an id; the object at places.main.objects[1922] is id "body-canary-hands" — use getSpec("places.main.objects.body-canary-hands")), digit-folded to one teaching per path shape per cooldown. Ids win over positions: an id that merely LOOKS numeric (an object literally named "1922") still resolves and is never shadowed by whatever sits at that index. Arrays without id-keyed elements (tags, spline points, …) have no id grammar to protect and stay positionally readable, unchanged.
• Tilemap chunk residency reconciles sim↔renderer — the silent-divergence class dies (ledgers 2303/2300). The sim→renderer tilemap chunk forward (terrain/tilemap-chunk SAB lane) had no delivery guarantee and no reconciliation: render-channel stream-reset recovery discards buffered frames and a poisoned reader drops queued ones undecoded, and forwarded cells are not ECS components, so the recovery snapshot never re-derived them — a lost chunk frame left the renderer's resident set diverged forever (2303's never-painted rows, 2300's stale-after-resave art). Now every forward carries a publish revision (codec v6), the renderer reports its resident chunk keys + revisions per place on the 1Hz perf-sample relay (collectTilemapResidencyCensus, cached per residency revision), and the sim's reconciliation sweep (reconcileTilemapResidencyForPlace, run from render/ecs-sync's tilemap drain) diffs the census against the retained forwards — re-sending exactly the missing/stale chunks, sending cells: null removals for ghosts, and pacing itself behind a quiet window so in-flight publishes are never judged as divergence.
• The boot-window generator race repaints in-session — both terrain lanes (the 5.2.26-candidate zoo side2d first-load specimen). A first load that sweeps before the generator module resolves used to install the override-only degrade and mark it clean forever: tilemap publishChunk had no retry at all (fingerprints move on override churn, the window on viewer movement, the revision on def edits — none on module resolution), and the voxel lane's never-built generatorUnavailable install (ledger 2293's broken-from-install posture) reset the failure entry and recorded the degrade as the inputs' installed hash. Now tilemap tracking remembers degraded publishes and republishes them — cells, forward, and colliders — the sweep after tileAt resolves; voxel degrade installs enter the failure lane (backoff retry, park on proven-deterministic) and deliberately stay out of installedHashes, so the dirty mark survives the spurious-mark absorb and the healed rebuild passes the install verdict on both realms.
• Client debug dumps carry a tilemap census. EngineBugRenderDiagnostics.tilemaps mirrors the same census rows (place, chunkCount, space-joined cx,cy@revision — clipped at 4KB per place on ingest, chunkCount stays complete; [] is a positive no-tilemaps receipt, null = pre-instrument). Tilemap state in dumps was previously ZERO (terrainTextures is heightmap-only) — 2303's "rows r ≥ 0 never paint" took a multi-session dig instead of one grep over this field.
• The failed-asset teaching splits by the server's own Retry-After (ledger 2306, incident 14e46bc9). The scene-view unready report's "failed" bucket taught one story — "a receipted death … stays a placeholder until regenerated under a new name" — for every failed verdict, including the TTL'd tombstone kiln mints for TRANSIENT trouble (the import/serve lane answers a source-fetch 5xx as 502 + x-cook-state: failed + Retry-After = remaining TTL). Five known-good uploaded GLBs earned that permanent-death teaching off a ~6-minute workshop-door restart while the files served 200/valid glTF 40 minutes later — reference churn for alive assets. Now a failed verdict that carried the server's own Retry-After window rides the unready atom as retryInMs (RendererAssetService marks serverRetryWindow on the terminal-park and ladder writes; the lume texture service's cook-kill park mirrors it), and buildSceneViewAssetNote renders it as its own clause: "TEMPORARILY failed to generate … the engine re-asks on its own within ~Ns … do NOT regenerate or rename". True terminal verdicts — dead 4xx answers, content-policy rejections, no-window parks — keep the receipted-death/rejected teachings, and the terminal clause still leads the temporary one. The wording deliberately avoids "still generating/loading", so capture settle gates read a timed pause as settled trouble, not streaming.
• worldBounds.bottom + onOutOfBounds — the bottom world bound as scriptable vocabulary (r-1a763818, the second half of DJ Def1le's ask). terrain.underground: true (#12802) removed the surface fall-catcher for declared under-terrain builds, leaving below-surface falls bottomless. The new place field is the deep net: a character or vehicle whose feet cross below the resolved bound (authored worldBounds.bottom anywhere; 3D heightmap places default to verticalRange[0] − 64) fires the body's own onOutOfBounds(event, api) hook once per excursion — event = { bottom, position, placeId, respawnPoint } — and, unless a hook returns false to own the response, the engine teleports the body back to the place's spawn point with motion zeroed (physics-coherent feet+body teleport, the chunk-rescue's transform discipline). The engine owns detection and the default; the response is the creator's script — respawn-at-checkpoint, damage, end-the-run are all one hook, never engine surface. Detection, hook, and default all run on the body's simulator (shouldSimulateEntityHere, the behavior execution-authority rule), every catch speaks in the runtime log ring (world-out-of-bounds), and the latch re-arms only when the body is next observed above the bound — no repeat-fire loop while below. The chunk-rescue is untouched: where it is armed it catches sunk bodies at the surface reading long before any bottom bound.

technical notes

• Content-keyed collider shape cache — the trimesh BVH construction churn is gone (dig df45b868). 81% of rapier's wasm time in a dense-place walk was Bvh::rebuild_range_binned under createCollider (160–185ms/s sustained): spec-level physics none↔static toggling and AOI streaming re-create mesh colliders continuously, and rapier.js rebuilds the full trimesh BVH inside every createCollider call (desc.shape.intoRaw()), then throws it away. The new cache (engine/physics/rapier/shape-cache.ts) keys BUILT wasm shapes by the engine's stable content identity — bespoke/cook/terrain signature + exact realized scale + trimesh/hull lane — and shares one wasm SharedShape across every collider realized from the same geometry (an Arc refcount bump per collider, standard native-rapier shared-shape usage recovered through the JS glue). Colliders stay fully independent (pose/friction/groups/sensor live on the collider); eviction is LRU under byte+entry caps and restores stock rebuild-per-use behavior on the shared JS shape, so a freed entry can never invalidate a standing collider. Bench on the shipped package: 2,048-tri trimesh createCollider 1.21ms → 0.12ms (10.3×), 8,192-tri 3.97ms → 0.43ms (9.3×); the dig-shaped sustained churn frame drops 4.3×.
• Every kernel log row now carries the booted engine identity (engineVersion + engineHash) — the DD engine-version facet, kernel/container half. The container-tier env seed (SPAWN_ENGINE_SEMVER/SPAWN_ENGINE_HASH → logger base context, ledger #421/#584) already existed; this closes the realms it never reached: the workerd engine isolate (a fresh realm with empty process.env) now seeds the pair from CONFIG.engine at EngineHostCore construction, RoomShell stamps its engine identity (x-spawn-engine-* headers, durable) onto every shell record instead of only the failure-line identity block, and the container host wires shell records through the kernel logger — which also stops hookServerConsole re-wrapping warn/error shell records into lines whose message is the first line's raw JSON. Logging only; no engine behavior change.
• Journal-replay husks are no longer permanent (ledger 2241). A runtime-spawned entity restored from the relay journal materializes sim-complete but drawable-free (Draw* components derive only where the spawn path executes, then replicate) and stays invisible until its manager's onSpawn re-mints it. Two seams made a sick host lane (2239 residency family) freeze that state forever, and both are closed: (1) the deferred-onSpawn drain (tome/lifecycle.ts) DISCARDED a parked hook when its entity read remotely-simulated — but a zombie host row (named in the table, not proving) reads exactly like a live one, so the drain threw away the very re-mint it exists to deliver; the entry now WAITS and fires when authority lands on this seat (re-election, heal, migration). Deterministic-id spawns adopt live children in place and heal missing visuals, so a re-run after a genuine remote run converges instead of duplicating. (2) api.spawn()'s adopt-under-reclaim path returned with no writes for an unchanged child, so a script re-run — the one lever a creator reaches for — was a no-op on the very husks it should have healed; adopt-under-reclaim now heals visuals like any adopt, husk-gated (the spawn call declares a visual, the entity wears none) so live drift on drawing children stays untouched.
• The nothing-persisted verdict — a persist:true run_script whose durable batch comes back empty now says so instead of silence (ledger 2244, dig 2ad10ad8). The chain had no honest failure path for persist-requested + world-mutated + empty-durable-batch: kiln's exec route skips its persist leg on an empty batch, studio-chat's fallback skips on empty mutations, and instance-place partition drops never reached droppedMutations — a relay-hosted exec once applied 18 live writes, persisted nothing, and told nobody (the creator burned a full session filing the "revert"). Three legs, one contract: (1) the exec engine's instance-place partition now reports through droppedMutations with a reason field ("instance-place" — the write landed on a session TomePlaceInstance row that dies on room recycle; "persistence-filter" — the existing dig-9b58cad7 class), wired kernel→wire→kiln→chat; (2) kiln's exec route stamps persistOutcome: "nothing-persisted" on persist + kernel-proved worldMutated + zero durable mutations; (3) run_script composes the same verdict from the underlying facts (old-kiln compat) into a structured field plus a note Savi cannot read as success, with per-reason copy naming where the writes actually live and what the durable fix is.
• The behind-truth verdict field — a catchup-starved client now says so where Savi's instruments read (dig 439a5e6f, ledger 2242 fix 3). A relay client that knows it is behind the room's journal head (its welcome named checkpoint seq + head; its drain tracks the applied cursor) now stamps that one fact on both diagnostics read surfaces: the engine-bug client dump (behind block) and the authored-UI read receipts (look target:ui → receipts.behind, riding beside hud). The field carries behindSeqs (a stated LOWER bound — the head kept moving), behindSinceMs (the welcome instant; the join-time spec fetch delivered everything saved before it), behindForMs, and one honest sentence: edits saved after <t> have not arrived here — a delivery backlog, not a script or UI failure. Presentation floor so healthy joins stay silent: gap > 0 AND (≥100k seqs — ~50× the relay's own 2,048-row journal bound, ~86× under the 8.66M field specimen, so a fossil room reports on the FIRST look — or ≥30s of drain — a healthy join drains in seconds). Pull-only provider (runtime worker → wire session): costs nothing until an instrument reads. The field the fossil-room incident burned a surgical three-save Savi investigation for the lack of.
• World reset re-mints behavior module instances — update-wired ears hear again after reset (r-7b0ec903). An explicit world reset drops every subscription on the rationale "producers run fresh", but a producer behind a module-scope once-guard (var wired = {} + api.on in update()) was exactly the one that did NOT run fresh: its module instance survived the content-keyed behaviorCache across reset, the latch stayed set, and the ear never re-armed — update-wired games went deaf after reset (red-pinned by the #12599 adversarial review, pins in #12602). Design call: reset = FRESH BOOT — module scope resets with the world. resetTomeWorld now sweeps the instance layer only (remintBehaviorModuleInstances): behaviorCache entries holding a compiled instance for the world's scripts are dropped, so the reset apply re-executes each factory into a fresh module. Every compile artifact stays warm by design — module artifacts, the function-factory memo (re-mint is factory re-execution, zero codegen, sealed workerd isolates untouched), source/dependency caches, and cached compile failures (no instance ⇒ no module state). The it.fails pin flipped green.
• lume particle slab-bank refusals speak, and the FIFO stops starving later effects (#12401, the mechablade whole-effect vanish). A slab-bank allocation refusal now emits one console line + one fx-arena-refused diagnostics event per deferred stretch (placement re-arms; announce-once lifecycle), instead of silently dropping the effect. The pending-FIFO skip-scans: the head keeps first claim on its slab class but no longer blocks later effects that could place now — early greedy effects can no longer starve whole later effects out of existence. Under-pressure eviction ("make room") is deliberately out of scope — design fork in the PR body for jure's ruling.
• worldPosition / worldFeetPosition — the world-frame position vocabulary (r-99ba97f9, BT dig fcdbe249 §2). feetPosition on a parented child is the documented LOCAL seat/part offset, so a script that computed a WORLD point and wrote it onto a parented rider was silently reinterpreted as local — BT's driver sat 17.5m from his own car in car-local space and the "invisible car" was one write. Both frames arrive as a bare {x,y,z}, so the bare write can't discriminate intent and flipping its meaning would break every authored assembly; the convert gets its own word instead: worldPosition means the WORLD point on every entity, parented or not. Writes convert world→local under the parent's current transform at write time (pivot fold and socket/part anchors included) and re-dispatch as a plain feetPosition write — mutation stream, spec mirror, and persistence only ever see the canonical local value. Reads compose parent ⊗ local on the fly. The two frames the conversion cannot honestly serve refuse with both options named (bone attachments — only the renderer resolves the animated bone frame; camera-attached subtrees — per-viewer pose), and a patch that re-parents and writes worldPosition in one bag refuses rather than guessing which parent was meant. Purely additive — no existing write changes meaning, so no engine-version gate.
• api.raycast verdicts carry a terrain lane (BT dig fcdbe249 §3, sibling). { verdict: true } results gain verdict.terrain: boolean | null — the data-model answer the overlap probes already speak (does solid terrain intersect the ray's segment per the terrain samplers; null = unresident voxel data, "cannot know"). A null hit over real ground now says so: hit: null + terrain: true is "the ground exists and this cast could not see it" (terrain collider not resident in this runtime, or a blind context) — the fork between "collider absent" and "probe unusable" that cost Savi's repair session real time, made structural. Verdict-lane only; plain calls pay nothing.
• Reset converges every realm to the document (r-16ed9c68, #12819). A plain reset's bump previously merge-applied an identical doc on non-authority clients — an empty diff — so client-side presentation ghosts (journal restates, orphaned children) stood through every reset. Reset bumps now ride replace: true, and on that transition non-authority realms sweep membership-carrying world content the incoming doc does not author (world-content-sweep.ts). Doc-authored entities are preserved by the replace apply's snapshot-restore branch. After a reset, the world IS the document.
• Delete propagation: destroyed spec rows leave the doc. destroy() of a spec-declared id with no live entity early-returned without touching the document — the row survived every reset and boot, silently. Under a persistence context the row and its parent-linked subtree now leave the doc exactly like the live path. Bonus root: buildNextSpecWithRemovedObject missed the placeId:objectId qualified runtime form, so a qualified-form destroy edited nothing — fixed, live path included.
• api.destroyObjects(ids[] | queryFilter) — bulk destroy with honest per-id verdicts (destroyed | not_found | refused+reason; live players refuse rather than filter silently). Each id runs the full single-destroy machinery — no parallel delete path. Kills the graveyard-purge chore class: hundreds of orphans is one call, and a no-op is a spoken verdict instead of silence.

technical notes

• Cross-place player mail (r-6f782b46, dig bf02c5e4 — the party-hoppers class-delete). patchObjectState on a target that misses the local resolve but is a room-resident session avatar now routes as per-top-level-key guarded LWW set/unset intents over the existing rail.intent lane — the server validates, sequences, and forwards to the entity's simulator (the target player's own machine), whose basis guard adjudicates and answers the sender's pending ref, byte-identical at the server gate to the same patch made in the same place. No local optimistic preview exists (there is no local copy), so nothing registers a revert; inside a behavior invocation the intents join the invocation's causal chain (basis included), outside one they ride the outside-invocation act lane with an empty basis (the explicit-act destroy's precedent). The local-resolve-hit path is byte-unchanged — the new lane runs only where the old code warned into the void.
• The gate is a new replicated coordination table, tome/room-roster (TomeRoomRoster, riding tome/spec beside TomePlaceHosts: globally AOI-visible, reset-proof, clientAuthWrite: "never"): clientId → { playerId, placeId } for every session avatar the server world holds, published by the new netcode/room-roster-publish server system (simulation −85, change-gated writes). Absent in singleplayer (never written — mode byte-identical) and on relay rooms (no server writer yet — the mail lane and roster reads degrade to pre-roster behavior there; a relay-side election-fold writer is the named follow-up seam).
• getPlayerPlace(id?) — the distinct-verdict presence read: place id from local truth when the entity is present (any entity, any mode), from the roster when it is an avatar in an unreplicated place, null when it is nowhere in the room. This is the honest branch point the old getObjectState === null conflation forced games to reconstruct with heartbeat scars.
• Pins: cross-place-player-mail-e2e.test.ts (two-place fixture through real netcode — delivery in- and outside-invocation, roster/room-truth reads including session-end, gone-target keeps the warn with nothing on the wire, detached-simulator refusal verdict with no blind server apply, and the wire-shape authority pin: what leaves the writer is one ordinary guarded rail.intent).
• The session's first pixelate/CA/DoF/blur look no longer flashes black (dig 9489e3d8 specimen 3). The first two-hop look flipped the composite's target format canvas → intermediate, and the retained-variant hold is keyed BY format — so the flip was the one seam it structurally couldn't cover: cold composite clears the intermediate black, cold present falls to a cold copy, and declareCopy's only cold move is clearing the canvas black. Two rungs, both landed: (1) seam pre-warm — the first active-look frame warms the copy fallback (post/look/copy/<canvasFormat>) and the neutral intermediate-format composite via PipelineCache.warm() (a look-less session compiles neither — the structural OFF); (2) hold-last-presenter — the topology does not flip until the incoming pipelines are ready: on the entry edge the chain asks LookPass.presentReady() (the sync twin of the capture rig's prepare(); asking kicks every compile) plus the intermediate-format composite handle, and while any is pending the frame keeps the last presenter — composite straight to canvas. Held frames release nothing, so the incoming scripted build survives the hold (a rebuild per held frame would mint fresh WGSL + pipeline keys and never converge — pinned by test). Deliberately NOT hold-last-frame: a stored image re-presenting departed light is the exact class limiter v2 eliminated.
• flash() gains intensity (dig 9489e3d8, the flash-authoring-defaults alignment). api.flash(id, { intensity }) names the peak emissive boost 0–1; absent = the historical 0.9 (FLASH_BASE_OPACITY), byte-identical wire (additive optional on the flash juice event; invalid input no-ops to default per verb etiquette; >1 clamps). The primitive previously had no amplitude knob at all while screenFlash did — the raw-three.js cost of "flash this mesh gently" is one uniform, so this is a property, not a pipeline. Under reduce-flashing the dim lane only ever lowers further (min(authored, dimRise)). Pins: object-api-vfx-args.test.ts (wire: absent/clamp/invalid), juice-client.test.ts (authored amplitude renders).
• combat.damage()'s bundled flash drops to 0.45. The builtin's hit juice is a default nobody explicitly asked for, so it carries the platform's care (game-feel: light is the loudest channel): at the primitive's 0.9 a whole-mesh emissive flash on a viewport-filling target IS a full-screen flash per hit — the Game Hour tree-chop specimen (2026-08-10), where a survival crafter shipped a screen-flash-per-cut its own creator called a bug, and the class Drake hotfixed out of his game on day one. Pin: builtin-modules.test.ts (0.45 on the loud path).
• The taught defaults align with the light-carries-the-platform's-care law (#12360) where the vocabulary actually emits: the screenFlash @tomeapi doc no longer says "the default reads right for per-hit feedback" — it now names screen wash as a rare-emphasis beat and routes per-hit feedback to the calmer deck (entity flash at low intensity, hitstop, particles); combat.md's melee recipe teaches calm flash intensity on big meshes and that screenFlash never rides a connect. api-reference/TomeAPI regen carries both.

Model-lane liveness door + honest loading/generating verbs

Savi could declare a model "dead" with no HTTP receipt (a raycast miss was enough) and re-mint it — 26 wrong-sized vine copies in one prod session while v1 served ready the whole time. The model lane's existing readiness probe already answered the question; its receipt was being discarded.

• The probe's answer is now latched per asset: alive (probe ready or a 2xx payload) · dead-by-authority (a real authority 404, via the shared provenance idiom) · weather (no answer — explicitly NOT a death).
• The scene note Savi reads says it plainly: a receipted-alive asset carries "do NOT regenerate or rename"; silence reads "no answer is not proof of death"; only a receipted death says dead.
• "Still generating" now requires the server's own 202 receipt — cold-cache fetches read loading, counted separately, so a 1GB zone refill no longer masquerades as mass regeneration.
• Relay-tier spec scatter minting (ledger 2194, conviction 4f6aa889). All four spec-path scatter mint sites (interpreter.ts refreshTerrainScatter / spawnObjectFromDef / updateObject scatterChanged + field-refresh arms) gated getWorldMode(world) === "server" — a kernel-tier-era rule ("clients receive them via replication") that no world satisfies on the relay tier, whose simulating seat is an elected CLIENT host. The gate is now shouldMintSpecScatter: server world OR not a client-auth observer of the bed — the anchor path's own predicate (isClientAuthObserverEntity), false on server worlds and singleplayer by construction, so those tiers are unchanged; unelected multiplayer clients still refuse via the no-hosted-place exclusion (no pre-election dupe storm).
• The mint moment for fresh rooms: tome/scatter-host-redrive (new client system, simulation −80). The bootstrap applySpec lands BEFORE the election, so the gate swap alone never fires on a fresh relay room. The system watches resolved self-hostship (getLocallyHostedPlaces — identity-cached, one reference compare per steady-state tick) and on a gained place runs redriveHostGainedScatter: ADOPT-FIRST — beds whose children are already recorded (the bed's replicated TomeState.scatterChildren; TomeScatter is replicate:never and deliberately not the key) are adopted untouched, only bare beds mint. Host handoffs therefore never double-mint and never resurrect deliberately destroyed children.
• Wire/journal pin: host-minted children are STATE creates — the SuppressMutationRecordingResource wrap suppresses spec-changeset recording and spec mirroring only, not replication; children journal as live keyed heads (e:<id>:@c) and fold into observers and late joiners like any hosted-remainder spawn.
• Pins: scatter-relay-host-mint.test.ts (zoo corpus on the relay client-host topology: elected host mints at apply, observer refuses, singleplayer control, gain-edge re-drive, adopt-first, spec-document-never-mutated) and relay-scatter-host-mint.e2e.test.ts (full relay wire: host mints → journal heads → observer folds the identical id set → host departs → successor elected → adopts, no double-mint; fresh-room apply-before-election boot order mints on the gain edge).
• State numbers carry full f64 end-to-end (ledger 2184, priority evidence row 2196, incident 110f42ab). Since #12554 armed the relay room clock, api.seconds() is EPOCH-SCALE (~1.786e9), and the state pipeline narrowed every stored number to f32 — twice: at the write funnel (quantizeStateValue → Math.fround) and on the room wire (shaped-object-map SHAPED_OBJECT_FIELD_F32, a 4-byte float lane). Math.fround's ULP at 1.786e9 is 128, so a stored timestamp landed up to ±64 SECONDS off and a correct authored window (now - gapSince > 2.5) misfired ~64s of every 128s window regardless of restamping cadence. #12684 cured one face (god-mode's tick stamps, moved to the session-scale local tick); this removes the class.
• The write funnel stores what the script wrote. quantizeStateValue/quantizeTrackedStateWriteValue are now sanitizeStateValue/sanitizeTrackedStateWriteValue (JSON-safety walk only — nonfinite→null+teach, Map/Set/Date conversion, function/symbol drops all unchanged); quantizeSimplePatch is copySimplePatch (detach-copy, no narrowing).
• The room wire's shaped-object-map lane classifies numbers as SHAPED_OBJECT_FIELD_F64 and vec3 records as SHAPED_OBJECT_FIELD_VEC3_F64 (8-byte doubles; +4 bytes per changed numeric state field — the transform/pose hot lanes have their own codecs and are untouched). The legacy F32/VEC3_F32 kinds stay decodable and writable forever (a shape def minted by an old peer via defineFromWire still parses) but classify never mints them again. Every other lane the bag rides was already lossless: JSON component codec, generic/OPAQUE nested values, relay register FIELD_F64, intent command payloads, binary-object codec.
• Write-through intents drop their frounds (intent-protocol.ts + intent-context.ts): the inc delta is exact f64 (next - prev — the frounded delta collapsed to 0 for any step < ~64 on an epoch-scale value, silently dropping the intent), basis/revert comparison (clientAuthIntentValuesMatch) is exact numeric equality (sound because both realms now hold identical bits), and applied set values detach-copy without narrowing (cloneIntentValue).
• Unchanged on purpose: transform/pose f32 quantization (quantizePositionLike et al. — render-tolerant, own codecs), physics read grids, collider-scale buckets, the sandbox float-literal/Math f32 regime (cross-engine determinism for script MATH, not storage), and the event-echo memo's fround-at-hash-time canonicalization (idempotent, consistent on both legs).
• Pins: state-f64-epoch-precision.test.ts (production client-auth wire both directions: top-level scalar, vec3 field, nested object, array — all bit-exact at 1786580200.125; seele's window shape never misfires; all three wire pins verified failing on the pre-fix tree), shaped-object-map.test.ts classify + legacy-kind vocabulary, client-auth-intents.test.ts epoch-scale RMW inc.
• The game-UI img lane's loading placeholder is now actually transparent (ledger 2202, dump cd8cc346, Kingsplow). TEXTURE_SCRIPT_PLACEHOLDER_SRC was labeled "1×1 transparent PNG" but its bytes decoded to RGBA(0,0,255,127) — half-opaque pure blue (PNG filter type 1 on a 1×1 RGBA scanline [1, 0,0,255,127] reconstructs to the raw bytes; there is no left neighbor to subtract). Every <img src="scripts/tex-*.js"> awaiting its first bake wore that pixel stretched to its styled width at 1:1 intrinsic aspect — a wordmark styled width:min(84vw,940px) painted a ~940px half-opaque blue SQUARE over the game for the whole bake window (~500ms per panel on the reporter's rig; repeated per multi-element panel — the photosensitivity shape enfeul reported, over a HUD Savi engineered to never flash). The constant is replaced with a decode-verified fully transparent pixel (RGBA 0,0,0,0), and the colocated test now inflates the actual IDAT scanline and asserts alpha 0 — the label can never drift from the bytes again. Same lying constant retired from kiln's OG-image test fixture and the assets README example.
• terrain.underground: true (heightmap kind) declares below-surface space as play area and disarms the chunk-rescue there (r-1a763818, ledger 2225). On a heightmap, under-surface air is unrepresentable, so TerrainChunkRescueSystem has always read "feet > 0.1 m below the sampled surface" as fallen-through-the-world and teleported the body back up — which also ejected players from deliberate under-terrain builds (DJ Def1le's under-terrain train line; chukinice's diggable voxel world made the terrain-kind asymmetry creator-visible the same day). The flag inverts exactly that one reading, on both realms (the predicting client reproduces the server's non-rescue — a server-only disarm would be the up/down warp loop in reverse). Everything else is untouched: heightfield colliders (the surface stays solid from above), the client collider parity probe, the server anchor watchdog, repeated-fire remediation (downstream of a fire that no longer happens), and the voxel entombed rescue. The spec read costs nothing on the standing-on-ground path — it is only evaluated for a body the surface sample already judged sunk. patchTerrain accepts the key via the schema-derived allowlist; the heightmap-terrain skill teaches it next to the walkable-pit recipe.

technical notes

• skills/debugging.md: recurring cross-session wishes are platform gaps — file once, tell them (ferhat dig 1f4b0ce8). One sentence added to the reportPlatformGap paragraph; no tool or API changes.
• A fresh api.on registration refutes a standing dead-ear verdict (#12511, train item 15). clearBehaviorLivenessFaults (behavior-faults.ts) clears kind:"liveness" records — and only those — at api.on registration time, for both scopes that would silence the new ear (the registration's own script scope and the whole-entity scope). A live registration is direct evidence against "these ears are dead"; if OTHER ears on the entity are still stale, the next emit re-derives their verdict through the dispatch fault floor — nothing is lost, only re-proven. Pinned by script-edit-event-rebind tests.
• REVERT of #12506 (sev fix-forward #12519, postmortem docs/postmortems/2026-08-08-white-worlds-sev.md). The 5.2.22 draft's <meta name="color-scheme" content="dark"> + html { color-scheme: dark } on the game documents made Chromium composite the WebGPU canvas opaque white (centerMeanLuma 251.5 → 149.1 on the strip arm; either declaration alone broke it; documentElement.style.colorScheme toggled it live). Both declarations are stripped from cf-edge's iframe HTML and the cf-kernel dev shell, and both documents carry inverse guard pins: the game document must not declare any color-scheme. Engine, relay (#12502), storage (#12500), kiln, and chat were exonerated with receipts.
• reportEngineBug gets its relay lane (#12526, r-73bad3a1, ravi's dig 0c58bbb6 — tseele's Wickworks bug died as a memory note). New dispatch lane "relay-rpc": on a relay-wired client world the incident ships over the relay's identity-stamped RPC lanes (lane "incident") to kiln's intake. The send door mounts beside the GameDB io (netcode consumers seam, capability-not-wire-mode); RPC_RESULT receipts log verbatim, so a lost filing is loud, never silent (ledger 2089's law). Platform halves riding worker deploys, not this tarball: cf-relay forwards lane "incident" → kiln /api/relay/incident (relay service auth; room scope + reporter identity from the relay stamps, never the payload; per-variant rate floor), and the store leg is shared byte-for-byte with the kernel-tier SDK-keyed door so the sweep and incident-ack lane consume both room classes generically. Head diagnostics gain dumpRail: 'relay-rpc' for provenance. Deploy order honored: relay + kiln before kernels that dispatch the lane — an old relay answers 400 "unknown rpc lane", logged verbatim as a failed filing.
• Savi body arrival position — a conversational offset, never the joining player's face (r-2dc06081 position half; annias' partner report via mavi). Every joiner self-spawns at the place's one deterministic spawn point with zero separation machinery, so a summoned body could materialize inside a player and a loitering body filled the next joiner's camera. The fix stays in the shell (arrival-position.ts, ArrivalAnnouncer idiom — decided once per process at the first poll that sees the body, retries ride the 2s poll): live foreign player within 3m → step ~3.25m in FRONT of their replicated facing and turn to face them; nobody close → step ~3.25m off the spawn along the body's own facing and turn around; candidates inside ANY player's personal space rotate around the anchor in 45° steps. Data plane is session.teleportSelf + optional yawRad (answered yawApplied: true); /healthz reports arrival: {state, detail}.
• Loading equirect shows the fallback base color, never a black frame (#12508, train item 21 — the placeholder ladder's first rung for pending texture bakes). sky-store.ts: a pending equirect renders EQUIRECT_FALLBACK_COLOR instead of routing to SKY_KIND_NONE (whose store default [0,0,0] cleared the frame black); texture adoption on arrival is unchanged and pinned.
• Warn-once on unknown three-vocab material props (#12513, ledger 2107). Every Mesh*NodeMaterial constructor returns a thin Proxy whose set trap warns once per prop name process-wide (curated map for three's texture-map props, close-name suggestion for typos, compact supported surface otherwise), then performs the assignment unchanged. Known props forward with no bookkeeping; only set is trapped, reads stay raw. The teaching rides the existing shader-vocabulary-unknown-symbol diagnostic rail (#1153's channel).
• Circular-import failures get a structured verdict (#12513, ledger 2111). script-modules.ts mints CircularDependencyError (code circular_dependency + the cycle's closed file list) at all four cycle-detect sites; the exec engine stamps the code on the outcome, the host threads it onto ScriptExecResult, and it rides the existing code channel end to end (kiln exec route and run_script already forward it). The SP-forward reply leg passes compile-class verdicts through while still dropping forge-able forward-lane codes; clone-fallback preserves it on degraded replies.
• run_script results carry spawn provenance for destroyed behavior-spawned entities (the seele resurrected-lamps class, dig b52f2842; engine resolver 35103eafd8, ravi r-ea36708d). ObjectAPI.destroy() on exec overlay worlds resolves the target's TomeSpawnedBy provenance AT DESTROY TIME (resolveSpawnProvenance, tome/ownership.ts — by settle the component is gone), deduped per spawning owner (a batch destroy of one spawner's brood is one row: {ownerEntityId, behaviorScripts, destroyedIds (sample), destroyedCount}), ungated by persist (a transient destroy misleads identically), and rides the TransactionLog to settle as ScriptExecResult.destroyedSpawnProvenance. Live-world behavior destroys (the projectile hot path) record nothing and pay ~nothing (WeakMap keyed on the overlay, same idiom as the property-write touches). cf-studio-chat composes the fact into run_script's note: live owner with scripts names the spawner and says the durable fix edits it; a dead owner gets the softer shape (owner id kept — the child's own component asserts it — scripts unknown); no provenance leaves the result untouched.
• Release-on-control-transfer (ledger 2129, ronnie/enigmagames stuck-WASD). tomeInputApplier tracks the last resolved dispatch target per controller (TomeControlDispatchTargetsResource); when the resolved target changes, it dispatches one final zeroed InputState (empty targets behind the memoized axis/action proxy handlers — declared axes read 0, declared actions read false) to the PREVIOUS target's onInput before the frame routes to the new target. Mechanism this deletes: after setControlMapping(player → god rig) every subsequent frame — including the keyup's zeros — dispatched at the god rig, so the parked body's onInput never ran again and game-authored intent state latched at the last held direction integrated for the whole god session. The keyup was never lost (all raw-capture flushes exist; god entry even calls clearInputState) — the latch was game state only onInput can settle, so the fix delivers a release the game's own code interprets, never an engine write into authored state keys. Release mirrors the primary dispatch's per-side guards exactly (behavior resolvable, not faulted, !isClientAuthClientSimulatedEntity) so whichever side runs an entity's onInput delivers its release; template is the parked-body action fan-out in the same file.
• enterGodMode velocity hand-zero deleted (commands/god-mode.ts). The old special case zeroed state.velocity at entry — it missed every intent-latching game and its zero was overwritten next tick by intent-driven acceleration. Subsumption is pinned by test: a velocity-latching player script settles to zero through the release frame.
• Size-star shrink is monotone through the screen centre (ronnie/enigmagames scale flip, dump a9c143a1). The three scale gestures in default-editors.ts (fallback hover star, attachUniformSize, emitterSizeHandle) measured the drag as screenRadius(now) − screenRadius(press) — an UNSIGNED angular distance off the pivot's on-screen point. That measure bottoms out at zero as the cursor crosses the object's screen centre and rises again on the far side, so a long shrink drag visibly flipped into a grow mid-gesture ("shrinking past a certain point flips and starts growing"). The scale VALUE never went negative (the ×0.02 factor floor predates this) — the through-zero was in the drag measure. All three now press-freeze a radial axis via radiusDragSnapshot and read radiusDragSignedFromSnap — the same monotone signed-radial primitive the radius rings and NPC vision-range grips already use (radialDragPress/radialDragSigned in builtin-authoring.ts, whose own doc names this exact failure: "dragging toward the centre keeps shrinking, never flips back to grow"). Shared factor math lives in one helper (scaleDragFactor), floored at SCALE_FACTOR_FLOOR = 0.02 — the gesture can never zero an object or mirror it through a sign flip, and a drag on an already-mirrored (negative-scale) object preserves the sign because the factor multiplies.
• Boundary, stated on purpose: only the interactive tool clamps. Authored scale through the ObjectAPI stays unclamped — scripts legitimately mirror with negative scale — pinned by test.
• Place re-entry re-arms api.on listeners (ledger 2145, dump b3959a68 — BUG SWEEPER's dead SOLO/DUEL menu and lost PvE-ladder MMR). Two engine legs, both fixture-proven red before the fix:
  • The delta-0 short-circuit ate the re-entry apply. unloadPlace destroys a place's entities but left the applied-generation record's binding intact; a re-entry whose spec content, residency key, and instance-places key all match the recorded generation short-circuited the parked placeResident re-apply, and the place never re-materialized at all — empty skeleton, no state, no ears. unloadPlace now drops TomeAppliedGenerationResource ("the world already IS this spec" was just falsified), so the next apply full-passes and the spawn loop's hasEntity checks rebuild the place. Cost: one full pass per post-unload apply; the gate re-arms at that apply's completion.
  • Module-memory persistence defeated the once-guard wiring shape. Compiled behavior modules live in the content-keyed behaviorCache for the process lifetime, so a module-scope once-guard (if (!wired[api.id]) { wired[api.id] = true; api.on(...) } — the exact shape api.on's own run_script teaching warn prescribes) never re-wires on a fresh materialization: the guard is already true, and the subscriptions died with the destroy. Now api.on stamps armedInOnSpawn provenance (via the existing onSpawn-context probe), the place-unload teardown PARKS non-onSpawn-armed subscriptions (TomeParkedEventSubscriptionsResource, threaded as DestroyEntityWithHookOptions.parkReentrySubscriptions through the cascade), and every later materialization at the same id — spec-lane re-expansion or a re-run producer's deterministic-id api.spawn child — revives them. onSpawn-armed ears clear as always: their producer re-runs (RUN inline server-side, the DEFER drain on clients), and reviving them too would double-deliver. Parked rows whose script's edit generation moved drop at revive (the edited script's fresh module re-wires itself); the park dies with the world-reset sweep.
• Deliberately NOT fixed here, named in ledger 2145: the relay-tier journal-refold lane (BUG SWEEPER's actual tier) re-materializes entities through replication ingest, which never runs spawnObject — the DEFER-park needs extending to ingest-materialized hook-bearing entities in unhosted places. And cross-place emits into an unhosted place (the rank-write hole) exist independent of the deafness.
• Parked re-entry ears now check behavior membership at revive (adversarial review of #12599 / ledger 2145). The park's edit-generation check only catches CONTENT edits of the same script; reassigning behavior: ["referee.js"] → ["other.js"] while the place is unloaded bumps no generation (referee.js never changed), so the parked referee.js ear revived onto an object that no longer runs referee.js and its handler fired on the new def — red-proven in place-reentry-park-revive-guards.test.ts. reviveParkedEventSubscriptions now takes the materializing def's behavior refs (spec lane passes def.behavior, the api.spawn lane passes resolvedSpec.behavior) and drops parked rows whose arming script left the list. Safe for every script-reachable sub: api.on binds to the arming entity itself and scripts hold no foreign full API (api.spawn returns an id string), so a sub's scriptRef is always one of its own entity's behavior refs; ref-less engine-side subs are exempt.
• Review pins landed alongside: double-armed (onSpawn + update-once-guard) stays at exactly two ears across the round trip; the park's diverging-id residue (module-scope counter id schemes strand one entry per round trip until world reset — deterministic script Math.random re-mints identical ids and revives cleanly, so it does NOT leak) is pinned honestly; the pre-existing reset-lane deafness (resetTomeWorld drops the park while the once-guard module survives the content-keyed cache — update-wired ears never re-arm after an explicit reset) is pinned as it.fails so the fix flips it loud.
• Torn-frame gate in client local-transform projection (ledger 2135, enfeul's furniture-sized frag grenade, dig 3e3d04e9). projectEntity derives Local* as inv(parentWorld) ⊗ childWorld; when the parent's World* wasn't available, every lane manufactured an identity parent — a missing parent entity fell into the "root" branch (Local ← World verbatim) and a present-but-unsolved parent divided by identity. Either way the child's world scale baked into LocalScale as a durable AOI-replicated authored-truth write; the next hierarchy solve recomposed parent × local and the child grew by the parent's scale per torn frame (2.3 → 5.29 → 12.2). The position and rotation lanes had the same flaw — a bake there teleports/mis-rotates instead of growing. Now projectEntity resolves the parent frame once (readParentWorldFrameIntoScratch): a parent that is missing, or present with NONE of the three World* rows, is a torn frame — the whole projection is skipped, nothing is written, and the entity stays queued (torn carry-over in the system loop) so the derivation re-runs when the parent's frame lands. Structural, not a sixth guard: the wrong write can no longer be manufactured in this shape.
• Partial parent frames still project, deliberately. A parent with SOME World* rows keeps identity/zero fallbacks for the missing aspects — the same convention solveChild composes with, so the division inverts the compose exactly (round-trip stable). This is a legitimate steady state, not a tear: physics write-back mints WorldFeetPosition/WorldRotation but never WorldScale, so an unscaled dynamic-body parent (car-weld rigs) carries pos+rot rows forever. Pinned by test so the gate never tightens to any-row-absent and freezes those children.
• Guard census (the managing-not-eliminating check, ordered by the mint): none of the five existing torn-frame guards dies under this gate — each closes a tear where the parent's rows are PRESENT but values are stale, mixed-authority, or in another basis: singleplayer short-circuit (#154, child rows hold parent-local coords pre-solve), god-mode-drag skip (parent moved mid-drag, child stale), stand-rider skip (child last-physics vs parent fresh-ingest), bone-subtree skip (#308, World = bone ⊗ local basis), eager attach compose (#160, attach window). All kept; census recorded in the gate's doc block. Deleted instead: the identity-manufacture branches themselves — the per-lane parent reads and their fallbacks collapsed into the single gated frame read, and the dangling-parent-as-root branch is gone from all three lanes.
• Mixer channels take time — the pose-freeze / seek primitive (seconds into the clip). speed: 0 was already legal but only ever showed frame 0; the raw three.js equivalent is two lines (action.paused = true; action.time = 0.4), so this is an API gap, not a pipeline. time is honored on create AND update: a layer is born at the seek, an UPDATED value re-seeks the playhead, and a re-sent equal value never disturbs playback (scripts re-derive and re-send channel state every tick — the no-op law). A startTick restart (one-shot re-fire) lands on time, not 0. Negative clamps to 0 at parse. Plumbed through the whole seam: spec type + Zod schema, parseMixerChannel, updateChannel merge + mixerChannelsEqual (time-only updates are never swallowed; time: null clears the stored seek), the per-character mixer (clip-state.ts — ActiveClipLayer.seekTime tracks the last-applied authored value), and the horde batch path (skinned-batch.ts — same law, and a seek is an event: it resamples immediately instead of waiting out an anim-LOD hold, so the batch↔clone seam agrees on the pose).
• Rail-lane audit closure (#12674, tucker's commission; audit doc docs/plans/rail-lane-audit-2026-08-11.md): every sendable message gets a lane or a loud refusal. Four verified gaps from the 13-agent rail/lane census (215 rows, 144 names, 25 candidates adversarially verified), each re-proven still-real at HEAD before building. Kernel parity: nothing new rides the wire.
• The resurrection cure — the ghost-destroy adjudicator widens past god-mode (rail.destroy residual; tide's destroy-authority adjudication, the journal-resurrection class). judgeRelayGhostDestroy drops its god-mode gate: ANY outside-invocation destroy — script, run_script/exec, god-mode alike — of a departed/unowned journaled entity tombs, or intent-routes to the live owner; sim-lease claim capture stands aside on relay (claims can never confirm there — lease.claim is a dead lane), so captured destroys stop silently reverting. This completes the covenant family whose god-mode face already rode this draft (a98bed581a): the class was entities outliving their own DESTRUCTION — script/exec destroys of hosted/unowned journal entities minted no tomb on every promoted engine, and the host-adoption restate (relay-world-restate.ts) re-journaled the ghosts as fresh keyed heads on every churn, which is why world resets healed for only days at a time.
• spawn:kernel:spec-save settles on the mobile embed (was silent park). GameHost (/embed/play) had no listener — a permissioned creator's relay-room edits parked after 3×30s and were silently gone on reload. VariantViewer's settle flow extracted to core/kernel/spec-save-relay (one implementation, two mounts); appId-less hosts answer a typed terminal host_has_no_save_lane refusal instead of parking.
• tome.dm.notify gets a lane (was none → {local, dmNotify}). Egress consumes into an identity-stamped RPC on cf-relay's new 'dm' lane → kiln /api/relay/dm-notify → the shared studio-chat notify_dm door (source pinned 'tome'). Rate window + once-key dedup kiln-side (Redis, fail-open, claim released on failed delivery); failed DMs land in the runtime log instead of pretending they sent. Platform halves ride worker deploys, not this tarball; an old relay answers 400 "unknown rpc lane", logged verbatim as a failed filing.
• rail.interactClaim journals peer-visible grants (was none → peer). Peers register (sender × target) grants in a kernel-mirrored table (relay-interaction-grants.ts, TTL/cap drift-pinned) honored at exactly the kernel-authorized rails — relocated hook terrain edits, dabs, and grant-sourced enterPlace converge room-wide and fold for late joiners.

technical notes

• Exec budget abort with api.sql in flight names the fact — never "a hung await" (#12441, ledger 2092 fork B). sql-api.ts grows a register→settle in-flight lifetime (separate from the drain's take-and-clear pending set, whose taken-but-unsettled entries are exactly the invisible case); buildAsyncSettleAbortError probes listInFlightExecSqlWork at mint and, when non-empty, mints the honest verdict: call named, lane's bounded window stated (relay reply deadline 30s, direct door fetch 10s), rollback fact stands, action = re-run once settled. The 5000ms budget itself is untouched; the fire-and-forget drain abort already named its sql fact and is untouched. Origin: dump 339d9450 — published call shapes blew the budget by ~5ms, then settled after rollback, and the "hung await" text got the planned event filed as an engine hang.
• mantle: box3d-guided fixes + frontier optimizations (#12311). Trimesh weld probes neighbor cells (box3d b3SpatialHash shape, 8-cell probe at cellSize = 2×tolerance) — seam vertices 2e-8 apart no longer cook to distinct representatives that read coplanar seams as boundary edges; 200k-tri mesh cook 946→475ms vs the 27-probe draft. Near-parallel edge-axis rejection at box3d's relative tolerance; face manifolds never stripped by edge axes in box-tri. Broadphase goes O(degree) per moved body. Sleeping worlds cost nothing (island-granular sleep; per-axis sleep extents). New pinned suites: wake-seam purity, sticky-zero scratch, tick-pair set, plane-lock extent, near-parallel edge rejection. Full box3d HEAD re-comparison recorded in docs/physics-native/box3d-harvest-notes.md (zero solver-constant drift; ζ=5 warm-start re-run rejected on new grounds; solver-sets rejection superseded by the derived-frontier design). frozen-receipts.ts retired.
• reportEngineBug: ok:true must imply a lane (#12436, ledger 2089 — intake-death mechanism #2). resolveEngineBugDispatchLane resolves rail | sp-forward | none BEFORE the verb returns; sp-forward requires client + singleplayer + POSITIVELY-sniffed kernel wire + live connection (isGameDbForwardEligible's gate shape — an undetermined pre-sniff wire refuses rather than gambling, since a fire-and-forget command has no typed reject at the relay egress). Exec snapshots can't see lane facts (all live-channel), so the exec host stamps the live verdict into the snapshot-riding config mirror at snapshot cut (the lastReportAtMs pattern). Lane "none" returns the throttle-style structured failure Savi already relays; nothing minted, no floor consumed. dispatchEngineBugReport now returns whether the report left, and the belt-and-suspenders no-lane warn carries networkingMode + wire. Test table covers every session shape: each row either lands the incident in a store or returns the honest refusal — zero silent-drop paths. Completes postmortem 2026-08-07-relay-sp-dead-db-lane §4.1; the kiln RPC lane for relay filings stays §6.2's owned follow-up.

technical notes

• lume alloc census logs only where armed (#12335, jure's catch in #w-rendering): wave 3 wired tickAllocCensus into the SHARED lume frame loop un-gated, so every prod client dumped a census line every 300 frames into Datadog. Now an arm-gate, armed exactly by the jsc-shell entry (the census's one consumer — the consumer declares itself, no env sniffing); every other bundle including prod web is a no-op. W4-PHASE-CENSUS never leaked (its ticker arms off the shell's __jsc* globals, verified null in browsers).
• The in-world placard gains the cook register (r-426fb323, dig af2514aa, #12206): ModelLoadVerdict grows 'cooking' — the asset service's own lastHttpStatus 202 receipt (written only by the still-generating lane) walks through to the placard, which then names WHAT is being made and the honest time class ("Making cat hero…" / "takes a few minutes" — no fabricated ETA). Ledger 1675's register law holds: generation language only on surfaces that can prove a generation job from the server's own answer; unproven non-failed copy stays "Loading X…", dead checks unchanged. Two-line labels ride the existing lume text lane (layoutGlyphs newline split; anchor [0.5,0] grows the block upward off the hologram). Copy pins updated; MID_COOK fixtures carry the verdict the real service answers mid-cook.
• Quality governor refresh detection rebuilt (#12346, jure's 120.1Hz-is-not-165Hz thread): the p10 floor estimator raced the fast tail of rAF DELIVERY jitter — worker rAF timestamps are callback delivery times, not vsync times, so late-then-on-time delivery manufactures intervals shorter than the display tick, and every misjudgment landed in the budget-tightening direction. Replaced with a mode-share + median estimator over the same 240-interval ring: the judged point must hold ≥25% of the window inside its band (fastest-first), between-points promotion reads the MEDIAN rounded down onto the vocabulary, and adoption residency is asymmetric by direction — down stays ~1s + the load-gate, UP takes ×3 sustained residency (this clock can fake fast, and a wrong fast judgment manufactures overload). All five field streams pinned as fixture tests (clean/jitter/double-fire/mac/rig); no presented-frame clock exists in the worker to confirm against — stated on the detector.
• Persist verdicts name their failures (dig 9741709b, #12344): every per-mutation error entry carries target (the mutation's own id/path/place/behavior-target/starter-id — one generic probe, no per-kind switch) on all three error lanes (throw, row gate, batch gate) and in the operator reject log; the studio-chat verdict formatter reads [#i kind(target)] path: why, mutation-first, every failing mutation named when ≤10 failed and first 10 + explicit (+K more failed mutations) beyond. Savi's deliberate bisection re-runs — re-running a batch purely to extract WHICH mutation the old "N of M failed" verdict withheld — lose their reason to exist.
• api.spawn refuses an unknown primitive.kind honest-early: the curated primitive validator throws at call time with the persist gate's own vocabulary (derived from PrimitiveSpecSchema, plus a did-you-mean) instead of letting the bad kind detonate the whole persist batch later. setProperty lanes untouched.
• Worker-layer fix recorded here because creators experience it as engine behavior (rides kiln deploys, not this kernel tarball; ledger 2068, dig 095031f8): a non-JS file in scripts/ (README.md, archived.js.bak — Savi's own documented practice writes these) failed acorn's parse in kiln's published-SQL manifest extractor, marked the whole manifest PARTIAL, and the cf-storage door then refused the game's entire player SQL lane — save reads at join refused, presenting as a full character reset at the update boundary. The extractor now consults the file's NAME at the parse-failure/size seam only (isJavaScriptShapedPath, kiln core/game-db/published-sql-manifest.ts): .js/.mjs/.cjs and extensionless entries that cannot be read still fail the lane closed (they are scripts the engine may run), while non-JS-named files are skipped. Skipping never admits a statement — the manifest is an allowlist, so anything unextracted refuses per-statement at the door. A non-JS-named file that PARSES as JavaScript still extracts under normal posture rules, because the engine's module rail resolves exact-named keys verbatim.
• Mantle box-character wedge/pop on flat heightfield internal edges cured (ledger 2080, tiger's nightline; conviction from the #12391 A/B harness):
  • Mechanism: the character controller's contact collection (move-shape.ts collectContacts) ran GJK/EPA against each heightfield/trimesh triangle as a bare 3-point hull (queries/primitives.ts) with no active-edge information — the narrowphase's FixNormal law (static-trimesh.ts) never reached the CC path. A box parked at the padded gap near the next cell's shared edge got a closest-pair normal of box-bottom-edge vs triangle-edge — near-horizontal, below maxSlopeCos — a manufactured wall. At 12 m/s the plane solver blocked all forward motion forever (0.091 delivery, 133-tick wedge ~0.02 m short of integer cell boundaries); at 51 m/s the same plane converted forward velocity into upward slide (+0.42 m single-tick pops, grounded flap). Capsules escaped geometrically: the bottom sphere keeps seam normals inside the walkable cone.
  • Fix: collectConvexContact now applies the narrowphase's active-edge FixNormal law to per-triangle static contacts — when the contact's barycentric feature region has only inactive edges, the triangle face normal replaces the manufactured one and the separation is projected (gap ×= dot); within 1° the snap is unconditional (the same float-fuzz kill that keeps flat-ground normals bit-exact). Edge activity comes from the enumeration that produced the triangle (queries/primitives.ts currently-visited-triangle context): cooked masks for trimesh, the on-the-fly neighbor-normal rule for heightfields (static-heightfield.ts heightfieldTriangleActiveMask).
  • The #12391 divergence pins regenerated toward the rapier column per the suite's own header rule: mantle @12 delivery 0.091 → 1.000 (streak 133 → 0), mantle @51 delivery 0.928 → 0.99999 (maxRise 0.421 → 0.000, flap 12 → 0, airborne 30 → 0). The race run now crosses the two-chunk seam at x=0 with min tick delivery 0.999998.
  • Determinism goldens regenerated (runtime-browser-scenario.ts): characters/narrowphase/solver/world sections moved (+ nightly chain.queries); finalCharacterX moved by ~4e-5 m; every other section hash and every physical metric stayed bit-identical. V8/JSC receipts verified identical.
• get/setProperty asymmetries cured (ledger 1947, tucker's ObjectAPI audit batch 1):
  • Dotted read parity: readDottedProperty (properties.ts) is the read half of the dotted machinery — same path grammar as buildDottedPropertyMerge (split at first dot, same model.materials → parts canonicalization) wired into getProperty and getObjectProperty. The write half existed for years; the read half kept answering undefined and scripts "fixed" working code.
  • Non-string keys: one teach rail (warnNonStringPropertyKey) across getProperty/setProperty/getObjectProperty/setObjectProperty — was null.startsWith / key.startsWith is not a function raw TypeErrors.
  • The null promise honored, and truthfully scoped: setProperty("scale", null) clears to neutral 1 (was a TypeError at value.x in the writer, contradicting the boundary's own "Pass null to clear" log); the undefined-value log now says "most properties accept null to clear" instead of promising it universally.
• Silent numeric coercion cured at the property boundary (ledger 1941):
  • CURATED_UPFRONT_PROPERTY_KEYS — curated validators now run up front on live writes for audited keys (rollout gate, spawn() has always run them all): scale first, whose garbage writes used to be rescued to {1,1,1} by quantize + component sanitize with zero log traffic (live-probed: an authored scale-2 box silently RESET to 1). The scale validator refuses non-finite numbers and partial/non-finite {x,y,z} with verdicts naming the value. A blanket gate was deliberately not shipped: writers like visible: Boolean(value) are lenient on purpose — widening is one line per key after a leniency audit.
• Silent numeric coercion cured at the state choke point (ledger 1941, the 1943 rail's numeric kin):
  • quantizeStateValue/quantizeTrackedStateWriteValue turn non-finite numbers into null (JSON's own semantics) at any depth and teach through the json-safety rail with the path (kind: "nonfinite"); isSimplePatch routes non-finite to the slow path (top and nested level — the same fast-path leak shape as the 1943 symbol kin); the tracked-proxy set trap applies the same law at the proxy door.
• Two fixture-stock test.fails pins (dot-path-round-trip, nan-state-coercion) flipped to unexpected-pass and were promoted to real assertions per that file's protocol. One old test pinned the silent 0 (getState direct writes normalize non-finite numbers) — flipped to pin the null + row citation.
• Docs ride same-PR (ravi r-4f375dc0): types.ts docstrings (getProperty/getObjectProperty dot-path parity, patchState/replaceState non-finite law), skills/api-reference.md, regenerated TomeAPI.md + tome-api-prompt.ts.
• Spline family contract cures (ledger 1946, tucker's ObjectAPI audit batch 1 — the validation half; the mesh-rebind-on-spline-move half is a separate engine dig):
  • placeOnSpline reads offset as {x, y, z} OR [x, y, z] — the tuple used to fail the Vec3 guard and be skipped silently while the call still answered true (the boolean is the caller's verification; success now means effect). A malformed offset refuses the whole call: false + a verdict naming the accepted shapes, no partial placement.
  • projectToSpline accepts [x, y, z] points; a malformed point answers a verdict-carrying warning instead of a bare null indistinguishable from "no spline".
  • options.space is validated across sampleSpline/placeOnSpline: anything but "normalized"/"distance" refuses (null/false + a verdict naming the valid values) — space: "furlongs" with at: 21.71 used to clamp silently to the spline's END under success: true.
  • Non-finite at (NaN/Infinity) refuses with a verdict instead of a bare null.
• Two fixture-stock test.fails pins (spline-offset-silent-skip, spline-space-fallback) flipped to unexpected-pass and were promoted to real assertions per that file's protocol.
• Not new in this change but pinned by its tests: non-string spline object ids (getSplineLength(5)) teach-and-refuse via the ledger-2018 id-resolver guard instead of throwing Q.includes is not a function.
• State writes filter unstorable leaves (functions, symbols) at EVERY depth, not just the top level (ledger 1943, tucker's ObjectAPI audit batch 1). Before: patchState({ deep: { bad: () => 2 } }) slipped the top-level-only filter, the function survived into the stored bag, and the whole script's mutation batch rolled back at the serialization seam — one nested function nuked every other mutation in the run_script. Now the drop costs exactly its own key (array slots become null, JSON's own semantics), the rest of the write lands, and a getLogs warning names the dropped path (state values must be JSON-safe: function at "deep.bad" was dropped — the rest of the write landed…). Applies to patchState/replaceState/setState, setObjectState/patchObjectState, spawn state, and direct tracked-proxy assignment (api.getState().bad = fn is refused with the same teach instead of storing). Symbol values also used to sail the simple-patch fast path straight into the stored bag; they filter identically now.
• The old top-level-only warn ("Functions cannot be stored in state and were filtered out") is replaced by the per-path JSON-safety teach rail (same rail as Map/Set/Date normalization: runtime log → getLogs and run_script's returned logs, cooldown-deduped per script per key).
• One path grammar across the state verbs (ledger 1942, tucker's ObjectAPI audit batch 1):
  • normalizeDeleteStatePaths (the one place dots ever split) now also accepts segment arrays — literal key chains that map 1:1 onto the wire/mutation format (paths: string[][]), so the API-level grammar converges with the recorded-mutation grammar and keys containing dots are reachable. patchState keys are LITERAL (unchanged — now said out loud in the docstring).
  • teachDeleteStatePathObstacle classifies no-op delete paths against the live bag: literal-dot shadow (teaches the segment-form spelling verbatim), array obstacle (arrays are leaves per the merge law — replace wholesale), primitive obstacle. Missing paths stay silent (documented idempotence). Wired into applyDeleteStateToEntity behind a changed-nothing guard so single-path deletes that land pay nothing.
• One door for the map-taking verbs (ledger 1944):
  • resolveStateMapArg validates the state/patch argument (tracked-state proxies unwrap first) across replaceState/setState/patchState/setObjectState/replaceObjectState/patchObjectState; refusals teach with the verb's own name and the value. Kills three lies at once: number → silent state CLEAR, string → index-keyed bag, no-args → raw Symbol(tome.trackedStateRawTarget) TypeError leak.
  • replaceObjectState implemented as setObjectState under replaceState's name (shared body applyObjectStateReplace; each alias keeps its own name in the teach rails; read-only prototype covers it). The verb family now reads replace·set·patch·delete on self and cross-entity alike.
• Docs ride same-PR: types.ts docstrings (patchState literal-keys law, deleteState/deleteObjectState grammar + segment form, replaceState argument law, replaceObjectState), regenerated api-reference.md + TomeAPI.md.
• 17 new pins in state-verb-grammar.test.ts (bare-world, fixture-stock pattern).
• A suspension-stamped dead-socket ghost no longer holds a capacity seat at the admission door (ledger 2072, dig bd369775). On ws_close a Ready connection stays grace-held (phase Ready, detachedAtMs set) for the 20s disconnect grace, and in client-auth worlds the session is suspension-stamped into TomeSuspendedSessions on detach (takeover grace 0) — the engine's own declaration that the owner is gone and the envelope is host-simulated place remainder. The door kept counting that ghost against spec.routing.maxPlayers anyway, so on a maxPlayers:1 world every disconnect made the room unjoinable by any other clientId for the whole grace window (LFO playtest: 11 room-full rejects in one window, savi's router minting a fresh container per bounce — ≥6 concurrent containers of one app, two testers structurally unable to share a world). The capacity count now skips a connection that is BOTH detached and suspension-stamped. The reservation survives where the occupant is plausibly present: an unstamped detach ghost (no avatar, or a non-client-auth world) and a hidden-tab suspension on a live socket still count. The ghost's own owner was never door-blocked (same-clientId reattach resumes past the count — behavior unchanged, now pinned by test). Deliberate residue: a stamped owner who returns after a newcomer took the seat resumes into a transiently over-cap room, bounded by the disconnect grace — favored over turning live players away for a ghost.
• The room-full reject is a structured log event (netcode.connection.rejected_room_full with roomId/clientId/connectionId/maxPlayers, via logger.warn) instead of a console.warn whose fields object was dropped by log ingestion — the dig's named receipt gap: eleven rejects, none attributable to a client.
• Terrain/water point reads refuse non-finite coordinates (ledger 1945, tucker's ObjectAPI audit batch 1; the 1941 silent-coercion class, terrain specimen): getTerrainHeight, getWaterLevelAt, getTerrainNormal, getTerrainMaterial all answer null for NaN/Infinity x/z through one loud-once teach rail (teachTerrainProbeNonFinite) naming the verb and the coordinate. NaN used to flow into the sampler, the generator-fault rail clamped the non-finite result to 0 — blaming the CREATOR's generator for the CALLER's coordinate — and getTerrainHeight answered a silent 0 against its own "(never a silent 0)" docstring. The sibling getWaterLevelAt already had the finiteness guard; the cure is symmetry.
• getTerrainNormal (ObjectAPI + CameraAPI) returns Vec3 | null: null for no-terrain and non-finite coordinates — the same null semantics as getTerrainHeight. The old {x:0, y:1, z:0} phantom-flat answer read as plausible data over places with no ground at all.
• One fixture-stock test.fails pin (terrain-height-nan-silent-zero) flipped to unexpected-pass and was promoted to a real assertion per that file's protocol.
• Docstrings + regenerated api-reference/TomeAPI teach the shipped null semantics (ravi r-4f375dc0 row 2, same-PR law).
• getWorldBoundsBox null polysemy cured by naming, not by return-shape change (ledger 1948, tucker's ObjectAPI audit batch 1; kin of the 1931 enumeration family): null used to mean five things — missing object, no geometry, light-only, "", null-arg — while the docstring reserved it for still-loading and the promised warning fired for exactly that one cause (the rail was gated on readPendingModelId). The return type stays WorldBoundsBox | null (every existing if (box) guard keeps working; the platform's own register for this class — voxel probes, terrain reads — is null + a named verdict, not a discriminated wrapper).
  • teachWorldBoundsNull — the r-0223b62a loading rail generalized into a classifier, loud-once per (entity, cause, script): "loading" keeps the original text; "no-geometry" names what null means (nothing to measure, never zero size) and, for spline owners (resolveObjectSplineValue), names the generated sibling id prefix that carries the rendered surface.
  • teachBoundsMissingTarget — the missing-object cause teaches at the API boundary with the caller's spelling ("" included), mutation-warn throttled per id.
  • Non-string ids (getWorldBoundsBox(5) / (null)) were already cured by the ledger-2018 id-resolver type guard — pinned here so the Q.includes crash can't regress.
• Docstring (ravi r-4f375dc0 row 3 — the doc shape this cure decides): "null always means 'no answer', never 'zero size' — and every null names its reason in a getLogs warning", enumerating the reasons. Regenerated api-reference.md + TomeAPI.md.
• Remainder, named honestly: owner-answered spline bounds (the spline object itself answering its surface's box) is the same generated-SIBLING architecture dig as the 1946 mesh-rebind remainder — the loft mesh is ${owner.id}__spline__* with no parent link, so no subtree union can see it. The verdict's redirect is the working call today; the row stays open for that dig.

technical notes

• Engine test/verify infrastructure riding this version, no shipped-bundle behavior change: probe harness repaired for the relay era (four breaks fixed, relay-ground seams added, dead frozen-world parity rows re-pinned — #12249) · verify-fpv-transparent device-in-the-loop A/B pin at the transparent×camera-attach seam (#12255 — ledger-2055's deterministic code-path-skip theory rejected on device evidence; the harness caught the field-signature transparent-lane dropout in miniature and soaks for it with --runs N) · sql-api relay-digest race flake killed at the await (#12223) · mint tooling refuses the repo-root .changesets/ trap where records silently never minted (#12229).
• lume: absolute internal-resolution floor in the quality governor (#12252): the ladder cuts renderScale as a FRACTION of the canvas, but thin-content legibility runs on absolute pixels — ×0.55 of a 1707×916 window is a 939×504 scene pass (far wires gone, world text mush) while the same fraction at 4K is fine. Effective scale = max(ladder scale, 1440 / canvasWidth) clamped ≤1, folded at the one seam where the fraction becomes a buffer size (renderer.ts frame args), so rung cuts, the judder hold, persisted landings and ?rungPin are floored by construction and live resizes track frame-by-frame. DPR > 1.5 passes through untouched (the deliberate density law). New wires-road render-harness fixture pins the class at the repro window (unfloored deepest rung fails 3/3 far-content probes; floored reads all 3).
• Res-floor follow-up (#12262, review findings fixed forward): ?sceneScale pins are held as hrefScenePin and bypass the floor at the consumption seam (the rig's A/B pins again); F2 names the floor as the true asker when it clamps to ×1 ('internal-width floor 1440px — ladder asked ×0.55') instead of reading 'session opening'; the seam doc's shared-clamp claim trued in both homes (shared THRESHOLD, not shared input — the divergence is deliberate).
• The '[Tome] Juice call has no audience target' teach-rail line no longer floods the prod error lane (#12230, ledger 2045; 61 lines/78min from one app): it now rides the standard 30s content-key window (claimRepeatingReportKey — one claim gates the getLogs half, the ledger-1671 diagnostic forward, and the DD line) at WARN (a teach is not an engine error), carrying an unthrottled running classTotal so consecutive lines still answer rate questions. run_script overlays take only the runtime-log half (one returned teach per exec, no DD line, no stats write through the transaction merge). Sibling teach lanes untouched. Red-first: a 20-call storm mints ONE warn line; past the window the next carries classTotal=21.
• placeCleanupSystem keeps the occupied⇒resident invariant in BOTH directions (#12228, ledger 2044, dig de367ce4): a session avatar standing in a place with no residency entry was a permanent hole — the sweep only REFRESHED existing entries, applySpec skips non-resident places, and no writer ever re-created the entry, so the place's objects existed in the spec doc and nowhere else (Fire Nuke Island after a crash-reboot: 44 spec rows, 0 live). The sweep now creates the missing entry from the SessionOwner⋈PlaceMembership occupancy index it already maintains, gated on the place existing (authored or live instance row), loud on the recovery. Red-first pins in reconnect-place-residency.test.ts, including current join semantics (spawnPlayer re-seats at the default place) as an explicit receipt.
• Worker-layer completion of the relay game-database lane, recorded here at tucker's direction (creators experience these as engine behavior; the fixes ride worker deploys, not this kernel tarball): #11685's player SQL lane got its config half everywhere (#12220 — STORAGE_DO bound on staging+prod relays, prod room-mode + sql-manifest rows), cf-edge stopped knocking fresh games off the relay (#12250 — ABSENT engineSemver means UNPINNED, not unprovable; the P0 floor fix), and the prod relay now deploys on the same train as the edge that routes to it (#12236 — the 5.2.18-promote incident where sql-using rooms landed on a relay with no storage doors can no longer recur by omission). Scheduled work (crons) on relay-hosted rooms rides the same lane.
• api.sql array-misread guard (#12224, incident dde237bc 'Be Somebody'): every tagged-template SQL library resolves an ARRAY, so sessions read .length/r[0] straight off SqlQueryResult and the misread was perfectly silent — that incident's session concluded "api.sql is a silent no-op" and rebuilt persistence AROUND a working database. mintSqlQueryResult now defines a non-enumerable .length getter that throws the shape teach at the exact property that carried the misread; all data paths untouched (own non-enumerable props ride none of them). Iteration needs no guard (for…of on a plain object already throws loud) and a Symbol.iterator trap is deliberately absent (it would break honest feature probes). Plus the 501→unconfigured remint pin on the relay lane (game-db-relay test).
• World notes: Savi checks off her own finished work (#12231 — contract 8's missing half; jacob's ruling 2026-08-03: "she can do that — this is her todolist"). The studio-chat mutate route's lane guard refused every Savi-sent 'done' (all 50 closed rows on the reporting app were creator- or wisp-closed; Savi's finish could only park a row at 'attempted'), which also made a wisp she dispatched more able to close rows than Savi herself. Now: kiln's markSaviTodoDoneBySavi moves → done from any open state (note required, recorded as a completed attempt — honest trail for reopen; CAS pins read status + owner_wisp_id IS NULL so wisp-parked rows refuse), the mutate route dispatches status 'done', and the world-notes skill teaches the done/attempted split ('done' for plain finish lines she saw land, 'attempted' for taste calls and any redo of a row the creator bounced — their eyes close disputed rows). Creator reopen/bounce stays the override; no creator-surface UI change (savi-closed rows ride the exact read path wisp/creator closes already ride). Rides the skills manifest + studio-chat/kiln deploys.

technical notes

• playSound gains follow: true (row 2037, dig 55122dec). A positioned one-shot that names it mirrors its SOURCE entity's WorldFeetPosition while the voice lives — the primitive-not-pipeline fix for self-emitted movement sounds (installation-03's footsteps: spatial plays pinned at boot-plant positions trail opposite the mover's velocity for the life of every clip; bystanders hear correct physics, the mover hears their own boots behind them). Mechanism is the one loops already use: audio/prep re-reads emitter positions per frame, so the fix is a position mirror on the pooled carrier — spawnPlaySound records follow + the source entity in the one-shot registry (OneShotSoundEntitiesResource), and a new client system (tome/one-shot-sound-follow, renderPrep −110, ahead of audio/prep at −100) copies source→carrier each frame, making a follow voice exactly as fresh as an audio: loop on the mover itself. A source that despawns mid-clip stops mirroring and the voice finishes at its last position (one-shots outlive their emitter, by design). Version boundary pinned red-first: flag absent = byte-identical wire and behavior (unset one-shots stay world-pinned); the option rides the wire only on positioned non-loop plays that named true (unpositioned follow teaches once and lowers — non-spatial plays are already ear-locked; loops lower silently — tracking loops are the audio: component's lane). Pins: tome/__tests__/playsound-follow.test.ts (wire shape + client mirror, both halves).

• Audio listener basis prefers the renderer's displayed camera (row 2036, dig 55122dec). readListenerTransform/readCameraTransform (engine/audio/prep.ts) now build the listener pose from viewState.rendererTransform (pos + rot) when renderer feedback exists, falling back to the script-authored viewState, then the entity transform — the exact preference the aim basis has used since camera-derived-axes' resolveViewState. Closes the latent audible-camera ≠ visible-camera seam: undeclared mouse-orbit rigs discard authored rot for display, so a camera script with missing or convention-flipped rotation writes produced wrong/mirrored audio with flawless visuals and correct aim, silently. Explicit AudioListener.forward overrides (the 2D fixed-basis law) still beat every camera-derived basis. Pinned red-first in engine/audio/__tests__/prep.test.ts (renderer-preferred, authored fallback, explicit-forward precedence, DrawCamera fallback path).

• Savi surfaces: follow in the playSound/playSoundAt option types + @tomeapi doc (api-reference regen), and the audio skill's world-sound section names the trap and both exits (follow for self-feedback, or non-spatial).

• Behavior-rail told-success-never-persisted — class elimination (ledger 2034, dig 4bd40250; second incarnation of the 9b58cad7 patchRouting hole). A spec-doc write from a tracker-less behavior script (api.patchInputs, and eighteen siblings) applied to the live spec, returned success, and never entered the durable stream — so every strictly-newer durable version rebased the section wholesale (inputs: next.inputs ?? prev.inputs) and wiped the write: annias patched 28 input actions from a behavior manifest and watched four Savi-churn spec applies erase them in 19 seconds, forever, across 190+ versions. The cure is structural, not another hand-copied tail: recordMutation itself carries ONE shared behavior-rail persist epilogue — armed trackers (run_script / god-mode) still own their batch; client-auth behaviors forward source-stamped (the ledger-1653 seam, now tier-complete); everywhere else a mutation classified persistable by isGlobalSpecMutation (the same classifier every other rail rides, with 9b58cad7's compile-time exhaustiveness gate) enqueues for the room's drain. The seven per-verb tails (patchEngine/patchRouting/places/mint) collapse into it, and the nineteen measured holes close: setScript, deleteScript, patchInputs, patchGodMode (+brushes), patchUi, setCreatorTab, patchTerrain, patchPlayer, patchCamera, replaceCamera, addBehavior, removeBehavior, buyables ×3, jobs ×3, replaceSpecWithStarter. A contract sweep derives its required set from the classifier, so a new spec-doc kind cannot ship without a behavior-rail persistence story (or a named live-only exception — patchAtmosphere's session overlay, which durable rebases deliberately cannot wipe). Falsifies: a bound action patched from behavior context vanishing on the next spec version.

• Query iteration SoA component VALUES are flyweights (ruled 2026-08-04, squeeze hunt ECS core). The engine-internal QueryResult iterator contract narrows: soa3f32/soa4f32 columns (WorldFeetPosition, BodyPosition, WorldScale, WorldRotation, LocalFeetPosition, LocalRotation, LocalScale) now hand out ONE reused value object per column per QueryResult, refilled per row inside fillRow — the last per-row mint #12093 left standing (one {x,y,z} per SoA row per pass; a 20k-row soa3 query paid 20k mints per iteration, now 1 per column per QueryResult). toArray() keeps fresh mints per row and stays the retain-safe form. Audit receipts (bound: every .query( call site across apps/cf-kernel/src including tests and benches; positive control: the known SoA-tuple site tome/api/query-utils.ts:554 and the flyweight row-identity pins were both hit): exactly one non-test SoA-tuple iteration exists (query-utils.ts emitFullScanMatches — consumes in-loop, scalar emit, no retention), all test SoA queries use toArray(), no import aliases of the seven SoA components, no multiline query calls, no generic wrapper passes SoA tokens into world.query. Zero retainers found, so no consumer migration was needed. The script-facing boundary stays fresh-mint by construction and is now named in the QueryResult doc: api.query builds its own results (query-utils.ts buildQueryResult captures scalars and lazily mints an escaping Vec3), the exec overlay's query builds its own rows from staged values, and world.get mints per call — the flyweight never crosses the ECS layer. This change is invisible to behavior scripts and run_script.

• Pin flip (documented per the ruling's duties): the retain-safety pin was documentary — the QueryResult interface doc ("SoA columns a fresh object per row", world.ts) plus a comment in determinism-pins.test.ts; no executable assertion pinned value freshness. Both texts now state the flyweight contract, and a NEW executable pin ("SoA column values are per-column flyweights during iteration; toArray mints fresh values", determinism-pins.test.ts) asserts one reused value object per column with correct per-row contents, and fresh distinct objects from toArray().

• drainEventAdds returns a shared frozen empty array when nothing fired (the common case for its ~11 per-tick/per-frame drain sites — juice ×3, sound-loop ×3, purchase prompt, renderer particle burst, audio prep/deriver: ~400-800 throwaway arrays/s per session at rest, now 0), and its declared return type is readonly StickyEventAdd[] so tsc enforces the read-only caller contract mechanically (all 7 production call sites audited read-only; a caller pushing onto an empty drain now throws in strict mode instead of silently cross-contaminating drains). sound-loop-ingest processes its three juice drains in place instead of spread-concatenating them into a fourth array per server tick.

• Replication drains refill a persistent changedComponentIds scratch in place instead of minting Array.from(set).sort(freshClosure) per drain — both the ECS-level drain (engine/ecs/replication.ts) and its production twin (runtime/replication/room-replication.ts, one drain per AOI-bucket class per egress tick). Consistent with the delta-is-reused-scratch contract already documented in replication-delta.ts; consumers (room-wire-codec frame encode) read synchronously within the same frame build.

• behavior-update's per-tick debug readout (TomeBehaviorUpdateDebugResource) mutates one engine-owned resource object in place (ensure-once + six field assignments at all four system exit paths) instead of minting a fresh object literal per tick per world. Reader census: the sim-probe markers handler (structured-cloned at post time), tests, and the behavior bench all re-read the resource per observation; none diff object identity across ticks; behavior-update never runs inside an exec overlay.

• New bench coverage for the two blind spots the sweep named: ecs/query gains query/1-soa3 (an soa3f32 population — the storage class every transform/pose query actually iterates; the old fresh-mint path measured 283µs/pass vs 254µs flyweight at 20k rows, mint kill 20k→1 per pass) and a churn/commit+churn/query pair (one spawn+despawn per iteration invalidates every cached query shape; measured ~2ms/churny-iteration of snapshot-rebuild tax at 20k entities across 3 shapes — the receipt for the still-open query-snapshot-rebuild-under-churn row, which this PR deliberately does NOT implement: incrementally-maintained snapshots need lend-bit copy-on-write across every store×shape pair plus a mass-churn fallback to hold snapshot identity byte-identical, a design project with engine-wide blast radius, skipped honestly per its own P verdict).

• fx particles join the 2D sprite sort band (resx dump 09ad1c9c, #12210). In 2D scene dimensions every sprite draws inside the near-camera sort band (sprite-sort-key.ts) — cutouts write band depth, soft sprites sort by band NDC — while fx particles rasterized at physical play-lane depth and sorted in the alpha bucket by view-depth METERS. Both currencies lose to every band draw, so a background sprite on ANY sortingLayer occluded every particle, and no authoring could put a spell effect in front of a corridor backdrop (fx has no sort vocabulary; creators rebuilt particle effects as sprite entities — Afterschool Starfall's own scripts document the workaround). The fix seats fx in the band: particles rank at layer 0 under the ySort law, half a rank behind sprites so exact-z ties keep the sprite in front. Mechanics: sprites-wgsl VS converts clip z to the band depth of the particle's world z in 2D (new frame uniform sort2d in the _pad0 slot) so the depth test interleaves particles with cutout sprites per pixel; 2D batch sortDepth becomes the band value of the anchor's quantized z rank (emissive bias rescaled to band units) so blend order interleaves with soft sprites and 2D text; band constants export once from sprite-sort-key.ts, and frame loop, scene-view capture, and pixel provenance all stamp the dimension. Receipts: new fx-2d-layering render-harness fixture (2D corridor: particles beat a layer −12 cutout wall AND a soft panel, stay behind a layer +6 prop) — fails both particle probes on the old engine; fx-fusion/fx-soft-distort/effects/part-dissolve/sprites-ysort/emissive-2d all green; unit pins for computeFxSortBandDepth, the sort2d uniform, and 2D batch sortDepth.

• Distort paint gated by displacement — no distortion ⇒ no paint (the #11475 shockwave law extended to distort sprites, r-156774a3, #12213). A blend:"distort" fragment re-samples the resolved-OPAQUE viewport share — no fx sprites in it — so a zero-offset fragment repainting that share verbatim erased every transparent drawn behind the quad (the kill-explosion transparent-rectangle cutout; a real authored shape — any haze fading its displacement out through 0). The fragment's alpha is now authored alpha × tex mask × smoothstep(0, FX_DISTORT_MIN_PAINT_OFFSET_UV = 0.002, |offset|) — the gate constant is the bespoke shockwave's own strength floor (mix(0.002, 0.05, strength)), so every visibly distorting look keeps full authored alpha while the idle quad paints nothing. Receipts: fx-soft-distort fixture gains the erase-probe pair (an additive glow behind a zero-offset distort quad must match its uncovered mirrored twin), and the effects fixture's rear slash becomes a mechanical target (flat saturated-orange body, whole-frame pixel count, orbit-proof — a repainting shockwave plane collapses the count to ~zero).

• The player SQL lane — api.sql works on relay rooms, bound to what the game published (#11685). Relay rooms had no durable write lane: api.sql reached a door only a credentialed room host could open, so on the tier that is becoming the only tier the taught persistence recipe silently never ran — hooks fired, saves "succeeded", nothing landed; run_script was dead there for the same reason and migrate() had no seat to run on at all. The lane opens without giving a browser the database: every call a player seat sends is admitted by DIGEST against a manifest kiln publishes from the spec, so a player can only run SQL the game itself contains — never a statement they invented, never one only the game's own privileged seats run — and @caller is a marker the door fills from the relay-verified identity, so a published call cannot be re-aimed at somebody else's row. migrate() runs inside cf-storage in a Worker Loader isolate with an empty env and globalOutbound: null, triggered by the door's own manifest pull for a spec version it has not migrated yet — no seat, no room, no boot: a fresh relay room that only ever contains browsers still gets its schema. Hook posture is decided per hook: the relay fires onPlayerConnected/onPlayerDisconnected in the player's own browser with no token-class gate, while onPlaceStart/onPlaceShutdown run only on the credentialed seat.

• GPU timestamp envelope — zero-slot guard at the fold + plausibility gate at the latch (r-e03edd0a, dig fc184c35, #12207). iPhone16/iOS26 sentinel units minted gpuFrameMs ~1.5–2.1e6 ms (milliseconds since device boot) because one resolve carried an unwritten query slot — WebGPU resolves those to 0 — and the envelope's min/max fold anchored at the epoch. Two guards: frame-graph.ts timestampEnvelopeMs/exclusivePassTimesMs/seamAttributionMs skip any interval whose begin or end resolved 0n (0 is 'query never written', never t=0 — deletes the unwritten-slot class at the fold), and renderer.ts pollGpuFrameTiming refuses any envelope >1000ms, >4× the wall gap between settled reads, or non-positive (the cross-base variant the zero-guard can't see) — gpuFrameMs holds the last plausible sample instead of relaying uptime. The device-farm sentinel relays the engine number verbatim (correct) and needed no change.

• Client job pool memory squeeze (squeeze-hunt round 2). The shared-SAB JSON transport is retired: job submits and results now ride structured-clone postMessage both directions, deleting 2.5 MB of resident ring buffers per worker, a triple byte-copy + triple payload pass per message, and the per-submit compatibility pre-walk — measured per-message CPU is a wash (the SAB lane's event-loop wake was a postMessage poke anyway), so nothing gets slower and every message gets one serialization instead of up to six passes. This also makes the ledger-2031 oversize class structurally unrepresentable: postMessage has no channel byte cap, so the 2 MiB-envelope incident shape cannot recur (the clone-fault rejection lane and the 3-attempt requeue bound survive unchanged for the residual fault classes). Separately, the idle teardown now reaps the LAST warm worker too — an explicit reversal of the one-warm floor: an idle world holds zero ~21 MB engine-bundle job isolates resident (was ~23.5 MB carried for the whole session on every iPhone and 1-worker-budget device), while the eager boot spawn still covers the load burst and the first job after a >30s idle gap pays only a parse-only worker respawn.

• Job-pool poison elimination + server collider-gate honesty (ledger 2031, incident 547f9352). One oversized job envelope (2,110,187 bytes > the 2 MiB shared-channel max) could silently kill ALL client terrain and asset builds: the transport throw landed in the pool's worker-failure handler, which terminated the worker, requeued the same envelope at the queue FRONT, respawned, and resent — an infinite loop (3,077 worker errors in one session) that starved every build behind it until the collider gate force-opened with zero colliders and nothing rendered. Now an envelope that can't ride the transport fails AS A JOB: a submit-time size gate (serialize once — the measured bytes ARE the wire bytes) rejects over-cap envelopes loudly with byte counts, job type, and a payload breakdown naming which arg ballooned; the structured-clone fallback lane (stack-blowing postMessage) takes the same rejection lane; a requeue bound makes ANY envelope that keeps killing workers fail as a job after 3 attempts instead of looping forever; and the worker-side response over-cap falls back to postMessage instead of crashing the worker. Separately, the "server physics is paused… Nothing is wrong — simulation resumes automatically" run_script note is now duration-aware: past a 2-minute warm-up window it names the measured pause duration, says the wait will not resolve itself, and routes to a bug report.

• Lifetime silence-backstop — the server reaps expired deadlines past a dark-in-fact simulator (r-c8d52362, the 07-30 projectile pile-up, #12211). A wedged client (starved sim worker behind a healthy socket) is Ready, Streaming, unstamped, and uploading nothing; its envelope had no takeover of any kind — not a seat (no re-election), never suspension-stamped (tab visible, socket attached), and the container tier's server seat fallback skips envelopes. A silent successorless-HELD seat deferred the same way. In both shapes api.spawn({ lifetime }) entities outlived their deadline with nobody to reap them — the frozen projectiles piling up in Mecha Blade, and the class the hot drop's own shotfx-reaper.js broom names verbatim. tome/lifetime-reap now resolves a reap LANE per expired deadline: simulator and last-resort stay byte-identical (hooks on), and the new SILENCE BACKSTOP fires on the server when the entity's simulator-in-classification (envelope owner, or the sitting place host) is dark-in-fact — Ready + Streaming + attached, silent on both upload cadences past the health window (the exact isSilent word host retention reads). The backstop destroy is HOOKLESS (the cross-writer destroy PREVIEW's reasoning): a silent client can wake and land its own replay, and envelope deletes are withheld from the owner, so the owner's own deadline reap fires onDestroy exactly once; a simulator that never wakes fires it zero times. Suspension-shaped connections (hidden tab, detach grace) are excluded by the connection-shape gate — a brief alt-tab never moves authority for this reaper either. Red-first pins in the lifetime e2e suite: WEDGED OWNER (envelope, with wake convergence) and SILENT HELD HOST (remainder) — both leaked forever before the lane. The projectiles skill's flagship example now carries the lifetime backstop its own rules prescribe.

• BREAKING: query results and object summaries hand out the live tracked state proxy (ruled 2026-08-04, supersedes #12092's detached snapshot). buildQueryResult and getObjectSummary (tome/api/query-utils.ts) return .state from the shared per-(world, bag) proxy cache in the new tome/api/tracked-state.ts — the exact object getObject()/getState() return. Reads are 0-alloc off the stored bag (the per-read {...state} spread + read-tracking wrap chain is deleted); writes mark the component updated, replicate, and ride the client-auth intent rail; a retained result observes live state. getMergedTomeState/getMergedTomeStateByIndex (state-utils.ts) and trackClientAuthSnapshotState (intent-context.ts, the detached cross-writer snapshot wrapper + its per-call WeakMap/JSON.stringify path cache) are deleted — the tracked proxy's own traps record reads/keys/has-probes into the ACTIVE invocation at trap time (same dynamic attribution, plus the toJSON-probe basis exclusion the snapshot tracker had).

• BREAKING at one seam: native structuredClone of a result's .state throws (proxies are not structured-cloneable). Scripts are unaffected — their structuredClone is the unwrapping bridge (script-value-clone.ts; every tracked proxy mint now registers in its proxy registry). The exec result boundary (exec/engine.ts finishOutcome) unwraps registered proxies before the reply crosses, so return api.query(...)/return api.getObject(id) from run_script now arrive as plain data (getObject views previously DEGRADED into a serialization note — fixed by the same unwrap). api.job args gain the same membrane unwrap as the property-write lanes.

• Tracked-proxy write path (row: tracked-proxy-write-double-materialization): the set trap stores to the TARGET directly and fires the recorder itself, instead of receiver-routed Reflect.set re-entering the defineProperty trap — one quantize walk, one markComponentUpdated, zero descriptor mints per write (was 2 traps + 2 quantizes + 2 marks; object-valued writes paid the whole container copy twice). Recorder emission stays the single funnel, after the local apply. Bench (this box, micro): getState mutate top-level 321→170ns, nested 319→163ns; object-valued assign 277ns single-copy.

• patchState/patchObjectState/deleteState (row: patchstate-triple-whole-bag-walk): an O(patch) write verdict (statePatchChangesStoredState, the deepMergeState mirror under the column write's own fastDeepEquals law) runs BEFORE the merge — a changes-nothing patch skips the {...current} merge copy, the full-tree sanitize walk, and the full-width equals walk (cross-writer intent emission and the ledger-1157 durable-mirror suppression contract are preserved verbatim; the specValuesEqual persist verdict stays its own law). Changed patches take the new trusted pre-sanitized lane — world.setResolvedByIndexPresanitized / setObjectMapPatch(..., presanitizedChanged) — which skips sanitize (merged bag is wire-safe by induction: sanitized stored bag + membrane-quantized patch values) and the equals gate (verdict already proved the write lands). Raw engine world.set callers keep the full sanitize net. Bench: patchState 2-key vs 50-key bag 1053ns, no-op 193ns, 2-key vs 100-key nested bag 2267ns (new cases).

• getObjectSummary (row: get-object-summary-eager-materialization) rebuilt on the lazy-accessor literal: id eager; tags/feetPosition/state memoizing accessors — contact/interact/voxel payloads stop paying the whole-state spread + tags copy + position mint when the hook reads only other.id, and land on the SAME final shape as query results. The missing-position {0,0,0} default still skips the physics-quantize check (hadPos capture); present positions keep the read-time pose-driven check.

• Script-transaction overlay (row: overlay-entity-walk-per-query): currentEntityIds is memoized against the overlay's own membership funnel (spawnEntity/despawn — the base world is frozen for the overlay's lifetime), the O(spawned×N) includes scan is gone, and query-row iteration memoizes on a staged-write epoch (bumped by every setComponentPatch and membership mutation; rows embed references, so in-place read-clone mutation needs no edge). Bench (new case, no pre-change twin): 50 staged spawns + 50 entity enumerations over 3k entities = 272µs total (~5µs per enumeration); the deleted term was O(N + spawned×N + N log N) per enumeration — ≥ 150k includes compares + a 3k sort each, at this shape.

• Flipped pins, each one the ruling's own semantics: query-lazy-results.test.ts "state stays a detached snapshot: result writes never reach the world" → "state is LIVE: result writes land"; its native-structuredClone parity pin → script-bridge clone + native-throw pin; new pins for door identity (query result / summary / tracked door alias one proxy) and live retention. client-auth-intents.test.ts rewired from the deleted getMergedTomeState door to getObjectSummary(...).state (all basis-recording expectations unchanged — get/has/ownKeys/JSON recording now comes from the tracked proxy's traps); its native structuredClone-of-snapshot assertions flipped to the script bridge. query-fast-path.test.ts reference impl reads the tracked door. New exec pin: returned query results/views cross the wire as plain data (clone-fallback.test.ts).

• Behavior-preserving invariants pinned by the untouched suites: client-auth e2e + intents (basis order, inc/set classification, revert inverses), script-transaction overlay + tx-spatial query parity, exec snapshot withholding drift pin, determinism pins. Caches name their invalidation edges at the definition site (tracked-state.ts header; overlay memo comments).

• Module compile artifacts cache across applies, keyed by content and realm flavor (#12098). Every applySpec minted a fresh ModuleContext and recompiled every lib module in the entry graph from scratch — export rewrite, float quantization, ASCII escape, and the factory-memo hash, all O(source bytes), synchronously in the client sim worker on every spec echo (the per-edit freeze on script-heavy worlds; the server measured 2354ms for a 68-script world before its slicer). The behavior/generator caches already survived applies; module codegen did not. The artifact — transformed body + memoized factory — is a pure function of the module's OWN source and realm flavor (require() resolves at execution time through the per-apply context), so it now lives in a cross-apply cache keyed like the failure memo (ref + ui/quantize/audio flavor) with byte-identical source validated per hit. Module INSTANCES stay per-apply — state isolation between applies is unchanged.

• Pinch zooms the game by default (jacob: "i want pinch to zoom in the game not the site"). The zoomIn axis becomes the engine-defaulted platform zoom channel, exactly like lookX/lookY: when a spec doesn't declare it, the compiler injects the axis and its MouseWheelY binding, which also arms the touch draft's pinch recognizer — so the wheel and the two-finger pinch feed input.axes.zoomIn in every game, declared or not (a declaration of any shape still replaces the default wholesale, and taught camera scripts that read zoomIn keep owning the gesture with their own distance/height semantics — including games where Savi wrote the camera read but forgot the axis declaration, which start working). Games whose cameras never consume the channel get an engine default on touch devices: a presentation-layer zoom the camera system integrates per frame and folds into the published view — perspective rigs zoom optically (fov through the tan half-angle), ortho rigs divide the presented half-height — clamped 0.5×–3×, reset on rig swaps and god edges, standing down whenever anything else claims the gesture (a camera behavior reading zoomIn, any spec axis bound to the wheel, god mode's own god:scroll dolly, or a desktop client, where the wheel keeps its desktop vocabulary). DrawCamera stays authored-pure; the pointer ray follows the presented projection by construction. Containment for the same report (the authored-realm iframe carrying the pinch law so Safari never scales the page) landed separately in #11952.

• Relay AOI: place-scoped delivery + networking.aoi parity — joins and motion stop being O(room) (#12063). The relay journal gains a place column on heads AND journal rows (idempotent self-heal migration; pre-existing rows read NULL=global) with a producer-supplied retag law (one entity, one place, atomically); joins declare places and drain place-scoped (declare(place) ⇒ drain(place), with a PLACE_DRAIN_ALL backstop); motion rides an EPHEMERAL plc predicate through fanout (fail-open on every axis; interest is socket-scoped, never journaled). Engine side: dial advert + declare flow, keyed-row place stamping with the retag law, drain-bracket admission, receive-all seat pins, and world-sync under scoped delivery (covered-places statements, bounded ghost sweep, placed answer seat, version asymmetry). Parity v2 adds the §13.1 config→lattice resolver on the shared aoi-cells math, emitter motion sharding (≤16 cells + spill), a two-term cell envelope with full-restate declare edges, and the relayBin 4 codec mirror. Net effect: a join downloads its own places instead of the whole room, and per-tick motion fan-out scales with who can see it instead of who is connected.

• Faster multiplayer boot: the relay join's load-bearing spec snapshot fetch no longer waits for the socket welcome. Every fetch coordinate is already parked at worker mount — before the WebSocket handshake completes — so the engine now kicks the fresh-room latest spec read right there and the join consumes it when the welcome's target matches (fresh-room latest, or a versioned checkpoint pointer whose dbVersion equals the prefetched read's adopted version — immutable content, so age cannot stale it). Any mismatch discards the prefetch silently and fetches exactly as before: same edge route, same 204/failure semantics, same retry ladder, byte-identical fallback. The result is one full edge round trip + spec body download (100KB-5MB) deleted from the serial wsConnected→specApplied boot path — pure overlap with the WS dial and mount chain, worth 150-800ms at mobile RTTs.

• Relay motion split goes per-COMPONENT, and a journaled name is forgotten without evicting the entity (tucker on staging: "the lag/freezes happen on directional changes", #12197). An avatar's pose and its draw/mixer weights land in ONE change-log row, and the locomotion feature writes the mixer FROM VELOCITY every tick — hold a straight line and the row is pure pose; start, stop, or turn and a non-motion component appears beside it. The lane split ran row.components.every(...), so one journaled component disqualified the whole ROW from the motion lane, and forgetJournaledMotion then ran motionChain.evict(row.id) — dropping the entity from the delta chain entirely; receivers discard rows for an unbound alias FAIL-CLOSED, so the avatar froze at every peer until the re-bind landed, then snapped. Freeze-then-teleport on every direction change. Two narrowings: (1) the split is per component — a row's motion components take the motion lane even when the same tick wrote something that must journal (rows carrying REMOVALS still decline the split and journal whole: the register has no removal list, and splitting a removal from a same-tick re-add would land the pair out of order across two lanes); (2) MotionDeltaAuthorChain.forget(id, names) replaces evict(id) for journaled UPDATES — the journaled component still re-sends in full (the §11.3 rule, preserved at component granularity), but the entity keeps its alias binding (aliases mint append-only within an epoch); evict remains for real deletes. Considered and rejected: reclassifying draw/mixer as motion — DrawMixer carries creator-authored one-shots whose startTick bump IS a replay trigger; that trade swaps a stutter for dropped animations. New pin: relay-motion-delta "THE TURN STUTTER" — a journaled sibling forgets only its own basis, the pose keeps its alias, the receiver discards zero rows.

• The relay tier's music lane — rail.music works on rooms with no server world (zoo jukebox+stems silent on relay, tucker 08-05, #12202). On the kernel tier TomeMusicState has a single authoritative writer (hooks forward rail.music, the server executes, replicate:"always" fans out); a relay room has no such seat, so the lane re-lands the same three guarantees in relay vocabulary: WRITE — the hook-running client is the room's only executor of its creator JS, so the verb applies to the LOCAL world at relay egress (the command lane's "music" consumer, keeping the Layer-3 claim-window hold: a rolled-back speculation never plays audio); FAN-OUT + LATE JOIN — publishRelayMusicHeadIfChanged ships the local head as one unstamped update row that the relay journals as a keyed head, so live peers converge LWW in the room's total order and catchup replays exactly the latest head to every joiner (the kernel's "land mid-track" story, relay-shaped); CLOCKS — relay clients free-run their tick clocks, so the wire value carries relayAnchor {tick, ms} and ingest rebases every anchor into the receiver's clock (live rows' elapsed ≈ transit, journaled rows' elapsed = dwell — late joiners seek mid-track truthfully, landed fades stay landed, and a stop-fade anchored at a longer-lived writer's tick can no longer hold one peer's music audible forever). An echo guard stamps ingest-applied heads as shared so the publisher never re-ships them.

• Relay generated content survives place travel — onSpawn defers on unknown authority instead of skipping (the P1 vanishing cars, #12190). The release blocker ("enter a place, come back, the cars are gone; reload and they're still gone"), measured against the relay's own durable state: the generated child's create IS journaled and STILL stands as a live keyed head after the round trip — zero delete rows, no tombstone. The loss was re-derived locally on every world: the re-materialization apply destroyed the authored chassis (remove-diff → destroyEntityWithHook, cascading to spawned descendants) and re-spawned it with onSpawn SKIPPED, because the place was unhosted at that instant (isClientAuthObserverEntity's fail-closed pre-table branch) — and nothing ever re-ran the skipped hook; any joiner that DID fold the still-live create off the journal had it reaped by relay-world-sync's ghost sweep, since the incumbent's liveIds were built from the world that just lost it. The cure at the lifecycle seam: "I don't know who simulates this yet" is a WAIT, not a skip — hosted lifecycle hooks defer until authority resolves, then run exactly once. Measurement pins ride in the two-client harness (journal rows + keyed heads), including the A/B that a HOST-authored destroy does journal a tomb (that lane was healthy — it just never fired here). Named hazard pinned: api.spawn onto an already-live id mints a _2 duplicate rather than adopting, so any lane that re-runs a lifecycle hook must establish the hook's spawns are absent first. The tier pin is a guard: place residency is deliberately not mounted on relay clients — placeCleanupSystem is mode:"server", so no place is ever unloaded in a relay room, and mounting residency there without local-only teardown first would turn memory eviction into permanent room-wide data loss (the docstring that primed the misdiagnosis — "the place can re-materialize on re-entry" — is corrected in place: it only ever described the spec's skeleton).

• Relay presence on the wire, cross-place removal, and one ordered egress lane — 8 defects across 2 dumps (#12185). The headline cure: the renderer's visible set was EDGE-triggered (SPAWN admits, DESPAWN evicts, every other op gates on set membership alone), while the include predicate (ecs-sync computeShouldIncludeEntity) was already place-aware and correct — so a peer that left or entered the viewer's place flipped the verdict with no lifecycle row of its own, and the client computed the right answer every tick and never applied it, in both directions. writeIncludeReconcile now level-triggers the set: it takes the entities whose verdict inputs changed in this tick's drained op window and repairs any disagreement between verdict and membership — despawn what is in and should not be, snapshot in what should be and is not; cost is strictly O(membership mutations this tick), and the nomination list rides the op walk that already retires memo entries. The render-suppression grace (#735's snapshot grace) is scoped and made a level for the same reason. The remaining defects in the set land presence rows on the wire and collapse egress onto one ordered lane so cross-lane reordering can't resurrect a removed peer.

• Relay wire perf ladder — binary keyed lane, drain compression, quantization (dark), command classification, client parse-once (#12046). B1: the keyed-STATE lane goes binary (BIN_OP_KEYED_BATCH + single-part register rows) behind the invite's accepts lattice with a two-step degrade latch and the place-bit reserved for AOI — measured 3.4–5.3× on the keyed tick. B2: catchup/retransmit/joinBuffer drains compress (BIN_OP_BATCH_DEFLATE at relayBin 3; ceiling + compaction-hold + drain-serialization replace the sync-drain accident; the live wire stays plain forever). B3: a compile-closed relay command-lane table kills the zero-consumer journal class — 12 leak names stop journaling. B5: motion quantization Q1 (op-10 register, quantize-at-source) lands default OFF, feel-gated on the walk; rest stamps bit-equal live values by construction — measured 1.3–1.6× over the binary lane per frame, 19.7× vs JSON on the seeded trace. B4: client download-path CPU — a parse-once memo door (fold + apply share one decode, ack facts extracted at emission), host-tick register adoption (golden vector pinned three-way), and the world-sync round-trip kill (pass-through translate + stringify-once assemblers). Review fix riding along: beginRelayInflate's async task is guarded — a throw from a session hook mid-drain no longer strands the ingest-busy latch forever (the silence watchdog provably could not heal it: activity stamps before parsing).

• Server terrain chunk-build submissions are budgeted per tick (#12097). Server chunk builds execute inline in the engine isolate's realm (the inline job executor — no worker threads), so a full-place sweep that submitted its whole pending budget in one tick was tens of seconds of back-to-back build macrotasks on the 2vCPU prod container. The tick RPC blew its 10s deadline behind that batch, the shell reloaded the isolate as wedged, and the reboot from the DB spec erased runtime-spawned entities — a spec-write storm turned into "the room restarted and the zoo is gone". The sweep gate (stale-cancel + trailing-edge coalescing, 5.2.15) already kept saves from stacking sweeps; this adds the missing work-side half: at most SERVER_MAX_CHUNK_BUILD_SUBMITS_PER_TICK (4) non-safety-lane builds submit per tick, so the tick loop keeps breathing between builds and the wedge-reload-amnesia chain can't fire from terrain load alone. Safety-lane builds (player support) keep their priority lane.

• Perf: flyweight set-event dispatch for motion-class SoA components (speed-of-light row soa-dispatch-flyweight, ruled 2026-08-04). A new SoA-only schema opt-in transientSetEvents routes setSoA3/setSoA4 subscriber dispatch through one pooled event object (+ pooled previous/value vecs) per store instead of minting three fresh objects per dispatching write — the top steady-state GC feeder at 3k-moving-entity scale (~270–500k objects/s → ~0).

• BREAKING (engine-internal subscriber contract only): for the seven opted-in components — transform/world-feet-position, transform/world-rotation, transform/world-scale, physics/body-position, tome/local-feet-position, tome/local-rotation, tome/local-scale — an onComponentSet event object retained past the callback is overwritten in place by the component's next dispatch. Every in-tree subscriber of these components was audited (spatial-index, hierarchy-solve, hierarchy-render-solve, local-transform-projection, rapier/sync, aoi-index, sprite-raycast, perception, nav-grid, overlap-probe-cache) and reads fields synchronously; onComponentSet is not reachable from creator scripts or any run_script/ObjectAPI surface, so no session-facing behavior changes and no banked-claim falsification exists for this change. Re-entrant same-component writes fall back to fresh mints; dev-mode mutation tracing forces fresh mints throughout. Contract: src/engine/ecs/contract.md (Subscriptions), pins: src/engine/ecs/__tests__/soa-dispatch-flyweight.test.ts. No pre-existing test pinned the old fresh-object identity for these components, so no pins were flipped — the new pins are additions.

• Spawn live through the deferred-compile window (#12096). On the container tier a spec apply defers the whole-graph behavior compile off the tick path (perf-apex L18): the old graph keeps serving while the new one builds in slices. A row spawning during that window had its compiled entry only in the graph still building, so it appeared fully rendered but inert — no onSpawn, no update — until the swap: seconds on script-heavy worlds. Fix at the spawn path, with the pattern spawnStampedPlayerBodyRows already uses: when the serving graph has no entry for a spawning row's behavior refs, compile just those refs (behavior-cache-assisted, typically 1–2 refs) into the serving graph before spawnObject, so the row boots live like every other spawn.

• 2D sprite silhouettes stop ringing in the sky color (zoo relay walkthrough 2026-08-05, #12199). #11597 routed the depth-writing sprite cutout class (the 2D alpha default) through the plain cutout slot; sprites register BEFORE tilemaps, so every silhouette edge texel (alpha in [cutoff, 1)) blended against the SKY still in the framebuffer, and its depth write locked the stale blend in as a ring the tilemap ground could never repaint — orange on Farm Dusk, blue on Village Green, on ALL sprites. Cure: MainPassDraws.cutoutBlend — blending cutouts get their own fold slot drawn after EVERY contributor's plain cutout, still inside the depth/velocity-owning opaque half (#11597's routing intent — AO, viewport sharing, velocity all unchanged); far-to-near within the lane keeps sprite-over-sprite edges correct. Receipt: new sprite-2d-cutout-edges pixel fixture (magenta-sky leak detector: 1148 leak pixels on the broken routing, 0 with the fix; authored draw/outline sprites still ring their authored cyan). Savi-latency cluster (squeeze-hunt round 2 — the apply path's second act after the changed-set-first visit filter): a non-short-circuited applySpec re-derived spline/room lowering for the WHOLE world on BOTH diff sides, re-ran ~6 whole-spec derive/library sync walks ungated, rebuilt every per-apply container, and every attributed ObjectAPI/fold spec write copied the ENTIRE object-diff-signature map to evict a handful of keys.

• Per-row lowering memo (src/tome/lowering-memo.ts): generative-spline (road/powerline/stairs/coaster/preset/fence/hedge/pipe) and room rows reuse their lowering products by reference when the source row (by identity), place mode, installed terrain definition token, and the composed terrain:height chunk-version fold over the entry's padded bounds are all unchanged. The field token is the SAME fold the spline redrape watcher re-lofts on (shared helper), so "the ground moved" can never mean two things. Scripted-kind splines, generator-script-bearing rows, scatter rows, and lookAt rotations are excluded and re-lower fresh every apply, exactly as before. Eviction edges: identity replacement (ObjectAPI/COW-fold writers), the spline drag preview's sanctioned in-place row write (explicit evict beside the diff-signature one), terrain def/field tokens, per-apply pruning to the final new-side expansion, whole-memo drop on a failed apply.

• Old-side expansion reuse (TomeAppliedGeneration.expansion): under the delta-0 gate's own completed-apply binding (specRef === live doc) plus expansion-time keys (residency, place-instance content, player-body derivation inputs — a new computePlayerBodyDerivationKey covering active players and session-parent liveness — and the unfiltered-record identity), the next apply's old diff side reuses the previous apply's FINAL new-side expansion whole, containers included (flat list, byId, placeById, id set). Omitted whenever a survived-destroy retry row diverged the recorded doc from what was expanded. Old-side lowering failures stop double-reporting (the recording apply's new side already reported them once).

• Caller-mutation guard: everything recorded past an apply (memo source rows, expansion defs) is re-bound to the ENGINE-owned clonedSpec row twins — "row identity ⇒ content unchanged" holds for immutable-by-replacement engine docs, not for a caller's own doc mutated in place and re-applied (the pinned in-place scatter-count editor pattern stays a full visit).

• Diff-signature eviction side index (object-diff-signature-invalidation.ts + TomeObjectDiffSignatureIndexResource): a root-id → key bucket index built once per apply beside the signatures map makes attributed spec-write eviction O(touched roots) with in-place deletes, replacing the per-write whole-map copy + full key scan. Unbound index (any non-apply map identity) falls back to the historical O(N) scan-into-fresh-map path.

• Derive-pass skip gate (TomeDeriveSyncInputsResource): the six library syncs (materials, field-feed demand, authored clips, looks, textures, warm hints), the spec-shape warn rail, and the asset-manifest merge are skipped when every raw subtree they read (scripts/places/assets/camera/player identities) plus the row-derivation keys match the last completed apply — with per-pass derived-component presence checks so projection resets (which recreate the tome/spec entity bare) always re-derive. Runtime ensure-hooks, the renderer join-watchdog force lane, and TomeSpec reset hooks call the sync functions directly and never see the gate.

• Container floor: buildObjectDiffSignatures returns the previous map by identity on a 100% hit (consumers pair every signature lookup with an oldObjectById lookup, so a superset map is safe); the reused old side ships its containers from the generation record.

Bench (spec-fold-cost.test.ts, new apply-path case: 1,060 source objects — 20 roads + 10 powerlines + 10 fences + 20 rooms + 1,000 flat — through the fold lane): delta-1 apply median 51.5ms → 12.4ms (expand-old 15.3→0.4ms, expand-new 14.8→0.4ms, signatures-new 15.2→2.6ms); 200-write burst 439µs → 112µs per write. Anchor (ecs/soa read-ts-plain) 13,107ns.

Named residues, deliberately not built here: the compiler's second child re-expansion per apply (compileSpec runs before expansion — reordering is its own change); pooling of genuinely apply-local scratch (small, and reentrancy-sensitive); the rebind-candidate query walk. Resident-memory note: the generation record now retains one expansion's containers and the memo retains lowering products between applies — bounded by the currently-expanded world, released on prune/replacement.

• CPU particle + audio lane squeeze (perf, behavior-preserving — squeeze-hunt round 2). CPU-owned particle effects (ribbons, trails, multi-sink, no-WebGPU fallback) drop their dominant GC feeds: the fx closure compiler evaluates every field expression into per-node scratch tuples instead of minting a fresh array per vec3 node per particle per frame (bit-exact f64 math and identical rng draw order, pinned by a master-generated golden digest); the reap pass mark-then-compacts instead of splice-per-death (O(alive) per frame instead of O(alive × deaths), death-record and draw order unchanged); snapshot group writes resolve their draw group through per-sink pointer caches instead of building a texture:blend:mask:align:soft key string per particle; and ribbon trail rings mutate their evicted slot in place and recycle whole rings through a capped per-size pool. Bench (5k churny particles, one frame = simulate+snapshot): churn 1.22ms → 0.69ms, 5k-sprite pack 0.59ms → 0.26ms, 2k-ribbon 2.07ms → 1.55ms per frame. Audio lane: the vibe transport tick no longer builds every pattern tree twice on the authority (primeBpm survives only on first-tick/pause/resume edges; the steady-state BPM check reads the tick's own evaluation — one pinned consequence: a mid-flight setBpm change now re-anchors on the same tick but its new tempo reaches the trigger-window math one tick (~33ms) later; the audible renderer schedules on its own lookahead either way), and skips the per-tick full-source hash behind a string-identity gate (3-vibe transport tick: 16.1µs → 9.0µs). The audio deriver stops rebuilding and comparing every emitter value every render frame — AudioIntent add/set/remove hooks and TomeSpec edges feed a dirty set (vibes waiting on script replication retry on spec arrival, not per frame). Audio prep collects reverb zones once per frame instead of re-walking every zone per emitter (O(emitters+zones), same verdicts), and its per-frame policy/set scratch is pooled.

• GLB texture payloads stop pinning whole files (jetsam cluster, round 2). parseGlb minted texture bytes as views over the GLB input buffer, so any retained parse pinned 100% of the file — geometry, JSON, and texture payload — for the retainer's lifetime. Three cuts along one seam: (1) GLB-embedded image bytes are now OWNED exact-size copies, so the fetch buffer collects after parse (renderer-side retained drops from whole-file to texture-payload-only; the budget estimator's texture term becomes honest by construction); (2) the sim asset service parses with retainTextureBytes: false — the sim worker never decodes or uploads textures (reader census: zero sim-side consumers), so the texture share (often 50–80% of a textured GLB) never becomes resident in the worker-lifetime modelsById cache at all; (3) the renderer models registry releases parsed.textures[].bytes once every decode for the asset settles — the GPU copy is the source of truth, device loss is a terminal reload wall (recovery re-fetches + re-parses), and assets are created once per modelId per scene, so no in-session reader remains. Receipt (8MB-texture synthetic GLB, reachable-backing-buffer arithmetic): old = whole file pinned per retained parse; owned-copy = texture payload only, input unpinned; sim flag = ~0; post-settle release = ~0.

• Render-channel writer scratch sheds its burst high-water. The spill-encode scratch doubles toward MAX_ARENA_BYTES (512MiB) during boot/backlog bursts and was never re-minted smaller — the high-water stayed resident for the session (the transport-residency stack named in ecs-sync's collapse-gate comment; PR #12099 iPhone-16 jetsam kills). It now re-mints at its 256KB rest size after ~30s of active sim ticks with zero spill demand and an empty pending backlog (frames never alias scratch — pushScratchFrame copies). Re-materialization is the existing cold-path shape: the next spill's ensureScratch(16MiB). New getScratchCapacityBytes() observability getter.

• Preload-hint derivation survives metadata-only spec landings. collectSpecPreloadHints memoized on whole-spec identity, so every asset-metadata landing (bounds batches, the per-analyzed-model triangle stamp, socket/parts rails — dozens per boot, plus every landing mid-session) paid ~5–7 regex passes over the entire script corpus plus place/object walks to re-derive an identical answer. The four metadata writers now land through one shared helper that forwards the memo when every derivation input identity is preserved (input set positively bounded: collectSpecAssetEntries reads places/terrain/atmosphere/objects/player/scripts and never spec.assets; sprite-warm-variants reads scripts/places/objects/player) — a hit returns the IDENTICAL array, so the fast path's previousRefs delta stays a no-op.

• Sidecar host-derive rails stop walking the world. Both rails' ~1s scans iterated every TomeParent-bearing entity (the whole parented population) on every metadata-authority client — including all singleplayer sessions — even with zero socket/part attachments. A hook-fed per-world attachment index (TomeParent add/set + one-time seed; the BoundsPrefetchFeature needs-set shape) makes the scan O(attached-children), i.e. zero for the overwhelming majority of games; stale ids prune on visit. Riders: the per-tick completed.splice(0) empty-array mint is gated on length; the authority resolution (place-hosts read + session query walk) is skipped entirely on ticks with nothing to scan or dispatch; tombstoned entries now cost two boolean checks per tick instead of nested spec probes (resolved-entry cleanup — including a tombstone's cap seat — rides the scan-cadence sweep, with a dispatch-due re-check so a resolved pair is never fetched).

• Perf: squeeze round-2 jetsam cluster (half A) — budgets and eviction for decoded media, behavior-preserving (sol-table .tmp/squeeze-hunt-2026-08-04/round2-rows.json). Decoded audio PCM gets the aggregate budget MAX_BUFFERED_CLIP_BYTES never was: the resource service keeps a raw-decoded-bytes ledger in LRU-touch order and, when a decode crosses the per-device budget (AUDIO_DECODED_PCM_BUDGET_BYTES in perf-static-data.ts — 128/64/48 MiB by the texture/model keep-alive facts, the table's third instance), releases oldest-touched buffers first, pinning the WebAudio renderer's live voices + pending starts (and the just-decoded clip, so one over-budget clip can never decode-loop). Only handle.buffer drops — handles, stream elements, duration memory, and failure/park budgets survive, so an evicted clip re-decodes on demand through the exact paths that loaded it; the re-decode latency on a cold retrigger is the traded term. getStats().decodedPcmBytes is the gauge. The video warm cache's flat 64 MiB budget becomes device-tiered through BOTH construction sites (the shared main-thread cache and the tome-UI frame warm lane): VIDEO_WARM_BUDGET_BYTES 64/32/16 MiB — a mobile miss is the module's own documented designed degradation (plain JIT streaming). Renderer-side: runModelEviction gains an exact O(1) early-out (running totalCachedModelBytes maintained at the cache's set/delete/clear seams; unreferenced ⊆ cached, so under-budget frames skip the per-frame walk + sort + array mint — getModelEvictionStats().cachedModelBytes pins drift). fx particle rasters stop being a session cache: they release by poll recency (every consumer — pack compositor, content-scale measurement — polls per frame until it settles, so 5s of silence IS the settled signal; "unavailable" tombstones stay as the refetch-storm guard), and a composited pack drops its captured per-layer CPU rasters instead of pinning them for the pack's lifetime. PipelineCache gains pipeline-key retention: material instances retain the variant keys they mint and release them on destroy, so an edited-away scripted material's driver-compiled PSOs leave the cache with the record (scripted-lane idle-LRU eviction, tilemap/decoration scripted retire, booth cleanup — all one seam) instead of living to device loss; drops bump generation so draw-memo pipeline-handle memos re-request (a map hit for survivors), a booth previewing a live material holds its own retain, and un-retained keys (fixed shaders, post chain, lanes) keep session lifetime exactly.

• Named residuals: the audio ledger counts raw PCM only — a looping clip's conditioned copy rides the raw buffer's lifetime and roughly doubles its true cost (the budget is deliberately conservative against it). A raster whose pack died mid-fetch stays resident for one grace window before the sweep drops it.

• Perf: speed-of-light squeeze wave 3, tick spine + timers (sol-table .tmp/squeeze-hunt-2026-08-04/2026-08-04-v2-whole-sim.md). The client runtime finishes the server's sharedCtx shape: per-system SystemContext objects, state closures, and push/pop run closures are cached at rebuildPhaseLists (tick/dt/jobs re-stamped per run), ctx.rng becomes a per-run lazy getter deriving the identical (epoch, tick, phase, name) fnv seed on first read, per-phase reduction stagers are prebuilt like the server's stagerByPhase (killing the per-phase flatMap and its reductions ?? [] empty-array mints), and Diagnostics.runWrapped writes a pooled verdict object — the ~6-7-alloc-per-system-run mint chain drops to ~0 and the 120-no-op-system spine bench (runtime/client-spine, new) goes 146.8µs → ~11µs/tick as measured during the hunt (loaded box); the #12166 adversarial re-derivation measured the identical paired bench at merge-base vs head on a quiet box as 79.2µs → 21.4µs (~3.7x) — the win is real, the headline ratio is measurement-conditioned. LastReductionStager memoizes its Proxy + boundFnCache (stable world identity for reduction-declaring systems across ticks — pinned by reduction.test.ts) and takes a prebuilt Set for the reducible-membership probe. Timer dispatch drains a (dueTick, id) binary-heap index (tome/timer-heap.ts; armTomeTimer is the one arm gate) instead of scanning every armed timer per tick — cancels/reaps stay map-only deletes dropped lazily at pop, holds/spills re-queue under their original key, fire order stays byte-identical ((dueTick, id) pins added to timer-dispatch-budget.test.ts), and the 5k-armed idle-tick scan collapses 6.1µs (reconstructed-old) → ~70ns (~90x; new bench case) — the #12166 re-derivation measured the real old scan at 88.8µs on the merge-base tree, so the paired ratio is ~897x, an order better than the reconstruction suggested. Small kills ride along: the server's per-tick sharedCtx/noop-jobs/placeholder-rng mints hoist to module/runtime scope, sim attribution keys per-kind maps by raw name (no per-sample NUL-template string), the client sim-step timing window becomes parallel Float64 rings (no per-tick sample objects, no Array.shift), and the worker's controlled-entity change probe compares retained expanded lists via scratch arrays instead of minting fingerprint strings per frame.

• Named residuals: a dead owner's timer now reaps at its dueTick (dispatch's hasEntity gate) instead of eagerly per tick — closure retention until due is bounded, and the spill breadcrumb's armedTotal counts such timers until then (log payload only). Reduction proxies are stable across ticks by design — the identity-per-tick pin in reduction.test.ts flipped to a stability pin. Static-body rotation ordering (ledger 2028, savi filing 61538a0c / Streetwork): under replication an entity's components arrive as individual rows, and chunked bursts + flood-budget re-delivery put tick boundaries anywhere in the row set — so a static body can materialize from its physics/body-config row before its transform/world-rotation row arrives, born wearing identity. The dig's churn repro (adopted here) shows current master converges those orderings, but only through a stack of four mutually-covering accidents (the write-back's cache-unchanged guard, the #550 transform-replace compare, the state re-align before dispose, dispose clearing caches). This change replaces the accident stack with an invariant: a static body's rotation is a pure function of its replicated WorldRotation — physics never authors it, and every (re)materialization derives from it.

• initializeBodyState: statics read WorldRotation (the author row) before PhysicsBodyState.rotation (the physics echo) — the previous precedence rebuilt statics at whatever stale orientation the last write-back caught unless the caller remembered to re-align state first. Dynamic/kinematic precedence unchanged (physics owns their rotation; state stays first). Engine-managed statics with no WorldRotation (terrain chunks, tilemap colliders) keep their state-seeded behavior.

• applyStateToComponents: statics no longer write WorldRotation back to ECS. The write-back used to mint WorldRotation=identity onto a mid-adoption static, occupying the author's replicated slot with an echo — upload fabric for ownership write-fights on client-auth hosts, and one component-sourced cache seed away from permanently blinding the transform-replace compare. The rotation cache still records the realized body pose (it is exactly the "realized" side staticTransformReplaceNeeded compares the author row against).

• getOrCreateHandle (signature-change swap): a static whose colliders are about to be re-created first gets its body pose re-written from the author components (WorldRotation, feet-first translation), so the fresh colliders index at the true pose — the swap used to inherit whatever pose the body was born with, so a signature row (scale, config re-delivery) co-arriving with a late rotation re-indexed fresh colliders at the wrong orientation and re-marked the signature fresh, permanently. The swap itself deliberately stays in place (no dispose+recreate: a removed-and-reborn body is not query-visible until the next step — a one-tick hole for raycasts and CC grow probes — and terrain edits pin handle identity); character capsule-grow holds and the mesh-not-ready hold are untouched.

• Static birth pose is author-derived end to end: the body desc and initializeBodyState both resolve a static's translation feet-first (WorldFeetPosition is the authored surface; BodyPosition is the realization echo, stale across a component-written move) — previously a static rebuilt after a component feet-move could be born at the stale center whenever the slept-pose coherence check didn't fire, and its colliders spent the rest of the tick indexed at the birth pose.

• seedPhysicsCachesFromECS: never seeds a static's rotation cache from ECS components (that is the one writer that could make cache == component while the body wears something else, silencing the compare forever). Currently test-only; guarded so it stays safe if resurrected.

• Suite: dig2028-rotated-static-box.test.ts — the dig's two straight-path probes (drive across the world AABB unblocked / into the oriented face blocked), the staged churn repro (config-first adoption → reap → re-adopt, rapier cuboid halfExtents + body rotation inspected at every stage), and the signature-co-arrival poisoning case. The no-phantom-mint assertions are red on master before this change.

Named residues, deliberately not built here: (a) the synthetic feet-delta contact.normal savi burned probe cycles on — already eliminated by the fabricated-contact fix (ledger 2022, #12153, landed); (b) the owned-entities write-fight (~38k fenced rows in the filing room — netcode/command-dispatch vs the hosting client over tome/owned-entities) — the environment that tears adoptions mid-entity and can fence the rotation row out entirely; rows 2016/2017 ownership family. When the rotation row never lands in ECS, no physics-layer fix can dress the body correctly — this change guarantees the body converges to whatever the author row says the moment it exists, and that physics never fights the author for the slot.

• Live terrain-kind flips compile — geometry inheritance is same-kind only (incident 6ac4bd05, #12209). A live tilemap→heightmap flip could NEVER land: the heightmap config build inherited existing.definition.verticalRange from whatever definition was installed, the tilemap def pins [0, 0], and validateTerrainConfig throws 'verticalRange min must be less than max' — on every apply, forever, until a room recycle cleared existing. The spec said heightmap while the world kept the stale tilemap ground; clients painted the old terrain over the hole (a wisp flip-looped on it for minutes on Fire Nuke Island — 9 server + 105 client definition_failed rows; a second app hit the same wall the same night). The voxel branch had the silent twin: same cross-kind inheritance, no validator throw — a [0, 0] voxel world with no vertical space installed quietly. The rule, already applied at the heightmap lodRanges site, now covers every geometry field in both branches: verticalRange/origin/lodRanges inherit only from a definition of the SAME kind; signature/revision bookkeeping still reads any installed def. A kind change compiles exactly like a cold boot ([-32, 256] default); same-kind inheritance is unchanged (pinned). Loudness (the incident's third ask): a definition that fails to install now names the place and the consequence in the creator-facing runtime log — 'Terrain for place "main" failed to install (…). The place keeps its previously installed ground — or none — until the terrain config is fixed.' — and tome.terrain.definition_failed carries placeId. Red-first pin: terrain-kind-flip-live.test.ts (flip installs + objects survive, voxel non-degenerate, same-kind inheritance preserved, failure names the place).
• Wire-codec squeeze (round-2 hunt): the client netcode meter and the room wire codec stop doing hidden per-message work. The debug transport used to serialize every outbound JSON message THREE times (once for the wire, once for the byte count, once again per bucket for the breakdown) and mint a payload-sized byte array per measure — byte accounting now rides the wire's own serialization (kernel lane: zero extra passes; relay/hold lanes: one counting measure), and breakdown detail (out-lane section splits, in-lane per-packet decode breakdowns and their 15s retained object graphs) is built only while the F8 multiplayer panel is showing it. DD bandwidth totals are byte-identical, armed or not. Codec inner loops shed their per-write mints: PacketWriter.writeUtf8 writes ASCII (entity ids, keys, component names — ~all wire strings) straight into the packet buffer instead of encoding a fresh Uint8Array per string, and the generic object/object-map writers enumerate keys once instead of minting entries+pair+filtered arrays per node — wire bytes byte-identical, pinned by round-trip and reference-encode tests. The server room dictionary's entity-alias map — the room's only unbounded per-entity residency (grew forever under spawn/despawn churn) — now evicts despawned rows once the replication change-log prune proves no future drain can reference them (two-phase mark + prune watermark; revival cancels; aliases stay monotonic).

technical notes

• PlaceDef.listenerEntity — the spatial-audio ear is now a spec property. The Web Audio listener pose derives from the named entity's live transform (position + rotation) instead of the camera; absent = today's defaults exactly (camera; 2D modes: the controlled character on the play plane). Set/clear live through updatePlace(placeId, { listenerEntity: "ring" | null }) — no new verbs. A dangling id falls back to the default ear rather than going silent; 2D places keep their fixed mode-derived stereo bases (sprite facing flips still can't invert left/right), with the bound entity supplying position; instance places resolve template-authored ids through the same <placeId>:<bareId> rename their objects get. Resolution lives in audio/listener-follow (client), pinned by listener-follow.test.ts.
• GLB parser accepts the EXT_texture_webp DECLARATION — and deliberately never resolves its source (#11992, ledger 1969; resolution half trimmed same-day per jure's ruling, thread 1785781497: "we don't want non-ktx2 textures going into the engine, ever"). The extension joins SUPPORTED_EXTENSIONS, so the required extension "EXT_texture_webp" is not supported — content may be missing or wrong warning class dies: ~40 per dump on moodboard GLBs whose declaration is stale cook-era metadata while every texture actually rides KTX2 (two savi-filed engine-bug incidents were this false alarm). parseTextures does NOT read extensions.EXT_texture_webp.source: a webp-ONLY texture (extension reference with no top-level source) stays unresolved — the model renders untextured, and the honest texture[N]: no image source warning stands — until the asset is recooked to KTX2 (the ledger-1198 recook lane, recook-webp-avatars.ts). Textures riding KHR_texture_basisu or a top-level source resolve exactly as before.
• Identify UI-plane mode — the scene-identify verb's named sibling (r-3934ca4b). identify_object gains ui: true: the same read-only query-primitive bar aimed at the AUTHORED UI plane (the creator's HUD in its sandboxed realm iframe — the plane host-page reads and 3D lanes structurally cannot see; ravi's badgerblunts receipts cec6b199 §3 class B′). Alone it enumerates the rendered census — elements that are addressable (id), take input (the pointer-events law's INTERACTIVE_SELECTORS, the exact grant vocabulary), are world-anchored, or are top-level overlay roots — and with screen: [x, y] (0..1 viewport fractions, the identify family's convention) it answers "what UI is at this point", latest-in-document (painted-on-top) first, style-hidden click-catchers included and marked. Each match: id + kind (tag) + screen-space rect (CSS px + the frame viewport) + visibility + interactive + a short label. Resolution rides the realm's own rails end to end — two new read-family query verbs (elements | hit, strictly decoded like the rest of the closed vocabulary) executed by the frame's own read executor against the tree it renders; never a DOM-scrape parallel, and platform chrome (Spawn's rail) lives outside the realm, invisible here by design. An empty plane is an HONEST EMPTY: ok with matchCount 0 plus a note derived from the HUD-pipeline receipts naming whether nothing was ever rendered or the render just emptied. Zero new spec words, zero ObjectAPI surface — an inspection verb, not an authoring one.
• Platform-side (kiln magic-cdn — rides platform deploys, not this kernel build): the write-once refusal metric learns its outcome (#11991, ledger 1967). spawn.v3.magic_cdn.write.overwrite_refused fired once at the top of refuseOverwrite with {component, layer} only, so a benign crash-resume spike and a cook-killing identity-error spike were indistinguishable without a log dig. The single emission now lands at the three consumption terminals tagged outcome: declared_handled (caller declared handlesRefusedOverwrite), resumed_identical (existing bytes verified byte-identical — crash-resume, benign), identity_error (existing bytes are not this run's bytes — the cook fails loudly, the alert-worthy slice). Exactly one emission per refusal, so totals across outcomes match the pre-tag count and existing monitor sums are unchanged.
• isGrounded() and getVelocity()/getObjectVelocity() truthful for NPC agents (#11994, ledger 1970). Both verbs read only physics-body state (PhysicsCharacterControllerState / rigid bodies) that agent-moved NPCs never have, so isGrounded() returned a plausible false forever on every npc: {} entity (air-state machines tripped into fall on tick 1 and looped the fall clip against the walk cycle — enfeul's Spartans) and getVelocity() read silent zeros. The agent mover's own NpcMotion (grounded + achieved velocity, engine-computed by npc-move-resolve every tick) now answers: character-controller state first (players byte-identical), then the agent lane — and the agent lane answers ONLY where the mover is the system of record (npc cfg/intent present, not controller-owned, not force-driven dynamic; a stale motion row can never shadow live physics). Velocity reads ride the same 0.05 read grid as every other velocity read. Stale jsdoc corrected at the source (types.ts → api-reference/TomeAPI regen) plus one npc.md line.
• Sim worker sheds the renderer (#11990). One value re-export of createLumeAdapter in engine/renderer/index.ts dragged 253 lume modules (frustum-cull, primitive lanes, lighting, sky, decals, shade graph…) into the sim worker and main thread — realms that render nothing. The re-export is deleted (the type-only export stays, erased at build): sim runtime-worker −0.373 MiB, main index −0.035 MiB, renderer unchanged — −0.408 MiB total off the minified kernel bundles.
• Terrain stochastic anti-tiling becomes a per-material enum, default off (jacob's ruling, thread 1785760739). New spec knob antiTiling?: "none" | "stochastic" on terrain materials (default "none"). The enum rides the shading chain (interpreter → buildMaterialPack colorBy → render config → lume atlas params PARAM_ROW_PBR2 .y as TERRAIN_ANTI_TILING_MODE) and gates the jitter strength per LAYER in the heightmap surface shader — mode 0 collapses to the pinned bit-exact plain sample, so default terrain tiles seamlessly; "stochastic" is the unchanged #9338 per-meter jitter mechanism. The string enum is deliberately the general form: hex tiling (jure's branch) lands as a third accepted value and mode index, never a new spec field or params row. Shading-only field: toggling it takes the materials fast path (no chunk rebuild). Device gate (verify-terrain-jitter) grew default-clean and per-layer-independence scenarios plus before/after captures of the repro class.
• Server terrain full-place sweeps: stale-cancel + save-burst coalescing (#11995, ledger 1965 cut 1). Every terrain-content save re-fired a FULL server rebuild sweep (256 chunk builds — 30–100s on the 2vCPU prod container), and during wisp world-build bursts the sweeps STACKED: each save saturated the pending budget with builds of dead content while the previous sweep drained (the measured tick collapse, 14 ticks/71.8s). Two scheduling moves at the seams, content and determinism untouched: the interpreter's terrain-content trigger now carries supersedeInFlight — every pending build for the place cancels before its body runs and the place-wide marks resubmit under current inputs the same tick (no warn, no backoff) — and a re-sweep landing within 10 ticks (~333ms) of the last sweep start holds until the burst settles (trailing edge, 90-tick max hold; held sweeps park as persisted dirty marks). First save of a burst fires immediately, so single interactive saves keep today's latency exactly. Player-support chunks and voxel authority-window reentry are exempt from the hold. Stacked-sweep bench (real spec, 5 consecutive terrain applies): 640 → 355 builds executed, 79.4s → 39.6s build CPU.
• Saturation-weighted texture tint on the primitive lane (#11989, ledger 1707). TINT_WGSL's colorize was binary: a primitive material carrying both texture and color ran luma-colorize at full strength, so a near-white color was a black-and-white conversion of the art (nickd's 8 gallery paintings, ma1neac's Sugar Rush — two creator specimens in 11 days). The law is now the FX sprite lane's mix(base * tint, colorize(base, tint), saturation(tint)): neutral/near-white tints degrade to an exact multiply (model-lane parity — near-white ≈ no-op; the accidental-grayscale class stops existing), fully saturated tints land byte-identical on the old luminance-preserving colorize (the June disco-ball/pizza panels keep their look). One shared prim_applyTextureTint serves the arrays and oversized lanes; tintStrength stays the store's binary tint-present flag; terrain WGSL tint laws untouched. VISUAL: worlds relying on ACCIDENTAL grayscale change look (they regain the texture's own colors), and textured primitives tinted with LOW-CHROMA MID-LIGHTNESS colors render 40–60% darker — the old law preserved texture luminance for every tint, the new one multiplies the tint's own darkness in at low saturation (enfeul's facility walls/floors/ceilings, oklch(0.5–0.72 0.02–0.03 240–250) → ×0.42–0.54; dig 9f25485c) — flagged for the zoo walk; version-pinned worlds unaffected.
• Platform-lip gate gains a weight-bearing exception — the corner-landing jump lock dies (dig cf6b52b8, #12001). Landing on a convex plan-view corner, the bottom-sphere contact normal tilts only asin(d/r) from vertical (d = axis→corner distance) — well inside the slope limit, so the contact solver holds the capsule as walkable ground — but the lip gate's support probes are axis-aligned (center + ±x/±z offsets, straddle pairs requiring BOTH sides) and a corner's support lives in one diagonal quadrant: every ray missed, no opposing pair existed, and the gate demoted a stance bearing full weight. "Airborne but load-bearing" is a contradiction no motor survives: isGrounded() false forever (coyote never re-arms — jump permanently dead standing there) while fall velocity integrates to terminal (stepping off fell INSTANTLY at maxFall). The gate now verifies the OUTPUT, like the lift gate one screen up: when the motor pressed down (desiredVertical < -EPSILON) and the committed movement blocked the fall (|committed y| ≤ EPSILON), the stance bears weight and stays grounded — can bear weight ⇒ can jump. Everything the gate exists for still demotes: a walk-off lip pivots the capsule down around the edge (committed y < 0 every moving tick), and a mid-fall rim catch carries fall-quantum or snap displacement (committed y ≠ 0). Snap cannot forge the hold — it only ever ADDS downward displacement (the dig's discriminator: snapToGroundDistance=null holds the identical pose at the identical height, so the hold is the solver's, not snap's). Weight-bearing/straddle stances keep groundEntity null (no single axis-support identity; the gate's probe result is not re-probed). Pinned by corner-landing-jump-lock.integration.test.ts; snap-lip-jitter.integration.test.ts re-pinned alongside.
• Script re-save reload suppresses onDestroy on owned spawns + one reload log line (ledger 1973, #12000). The rebind sweep's teardown (teardownAndRerunOnSpawn) now destroys previously-owned children with skipOnDestroyHooks: true — a re-save reload is a planned event, not gameplay: onSpawn-authored children re-mint under IDENTICAL ids in the same synchronous turn, so an onDestroy fired there narrated deaths that never happened (phantom casualties, ghost wrecks — the planned-events law: a planned reload must never present as an in-fiction death). Same option class as its original consumer, the cross-writer destroy preview: a destroy whose fiction does not belong to this executor. Suppression makes the reset silent, so the sweep writes ONE "log"-level line per save (logScriptSaveReloadDespawns — never "warn": planned events never present as anomalies): which scripts saved, which owners reloaded, how many spawned entities despawned, whether onSpawn re-ran, plus the teach tail — spawns made in onSpawn re-create with stable ids; spawns made outside onSpawn (events, timers, update) do not re-create until code re-spawns them. The line is the witness that gives the god-mode dangling-id warnings a cause standing next to them in the ring. Pinned by script-resave-entity-lifecycle.test.ts.

technical notes

• AudioParam writes now go through a dedupe + suspend gate at the renderer seam (Safari P0, #w-rendering 2026-08-01). Every AudioParam write — including plain .value = — inserts a WebKit timeline event (AudioParamTimeline::insertEvent, one heap allocation each); prep re-sends full state every frame (≥16 inserts/frame with zero voices, ~6 more per voice), and while the destination is autoplay-suspended nothing consumes the timeline — measured ~12 MB/s WebContent growth until the machine swaps to death. Now a write whose target equals the last value actually written is skipped (per-param last-written cache; epsilon for ramp targets), and while ctx.state !== "running" no per-frame param write lands at all — desired state parks and the statechange back to running flushes one converging refresh. Ramps still schedule normally while running (no zipper-crackle regression); bounded one-shot writes (node creation, cull fades, duck ramps, vibe edits) stay ungated. Pinned by renderer-param-timeline.test.ts (red on the old renderer, 9/9 green now).
• The erase brush clears EVERY painted material at once (jacob's punch list, #inventors 1785628548). Erase on a material brush was a sign flip on the armed field only — erasing "dirt" left sand and grass paint standing, so returning ground to its natural look took one erase pass per palette material. An erase dab (Alt, the Mode chip, or negative-strength armBrush) now runs the paint script over every authored terrain:material:* field in the place — enumerated from the fields that actually hold paint, so orphaned fields whose material left the palette clear too. Material fields ONLY: marks, terrain:height, decor:*, and the generator's natural weights are untouched — erase returns the texel to its natural generated look. The expansion is per-dab and never persisted (brush.fields stays the armed field); commit/undo bookkeeping now iterates the stroke's touched-field ledger, so one undo restores every field the erase cleared.
• Replace mode: paint that wins. New third Mode on material brushes (chip: Paint / Replace / Erase; session flag replace; armBrush({ replace: true })). A replace dab paints the armed field exactly like additive paint (max(current, amount), amount = falloff × strength) and additionally scales every sibling painted material field by (1 − min(1, amount)) — engine math in the session, so the paint-script contract stays one-field and overridden material scripts inherit the mode. All siblings scale by the same factor (their relative mix is preserved as they fade); at strength 1 a single core dab zeroes them. Natural generator weights still compose underneath (chunk-build's additive law is unchanged), so strength remains the lever against natural coverage: replace-at-2 visibly dominates. Default stays additive — jacob ruled additive correct; replace is the opt-in.
• Cursor label gains "Replacing"; the Mode chip label gains the same. Non-material brushes keep the two-option chip (no sibling family to lower).
• Pinned in brush-material-erase-replace.test.ts: erase clears all painted material fields (armed-or-not) and leaves height/decor alone, emptied fields drop from the spec, one undo restores them all; replace scales siblings proportionally (1.0/0.5 → 0.5/0.25 at strength 0.5) and compounds across dabs; Alt-erase beats an armed replace; additive-without-the-option writes no sibling chunks at all; the chip index contract; the armBrush surface.
• Engine diagnostics adopt jacob's DM taxonomy (#inventors 1785635891): everything in logs; errors and storms ping. Every client-reported diagnostic still lands in getLogs() the moment it arrives (unchanged). Each of the 98 rail codes in engine-diagnostics.ts now carries a class: error (broken/wedged/terminal — script compile/runtime faults, renderer crashes, exhausted self-heals, physics corpses, engine parks of authored content) DMs Savi once per episode on first occurrence, with repeats counted to the log; warning (renders degraded-but-playable, placeholder shows, self-heals, teaching, environmental — texture/model load failures, missing clips, slot exhaustions, quota parks, schema skew) never DMs per instance. Either class escalates ONE storm DM when a single code accumulates ≥25 reports inside a 5-minute window ("N reports of this kind… something systemic; getLogs has every instance"). The old trailing "+N more" rollup flush — one hidden Savi model turn per active code per window — is deleted, along with its timer machinery and budget-carry branches; the perf-pointer lane (#235 hourly categories) and the room-global 5-DM/min budget are untouched. Class table pinned in engine-diagnostics.test.ts.
• The game document can no longer paint a scrollbar (tiger, #inventors 1785641498). The engine page's html/body had no overflow guard, so any in-flow element that outgrew 100svh by a few px — in tiger's session, a transient during an art cook, frame-coincident with the kiln "Spawning art" chip — painted a full-height document scrollbar over the game's right edge on always-visible-scrollbar setups, and window.scrollTo could slide the whole canvas (measured: 8px in-flow overflow → scrollHeight 892 in an 884px viewport, scrollTop movable). Root overflow: clip now propagates to the viewport as hidden (CSS Overflow §3.3): no document scrollbar, ever, regardless of what transient DOM appears. In-game scroll surfaces are untouched — realm UI already scrolls inside its own overflow: hidden chrome-host container, and the kiln page's own scrollers (chat, settings) live in the parent document. Pinned by game-document-overflow.test.ts.
• The input-binding validator stops billing Savi for entries the platform wrote (r-20a666a8, ravi's 08-01 playtest dig 3c3d2509). Every 3D game minted from the starters carries lookX/lookY/aimYawSin/aimYawCos/aimPitchN in inputs.axes — the starter template ships them — and the #11518 validator flagged all five as "engine-internal axis … Remove this entry" on the merged map, so EVERY patchInputs (including ones that never touched axes, including writes that later rolled back) drew 5 warning lines for entries Savi never wrote. During the 08-01 playtest the noise drowned the real schema errors in a 19-second terrain thrash. The condition was both provenance-blind and factually wrong for two of the five names.
• lookX/lookY leave the scold entirely — they were never "engine-internal" in the claimed sense. They are binding-fed axes with an engine DEFAULT (buildDefaultBindings injects the mouse binding only when undeclared — the hasOwnProperty guard exists precisely so declarations override, and gamepad-look treats explicit rightStick → lookX/lookY bindings as the look gesture). Declarations now validate like any axis: a remap is silent, a junk source names itself, and an EMPTY lookX: {} — the one genuinely hazardous shape, since it suppresses the default and binds nothing — gets an honest teach ("replaces the engine's default mouse-look binding with nothing … remove the entry to restore the default") instead of a false one.
• Engine-computed axes (aim*, cam*, pointer*, touchActive) warn only on the genuinely-wrong shape: a declared hardware source. input-resolution seeds each axis from the engine's setAxis write, then keyboard bindings override it and mouse/gamepad deltas add to it — so aimYawSin: { keys: "q/e" } really does fight the camera-derived value, and still warns (with the true mechanism named). A sourceless {} declaration compiles to nothing, blocks nothing, and is exactly what the platform's own templates planted — it is now silent everywhere (patchInputs rail and spec-sync console lane both ride collectInputBindingFaults).
• Multiplicity: one line per patch, never one per axis. All sourced engine-computed axes in a map collapse into a single fault line naming them together — the 5× per-write fanout shape is structurally gone.
• The planting stops (structural elimination). The five declarations are deleted from packages/game-starters/starter-3d.ts, cf-kernel's DEFAULT_GAME_SPEC, and kiln's DEFAULT_ADVENTURE_GAME_SPEC (behavior-identical: the engine injects the same mouse-look binding when undeclared, and the aim basis never read declarations at all). The teaching corpus stops teaching the shape: the camera skills' "Required Inputs" JSON and the @tomeapi-example camera SPEC-REQUIREMENTS lines now say these axes are engine-provided reads, declared only to remap look. The starter drift fixture is regenerated in this commit.
• Placeholder concept images keep their aspect (tiger's squashed shinobi, dump ad7dcd12). The mcdn placeholder ladder's image rung stretched the decoded preview across the full square hologram quad (packPlaceholders packs one scalar drawn size; UV spanned the whole quad), so a 1024×1536 portrait humanoid card rendered 1.5× too wide. packPlaceholders now packs a contain-fit rect (placeholderPreviewFit — the fitted rect as a per-axis fraction of the quad, computed from the decoded texture's own dims) into the instance's two free pad floats, and the preview shader letterboxes the image to that rect — centered horizontally, bottom edge at the entity's feet, fragments in the letterbox margins discarded exactly like the BiRefNet-cut alpha. Quad size, pick volumes, crossfade, and TAA velocity behavior are unchanged; procedural/failed instances keep byte-identical instance data.
• World touches in the authored realm survive the browser's pan-slop — the mobile touch stick stops vanishing on slight movements (incident 300a3b65, Savi-filed; enigmatic1's report, 08-01). When a game has live authored UI, the realm frame iframe is the viewport-wide hit target for every touch, and a fall-through press (target <body>/<html> — the pointer-events law) is the world's: the platform stick, look-drag, and world gestures. The frame document shipped with no touch-action posture, so the browser's touch gesture disambiguator was free to claim those presses for a pan at its ~10px slop — pointerdown → pointercancel, no pointerup — and Chrome cancels even when nothing in the chain can actually scroll (browser-gate receipt: non-scrollable host, non-scrollable frame, micro-drag still cancelled). The arbiter then correctly ends the analog claim, so the stick died ~10px into every drag — forever under its own 8.16px deadzone, which is exactly Savi's filed observable (touchActive:1 with moveX:0/moveZ:0 while the player holds the stick, "the stick widget vanishes when pressed or nudged slightly"). The shell now pins touch-action: none + overscroll-behavior: none on the frame's html/body: a world press can never start a browser pan, so its pointer stream stays the platform's from down to up. Same law, third layer — the canvas has carried it since day one (browser-host/dom.ts), kiln's game routes carry it (game.css), and the frame the UI actually lands touches on now does too.
• Pinned by tests/browser/suites/world-touch-stick.pw.ts (real shell + real frame bundle, CDP touch): the micro-drag world press delivers down → moves → up with zero pointercancel under a scrollable ancestor chain AND when the frame's own root scroller has extent (body touches pan neither); mobile-authored-ui-actions.pw.ts's scroll-stays-scroll matrix pins that authored scrollers still really scroll (CDP flick moves #shop-list). Arbiter-level law pinned in arbiter.test.ts: an analog claim has no slop-cancel — sub-slop micro-moves plus a hold past every gesture window keep the claim alive to the lift.
• Replace mode fully replaces — natural ground included (jacob's 50/50 crop, #inventors 1785628548). Replace previously zeroed painted siblings only; the generator's natural weights still composed underneath, so replace-at-1 over natural grass landed at 50/50 — "it's NOT winning it's merging". Natural coverage is derived (materialAt re-evaluates per texel), so there was nothing stored to write down; the suppression now persists in its own channel, terrain:natural-mask (0–1). A replace dab raises it to amount (max-composed, clamped to 1) alongside the sibling scale; chunk-build scales the generator's material result by (1 − mask) BEFORE marks and paints compose — a full-strength core is pure painted material. An erase dab writes the mask back down (subtract, like the material script's signed erase), so one erase gesture returns replaced ground to its natural look and the emptied mask drops from the spec. The mask rides the stroke's touched-field ledger: one undo restores paint, siblings, and suppression together. Marks stay outside the mask — they're authored decoration, the same boundary erase draws.
• The mask is an ordinary field: readField/writeField see it (documented in the ObjectAPI field docs), the scatter material matcher applies it (ground the renderer shows as pure painted material reads as that material for material-conditioned beds), and the terrain inputs hash carries it name-keyed beside the painted material fields.
• Texture transitions sharpened (the blendWidth follow-up #11801 deferred). The pbr weight resolve's crossfade window was floored at TERRAIN_HEIGHT_BLEND_DEPTH (0.18) — as wide as the ±0.18 texture-height bias that decides which layer wins each texel, so across a whole transition band the losing layer rendered THROUGH the winner: 2:1 and 50/50 paint ratios both read as a translucent ghost-merge. The window floor is now its own constant, TERRAIN_BLEND_SHARP_WIDTH = 0.06 — the height bias still carves which texels each material wins (grass blades between stones), but the loser fades out within a texel-scale band: dominant paint reads as dominant-with-speckle, partial rims dither instead of washing. Non-pbr paths (dither, tier ≥ 1 winner-take-all) are untouched. The verify-terrain-blend device gate is re-pinned to the sharpened character.
• Pinned in brush-material-erase-replace.test.ts (mask raised proportionally, erased back down, spec-dropped when emptied, restored by one undo, untouched by additive paint) and terrain-jobs.test.ts (a full-mask texel composes as painted material alone; the mask changes the inputs hash).
• Terrain textureScale adopts meters-per-tile (the object-material semantics). The heightmap material pack conversion (features/terrain/config/factory.ts) previously computed shader repeats-per-meter as 0.4 × textureScale — a repeat-frequency multiplier inverted from object materials' "meters each tile covers", ~1000× denser for the same small value; the knob-name collision burned a creator world authored at 0.05–0.08 (thread 1785625835). Now metersPerTile = textureScale (clamped ≥ 0.001), shader repeats/m = 1 / metersPerTile. No stored-value conversion (jacob's ruling, ts 1785626860). Defaults and tile-only materials pack byte-identical values to pre-flip; savi docs (api-reference §TerrainDef, heightmap-terrain skill) carry the flip note + conversion.
• Instanced places work in client-hosted rooms — rail.enterPlace relay authority (#11898); server is the place host on container tier (#11899)
• Render scripts read ctx.device ({class, coarse}, session-frozen); getClientHealth() rows carry deviceClass (#11923)
• Per-lane draw census in render health + primitive-lane drift sentinel + refusals name entities per family (#11921)
• Single-motion avatars play their only clip instead of T-posing; substitution named in diagnostics (#11922)
• KTX2/Basis transcode moved off the render worker; per-mip chunked uploads (#11878)
• Firefox: WebGPU canvas reconfigured after transferToImageBitmap — cures the Gecko session-death class (#11862)
• Tab press-wedge cures: forced tab-up on remount, stale-press cap, no-device voice ladder (#11880)
• The server hosts a place only when no client can (#11934, refines #11899). The permanent server host claimed the fallback seat for every loaded place even with players connected, so the container simulated every place at once (the zoo on staging: 21 physics runtimes on 2 vCPU, tick 30→13/s). Now the client election outranks the server's fallback seat — the server claims seats only in an empty room, releases them as clients arrive (epoch chain intact in both directions), and every server-side sim gate (physics dispatch, interpreter, default-place pause, place cleanup) is per-held-seat, so the server sim goes fully dormant while players are online. Cures the staging tick collapse observed in dumps 90873f77/19e6f4c0. Pinned in server-place-host.test.ts.

technical notes

• Builtin camera kinds deleted — scripts are the only camera authority. The five spec camera archetypes (third-person/first-person/top-down/isometric/side-scroller), their rig implementations, the kind-swap prune vocabulary, the numeric transition interpolator, and the kind-keyed engine plumbing (pointer-lock/hide defaults, archetype state seeding, per-kind ortho zoom derivation, the renderer's first/third-person regime) are gone. One camera shape remains: kind: "custom" + behavior scripts, with the existing primitives (hideLocalPlayer, orientation authored-axes contract + getViewAngles(), pointerLock, cameraApi.raycast + collisionDist, state.orthoSize ortho zoom) carrying everything the kinds used to. The god camera and the 2D no-camera fallback rigs survive engine-internal and spec-invisible. A spec arriving at this version with a removed kind runs as custom (scripts-only semantics) and raises a structured spec-shape warning naming the migration — loud, never silent; it is unreachable except through an upgrade-path bug, since pinned worlds keep the engine that carries their kinds. The 2d-side starter now ships the canonical side-scroller camera script (dead zone / look-ahead / peek / world-bounds clamping) instead of a kind block, and the camera skills teach script recipes for every perspective.
• Character capsule dims are authorable and runtime-writable — physics.capsule = { height?, radius? } (the crouch/prone primitive; the fixed 0.35/0.6 humanoid capsule becomes the default instead of the only option). Height is end-to-end (halfHeight = height/2 − radius, clamped at 0 — the same number traverseCheck reports as capsuleHeight); dims are entity-local and scale folds on top like every collider. Applied at the one spec seam (applyPhysicsSpec), echoed by readPhysicsSpec as realized collision truth (round-trip idempotent), and it rides the existing PhysicsBodyConfig wire codec (capsule halfHeight/radius were already on the wire), so remote followers realize the same hitbox. Non-character bodies get a one-time teaching warn (their capsule size belongs to the primitive/model + scale); the old normalizeColliderSpec warn that taught the uniform-scale workaround now names this property instead.
• Grow admission, both backends: shrinking is always legal; a grow that would embed the capsule in STATIC geometry is HELD — old collider live, per-tick re-probe, applies the tick there is room (the held-handle "never trade a collider for a hole" idiom pointed at a new hazard). The probe is the stuck-escape's own predicate (same shrink tolerance, fixed-only + sensor-free, self excluded — one shared constant, CHARACTER_PENETRATION_TEST_SHRINK), so an admitted grow can never trip the penetration escape: no teleport-through-the-ceiling, by construction. 3D runtimes; rapier gates in getOrCreateHandle, mantle in ensureMantleEntity via overlapShape.
• Mantle feet-anchor parity on rebuilds: a mantle body rebuild whose feetOffset changed now re-anchors center = feet + up·newFeetOffset before teardown (rapier already did this in its rebuild path) — previously a capsule shrink left mantle characters hovering at the old eye level, since the recreate seeded from the stale BodyPosition and the motor owns gravity.
• Authored-UI shell boot: the fixed 4s load deadline became an escalating, progress-aware stall ladder (4s → 8s → 16s). The old choreography converted SLOW into NEVER on weak devices (ledger 1913, third specimen of the patience-topology class): a phone that needed 6s to land the shell document was killed at 4000ms, and the single cache-busted retry — killing the iframe aborts the in-flight fetch — restarted from byte zero under the same 4000ms, so no amount of retrying could accumulate progress; the session latched failed with "shell document never loaded within 4000ms, twice", re-armed on the next render, and died the same way forever. Now: three attempts with doubling windows (total 28s of patience for silence, still bounded for a genuinely dead shell), every retry still cache-busted (the poisoned-cached-response class keeps its medicine). Each window is a stall detector, not a duration cap — the shell HTML gained two inline one-liner progress beacons (tome-realm-progress, stage parsing at head-top / parsed at body-end; the only host-visible signal below the iframe load event, since the sandbox's opaque origin hides contentDocument/readyState), source-gated exactly like hello, and a stage ADVANCE re-arms the live window in place — same iframe, same in-flight fetch, no restart — so an observably arriving document is never killed; duplicates and spam are inert (advance-only, two stages max). The exhaustion fault stays ONE bounded ui.realm verdict and now names what the final attempt saw: "no byte of the document ever arrived" (dead route/serving class) vs "html parsed; the shell module never finished loading" (connection too slow or died mid-transfer) — the discriminator Savi can act on. Hello/ready phases unchanged.
• Reconnect rebaselines are invisible or labeled to behavior scripts (dig 76609a1f — the "was that you moving my camera?" ghost). A join/reload/tab-reopen rebaseline surfaced as an unlabeled >8m position step, indistinguishable from portal travel — authored displacement detectors misfired on every reconnect (the specimen: an arrival-facing auto-turn snapped a player's camera toward the world origin 46s after a tab reopen). The hold: on netcode-client worlds, behavior update() and camera script hooks park until the first replicated baseline has ingested AND the reset cadence has been quiet for the settle window (1s, REPLICATION_SETTLE_WINDOW_SECONDS) — the whole boot choreography (including the observed double reset 54ms apart) happens inside the hold, so a script's FIRST observation of the world is the settled truth, even for deployed legacy scripts that will never check a flag. Boot-only latch: once released it never re-arms, so a mid-session reset storm can never freeze live gameplay. Camera rig maintenance (projection sync, first-person visibility, pointer lock) keeps running through the hold — boot frames still have a camera.
• Felt cost, deliberate (the release's one deliberately-felt boot change): on fast kernel multiplayer joins, scripts and camera hooks start ~1s after the last boot reset — a breath before the world starts moving. Pre-baseline motion was placeholder-world motion the snap threw away; physics pause usually overlaps the window.
• The name — api.isSettling() (ObjectAPI + CameraAPI): true while pre-baseline or within 1s of the last reset-projection ingest. Mid-session rebaselines (wake reset on tab resume — the ledger-1896 adopt-everything envelope; self-heal resets) cannot be held without freezing gameplay, so they are labeled instead. Named residue, pinned as such: unguarded legacy scripts still misfire on a mid-session takeover iff the position actually moved — the label exists for exactly that guard.
• Relay-bootstrap worlds synthesize their baseline locally — the hold releases at that edge with no settle window. Real portal teleports after settle stay fully visible (pinned). Reset ingests funnel through applyProjectionResetAdoption, which stamps noteReplicationRebaseline on the client clock the behavior gate reads; unarmed worlds (unit tests, sim-check, server worlds) are inert.
• Redrape pre-check — a moved usesGround anchor replays the mint's recorded ground samples before paying a generator re-run (tucker's P1, thread 1785563036; dump 9e8d30a3: tome/scripted-primitive-ground-redrape at p95 21.3ms/tick, max 294ms, 370 watched recipes in one place). scriptedGroundStateKey folds the quantized anchor transform (1/64 m feet), so an object MOVING across ground moved its change token every cadence window — and the redrape system answered every moved token with a full generator re-run (sandbox execution, mesh build, hashing, physics refresh) even when the ground under the new footprint answers byte-identically; N movers × 5Hz windows = the destruction. The key stays the cheap, never-under-triggering dirty bit; the consumer now pre-checks: the mint records its ground-call ARGUMENTS (process-local GroundSampleTrace, never on the wire) beside the recipe's existing #11170 results tape, and a moved key replays those arguments through a live sampler comparing quantized answers against the tape — all equal ⇒ a re-run would emit identical bytes (deterministic generator, identical ground answers at every branch point) ⇒ skip, costing a few terrain height lookups. Any differing answer (real terrain change, slope arriving under a mover, pose change) re-mints exactly as before.
• Vintage honesty: recipes without a provable trace — pre-#11170 mints, over-cap groundDigest recipes, boot/restore, ownership handoff — fall back to the re-mint, whose mint re-stamps trace + tape: one paid run, then covered. An adopted row whose tape ≠ the local trace is never vouched for (element-wise identity guard). Same-system bonus: the key's O(vertices) footprint scan (per window per watched entity) is now cached per content-addressed geometry value.
• Pins are mutation-checked (disabling the pre-check turns exactly the three skip-pins red): zero generator re-runs across 10 movement+yaw windows on flat terrain (counted by trace identity — equals-gated component writes made object identity a vacuous counter); movement onto genuinely different terrain still re-drapes; a sculpt on a recorded contact point still re-mints while a near-miss chunk bump skips; the traceless fallback pays once and self-heals.
• Renderer census in engine-bug client dumps (dig 80a1746b; ledgers 1854/1833/1831 — third render-family investigation in a week blocked by the same instrument gap). EngineBugClientDump.render gains primitives (live primitive + bespoke record counts; count + first-12 entityIds of live entities at representation=null — the museum-blackout signature; the null classifiers waits/parkedWaits/deriveFailed/starved; per-lane arena used/ceiling rows with overflowed and gpuAllocFailed verdict bits), flags (the session's enabled render feature flags — [] is a positive all-off receipt), and drawCalls, riding the existing 1 Hz perf-sample mirror (≤1s stale by construction; zero per-frame state). Bounded (12 ids / 16 lane rows / 8 flags) and re-clamped server-side regardless of what a hostile or future client ships; old 5.2.x dumps parse to null fields, never reject.
• Arena-refusal rollbacks became retryable — the structural half. The three silent representation=null paths (the batched-lane allocateSlot ceiling refusal + the two bespoke rollback branches) now register in store.starvedRepresentations; a bounded (≤4/prepare), epoch-gated sweep re-derives them whenever arena capacity MAY have freed (lane slot release, idle-lane disposal, device-limit grant — freed-range best-fit reuse genuinely heals). Epoch-stamping at registration is the ping-pong guard: a failed retry's own partial rollback cannot re-arm itself; stable scenes pay O(1) per prepare. An object refused at tick N renders the moment room frees, instead of staying invisible for the session.
• Lane GPU buffer creation/grow OOM is now loud (the long-session whole-lane-blank hypothesis): error scope on recreateGpuState, once-per-lane console line + primitives-lane-gpu-alloc-failed diagnostic + the gpuAllocFailed census bit. Rollback is not representable (the buffer stays invalid until memory frees and the next grow) — but it is visible now.
• Checked, no fix needed: a 202'd GLB already re-fetches in-session (Retry-After-scheduled re-probe + a render-on-change wake at the retry deadline, plus the slow-cook diagnostic when the loop outlives its threshold) — never-arriving assets point at the cook side, and the dump now carries that receipt.
• Equirect skies serve from the max-res-4k variant — the 1568 canonical cap protects Savi's eyes, not the players' (r-afa42722; ravi's dig 67b78fd3 on enfeul's partner-tier report). His 8688×4344 skybox rendered from a 1568×784 KTX2 because every canonical persists at DEFAULT_MAX_DIMENSION=1568 (deliberate: Anthropic-vision-optimal + the >2000px session-wedge guard) — Savi diagnosed the cap herself in-session and was right. One pure helper (tome/skybox-texture.ts, upgradeSkyboxTextureRef) applied at the two places that must agree — atmosphere-sky-utils.ts (the DrawSkybox textureId the sky renderer leases) and spec-assets.ts (asset-manifest registration + preload hints): cdn/foo.webp → cdn/foo.max-res-4k.webp, and the KTX2 transport derives ….max-res-4k.webp.ktx2, so the GPU texture cooks from the 3840-cap variant. Non-cdn/ refs, query-bearing refs, and non-image extensions pass through unchanged. First production use of the max-res lane; staging receipts end-to-end with the specimen's actual source pixels (canonical 1568×784 unchanged; max-res-4k 3840×1920 PNG + KTX2 minted on demand).
• api.traverseCheck — the walkability probe (r-be446670; tucker's bridge dig). Savi ran SIX collision probes on an unwalkable bridge and every one answered TRUE, because colliders existed everywhere — the bridge stepped +0.368m between slab tops against the character controller's autostep maxHeight 0.3, and walkability = f(riser, autostep) was computed nowhere she could read (~20h of blind authoring). The verb marches the segment at controller-scaled steps over the same resolved collider volumes the overlap probes use (rapier-pinned) plus the terrain samplers, reading the LIVE PhysicsCharacterControllerConfig (+ the body's resolved capsule) through the same voxel-place effective rule the stepping controller applies — the CC's own numbers, never duplicated constants. Body resolution: opts.body → caller-if-character → a player in the place → engine defaults. First blocker + WHY: blockedAt pins the failing location, blockedBy names the entity, detail carries measured-vs-limit.
• What the controller ignores, the probe ignores: sensors never block; other characters pass through by the CC's own packed-group law; dynamic (pushable) bodies only with includeDynamicBodies: true. Pure geometry, no simulation mutation — answers identically in run_script's snapshot (where the bridge session went blind — exec-lane test included), on the multiplayer server, and on live clients.
• Prompt budget (the #11746 convention): traverseCheck joins the Raycasting long tail as a bare name (16,097 < 16,100 cap); the full contract rides api-reference §Raycasting + TomeAPI.md; the worked example rides the pointer-raycasting skill. The pinned test suite includes the bridge specimen exactly (13 slabs, +0.368 risers → riser_exceeds_autostep, detail.riser ≈ 0.368, blockedAt at slab-0's top).
• api.unionSolid(objectIds, options?) — the union-solid primitive (r-9b856490). Takes N axis-aligned box/cube objects (any 90°-multiple rotation; validated as a signed-permutation rotation matrix) and produces one object wearing primitive: { kind: "custom" } whose geometry is the exact boundary of the box union, computed by the 3d-rooms apex extractor (rooms/boundary.ts — one face per boundary location, owner resolved by input order, interior/coplanar-duplicate faces impossible by construction; same-paint solids pre-merge via mergeSolidsForExtraction). Per-piece paint rides the bespoke vertex lanes (linearized color multiplies instance albedo; metalness/roughness/emissive carry the negative keep-instance-scalar sentinel when unpainted). The result spawns through the normal spawn pipeline (persistence, ownership, undo, replication all inherited), inputs are destroyed after the spawn commits, and physics (when any piece had a body) is static with a bespokeMesh collider — N box colliders → 1. A shared non-default material family (water, explicit keys) survives the merge — the union spawns wearing the family key; keyed pieces merge BARE (per-piece overrides on a keyed family refuse: paint is a standard-family lane those shaders never sample). Refusals are structured ({ merged: false, reason, message, blockers[] }) and name EVERY blocking piece: not_found / not_a_box / rotated / degenerate (floor = the extractor's 10 µm lattice, so no accepted piece can quantize to zero cells) / has_children / has_parent (a union spawns as a root object and would stop following the parent) / has_behavior / unsupported_physics (dynamic/kinematic bodies, sensors, collision filters, friction/restitution — the one plain static collider cannot represent them) / unsupported_material / mixed_material_keys / mixed_places / mixed_realms, plus call-level too_few_pieces, too_big (the 16,384-vertex bespoke cap refuses instead of truncating), and id_taken (a live options.id refuses — the union never mutates or shadows an existing object). Determinism pinned by test (identical input → identical buffers).
• Runtime-spawn lane: inline-custom geometry now collides as its mesh (ledger-906 parity). applyObjectPhysics in object-api.ts gains the interpreter's bespoke branch: an entity whose appearance is inline bespoke geometry (kind "custom", no DrawPrimitive) and whose collider resolves auto/mesh gets { kind: "bespokeMesh", geometry: <signature> } instead of falling through to the 1m default box — the "collision only at the center of the objects" class (triage 70410cc7) arriving through the spawn lane. Explicit collider shapes (box/sphere/capsule) behave as before.
• Prompt/docs: unionSolid joins the always-on Lifecycle tail as a bare name (+12 chars, 16,020 → 16,032, cap 16,100 unchanged); the full contract (@tomeapi on the verb + result types) rides api-reference §Lifecycle; the custom-geometry skill's one-solid-not-stacked-plates law now points at the verb for already-spawned assemblies.
• properties.visibleRange — per-object camera-distance visibility, renderer-evaluated with hysteresis (r-005e6f9a; ravi's NY-1:1 LOD dig ef4136e0). Savi structurally could not express 10-lines-of-three.js distance visibility (if (dist < 700) mesh.visible = …) without destroy/respawn entity churn or tick-lagged property writes — the observed tier swap was destroy-now-respawn-on-a-later-pass (≥4–8 blank display frames per swap, a strobing ring traveling with the camera at fly speed; three overlapping hand-rolled LOD systems in one world). Now: a DrawVisibleRange component (replicate: "aoi", forwardToRenderer: "always") carries only the authored band; the renderer registry (lume/entities/visible-range.ts) precomputes squared thresholds at write time and sweeps per frame against THAT frame's camera; verdict flips rewrite lane visible bits through the same paths a visibility-mask op uses, composing as one more AND with the camera visibility mask across every primitives-store representation (batched lanes, oversized pools, scripted, water, bespoke parts). Objects without the property pay ZERO per-frame work (registry-only iteration, size===0 short-circuits).
• Hysteresis is engine-owned — a hovering camera can never flicker: the authored boundary is the CENTER of a ±5% band (shown hides only past max × 1.05; hidden shows only inside max × 0.95; min mirrored; between them the previous verdict sticks). Pinned: 500 camera sweeps at ±98% of the half-band produce ZERO toggles from both armed states; decisive crossings flip exactly once; a REPLACED range inherits the standing verdict (no one-frame blink); complementary bands admit at least one tier at every distance.
• ObjectAPI getProperty/setProperty("visibleRange", …) round-trip in the spec shape; invalid writes warn and HOLD the standing range (a bad write must not silently un-range a streamed building). In-passing fixes at the same seam: refreshPrimitiveVisibility now honors OVERSIZED representations (a visible: false op on an oversized-represented primitive silently did nothing), and fresh oversized slot acquisition re-asserts current visibility (a hidden entity re-deriving into a pool slot no longer pops visible).
• worldBounds.top completes the 2D camera fence (ledger 1870, gutterbt's grey-void report; dig 3faa4158). The set was {left?, right?, bottom?} at every layer — an authored top silently dropped (the zod schema stripped it on parse; isWorldBounds/clampToBounds never read it), so shot-follow drove the eye high and opened grey void above the painted world, unfixable by any authored rect. Now top rides the type, the schema, isWorldBounds, and clampToBounds, honored exactly like bottom, mirrored: frame top never passes top; shorter-than-viewport levels center vertically. The gutterbt repro is pinned (bounds {left:-70, right:70, bottom:-24, top:24}, camera driven to y=60 → eye pins at 19, frame top exactly 24 — no void above the paint), plus top-alone, level-entity-published top, short-level centering, and schema-parity pins.
• The silence dies — spec-shape warning for unrecognized worldBounds fields (tolerance stays: unknown fields still no-op; once per room per field-set, a newly authored unknown field re-warns): the warn names the field, states the four understood edges, and says what an ignored field means (that edge is NOT fenced). The next authored field that doesn't exist warns by name instead of dropping traceless.
• Named residue (row 1870's remaining shape): BOUNDS_ASPECT still assumes 16:9 (a 2.03:1 screen under-clamps horizontally ~2.75wu/side); the fence stays opt-in (derive-default-from-painted-extent is the bigger cut); unknown fields in level-entity-published state.worldBounds (runtime state, not spec) still drop silently.
• The zone-arrival contract — transitions land on a validated destination spawn, never carried source coords (r-23615562, dig ec420521; three specimens in five days on one prod world: wall-regen embedding 07-29, "it put me in the wall" 07-31, arrive-in-the-ground 08-01). Two halves. Client: the reset client-sim guard (ledger 1848) rewrote guarded reset rows to server-stamped components only, so a traveler's OWNED transform kept source-place coordinates while PlaceMembership flipped underneath — the client rebased into the destination standing at source coords and uploaded them back as canonical (the specimen telemetry exactly: Place=gnollwarren, position=wildlands, minimap lagging). A guarded reset row carrying a PLACE CHANGE now adopts wholesale (proof of server origin — a client can never rewrite PlaceMembership on a live entity); same-place resets keep preserving owned locals (the guard's send-failure-storm purpose, pinned by test). Server: enterPlace spawn resolution checked nothing against destination ground — explicit spawnPoints, "last" memories, and authored fixed-y defaults all go stale under digs/sculpts/regens, and the KCC cannot depenetrate out of a heightfield from underneath. New tome/place-arrival.ts validates player arrivals against the destination's current terrain. Players only — authored under-terrain props stay legal.
• Structured verdict when validation moves a player: runtime log code: "arrival-embedded-lift" naming the stale source (explicit / last-memory / authored default), from-y, resolved ground, and place — Savi sees WHY someone arrived where they did instead of investigating a mystery.
• Named residue: cold first-residency arrivals fail open (the destination's terrain definition installs a tick after ensurePlaceResident, so there is no ground to judge at verb time — pinned by test); mesh/prop overlap at the arrival stays the character controller's depenetration job.
• GeometryScale single-writer treaty — the server-side fit solver never writes a client-simulated entity (dig ad327a50 cuts 1+3; badgerblunts' warfare room: ~2/s geometry/scale stomps on one held weapon, 66/30s, 7,043/session, weapons visibly snapping). geometry-fit-solve ran mode:"both" with zero simulator guard: a server-side solve on a client-simulated entity was a LOCAL-origin write → forwarded, fencing the owner's uploads and replacing the owner's local values — with realm-skewed bounds inputs the two solvers disagree indefinitely. The engine fighting itself; no script to stop. Now it adopts terrain-reanchor's exact treaty: server half skips client-simulated entities WITHOUT consuming the dirty mark (write duty returning re-solves immediately); observer half consumes the mark as bookkeeping (the simulator's replicated rows carry the answer); fresh-boot/headless/exec/singleplayer worlds solve exactly as before; unowned place content under client-auth pauses until a host claims it (the same pause terrain-reanchor and behaviors obey). The fight class is structurally unrepresentable: the simulator is the only realm that writes.
• Sustained-fight verdict that names the writer. Same-(entity, component) fence drops crossing 50 in 60s escalate the per-client teach to ONE structured verdict per pair per window (data.verdict = "sustained-write-fight"), and a new local-write observer seam (setLocalWriteObserver, fires only on LOCAL-origin marks) + the executor's ambient withSystemContext bracket let the verdict name the actual writer: server-side writer "tome/geometry-fit-solve" is fighting the owner of <entity> over "geometry/scale". Hook/cron/run_script writes (outside any system bracket) stay unattributed and keep the script-lane diagnosis — correct for that family. The old blanket "a server-side script keeps writing it" was wrong for engine-writer fights and unactionable.
• Dump surfacing (the fence lane is DD-invisible by construction): EngineBugRealmContext.uploads now carries uploadDrops per gate + serverWrites (including sustainedFightVerdicts) in every engine-bug/incident dump. Enforcement is byte-identical — the verdict is a receipt, never a behavior change (pinned).
• God-mode gesture commits preserve terrain anchors — the spec's y: { terrain: offset } form is the truth; the live resolved y is only its projection (cal's Final Abyss dig, dump 4456c18d). commitGestureEdit diffed and persisted feetPosition through getProperty — resolved world coords — so ANY gesture touching a terrain-anchored root baked its current live height into the spec as a concrete number and deleted the anchor. When the live projection was wrong (not-yet-streamed terrain resolution, a script re-seat mid-flight, cross-realm height divergence), the wrongness became durable: cal's boundary trees sank 6–10m at the touch and reloads kept them buried, while his ground-warden script re-lifted them live every 2s — "looks fine until it suddenly doesn't", and "not persisting" on every boot. Now readEnvelopeValue reads feetPosition in the frame the spec stores it (the live TomeTerrainAnchor component, root-only — armed by every terrain-form write, removed by every concrete write, so it always mirrors the last form a writer chose): before/after compare form-to-form, a gesture that never rewrote the pin contributes no feetPosition diff at all (zero-move touches and menu picks bake NOTHING, even while the live y wobbles underneath), a slide persists the pin at the new x/z, and undo restores the authored form. Bonus determinism: the commit diff no longer depends on per-realm terrain samples, so client and server record identical undo entries by construction.
• Horizontal slides carry the authored offset verbatim. The translate pad and the spline move pad derived their terrain offset from liveY − terrainHeight at press — a wrong live y turned a purely horizontal slide into a durable vertical edit. Both now read the offset (and the f64 x/z base) from the object's authored spec form when it is terrain-anchored: { terrain: 0 } slides as { terrain: 0 } exactly, with no terrain-sample round trip to smudge it, and the y-less { x, z } shorthand keeps its shape. Unanchored (concrete-y) roots keep the live derivation — the pad converts them to terrain-relative at the float the creator sees, which is the pad's long-documented intent ("persists a terrain-RELATIVE y … rides later terrain edits instead of being buried") finally reaching the spec instead of being re-baked concrete by the commit. Deliberate vertical lifts keep their as-found rule: they re-author the pin's offset ({ terrain: newOffset }), still terrain-form. Snap TOP-STACK mates still re-derive (a deliberate vertical correction). Pinned red-first in terrain-anchor-commit.test.ts, including the exact cal shape: spec { terrain: 0 } + live y corrupted meters downward + horizontal touch → the pin survives and the wrong y never bakes.
• Coverage boundary against the LIVE-PARKED-ENTITY class (dig 6f5f9bb5 — cal's XZ teleports to glade center: live entities sitting at the park transform (origin x/z, y=3.8, identity scale) because spec position was never applied while scale was; receipts: ha-tarn-mourn-5 durably baked to (0, 3.8, 0) at v16197, plus four kernel identity-scale resets v16193/v16196/v16201/v16203). Pinned by test, honestly: (1) a zero-move touch on a parked object now bakes NOTHING — the grab-verbatim park write (v16197's shape) is dead at commit; the one residue is an undo entry whose before is the resolved park (no anchor was ever armed, so the press-time envelope falls back to the live read) — undo after such a touch re-bakes the park. (2) A real drag on a parked TERRAIN-ANCHORED object lands at authored+delta — the pads base x/z on the authored spec row, never the live park — so the teleport-toward-origin is cured for the terrain-form specs cal's trees actually carry. (3) NOT cured, the follow-up's cases: a real drag on a parked CONCRETE-y object still persists park+delta (no authored terrain form to read); deliberate-vertical grips on a parked object still derive from the parked live; and script-lane editors (getProperty/setProperty in game scripts, e.g. the session's editor.js move arrows) never pass through this commit at all. The root — the silent partial transform-apply that parks the entity — is the named follow-up; fixing it re-arms the anchor and closes every residual above at once.
• Zero-effective-delta touches of concrete-writing handles bake nothing (found in adversarial review — the form-based diff would otherwise have OPENED a bake path master didn't have). Several drag handlers write concrete feetPosition from the press-time live snapshot on every drag tick, including a tick with zero effective delta: the cylinder cap extrudes (hover + declared grip), the plane edge extrude, and the 2d-top/2d-side pad branches. On an anchored root, that idle write strips the live TomeTerrainAnchor (concrete write = de-pin), so the commit diffed form-before vs resolved-after and baked the live — possibly corrupted — height on a plain press+release; master's resolved-vs-resolved compare baked nothing on that same touch. All five sites now skip the feet write at zero effective delta (no movement, no write — which also stops an idle touch from silently de-arming the live anchor, a live-only master bug). Pinned red-first: cylinder bottom-cap hover extrude, zero-move touch, corrupted live y → spec byte-identical, no undo entry. Real (nonzero) resize drags keep their as-found rule: cap/edge extrudes persist concrete feet — the "never de-pins" rule is the MOVE grips' (pads, lifts); resize extrudes that genuinely move feet still convert, as they always did, and undo now restores the authored form.
• THE COMMIT SEAM — one boundary rule closes the whole zero-move-bake class, for every handler present and future. The per-writer guards above fix the sites they name, but the class was wider (review round 3): cube extrudes write concrete feet unconditionally — and for axis=y sign=1 the shift is hardcoded 0, so even a REAL grow-taller drag wrote value-identical concrete feet and de-pinned the root; the vertical grips (terrain-offset, verticalMoveGrip) write { terrain: liveDerived + total } at total=0, baking a corrupted live y as a wrong offset; writeAnchoredScale does the same on the fallback/model handle set — the handles cal's actual trees carry. Instead of a third round of per-site guards, the commit now owns the rule: captureUndoEnvelope records the LIVE feet as the gesture found them (GESTURE_LIVE_FEET_KEY), and commitGestureEdit drops feetPosition from the diff when the release-time live feet are byte-identical — "a gesture that left the live feet where it found them persists no feet change". That is master's own zero-move semantics (its resolved-vs-resolved compare could never persist feet without live movement) restored structurally, composed with the form-based diff for genuine moves — so the seam can never bake where master didn't, and it also stops the zero-move pad touch of a concrete-y root from phantom-converting the spec to terrain form. Pinned red-first per family: cube face touch, cube top-grip REAL grow (scale persists, pin survives), vertical-grip touch on a parked object, model size-star touch, concrete-y pad touch. The per-writer zero-delta guards stay as live-write hygiene — an idle touch must not de-arm the live TomeTerrainAnchor even transiently; the seam protects the spec, not the live component, and the unguarded families still de-arm/re-derive the live anchor on an idle touch exactly as master did.
• Out of scope, named for the follow-up: the gesture-seam reconciliation (client-predicted vs server-applied divergence inside a drag — what produced cal's 6–10m mid-gesture drops). This change removes that divergence's path into the SPEC; reconciling the live projection across realms during a gesture is the #11775 zone-arrival doctrine transposed to god-mode object writes, and it is not built here.
• Terrain raw-albedo fallback — a pending or refused Patina cook no longer degrades new terrain to flat tint (dig 554e8cd9, jacob's "blurry with lines" 08-01). Since pbr-by-default (#10552, prod ~07-26) every new textured terrain material's textureId is the Magic-CDN Patina albedo+height variant (<albedo>.pbr.json.png.ktx2?transform=albedo-height), and until that derived source lands the atlas rendered the layer as its tint color over a 1×1 placeholder — so a fresh mint (cook minutes), a starved cook queue (the 07-31 storm), or the 24h Patina 4xx reject park (c9c080f68f) all read as textureless watercolor ground. Now buildMaterialPack threads the raw albedo the variant was cooked from as fallbackTextureId, and the terrain layer atlas requests it whenever the variant isn't already resident: the raw texture joins the array and renders (the pre-07-23 look — alpha-as-height off while it serves, so height-aware blending never reads opacity as height), and the cooked variant supersedes it the moment it lands (join priority: a fallback never displaces a resident or batched primary; the warm path — variant already resident — never fetches the raw albedo at all).
• Reject-seam honesty: terrain-atlas-tint-fallback now fires only when NO source can serve the slot (variant rejected AND raw albedo absent/rejected). A variant that can't pack while the raw texture serves fires the new milder terrain-atlas-raw-albedo-fallback teaching ("ground stays textured, PBR surface detail is what's missing"), and a variant that rejects while its raw albedo was warm-path-deferred kicks the fallback load right then.
• Cook-refused verdict (texture-pbr-variant-refused): a Patina-derived map URL that dead-parks or tombstones at the texture service (the kiln 24h reject verdict serves a descriptive 400) no longer teaches the generic "fix the texture reference in the spec" — the engine minted that URL itself, so the teaching misdirected Savi at a ref she never wrote. The new verdict names the SOURCE texture, says the raw texture keeps rendering, and puts the fix where it lives: upscale/regenerate the source, or pbr: false. Teaching leads, server detail trails (the diagnostic rail truncates from the end).
• Named residue (follow-up, dig shape 3): blendWidth = max(fwidth, 0.18) on the pbr shader variant is untouched this PR — height-aware blend width without landed heights is a separate softness contributor and deserves its own change.

technical notes

• Engine-owned tap primitive — authored action buttons stop depending on browser click synthesis (r-e6fef5fc; the laurolandia dead-buy class). onclick="sendAction(...)" buttons died in the user agent's touch gesture disambiguation: pointerdown→pointercancel over a scrollable authored list means no pointerup, no click, zero actions. (onpointerup — Savi's field workaround — is only half a fix: pointerup never fires on canceled gestures either.) frame/tap-actions.ts: the frame runtime owns the tap verdict with ONE constant pair (TAP_MAX_MOVEMENT_PX=10 / TAP_MAX_DURATION_MS=500). An in-budget pointerup fires at finger-up as a synthetic click with full authored fidelity; the browser's own compat click is swallowed — one activation per gesture, structurally. A within-slop pointercancel takes a deferred scroller-displacement verdict: a real scroll stays a scroll, a cancel that scrolled nothing is a stolen tap and fires.

• Binding surface: [onclick*="sendAction"] auto-upgrade (existing games heal with no edits) + declarative data-action / data-action-payload. input-forward skips engine-synthetic clicks so the host click stream is byte-identical to today's. Red-first receipts (tests/browser/suites/mobile-authored-ui-actions.pw.ts, both engines): stolen-tap pins were ZERO arrivals pre-fix and deliver post-fix; a scroll flick from a button stays zero-false-fires with the list really scrolling; clean tap / micro-drag / long-press / morph-under-finger deliver exactly once.

• Hook fault boundary — a creator-script throw no-ops that call, never the script (r-1ad83017; ravi's laurolandia dig cdbf3634). The specimen: a wrong-signature spawnFx on the jump path of a single-script pony marked the whole scope faulted on the FIRST throw — update, onInput, and sound all skipped, durably parked after 3 identical strikes. One typo = can't walk for ~40 minutes, while Savi verified green on the server plane. The cut: the fault ledger stops meaning "a hook threw" and starts meaning "this scope must STOP running" (a stop-verdict). containBehaviorHookThrow is the one catch body for every creator-hook throw site (composed callEach entries, update, onInput, onInteract, onCollide/Trigger/Liquid/JointBreak, onSoundEnd, onNoise, camera hooks, timers, job callbacks, event handlers, onSpawn/onDestroy, onControlBegin/End, onPurchase): the throw no-ops that call ONLY — no fault minted; the script's other hooks and its own later calls keep running.

• Loud, never spammy. Ops log sees every occurrence (boot-scale class dedupe), then ONE report per (hook, script, error-class) signature per 30s window rides runtime log + DM + the client fault wire, carrying "contained: that call was skipped; the script's other hooks and later calls keep running" — the fault report names the hook. A valueless throw gets a substitute message instead of silent no-op forever.

• NOT absorbed: ScriptBudgetExceededError keeps fault+park (a wedge costs ~1s per re-invocation; the budget watchdog relies on the ledger to not re-run it), and throwing updates now bill the budget watchdog since they re-run. Rapier corruption / codegen-pending stay classified, never blamed on the script. Surviving fault mints are each a genuine stop-verdict: wedges, subscription liveness verdicts, god-mode editor/visual layers, the stuck-job backpressure lane. Red-first pin: behavior-hook-containment.test.ts reproduces the specimen (watched red at walked=1 on the old code).

• Keyed heads — the relay journal stops deleting the live world; reconnects and fresh joins rebuild the runtime world (kernel half of #11655; dump efd83a2b, MechaBlade room-1). Root: self-compaction prefix-deletes the journal behind a SPEC-ONLY pointer (the authored level, a document that predates the session), so runtime-spawned entities — which exist ONLY as journaled create rows — were unrecoverable after one compaction cycle; the peer-witness lane papered over it only while a witness was online. The engine now SPEAKS the keyed-heads grammar the relay learned: producers stamp an opaque key on batched STATE rows and the relay upserts each into a heads overlay at append time (keep-max(seq)-per-key, O(1), engine-blind); a FRESH dial drains heads(≤C) then journal(>C) as one ascending stream, so journal+heads alone reconstruct the running world — witness or no witness, empty room included.

• The producer (relay-wire-session emitJournaledStatePart): journaled StateDeltas re-chunk into one-total-statement-per-key rows — creates → key + tomb (scrub-and-insert; spawns and rebirths are one shape), non-motion updates → one row per component carrying the full value, deletes → tomb-only. Per-flush key coalescing sheds write amplification; rest stamps ride the same lane, upgrading the motion lane's loss story to "durable past compaction". The fold constitution keys NOTHING fold-relevant: member avatars, presence-stamped messages, commands, and events stay keyless legacy.

• The join edges: F10 failed-resume answers a new redial-fresh verdict (cursor reset, keyed outbox pruned, re-dial with resume=0 — the only dial shape whose welcome floor serves heads); the live flip rebases the cursor to the welcome's catchupThroughSeq; the host-stamp gate runs on the LIVE phase only (gating history on a mid-construction host table dropped the entire hosted world at every fresh join — the dump's "names nobody" lines). Restate-on-adoption (relay-world-restate.ts): a host seat taken at a new epoch re-journals its place's unowned remainder as keyed creates, closing the deposed-epoch stale-heads window and self-healing keyless journals at the first post-deploy adoption. Pinned end-to-end: kill-all-clients world reconstruction — bots return with last-written state, dead bots stay dead, no avatar resurrection (relay-late-join-live-layer.e2e).

• window.spawn.leaderboard + leaderboard:submit removed — api.sql subsumes the platform leaderboard (jacob 07-28, thread 1785296593; r-a20d11f0). Removal lands as TEACHING refusals because real callers exist: the kernel client's window.spawn.leaderboard is a throwing getter naming api.sql + the one-line migration (the RPC trio leaves the iframe method union); the kiln parent answers leaderboard.submit/top/around RPCs with the same teaching error (covers engines pinned pre-removal) and its sdk object drops the leaderboard block; leaderboard:submit becomes a registered builtin tombstone settling { ok: false, error: "leaderboard_removed_use_api_sql", message: <migration> }, and the relay bridge settles the same tombstone data (kernel parity); the realm allowlist shrinks to [assets.uploadImage, user.upgradeGuest] with the frame shim teaching api.sql on any leaderboard.* touch.

• The env.leaderboard capability rail dies whole: createSdkLeaderboardEnv, JobLeaderboardEnv, WorkerdScriptedJobIo.leaderboardSubmit, the RoomJobIo lane, the room-seam presence/cadence gate (leaderboard-submit-gate.ts deleted), both seam gate blocks; BUILTINS_REQUIRING_HOST is empty. gsdk-types drops leaderboard from the client SDK type (server type untouched).

• Teachers edited same-turn: skills/leaderboard.md rewritten around the api.sql board (write/read lanes, every networking mode); game-ui + jobs + data-and-saves scrubbed; V2-leaderboards.md wears a removal banner; the read-rail drift guard now pins the successor teaching. Controls held: api.sql untouched; leaderboard-using tests migrated, not deleted; kiln HTTP routes + DB tables + gauntlet + gsdk-server stay for a named follow-up teardown.

• Multi-place sidecar — one room_host shell hosts every place Savi's work needs (#11562, dump 237ad0fc). A place-less run_script resolves to the spec's defaultPlace, and a place with no bodies can elect no host — so when a match start pulled every member (headless shell included) out of the lobby, the exec lane wedged permanently: every member logged "not mine to run: host=UNELECTED", kiln burned its 20s deadline into infra-cut 504s, and the summon machinery correctly saw a healthy attached shell it could not help with. Fifteen minutes of dead tools on a perfectly live room. The structural fix: hosting is no longer welded to body residence for the room_host shell.

• Claims are the floor under the election. RelayPresenceFact grows an optional hostPlaceClaims restatement (room_host class envelopes only; sinceSeq anchors mirror presenceSeq's compaction convergence). The fold seats a claimant only when no eligible resident exists — residents always outrank. The shell states a STANDING defaultPlace claim at bootstrap and claims other spec-declared places LAZILY: an exec targeting an unhosted place is parked, the claim journals, and the same exec releases when the seat folds (~1 RTT). The "at most one hosted place per client" invariant dies: getLocallyHostedPlace → plural getLocallyHostedPlaces/isLocallyHostedPlaceId/getLocallyHostedPlaceEntry across every consumer; the uploader drain stamps one message per seat; physics adoption lanes key per seat.

• Receipts: 10 e2e scenarios including a literal incident replay (bodies pulled to main, lobby seat holds, the exact 504'd exec answers), compaction convergence, forged-claim refusal; live on the deployed dev relay — place-less boot 16s cold, lazy place claims ~600ms, held-seat repeat 477ms, an undeclared place refused honestly in 6s with relay_exec_no_host_tick. One sidecar, three simultaneous seats.

• Explicit NPC locomotion suspend — the seat primitive (ledger 1892, incident f6c70bbb). A seated pose used to fight three engine systems at once: npc-loco's weight-1 idle channel rewritten every tick under any script-owned Sit channel, the mover's per-tick ground snap dragging a body seated above the nav floor down (or up onto the chair collider — the field's "kaptajnen sad i luften"), and per-tick facing writes. npc: { locomotion: false } is the explicit switch that releases the body from all three: the nav solver and mover skip the agent (parked intents spend no path quota; a seated Y holds exactly), facing writes stop, and the locomotion system REMOVES its npc-loco channel (merge-delete — script-owned sibling channels survive; an empty mixer drops the component, mirroring updateChannel(name, null)). Perception (canSee/onNoise) stays live. Only exact false suspends — the engine never infers a pose hold from channel weights. Round-trips through getProperty("npc").

• Park/re-host protocol pin (ledger 1839 kin). New e2e pin: a runtime updateChannel write (DrawMixer component) survives the unhosted-place freeze byte-for-byte and redelivers intact on the re-host wake reset; it dies only when the empty place UNLOADS (entities destroyed, re-materialized from spec). Runtime channels are load-scoped; the durable expression of a pose is spec state (properties.mixer, properties.npc) — now taught.

• Teaching: 3d-animations.md gains "Seating a character" (the ?animations= Sit mint gate, the suspend, parent-with-LOCAL-offsets, the ik: { feet: false } opt-out and its whole-value-replace spread, runtime-vs-spec durability); npc.md's properties block names the switch. Three increments of the binary-protocol ladder (apps/cf-relay/docs/binary-protocol.md), one lane (#11645 → #11650 → #11656):

• Envelope v1, negotiated per socket (#11645, increment E2 — plus E0's encode-once fanout: relay CPU per fanned motion-1 frame 13.19µs → 3.93µs). The frame envelope (op/seq/identity framing) goes binary; payloads stay JSON at this rung. Negotiation is the relayBin=1 dial advert × the welcome's transport form as the answer — settled at the 101 relay-side, before first client egress, fail-closed in both skew directions, zero probing frames (a WS subprotocol offer would hard-fail browsers against already-deployed kernel-tier shells). cf-kernel carries the mirror codec (relay-wire-binary.ts — mirrored, never imported; golden-vector twins pin both sides byte-for-byte), per-generation session wire format, and sniff/ingest for binary relay frames. Journal storage-class split: TEXT = JSON payload, BLOB = binary register — the class IS the format tag, no migration; catchup/retransmit re-wraps per socket (BLOB to a JSON socket = base64 + payloadEncoding). Platform truth pinned: workerd's output gate captures ws.send(view) by REFERENCE and materializes at gate-open — binary frames copy once per frame per format (binary-envelope.workerd-test.ts).

• Payload registers: StateDeltas + host-tick rows (#11650, increments E3+E4) — the ~90–97% of hot-frame bytes the envelope left alone. Registers open with their own payload-version byte (0x7B reserved forever as "this payload is JSON", so mixed-vintage journals decode row by row) and are self-contained per frame (journaled payloads never carry cross-frame state — compaction makes a session dictionary structurally unsound): a version-pinned STATIC component name table + per-frame string tables + a self-describing recursive value grammar with vec3/quat fast paths; unknown component names inline once and alias within the frame, so new components never need a new register. The equivalence gate is MECHANICAL — deep-equal, no tolerances (corpus includes f64 physics, NaN/Inf/−0, unicode, unknown components). One shared parse door (parseRelayOpaquePayload) at peer-apply, the election fold, the host-tick gate, and the SPEC lane; unknown registers warn-drop loudly. An outbox entry minted binary re-projects LOSSLESSLY to JSON text when the next generation is JSON. Measured: motion-1 498→157B, motion-8 3237→950B, 10-row mix 3153→1040B.

• Motion-delta lane: lossless deltas + keyframes on the EPHEMERAL wire (#11656, increment D1) — zero relay changes; the relay cannot tell a delta from a keyframe. The one STATEFUL register, legally: EPHEMERAL frames are never journaled, so self-containment scopes past them; keyframes (cadence K=30 ticks per author) bound the chain. Delta rows carry only components whose value changed since the author's own last motion-lane send; they apply as the partial LWW component writes update rows already are, so the applied stream is bit-identical to the full-row lane's — pinned at every tick of a seeded 200-tick trace (full-row JSON 259,895B vs 23,831B, 10.9×). Fail-closed at every seam: unresolvable aliases discard (never guess — the entity holds its last pose ≤1 keyframe, then re-bases), a chain-epoch guard makes a stale alias table unusable, a refused/failed send marks the whole chain keyframe-due, and journaled-restatement/create/delete EVICTION means a delta can only skip components the receiver provably holds. keyframe-please gives joiners a fast re-base, gated on binary payloads so old-build peers never meet the vocabulary.

• Terrain edits cross the relay tier (#11644; the 2026-07-30 staging "terrain missing until modified" class). Terrain-edit state had zero working lanes on relay rooms: rail.voxelEdit/rail.fieldDab dropped at every peer, the world-sync statement excluded terrain, and the durable _spawn_chunks baseline had no loader without a server world. Three lanes now exist: peer apply (relay-peer-apply — senderOwnsSource authority gate, the same engine funnels as the kernel rail, live + catchup phases; parse/cap cores extracted into shared wire modules consumed by both sides, server behavior byte-preserved; per-tick budgets deliberately NOT mirrored at peers — observer-relative ticks would fork the journals); world-sync terrain statement (the default-place host states its compacted chunk journals inside the existing request/authorship envelope); durable baseline READ (cf-edge GET /terrain/{variantId}/{roomMode} — the /spec route's sibling — plus relay-terrain-fetch and a parallel join-time fetch that is never join-fatal).

• Install primitive: rebaseTerrainChunkEditsOntoBaseline — baseline history hydrates UNDER live session edits (never stamp-compared across lineages); idempotent, order-safe, convergent across observers. The durable WRITE half (relay rooms flushing back to _spawn_chunks) is deliberately absent: it is the persistence program's recorded open ruling (persistence-one-verb.md §15, elected-host trust) and must not be decided as a side effect here.

• Shipped in 5.2.11 (#11631 was inside that release's re-sha'd build head) — but 5.2.11's notes never taught it; taught here so the record is honest. Behavior on this version is identical to 5.2.11.

• api.seconds() and api.getTick() now read the ROOM's clock instead of the local machine's tick counter. Both add back the sim time this machine's ticker shed (backlog clamps past maxStepsPerFrame, plus the wall-clock gap a frame-clock reset discards on a hidden-tab resume), so every machine in a room reports the same game time. Engine-internal scheduling — timer due-ticks, lifetime deadlines, sound-loop and vignette anchors — keeps using the local tick, unchanged.

• FixedStepTicker accumulates getShedMsTotal(); the client runtime publishes the correction as RoomClockShedTicksResource each step and zeroes it on every authoritative rebase. Server worlds and singleplayer never set it, so their readings are byte-identical to before.

technical notes

• The 5.2.11-cut fps latch is dead before release (#11640). Two freight commits interacted into a silent full-spec fetch live-lock on the sim worker (fetch loop re-entered hot when a plain adopt gated on the per-realm revision counter while the covered-check spoke dbVersion) — 112fps pinned to ~22 after any pointer skew, forever. Non-covering resolves now take the level-triggered miss ladder and kiln saves ahead on dbVersion adopt past snapshot-inherited revision counters; a progress gate makes the hot re-enter unrepresentable.
• God-mode flight reaches the server (#11630). The god entity's ownership walk attributed it to the creator, so server input dispatch skipped it — the flight existed only in local prediction and exit honestly snapped back. One law at four seams: god-mode entities are server-simulated; the owner's rig sim is presentation-only.
• Focused text fields stop eating game keys; solo write-fence tells the truth (#11624). Readonly/disabled fields release the keyboard ([data-input-capture='ignore'] outranks editability); the solo-session drop was correct two-writer enforcement wearing a lying receipt — the receipt now teaches, and sustained fencing escalates to a warn.
• Alt-tab no longer wipes script state (#11622). The projection sweep destroyed verdict inputs mid-iteration (make-before-break re-baseline, one verdict per entity); the suspension-takeover wake handback is wired and pinned.
• God-mode exit position pins through production netcode (#11626). E2e pins drive the full egress/wire/ingest path in five hide/show permutations.
• getWorldBoundsBox becomes honest about pending model loads (demand row r-0223b62a, engine-demand wave p-35fbe727 item 2). The bounds read has always measured real resolved geometry (BoundsRegistry: GLB header POSITION min/max, or replicated assets.metadata from a prior parse) — but a model whose bounds hadn't landed answered a bare null, indistinguishable from "nothing drawable", and Savi assembled blind (the 0.18m-eyeballed lantern, a-1389). Now: while measured bounds are unknown, a FULLY declared properties.layout (per axis maxExtents else minExtents; all three axes or nothing — a fabricated axis would be a lie) answers as the placeholder box flagged geometryPending: true, in post-fit meters × authored scale with GeometryScale deliberately skipped (declared extents are already the fit target; a held-stale factor would double-fit). Partial or absent layouts still answer null, now with a loud-once (entity, script) runtime-log teach naming the loading model and both cures. Subtree unions (getWorldBoundsBoxWithChildren, god-mode grips) propagate the flag when any contributor is a placeholder. The read stays pure: no waiters parked, no spec mutation, no components touched (pinned in world-bounds-api.test.ts). Docs regenerate from the source JSDoc; getWorldBoundsBox joins the always-on Properties scent (the invisible-verb law — coverage-test ledger entry 2026-07-30) and a BOUNDS_DRIVEN_ASSEMBLY example rides api-reference.
• Collider overlay in Savi's eye (gap 2): view_live_scene({ colliders: true, camera|frame }) composites the F3 collider view's exact wireframes into the capture — same sim-side builder (physics/systems/collider-view.ts), same lume overlay-lines geometry, same color code (static green, character cyan, dynamic/kinematic orange, sensors yellow-dashed). A counted debug-state hold (armSceneViewColliderHold) arms the builder for the capture's duration without opening the inspector; hold-only views carry captureOnly and are excluded from the player's live frames — no wireframe flash while Savi looks. The capture appends collider draws after scene draws (always-on-top) and reports colliderBodies, so a still-arming overlay captions an honest zero instead of "no colliders exist". Composes with burst. The plain viewport form refuses the flag loudly (the player's literal screen never wears wireframes).
• Live-vs-spec drift read (gap 3): new tome/live-spec-drift.ts owns the comparison Savi hand-rolled as a 314-object sweep while a recycled room kept wiping physics off the same 143 objects (dig 2bdedc41). Bounded to where it is structurally true: objects whose spec DECLARES physics; body-type equivalence through the spec's own words (character/vehicle compare presence only); resting feetPosition only for live-static bodies with plain-number authored positions (1mm epsilon); spec objects with no live entity count missing, never guessed at. Exposed on the debug surface family: the colliders: true capture result carries the report (over the physics.liveSpecDrift debug request — the include-only/never-arm rail), and the physics inspector panel appends the one-line verdict (2s-cached compute; also reachable via __spawnCollectDebugConsole panel pulls with the inspector closed). Zero cost while no debug surface asks.
• Frame-index collider lane + runtime-spawn coverage (gap 4): frame-mode object resolution (scene-view-bounds.ts) gains a collider-outline lane — own visual → parent-linked subtree → collider outline (armed overlays only) → honest miss — so an object that renders NOTHING (visible: false collider treads, invisible walls) frames by its collider shape when colliders: true is on. Runtime-spawned bodies ride every lane identically to authored ones by construction (the builder reads PhysicsBodyConfig off the live world, never the spec) — pinned by tests, alongside a pin that the original row shape (frame-index NOT-FOUND for rendered runtime spawns) stays dead (#10828 killed it).
• God-mode half-session no longer survives a reconnect (ledger 1886, dump 2f28abea). A room restart mid-god-session left the client holding replicated session state while the fresh room joined the player in play mode — the join reconcile reaps god wreckage server-side only (tome/lifecycle.ts), and reapGodModeWreckage had no client-realm caller. Now noteProjectionReset (the client's reset-boundary reconcile, beside the speculative-control/sim-lease/travel-cover flushes) reaps any god session whose god entity the reset snapshot did not re-show, through the same one teardown every other exit path uses (tome/god-mode/session.ts). A live session the reset re-shows (suspend-resume wake, mid-session recovery resets) is untouched; relay-wire worlds never reap (the local world IS the god-mode authority there).
• The raw-flip toggle is dead on the wire (the structural leg). dispatchGodModeToggle shipped god-mode.toggle with no {desired}, so a desynced exit INVERTED into an enter — enfeul's specimen: the first-entry DM re-fired in the fresh room and the server parked his player at the god pose (a 300 m owner split, god flight speeds in normal play). The sender knows which way it means the flip; now every shipped toggle stamps desired (the negation of the client's own replicated view) and the server's existing set semantics absorb a desync as a no-op. Old clients' bare frames still flip (decode-compat) and the dispatch log line carries legacyRawFlip: true so the raw-flip population is watchable. Local-authority dispatch (singleplayer, relay wire) keeps the bare flip — sender and authority are the same world.
• api.destroy('god/player/…') refuses with the teaching (the pre-#386 wreckage class). Savi's live repair destroyed the engine god entity from game code, out from under the session — dangling control-mapping halves, the exact class the one teardown exists to prevent. ObjectAPI destroy() now refuses the engine god namespace and any entity a live session claims, before any rail forward or local despawn; the error text teaches that sessions end through the engine's own exits and leftovers reap automatically. Non-god destroys, zero-match honesty (ledger 1247), and the server-side reconcile are all untouched (pinned).
• God mode no longer eats the game's own UI buttons (ravi's badgerblunts read cec6b199 §F′, request r-f670d207). The control-target resolution in tome/input-applier.ts routes the whole input frame to the god rig while god mode holds TomeControlTarget, so a creator's authored sendAction('join') button was silently dead exactly when they were most likely to be testing. The swallow was incidental, not designed — nothing suspended authored actions on purpose. Now sendAction rides the wire object-shaped whether or not it carries a payload (input-resolution.ts; hardware binding pulses stay plain strings, so the shape IS the origin bit), and the applier fans the sendAction plane — object-shaped, non-god:* actions only — to the god-moded creator's parked body with empty axes. Hardware stays the god rig's (Space flies the camera, the parked avatar never jumps), god:* chrome stays the god rig's, vehicle/turret control transfers keep the documented "handle it there" routing, and the primary god dispatch is byte-identical to before.
• Unknown-API teaching: reads never fault, only invocations do (badgerblunts §6, request r-eb34af9f). The teacher's throw-on-property-read semantics detonated the universal JS existence probe — world && world.screen && world.screen.width threw every render frame from inside the && guard, and a taught try/catch swallowed it into a 46-minute invisible-UI incident. Now a read THROUGH a teaching thrower (api.screen.width) returns undefined and delivers the full teaching message once per name via console.warn (getLogs / ui.log), and a namespace miss (music.fadeOut) answers with a callable thrower instead of throwing at read time. Phantom CALLS are unchanged and stay the loud teaching channel: api.updateMaterials(...), music.pause() throw the same teaching TypeError text as before (ledger #699 / ledger-805 messages preserved verbatim). Named residual: a bare if (api.foo) probe still reads truthy (the documented tombstone tradeoff), and world still has no real viewport surface — the world.screen reach itself is an API gap left open deliberately (new surface gates on vocabulary review).
• The identify verb — savi's "what object is this?" query (r-8c412240). Third eye of the inspection family: identify_object maps a screen position (0..1 image fractions through the live camera), a world point (nearest-by-bounds, 0 = inside), a world ray (first visual hit per entity, terrain included), or a name (case-insensitive id match: exact > prefix > substring) onto object ids with kind + world bounds + position + parent link. Resolution is renderer-side over the live lume stores (renderer/scene-identify.ts, riding lumeSceneRaycast and the scene-view bounds vocabulary), so matches are RENDER truth — colliderless spec dressing matches (the spawn-pusher verdict's six-wrong-objects case), and by name a live-but-unrendered record answers honestly with bounds: null. Every lane's ordering is deterministic and pinned (__tests__/scene-identify.test.ts); a miss is an honest empty, never an error. Wire: one new identify renderer-worker message + the identify_object client RPC (spawn.ts dispatcher, _entry/client/scene-identify.ts validation); chat-side the tool enriches matches with authored-spec facts (place, one-word visual summary, tags, behavior, parent — authored: null = runtime-spawned) and translates the pre-verb engine's "Unknown client RPC method" into the engine-version fact. No spec words, no ObjectAPI surface — a read-only query lane.
• Head-pose/gaze primitive: direction-form IK targets (r-29637275). { yaw, pitch? } in degrees resolves at the sim plane from replicated entity state alone (feet + rotation → a far aim point at 1000 m along the body-relative direction) — deterministic across realms, follows the body as it turns, needs no bone reads at authoring time, so nothing exists to misread before the model loads (the class savi's savi-gaze-steer.js/savi-behavior-kick.js kick-scripts hand-rolled). Direction-authored channels carry wide look clamps through DrawIK (maxYaw 179°, maxPitch 89° — a stated pose is honored; the exact antipode is excluded because a 180° swing has no unique axis), consumed only by the head solve; point/object/script channels carry no clamp fields and stay byte-identical (pinned). updateIK/properties.ik/getIK all speak the form; getIK echoes the authored direction: { yaw, pitch } alongside the resolved point.
• Pose/IK application is model-load-order independent (r-29637275's second demand). draw/ik and draw/mixer are change-driven renderer forwards; a value arriving while the entity had no model visual was dropped by the store and never re-sent, so a pose set before the model property landed was permanently lost when the visual was created later. The models store now holds the latest ik/mixer per entity (the shadowIntents pattern) and seeds visuals at creation; a model remove + re-add re-dresses from the hold (the components still live entity-side), and DESPAWN disposes it. IK/mixer arriving while the asset is still loading was already held on the visual and is unchanged.
• Joining clients no longer replay hosted onSpawn (ledger 1867, tucker's sev — the car-in-pieces join): kernel-tier clients are spec-built + delta-corrected, and spawnObject ran the composed onSpawn with zero authority consultation on whatever client materialized a spec object locally first. At join, the global-AOI spec can land before an entity's AOI-scoped replicated CREATE row, so the joining OBSERVER built race-car from def bytes and replayed the host's onSpawn — deterministic-id duplicate children, local physics/pose stomps, a locally-diverged pose the host's fan-out then fights forever. The replay fired even with the host table present and naming another client: the spec-build lane never consulted it.
• The fix is one predicate at two lines, not a new mechanism: spawnObject and teardownAndRerunOnSpawn (the script-edit rebind sweep, which re-ran onSpawn ungated on every client per revision — same class) now skip execution when isClientAuthObserverEntity — the existing classification behavior-update/interaction-dispatch already gate on, fail-closed pre-table (absent host table → not simulated here → skip). The entity still materializes everywhere (spec-built warm start; late-join visuals keep working) and the simulating side's fan-out carries the authoritative state. Observers skip the rebind teardown too: their owned-children rows are replicated entities whose destruction (and onDestroy hooks) belongs to the simulator; compile-registry updates stay unconditional, so an observer's compiled spec stays fresh for a later host adoption.
• Genesis execution is unchanged on every authority: server worlds keep running onSpawn at spec apply — including RELAY-TIER server worlds, whose applySpec deliberately compiles and runs object behaviors as the world-structure generator class (sim-tier.ts option-(b) carve-out), so no deferred re-delivery machinery is needed; singleplayer clients keep running everything (the local client owns everything); the named place-host client keeps its runs.
• Pins (join-hosted-onspawn-replay.test.ts — the 5 core pins dug and red-tested by the pin-1867 dispatch, report cfd3e5a1, adopted with the fix): observer + absent table and observer + other-client table execute nothing (formerly red), host client / server world / singleplayer keep executing (controls); plus relay-tier server genesis, and the rebind-sweep sibling lane (observer skips the revision re-run; host client and server keep it).
• Join-liveness watchdog (ledger 1888, the warm-room join-starvation class): a room on the old 4.2.0 pin admitted only bootstrap-time sockets and silently starved 13/13 later joins (~25–35s each, zero egress) across two multi-minute windows — every reload landed on the same wedged-warm worker, and the idle reap was the accidental cure. The shell now treats starvation as evidence: JOIN_STARVATION_RECYCLE_THRESHOLD (3) CONSECUTIVE starved joins (each one a full 45s join-honesty deadline of proven zero egress) while the room holds ZERO admitted players recycles the isolate NOW through recoverFromWedge — the same teardown the tick deadline uses, escalation ladder to the terminal park included. Conservative by construction: one admission anywhere resets the streak (SocketGateway.onFirstFed), a room with live admitted players never recycles on a newcomer's starvation (hasFedConnection gate — that starvation stays log-only, stamped roomHoldsAdmittedPlayers/starvationStreak on the room-do.join_starved row), a slow-but-alive boot feeds its first socket inside the deadline and never strikes, and every recycle resets the streak so a wedged replacement must re-earn all N strikes.
• room.join_starved finally sent (reserved since ledger 1460, named by 1695(b)): fireJoinStarvation sends the verdict frame immediately before the retryable close, so the client can say "room stuck, retrying" instead of an eternal "Starting game…". The reservation's hazard — a pre-close frame on a RETRYABLE close resets the client's first-message authenticated latch and reconnect budget every cycle, so a permanently starved room loops forever — is discharged by byte identity, the LIVENESS_BEAT_FRAME pattern: the message is now field-less so the whole frame is one constant (JOIN_STARVED_FRAME) the client latch exempts before parsing. Past the latch it parses as a normal control message; the runtime worker posts the honest "The game server is stuck letting players in — retrying…" loading state (a parsed server verdict outranks the boot-flap silence gate), cleared by the boot's real Ready. Client and server ship in the same engine bundle, so the sender and the exemption always travel together.
• Pins (room-do-join-starvation.test.ts, room-runtime-resilience.test.ts, connection-presentation.test.ts): the 1888 shape recycles at N and the fresh isolate admits again; live-resident rooms never recycle; an admission between starvations breaks the streak; healthy churn accumulates nothing; the verdict frame reaches the same bounded reconnect terminal as the no-frame arms (budgets never re-armed) while still parsing into ingress; the starved verdict posts pre-Ready and clears at Ready.
• Held level axes no longer fabricate a release on frame-less render passes (ledger 1879). runFrame's steps==0 branch runs renderPrep alone at display rate between fixed 60Hz sim ticks; camera-behavior calls onInput unconditionally with framesSince() empty, mergeCameraAxes([]) produced {}, and the input Proxy minted 0 for every spec-defined-but-absent axis. Any custom camera reading a held key-bound axis on a display outrunning the tick rate saw the axis oscillate commanded/0 at the render/sim beat — tiger's lean camera equilibrated at ~half depth with a 60Hz roll shiver, and his script-side guard was defeated because the fabricated 0 is indistinguishable from a real one. Fix: merged level axes persist in camera modeState exactly like heldInputActions and are served on frames.length === 0 passes; the snapshot is replaced (never merged) on every real pass, so explicit releases (the explicit-zero law: key-bound axes ride every frame as ±1/0) and quiet analog sources clear it naturally. Delta axes are excluded from the snapshot — absence of a frame genuinely means no new motion for them, so the proxy's 0 stays correct. The law: absence of a new input frame reads as the last-sampled level value, never 0 (memory/shared/absence-is-never-a-value.md).
• Scripted-primitive re-mint is now LEVEL-triggered, killing the stranded-mint class (ledger 1880; dig 33af4d53; closes #1069's admitted residual). #8455's re-mint lane was edge-triggered (fires only on the one applySpec whose detectChangedScripts is non-empty), def-driven (iterates spec defs only), and single-world — while recipe rows are level state. Three lanes carried stale rows past it forever, each a permanent scriptContentSkew derive-mismatch stranding post-edit joiners on terminally invisible geometry (savi's observed split on Pixel Online c37f7ea3: mint-era clients see stale-but-visible meshes, everyone else sees nothing): (a) def-less runtime spawns (api.spawn / children(ctx)) unreachable by the def loop; (b) worlds booting INTO the post-edit spec (detectChangedScripts(undefined, …) is empty by design); (c) TomeScriptedPrimitive is clientAuthWrite:"owned", so a stale backgrounded owner re-uploaded pre-edit recipe+pointer rows over the server's re-mint. The fix is one enforcement funnel (tome/scripted-primitive-remint.ts) for the invariant recipe.scriptHash == buildGeneratorScriptContentHash(currentScripts, recipe.script): applySpec sweeps entitiesWith(TomeScriptedPrimitive) when the scripts identity moved and on a world's first apply; the isolate-swap restore lane sweeps after overlaying captured rows; the upload drain re-judges every adopted recipe row (stale hash ⇒ re-mint from the adopted script/params/seed — the owner's intent survives, the stale mint does not; the deliberate single-writer exception, since the scripts registry is level state only the authority holds current). Cost: one memoized hash compare per row, only on script-move/first applies and recipe-row ingest. The ground-redrape system's local re-mint funnel deduped onto the shared one. warnDeriveMismatch's cause-1 prognosis ("converges when the server re-mints") was provably false for def-less/LWW-stranded rows — the sweep makes it true, and the text now names the mechanism.
• Orphaned one-shot fx are reaped by the room authority (5.0 debug day #69 class; DUST LINE's measured instance: 15 anchors from two departed sessions pinning ~70 of 256 fx slots). fx-reap ran only on an entity's CURRENT simulator, and a fully departed session's fx has none: the leave path's raw avatar despawn breaks the fx's TomeSpawnedBy chain, the server's owner walk reads null → yields it as place remainder, while every host's walk reads the broken chain as dangling → maybe-owned, never adoptable. No peer's predicate ever claimed it again, so the anchors pinned fx slots forever — a creator hand-wrote an allowlisted janitor script as the backstop.
• The fix is one deterministic gate, not a scan heuristic: on the client-auth SERVER world (full world knowledge, no AOI — a broken link there is definitive), a runtime fx whose replicated-owner chain is BROKEN (isReplicatedOwnerChainBroken, the same single walk body the host predicates read) joins the ordinary track → derive-completion → reap pipeline with the same fresh conservative clock any successor simulator starts, and counts toward the same runaway cap. No client can be simulating a broken-chain entity (owners walk the same chain and lose it; hosts refuse dangling), so adoption can never cross another writer.
• Deliberately NOT reap-on-disconnect (engine-principles test 8): departure changes WHO reaps this one engine-owned lifecycle class — self-reaping one-shots with no behavior and no spec entry, whose lifetime fx-reap already owns — never whether or when it would have reaped. Looping/scripted/spec-backed orphans are untouched (the cap remains their backstop); general departed-ownership reversion (ledger 671 / #7414) stays separate work.
• Pins (fx-reap.test.ts orphan-adoption suite, red-first): a departed client's finite one-shot reaps on the authority at completion + grace from adoption (formerly leaked forever — the red run pinned it surviving 10k+ ticks); a CONNECTED owner's identical fx is never adopted however long it lives; an adopted LOOPING orphan is never lifetime-reaped; a connected client's own fx still reaps on its own simulator; the existing clean-unowned place-remainder pin (host reaps, server abstains) stays green.
• playSound(clip, { mode: "restart" }) — the Pokemon-cry law (ledger 1705, dig 0f49d653). A new play of the same clip from the same emitter REPLACES the still-playing copy instead of stacking: the client sweep despawns the emitter's live same-clip one-shot voices before minting the new one, and the teardown rides the same cull fade the governor's steal uses (VOICE_CULL_FADE_SEC, 50ms) under the fresh attack transient — no click. The sweep runs AFTER the per-clip governor so a within-floor (~30ms) retrigger drops the new play and the standing voice keeps ringing; replace-then-drop would go silent. Scoped to (emitter, clip): other emitters' voices and the emitter's other clips are untouched. Anything other than "restart" — including the explicit default "overlap" — lowers to the absent wire field. Loops ignore mode (a loop is a keyed channel; there is nothing to replace). Previously this was inexpressible in ObjectAPI (~3 lines in raw WebAudio): repeats summed toward ~8× loudness and then the 8-cap steal-oldest broke sustained triggers — "louder and louder until it breaks".
• One-shots are stoppable (ledger 1706). playSound minted an id only for loops or onSoundEnd behaviors and returned "" otherwise, and the client stopSound consulted the loop registry only — a one-shot voice was unstoppable by construction, so every script clamp built on stopSound(id) was dead code that reported success (the enfeul specimen published on one). Now every play mints the deterministic handle (unconditional mint = TomeIdSeq lockstep by construction on server and predicted client), the id rides the wire, the one-shot registry records soundId + source entity per voice, and the client stopSound falls through from the loop registry to the one-shot registry. Unknown ids stay a no-op.
• Pooled-id recycle hazard closed for the new teardown lanes. The restart sweep and one-shot stop despawn voices whose renderer teardown is still in flight, keyed by entity id — releasing the pooled id there recycles it straight into the next minted voice, and the in-flight completion would reap the fresh voice (reproduced in the red run: the replacement voice died to its predecessor's completion). Those lanes hold the id out of the pool; the completion drain (cleanupCompletedSoundEntities) returns it once the teardown reports, and a missed completion falls back to minting, never to a collision (the pool's own law).
• Poke convergence — the stale-latest-read strand closed (spec-delta continuity F2, design 67870fb4 §3; the 1537 family's server face). Kiln's save fanout pokes /rooms/{id}/update with the dbVersion it just committed; the room answers by fetching kiln LATEST and applying behind monotonic gates. Nothing compared the FETCHED version against the POKED one — so a latest read that lost a race with the commit (replica lag) skipped-or-applied old content and returned 200 while the room silently stayed behind until the next unrelated save: a dead write with a receipt, structurally invisible to the spec-skew heartbeat because the server head and every connected client AGREE on the stale head.
• The rule: fetched < poked is a provably stale read, never truth — kiln commits before the fanout ever fires, and dev latest is append-only (revert CAS-publishes a NEW head). applyTomeSpec now tracks the highest poke-named version as a convergence floor and re-arms the existing frozen-stamp self-fetch lane (the same bounded-backoff fetch a self-authored gap uses, ledger #352) each stale round, so the 200 means "applied or converging", never "read whatever was lying around". The apply itself is untouched: the fetched content still flows through the ledger 1268/#352 echo-dedupe and stale/self-echo gates byte-identically; the floor only decides whether a follow-up fetch is owed.
• Bounded stand-down, loud: on the live lane a rollback publish can legitimately move latest backward (game_publishes resolves by published_at, not by version), so a claim that never converges stands down with a warn after 8 stale rounds (~90s of 1s→30s backoff) instead of retrying forever. updateSlug-pinned rooms never track — their fetch pins a published version by design, so "latest < poked" there is the pin working.
• Plumbing (the design's verify-first item, confirmed): the DO/container shell passed the poke's dbVersion into ApplySpecRequest all along, but EngineHostCore.applySpec dropped it before applyTomeSpec on the ambient tier. It now rides into ApplyTomeSpecOptions.dbVersion. On loopback (workerd DO) hosts the primed spec already carries this exact version, so the comparison is a tautology there — the shell-side fetch's own stale-read exposure on that tier (dispatchUpdate stamps payload.dbVersion ?? fetched.version) is a named sibling seam, not covered by this change.
• Relay-tier head beacon (spec-delta continuity F3, design 67870fb4 §3 — ledger 987's invariant extended to the relay tier, ends-only). On the relay tier a save rides as one edge-triggered SPEC frame; if that one delivery died (a swallowed fanout send, a seq hole handleSequenced consumes silently, a single-occupant room with no peer to hear anything from), the client stayed one version behind until the next unrelated save — F1 (#11585) chases a fetch it KNOWS about forever, but nothing re-stated a head the client never heard. Now the relay re-states its own durable meta on every heartbeat echo: relay-do.ts stamps journal.getCheckpoint().pointer onto the echo (zero payload parsing, zero decisions, one field — the dumb-pipe law holds; a never-checkpointed room echoes the exact pre-F3 shape). Client-side, the session surfaces the pointer verbatim (onHeartbeatPointer, wire-layer only) and the join coordinator parses it with the existing parseRelaySpecPointer, compares the named dbVersion to the adopted head, and — only when behind, only once the world is baselined — arms the SAME F1 fetch loop a sequenced SPEC frame would (armSpecClaim, the one shared door; never a parallel retry system). Because savi's spec lane checkpoints on every save, the pointer is fresh-versioned on exactly the live-edit rooms the strand class lives in: a dead SPEC frame now decays into ≤ one 2s beat + one bounded fetch of staleness. The host-tick peer-gossip hardening the design names stays deferred (not load-bearing).
• Inert by construction everywhere else (never worse than today): absent pointers (old relays, never-checkpointed rooms), latest pointers (dbVersion-free by design), unparseable/legacy pointer shapes, versions at-or-behind the adopted head, and mid-bootstrap arrivals (the join machinery owns convergence until baseline) all do exactly nothing. Repeated beats during an armed backoff hold F1's ladder floor — a dead edge sees the 48s-capped cadence, never a 2s hammer — and a newer SPEC frame supersedes a beacon-armed claim instantly, while an older beacon never downgrades a pending claim. A wrong-typed pointer decodes as absent (lenient like welcome.connected): the beacon is advisory and the heartbeat is the liveness signal, so a malformed rider never condemns a socket.
• Pins (red-first — on the pre-F3 code the wire decoder drops the field, so the core test died with the head stuck at 9): relay-join.test.ts F3 describe drives every echo through the REAL wire decoder — behind-by-one arms the loop and adopts within the beat, loud once per armed claim; the empty-world single-occupant fresh room adopts the first save named by a beacon (head null counts as behind a concrete version); controls pin pointer-less/latest/at-head/behind-head/unparseable beacons byte-identical on the event stream. relay-wire-session.test.ts pins the additive decode + the hook surface with bookkeeping identical for bare and stamped echoes. heartbeat-head-beacon.workerd-test.ts pins the real DO: bare pre-F3 echo before any checkpoint, the accepted marker's pointer re-stated verbatim to EVERY socket (checkpointer or not), and the beacon tracking checkpoint advances.
• A known spec hole is never abandoned (design 67870fb4 §3 F1 — the nexuiz strand's codified door). On the relay tier a save rides as a sequenced SPEC frame naming a dbVersion; the client fetches that version via the edge. The fetch ladder was 3 attempts with 1s/2s backoff, then a permanent give-up — "the world stays on its current spec until the next save or rejoin" — so a ~3s edge/store hiccup left an ACTIVE client one version behind indefinitely (7 minutes in the field, healed only by the next unrelated save). Worse, a positive-204 gave up after ONE attempt: the store's "that version does not exist" was trusted over the durable sequenced claim that it does — the frame is proof-of-existence (the writer saved, acked, checkpointed); the store read is the lagging party. relay-join.ts now chases the hole with the same withheld-content shape the kernel tier ships (tome/spec-resync.ts — doubling backoff to a 48s cap, forever, loud at each miss), 204s included. pendingSpecUpdate stays non-null through the flight as the loop's liveness truth, so every async resume point re-validates against live state: a newer version superseding cancels the armed wait immediately (a fresh save never queues behind a dead version's 48s timer — host.schedule has no cancel, so a bumped token deadens the old timer), the room reset kills the loop, and the loop survives socket bounces (the hole belongs to the room's spec lineage; a resume re-delivers nothing whose seq was already seen, so the loop is the only healer there). One pending fetch at a time, exactly as before. The one remaining genuine give-up: a realm with no ctx/variant coordinates structurally cannot fetch (unchanged, warns once).
• Pins (relay-join.test.ts, red-first — the red run died at 3 attempts / 1 attempt for 204 verbatim): a fault retries past 3 on the doubling ladder 1s → 2s → 4s → 8s → 16s → 32s → 48s (cap) and adopts when the fetch lands, loud at every miss, never a failJoin; a 204 for a frame-named version retries the same way and adopts when the store catches up (join-time 204 semantics untouched — pointer/fresh-room pins all green); a newer version cancels the older armed wait and fetches NOW, dead timer inert; the loop heals across a socket bounce; happy path, burst coalescing, replace-at-head triad, and replay coverage byte-identical (39 pre-existing tests unchanged and green).
• Flatten-along-spline: kind: "road" marks carry a spline and project the whole road footprint from that one curve (r-7e87c657, ledger 1148's shape). spline: [[x, y, z], …] control points resolve through a new 3D centripetal Catmull-Rom sampler (sampleCentripetalSpline3D, the 2D river sampler's sibling — interpolating, cusp-free, curvature-adaptive, the same law #10898's drape crests ride) into one dense centerline + height profile per mark, and every consumer measures against it: terrain FLATTENS to the curve's authored Y profile across the corridor (width, then a falloff shoulder blending back to natural ground — smoothstep, default max(2, width/2)); material/edgeMaterial PAINT the same corridor (unchanged road edge-band law, now curve-following); and object scatter CLEARS off corridor+shoulder (clearScatter: false opts out — honored by legacy roads too). Roads apply after the water kinds in mark order, so the authored curve is authoritative where it crosses a carve (causeway, not trench). Legacy points roads: never move terrain, pinned paint weights, no behavior change (controls in marks-road-spline.test.ts); path/area flatten marks resolve byte-identically (shared profile sampler refactor is arithmetic-identical). Schema: TerrainRoadMarkSchema gains spline/falloff/clearScatter, points+material go optional; api-reference/heightmap-terrain docs regenerated from the schema.
• Schema-hash connect-time comparison — the registry-skew ghost class closed (#11216 §schema; request wf-a43d8b69). A client connecting with a stale/skewed component-schema registry used to read as a GHOST: entities exist server-side but deserialize wrong/empty client-side (unregistered names drop row-by-row at the shared apply core; changed encoders read garbage), and #11216's dig verified no client↔server schema comparison existed anywhere on the join path. Now the client declares its registry's content hash (ComponentRegistry.schemaHash() — already sorted by name, replicated components only, wire-contract fields only) as ?schemaHash= on the connect URL at every dial (the hostEligible pattern: URL → SocketAttachment → connection.attach, surviving hibernation restore and isolate-swap reattach), and the server's netcode attach compares it against its live registry.
• Mismatch is a NAMED outcome on both sides, accept-with-warning: server netcode.schema_skew warn log (roomId/clientId/both hashes, deduped per socket + hash pair so restores/swap reattaches don't spam while every real reconnect re-fires) + a schema.skew control frame to the client, which console-warns both hashes with the reload recovery and reports the allowlisted netcode-schema-skew engine-diagnostic — so the fact lands in Savi's getLogs (log-only, no DM: skewed joins during deploy windows are planned churn, the renderer-degraded-adapter #8779 lesson). The behavior ladder's shipped rung is accept-with-warning because the hash is opaque content evidence: it proves the replicated wire contract differs but carries no direction (which side is older) and no compatibility grade, so a hard refuse would kick sessions a benign additive skew leaves playable AND reload-loop the server-is-stale direction (a reload fetches CURRENT bundles, which re-skew against a stale long-lived room). The one direction a reload provably heals — client-stale COLD boots — already hard-refuses with reload copy at cf-edge's stale-hash 409 (ROOM_ENGINE_STALE_CONDITION).
• Named residuals: a pre-mount first dial carries no declaration (the registry doesn't exist yet client-side; every post-mount reconnect declares — and the deploy-window skew class reconnects by definition); relay tier is registry-less (peer↔peer skew is a different seam); post-attach server hot-reload skew is compared at the next (re)attach, not mid-session.
• Singleplayer dbVersion-skew watchdog (spec-delta continuity F4, design 67870fb4 §3 — the K2 strand, last leg of the program). The ledger-987 skew lane is deliberately inert in singleplayer: revision counters are minted independently per realm (ledger #718), so getLocalSpecHead answers null there and a dead control-lane spec push — a Savi save the room applied whose tome.spec.push never reached the authority — had NO detector (the withheld-content rail, #7613/ledger 1825, only fires for pushes that arrive and are gated). The heartbeat already reaches suspended singleplayer connections; it now carries enough to audit: noteSingleplayerSpecSkew (room-runtime.ts) compares the beat's claim on the two axes both realms share — kiln dbVersion and structural content hash — and arms ONLY when the server is strictly ahead on dbVersion WITH mismatched content. Sustained past the same 10s window, the episode is handed to the EXISTING withheld-content resync backoff (requestWithheldContentSpecResync — its 48s-capped doubling floor, server-side kiln-lineage adjudication, and #718 admission gates all unchanged; spec-resync.ts is untouched by this PR), never a projection reset — the singleplayer projection is suspended by design. The answer adopts through the ordinary dbVersion gate and the strand decays into ≤ one beat + one bounded fetch.
• Why the compare is dbVersion AND hash, not dbVersion alone (the 987/#718 inertness audit this leg was budgeted for): dbVersion-behind with EQUAL content is the healthy steady state of every singleplayer session — the room persists this client's own forwarded writes and stamps the new version with no push (noteAuthoredDbVersion), so a bare dbVersion compare would fire on every idle world after every autosave, turning the persist cadence into a permanent kiln-consult + full-doc-fetch cadence. Hash parity names that state silent. The armed clock carries the 987 armed-evidence discipline transposed onto dbVersion: delivery proof is the ARMED version landing (busy worlds — perpetually one persist behind, adopts jumping to emit-time heads — clear within a beat and never sustain), evaluated only at post-apply instants (thaw bursts acquit first).
• Inert by construction on every case the current inertness deliberately protects: multiplayer worlds — including Suspended hidden tabs whose withheld deltas are healthy — report a null singleplayer head (readSingleplayerSpecSkewHead is getLocalSpecHead's exact mirror; the 987/F3 lanes own those tiers and their code paths are untouched); revision divergence of any size or direction never consults this lane; content mismatch AT the dbVersion tie stays the withheld DROP rail's jurisdiction (its pushes arrive — arrival is its trigger); mid-bootstrap (no world, no baseline, no dbVersion stamp) and old servers (no beat head, no dbVersion, no hash) are unknowable and never skew; socket death discards the clock; relay-tier singleplayer never records a kernel beat head at all (F3's pointer beacon owns that tier).
• Pins (red-first — on pre-F4 code the lane is inert, so the strand test dies with zero fires): room-runtime.test.ts F4 describe — the K2 strand arms/sustains/fires/converges; controls pin the self-persist stamp lag (60s behind-with-equal-content, silent), revision divergence at the tie (silent), mid-bootstrap and protocol-additivity disarms, the busy-world armed-delivery ladder (60s, zero fires), thaw acquittal, socket-scoped evidence, and the multiplayer lane firing its 987 heal with both hooks installed while this lane stays dark. runtime-worker.spec-push.test.ts pins the head reader's null cases; netcode-upload-echo.test.ts pins the beat carrying {revision, dbVersion, hash}.
• Wrap/repeat decoupled from plate-class (r-1f85d7ec, plan p-35fbe727 item 3). repeatX === true reclassified a world sprite to plate-class (sprite-appearance-rules.ts + the lume copy in sprite-logic.ts), so asking for a repeating texture silently bought unlit + unbatched + camera U-recenter. Both classifiers stop consulting repeatX; plate-class remains parallax + the moodboard plate grammar (backdrop-*/strip-*/floor-*). Aligned with #11486's move one surface up: wrap is sampler address state, carried by the texture lease, never a class.
• spriteWrapModes(sprite) is the one wrap rule (sprite-logic.ts): U wraps for repeatX or an authored uvRect overflowing U; V wraps for an authored uvRect overflowing V; everything else clamps. Three consumers, by construction in agreement: the texture lease options (spriteTextureOptions), the batch key (a |wrap: segment appended only when wrapping — clamp keys stay byte-identical), and the texel-AA snap exemption (the AA sampler is linear-clamp; substituting it would stomp tiling).
• The resurrected three-era strip machinery dies again (sprites.ts): repeatRecenterX (whole-tile camera recenter) and the world-sprite 3×-quad span (1 + 2·tilesX in packVisual and the bounds path) are deleted; getSpriteBatchKey no longer nulls on repeatX. Camera-attached strips are untouched — resolveCameraAttachedPlacement still spans the viewport and scrolls the UV phase.
• Sim raycast parity (tome/api/sprite-raycast.ts): a repeating world sprite has an observer-independent quad again, so the lane hits it — what the player sees is what the ray hits. Parallax and camera-attach exclusions unchanged.
• Torn-parent heal goes LEVEL-triggered, closing the two proven heal holes of the marionette-tear class (ledger 1884; dig 58262db3). Authored parented children were observed losing their live TomeParent mid-session and freezing at stale world coordinates while their roots kept moving — whole actors dismembered at one instant, spec rows healthy the whole time. The reattach pass (rebindExplicitParentObjects) provably heals this — but it was edge-triggered, running only inside a content-CHANGING applySpec, which left two holes: (1) the delta-0 short-circuit (interpreter.ts) skipped it entirely, so every join/reload/reset re-applying the SAME revision left a torn room torn forever (field receipt: a creator's client reloaded and the room was still torn two minutes later); (2) a fresh client's first spec apply ran before its AOI rows existed (hasEntity false ⇒ silent skip), so entities landed torn from replicated rows with nothing left to re-run at that revision. The fix: a spec-entity index (TornParentHealIndexResource: runtime child id → authored def, derived by the exact rebind derivation, cached against doc identity + place-instance registry content) and one sweep over it (sweepTornAuthoredParents — O(authored parented rows), heals missing/dangling edges only). The delta-0 short-circuit now runs the sweep (precedent: it already ran the spline-orphan sweep — both are state-dependent passes no content compare can veto), and a new simulator-resident system (tome/torn-parent-heal, every 30 ticks, beside lifetime-reap) enforces the invariant between applies on the world that simulates the entity, so a host-side tear heals at its home and uploads through the owned component lane. A heal fires tome.parent_heal.reattached — loud while the tear's origin remover is still hunted (the O1 mask-fold apply-diff lane is disconfirmed by a committed probe; origin fix lands separately on its receipt).
• Wheel over UI never reaches world input — the same silence presses already get (ledger 1883, savi-filed f98584b1). A wheel over a god-mode/creator-tab panel scrolled the panel AND zoomed the world: the frame forwards every wheel with its overUi verdict attached (input-forward.ts, capture-phase document listener — authored stopPropagation can never suppress it), but the verdict died in both host sinks of routeWheel. Raw-capture lane: ForwardedWheelPass carried no overUi field, so the sole gate was slot geometry (always passes fullscreen) and the delta rode the input ring → mouseWheelDy → any spec binding wheelY (NEON APEX's zoomIn + camera-chase = the felt zoom). Transport lane: handleWheel was gated only by slotBlocksWorldPress, a press-shaped predicate whose !pointer.overUi press-exemption (correct for presses — press consumers read the paired overUi flag) wrongly admits over-UI wheels, whose delta has no such pairing. Fix at the boundary, since authored axes structurally can't check: ForwardedWheelPass gains overUi and injectForwardedWheel drops over-UI wheels before the ring (mirroring pressMouseButtonIntent's overUi silence); the transport handleWheel drops the wheelDelta whenever the event's own verdict is overUi, regardless of slot state (freshness post still ships, mirroring the slot-blocked branch); and the native raw-capture wheel listener gets the same data-input-capture hit test (canon §3 one-code-path law — native overlay and realm agree). The god dolly's own sim-side overUi re-check (scrollConsumedByAuthoring) was the one protected consumer; now every consumer behaves like it. Presses are byte-identical: slotBlocksWorldPress itself is untouched.
• Lazy view materialization (ledger 1894 leg a). buildObjectView ran all ~40 propertyGetters per api.getObject call — spec locates and deep clones for properties the calling script never read, per entity per tick (dig c961d106: 17.2% of MechaBlade's sim-worker busy CPU inside this loop, GC sawtooth 65→96MB from clone garbage, worst tick 287ms). The view's properties bag is now built on first access, and each key is an enumerable accessor that memoizes into an ordinary data property on first read. Key set/order, spread, Object.keys, JSON, structuredClone, local assignment/delete, and per-view value stability are all preserved (pinned in object-view-read-path.test.ts). Script-transaction overlay worlds keep the eager snapshot (their staging worlds die at commit).
• Spec object index (leg b). findSpecObject ran a findIndex linear scan over every place's objects array per call — the top JS leaf in the trace, reached per read through the spline/blueprint/brush getters. Now an id→row index per spec identity (WeakMap<GameSpec, …>, the SPRITE_DEF_INDEX shape), revalidated per lookup by a freshness walk (places-record identity, per-place array identity AND length) that mechanically catches the one in-tree in-place writer (ensureSpecEntryForSpawn's spawn-stub push) plus place add/delete/REPLACE under an unchanged root; hits additionally validate the row's id and fall back to the verbatim linear reference on any mismatch. Precedence semantics (hint place → entries order → legacy scope → namespaced-id fallback, first row wins on duplicates) are pinned test-by-test.
• Cheaper isolated clones (leg c). The model getter's per-read structuredClone(parts) becomes cloneSpecValue (the plain-data cloner the spec getters already use). Reads stay per-read copies rather than shared frozen views — deliberately: the mutate-then-write-back round trip (const m = …model; m.parts.X.visible = false; setObjectProperty('model', m)) is a documented creator contract (ledger #735), and sharing structure with the store would make the write-site equals gate compare the mutation against itself and silently drop it. Write semantics byte-identical; isolation pinned by test.
• Microbench (scripts/bench-object-read.ts, 600 authored objects + 120 runtime-spawned, bun 1.3.14): getObject+position/state 14.31µs → 1.05µs (13.6×); getObject+read model 18.10µs → 9.19µs (2.0×); getObject on runtime-spawned ids (the full-scan miss path) 18.24µs → 1.00µs (18.2×).
• Unknown playSound option KEYS warn once (dig ec4cb85d — the sfx-zoo fight). Savi invented a soundId: option and the engine swallowed it silently; her stop calls then aimed at a handle that never existed — three debugging rounds, zero engine feedback. The engine already warned on given-but-unusable VALUES of known keys (bus/priority/maxDistance); the unknown-KEY class now teaches through the same audio-verb throttle: once per entity, value-free dedupe key, the offending keys and the valid key set ride the first message. soundId among the unknowns names the true lane outright (playSound RETURNS its handle). Legacy gain/spatial spellings are read, so they never warn — but they're not advertised in the teaching list either.
• stopSound(id) with a never-minted id warns once; finished handles stay silent. Every handle playSound has ever minted carries the uniqueId("sound") shape; an id without it (and absent from the loop registry) was never a handle in any engine version — the typo/invented-handle tell, and exactly the id shape the sfx-zoo stops died on. A MINTED handle whose sound already finished stays silent: finished is normal, and the server keeps no one-shot liveness record to tell live from done. No-op semantics unchanged — the stop event still rides, downstream stays tolerant. The loop registry's silent-tolerance comment now points at the verb-site teach (the registry write also ingests relayed events, where a warn would be ops noise).

technical notes

• Bone-attached children join the render-composed rail (ledger 1860 — tucker's armor trailing its wearer). A tome/parent op carrying attachment.bone used to parse to parentId: null, transformAlreadyPresented: true: excluded from the renderer's parent-relative composed-child rings and drawn from raw wire rows that the SIM composed through the cross-worker bone-pose feedback — the bone's world transform from the renderer's LAST displayed frame, plus a channel hop. Net: worn gear = the body's drawn pose 1–2 render frames ago, trailing by speed (measured 0.39 units at a 0.25 u/tick sprint in the new harness). Now bone children keep their parent edge and compose RENDERER-side at draw time: parent's displayed pose ⊗ live bone local ⊗ authored offset — the live rig providers already register renderer-side (lume/models/skinned-character.ts), so the composition is same-frame with zero feedback round-trip. This is #11535's stand-rider rail (drawn composition against the parent's displayed pose at render cadence) extended to bone anchors.
• The drawn chain, not the physics chain: the new writeDrawnBoneTransform provider leg runs the base through the visual's own trailing chain (local offset ⊗ geomScale + ground-alignment lift — composeVisualWorld's math), so the bone lands where the body actually draws. The existing writeBoneTransform base leg stays deliberately lift-free (ragdoll seeds pin that contract).
• #7350 stays dead, structurally: the pass-through rail (transformAlreadyPresented + its sync path) is deleted, and bone children never seed a snapshot ring — the wire rows CANNOT be re-interpolated (the double-delay #7350 cured has no code path left). Pinned from both directions: corrupt the feedback channel and the drawn pose stays welded to the live rig while the sim rows dutifully carry the corruption.
• The feedback channel keeps serving the sim, unchanged: hierarchy-render-solve still composes the child's World* rows from the SAB feedback every renderPrep (gameplay reads, script queries, ecs-sync). Those rows draw only as the fallback while no live rig is registered (model loading / horde-batched parent — the ledger-#308 seed baseline), exactly the old first-frames behavior.
• Named gaps: a pivoted DIRECT bone child draws unfolded (the pivot fold needs bounds the op stream doesn't carry, and anchor inference can't serve here — a direct bone child's authoritative rows are feedback-stale, so the inferred anchor would bake in the trail); children NESTED under a bone child infer normally. Bone children of an interpolation-disabled or record-less parent keep the raw-row fallback.
• Running fx decks adopt every recompile — live .fx.js content edits included (ledger 1834 face 1). The renderer-side diffs (lume particles store, particle service, both backends) adopted a program only when FxCompiledProgram.sourceVersion (= FxEmitter.version) moved — but a live script-content save recompiles under an UNCHANGED emitter version, so a running deck kept executing the original program until the ref itself was rotated to a new filename ("the effect system reloads by filename, not by file contents" — savi taught filename-rotation as the workaround, baking ref churn into specs). FxCompiledProgram now carries compileSeq, a per-entity monotonic counter minted by tome/fx-compile on every program write, and every downstream diff keys on it: any recompile — params write, script edit, lib edit, cache-epoch reset — reaches the running deck by construction. The recompile-invisible-downstream class is unrepresentable now, not patched per trigger.
• fx decks honor visibility (ledger 1834 second face, incident b62bd296 THE VOW). The particle path never read draw/visibility: properties.visible = false hid the model while the deck kept emitting (mist visibly rendering while visible === false; same leak under the first-person body hide, the editor-only courtesy hide, and the foreign camera-attach gate — all DrawVisibilityOverride writers). tome/fx-compile now resolves effective visibility the way the mesh path does (client-local override wins over authored; layerMask 0 = hidden) and a hidden emitter drops its compiled program exactly like paused: true — deck gone next frame, unhide recompiles from scratch (decision 11; non-zero layer masks stay visible). fx.paused and api.destroy() behavior unchanged and pinned.
• Ground-follow lift gate (ledger 1853, tiger's car-bump): a kinematic character controller driven across a FLAT heightfield at race speed popped up to ~0.20 m in one tick and floated back down over the next several — track flat, zero script y-writes, autostep disabled. Mechanism (measured, ground-follow-lift.integration.test.ts reproduces it from a plain world): rapier's controller sweep collides with the SHARED edges between coplanar heightfield triangles and parry reports phantom tilted contact normals (n = (-0.28, 0.96, 0) on an all-zero field); collide-and-slide climbs the phantom ramp, and the taller the per-tick sweep the taller the climb — race speed turns a sub-millimeter artifact into a visible hop, and the motor's ground press (-6 m/s) takes ~3 ticks to bring the root back down. The float-back was never a separate mechanism; the up-pop is the whole injection.
• The fix verifies the output against the world instead of trusting the phantom: when the motor is pressing down (no commanded upward motion) and the computed movement still rises more than 5 mm, down-probes at the landed position — axis, thin lateral offsets, and leading samples out to the shape's full support reach along the motion direction (a rotated car box reaches 2.2 m lengthwise; slope entries and kerb step-ups ride the leading corner) — measure the ground that is really there. A rise the surface backs (slope, step, kerb) commits untouched; a rise into air gets clamped to follow the measured surface, and the grounded verdict rides the committed pose. Probe origins sit INSIDE the shape near the feet, so an overpass above the car can never masquerade as support, and embedded floors stay visible. Rays fire only on rising ticks (≥ 5 mm) — idle, walking, and flat cruising pay nothing.
• Not fixable at the source, and mantle needs none of this: HeightFieldFlags.FIX_INTERNAL_EDGES (rapier 0.19.3) only corrects the contact-manifold path — measured: controller pops byte-identical with the flag on — so the gate lives at the controller output seam. Mantle's heightfield narrowphase already folds neighbor-triangle normals structurally (narrowphase/static-heightfield.ts edge activity) and never manufactures the ramp.
• Pins: ground-follow-lift.integration.test.ts — (1) race-speed box on a flat two-chunk heightfield stays glued (pre-fix: +0.2035 m single-tick rise, red; post-fix: ≤ 0.0134 m, within contact noise); (2) a 15 % grade still climbs at race speed (the gate's leading-corner samples keep real hills honest); (3) a 0.2 m kerb still autosteps at driving speed.
• Per-binding input-map refusals (ledger 1851 residue (a), forensics 3b93f733 — tucker's pirate sloop): the input compile was already per-binding tolerant — a binding that can't resolve is dropped ALONE and its neighbors stay live — but nothing ever SAID so: resolveKeyBinding returned null silently, a case-broken code-shaped name ("Keyw") passed through verbatim as a binding that can never match an ev.code, an engine-internal axis declared in inputs.axes (aimYawSin: {} — the pirate map's exact content) compiled to nothing, and the only diagnostics were console.warns in whatever realm compiled the map. A creator sat pinned at spawn for an afternoon while Savi probed for what one write-time line would have named. New collectInputBindingFaults in input-config.ts shares the exact resolver tables (no drift possible) and emits one fault per broken binding — path, reason, fix, with the valid form suggested when the mistake is spelling case ("Keyw" → did you mean "KeyW"?, "escape" → "Escape"). Two lanes consume its printable form (capped at 12 lines + remainder): patchInputs warns on the mutation-warn rail (Savi's getLogs, at write time, validating the MERGED map so still-broken bindings re-warn on the next write), and spec-sync's control install warns on the client console ring once per distinct authored map (the existing inputs-signature gate) — so a map written by ANY path names itself.
• What faults, exactly: engine-internal axis declarations (ENGINE_INTERNAL_AXES — never bindable, the declaration does nothing); dead key tokens (silent-drop null resolutions AND verbatim-passthrough tokens whose case-fold matches a known binding); Tab (named reservation); wrong containers (axis keys must be a slash-string, action keys an array — a bare string binds each CHARACTER); unknown mouse/gamepad names with their valid vocabulary; junk activeOn/modifiers; near-miss field names on inert defs (key → keys). What deliberately does NOT fault: any case of a documented shortcut ("arrowup"/"Arrowup" resolve — the pirate map's lowercase arrows always worked), unenumerated code-shaped tokens with no case-fold match ("NumpadComma" — the raw-capture escape hatch), empty ACTION defs (the sendAction UI pattern), empty AXIS defs get a notice teaching their live uses (sendAxis / authored touch sticks) rather than a refusal — declared-but-unbound axes stay declared, and creator metadata beside a live source stays unpoliced.
• The anti-cliff pin: input-binding-validation.test.ts pins survival (WASD moves and actions fire with three broken axes in the same map; a dead key name disables its one binding alone) and byte-identical compile of the pirate map, so per-binding tolerance is now a contract instead of an accident — input validation can never become all-or-nothing without a red test.
• Look-script textures gain wrap control — UV>1 no longer forces silent edge-texel smear (THE VOW's screen streaks, ledger 1847: every look-pass ctx.texture() bound a hard-coded clamp-to-edge sampler, so a paper-fibre texture sampled at screenUV × aspect rendered ~2/3 of a 16:9 frame as horizontal/vertical streaks with zero signal). ctx.texture(assetId, { wrap: "clamp" | "repeat" | "mirror" }) and ctx.target(name, { …, wrap }) (riding .previous too) lower to the GPUSampler address mode (clamp-to-edge / repeat / mirror-repeat) — the smallest primitive, no pipeline: the wrap rides the ShadeTextureRef, and the look pass picks the sampler per ref at bind time. Defaults stay clamp everywhere (existing content pixel-identical); the engine-owned frame/depth inputs stay clamped by construction (edge-extension is what screen-space kernels want). Unknown option keys and unknown wrap values throw teaching errors inside look(ctx) — one diagnostic naming the vocabulary, look parks on the copy fallback (the fx-sink invented-keys law).
• Authored touch surfaces: inputs.touch.surfaces — named, complete TouchSurfaceDef documents (multiple sticks with zone/anchor/quantize, buttons incl. axis pedals and drag-aim with release payload {x, y, magnitude}, absolute/relative pads, one-action world gestures, ordering slots, icons, sizes, roles) — plus inputs.touch.active, a per-player selector script (default export (ctx) => name, worker-evaluated on the god-posture ship pattern; junk/unknown picks park that player to the draft with a teaching fault; oscillation is rate-limited and faulted). Surfaces compile into the same ControlSurfaceSpec the draft and god specs feed deriveLayout; the engine never merges two surfaces.
• Silent drops died as a class: every clamp/drop/park is a named TouchSurfaceFault (unknown-channel, zone-conflict, button-overflow, stick-suppressed, gesture-folded, …) surfaced through compile errors and getLogs teaching faults; main-side geometry drops post an engine.diagnostic (touch-layout-overflow).
• The draft is a value: api.resolveControls(surface?) returns the engine's auto-projected draft (no arg / "auto") or a named surface, each with diagnostics. The draft's projection semantics stay byte-stable (pin-tested at reference viewports) — floor, not ceiling.
• Authored button capacity is geometry, never a fixed cap: deriveLayout fits what safe-area + chrome reservations + 44px thumb floors physically allow and drops loudly from the slot-order end. The draft keeps its cap of 4. Slot is an ordering number; axis-hold's game-path ban and role's god-only scoping died.
• Runtime: slot-indexed analog SAB (16 slots — twin-stick works), input.axes.touchActive (1 while touch is the live input; desktop trace-free), surface swaps are edges with cancel synthesis, ?touch=1 gives desktop creators a live touch-chrome eye.
• Tome UI contract fixes: sendAction(name, undefined, { down: boolean }) plumbs the wire's held-button field (routes to setAction — press/release edges, hold bindings included); the god-slider data-dragging morph guard is generalized — any authored element holding an active pointer capture is never morphed mid-drag (hand-rolled UI sticks stop being rebuilt under the finger).
• A model that cannot decode now says so out loud instead of rendering nothing (ledger 1862, dig e6888eaf). parseGlb/parseGltfJson refuse a file that REQUIRES EXT_meshopt_compression when no meshopt decoder is available (GltfParseError), instead of "succeeding" with every compressed accessor read as zeros — full node/mesh topology, invisible geometry, all load books green (repro: 0/165,246 nonzero positions). Since the v7 quantize+meshopt republish that was every Magic CDN visual model for any client whose wasm init failed. The refusal rides the EXISTING model-load failure machinery — renderer retry ladder, console.error, and the ledger-1025 model-load-failed diagnostic carrying the parse refusal verbatim — never a new lane. Files that merely USE the extension (fallback buffers present) keep the per-bufferView warn-and-zero degrade; healthy loads parse byte-identically (pinned).
• ParsedGltf.warnings has a consumer (ledger 1862's second face: written since the lume cutover, read by nothing). A model that loads successfully but parsed with warnings — zeroed accessor reads, skipped primitives, unsupported required extensions — now surfaces them once per id on the new allowlisted model-parse-warnings diagnostic (log-only: the load succeeded, so it is why-does-it-look-wrong context in getLogs, never a DM) plus a worker-console warn.
• A Magic CDN cook loop past five minutes is a named fact, not a silent treadmill (ledger 1025's never-terminal hole, dig e6888eaf: badgerblunts' ten-clip ?animations= bot variants looped 202→cooldown all session with zero Savi-visible signal). 202 answers never escalate attempts by design, so the attempt-5 model-load-failed diagnostic can never fire for a cook that simply never lands. New allowlisted model-generation-slow diagnostic fires once per pending episode when a model is still answering 202 past 5 minutes — deliberately worded NON-terminal (the engine keeps re-checking; the model appears when the cook completes; regenerate/simplify only if it stays stuck).
• Cooldown-parked models stay visible to getUnreadySceneAssets (the dig's confirmed second gap). Render-on-change stops prepares in a quiet scene, so a model waiting out a retry cooldown aged past the 2s poll-liveness window and vanished from the unready report for most of every cooldown — Savi's captures read "nothing missing" while ten bot variants were mid-cook. A model whose retry is scheduled (finite retryAfter in the future) now counts as scene-referenced until that deadline: the due-retry wake buys a prepare, so a scene that still wants the model re-polls (stamp refreshes) and one that dropped it ages out at the deadline (pinned both ways).
• moveTo(target, { face }) now holds the face override for the whole move (MechaBlade "regression on untouched code" dig: the option carried faceTargetId in the intent but stamped only the move beat, and resolveYawTarget honors the override only while the FACE beat is fresh — which only the explicit face() verb stamped. Net: the documented option decayed to travel-direction yaw within one beat grace, so "walks toward you facing you" worked only when travel happened to point at the target — empty-yard geometry — and died the moment pathing sidestepped around an obstacle). The fix follows the beat system's own grain: a face option IS a face assertion, so moveTo stamps both the move and face beats (assertNpcIntent now stamps a beat per asserted channel); the override holds exactly as long as the moveTo keeps being re-asserted and releases with it — travel yaw resumes within the same decay grace as everything else. No resolver/system special case.
• A plain moveTo no longer clobbers a live face() override's fields — same root, second symptom: moveTo's patch used to carry explicit-undefined face keys, so api.face(x) called BEFORE api.moveTo(y) in the same pass was silently wiped (only the face-after-moveTo order worked). moveTo now writes the face channel only when its option asserts it; face() beside a plain moveTo holds in either call order. When both writers assert in one tick, the last call wins (merge-and-stamp semantics, pinned).
• Sweep result: face was the only intent option gated on a beat its writer never stamped — speed/range/exact/avoid/fleeUntil/wander opts are all honored while their own verb's move beat is fresh, and steer() stamps its own beat. No other silently-decaying option found.
• Held/unhosted places tell you they're frozen (ledger 1839, dig e6ed67b2 — the ledger-931 pause-legibility pattern extended to host state). In client-hosted multiplayer the server never simulates place content; while a place's seat is successorless-HELD (ledger 1788 — the sole host's tab hidden/silent/mid-reconnect with nobody else to elect) or the place is unhosted-but-occupied, update()/api.on events/interactions/timers are frozen there by design while onSpawn, crons, api.sql, and edits keep working — previously with zero Savi-visible surface (Savi filed the designed freeze as an engine bug four times in one night; ~447 hold episodes across 48 apps in a 4h window is standing weather for solo-occupied rooms). Now: (a) every run_script result during the freeze carries a prepended place "X" is not being simulated right now … note naming the reason, the since-tick, the frozen-vs-alive class split, and the "designed netcode behavior, not an engine fault" verdict; (b) an edit landing in a frozen place writes one getLogs runtime-log line per hold episode (episode-deduped like 931's pause line); (c) api.reportEngineBug incident dumps carry a placeHosts block on the server context — every table row plus hold state (reason, sinceTick), tenure confirmation, and occupancy — so a "update() never fires" filing self-classifies. One truth for all three surfaces: tome/place-sim-status.ts reads the same hold-episode record the assignment system maintains (moved into the cross-system PlaceHostTenureState; zero simulation-behavior change).
• The placeholder ladder's middle rung is back: a cooking model shows its 2D concept image as a billboard within seconds, then swaps to the model when the cook completes (thread 1785358887). The three-era hologram (extensions/models/placeholder-visuals.ts) crossfaded to the Magic CDN preview image; the lume port (#7602) cut that lane with a TODO(lume-placeholder-previews) and shipped pure-procedural rings — the "swirling circle until it loads completely" regression. The lume placeholder module now resurrects the old logic minus the bubble shell (removed on taste back in ledger 417): collectPlaceholders already derives previewTextureId from the preview metadata poll (preview_image_url is written ~2-3s into a Trellis/Meshy cook, minutes before the GLB), and packPlaceholders now registers that URL with the lume texture service (registration + subscription IS the load demand — the override-map mount pattern), partitions instances procedural-first then one contiguous run per decoded preview texture, and draws each run with its own bind group and a firstInstance offset into the shared instance buffer. The preview's own alpha masks immediately (BiRefNet cuts the background CDN-side); the procedural hologram crossfades out underneath at the three-era 4/s rate. The rung is visual-only: pick volumes (placeholderDrawnSize) and physics are untouched, failed cooks stay procedural red (legibly dead beats pretty), a missing/undecoded/layered preview falls back to today's procedural hologram instance-for-instance, and the model-ready swap releases the texture retain and subscription the frame the placeholder drops.
• The batch-lane arena-full refusal is loud on every rail (ledger 1833, War Cloud d757e8d9 root). When a primitive batch lane's shared geometry arena hits its cap (LANE_MAX_VERTICES/LANE_MAX_INDICES), every NEW unique shape routed to that lane is skipped by design — the object exists, answers queries, keeps physics/bounds, its bespoke-geometry wait resolves (data was delivered), and it renders NOTHING, permanently. The engine already emitted primitives-lane-arena-full for this, but the code was never allowlisted server-side (the #330 emitted-but-dropped class) and the emitter printed no console line — so the loss was invisible end to end: clean console, clean getLogs, zero stall reports (War Cloud saturated one vertex-PBR lane at exactly 1,048,576 reserved vertices across 2,664 split-slot registrations from ~440 scripted bodies; everything refused after the cap — the creator's viaduct among them — was silently invisible for two sessions and ~100 rebuild attempts). Now: the diagnostic is allowlisted (full-body DM — ACTION-classified with the #297 consent rule, the outline/shadow-slots shape), it prints a server-console breadcrumb (client-side emitter; the stdout line is what makes arena exhaustions DD-countable fleet-wide), and the emitter warns on the worker console (once per lane) so client dumps carry the refusal.
• Batch-lane geometry arenas grow on demand — the fixed 1M-vertex wall is gone (ledger 1833, the capacity half; the silence half landed as primitives-lane-arena-full loud rails). A primitive batch lane's shared vertex/index arena was admission-capped at a fixed LANE_MAX_VERTICES = 1<<20 / LANE_MAX_INDICES = 1<<21, even though the arena's whole growth stack already existed (pow2 CPU mirrors + GPU buffer recreation that preserves flushed content with a buffer-to-buffer copy — mobile memory diet phase 2a). War Cloud held one vertex-PBR lane at exactly the cap (2,664 registrations, 702,604 live vertices, ~33% pow2 reservation padding), so every later unique shape — the creator's viaduct among them — was refused at the batch seat and rendered nothing, forever. The fixed caps are deleted: admission now checks a device-derived ceiling (laneArenaCeilings) — min(maxStorageBufferBindingSize, maxBufferSize) over the lane's vertex stride (pulled lanes bind the whole arena as ONE storage buffer, so bindability is the bound, not creatability), maxBufferSize/4 for the u32 index arena, and an absolute 2^24 vertex cap (instance-param float 21 carries each slot's vertex-arena base as f32; integers stay exact through 2^24). Under the ceiling the arena simply grows on the existing ladder; before a lane has seen its device, the WebGPU spec-default limits are the floor (any device can bind what they admit), so cold-boot bursts grow too. On a desktop 512 MiB grant a vertex-PBR lane now tops out ~7.07M vertices (~6.7× the old wall); at the TRUE ceiling the loud primitives-lane-arena-full refusal (DM + breadcrumb + console) fires exactly as before, now carrying used/max vertex+index counts. Growth cost is a one-time hitch per doubling (a lane doubles at most a handful of times in its life): one GPU-side copy of the old arena (~76 MB at the 1M-vertex boundary — sub-millisecond at VRAM bandwidths, and it replaces what would otherwise be a CPU re-upload) plus one prepare's worth of mirror re-uploads and bundle re-records. A permanent one-frame hitch per size class beats permanently invisible geometry. The pow2 reservation padding (~33% burn in the specimen) is deliberately untouched — growth, not packing, is the fix.
• Authored UI is now READABLE from the tool side — the realm-aware read relay (ledger 1845 fix b, the structural cut behind the c13632c4 phantom-blackout family). Since the authored-realm isolation cutover, ui.js DOM renders inside a sandboxed opaque-origin iframe, so run_ui_script's host-document reads structurally cannot see it: every probe of the taught addresses returned empty and healthy HUDs got filed as "never paints" while creators played through them. New client RPC read_authored_ui (contract read-authored-ui/1) crosses the frame broker into the realm and executes the query where the DOM is legible: a closed read-verb vocabulary (snapshot | html | text | rect) + selector via querySelectorAll — never evaluated, realm answers only (never initiates), bounded payloads with honest truncation markers, write/eval-shaped requests refused loudly at the RPC gate AND structurally unrepresentable on the wire (protocol family 23 read, strict decode). The response carries the realm boot state and a FRESH HUD-pipeline receipts block (compile state, sent count+sig, applied outcome + sent→applied lag, dedupe count+last-tick — minted per read from the runtime worker) alongside the DOM answer, so a "never paints" claim has to beat the pipeline receipts in the same payload.
• The reset-path client-sim rewind dies (ledger 1848, kin 1523). The reset-delta path was the only inbound lane that could rewind client-simulated state in normal play: sweepProjectionForReset despawned host-simulated/owned entities and the reset's create rows rebuilt them from the server's canonical blobs — but for an entity THIS client simulates, the canonical copy IS the client's own uploads, ~RTT stale by construction, so every reset rewound live hot state (TomeState clocks, owned appearance values) by RTT. Send-failure reset storms (Bun ws.send backpressure → strict false → reset; ledger 945's prod specimens) made that a per-0.6s event on saturated links. Family contract, now enforced at the seam: an inbound apply must not write client-simulated (or script-diverged) hot state it cannot prove newer.
• The guard shape: the applyAll bypass stays (load-bearing — owned entities must re-materialize on place transitions). What changes: a new shouldAdoptEntityStateOnReset ingest hook (control-utils shouldAdoptReplicatedEntityStateOnReset) marks entities this client currently simulates; the reset sweep keeps them alive, and their reset rows are rewritten to server-stamped (clientAuthWrite !== "owned") components only — spawn-stamped fields (TomeLifetimeDeadline) and authority transitions keep landing, owned values keep the local copy: exactly the value the server itself defers to. Preserved entities the reset does NOT re-show are despawned after the row passes (server-side kills of simulated entities keep landing via resets). Unknown/foreign entities adopt wholesale, unchanged.
• The wake handback is exempt by design: this session's OWN suspension-stamped envelope adopts the reset wholesale — while the tab was hidden the place HOST simulated it, so the resume reset's blobs are the newer truth (docs/client-auth-suspension-takeover-plan.md). A suspended FOREIGN envelope this client host-simulates under the takeover is protected like the rest of the remainder.
• The no-confirm reset-resend loop gets a terminal state (ledger 1850 — #11360's disease, server edition: unbounded retry, no terminal). The o-53 ingest-truth lane deliberately removed the give-up-flip-to-Streaming (the 2026-07-20 one-directional freeze) and assumed a pipe that never confirms is owned by other rails — but a HALF-ALIVE socket (downlink delivering every frame, uplink eating every echo) is visible to none of them: the client's silence watchdog keeps hearing heartbeats, its self-heal re-request rides the dead uplink, and the ledger-695 eviction guards on Streaming. The GOHN specimen (07-29): full 1.26–1.7MB world snapshots every ~32s (the hold ceiling) for 25+ minutes with zero ingest_confirmed, each delivered resend re-seating the mid-flight creator back at the arena landing ("DAMNIT IT TOOK ME BACK TO AMONKET"), BAD@277 landing 0.3s after the final resend — version-independent (same shape on 5.2.6 and 5.2.9).
• The verdict shape: a new deafness budget RESET_ACK_TERMINAL_HELD_SENDS = 11 (5 doubling holds + 6 at the 32s ceiling ≈ 3m43s of provable deafness — far past every genuine recovery the ledger-945 client budget observed). At the hold expiry that would cut snapshot N+1, the egress instead logs netcode.reset_projection.terminal (warn, with heldSends), closes the socket retryable (4437 / reset_ingest.deaf — deliverable, the downlink works), and detaches the connection into the ordinary disconnect grace. NOT a despawn and NOT a Streaming flip: the entity keeps simulating through the grace window, no snapshot rides the transition (the per-resend re-seat was the harm), and the client's existing reconnect lane lands a reattach that resumes into the same entity via replaceReadyConnection with every reset counter re-zeroed — a fresh socket, the only thing that can heal a dead uplink.
• Ground truth always wins: a late ingest_confirmed anywhere inside the budget clears the counter through the existing echo path and the episode ends as a normal confirm — the terminal check only ever reads the counter, so a healed link can never be condemned after the fact (pinned by test).
• The road/spline ECS component is deleted (residue cut named by #11164, probe 60f4933c, row r-dd0a41ea). The component had zero producers since roads migrated to the spline system (#6308, 2026-04): every remaining reference was a has-guarded remove or a has-guarded set — branches that could never fire. Dies with it: the component definition + its bespoke encode/decode (features/road/components.ts, the whole file), its registry row (defineRoadComponents, the road/spline wire-dictionary entry and its share of schemaHash), the 8 dead guard sites in tome/api/properties.ts + tome/interpreter.ts, and the fossil RoadSpline section of docs/API.md. Survivors, untouched: features/road/geometry.ts (getRoadGeometry/RoadSplineValue — rivers and spec-level spline: { kind: "road" } visuals are a different, live system) and the road feature barrel, which now re-exports geometry only.
• Dotted euler writes no longer vanish against quaternion rotations (ledger 1863, GUTTERBT snowboard dig). setObjectProperty("rotation.roll", …) deep-merges onto the {x,y,z,w} read-back and the merged {x,y,z,w,roll} hit resolveRotationSpec's quat branch first — the fresh euler intent dropped with no rail (the lookAt+euler conflation had one; quat+euler had none). Both resolver twins (api/object-api.ts, spline.ts) now detect euler keys riding a full quaternion and apply them onto the quat's decomposed axes (quatToYawPitchRoll, new in the math library: intrinsic Y-X-Z, the exact inverse of quatFromEulerDegrees, gimbal-lock safe); unnamed axes keep the quaternion's values, so per-frame rotation.roll writes are absolute, not accumulating. warnRotationQuatEulerConflation joins the spec-shape rail — once per room, names what the engine did. Pure-quat and pure-euler resolutions are pinned byte-identical.
• Savi's inspection camera sees the post chain — camera/frame captures composite the active look + bloom (the lume port of #8344's composite leg; r-df174d4e gap 1). view_live_scene camera/frame captures rendered the raw scene (ACES + sRGB only) and skipped the whole post chain, so Savi authored look scripts blind ("my inspection camera can't see the post chain… this fix is a bet until you turn around and look"). The capture now owns a post rig of the chain's own pieces (lume/capture/postfx.ts): the dual-filter bloom pyramid, the generated composite kernel (veil 0, no outline slots, no RCAS — scene + bloom → ACES → fused look → sRGB + dither), and a capture-owned LookPass for two-hop looks (offscreen ctx.target/ctx.pass graphs — the godray shape), with a 1× depth resolve feeding the depth-reading kernels (haze, dof, ctx.depth). One-shot correctness: BloomPass.prepare() / LookPass.prepare() await pipelines where the live chain keep-presents, so the first capture after a look edit carries it. Nothing active keeps the plain path byte-for-byte; any post-leg failure falls back to the plain render (never a failed capture). Every capture note names exactly what the image carries — composited / nothing-active-matches / still-compiling-recapture / broken-look-matches-viewport / could-not-apply. Burst tiles ride the same path, so filmstrips are graded too.
• The render-time sun is readable — getAtmosphere().sunState (r-df174d4e gap 2). Savi inferred the sun's world-space direction from shadow angles in a render; the derivation (timeOfDay orbit, authored-rotation pin, cycle override, overcast dimming, night moon handover) lived only inside the client atmosphere-sync system. The sun block is extracted verbatim into one shared resolver (atmosphere-sun-color.ts resolveAtmosphereSun) feeding both the sync's light entity and the new derived read-only sunState on getAtmosphere(): { direction, rotation: { pitch, yaw }, color, intensity, body: "sun" | "moon" }, or null when the atmosphere has no sun at all — the "new worlds ship with no sun" truth as a readable fact instead of a black render to reverse-engineer. patchAtmosphere strips sunState on the way in, so a full read patched back round-trips clean.
• The empty-derive silence hole dies (ledger 1833, War Cloud/viaduct-river): realizeScriptedPrimitiveGeometry's ok:false reason:"empty" outcome — geometry() returning without error and without a single emit — used to return geometry: null with NO report (only thrown errors were loud), after which the interpreter removed the entity's DrawMesh pointer entirely: no log, no DM, no heal traffic, no vocabulary in getLogs or view_live_scene. An object that exists, answers queries, and renders nothing anywhere, forever, silently. Now the empty outcome reports through the same behavior-error rail every other geometry() failure rides (runtime log + deduped DM, naming entity + script + "emitted no geometry — check the params/seed"), from the ONE derive funnel (deriveScriptedPrimitiveGeometry), so every lane is loud: server mint, client applySpec, live property writes, the #929 ingest drain, ground redrape.
• view_live_scene's frame-mode miss names the real cause: a failed/empty derive on a client world now leaves a ClientBespokeGeometryDeriveFailed row (client-plane, replicate:never, forwardToRenderer:always — the Unhealable pattern) carrying { script, reason: "empty" | "error" | "no-geometry-export" }; cleared by the next successful derive, dies with the entity. The renderer's primitives store keeps it as a per-entity note (it is the ONLY renderer-side trace — a no-mesh entity has no pointer, no wait, no record), and sceneViewObjectBounds' miss carries it into the frame-miss sentence: Object "x" exists but renders nothing: its geometry script (gen/foo.js) ran and emitted no geometry on this client — the mesh is empty under the object's current params/seed. — replacing the "assets may still be loading" guess that cost a creator two sessions.
• Stand-parent grounded egress (#11535 landed-look, finding P1). Walking from a moving platform onto foreign non-moving ground (static dock, terrain) while staying grounded now ends the ride: the attached tick detaches (no momentum — feet never left ground) when the CC's support entity is neither the platform, nor a moving attachable (the transfer branch), nor a member of the platform's own parent chain (a static-bodied part of the same assembly holds the ride until the pose watch qualifies it for transfer). Persistence-gated at 2 consecutive foreign-ground ticks so single-tick support misreads at the deck edge can't drop the ride and re-base the anchor. Before this, every detach path required airborne ticks, despawn, or a moving support — stepping onto a dock left the carry composing the rider in the departed platform's frame, dragging them at platform speed indefinitely (measured: 2.000 m of drag over 60 idle ticks at 2 m/s, exactly the deck's travel).
• Stand-parent authority handoff (#11535 landed-look, finding P2). The engine's edge now survives its simulator: attach() writes TomeParent { parentId, stand: true }, and a simulator that finds a bare flagged edge with no local state (host migration, suspension wake, control transfer — the replicated product outlives the realm-local TomeStandRider marker and the WeakMap) ADOPTS it instead of classifying it as a script mount and orphaning it. Before this, the orphaned edge re-entered the hierarchy solve and the −10 projection on the new simulator — the two pinned-red grinds (teleport-compose depenetration + mixed-frame erosion) with no detach path ever. Scripts-win is unchanged: script writes lack the flag (never adopted), and a script overwriting a flagged edge still makes the system forget it.
• Destroy cascade reads the flag. A rider spared from a platform's destroy cascade is now recognized by the wire-visible flag on every realm, not only where the realm-local marker lives — an NPC rider no longer dies with its platform when the destroy is issued by a realm that doesn't simulate the NPC. (SessionOwner players were already spared everywhere; the marker check remains for pre-flag edges.)
• Named the rotation gap. Platform rotation (facing does not turn with the deck; detach momentum misses tangential ω×r) is now in the system header's out-of-v1 list rather than unstated.
• Stand-parent — the moving-platform primitive (thread 1785355069: jacob's "parenting to the boat that should just work" + "unparenting when leaving"; tucker's brain dump is the spec). Stand on a moving entity → the realm that simulates your character parents you to it (TomeParent + Local* anchor): movement becomes deck-frame-relative (walk speed independent of platform velocity), the platform carries you through rapier's own controller pipeline, and the renderer composes your drawn pose from the platform's drawn pose via the existing parent-relative presentation rings — the deck-rider world-space follow workaround and its structural one-platform-step sawtooth die. Leave (jump, walk off, platform despawn) → unparent with world-pose continuity plus the platform's last measured velocity carried ballistically until the next grounding. Jump straight up on a constant-velocity deck and you land back on the deck (re-attach) — the deck only leaves you if it accelerates.
• Mechanism: the rapier character controller now reports its ground-support ENTITY (getCharacterControllerGroundEntity — axis support resolved whenever grounded). A carry system (order 9000, pre-physics) composes the rider's target from the platform's current pose ⊗ the stored local anchor and adds the HORIZONTAL delta to the controller's desired translation — deliberately NOT a hierarchy body-sync: teleport-composing a capsule into exact deck contact makes rapier burn its solve on depenetration and eat the desired movement (walking dies on deck — pinned). Vertical stays the controller's own (snap-to-ground follows a falling deck; depenetration push-out follows a rising one). The anchor system (order 10000, post-physics) owns attach/detach and re-derives Local* from same-tick frames. Attach: grounded on a non-terrain, non-character physics body that is moving (kinematic/dynamic by declaration; script-moved static bodies the first tick their pose changes), cycle-guarded. Detach: airborne past a 4-tick grace, despawn, or support transfer.
• The 1848-family seam, handled: both hierarchy solves and the client Local*←World* projection skip TomeStandRider children — at the -10 projection point the rider's World* is last-physics-step truth while the platform's is this tick's fresh ingest, and dividing those mixed-authority frames bakes the platform's inter-tick delta into Local*(the ride erodes to a standstill — pinned red).TomeStandRider is realm-local (replicate: "never"); the managed TomeParent/Local\* rows are the replicated product, and each rider's edge is managed exactly once, by its own simulator (client-predicted set / not-client-auth-external — the hierarchy solve's own predicate family). Relay tier unmounts both halves (steps no character physics).
• Destroy cascade: riders and players (SessionOwner) parented to a destroyed platform detach instead of dying with it — a rider is not a part.
• Scope (v1, named): any character-controller entity rides — players and kinematic NPCs alike. Out: characters as platforms (head-standing never parents), items without character controllers (dynamic props ride via physics friction, not parenting), mantle-runtime places (mantle's CC already velocity-follows platforms), 2d-top (no vertical support semantics).
• api.uniqueId() can no longer collapse into one permanently-identical id (incident 0cb62ea7, THE VOW on 5.2.6). The poison chain: any exec's setup spawns the bare tome/exec entity with no TomeIdSeq; a later spawn-only exec shipped a PARTIAL counter delta ({ spawn: k }, the untouched unique lane dropped as a zero delta), merge built a partial live component, and the next uniqueId mint did undefined + 1 = NaN — from then on every call returned the same _NaN-suffixed string forever (spawns silently adopted each other, destroys missed), and the NaN delta re-shipped on every merge. Killed at all three layers: the mint is total over malformed stored values (a non-finite lane re-derives from the persisted-spec scan — long-lived rooms already carrying the poison self-heal at their next mint, no reset needed), the exec overlay never ships non-finite counter deltas and ships snapshot-missing keys at delta 0 (a partial TomeIdSeq is unrepresentable at merge), and merge-side counter arithmetic skips non-finite input on both arms. Applies to both lanes of the machinery — api.spawn's minted ids ride the same component.

technical notes

• Entity fences stop eating CREATE rows — the city-blink/anti-phase-rebuild class dies (ledger 1795, dig 8b34645c). A forwarded-DELETE entity fence no longer drops CREATE rows (updates/deletes/events stay fenced): a create row is a deliberate re-mint (ENTITY_NEW at the sender's log walker), never a pre-adoption straggler, and the admission path already owns same-id collisions. This deletes the wild loop's only receipted create-killer — prod 5.2.8 "Clog a Toilet" (incidents 119a08e8 → 8b34645c) churned a 123-tick anti-phase rebuild for the room's whole life: fence eats creates → never acked → 3s ghost retire → confirm walk fails → rebuild → next fence. Destroy/respawn builders now converge by construction.
• create.nack on every create-drop class: every create row the StateDeltas drain DROPS now answers {kind:"create.nack", ids, reason} beside the create.ack push — create-gate rejects, chain-validation unwinds (displaced-host included), flood-budget prefix drops, and the suspended-session wholesale drop. Client-side a nack fast-forwards the pending entry's grace (ghost retires on the next drain, not 3s later) and the client-ring receipt names the room's reason. No create can die silently — silence now means only "the message never arrived", which is what the grace window remains armed for.
• Dead-parked model loads re-probe on a long cooldown — the silent forever-park is eliminated (ledger 1808, the Thunder Bluff latch, dig 22f87a4d). Models placed while their import was still cooking never transitioned to rendered after the asset completed: dead answers collected during the cook window burned the terminal budget into retryAfter=INFINITY, and both documented re-arm doors are dead mid-session (manifest re-add dedupes at the sim AssetService; room reattach needs a reconnect). Dead-4xx/auth give-ups now park on LONG_RETRY_COOLDOWN_MS (one bounded re-probe per 5 minutes, autonomous via the retry wake) — any asset that becomes servable converges within one cooldown with zero external signal. INFINITY now belongs only to states with their own explicit door (pre-session cap, content-policy rejection). Room attach still re-arms immediately (ledger 1183 semantics preserved).
• Eye honesty: getUnreadySceneAssets reads a dead 4xx answer as 'failed', never 'generating' — a cooking asset answers 202, so a dead answer is a verdict, not progress (401/403 stay 'generating': auth verdicts the session cookie, not the asset). Savi's live-eye stops promising assets the engine had stopped requesting.
• The upload-drop receipt rail's dedupe key drops its per-entity component (dash-named ids made one 80-entity sweep 80 warn buckets in one tick, evicting the asset-load receipts this incident needed): one line per (client, gate) per 30s window, every drop still counted in stats.
• Firefox-valid generated WGSL — cullSelectWgsl gains an explicit unreachable tail return in aggClaim so all five variants validate under naga (r-859dee09). Firefox's WebGPU validates shaders with naga where Chrome/Safari use Tint/Dawn; a Tint-accepts/naga-rejects shader parks the pipeline at createShaderModule, the canvas goes black, and telemetry reports only second-order resource-state noise (forensics: 152/153 victims of the affected family were Firefox, one a fresh starter world). The pulled vertex source also threads through displacementWgsl correctly.
• CI gains the missing validation axis: a naga gate over lume's GENERATED WGSL (#11314). Every WGSL gate previously validated against Dawn only, so the whole Tint-accepts/naga-rejects family was structurally invisible. The gate enumerates the generators' output — every lume shader generator × its realistic parameter matrix, couplings taken from the engine's own derivation sites, 1,538 artifacts across culling, terrain, and post — and validates the exact strings prod builds pipelines from. The class can't come back unseen.
• Shipped Safari/WebKit renders again — fragment stub for vertex-only shadow bundles (WebKit bug 319980). Root cause of the Safari/iOS GPU session deaths ("graphics device stopped responding" on desktop, silent WebContent kills on iPhone): every lane shadow bundle pairs a vertex-only caster pipeline with a depth-only bundle encoder, and shipped WebKit's RenderPipeline::validateRenderBundle rejects that spec-legal shape at setPipeline — the bundle records invalid every frame and the sustained validation storm survives both render-chain rebuilds. Fixed on WebKit main 2026-07-22 but months from shipping, so: probeFragmentlessBundleSupport() runs one throwaway vertex-only bundle at device init inside an error scope (a probe that cannot run never convicts), and when armed, laneShadowWgsl gains an empty @fragment fn fs() {} bound with zero color targets — a construction-frozen session latch, same law as the sample-count/color-format contracts.
• Phone texture-page mip admission — 15→27fps on iPhone (7.9× draw cut). The mobile texture profile (256² pages) refused every 512² world texture to the oversized direct pools, whose lanes can never activate pulled-attribute batching — phone-tier sessions drew the forest one indirect draw per unique geometry (1,333 draws vs 169 on desktop, ~18ms of empty-indirect Metal encoder overhead in scene.opaque). A 512² chain's mip 1 IS the 256² image, so admission now seats an oversize chain at its first fitting level and the residency copy reads the tail. iPhone receipts: pinned rung 0 1,320→156 draws, scene.opaque 19.6→5.6ms, GPU 38→25.8ms; unpinned natural ladder ~17→~27fps, and the frame-budget guard no longer parks the look (thermal ramp flattened). Tail admission is per-tier policy — desktop keeps native-res pools.
• Offset admission refuses off-block-grid base dims — the zoo 512×285 device-loss storm. Compressed formats require block-aligned dims at createTexture's BASE level; halving a block-aligned NPOT chain can land off-grid (2048×1140 ASTC at offset 2 = 512×285), minting an invalid texture that stormed every lane bundle binding it and killed the session with GPU device loss. Off-grid offsets are refused at admission.
• Bloom shape presets — full/lean/phone on the quality ladder. Bloom's 7-pass half-res 4-level pyramid becomes 'full'; 'lean' (half-res, 3 levels, 5-tap Kawase) and 'phone' (quarter-res, 3 levels) join it as a construction-frozen session contract. The post stack runs at OUTPUT resolution — TAAU internal-res scaling never protected the phone from bloom — so the phone preset is the first bloom cost cut that lands on device. A/B override: globalThis.spawnBloomShapeOverride + render-harness --bloom-shape.
• Depth-local look fusion — haze rides the composite, look.present dies on hazed frames. classifyLookFusion three-classes the active look (pixel-local / depth-local / offscreen); vocabulary haze (a fixed per-pixel depth tap) now fuses into the composite (zero new bindings on the TAAU-fused kernel), freeing the full-res rgba16float look intermediate on leaving two-hop. Standalone pass stays byte-identical as the offscreen path + A/B control arm.
• Transient textures survive usage injection (F1) — zero validation errors at any creation time. WebGPU Inspector ORs COPY_SRC|TEXTURE_BINDING inside wrapped createTexture and Dawn rejects the merged mask (every scene.alpha submit failed under instrumentation). The pool probes once at first transient request (a 1×1 attachment-only create reveals the wrapper), degrades to non-memoryless up front, and keeps per-texture destroy-and-recreate as backstop for late-attaching wrappers.
• Scatter templates stop silently dropping castShadow/receiveShadow (+14 more keys) — the hoist list is derived, not hand-maintained (incident 7fdfd766). SCATTER_TEMPLATE_PROPERTY_KEYS omitted 16 keys that were valid per the type (ScatterTemplate includes Partial<ObjectProperties>) and silently vanished in normalizeTemplateProperties when written top-level: attachment, pivot, visibleInFirstPerson, visibleTo, castShadow, receiveShadow, spline, mixer, ik, jiggle, collider2d, sign, fx, interpolation, npc, blueprint, brush. Incident app ca4e9c87: 403 scattered trees all read cast:true against templates declaring castShadow:false — full sun-cascade cost for shadows the creator turned off. The hoist list is now DERIVED from SCATTER_TEMPLATE_KEY_ROLES, a role map whose satisfies makes classification exhaustive — a new ObjectSpec/ObjectProperties key is a tsc error until marked hoist/spec/dropped (with a reason comment for every drop). Spelling-parity tests cover every hoisted key.
• Skills teaching wave (rides this build's skills.json): combat.md teaches predicted-kill presentation — death reactions project locally, authority reconciles (tide's f3a09a5f §3c, #11288); world-composition.md teaches the open-sky idiom — floating islands set atmosphere.ground: false (two-creator demand in one week: Lightwake's 14 burned versions + izkimar; the cure itself ships since 5.2.8, the teaching now points at it); weaves.md teaches the structured inter-wisp handoff shape that parses at the seam (#11285); match-a-reference.md's three prompt clauses learn their true targets (#11338); drawn-art.md's cliff step gets a bounded budget — one doubling, then it's a camera-height problem with named levers (#11341).
• Texture bakes ship a pixel-coverage receipt — a blank bake is a named outcome, never silent success (incident c2c60fea, ledger 1805). The bake worker reads an exact non-zero pixel census + strided sample hash off the finished canvas before transferToImageBitmap and ships it with every ok bake; the host raises texture-script-blank-bake when the census reads blank after a draw that ran ops. The blank bake still ships — the receipt is a name, never a gate.
• texture(ctx) returning a thenable is a runtime fault (texture(ctx) must be synchronous): the canvas is captured the moment texture() returns, so an async draw silently shipped only the ops before its first await.
• New browser-gate suite bakes the incident probe through the REAL built worker artifact on chromium+webkit and asserts bitmap content pixel-exactly — the raster class vitest's recording stub structurally cannot see.
• STOP PAIR: the update storm (runaway version-minting) is cured at both ends (dig 535afdad, ledger 1797). Engine side reverts #11111's bidirectional singleplayer template fold: the fold judged live writes against a template mirror its own enqueue never advanced, so a per-tick state write on a promoted key re-enqueued every tick forever, and the coalescing persist sink minted one game_specs version per batch — Slime Arsenal (90469935) minted at 2.6 versions/second. Live state writes on template-carried keys are once again live-only (the one-directional promotion at persist:true write time stays). Known trade, taken deliberately: #11111's resurrection cure re-opens — a template-carried key cleared by a plain live write re-seeds its stale template value on rejoin (the goblinjo class, dig 7ed7f11e) — until a storm-proof fold design lands.
• Platform backstop (kiln-side, active for every room at kiln deploy regardless of engine pin): a mutations batch that changes nothing can never mint a game_specs version — the SDK mutations route serialize-compares the folded doc against the pre-apply head and answers the existing no-op shape (200, updated:false, head version) on equality, inserting nothing (prod receipt: Sky Islands 9bfc70a0 minted byte-identical v4740/v4741). The platform-wide floor for the empty-mint class, whatever the future writer.
• Zoo: VAT Lab pen — vertex animation textures from existing primitives, zero engine changes (jure's spike, #11306). Three exhibits + the bake-on-display board (KeyX): soft (80-figure one-draw crowd wave), rigid (60-brick shatter with baked quaternion tumble + staggered time-reverse rebuild), and sim-sourced cloth (Verlet flag, crossfaded seamless loop) — texture scripts bake the data (RGBA8, alpha-255 law), bespoke geometry carries VAT addressing in uv, scripted materials replay it in the vertex stage (~287 KB total). Engine findings for the rendering lane, named: vertex-stage texture sampling works today; scripted materials draw standalone (merged-mesh crowds cap at the 16,384-vert bespoke budget — instancing is the scale-up ask); positionNode does not reach shadows (exhibits set castShadow:false); culling uses rest bounds (envelope markers).
• view_player_screen accepts viewport: { width, height } — the schema catches up to the booth (r-c853e0d1 item 1a). The tool's inputSchema was z.object({}) while the booth underneath already honored viewport end-to-end (resolveViewport clamps 64–4096, warm eyes resize per job) — Savi could not ask for the phone-sized look her own craft clause ("the HUD fits a thumb-wide screen") requires. Viewport rides the booth request verbatim; the caption names the served size from the booth's own receipt; bounds are mirrored at the tool boundary; a provider-level schema pin asserts only viewport {width, height} exists (a param the booth ignores would be a new lie). game-ui.md retires "asking the player — they see them; captures don't" (false since the composited eye landed): view_player_screen IS the capture that shows anchored plates.
• facing:'x' wall colliders no longer mirror their holes across the wall's center (SHUDDER incident 4bbd28d3; born with the wall feature in #5529, survived all three renderer eras). The mesh (createWallGeometry) builds the wall shape in XY and rotates it +π/2 about Y, sending an authored hole.x=+8 to local z=−8; the collider grid (generateWallCollider) wrote shape-x straight into +Z, landing the same hole at z=+8. Every facing:'x' wall with an off-center hole got both player-facing faults at once: an invisible wall at the drawn doorway and a walk-through phantom at the mirrored spot (2·hole.x apart). The collider now mirrors hole.x into the mesh's frame — creators authored five months of worlds against what renders, so the invisible side conforms. Centered holes (x=0) were mirror-invariant and are byte-identical before/after; facing:'z' and 'y' were already consistent and are pinned by new tests, including a mesh↔collider projected-occupancy parity sweep across all three facings.
• Blender workshop: quickmenu's 10 real algorithms land with their teaching — qm_apply one-call procedural detail (jure's harvest, #11335). The workshop image gains qm.py (355 lines of real quickmenu ports) provisioned as a Blender addon, with the blender-game-assets skill teaching the one-call qm_apply shape so wisps reach for proven procedural detail (bevels, greebles, surface breakup) instead of hand-rolling operators. Workshop-image change rides its own image build; the engine build carries the skill teaching.
• One save file per game+mode — api.sql is Savi's whole storage surface (the storage-rail deslop, #11259). Every game owns one SQLite database per mode, dev and live physically separate, and api.sql is the one verb: a tagged template whose interpolations bind as parameters, one call one atomic transaction (semicolons = ordered statements that commit or roll back together), errors throw, budgets fail loud (≤64 statements / ~250ms wall / ~10k rows / 4MB per call; size warn near 8GB, growth refused at 10GB with reads and cleanup DELETEs always working). Behavior-script awaits settle at tick boundaries so a load enters the sim atomically; run_script hits the dev DB the moment it executes; scripts/db.js migrate(sql) runs under a door-held lease exactly once per (mode DB, spec version) — a throwing migrate never blocks play, it reports and re-runs at the next boot. The old rail is deleted, not wrapped: api.updateStorage, the lifecycle storage lane, the eight storage:* builtin jobs, createSDKStorage, and the gsdk documents/CAS family are gone, with tombstones on every old name teaching the live verb. Terrain edits and room-state resume are re-planted on _spawn_chunks/_room_state rows (the 10MB doc cliff deleted); pre-database saves surface read-only in legacy_kv via an idempotent, crash-resumable boot importer. New data-and-saves skill replaces lifecycle-and-persistence + jobs-and-storage.
• fx sink options the engine does not know now talk back instead of silently no-oping (the soft: lesson — soft: 0.4 depth fade was authored in the wild for months against enfeul's fireballs while sprite() silently dropped the key; B5 landed the fade, this closes the class). sprite() / ribbon() / light() refuse unknown option keys with the builder's full vocabulary in the message (fx: unknown sprite() option "softness" — options are: texture, textures, blend, layerMask, align, stretch, axis, soft), and the compile issues rail (validateFxProgram) holds hand-built sink objects (render: { kind: "sprite", … }) to the same law: unknown sink keys, unknown sink kinds, and out-of-law hand-built soft values (non-finite / negative) each report a path-addressed issue instead of a silent drop or a mid-validation crash. Builder throws and FxProgramError both surface through the existing fx.compile fault channel (kept-last-program + one DM per broken version).
• Singleplayer per-tick player-state persistence coalesces — the third door on the version-storm class (ledger 1814, dig ef0675cc). A behavior script writing player state every 30Hz tick (enfeul's NANO-WELD regen perk, +1.2 hull/sec) minted one FULL game_specs row per drain at the kiln RTT cap — ~115 rows/min × 775KB for as long as regen ran. The persist funnel now stamps kernel-authored singleplayer batches that are exclusively patchPlayer{state} writes as playerStateOnly; the write-ahead ledger merges stamped appends into the queue tail (latest-wins per key where merge-patch composition is provably exact against the fold, sequential otherwise) and holds a sole stamped head until 30s since the last player-state flush. Any structural batch behind the head lifts the hold immediately — order never bends — and /update freshness, idle save, and container shutdown force the flush. Crash-safe from append (the held fold is DO-durable and replays whole); only kiln VISIBILITY of pure player-state deltas lags ≤30s. Pinned: a 60s regen storm mints ≤2 rows (was ~115); unstamped batches drain byte-identically; god-mode hands, multiplayer worlds, and mixed batches are never stamped.
• Skills teaching additions (ride this build's skills.json): camera-first-person.md teaches crouch as an eye-height change on the FPS feature list — route eyeHeight, never camera pitch (creator report ma1neac: Savi's first-try crouch tilted the camera; eyeHeight existed all along, invisible from her base context); combat.md's Predicted Kills section gains its premise line naming the current host-event NPC damage shape (an engine change to client-auth NPC intents rewrites the section in the same PR); debugging.md gains the measured-signature-is-a-grep-key line (dig f4510109: five mechanism fixes beaten every tick by a stale clamp the user's own number named twice).
• Retired sprite art stops being asked for forever — the sprite-metadata derive queue prunes at consumption (ledger 1813, dump 9766d757). The host's derive queue had success-only exits: entity despawn and spec art-swap never pruned it, so a mid-session art retire kept paying derive fetches for retired art through the claimed-fetch seam and re-offered rail.assetMetadata every 10s into the relay's unreferenced refusal — forever (4 retired refs × ≥49min; only a reload cleared it). The sprite2d reference walk moves into ONE shared predicate (tome/sprite-texture-refs.ts) consulted at fetch launch and offer/landing — the queue is scheduling state, never a shadow reference list, so despawn and art-swap retire their asks the same sweep — and the relay's unreferenced verdict now routes into hydration as a terminal door. Deliberately not #11334's give-up pole: still-referenced refs keep their ordinary retry ladder (pinned), and a retired ref re-queues on a fresh ladder from any new live reference.
• Studio input pair (kiln-side — rides kiln deploys, live for every room regardless of engine pin). (1) File drags over the game canvas reach the page again (#11352): the kernel iframe is cross-origin, so a hovering drag routed every drag event into its document and the parent's AssetDropOverlayV4 went silent — drops over the canvas vanished into the game (thread 1785273583, dump e5cab07b). Kernel frames now go pointer-inert only while a Files drag is in flight (DataTransfer.types gate keeps in-game pointer interactions untouched; a depth counter defeats dragenter/dragleave flicker), and every end-of-drag signal restores — drop, dragend, leave-to-outside, window blur, safety timeout, unmount. (2) A quick Tab tap right after a voice send toggles chat again (#11354): a released take now answers hasVoicedAudio() false, so the 0.5–6s settle window stops misreading the tap as TALK and swallowing the chat toggle (cal, dump ea53b5c2).
• Cold animation sheets stop flashing giant — the texture-swap hold keeps the WHOLE last-good draw tuple (ledger 1817, #11370). A sheet-per-animation script authors texture+uvRect+size+anchor as one write, but applyComposedSprite's mid-fetch hold kept only the old texture while the new sheet's geometry applied immediately — first play of a cold sheet rendered the old sheet's texels stretched over the new-sized quad (~6× blowup) until the fetch landed. The hold now carries the entire last-good draw value and the existing subscribe re-applies the latest authored value whole when the texture arrives; geometry churn without a texture change never enters the hold (the warm spritesheet-frame path stays immediate, pinned by test).
• WebKit sessions bypass render bundles — the Safari/iOS wall collapse closes (#11337; WebKit RenderBundleEncoder.mm, deep-dive receipts in docs/renderer-gpu-deep-dive.md). Shipped WebKit marks any bundle carrying drawIndirect/drawIndexedIndirect as requiresCommandReplay and re-replays its commands into freshly constructed Metal indirect command buffers on EVERY executeBundles call — the AGX ICB construction pegged the GPU process's WebGPU work-queue thread (93.6% of its samples in replayCommands/makeICB) and the frame's present handshake queued behind it at p50 275ms. This is #8970's iPhone wall collapse, named. Every lume bundle draws indirect (cull args buffers), so on those builds bundles are pure overhead: the UA verdict reusableIndirectBundles:false (bare-AppleWebKit desktop UAs + every iOS browser; not probeable via error scopes — a perf pathology, not a validation failure) drops the bundle profile and every contributor takes its existing direct-command path. No parallel mechanism; Chrome/Dawn keeps bundles. Riding the same hunt, three JSC per-tick churn eliminations (sim-side −63%): bind-group/layout cache keys become an interned-integer trie and canonicalJson dies (per-frame rope flatten + hash was a dominant JSC cost); ground sampling goes revision-driven with a per-foot IK memo (the per-frame terrain index rebuild could never survive a frame by construction); scripted-primitive ingest settles SILENT on a hook-fed dirty set (~4,800 resolveDeriveWork calls × 30Hz on a settled world → zero, pinned by silence tests).

technical notes

• Below-horizon open sky — atmosphere.ground: false (adjudication r-e98895c5; floating-island worlds). One declarative place-level atmosphere property: ground: false declares "no ground plane" and the procedural sky becomes full-sphere atmosphere. In the sky-view LUT (sky-luts.ts), below-horizon rays march to the atmosphere's far exit instead of the ground hit, the medium continues at sea-level density below the reference radius (per-sample radial clamp), and the lit-ground bounce term is skipped — the below-horizon rows come out as physically-derived downward aerial perspective (Hillaire's own integral with the ground intersection removed: haze that saturates toward the sea-level in-scatter limit at the nadir), NOT a mirror and NOT a pinned horizon clamp. The horizon stays seamless by construction (the integrand varies continuously through the tangent ray). Plumbing: schema → resolveAtmosphereSkySource → DrawSkybox.ground → skybox handler → SkyValues.openSky → the Sky uniform's spare pad slot; the flag folds into the scattering change key, so a live toggle rebuilds the LUTs and the IBL (the environment capture and sky-driven ambient inherit the haze below automatically — floating islands get lit from below by it, physically right). The grounded default is untouched: openSky = 0 leaves every sky-view expression the grounded path verbatim (above-horizon rows are unchanged even when open — those rays never hit ground), transmittance/multi-scatter LUTs never read the flag (the planet remains the twilight shadower and the ambient's ground), and the atmosphere-open-sky render-harness fixture pins the open-sky signature on GPU (its thresholds discriminate both states with measured margins).
• physics/step perf reports become lagging indicators (jacob's ruling, #inventors 1785193978, 07-27: "performance reports to savi should be lagging until we're 100% sure that there's an issue" — his screenshot: a single-tick physics blip at JOIN, zero moving objects, reached Savi as a client perf report and the creator as a slowdown notice; the three-consecutive-strikes trip from #10952 fired ~100ms into any breach with no join exemption). The physics-step-budget lane (behavior-watchdog.ts) now requires the breach to HOLD unbroken for PHYSICS_STEP_SUSTAIN_SECONDS (5s) of wall clock on top of the existing consecutive/separated strike laws — a spike of any size, even several over-budget ticks in a row, is never evidence — and the first PHYSICS_STEP_JOIN_GRACE_SECONDS (10s) after the world boots or after any place first steps its physics (PlacePhysicsSteppedTickResource, the same stamp the transition veil's settled reads) are exempt entirely: no evidence accrues, so a join/place-load blip reports nothing, ever. A visibility resume re-anchors the grace (the flip already wiped the lane's state; the wake burst is the same expected-physics class as a join). A genuine population melt (probe 5703dcd7's every-tick billing) still clears both gates trivially and reports once — the mechanism, teach numbers, consent rule, DM latch, and DD breadcrumb are all unchanged.
• BREAKING: powerline splines mint poles by default again (jacob's 07-27 walk of the 5.2.7 zoo: the bare 'Powerline: wood' exhibit rendered as wires floating unanchored — one run ending mid-air, the wire bundle sagging against nothing). #10870's poles-opt-in default was jacob's ruling for the string kinds (fairy lights, bunting); powerline got swept into the same default, but a power line's poles are the product, not optional supports. Bare powerline runs route to the grounded pole+crossarm layout (pole_N + per-span wire_<span>_<wire>, byte-identical to pre-#10870); poles: false routes a run to the #10870 draped layout (one whole-run wire_N cable per wireCount, hung at the pole layout's wire height). poles: true stays valid and redundant. Stringlight/bannerline defaults untouched.
• Authored-realm boot: the starvation class is eliminated, not tuned (2026-07 incident: 3 prod apps in 8h, one hard soft-lock — a fixed 4s hello deadline racing a 2.85MB iframe module on starved devices, with a session-permanent failure latch). Four structural changes, one per mechanism:
  • The engine is out of the UI iframe. frame/lifecycle.ts imported @/tome/compiler — the whole-engine compile rail — which dragged ObjectAPI, mantle physics, terrain streaming and frustum culling into the authored-realm bundle (1005 modules, 2,854,157 minified bytes). The module rail (require()/lib compilation, source transforms, dep watches, UI-lifecycle compile) now lives in src/tome/script-modules.ts (engine-free; structuredCloneTomeScriptValue's snapshot-proxy cluster extracted to script-value-clone.ts), and compiler.ts re-exports it — one implementation, zero engine-side import churn. The bundle is now 213,587 minified bytes (62 modules) — a 92.5% cut — and frame-entry.size.test.ts pins a 512,000-byte CI ceiling so an engine-scale import can never creep back in. require("builtin/*"), quantize-off compilation, uiGlobals/audio injections, and the deterministic-math/numeric-runtime installs are byte-identical in-frame.
  • The boot deadline arms on progress, not wall clock. The iframe load event splits the two failure classes the old single timer conflated: NO LOAD (asset fetch failed/blocked — the class a cache-busted retry can fix) keeps the retry ladder on REALM_BOOT_LOAD_TIMEOUT_MS; LOADED-BUT-NO-HELLO (starvation, or a pre-hello crash carried by the boot-error relay) never retries against the identical immutable module — it faults once (diagnostic) and keeps waiting through REALM_BOOT_HELLO_EXTENDED_TIMEOUT_MS (30s), so a starved frame that catches up still boots. Hello is accepted from either pre-hello phase (module scripts execute before the document load event).
  • The terminal latch is deleted. A failed target re-arms on the next mount-trigger message (nonempty render / lifecycle mount — the lazy-mount trigger, both targets), giving the field-requested periodic re-retry with zero new machinery; the dead, caller-less remount() escape hatch is removed. Boot faults latch one-per-phase-per-target-per-session, so re-armed ladders retry silently instead of spamming ui.realm.
  • The fault lines name the class. shell document never loaded … (network/serving) vs authored realm boot starved (… no hello …still waiting…) (starvation/parse, with crash detail when relayed) vs no ready after retry (init handshake stall) — the next dig is a read, not an 8-hour correlation. All keep the authored realm boot grep prefix; the misleading always-epoch 2 line is gone.
• Script loop budget: the wedge-the-renderer class is contained (ledger 1328). A creator behavior script that never returns (while (true) {}) used to block the tick forever on every surface scripts run — browser client-simulated rooms, the Bun container tier, workerd realms — and all wall-clock watchdogs live ON the tick, so none could fire (behavior-watchdog.ts named the limitation). Now every body compiled through the single compileFunctionFactory choke point (tome compiler, terrain generator-runtime, voxel templates share the memo) gets AST-level back-edge instrumentation (engine/library/script-loop-budget.ts, acorn parse — real AST, never regex): each function that directly contains a loop declares a per-invocation int32 counter, each loop back-edge (while / do-while / for / for-of / for-in, labeled included) pays one increment + one predictable branch, and the full budget comparison runs every 1024th iteration. Exhaustion throws the named ScriptBudgetExceeded (script attribution + approximate loop line), which rides the ordinary throwing-handler containment into the runtime logs — the tick CONTINUES and Savi gets a teachable fault instead of a dead room.
• Ceiling is generous by design (2^28 ≈ 268M iterations per invocation — a wedge-catcher, never a perf governor): the zoo's heaviest real exhibits stay under ~10^4 iterations/invocation, the heaviest legitimate engine-invited shape (full-map generator sweep ≈ 8.4M) sits ~32× under the ceiling, and a tight wedge still trips in well under a second. Per-invocation counters mean bounded per-tick loops can never accumulate toward the budget across ticks.
• Fail-open law: unparseable bodies compile byte-identical to before (containment never breaks a script that works today); loop-free bodies skip the transform entirely. Workerd startup-seal semantics untouched — instrumentation runs inside the memo-miss path before new Function, so startup warms compile the instrumented body and a post-seal miss still refuses with CodegenStartupOnlyError before any parse. Injected fragments carry no newlines (stack line numbers survive) and identifiers are collision-checked against the body text.
• Scope v1 deliberately: loop back-edges only — no recursion instrumentation (stack overflow self-contains), no async coverage (await-forever doesn't block the tick), no per-op cost accounting.
• BREAKING: terrain marks become named-target verbs — the bulk marks clobber is unrepresentable (jacob's bless, thread 1785200291; the oak-path/pond specimen, dump 2243de5f: one patchTerrain({ marks }) call silently deleted every mark it didn't name, verified green by a single-key read-back). Three top-level ObjectAPI methods — addMark(key, mark, place?) (add-or-replace one), updateMark(key, patch, place?) (deep-merge into one; throws on an absent key with the add/update asymmetry teach), removeMark(key | key[], place?) (delete by name; idempotent on missing keys) — all riding patchTerrain's spec-write core (same place resolution, validation, row commit, no-op verdict, persist stream). No expression in this vocabulary can touch a mark it doesn't name.
• patchTerrain({ marks }) as a same-kind operation throws the retirement teach, naming the casualties mechanically ([Tome] patchTerrain(): "marks" replaces the whole mark map — this call would delete N marks you didn't name (…). Use addMark(key, mark) / updateMark(key, patch) / removeMark(key). Rebuilding the set? removeMark the old keys first, then addMark the new ones. To wipe the map deliberately: removeMark([…]). — both key lists BOUNDED: casualties coalesce past 8 named, and a >8-key map's wipe hint self-computes via removeMark(Object.keys(api.getSpec("places.<id>.terrain.marks"))) so it stays a teach, not an 18k-char wall) — the objects-array refusal law, extended to the sibling collection. The carve-out is the authoring create: a kind-switching patch (and a first kind over a markless base) replaces terrain wholesale, so marks there has no prior map to clobber and keeps working. marks: null and the addMarks/removeMarks patch sub-keys (both accepted shapes) are deleted with errors naming the successors.
• The persisted wire goes granular: mark verbs record addMarks: [{key, value}] / removeMarks: [keys] ops instead of echoing the merged map as a bulk marks replacement (the old buildPersistedTerrainPatch behavior) — the durable fold now merges disjoint concurrent mark writers instead of last-map-wins, and an engine carrying the verbs can never put a same-kind bulk replacement on the wire.
• Both folds enforce the same named-target law via shared @spawn/tome-schemas primitives (terrainMarksReplacementCasualties, isTerrainMarksRemovalEcho, terrainMarksBulkReplaceRetiredMessage): kiln's durable gate throws the identical retirement message on a same-kind bulk replacement that deletes marks it didn't name; cf-kernel's spec-mutation fold skips that class (no error channel — never destructive). Pre-verb engines stay compatible through mechanical classification, not version sniffing: their persist layer echoed the full merged map for every mark op, so an add/update arrives as a superset (deletes nothing unnamed — folds), a removeMarks arrives as a pure-erasure echo (base echo minus removed keys, or null — folds), and only the clobber class (writes riding unnamed deletions) is refused. Kiln's addMarks wire parsing narrows to the canonical {key, value} array the engine emits (the record/single-entry shapes had zero wire producers).
• Teach-side swap in the same change: the always-on <terrain> block teaches the three verbs where the bulk marks?: field sat alone; _examples river/ocean rewritten to addMark; heightmap-terrain / voxel-terrain / structures / water-and-swimming skills and the api-reference regenerate to the verbs; studio-chat's run_script teach and the api.addMarks phantom-lint entry now point at addMark.
• Cross-player effect audiences: the silent lie becomes a named teaching fault — phase one is self-only (jacob's ruling, #inventors 1785207433: "Cross-player audiences are structurally dead under relay — two independent verified blocks. Phase one is self-only or it lies."). In client-auth multiplayer every effect call executes on a CLIENT (the acting player's machine, the place host, or the relay exec host), and a cross-player audience cannot be honored from there — two independent structural blocks: (1) EMIT-SIDE, the fan-out cannot see or address the room's other players (SessionOwner replicates owner-only and is server-stamped — session.ts — so the nearby/place/all loops in object-api.ts enumerate exactly {self}, and rows placed on a remote player's entity die at the client-auth upload envelope, runtime-client.ts getClientAuthUploadView); (2) WIRE-SIDE, the room has no per-player delivery channel (relay fan-out is broadcast; the owner-replicated carriers TomeJuiceTargeted/TomePlayerJuiceState are stripped at every peer reader — relay-peer-apply.ts stripPeerInvisibleRows / PEER_VISIBLE_REPLICATE_MODES, the law that closed the 2026-07-23 session/owner cross-wire). Previously an explicit nearby/place/all/other-player audience silently collapsed to self (the exact screenShake/vignette-with-nearby break the ruling names). Now resolveJuiceEventAudience/resolvePlayerStateAudience route every explicit audience through teachCrossPlayerAudienceSelfOnly: in client-auth multiplayer client worlds it records a named teaching fault on the getLogs rail (mutationWarn — "audience 'nearby' can't reach other players yet — effects are self-only in multiplayer for now", with the per-space action: world-anchored effects say drop-the-option since AOI already reaches everyone; screen/state effects say call-it-from-each-player's-own-trigger). Delivery is unchanged — the self half still applies; player audiences that resolve to the local session player (the ambient hook pin's own shape) never teach; server worlds (kernel-tier DO rooms, where the fan-out genuinely works) and singleplayer (trivially honest) never teach. Docs narrowed in the same change: the Audience @tomeapi block (types.ts), the generator's audience-defaults teaching block (generate-tome-api-docs.ts → api-reference §Audience defaults), and game-feel.md's manager-juice gotcha now teach the self-only phase-one contract. Runtime-fault-only compat: the Audience type keeps its members (existing specs carry nearby/place/all; scripts are untyped at runtime) — the narrowing is contract + fault, not a type break.
• The lifetime reaper of last resort now fires on a successorless-HELD seat whose sitting host is suspension-stamped (fixes the warm-room-leak regression the successorless hold (ledger 1788, #11256) reintroduced for the never-returning-solo class). reapsExpiredLifetimeHere's server branch keyed on "place unhosted" (getPlaceHostEntry === undefined); the hold keeps the entry — same clientId, same epoch, "frozen-in-fact exactly like unhosted: nothing simulates a held place" — so a solo room whose owner F5'd or alt-tabbed away forever deferred every api.spawn({ lifetime }) reap indefinitely: the exact ledger-#732 warm-room ghost the deadline component was built to kill. "Hosted" for reap purposes now means ACTIVELY SIMULATING: the server also reaps the paused remainder when the seat's sitting host is suspension-stamped (the replicated word for "this session simulates nothing" — the same boundary that classifies its envelope into the remainder; the drain refuses a stamped session's uploads wholesale and any resume re-bases from a reset, so the reap can never race a valid write). In multi-client rooms a stamped host is re-elected away the same reconcile tick, so the new clause effectively fires only on the held solo room. The unstamped hold flavors (silent, off-Streaming past the retention ceiling, a god-parked detach) deliberately still defer — no authority boundary has been declared for them and each has a bounded exit. The hold's own semantics are untouched (all #11256 pins green); the GHOST solo e2e now asserts BOTH truths: seat held AND server reaps at one-tick precision.
• properties.-prefix forgiveness in normalizePropertyKey (tome/api/properties.ts): setObjectProperty(id, "properties.light.intensity", …) — the spelling authors reach for because the spec nests object properties under properties — now strips the prefix and resolves identically to the bare key, silently, the same posture as the existing position → feetPosition alias. Kills the unknown property "properties.light.intensity" — call ignored class for Savi, wisps, mods, and humans at once (ravi's promotion-audit receipts, ×2 in staging events). One normalization site covers set/get/batch/dotted paths; a bare properties key (no dot) still rides the unknown-property teaching rail.
• Fog numeric ranges warn instead of clamping silently (tome/api/dead-write-warnings.ts, new fogRangeClampRule row in the atmosphere table): a patchAtmosphere fog patch whose merged state the renderer would clamp now warns in the result channel naming the key, the given value, and the allowed range — linear far <= near (renderer clamps far to near + 1e-4 → hard fog wall at near instead of a gradient; atmosphere-sync's unauthored defaults near ?? 100 / far ?? 500 participate the way they render) and exp2 density < 0 (the shader squares density, so a negative renders exactly like its absolute value). Warn-and-clamp, deliberately not a reject: a latest-version-per-app scan of prod game_specs (2026-07-27) found 2 live specs carrying far == near linear fog that render through the clamp today — a hard reject would fault them on their next authored patch, and patchAtmosphere's told-success ⇒ readable-back contract stays intact (the doc keeps the authored values; the renderer clamps at its own boundary). Judged only when the patch touches a range key (kind/near/far/density); non-finite values remain applyFog's coercion lane.
• Regression coverage red→green in __tests__/object-api.test.ts (prefix resolves like the bare key, composes with the position alias, bare properties still teaches) and __tests__/dead-write-warnings.test.ts (both range rows, default participation, silence for in-range/untouched/non-finite, plus an e2e pinning the warn rides the green receipt on the real verb).
• player/-prefixed owners can now address their own spawned children (tome/api/object-api.ts resolveObjectIdFromEntity; DUST LINE lag dig, dump 01b9df / report b955324d §3A): the player/ early return resolved exact entity ids only and preempted the local-child scope every other id form gets, so an entity whose OWN id starts with player/ — every player rig — could never resolve api.id + suffix back to the parts it spawned with api.spawn(api.id + suffix, { parent: api.id }). The children existed (the dump's teach line showed hasChild: true while the call dropped); the writes were discarded at 497/session in DUST LINE and the flood repeatedly misdirected that game's own debugging journal. On an exact-id miss the resolver now falls through to resolveLocalChildId — local-child scope only; every other missed player/… id stays null, and live exact ids still win first. Red-first regression pins the rig pattern end-to-end (spawn → resolve → setObjectProperty lands) plus the exact-first and stays-null contracts.
• The authored-leaf-id fallback no longer walks the world per miss (same resolver tail + findLeafIdCandidates; §3B): any slash-free id that missed every cheap scope triggered a full world.query(TomeChildren) walk — endsWith + hasEntity per listed child, O(world) per miss (~65 µs on a 2,203-entity DUST LINE-shaped world; a script looping over stored-but-dead ids paid for the whole world on every dropped call). Both sites now read a leaf→ids index (tome/leaf-id-index, classified re-derive at the exec boundary) maintained by TomeChildren component events — which fire synchronously on every write path (ObjectAPI spawn/destroy/reparent, interpreter, replicated deltas) and on parent despawn. Duplicate entries are refcounts so out-of-order replicated childIds writes (new parent's list landing before the old parent's removal) can't orphan a live listing. Lookup semantics are byte-equivalent to the scan: same per-child hasEntity liveness guard, same unique-leaf match, same ambiguity refusal. Micro-bench on the 2,203-entity world: miss 65.06 µs → 0.53 µs, leaf-hit 64.65 µs → 0.56 µs (~120×). Churn tests pin spawn/destroy/respawn-elsewhere/reparent/parent-despawn/out-of-order-replication equivalence.
• Sim-tick attribution in the debug dump — the instrument that ends the blind-perf-pass class (b955324d §5: DUST LINE's sim ran 11× over budget, two structural perf passes landed without curing it, and the dump carried ONE aggregate sim number — "the profile is structural, not a stopwatch"). The #631 simTiming payload now carries per-system AND per-behavior-script milliseconds over the same ~45-tick window, on both sides: the client worker's perf-rollup block and the server's input-stats capture each gain simTiming.attribution = { ticks, entries: [{ name, kind: "system" | "script", p50Ms, p95Ms, maxMs, totalMs }] }. No new clocks on the hot path — the collector (engine/runtime/core/sim-attribution.ts) routes measurements the engine already takes: Diagnostics.runWrapped/runTimed gained an onSample tap (every system, every tick, ecs/commit and changelog/prune included), and behavior-update reports the per-entity elapsed it already measures for the watchdog through the new SimAttributionResource, keyed by the composed behavior's normalized update-bearing script refs (dust-storm.js — spec-declared objects included, which carry no behaviorRefs; multi-script entities join their refs; non-authority multiplayer clients stay clock-free and simply ship no script rows). Client-side collection is gated to the MAIN simulation phase — exactly the window the client tick ring measures, so the two blocks cross-read. Payload bounded by construction: top 12 systems + top 8 scripts by window-total ms, each kind's remainder folded into "(other)"; tracked-name caps (128 systems / 32 scripts) route overflow into the same fold. Kiln retains the block through the existing simTiming lane (re-validated + re-bounded, session-captures.ts) and the dump summary renders "Sim Attribution — top by p50 ms per tick" beside the Sim Tick Timing rings, script rows as a sublist under the behavior-update system row they subdivide. Instrument overhead measured (scripts/bench-sim-attribution.ts, the #11220 bar): 28µs/tick at a deliberately heavy 64-systems + 300-script-samples scale = 0.085% of the 33.3ms tick budget, runWrapped tap delta unmeasurable — noise floor, so the instrument ships unsampled.
• Sole-candidate place-host churn: a place is never unhosted out from under a live connection — the successorless hold (ledger 1788, dump b0298916 / incident family across ≥7 apps: in a room whose place has ONE live client — the creator, also its host — every transport/visibility boundary deleted the TomePlaceHosts entry because electable.length === 0, then re-elected at a bumped epoch once the client recovered; every host write uploaded around the boundary died silently at the drain's stale-epoch gate on the unhosted branch (tableEpoch:null), and because uploads are deltas against the client's own last-sent state the lost rows were never re-sent — one-shot script writes (entered/health init) forked the room's copy from the client's truth permanently; F5 reproduced ~100%, room restart + fresh join was the only cure). The fix is election-side, at the unhost branch of reconcilePlace: when retention declines the sitting host for a reason its connection record survives — detached inside the 20s disconnect grace (F5/pagehide), suspension-stamped (alt-tab past the takeover grace), sustained silence, or off-Streaming past the retention ceiling — and NO other candidate is electable, the entry is HELD: same clientId, same epoch, no revoke, frozen-in-fact exactly like unhosted (nothing simulates a held place; server-write-forward only forwards to Streaming connections; the drain's suspension/ingress gates refuse a non-live host's writes). The returning client's uploads validate the moment it recovers — the resume reset carries the held table at the epoch the client already adopted, and an F5 rejoin adopts hostship on its join's OWN reset with no unhosted gap. The hold never outranks a real successor (any electable candidate takes the place through ordinary election, same epoch bump as before) and never shelters a genuine departure (connection gone/tearing down, disconnect-grace expiry, place-leave, attach-time opt-out unhost exactly as before, now with the retention-decline reason on the netcode.place_host.unhosted line — the solo-churn field dumps carried six drop windows and zero election-side evidence). New ops receipts: netcode.place_host.successorless_hold / successorless_hold_released (one pair per episode, with reason, heldTicks, and outcome) and a successorlessHolds tenure counter. This also deletes the precondition of the #11237 returning-tab wedge for the un-stamped (god-parked) sole population: the "dead" frozen table claim stays live, so writes land directly and the forced re-seat rail is left to the moved-table wedges it was built for.
• UI render heartbeat rides the debug dump — "frozen authored UI + all-green instruments" stops being representable (ledger 1786, dig 72d4ee01: a creator stared at an unclosable shop menu while Savi's live bisect proved the close click ARRIVED and flipped state server-side; the dump summary carried sim-tick/renderer/network/scene-gate and NOTHING about UI render, and run_ui_script cannot reach the nested cross-origin realm). The HUD pipeline stage ledger (c1762332's instrument) gains the two legs the incident class needs and then surfaces in the dump: (1) a rejected stage — the apply-render.ts invalid-inline-handler early return, which keeps the OLD DOM painted on purpose, now counts itself via a new ui.rejected frame receipt (sig echo + htmlLen + teaching-message head; protocol spec + 120/s cap mirroring ui.applied, relayed uiRejected by the realm host, recorded on the ledger beside applied); (2) a client-side ui.fault counter — uiLifecycleFault arrivals count on the ledger at the worker choke point BEFORE the behavior-fault rail forward, so a fault count that moved while getLogs stayed empty names the rail's dead leg instead of reading as "no fault fired". The whole ledger (compile state, sent/deduped/applied/rejected sig-stamped stage breadcrumbs, faults) now rides the 15s perf rollup as payload.uiRender → kiln session-captures retains it (re-validated, bounded) → the debug-dump diagnostics carry it → the dump summary renders a per-plane UI render: line beside Scene gate, including the derived stale-paint tell (⚠ last sent ≠ last applied — the painted DOM is NOT the last render). Fault-rail verdict from the same commission: the DM/log path is intact end-to-end in code (frame ui.fault → host → uiLifecycleFault → sendClientBehaviorFault → engine.diagnostic, allowlisted behavior-fault → runtime log + Savi DM) — the incident session's empty getLogs is evidence the reject class never fired on that client, which the heartbeat now proves or refutes from the dump alone.
• Host-migration desync: the forced re-seat rail admits Suspended senders — the unhosted-epoch silence is healed, not just counted (2026-07-27 field family, verdict 5c2a90ee: four specimens on the unhosted-table branch — tableEntry === undefined, "the place is no longer hosted" — one 204s / 31,482-write window; partner gutterbt's Castle Clash session, dumps c870e5ce/7ec9cc8b: a tab goes inactive, the place host migrates/unhosts, the returning client keeps stamping its frozen table copy and every host write drops silently, unrecovered by room restart or reload). The wedge was a false premise at the rail's connection gate: it declined any non-Streaming sender on the claim that its uploads "never reach this drain" — false for plain Suspended since the ledger-1572 ingress admit. A session the server still classifies Suspended while its tab is actually back and simulating had NO exit: ingress admits its uploads, the stale-epoch gate drops every host write, the truth echo is inert on the unhosted branch (v1 null-truth), egress skips the connection wholesale, election cannot touch it, and the one rail built for exactly this wedge (ledger 1257) declined per-message forever — reseatsDeclined with projectionState: Suspended was the counted-but-unhealed signature. The gate now tracks the ingress admit exactly: Streaming and Suspended-without-rebase-debt force (same floors, same cooldown, same NeedsReset directive through the production make-before-break reset rail); NeedsReset, Suspended-mid-rebase, and detached still decline (a rebase is in flight, or the directive cannot be delivered). Session-STAMPED zombies never reach this gate (the isSessionSuspended wholesale drop runs earlier), so the admit can never fight the suspension takeover. A genuinely-hidden tab discards the snapshot until it returns — bounded by the reseat cooldown and the reset-ack hold backoff — replacing an UNBOUNDED silent write-floor. Red-first e2e pins the whole field arc: god-parked creator (the un-stamped suspension population), tab hides, place unhosts on silence, tab returns without the server ever hearing the Active, the client stamps the dead claim for a sustained window → one forced re-seat, the client rebases onto the unhosted truth, election re-hosts it at the bumped epoch, and its writes land where they silently dropped.
• fx VM algebra completion: sin, cos, atan2, fract, floor, step, smoothstep, abs, mod, pow, sqrt, dot as field ops on both backends (branchless WGSL, CPU/GPU edge semantics pinned: totalized pow(|x|,y), atan2 x=0 column defined), plus channelIndex() for exact per-particle spawn ordinals and .yaw() sugar (atan2(−z, x), the ground-plane spin convention)
• bindings.frame: flipbook as a field over the sprite sink's layers (floor()ed, clamped; unset keeps the stable per-life random pick bit-for-bit); sheet("…?animated=CxR") slices one uploaded atlas into layers at pack build; fx texture packs now carry full mip chains with trilinear sampling
• pos:/vel: authored kinematics (integrator bypass; attr("p") reads last tick); entity(id) live-transform vec3 fields (≤4 links per effect, dead links freeze at last sample)
• sprite sink: soft: meters depth fade against the viewport share; blend:"distort" (color.xy → screen-space refraction offset, alpha = mix); align:"ground" honors stretch as a plain aspect factor along an authored rotation binding
• floor:"bounce" with per-particle restitution (bounce: number | spawn-time field); floor:"die" death records now carry age-at-impact on BOTH backends (was end-of-life on CPU)
• one dynamic light per population now follows the alive-particle centroid on the GPU backend too (anchor stand-in path deleted); light radius accepts a field
• B12 event rail: api.pulseFx(id, name, { at?, data? }) + spawn: { when: { event: "pulse", name } } arms — integer counters on the replicated FxEmitter, per-tick coalescing, late-join snapshot-then-deltas; world-anchored juice kinds are simulator-elected at the emit funnel (the doubled-VFX class is structurally unrepresentable; realm:"server" is a compat no-op)
• decal: [start, end] lifetime ramps on scalar fields, attachTo alias, anchor references resolve like every sibling ("player", place-scoped, child ids); part materials gain dissolve: 0..1 (perlin-erode cutaway, emissive edge tint, blended lane)
• BREAKING (vfxContractV2 games only): slash throws on invalid args and requires size in meters, defaults to a horizontal arc at the caller's yaw with a seeded sweep side; decal rotation in degrees; decal size pairs are ramps
• slash edgeBody preset product (20 names) retired to an untaught legacy lowering; the 14 particleBurst presets frozen into a lowering table; oklch color strings accepted spec-wide in fx fields and juice colors (slash's ride the v2 gate — legacy slash colors stay number-only, exactly as shipped)
• governance: slash/shockwave/decal instances register in the fx census and pressure ladder with honest cost weights (distort 2×, soft +0.5, slash 3×, shockwave 2×); new fx-bespoke-clamp diagnostic
• 27 confirmed bug fixes from the adversarially-verified VFX scout sweep, each regression-pinned — highlights: space:"local" localP force fields correct and CPU/GPU-identical at non-origin anchors; inheritVelocity works platform-wide (anchor velocity derived at the sampling seam); duration'd highlight/pushLook cleanup survives the calling entity's death; GPU rate-spawn derivation is closed-form (rate 1e9 costs O(1)); ribbon segments validated/capped; live param-patch reshapes take effect on the CPU backend (reset-on-grow, matching GPU); fx census/expected-value folds never certify non-monotone ops or fold taught idioms to 0

technical notes

• Ledger #597's failure-visibility cure now exists on the CLIENT chunk-build path (ledger 1771 — the same half-cure class as the #10902/#10924 blur family: a fix that landed on one of two symmetric paths). Pre-fix, every client build failure (job error/canceled/stale, stuck-past-deadline) was consumed silently, re-marked, and resubmitted every tick forever — no reason, no counter, no backoff, no terminal state; cal's support chunk looped 3 hours emitting nothing (report 2b9742c1). Four pieces, mirroring the server's #597 vocabulary:
  • Failure reasons: every failed client chunk build logs the actual reason via tomeLogger ([terrain/client-build] chunk build failed: … consecutiveFailures=N retryBackoffTicks=… reason=…), first failure immediately, re-warn once a minute.
  • Counter + backoff: per-chunk consecutive-failure count with the server's doubling backoff (serverChunkBuildRetryBackoffTicks, 1s→60s) gating resubmission in the Phase-2 scan; a completed build resets it.
  • Terminal park (park-don't-hammer): after 8 consecutive failures of UNCHANGED inputs the chunk parks on its inputs hash with a logged verdict — rescue re-requests and place-wide dirty sweeps are absorbed instead of hammering the proven-failing build; the park lifts the moment the chunk's inputs actually change.
  • Scene-critical escalation (the #10927 wall pattern): a terminal park on the LOCAL player's support chunk — they're standing in ground this client provably cannot build, sinking into the rescue's containment loop — emits the new terrain-collider-build-parked engine diagnostic (server runtime log + DM + stdout breadcrumb, naming chunk and reason) and raises the player-facing reload wall through the loading-state error channel (one per world). Fires both at park time and when a player later walks into an already-parked chunk.
• Rescue-remediation attempts survive across episodes (the report's second bug: attempt=1 three times across 3 hours). The remediation entry no longer resets on a firing gap — the rescue pauses when the player leaves, not when the chunk heals — it resets only when the side actually observes the chunk's collider ready (client: collider readiness counts; server: done build + intact collider plane). The #597 honesty bound (escalation after 3 attempts) is now reachable for the episodic failure shape, on both sides symmetrically.
• Server build path (server-terrain-system.ts) untouched — byte-identical.
• Coverage, red-first on the pre-fix build (93 submissions in 93 ticks vs 3 with backoff): src/engine/features/terrain/__tests__/client-chunk-build-failure.test.ts (reason logging, stuck reason, backoff cadence 1/32/93, reset-on-success, terminal park + absorb + lift-on-inputs-change, active-chunk escalation + one-shot wall, walk-into-parked-chunk escalation, no escalation for unoccupied parks) and chunk-rescue.test.ts (attempts 1→2→escalate across gapped episodes on both sides; observed-ready resets).
• layout.maxExtents can no longer die permanently on runtime-spawned GLB children (ledger 1770, P1 — ITERO's 8m-tall zombies / invisible speck enemies with floating HP labels, physics staying correct throughout). Two structural halves:
  • Park without delete. geometry-fit-solve no longer removes GeometryScale when layout + model are present but the model's bounds are unresolved in THIS realm. GeometryScale is a replicated component every realm independently re-derives — deleting on "I don't know yet" turned one cold BoundsRegistry in one realm into a permanent raw-native render. Ignorance now holds any present factor (replicated or previously solved) and parks on the bounds waiter; deletion stays reserved for genuinely-removed fit inputs (layout removed — the interpreter's design-intended strip — or model removed).
  • The wake. The onModelAnalyzed writer (game module serverMount) now lands analyzed bounds through the shared writeBoundsToSpec writer instead of a hand-rolled spec merge. That gains the BoundsRegistry side-write (setBounds → onBoundsReady), so entities parked by geometry-fit-solve re-solve the moment analysis delivers bounds — previously they woke only on the next full applySpec, i.e. possibly never. It also gains the TomeUnfilteredSpecResource merge the hand-rolled path skipped. Still deliberately triangle-less, so bounds-prefetch's completeness gate keeps the glb-bounds derive eligible.
• Regression coverage, red-first on the pre-fix build: src/game/__tests__/geometry-fit-analyzed-bounds-wake.test.ts (the ITERO shape end to end — production game module, singleplayer client-authority spec via the TomeSpec carrier, behavior objectApi.spawn child with model + layout.maxExtents + scale, cold registry, bounds arriving via the analysis listener only after the entity parks) and src/tome/__tests__/geometry-fit-solve.test.ts (park-holds-replicated-factor, park-then-wake solve, layout/model removal still delete).
• The overlap/touch pair reads (getOverlapping/getTouching/isTouching) join the server-realm loud-once teach rail (ledger 1763's class-phrase enumeration, completed — the raycast and velocity/impulse families rode it in #10315/#10888). The multiplayer server never mints a physics runtime (client-auth: mantle and rapier runtime creators are client-only systems), so server-run pair reads are structurally dead — empty answers per call, forever, with no replicated mirror to fall back on — while the old warn told a server behavior that reads are "unavailable in run_script; use behavior scripts", a redirect to exactly where it already was. Server-side the warn now names the mechanism and the redirect (read contacts where the entity simulates; replicate results as state/component writes), and one Savi error DM per (place, script) covers the whole three-verb family on its own notifyDmOnce key — a per-tick contact poll teaches exactly once instead of storming the log with zero DMs. The empty degrade, the mantle/rapier answer paths, the rate-limited warn trail, and every other realm's warn text are byte-identical.
• physics/step joins the tick-budget watchdog — the population melt is no longer silent (ravi's probe 5703dcd7: falling dynamic props cross the half-tick budget between 400–800 bodies, and an 8000-body room ran 2.4Hz with ZERO diagnostics, because the watchdog sampled behavior update() brackets while physics/step is an engine system). The behavior watchdog (behavior-watchdog.ts) gains an engine-system lane watching the whole physics step bracket with the module's own conventions — half-tick budget, BEHAVIOR_BUDGET_STRIKES strictly consecutive separated over-budget ticks, the #443 strike-separation rule, the hidden-tab law — plus a lane-local self-measured stall grace (the behavior lane's inter-pass probe only arms on the authority; multiplayer clients, exactly where physics steps under client-auth, never run it). Sustained over-budget emits the same shape as behavior overruns: a physics-step-budget engine diagnostic naming the mechanism (dynamic-body count, awake count, step ms, tick budget) into the runtime log, one loud-once Savi DM naming the fix (~250 dynamic bodies comfortable, ~400 the ceiling, despawn/pool spawned props, cap spawners — with the #297 consent rule inline, since the named fix reduces live creator content), and a DD-visible server-console breadcrumb (under client-auth the melt costs the browser, not the container — every server-side signal stayed quiet by design). Deliberately diagnostics-only: no parking, no body governor — population is the author's lever and the honest ceiling is device-relative; the trip-time body census is the only added sweep (≤ once per 10s cooldown, never per tick).
• Fixed pointer-only games permanently losing all mouse input when the input mode strands in "overlay" (ledger 1774, incident 36984a9f "Idle Homestead"): the mode is a kernel-side replica of parent overlay state over a lossy change-only postMessage channel, and the #233 self-heal (overlay-state refresh request + honest fallback to game) was keyed to eaten KEYDOWNS only — a mouse-only game never presses a key, so a stranded mode ate its world clicks forever (only a page refresh recovered, and it re-wedged). The healer's evidence now matches the overlay gate's diet: an eaten world-bound mouse press, touch tap, or frame-forwarded keydown feeds the same re-sync lane. A legitimately open overlay is never fought — the parent's answer to the refresh keeps the mode exactly where the parent says it belongs.
• noteEatenGameplayKey renamed to noteEatenGameplayInput (it is no longer key-fed only). No wire changes: the fix reuses the existing spawn:kernel:overlay-state-refresh / parent:overlay:state lane.
• Fixed every world click being wiped before behavior onInput on realm-architecture games (member #2 of the #10902 blur family; field receipts 0/1542 clicks vs 169/169 keys): a world click focuses the full-viewport data-tome-realm frame, the game window fires blur, and raw-capture's window-blur RESET landed in the same drain as the forwarded MOUSE_BUTTON_DOWN — then focusGameplayCanvas bounced focus back so every click re-fired the blur. Blur classification now lives in ONE shared predicate (realm-focus.ts isBlurIntoAuthoredRealm) consulted by both raw-capture and the pointer transport (#10902's private copy migrated); real blurs (other window/tab/devtools) still reset.
• Eliminated the family at the source: a fall-through pointerdown in a realm frame (target <body>/<html> — the world's press) now preventDefaults, so focus never enters the frame on a world press and no host blur fires. Presses on authored UI keep native focus; the spec keeps click firing after a canceled pointerdown, so the pointer-lock gesture lane is untouched.
• Fixed right-click over the world opening the browser's native context menu in both normal play and god mode (dump 259821ee): pre-realm the canvas node suppressed contextmenu, but inside the realm frame suppression only lived on the mount containers — fall-through right-clicks hit <body>. One document-level listener per frame now cancels the default; authored contextmenu handlers keep firing.
• Relay sim tier is now an EXPLICIT host declaration — never an inherited default (ledger 1772, incident de79b468). Since #9786, EngineHostCore defaulted simTier to "relay" and the Bun container host passed no simTier, so the CONTAINER tier — a trusted in-process host that runs creator JS — silently declared "nothing server-side executes" the moment a room upgraded past 5.2.4: crons forwarded to a player seat (whose shared-storage writes refuse with storage_unauthorized), lifecycle hooks skipped hostless, and spec.jobs submissions hung. The default is inverted: an undeclared host is "host-capable" (capability-preserving), and the RoomDO shell — the one host that IS the multiplayer relay tier — declares simTier: "relay" explicitly (SPAWN_SIM_TIER=host-capable stays the ops rollback knob; deployed DO behavior is byte-identical). A version promote can no longer act as a silent capability removal. Pinned by the slim-server manifest suite: an undeclared host registers the full host-capable allowlist, a relay-declaring host registers exactly the relay allowlist.
• A custom (spec.jobs) job submission on a relay-tier room settles an immediate refusal instead of hanging forever. The relay RPC bridge classified non-builtin job ids as {kind:"pass"}, which fell into the relay egress dead-lane drop — no job.response ever arrived and awaitJob wedged silently. Non-builtin ids now settle ok:false immediately with a message naming the tier and where the job class actually runs ("custom job X cannot run on this room's relay tier — … crons and lifecycle hooks run on the resident host client, and a custom job runs on the client that submits it"), the same failNow shape as the bridge's other honest refusals. Red-first e2e coverage in relay-rpc-bridge.e2e.test.ts.
• Placement height answers loudly or not at all (ledger 1773; digs 7ed968cf + 3694dc1f, cal's Final Abyss — vgw-35 parked 12.16m under its own ground because a baked Y fossilized a pre-steepening terrain). hasTerrain(placeId) === false now REFUSES: the samplers return null and warn [terrain] no definition installed for place X once per place per session, instead of silently answering 0 + offset. getTerrainDefinition with no placeId refuses instead of answering whichever place was first in the map (a stranger's ground). Every caller was audited to a chosen behavior: placements PARK at the bare offset with their terrain anchor armed, baking paths (spline, scatter, god-mode gestures) read refused ground as the park origin so { terrain: offset } round-trips exactly, and feature paths treat refusal as feature-off.
• A parked placement re-resolves the moment its place's definition installs. The re-anchor system's watched version is now the ground's inputs — the per-chunk terrain:height field token PLUS a definition install token (terrainDefinitionInstallToken) — so an install by ANY arrival path (spec apply, first-residency expansion, client replication) revisits the parked answer. Before, the gate was the field version alone and an install never moved it: parked meant permanent.
• One ground truth for the drawn and the placed surface. Heightmap placement sampling (sampleReplicatedTerrainHeight, the y: { terrain: N } pin lane, api.getTerrainHeight) now folds in the same heightmap sculpt edits the chunk builds realize (applyHeightSculptEdits, extracted from jobs/chunk-build.ts into one shared module) — a sculpted world's placements land on the ground players see and collide with, not the pre-sculpt generator surface.
• The repair anti-pattern, as doctrine: any re-seat that writes an absolute Y is a future sink — the repair primitive is { terrain: N }, which follows every subsequent terrain change for free.
• Velocity/impulse teach rail completed (ledger 1763, #10888 + #10945): every silent no-op arm in the server-realm contact/motion family now speaks once. setVelocity/applyImpulse on a client-realm body, and the pair-read family (getOverlapping/getTouching) polled from a server-realm manager, each emit one runtime-log diagnostic naming WHY the call can't work in that realm and WHERE to move the code (the shooter's onInput, a client behavior, or an authority-side handler) — instead of returning nothing and letting the script author debug a ghost. Same #597 vocabulary as the collider rails; episode-surviving counters; one report per script per condition.
• A relay-tier room's forwarded crons and lifecycle hooks can write SHARED storage — the exemption keys on host-forwarded provenance, never on the seat and never on "any client may write shared" (ledger 1772 residual, incident de79b468; composes with #10934's explicit tier declaration). On relay tier, crons/lifecycle hooks execute on the resident place-host client, but that seat's shared-key storage writes refused with storage_unauthorized — authorizeForwardedStorage only knew the player-context law plus the singleplayer engine exception, so the taught persistence patterns (cron autosave to world/state, a departed player's disconnect save to user/<departed>/…) silently saved nothing on the tier that is about to become the prod default. Now the lifecycle/cron execution lane stamps its forwarded job submissions (lifecycleSubmitted — minted from hook-forward's marked ObjectAPI lane state, never from creator args, threaded job-dispatch → forwarding facade → wire), and the server honors the stamp only when its OWN facts corroborate it: effective sim tier is relay AND the sender is a currently named place host in the DO's replicated host table (the same table the fire sites target). A non-host client forging the stamp refuses exactly as before; the host's own unstamped player-context writes refuse exactly as before; singleplayer semantics (deliberate shared-key refusal, dig 93bab0de) are untouched — resolveWorldSimTier never answers relay for SP. Red-first coverage in job-forward.test.ts: resident-host cron CAN write shared while a stamped non-host player CANNOT, cross-player disconnect saves, anonymous hosts, tier/declaration gating, hostless rooms, and the end-to-end stamp mint through the wire parse.
• Look scripts gain offscreen render targets: ctx.target(name, { scale | width+height, format }) returns a write-only descriptor with .previous (last frame's contents — touching it arms a ping-pong pair) and .size (live vec2, patched per frame). Default format rgba16float; rgba8unorm option.
• ctx.pass(target, (uv) => colorNode) renders a fullscreen pass into a target and RETURNS the readable texture node (sample/sampleLevel/.size); declaration order IS execution order, and eager graph recording makes read-before-write unrepresentable (a target has no readable surface until a pass hands one back). Passes read ctx.scene/depth/viewZ/params/textures and earlier passes' returned nodes. Passes attach between the composite and look.present at one call site (LookPass.declareScriptPasses).
• Budget rails with teaching errors naming the cap: 8 targets, 16 passes, 2048px fixed-size cap, scale ≤ 1, 256 MiB total target memory.
• Closes the documented TODO(lume-postfx-rtt) boundary — multi-pass effects (separable blur chains, feedback trails, radiance-cascade-style accumulation) are now expressible in plain look scripts.
• GLB parse (ledger 1776, ravi dig b28329ec): a material that authors neither a metallicRoughnessTexture nor a metallicFactor — the raw Meshy 1-texture export that 86% of humanoids ship since the bake removal (#9425/#9440 + #10396) — now defaults metallic 0 / roughness 0.8 instead of the glTF spec's silent metallic=1.0 (near-black in shade under lume; shading.ts's own comment names the hazard). Authored values honored verbatim: an explicit metallicFactor (even 1.0) parses unchanged, mR-map materials keep spec factor-1 (baked assets byte-identical), authored roughnessFactor always wins. Aligns the parse-side default with lume's own DEFAULT_MATERIAL_SOURCE (unauthored = dielectric) — one opinion, one home. Heals the 10 days of already-minted raw assets at load, no backfill. Fixture-tested across 6 material shapes; content-verified on the farmer-woman raw/baked boundary pair. (Re-landed on tiger's KEEP after the before/after pair — #inventors 1785101325.)
• Fixed feet-anchored placement (feetPosition without y / y: { terrain: N }) and api.getTerrainHeight on voxel terrain: the ground sampler pre-floored x/z to whole meters, so at cellSize < 1 fractional positions sampled the neighboring column and baked its height (objects sank into or floated over slope cells).
• 2D voxel places: the height sampler now reads the gameplay slice's cell layer (THE SLICE CONTRACT) — an object's own z is cosmetic depth and no longer selects a phantom column. One correction in the sampler, shared by feet anchors and getTerrainHeight (which previously corrected only its own reads).
• A voxel column with no supporting surface now refuses (null) instead of fabricating verticalRange.min — terrain-relative placements park at their bare offset with the anchor armed and re-seat when ground appears, matching the no-terrain-definition convention (ledger 1773).
• Voxel reads answer loudly or say they can't (the #10949 loud-or-nothing doctrine, chunk-residency edition; dump 8a692ef1 / anatomy 011ef557: Savi's isVoxelSolid(0,30,0) read un-built rock 90–150 m from the player as air BY DESIGN, she announced "the asteroid never generated" and chased a generator bug that didn't exist). VoxelMaterialLookupResource.getCell now returns the third state "unloaded" when a cell sits inside the loadable chunk band (the streaming lattice enumeration over verticalRange) but has no resident grid AND no edit-overlay entry; outside the band air stays air (no chunk can ever exist there — known by construction). Fresh grids, the edit overlay, and stale-grid reads are untouched.
• Every consumer audited to a chosen behavior (the type union forces the audit): ObjectAPI probes surface it honestly + one teach-rail warn per (place, script) shared across the whole family (isVoxelSolid → null, getVoxelMaterial → "unloaded", raycastVoxel/queryVoxels/getWaterLevelAt report unconfirmed scans via onUnloadedCell, setVoxelState/interactWithVoxel/breakVoxel refuse); block-hook local reads treat an unloaded neighbor as absent (writes still land through the edit log + overlay); NPC line-of-sight blocks only on CONFIRMED solid; the stuck-body rescue fires only on confirmed solid and never teleports into unconfirmed clearance; block ticks skip unconfirmable cells; the renderer pointer-raycast bridge deliberately keeps pass-through (picks target what renders, client-resident by construction).
• api.ragdoll(id?, opts?) / api.unragdoll(id?, opts?) (jacob's rq r-5d43631f): a rigged character flips from animation to physics and back — the primitive, not a pipeline; Savi owns the choreography. The skeleton's bones become dynamic mantle capsule bodies (dims from bind-pose bone lengths, sub-scale bones fold into parents, mass by volume share) joined along the skeleton's own hierarchy — hinges derived on straight chains (knees/elbows), balls at branch points (hips/shoulders), no humanoid bone-name table. Initial velocities come from the animation pose delta across the arm tick, so a running character crumples with momentum; opts.impulse adds a hit direction.
• Joint-limit derivation is ONE swappable module (engine/physics/ragdoll/joint-limits.ts) — Jure holds physics design word on ragdoll constraints, and his steer (signed hinge ranges, cone limits, stiffness ladders) replaces that module's internals without touching the builder, runtime, or wire. Design doc: docs/ragdoll-design.md.
• Replication rides client-auth semantics: only the machine that owns the entity's physics builds bone bodies; it publishes RagdollPose (motion-class, canonical forEachParsedBone order — no bone names on the wire) plus the entity transform, and every other machine renders the wire pose. The entity's own body/CC handle is suppressed while ragdolled and re-ensures from unchanged components on release.
• Unragdoll blends: the renderer cross-fades from the last ragdoll pose back to the mixer over blendSeconds (default 0.25 s, smoothstep) — the pose snap is the named failure mode and is pinned red-first (ragdoll-pose.test.ts).
• Rails per the no-lag law: 12 concurrent ragdolls per place (RAGDOLL_PLACE_CAP, teach-rail refusal naming the consent rule — settled ones count; free one deliberately), and settle-freeze default ON (3 s of stillness converts bone bodies to static — corpses keep collision at ~zero solver cost). The physics watchdog (#10952) keeps watching the melt; the cap keeps ragdolls from causing one.
• Red-first coverage: bone-body creation from a fixture rig, joint hierarchy matches the skeleton (world anchors coincide < 1 mm at birth — the mantle-joint-feet-anchors lesson pinned at creation), hinge/ball derivation, pose-delta velocity seeding, drop-and-settle simulation, settle-freeze, cap refusal, unragdoll blend continuity.
• First-person / god-mode local-player hide keeps the player's shadow (jacob's 07-25 report; a95dc46ee9): the hide wrote DrawVisibilityOverride { layerMask: 0 }, which excluded the mesh from the shadow pass as a side effect — the body vanished AND its shadow died. The hide now writes SHADOW_ONLY_LAYER_MASK (bit 31 alone): no camera draws the character (skinned-character tick derives camera-hidden from the camera-mask bits), but it keeps casting, so the first-person player still reads as present on the ground. Root contract pinned by six camera hide asserts (#11014).
• Skills teach the authored-weapon contract for held/aimed/mounted items — the second pole of verts-in-the-bag (#11000, dig 981498cb; jacob's 07-25 "verts in the bag" ruling reached scenery but every held-item example still routed to generated GLBs). camera-first-person.md §Held-Item Viewmodel now builds the viewmodel from a gen script whose first lines declare the frame (-Z muzzle, +Y up, origin at the grip web — identity rotation aims where the camera looks), exports landmarks as constants (export var SIGHT_LINE), computes the ADS anchor by arithmetic instead of a guessed lerp, and authors hands in the weapon's own frame mounted at identity (they cannot drift off the grip). depthTest: false is qualified to flat/simple viewmodels — it erases self-occlusion inside a detailed mesh. custom-geometry.md routes anything the game must aim, grip, or mount to authored geometry (a generated model is a shape with no contract), and api-reference.md's bone-attachment example marks the held-item rotation as a per-rig knob, not a number to copy.
• Look-pass reshape (post-land review of #10980, pre-release — no shipped script is affected): ctx.target now returns a write-only descriptor (.previous + .size, no sample surface); the readable texture node is what ctx.pass returns. Pass builders record eagerly in declaration order, so a read that precedes its producing write is unrepresentable — the read-before-write detector and its teaching error are deleted. One narrowed rail survives: a rewrite pass sampling its own target's already-returned readable node (WebGPU-illegal read-while-write) teaches .previous.
• A stale async pipeline rejection from a superseded look build can no longer park the healthy rebuilt look (built-identity guard on both rejection handlers); a pipeline-failed park now frees all target memory; swapping look scripts recreates same-named targets (history starts from black — param-only rebuilds of the same script keep trail continuity); ctx.target with width but no height (or the mirror) is a teaching error instead of a silent 512×1 texture.
• skills/looks.md gains a radiance-cascades worked example (disjoint annuli gathered from an emissive key, coarse→fine merge), compiled and lane-pinned by the skill-examples tests alongside trail + separable blur.
• preview_object renders scripted (kind: "scripted") and custom (kind: "custom") geometry through the engine's own realization path (#11015; wisp-gun dig 981498cb §4 — the booth refused the DEFAULT asset form and the AK wisp burned two failed inspection-camera workarounds). realizeScriptedPrimitiveGeometry is extracted as the pure core of the live spawn derive (compile → seeded ctx → geometry() → UV resolve → createBespokeGeometryValue) — the live lane wraps the same function, behavior byte-identical, and a test pins preview-realized signature === engine-derived signature. The booth renders bespoke pieces on the live slot plan with lane-parity materials (vertex color/PBR/emissive selects, double-sided, translucent slots off the caster draws). Script failures skip with reasons naming the script + error (scripted geometry (scripts/gen/ak.js: radius must be positive)), never a mute skip. Deliberate booth deviations, noted in the reply when hit: no ground sampler (ctx.groundY reads flat ground — the fields: "zero" sibling) and ctx.albedo texture runs render base material (live texture-array residency would make the probe non-deterministic).
• The authored sign spec is now world state (ledger 1783): a replicated component (tome/sign-spec, replicate aoi) replaces the module-global signSpecCache Map in object-api.ts — the only authored property value that lived outside the world. It now rides the wire, join/reset snapshots, and room-state resume, and dies with its entity (the old Map never evicted on destroy and leaked across rooms sharing an isolate). Consequence fixed: a dotted write (setProperty("sign.text.content", …)) on any isolate that hadn't itself run the sign setter — host takeover, headless room host, room-recycle resume, any fresh client — read null, merged onto {}, and silently rebuilt the whole sign from engine defaults (the 2.4×1.2 board / text maxWidth 2.04 fingerprint).
• A dotted sign write that finds no sign spec to merge into on an entity that already renders text or a primitive now warns loudly (with the recovery: set the full sign once) before proceeding — silent-rebuild-from-defaults is gone; creation-by-dotted-write on bare entities is unchanged.
• getProperty("sign") now answers truthfully on every realm the entity replicates to (server reads of client-authored signs returned null before — sign == null was never a valid damage detector).
• replaceSpecWithStarter gains { wipe: true } — the explicit destroy-everything path through the built-work guard (#11018; holodaek read 83b5ebe3: "slet alt tag mig til grasset" had no honest path — the guard's only offered option, { convert: true }, PRESERVES creator work, the opposite of the ask, so Savi hand-rolled a 7-minute demolition through two schema walls). With wipe the young swap runs unchanged: the starter lands exactly (fresh world, nothing preserved, nothing parked), terrain-edit history demolished on the swap's own rail, undo stacks + session camera overrides cleared, lineage stamped, exactly ONE persistable mutation; the result carries wiped: true. The guard still refuses by DEFAULT and the refusal now names BOTH explicit paths (convert = preserve, wipe = destroy); the option docs and refusal both say wipe fires only on the creator's explicit delete-everything ask, in their words. wipe + convert and wipe + dryRun refuse loudly. Convert mode extracted verbatim to convertSpecToStarter; mutation shape untouched (pinned by test).

technical notes

• Mantle physics quality wave (#8579): collision, CCD, contact manifolds, joints, terrain interaction, and vehicle handling all hardened, with a playground exhibit touring the edge cases. Perf: sleeping objects ~97% cheaper, characters ~12% cheaper, the busiest simulation frontier ~52% cheaper; a few awake microbenches pay 10–33% more at p50 but everything stays under 3.9ms absolute. The engine default did NOT flip — places opt in via physicsEngine: "mantle" in their spec.
• api.decal — stamped marks on surfaces (#9938, #9963): games can stamp footprints, skid marks, and splats onto anything in the world. Round 2 fixes from the first walk: a signed receiver hemisphere keeps stamps off characters passing through them, and a 2:1 incidence bound rejects grazing-angle stamps cleanly instead of smearing them into streaks.
• Reprocessed skinned models grounded (#9484): bind correction now cancels the full wrapper residual, so re-baked character models that drew meters above their own physics (one spider hovered ~30m up) stand where their body is — bounds, grounding, and picking all agree with the drawn mesh.
• Build/edit safety: place-scoped spawn folds (#9956) — saving an object into one room no longer silently deletes a same-named object from every other room; explicit material keys replace stale override echoes (#9793).
• Room & version integrity: the spec JSON always travels with its DB version (#9976) — restarts can no longer forge "version 1" and wedge rooms; rejected-save storm damping at the host layer (#9955 — applies to all rooms at kernel deploy, regardless of each game's engine pin); stale-epoch resync fires under sparse drains (#9824); reset delivery with a chain age bound (#9821); opt-in exact-state resume when a room recycles (#9901); multiplayer visibleCount heartbeat (#9743); cf-edge is the single room-tier resolver (#9492), killing the split-room class.
• DO-tier room hardening (#9974): spec-miss failures are loud instead of silent, and an unpublished room latches terminal (room.unpublished) instead of retrying forever.
• Jobs & economy: spec.jobs authoring door (#9887); cron and lifecycle jobs survive the dispatch gate and room restarts (#9867); rail.purchase actor is relay-asserted — purchases are stamped server-side so scripts can't fake the buyer (#9899); owners and editors can test their own buyables free again (#9855).
• Feel & rendering: resumable texture-bake slices (#9891) — rich tile-art worlds finish loading textures instead of parking fresh joiners; camera lens matrices exposed for look scripts (#9945); world-anchored HTML UI (#8870) — nameplates and other HTML pin to entities without hand-rolled projection math; releasing the left mouse button mid-movement registers cleanly (#9823).
• Terrain & tile art: ctx.wang scripted tilesets — the drawtile port with parity fixtures (#9834); face-depth voice knob (#9908); validation + median-pin fast-follow batch (#9842); rail.fieldDab — runtime heightmap edits reach the server (#9985).
• Script cadence: god-mode recompose reaps stale overrides (#9790).
• Unified debug console (#9917, #9929, #9939, #9957): F3 opens one mega-console — GPU-passes panel, frame-graph inspector wings, windowing — one keybinding story instead of scattered debug surfaces.
• Server memory/infra: relay-tier Durable Object (#9786).
• Errors & ops: a missing UI export is a first-class script outcome instead of a mystery (#9879); game-alert flood damping (#9880); server logs are pure JSON so Datadog parses them again (#9816); exec disposition noise closed — the last unclassified emitters are classified with a detector in CI (#9877, #9972), which ends 5.2.4's three-errors-per-script-run log spam.
• Telemetry & test rigs (no behavior change): voxel edit-latency path tag + teardown counter (#9973, #9975); cross-client voxel convergence oracle (#9866); netcode-canary battery (#9856). Voxel digging feel is intentionally UNCHANGED this version — only measurement shipped.
• Behavior-source retention hygiene (plan p-300376ee lever 1; V8 anatomy PR #9777). Four moves against the Garden-class compile lane's 15.8MB of retained source text:
  1. compileFunctionFactory memo keys are now verbatim NUL-joined params + <bodyLength>:<murmur3_128(body)> instead of the full joined codegen input — the ~6.3MB Garden key family (misattributed to "V8 compilation cache" by the first anatomy pass; erratum on #9777) drops to ~90 bytes/entry. Keys stay a pure function of codegen input, so startup-warmed workerd realms keep serving request-time compiles as pure hits (DO-kernel invariant 3; verified on a no-eval-flag workerd: startup-compile then request-time applySpec of the same spec, zero EvalError). Eviction semantics untouched.
  2. The transform pipeline ASCII-escapes transformed source (\uXXXX, surrogate pairs kept as pairs) in string/template/comment/regex content, then materializes the result one-byte (engines OR representation widths through slice/concat without re-scanning). Tagged templates, non-Latin1 code positions, U+2028/29, active-backslash prefixes, and emoji-dense bodies skip verbatim. Spec originals stay byte-faithful; column offsets on emoji lines drift, line numbers never.
  3. The 3,021-char _f32 + Math-shim preamble inlined per compile unit becomes a two-line bridge to globalThis.__tomeNumRt (tome/numeric-runtime.ts — the shim now exists once per realm as real TS, semantics mirrored verbatim and pinned by deterministic-math.test.ts). Same two-line preamble height, so authored stack line numbers are unchanged; ~15% fewer chars parsed per unit compile.
  4. scriptSourceHashCache + extractDependenciesCache (content-keyed) clear on invalidateBehaviorCache/clearBehaviorCache, bounding Savi-edit-session creep. The factoryMemo is deliberately never swept (invariant 3).
• Measured on the do-sim rig (local workerd, 600 ticks): Garden compile lane 15.8 → 4.8MB, fixed cost before entities 40.9 → 29.9MB, afterTicks live set 88.6 → 76.1MB; memo-key string family 6.7MB → gone; fn-source family 6.86 → 3.01MB; sky-king fixed cost 23.9 → 22.1MB; smoke unchanged. Tick-time histogram unchanged (mean 18.2ms both sides).
• updateSchedule — declared behavior cadence, gated BEFORE the sandbox crossing (plan p-953ea933, PR 1 of 2): the compiler extracts one data export, export const updateSchedule = { every: N | { seconds }, near: { tag, radius } | [...] }, and tome/behavior-update evaluates it before the crossing harness (api materialization, per-entity RNG derivation, juice/intent wraps, watchdog timing) — a declined tick costs a map get and an integer compare. every phases deterministically per entity (djb2 of the entity id — no mutable counters, identical on every simulating side); near snapshots tagged positions at most once per (tick, tag) and compares squared distances (same-place, physics poses quantized like query reads; positionless/camera-attached bearers never wake anyone). dt = cadence-step (every × tick dt; flag: plan open decision 1). Runtime override: api.setUpdateSchedule(partial | null) — per-key merge over the static export, scoped to the calling script, side-local (never persisted/replicated), cleared on despawn. Multi-script entities: pre-harness gate is the most-permissive union; each update-bearing entry re-gates inside the merged wrapper with its own cadence dt. Malformed schedules salvage (never fault the script) with one compile-lane report. TomeBehaviorUpdateDebugResource gains scheduleSkippedEvery/scheduleSkippedNear.
• Composed update is presence-gated like onNoise: composeBehaviors no longer synthesizes an unconditional update wrapper, so behavior-update's if (!update) early-out actually fires for hook-only scripts (DEADZONE receipt, ledger 1463: 912 of 1,132 scripted objects — 80.6% — export no update hook and paid the full harness per tick for a no-op).
• Dead-GPU-instance clients now reach the reload wall instead of zombieing (staging dig 2026-07-19). When a browser's GPU process dies (chronic on software adapters: SwiftShader under headless Chrome), device.lost never fires and every createRenderPipelineAsync rejects with "A valid external Instance reference no longer exists" — previously that message matched no recovery rail, so the client sat with a black canvas forever: pipelines parked one by one, preview_object/view_live_scene failed generically on every call, and neither the player nor Savi was told the device was gone. The instance-dropped class now joins GPU_DEVICE_DEAD_RE, and handlePipelineBuildError feeds dead-class build rejections into the dead-device burst rail — a sustained burst posts the #6710 reload wall plus the renderer-device-lost diagnostic (Savi's getLogs names the device failure and warns her eye may lie).
• Capture failures name their cause: preview_object ("Preview render pipelines failed to build (…)") and view_live_scene (encode/downsample build errors) now append the underlying pipeline-build rejection reason, bounded to 300 chars and deduped across pipelines (pipelineBuildFailureText). The cause-free form cost a 14-call isolation session to attribute to GPU death.
• Every device-loss report now carries adapter identity + a GPU-memory snapshot (dig 11400612): LumeAdapterIdentity (description + degraded/integrated verdicts) was previously reported only on degraded/integrated adapter verdicts, and the #1101 gpu-memory ledger was never attached to loss diagnostics — so a 14-day latch-row sweep could decompose losses into 3 signatures but never say WHICH machine class died at WHAT allocation pressure. Both halves already live in-process at the loss site; this is attachment, not new collection. The renderer-device-lost diagnostic's data gains adapter/adapterDegraded/adapterIntegratedHint plus exact gpuBuffers/gpuBufferBytes/gpuTextures/gpuTextureBytes/gpuTexturePeakBytes, snapshotted at post time from every death path (device.lost, dead-device burst, storm ladder, boot watchdog). The [lume] GPU device lost console line appends the same context in one bounded human-readable clause (describeDeviceLossContext). The #6710/#6741 once-per-session latch and reload wall are untouched.
• Restored fetch() inside custom job scripts on the DO tier (ledger 1542; regressed in #7667 when rooms moved containers → DO): scripted-job isolates load with globalOutbound: null, so the documented webhook pattern (fetch(args.url) in a spec.jobs handler) was structurally dead on the room server. Job scripts now compile with a fetch shim that forwards a bounded request descriptor over the existing JOB_IO forward lane, and the room host executes the egress — mediated, never a blanket unlock (tome/jobs/job-fetch.ts owns the policy; RoomJobIo.fetchExternal is the host side).
• Host-side policy on every forwarded creator fetch: absolute http/https URLs only; internal-shaped targets refused (localhost/*.local/*.internal, private/link-local/reserved IP literals in v4 and v6 forms, Spawn service hosts, and the room's own kiln origin); redirects followed manually with every hop re-passing the policy; the outbound request carries exactly the headers the job set — platform credentials never attach. Budgets ride the existing job-limits vocabulary: 32 fetches per run, bodies capped at the job wire's 16MB payload ceiling both directions (streamed, cancel past cap), ~10s wallclock per request, with the job's own deadlineMs still racing the whole run. Refusals and blown budgets settle the job through the normal error channel.
• Tier semantics unchanged elsewhere: builtin jobs (sparks, leaderboard) keep their platform-trusted shell-side lane; Bun-container and device-local (browser) job scripts keep ambient fetch. Multiplayer rooms are also unchanged: the relay-tier server never executes creator JS and custom jobs are not forwardable (job-forward.ts job_not_forwardable), so server-context custom jobs there run on the resident host client's browser — the mediated lane applies only where scripted jobs run on the room server (the DO-isolate tier).
• ecs.inspect component allowlist + typed-array summary tokens (p-300376ee lever 5, C1): the debug snapshot accepts an additive components?: string[] filter; the headless-room-host 2s poll passes exactly the five component names its buildWorldView reads (WORLD_VIEW_COMPONENT_NAMES), dropping a Garden-class poll from ≥35MB of JSON text (geometry inflating 6.4× through index-keyed stringify, plus the 9.25MB tome/spec value) to KBs. serializeDebugValue summarizes ArrayBufferViews at any depth, so bulk replicate:"never" typed-array holders (geometry/bespoke class) stay cheap in the unfiltered walk too.
• Object diff signatures are compact content hashes (C2e): TomeObjectDiffSignaturesResource stored the full canonical-JSON string of every object's properties/tags/state — ~5.6MB resident geometry-as-text per realm on baked-heavy worlds. Now murmur3_128(canonical) + ":" + length (~39 chars/field); equality-compare semantics unchanged.
• Allocation-free spec-value equality (C3a): the duplicated specValuesEqual copies (object-api + interpreter) collapse into src/tome/spec-value-equality.ts; a structural walk verdict-identical to canonical-text comparison replaces the ~2×1MB transient strings a baked-primitive rewrite built per no-op check (9.6ms → 0.1–2.9ms, zero garbage). Exotic values (toJSON, holes, bigint) still take the text path.
• Runtime-log value budgets (C3b): formatLogArg caps per-arg JSON at 8,192 chars with O(budget) pre-cap work; oversize values render honest summaries, big typed arrays tokenize in place so their small siblings still log.
• Night-sky GPU cost (jure's thread: looking at the night sky jumped GPU power ~10W→40W): NO per-pixel star hash walk survives in the sky radiance shader. Both sky_starLayer 3×3×3 hash walks (~54 gated cell visits per sky pixel per frame) are gone from the per-pixel path:
  • Dense faint layer → the night equirect bake (sky-night.ts, same dirty gating — its params were already in nightKey). Each star deposits its analytic energy through a normalized truncated-gaussian kernel from the same hash field (sky_starSite, shared WGSL). Energy target per Sol's P1-1: native-σ energy × FAINT_DUST_CALIBRATION (defaults to the old path's 1080p/60°FOV rendering — the old analytic energy was resolution-dependent, ~1.5× at 1080p and 2–5× at wider FOV/lower res vs ≥1440p parity; the bake is resolution-independent with one taste knob). Kernel σ floors at 0.7 bake texel per tier (Sol's P1-2: sub-texel σ made per-star deposit a ±30% grid-phase lottery at the 512 tier; at ≥0.7·texel the lattice sum equals the continuous normalization to ≤0.1%, pinned by a lattice test at 512). Stars-off skies skip the gather via a uniform gate (fable F2).
  • Sparse bright twinkling layer → baked star-field lookups (sky-stars.ts, new): the star SITES (not an image) bake on CPU into an rgba32float record texture (direction/brightness/tint/twinkle-phase per star, capacity 2048, ~1400 at max density) plus an rgba16uint equirect index (256×128, K=4 slots per texel, conservative texel-diagonal footprint rasterization — no coverage holes at texel boundaries; overflow drops the dimmest star, measured drop mass <0.1% at default and <1% at max density). Per pixel: 1 index fetch + up to 4 record pairs + the walk's exact gaussian/twinkle math — footprint σ still tracks the screen pixel and twinkle animates live from the baked phase, so nothing about the look is frozen. Rotation-invariant like the night equirect. Rebake rides the same nightChanged dirty mark + an exact-density guard.
  • Costs stated honestly: the per-pixel night path is now 1 index fetch + ≤4 records + grain (the nightVisibility > 0 uniform gate still zeroes the whole night stack by day, per pixel). The BAKE passes themselves run once per night-authoring change as before, and the night bake now carries the faint gather (125–343 sites/texel; one-time, milliseconds-scale, stars-off skies skip it). f16 range: baked dust peaks sit multiple f16 ulp above quantization at the night floor at every tier (2–20 ulp dimmest→median, scaling with authored starsIntensity).
  • Evidence: CPU reference mirrors both forms (sky-star-bake.test.ts, sky-bright-star-field.test.ts, star-field-reference.ts) — per-star flux parity vs the calibrated target at every tier, lattice-deposit honesty at 512, record contents vs the analytic derivation, index coverage, K-overflow policy, fetch-vs-walk parity at real pixel angles (5e-3 f32-packing tolerance). New scripts/verify-sky-wgsl compiles every generated sky shader on a real WebGPU device (GPU machine required).
• Place-host wedge self-heal is convergence-bounded (ledger 1532, dump 85d9a1cc): healWedgedHostCycle's sole-candidate leg now spends at most HOST_WEDGE_HEAL_SELF_REASSIGN_LIMIT (= 1) same-client pipeline re-runs per wedge episode. The same client showing the same wedge signature (off Streaming, resetDeliveryFailStreak ≥ threshold, uplink live) at the next confirm window after a full re-run proves the re-run does not converge that wedge — the second identical election is refused and the breaker opens: the sitting host is retained (frozen-but-not-wiping, the pre-#9618 5.2.2 shape) instead of being re-seated at epoch+1 every window. Breaker-open retention is leg-scoped: the retention ceiling's unhosted endgame still bounds the hasStreamed=true legs, while the never-streamed join-window leg holds retained-frozen with no ceiling — deliberate and harm-free (nothing adopted there to wipe, the diagnostic already fired, and a second joiner / socket replacement / departure all exit it; pinned by the join-window-past-ceiling test). The 5.2.4 field failure was exactly that carousel: a solo place host wedged on DO-tier epoch adoption (stamps pinned to a dead epoch, so no confirm could ever retire the fail streak) had his place world-reset — and his host writes wiped at the stale-epoch gate — every window, forever. The DO-tier epoch-adoption root is a separate dig; this bounds the amplifier.
• Loud once, per episode: breaker-open emits one logger.error("netcode.place_host.wedge_heal_circuit_open", { placeId, clientId, epoch, failStreak, … }) (container stdout → DD) plus one Savi-visible runtime-log error entry, and increments the new wedgeHealBreakerOpens tenure stat. Not re-emitted on subsequently refused ticks.
• Breaker reset only on genuine evidence-retire edges: the per-place convergence record (PlaceHostTenureState.wedgeHealByPlace — server room state, never replicated, no client-visible tick arithmetic) prunes when the wedged client's fail streak retires (live-epoch confirm or socket replacement — the exact edges #9618 defined) or the connection departs, re-arming one legitimate re-run for a fresh episode; a momentary Streaming flicker without a confirm deliberately does not reset it (on the DO tier, Streaming can flip on a void-accepted send the platform dropped — projection state is not delivery evidence). A viable different Streaming candidate never consults the breaker: real election always moves the place and leaves the record latched to the wedged client's un-retired evidence — the record's lifecycle is evidence-keyed, never seat-keyed.
• Named residual blindness (ledger 1532 root dig): the wedge signature's evidence (resetDeliveryFailStreak) increments only on the transport throw path. A silently dropped reset on the DO tier (workerd ws.send() returns void = accepted; a lost chunk of an over-cap snapshot drops client-side with no nack) builds no streak, so neither the heal nor this breaker engages on that variant — and no carousel spins there either (no signature ⇒ no heal ⇒ no epoch churn); that freeze belongs to the delivery-truth root (Streaming-on-ingest / post-reset ack), dug separately. When that delivered-signal lands it upgrades the signature's evidence source in place; heal and breaker inherit it unchanged.
• Spec traffic never stomps what the local client actively simulates and writes (the 5.2.4 farm-dusk DURING-PLAY lighting flicker — round 2 of tiger's zoo verdict, video receipt 2026-07-19; round 1 was #9754's resync→projection-reset coupling): in client-auth multiplayer the simulating client's behavior writes move its live world AND its local doc first — the forwarded batch → server fold → spec push is the same write echoed back a round trip later, or staler (resync answers after a delta rejection, uncovered-writer full pushes). spec-sync's apply diffed that pushed content against the local doc, read "changed", and re-stamped live values backwards: on farm-dusk the dusk-sweep sun's state.warm/night and light snapped to a stale cycle phase, every threshold-reading lamp/window/firefly/rim script answered with a wink-off at its own %4/%5 cadence, and the rig visibly flickered several times a minute (the video's exact pop→crash→staircase luma signature; tome.apply.episode lane tome/spec-sync visiting ~80/111 objects in the field console). The fix extends the execution-authority rule (behavior-update's isClientAuthLocallySimulatedEntity) to the spec-apply lane: forwardSpecMutationsToRoomSink records the ids this client forwards as a simulation authority (local-sim-write-recency.ts, id + tick, every namespace shape), and a non-replace multiplayer apply substitutes the LOCAL doc's defs for rows whose subtree was locally written within the 90-tick horizon — the reconciler sees no change there and live values survive. The tracked TomeSpec head keeps the server's exact bytes (delta folds stay anchored); replace applies (revert, #296) keep their full "reset live state to this spec" contract; foreign edits to objects the local sim is not writing land exactly as before. Masking is ROW-scoped: a foreign edit to a hot row is deferred whole — for the exact paths a script keeps writing it was already futile (the script's next write wins), but the row's other paths wait for the row to cool (path-scoped masking is the named refinement, netcode owner's call). Convergence is guaranteed: a masked apply arms maskedApplyTick, and spec-sync schedules ONE unmasked re-apply of the current revision once that apply's hot window has fully expired (the same same-revision re-apply lane the place-instance key drift exercises) — so the local doc converges to server bytes at quiescence and deferred foreign edits land, even when the masked push was the last one before the room went quiet (#9826 adversarial review's convergence hole).
• Tests: spec-sync-local-sim-authority.test.ts — red on parent (a stale-echo push re-stamped a locally-written sun light 0.45→1.1); pins live property + script state + child-pool survival through a stale push, foreign edits still landing, horizon expiry re-asserting the doc, and the quiescence leg: a foreign edit inside the FINAL hot window converges to server bytes after expiry with zero further pushes.
• sprite.upright: true — the 2D spin lock (QA field specimen app 3d656cc0 / dig 604e064c): in 2D places the quad keeps its base pose (upright in 2d-side, flat in 2d-top) and never inherits the entity's rotation as in-plane spin, whatever writes the rotation — NPC steering's yaw-to-travel-heading (npc.turn clamps to min 10°/s, so it can never be zeroed), physics, scripts. Before this, every walking properties.npc character sprite in 2d-top rendered tilted toward its velocity with no lever to stop it; Savi's only recourse was a per-tick counter-write that fights locomotion.
• One property, one choke point: instanceRotationFor (lume sprite pack, keyed + standalone paths alike) composes the base pose from zero rotation when upright is set — exact math, so upright sprites keep the fixed pins bit-for-bit. Property absent = byte-identical existing behavior (top-down cars/ships keep turning). Sprite raycast picking mirrors the lock (fillPose), so the ray hits the un-spun quad the player sees. Render-only: rotation still drives physics/colliders and children. No effect in 3D places — billboard owns rotation inheritance there.
• Spec plumbing: ObjectProperties.sprite.upright (types.ts) + DrawSpriteValue.upright (carries through sparse merges like billboard) + SpriteSpecSchema.upright (the STRICT sprite write gate accepts it). Skills: 2d-mode teaches the lock next to the yaw-spins-sprites rule; npc teaches that steering yaws the body and 2D character sprites want upright: true.
• Tests: upright pins bit-for-bit in both 2D modes on both render paths while the property-less twin keeps the spin contract, live toggle restores spin, 3D no-op (billboard default and "none" unchanged), raycast pick parity in 2d-top, sparse-merge carry, strict-schema round-trip.
• Opt-in HUD viewport normalization — engine.ui.referenceHeight (papercut pc-4958f5f3, jacob's opt-in ruling 2026-07-18): the game-HUD lane applied zero viewport normalization, so authored px land as-is and a HUD designed on a 4K monitor covers twice the screen fraction on 1080p. When the knob is set (Savi sets it — never a default), the game-target tome UI containers (tome-ui-container + tome-game-mount) get CSS zoom = viewportHeight / referenceHeight (recomputed live on resize), and the worker's window.innerWidth/window.innerHeight mirror reports the same reference space (innerHeight reads exactly referenceHeight), so authored px mean "px at the reference height" on every monitor. One resolver (resolveUiReferenceHeight, ui-globals.ts) feeds both sides: off for unusable values, clamp 240..4320. Game target only — god-mode chrome never scales. Knob unset is pinned byte-identical: no style write, raw mirror dims, unchanged render-message signatures.
• Rides the ui render message (pre-resolved, like font), participates in the dedup signature so a knob-only patch re-posts, applies live via api.patchEngine({ ui: { referenceHeight } }) with no reload. patchEngine's silent-ignore warn lane and the tome-schemas EngineConfigSchema both learn the key (schema lenient on purpose — engine clamps at read).
• Tests: unset byte-identical pins (dom-host style surface, mirror dims, signature), zoom math at three viewport sizes + live resize + clear-on-unset, mirror reference-space math at three sizes, resolver clamp band, schema round-trip parity.
• The collider cook can no longer park a CDN model as a placeholder box forever (zoo-mantle local-dev field bug: all five CDN-model exhibits had empty collider meshes — the ?transform=collider variant resolved against the absolute https://spawnfile.io base, every URL answered a dead 404, the §(g) classifier latched {retryAt: Infinity}, and mantle kept the props demoted kinematic followers for the whole session, hence the barrel ghost-rolling 170 m with no contacts and no sleep). Two legs:
  • Same rail as the renderer. The lightweight collider lane already fetched root-relative /cdn/ through the assetFetch rail; the asset-service lane (service.ts loadModelAsset, which getModelCollider rides) now fetches through assetFetch too instead of ambient fetch — identical in browsers and on the Bun container tier (no route installed ⇒ assetFetch IS fetch, and the container keeps its legitimate SPAWN_API_URL-based absolute resolution for ambient egress), while under the engine-isolate posture (globalOutbound: null) model loads now ride the shell's fetchAsset rail (public-default origins rebase onto the room's kiln, shell-minted identity) instead of failing unconditionally.
  • Local cook from the visual bytes. When both Magic CDN collider lanes settle with a §(g)-terminal-shaped verdict (dead 4xx / empty cook — never the self-healing parked classes, never the rail refusal), fetchMagicCdnCollider now cooks hulls from the VISUAL GLB the renderer already fetches: the lightweight extractor on the variant URL minus the transform param, then the asset service's own model path. To make that possible, gltf-hull-extractor.ts decodes EXT_meshopt_compression bufferViews through the vendored wasm decoder (lume/model/meshopt.ts initMeshoptDecoder, injectable per the MeshoptDecoderLike pattern; refusal preserved only for wasm-less runtimes) — every Magic CDN visual has been meshopt-compressed + KHR_mesh_quantization (normalized int16 positions, dequantization riding nested node scales) since the v7 corpus republish. Result: one quickhull cloud per primitive — coarser than the CDN's multi-hull decomposition (which stays preferred whenever reachable) but a real shape. Terminal-park classification is gated on the same predicate (readTerminalColliderVerdict), so a permanent park now truthfully means BOTH the variant and the local cook are impossible; a collider-cooked-locally runtime log names the degradation direction once per cook.
• Regression coverage: meshopt+quantized extraction with nested-scale baking red→green pinned in __tests__/gltf-hull-extractor.test.ts (real meshoptimizer encoder → vendored decoder, plus the wasm-less refusal), and the cook rail in systems/__tests__/collider-assets.test.ts — dead-variant/fetchable-visual recovery on the renderer's root-relative URL family (server and client lanes), empty-variant recovery (narrowing ledger 1491 to "empty everywhere"), and the terminal family updated to prove the park only latches when the visual lane is dead/empty too. Verified against the real barrel visual GLB by manual probe (17 729 verts → 0.687 × 0.900 × 0.687 envelope, matching the served collider fixture).
• Out of scope, noted for follow-up: a ghost-roll stop condition for demoted kinematic followers, and a distinct debug-draw style for locally-cooked (degraded) colliders.
• Mantle character controller no longer wedges permanently when a live voxel edit closes solid around the capsule (staging field report: "permanently stuck in one place, no movement works" in the mantle voxels place after break/place edits). Two root causes, both fixed:
  • The collide-and-slide verify sweep accepted initial-overlap (toi 0) hits as blockers. Every surface already overlapping at the start of a move iteration is inside the contact-collect radius and therefore already constrained by the velocity-plane solver — including the depenetration escape — but the raw overlap normal of a second overlapped voxel box could oppose the solver's escape direction, scaling the whole displacement to zero every tick, forever. The sweep now excludes initial overlaps (move-shape.ts VERIFY_SWEEP_OPTIONS, the cast API's existing includeInitialOverlap: false); surfaces newly reached along the path still report toi > 0 and block exactly as before.
  • Per-box EPA picks each greedy voxel box's own minimal exit blind to its neighbors; when a real wall opposes that exit the plane system is infeasible and the solver legitimately yields zero displacement. New union-aware voxel unstick in controller.ts (voxelUnstickInto): when a contact is deeper than padding + half the capsule radius against voxel geometry and the capsule overlaps solid cells, the solid bitset is searched for the nearest capsule-sized air pose (current column + 8-neighbor ring, at the current feet height and successive cell tops, bounded 2.5 m climb) and the pose moves toward it at the depenetration speed cap. No air pocket in reach ⇒ no move — a buried capsule never ratchets upward through a solid column (rapier controller escape parity, its pinned behavior). Deterministic and stateless: a pure function of table + geometry state per tick, no new lanes.
• Observability: characterVoxelUnsticks scratch counter + mantle:count:characterVoxelUnsticks profiler lane.
• Regression coverage: distilled wedge scenes lifted from the reproducing fuzz (mantle/character/__tests__/embed-wedge.test.ts — sweep wedge, chimney unstick, lateral-pocket unstick, entombed no-ratchet), end-to-end voxel-edit + CC walk suite over the real fast-lane grid/rebuild/payload functions (__tests__/mantle-voxel-edit-cc.integration.test.ts), and a deterministic 3-seed × 6000-tick dig/place fuzz with a transient-motion wedge detector (__tests__/mantle-voxel-edit-cc.fuzz.test.ts).
• Mantle now applies the collider cook's re-centering translation to CDN model colliders (staging field report: the CDN barrel exhibits — dynamic barrel "made up of a mess of colliders" responding unnaturally to hits; scaled static barrel's bottom not colliding at all). buildColliderMeshFromHulls anchors cooked geometry to minY=0 and records a translation + feetOffset on the cook; rapier applies that translation to every hull/trimesh desc, but mantle's resolveEffectiveMesh dropped the field, so every CDN collider attached with its bottom at the body origin — a full feetOffset above the feet. resolveEffectiveMesh now carries translation, and mapMeshColliders applies it (× the baked-scale ratio) as localPos on every convex-hull piece, the static trimesh branch, and the bounds-fallback box (which also double-counted the offset and used combined scale instead of the ratio).
• Regression coverage: __tests__/mantle-cdn-model-collider-offset.test.ts — scaled static multi-hull world-AABB reaches the model's true bottom, dynamic compound COM sits at the geometric center, static trimesh and bounds-fallback placements pinned.
• Mantle joints now interpret authored anchors in the engine's feet-local frame (staging field report: the zoo motor carousel spun at a perfect 30°/s while its rider cubes bounced violently and flew off). ObjectAPI anchors are feet-local — the engine-wide feet pivot — but mantle-runtime births bodies with origin at the collider center and passed anchors through raw, silently reinterpreting every authored mantle joint's anchors center-relative, off by each body's feetOffset. For the translation-locked carousel raft that meant a permanent 0.4 m constraint violation: each substep the revolute point-block injected phantom bias velocity that applyLockFlags zeroed before integration, but the contact solver in between saw the raft surface rocketing — rider contacts position-popped with zero net impulse. Fixed with feetAnchorToOrigin() at the single addJoint site in syncMantleJoints; the misleading "(feet pivot)" frame docs in solver/joints.ts corrected. Raw MantleWorld.addJoint callers (harness, goldens) are unaffected — the conversion lives in the runtime bridge.
• Regression coverage: zoo-mantle-live.test.ts drives the real authored carousel exhibit + script and asserts world anchors coincide (<1 mm; reads 0.4 m without the fix), steady spin within ±1% of 30°/s, and both riders carried with feet pinned to the raft.
• Known adjacent gap, deliberately not changed here: the rapier bridge has the identical raw anchor pass-through over center-origin bodies. Rapier is the prod default and existing games may be tuned against current pivots — changing its anchor interpretation is a separate product decision.
• Night-sky quality package on the star-bake branch (jure's "combine that with this work", #inventors 1784237988):
  • shade_hash11 returns to the u32 PCG hash three-TSL emitted (shade/std.ts; the lume port had swapped in the Hoskins float hash). The float form loses the star lattice's y/z stride steps to f32 ULP at seeds ~10⁶ — adjacent cells return bit-identical hashes, which stamped duplicate stars down whole columns (the 5.2.x night-sky "vertical dot-chains", community thread + screenshot). The star-site WGSL (faint-dust bake) and the CPU bright-star baker now share ONE hash with bit-exact CPU/WGSL agreement: 32-bit integer math both sides, and the JS mirrors round their return through f32 (Math.fround) to match the WGSL's f32(word) conversion — including the ~3×10⁻⁸ saturation tail that returns exactly 1.0 — so the old f64-vs-f32 threshold-drift caveat is dead. Verified: JS mirrors vs an independent BigInt u32 reference in-repo (drift-pin test in sky-radiance.test.ts, which also string-pins the shipped WGSL's PCG pipeline); the WGSL half executed on an L4 compute pass by the #9482 adversarial review — 230,006 seeds, 0 mismatches. Scripted-material hash() is back on three-era parity (range note: [0, 1], reaching exactly 1.0 for the same sliver the three era did). Look risk stated honestly: content authored against the float hash during the 5.2.0–5.2.x window (≈6 days) sees its hash() values change; everything older gets its original values back.
  • Star/grain footprints are sized against the PRESENTED pixel, not the render-res one (sky-store.ts background pass scales the fwidth derivative by viewportSize/canvasSize): under TAAU the scene renders at 0.75×–0.55× and upscales, so render-res sizing birthed stars fat and the resolve kept them fat — half of the community "blurry night sky". Outside TAAU the ratio is 1 (exact no-op). The σ floor is now a named dial, STAR_FOOTPRINT_PIXELS (sky-radiance.ts, 1.4 output pixels), wired through the CPU test mirrors so parity tests track it.
  • New scripts/profile-sky-night: real-GPU cost probe for the sky composite (real LUT computes + real night bake + real star-field bake, saturated throughput + pass timestamps + nvidia-smi sampling). Measured on an L4 at 1920×1080 night: sky fragment work 1.27 ms/frame on 5.2.x master → 0.36 ms on this branch (−72%); sky-occluded floor cost identical 0.066 ms both builds.
• In-world asset placeholder chip copy tells the truth (ledger 1675): "Spawning {name}…" → "Loading {name}…" for every non-failed load state (formatAutoPlaceholderLabel / deriveFallbackLabel in renderer/components/placeholder-metadata.ts — the label lane of the lume collectPlaceholders spawning-bubble derivation, #6673). The chip claimed generation while the engine was merely downloading an already-baked asset: 48h of Magic CDN traffic shows zero 202s and zero generation jobs — every placard pop-in on a cache-cold load (~130 assets/session; 1h redirect cache) is a plain 200/302 download of a write-once baked asset plus GPU KTX2 transcode. The placard site sees only LoadState, which cannot distinguish a genuine 202-class generation job from a download, so all non-failed states read as loading (a rare generation job reading as loading is the acceptable direction; a download claiming generation was the reported bug). Failed copy unchanged ("Couldn't spawn {name}"). Savi's-eye getUnreadySceneAssets classification and the capture settle gates are untouched. The anti-flash constant is renamed to what it does (PLACEHOLDER_ANTI_FLASH_DELAY_MS); behavior identical.
• Player settings resolved seam: user-player-settings.ts now exposes the MERGED view (player global ⊕ per-game override ⊕ creator policy) to every engine consumer; transport payloads carry families + legacy flat reduceFlashing (dual-write both directions, wire-compatible with old parents forever).
• The engine consumes accessibility signals for the first time: reduce-motion (OS-seeded or explicit) governs juice-hud flash peaks/spacing, entity flash and outline coalescing, and camera-shake softening at ONE seam — isReduceFlashingEnabled() reads the resolved view.
• Sound buses run two-lane (legacy flat + families) with a families-authority latch; per-game sound overrides resolve above player-global.
• Creator tier: engine.playerSettings (defaults + caps per the family policy — accessibility is player-absolute, never cappable) validated by the contract sanitizer; savi-writable via the existing spec-edit verbs + the player-settings skill.
• Perf tier vocabulary unified (PERF_TIERS in @spawn/player-settings is the one copy; tier-override plumbing reads the resolved perf family).
• api.getRoomMode() is now truthful in client-simulated hooks (the #inventors dev-only-flag miss, 2026-07-23). The read's backing fact (TomeRoomModeResource) was only ever mirrored into the SERVER world (room-runtime bindRoomModeResource, from SPAWN_ROOM_MODE), so in every context where gameplay scripts actually simulate under client authority — player behaviors, singleplayer authority worlds, place hosts — the resource was absent and the read fell back to "live" even inside dev rooms. Now the door-minted room mode (readSurfaceRoomMode: cf-edge's templated __SPAWN_CONTEXT__.roomMode — the validated /{engineHash}/{variantId}/{roomMode}/{roomId} path segment it keys the container DO on, the only place edge iframes carry the mode — falling back to the iframe URL ?roomMode= param on kiln's local-kernel and legacy lanes) rides worker.mount (the servedVariantId/publicUrl/relaySpecBootstrap lane) and configureMountedRuntime mirrors it into the mounted world's TomeRoomModeResource. One fact, one mirror per realm: server = env leg, client = mount leg; no second derivation anywhere. The strict reader (readRoomModeFromHref, engine/runtime/relay/relay-spec-fetch.ts) reports absence instead of coining a default — an unknown mode leaves the resource unset so the read keeps its "live" fallback, exactly how modeSegmentStorageKey treats unknown modes (the relay spec-bootstrap claim keeps its own separate join rule — a JOIN needs a concrete mode, unknown-everywhere → "dev" — but is now fed the same resolved surface mode, so an edge-lane LIVE relay room's latest spec fetch targets the live spec instead of the draft).
• Side effect, more-correct class: the dev-room shared-key FYI (ledger #996) hooks the ObjectAPI job() seam on whatever world the script runs on — with client worlds now knowing their mode, a dev-room CLIENT-simulated storage write records the FYI line too (it was silently skipped exactly where most gameplay scripts run). Same once-per-key-per-world-session dedupe, still informational-only.
• getRoomMode()'s declared return narrows string → "dev" | "live" (the implementation always guaranteed it), and the JSDoc gains the room-not-viewer fact: the answer is the ROOM's — every collaborator in the build room reads "dev", every player in the posted game reads "live" — so dev-only conveniences gate on it instead of on account ids, and flip off at publish with zero per-person wiring.
• Savi-side teaching: getRoomMode joins the always-on hot set in the generated tome-api prompt (the updateStorage promotion precedent — the verb lived only in the api-reference/publish skills, and at author time Savi asserted no mode/build flag is script-readable and keyed a creator's dev flag to his account id). Prompt budget +196 chars with a dated ledger entry (cap 15_700 → 15_900); reach-vocab drift guard extended to pin the collaborator/room-not-viewer vocabulary.
• Tests: client-world twins for the behavior-context read (dev/live/absent), strict-vs-join href reader contracts, and the always-on prompt pins.
• BREAKING: wire splines hang by default — poles are opt-in (jacob's ruling, #inventors 2026-07-25). stringlight/bannerline/powerline runs render as ONE continuous draped strand through their authored points: per-span droop (explicit wireSag stays absolute meters per span; the default now scales with span length) smoothed through drooped midpoints with a centripetal Catmull-Rom, so the strand crests interior suspension points tangent-smooth instead of meeting them as N independent per-segment sags with hard kinks. Ground-line points hang at the exact wire height the pole layout used (wireHeight ?? poleHeight-derived), so adding poles: true never moves the wire line; snapToTerrain re-measures hang height from the terrain under every point. New SplineSpec.poles?: boolean restores the #10824 grounded pole+wire layout verbatim; poleHeight alone no longer opts stringlight/bannerline into poles. Field specimen: the town-plaza fence-of-poles (stringlight, poleHeight: 5.6, spacing: 1.5 = a grounded pole every 1.5 m around the fountain) re-renders as draped strands with zero spec edits. streetlight/bollard/zipline (pole/anchor products) keep their generated supports.
• Generated ids change on bare runs: one __spline__cord tube per run (was per-span span_N), with bulb_N/banner_N indexed along the whole arc (was bulb_<span>_<n>). A bare powerline drapes wireCount ?? 1 cables as wire_N.
• Behavior-moved rigid model instances emit TRUE object motion vectors under TAAU (ledger 1592 — the hand-rolled-rig ghost/smear): static-batch instances and character rigid children rode the camera-only velocity lane (the named TODO(lume-velocity) in lume/camera.ts), so the TAAU history blended them against where they WERE — characters built from model parts animated by per-tick transform writes left a motion smear while skinned GLB avatars stayed sharp. The fix is the skinned path's prev-palette pattern applied to the rigid lanes: ModelInstance records carry a prev-model mat4 lane (MODEL_STATIC_INSTANCE_FLOATS 36 → 52; appended, so every existing offset is unchanged), written from per-visual prev-world retention in the models prepare loop (rotated before each recompose, with the character path's first-frame/teleport zero-motion resets, sharing VELOCITY_TELEPORT_SPEED), and the static velocity shader variant blends it through lume_velocity_pair — exactly as skinned geometry does. Horde (batched) instances and scripted-material displacement remain camera-only (their own TODO(lume-velocity) arcs).
• BREAKING: Authored Tome UI executes in an opaque-origin sandboxed iframe per UI target (game/creator), not the host page (engine/ui/tome/realm/ — realm-manager, typed broker protocol, frame runtime). Host ambience (parent/top, cookies, host globals, host DOM) is unreachable from authored UI by construction.
• Documented capabilities are realm-local: dialogs via sandbox allow-modals; sensors/clipboard-write/gamepad/autoplay via the frame allow= delegation; localStorage/sessionStorage via the per-game storage shim (unprefixed keys, existing data resolves); audio hatch twin with policy-mirrored bus gains; window.spawn via the closed sdk.call allowlist; external window.open + ?room= navigation via budgeted nav.* brokers.
• Boundary failures are loud: teaching errors ride ui.log into getLogs; realm boot failure = one bounded ui.realm fault, world stays playable. Pre-existing fault hooks keep byte-identical strings and throttles.
• Host window.sendAction/sendAxis/dispatchUIEvent globals, dom-host authored half, event-bridge scope stack, and host lifecycle compile/invoke die with the move; engine chrome de-inlines to delegated handlers.
• Skills/docs realm-word pass (game-ui, creator-ui, audio, drawn-art, leaderboard, types.ts @tomeapi + regenerated TomeAPI.md/prompt/skill blocks). Full impact table: docs/tome-ui-authored-realm-migration-notes.md.
• Fixed god-mode drags (brush strokes, spline draws, handle drags) dying the instant they start: a press over the Tome UI authored-realm overlay focused that iframe, the game window fired blur, and the pointer transport's blur handler force-released the primary button — every gesture committed one tick in with a lost hold. handleBlur now ignores a blur whose focus moved into a data-tome-realm frame (its pointer stream forwards back into the same transport handlers); focus leaving for another window/tab still releases all buttons.
• BREAKING: draped wireSag scales with span length (jacob's drape-taste veto on the whole-run drape's first render, #inventors 2026-07-25: "too few lights. too big lights. weirdly draped?"). On draped runs wireSag is meters of droop per 10 m of span (default 0.8) — absolute-meters droop flattened every long crossing into a bar (0.6 m over a 30 m span reads straight). Pole layouts (poles: true, streetlight, zipline) keep absolute meters per pole-to-pole span since generated pole spans are uniform spacing-sized. Supersedes the 5.2.5 draft's "explicit wireSag stays absolute meters per span" line — if that draft re-folds onto a sha containing this change, fold this note into it.
• Draped spans hang as true parabolas now (droop 4·sag·t·(1−t), exact at the anchors, sampled ~0.5 m) smoothed through the parabola's knots with a centripetal Catmull-Rom — no rubbery overshoot between anchor and midpoint, tight-but-smooth crests over interior suspension points.
• Stringlight bulbs are small warm blazing points (r=0.035 globes hung under the cord, warm amber emissive at intensity 5) instead of 15 cm near-white orbs — real festoon look, on both the draped and poles: true layouts.
• BREAKING: stringlight bulb pitch is engine taste, not spacing (jacob's density call on the plaza render, #inventors 2026-07-26: "there should be like 3-5x more lights i think then good"). Bulbs pitch at 0.4 m along the strand — one constant across the draped and poles: true layouts (the pole lane hardcoded 1.6 m before), overridable per run with the new bulbSpacing field. Bare draped runs used to read spacing as bulb pitch, but field specs authored spacing for the pole-era layout (support pitch — jacob's plaza: spacing 1.5, poleHeight 5.6), and that read is exactly what gutted his 47 m runs to 31 sparse bulbs. His plaza re-renders at 118 bulbs per run (3.8×) with zero spec edits.
• Bulb caps degrade density, never coverage: a run longer than the bulb cap allows (512 per draped run, 64 per pole span) widens its pitch so bulbs still span the whole arc — a strand dark for its last stretch reads broken; a slightly sparser strand just reads longer.

technical notes

• Rooms move from Containers to Durable Objects (#7667). The room server no longer needs an OS: the five-isolate container topology (shell, sim worker, network worker, job pool, exec worker) is replaced by a host-blind room core behind three seams (netcode drain/send, externally driven runFrame, exec/job executor) with two hosts. RoomDO is the new default host — websockets + hibernation, a write-ahead ledger in DO storage (durability before visibility), a work-gated tick driver, crons on alarms, idle save — driving a Worker Loader engine isolate that compiles creator scripts at isolate startup; script edits swap the isolate make-before-break while sockets stay open. A thin Bun container host remains as the escalation tier for rooms too big for the isolate memory cap. The multiplayer server world now mounts an explicit 50-system manifest (down from 61) — a slim relay handling lifecycle, storage/LLM/auth rails, and fan-out, with NPC/animation/IK/voxel-tick/physics-step systems unmounted by name and pinned by a manifest test. IMPORTANT: this build ships with 0% of room traffic on the DO host — the new path stays dark until the staging pilot completes; rooms keep running exactly as before until the flip.
• 2d-top capsule feet-offset Y→Z leak (ledger 1421): every feet↔center conversion now derives the feet→center lift from the SOLVER-representable rotation instead of the raw ECS quat. New primitive projectRotationToRuntime (rapier/runtime.ts) — 3D passes the normalized quat through; 2D collapses to the solver's single in-plane angle (yaw about +Y in 2d-top, roll about +Z in 2d-side), the same collapse writeBodyRotation already applies on write. Previously the lift was rotated by the raw quat, so an out-of-plane WorldRotation (a flat-lying sprite pose, e.g. ±90° about X) expressed the character capsule's 0.95m feet→center lift (halfHeight 0.6 + radius 0.35) on world Z — the visible south axis top-down — genuinely displacing the body ~0.95m south of the sprite's boots at body birth (initializeBodyState) and on every external transform sync (syncPhysicsBodyToComponents → resolveTranslationFromComponents), and drawing the F3 collider ring at the same displaced spot via the view-origin fallback (resolveViewOrigin). The renderer's 2D orientation contract (lume quad-orientation) already composes only the in-plane twist of WorldRotation; physics now matches it.
• resolveTranslationFromComponents takes the runtime dimension as its first parameter and projects internally. Callers updated: rapier sync (static + dynamic/kinematic transform sync), collider rebuild realign, collider-view fallback (place mode as dimension), terrain rescue feet write. The ObjectAPI door is covered too: syncFeetPositionPhysics (feetPosition/position setters, move(), the interpreter's deferred op, NPC per-tick movement) carried two raw-quat conversions of its own — the live-handle path (transient: same-script-phase queries saw the body displaced for part of a tick) and reconcileUnmaterializedFeetWrite (persistent: a feet write in the disposed/respawn window stored the displaced center, rebirth preferred it, and the external-sync dirty loop skips handleless entities so nothing ever repaired it). Both now project; the live path's no-WorldRotation fallback reads the body via readBodyRotation instead of feeding rapier-2d's scalar angle to quat math raw. After this, every feet↔center conversion in the rapier paths derives the lift from the solver-representable rotation (mantle's own conversions are 3D-only by construction — 2D places always resolve to rapier — where the full quat IS solver-representable).
• getOrCreateHandle's RigidBodyDesc translation now goes through projectWorldVecToRapier like every later write — rapier-2d's setTranslation(x, y) reads y as world Z in 2d-top, and the raw 3-tuple call was handing it the world-Y feet lift (masked until now by initializeBodyState's immediate re-place, but dead wrong on its own).
• Deterministic repro tests: 2d-top character + one static box — north vs south walk-in stops at mirror-image feet positions (the ledger 1421 discriminator), body plane position equals written feet under external script-owned movement with a flat WorldRotation re-asserted per tick, no birth displacement, the collider-view ring pinned to the sprite's feet under a flat-lying WorldRotation, and ObjectAPI setProperty("feetPosition") pinned on both the live-handle and disposed/respawn-window paths. Mantle untouched (3D-only; 2D places always resolve to rapier).
• Authored-axes camera contract (ledger 1294 redesign; Slack C09PQJRDF08/1783986300 convergence, jure's spec): custom camera rigs can now DECLARE per-axis view-orientation ownership — camera.orientation: { source: "look" | "script", authoredAxes?: ("yaw" | "pitch")[] } — replacing every inference of authorial intent from what the script reads or writes. One owner per axis, declared at the API boundary. Script-owned axes are adopted from the authored camera state on every ingest and displayed exactly; mouse input never integrates over them (and the pitch-convention rederive is exempt on an authored pitch — the engine doesn't reinterpret a declared value). Look-owned axes keep display-rate pointer integration, with sensitivity now a typed field on custom defs. A script→look handoff continues from the displayed pose and drains pending input so buffered motion can't double-count. Fully script-owned rigs skip the renderer-authoritative live path entirely and present timeline-exact — a rig may read look axes without the renderer hijacking the screen (the pre-#9059 death-cam discard class, now unrepresentable by declaration rather than adjudicated by a divergence gate).
• UNDECLARED rigs keep exact 5.2.0 semantics, pinned by test: parameters-only steady state on the renderer orientation (config yaw/pitch never adopted after the kind-transition seed, however the numbers move), the mouse-shape classification heuristic unchanged, and the renderer→state angle write-back (writeCustomCameraAnglesBack) still applied. The write-back is now gated OFF for declared rigs: on the new contract nothing mirrors renderer angles into camera state fields — scripts read feedback through getViewAngles(). The declaration dissolves the echo-window/epsilon/headroom/false-adopt machinery of #9059 (already reverted in #9108) instead of re-windowing it.
• New read verb getViewAngles(): { yaw, pitch } | null in RADIANS on both CameraAPI (canonical view angles — renderer-published for look-integrated axes, authored state angles for script rigs) and ObjectAPI (same three-tier client/server resolution as getCamera(), which stays degrees). quatToYawPitch promoted to the shared math library.
• The declaration crosses the sim→renderer camera SAB as three flag bits (declared / yaw / pitch — [] and absent are distinct states), with a writer→reader round-trip test pinning the wire; malformed declarations (bad source, any invalid axis entry) degrade WHOLESALE to the legacy path, and tome-schemas mirrors that exact tolerance jiggle-style (a malformed orientation degrades to undeclared at parse, never rejects the spec — the patchCamera/DB-fold rollback class). Script→look handoffs drain axis-selectively: the handed-off axis's buffered motion is discarded, a still-look-owned axis's pending input integrates.
• Ported the three-era glowTexture material override (albedo-as-emissiveMap) into lume's model lanes — the #7602 three→lume swap never carried it, so every GLB whose glow rode overrides.glowTexture: true lost its texture term (the emissive override fell into the FLAT lane because the GLB declares no emissive map). Registry-level port: glowTextureVariantOf mints a cached material twin whose emissive map IS the base color texture, so the resolved override rides the existing map-multiplied lane (writeEmissiveLanes) and the existing full texture tier — final emissive = emissive(tint) × albedo × emissiveIntensity, zero new WGSL. Covered lanes: static batches, characters (whole + per-part subOverrides, rigid children included), and horde batches. glowTexture was already structural in both batch-signature classes (never uniform-class), so ± glowTexture visuals never share a batch and the emissive binding cannot leak across a signature reuse.
• A black (unauthored) source emissiveFactor lifts to white in the glow variant, so glowTexture: true alone glows the albedo as-authored — the three-era skinned-visual default, now uniform across lanes.
• Rigid children of skinned models (a sword on a hand bone) now resolve the emissive TINT into their instance lanes like every other lane writer — the per-character rigid path passed a null override hex (pre-existing), which the glow port made visible as lifted-white × albedo × intensity next to correctly tinted skinned siblings. The fix covers the whole emissive-tint class on rigid children, not just glow.
• glowTexture routing is one shared chokepoint (glowRoutedMaterial) across the three lane writers. A part that also mounts an override texture (model.materials.<part> texture/pbr) keeps its BASE material: the mount replaces the GLB texture table at bind time and neither mount tier carries an emissive-map slot, so the albedo-as-emissiveMap variant cannot bind — routing onto it would strand the emissive in a lane basecolor mounts never read (darker than not authoring glowTexture at all). The combo warns instead, and the emissive override still renders as a plain glow color.
• New log-only diagnostic model-glow-texture-ignored (engine-diagnostics allowlist) for every surface that still ignores the key instead of doing so silently: a material with no base color texture (nothing to glow), a scripted material (top-level or per-part subOverrides glowTexture — the script owns shading), a part claimed by model.subScripts (the part's script owns its shading), and a part mounting an override texture (no emissive slot to bind the albedo into). The silent ignore is how this regression went unnoticed.
• The quality governor's environmental-cap classification is INTERVAL-RELATIVE instead of budget-relative (ledger 1425). On iOS, a never-interacted cross-origin iframe's rendering updates are throttled to ~2Hz (466–660ms walls observed on iPhone 16 / iOS 26.0), and each starved frame drains ~10 sim ticks of catch-up — measured work inflates to ~20ms, which cleared every budget-relative defense: the clean-2× signature never matches 500ms, the throttle-suspect persist gate (#818) refused on busy ≥ 10ms so floor landings persisted and poisoned the device's future sessions, and the interval-capped regime (ledger 1223) refused on its work gate (20.3ms > budget × calm ratio reads "real load, keep cutting"). Three gates now judge work against the arrival interval where no genuine refresh-cadence overload lives: (1) the interval-cap work gate accepts above the calm band once the fused signal passes the deep-cap line (intervalCapDeepFactor = 4× budget), with the existing unexplained factor carrying the work test there — 20ms explaining a 500ms interval is 4% explained; (2) the throttle-suspect regime's near-idle test widens the same way, so catch-up-inflated busy on a ≥deep-line interval withholds the landing write instead of persisting the floor; (3) the frame-budget guard's environmental gate becomes a full interval gate instead of a 40ms-fallback floor, so a held latch's capped cadence stops re-entering the fused signal and re-descending the ladder the restore just gave back. These sessions now route into the 1223 machinery as designed: restore the pre-descent rung, hold, release when arrivals recover. Everything under the deep-cap line keeps its budget-relative refusals (near-budget real load still classifies as load), work ≈ interval slideshows still descend and persist honestly, and the clean-2× signature path is untouched. The pre-interaction throttle itself (early-interaction gate / same-origin serving, docs/mobile.md) is a separate product decision deliberately not taken here.
• Admission stability — killed the one-object-at-a-time pop-in after load (#9287): restored the renderer's apply-ack (markApplied after frame collect, so staleness machinery stops over-firing), a pending-vs-lost delivery guard, immutable resets, and one governed admission gate with a derived work budget and O(tree) admission. Worlds admit content in coherent chunks instead of trickling.
• Places restructure (#9306): runtime-minted place instances (enterPlace createIfMissing, ephemeral/session places) now live in a replicated server-owned registry component and expand to effective PlaceDefs at apply time — they are no longer written into the authored game spec document. The authored spec stays authored; the spec revision no longer moves when a runtime place is minted or torn down.
• God-mode selection fixes: fully invisible (opacity-0) objects rank below visible objects in click resolution — an invisible helper no longer steals the click from the thing you can see (#9452); children attached to model bones refuse selection consistently instead of sometimes selecting and never steering (#9399).
• Field-feed convergence (#9371): a walked-path fade now reaches exactly 0 instead of parking at a faint residue, and small per-frame write progress below the quantization step is no longer erased — slow fades complete instead of stalling.
• FX GPU reservations are sized from the authored population bounds (#9393): long stamped trails and other big authored effect populations stop starving mid-emission.
• The pass-lights fallback tripwire counts completed renders instead of loop iterations (#9376) — slow-booting worlds no longer false-trip into the fallback lighting path.
• Behavior job storage retries are bounded (#9441): a storage write that keeps losing its compare-and-set race re-reads fresh once and then parks loudly, instead of retrying forever.
• New API: spawn.assets.uploadImage (#9357) — frame-callable image upload into servable asset storage, so running games can turn player-made images into real assets.
• New diagnostic: a spec-shape warning when a rotation carries both lookAt and euler (#9387) — euler silently wins, and the engine now says so instead of leaving the conflict invisible.
• Hidden-tab capture timeouts name the real cause in their error text (#9412).
• Play-URL instruments: ?tierOverride forces a device tier (#9416) and ?rungPin holds a quality rung for measurement windows (#9429) — both for test rigs and device farms, no product behavior change.
• Perf rollups carry the viewport's inner dimensions (#9443), making orientation-split performance measurable.
• Savi teaching refreshed alongside the engine: primitives dress from the CDN by default with material-slot mounting taught (#9430), the flip idiom and lookAt/yaw conflation teaching pinned (#9384), game-UI inline handlers window-qualify document-shadowed globals (#9451), full-page screens taught fit-or-scroll on phones (#9438), and workshop wisps checkpoint after each stage so long runs resume instead of restarting (#9456).
• Spawn lifetime is now a replicated deadline component (tome/lifetime-deadline, stamped at spawn as spawn tick + lifetime ticks) instead of an in-memory engine timer, and a new tome/lifetime-reap system destroys past-deadline entities from whatever world currently simulates them: the owning client, the place host (including a suspension-reverted envelope, which joins the remainder WITH its deadline), or the server — which also reaps the UNHOSTED place remainder, the warm-room case where nobody simulates (ledger 732). Previously the timer lived in the world that executed the spawn — the owning client's sim under client-auth — so a refresh mid-lifetime stranded the server-replicated entity forever in a warm room. Re-arm-on-load falls out free: the deadline rides reset snapshots, re-adoption, and host migration. Only lifetime-bearing spawns carry the component (zero wire delta for everything else); armEngineCleanupTimer stays for world-local duration cleanups (effect/look/highlight clears); the armLifetime exec deferred-op dies (the component rides the create row through the merge). Two supporting seam fixes so a simulator's reap actually lands canonically: rail.destroy now authorizes the place host over a suspension-stamped session's adopted envelope (mirroring the StateDeltas drain's suspension rule), and the client-auth upload memo seeds reset-adopted simulated entities so their delete rows drain (an adopted entity destroyed without any intermediate write used to despawn only locally).
• Live-mouse-look de-aliasing (ledger 1320, tucker's counter-rotation stutter video): the pointer look path drained an integer movementX/Y Atomics accumulator once per render frame with no time base — device event cadence beating against frame cadence lumped two events into one frame and zero into the next (slow precise orbit-tracking stutter; trackpads worst, 60Hz events on a 120Hz display alternate double/empty frames). The camera SAB now carries a seventh slot accumulating the producer-clock span the look samples actually cover (per-sample gaps, capped at 50ms so an idle pause reads as a fresh gesture), and the renderer drains through MouseDeltaReader.drainTimeNormalized(frameDtMs): pending motion releases at the velocity it was produced at (frameDt/span per frame) through a displacement-conserving reservoir. Event rate ≥ frame rate ⇒ everything releases immediately (zero added latency for high-rate mice and flicks); added latency is bounded by one producer sample gap, ≤50ms always. drain() keeps take-everything semantics (reservoir included) for every discard/handoff/seed seam, so camera-kind transitions, sim-authority windows, and authored-axis handoffs still leave nothing to double-count. The visibility seam is closed on BOTH sides of the channel: the main thread clears the SAB slots it owns (as before), and the renderer's visibility message — which runs off the message queue even with rAF parked — discards the worker-side reservoir (LiveCamera.discardPendingInput()), so pre-hide motion can never release as one whip on the first resumed frame (adversarial-review receipt: a sparse-cadence 3×300px sweep whipped ~77° of yaw in one frame without it).
• pointermove look capture is now coalesced-aware: getCoalescedEvents() sub-samples (feature-detected; Safari and empty-list browsers degrade to the parent event, zeroed-sub browser bugs fall back to the parent delta) feed the camera SAB individually with their own timestamps, so the time-normalization sees the device's honest cadence instead of the rAF-aligned dispatch cadence. The ±350px whip clamp applies per sub-sample; the raw ring's MOUSE_MOVE append stays on the parent event — sim-side gesture traffic is byte-identical. Gamepad look passes its rAF poll timestamp (the main-rAF→worker-rAF phase drift is the same beat) and rides the same de-aliasing; touch look passes no timestamp and keeps its exact raw immediate-release behavior — a sample without a time base carries no coverage, and no wallclock is ever read in the channel.
• Feel-layer only, below both camera contracts: declared and undeclared rigs (#9148 authoredAxes) integrate the same de-aliased drain identically (pinned by test); the engine still never substitutes camera framing, and nothing replicated changes. Deterministic beat-frequency regression tests drive synthetic event/frame cadences with no real timers: lumpy pre-fix drain, smooth post-fix drain, conservation, idle-start immediacy, stall-backlog bounds.
• Fixed api.query silently dropping positionless entities (tag/state-only data holders spawned with no feetPosition) on every enumeration path (ledger 1414). The tag-index walker now reads a missing WorldFeetPosition as the pinned origin default {0,0,0} (ledger #359's read contract, matching getObject), and the full-scan, tx-overlay (run_script), and spatial paths gained a positionless supplement leg so all paths agree — sensor surfaces (nearest, player scans) read the same origin default. Missing position counts as the origin in radius tests: a query sphere covering the world origin includes data holders, one that can't reach it excludes them. The supplement rides PositionlessTagBearersResource (maintained at the tag-index chokepoints plus the spatial hooks' position edges, drift-pinned against the component-derived truth), so zero-positionless worlds pay ~nothing and origin-covering queries pay O(data holders), not O(all tagged entities).
• scripted-material.ts's walkGraph (param classification + non-finite slot detection) is now explicit-stack iterative instead of recursive — the one residual #9361's review adopted (ledger 1307's recursion half). Content scripts mint graph DEPTH with flat loops (for (…) n = n.add(…)), so the recursive walk threw RangeError: Maximum call stack size exceeded out of collectReachableNodes, whose catch degraded the build instead of crashing it: every pending auto param forced raw, up to MAX_UNIFORMIZE_ATTEMPTS (4) builder re-runs, and the material lost uniform patchability (every param change cost a full rebuild). Visit order, first-true early exit, fnCall body expansion timing, and the catch-containment semantics around the walk are byte-identical to the recursive form — the walk trades JS stack for heap, nothing else.
• Every walk over shade node-graph inputs is now explicit-stack iterative instead of recursive (ledger 1307's recursion half): StageEmitter.count, the ref/express emission fold (now ref/openFrame/compose/finishRef), validateFnBody's capture check, resampleAtUv's rebuild, and fused-look's rejectNode classification + rewriteFrameReads rebuild. Content scripts mint graph DEPTH with flat loops (for (…) n = n.add(…) — sky-king's 445 generated materials), so the recursive walks turned working authored graphs into RangeError: Maximum call stack size exceeded thrown out of the scripted-material rebuild (izkimar's "Maximum call stack while rebuilding materials" episodes) and into caught two-hop parks for looks. Emission order, hoisting, resource first-encounter order, and node-id assignment are byte-identical to the recursive emitter — the walks trade JS stack for heap, nothing else. Emit-time failures that remain are deterministic ShadeTypeErrors, which the per-material catch already parks with a diagnostic and a visible Std/PBR fallback.
• Ledger 1395 (Farm Island dig c39c9027): extended the runscript forwarding recipe (tome/script-forward) to the engine's own rails. New hook.invoke control message (protocol-additive) carries a hook _invocation descriptor — never code; the client resolves the hook from its own compiled spec — sharing the script lane's pending table, ref space, and ScriptResponse reply channel, so ref mismatches between the two lanes are unrepresentable. Verdicts are coded (no_client/timeout/interrupted/mode_changed/rejected/hook_error) so fire sites can tell delivery residuals (skips, logged) from the game's own script failures (reported through the same behavior-error rails as local runs, with per-script LifecycleHookError attribution reconstructed from the wire).
• Authority-side executor tome/hook-forward-authority (server bundle — glued client-side in singleplayer, no-op on the real server): strictly FIFO, one invocation in flight, so a save-at-disconnect can never start before a restore-at-connect settles (the takeover/self-heal clobber order is structurally dead); entries wait (deadline-bounded) for the compiled spec / player entity boot races and answer honestly (timeout, rejected on revision skew) instead of rotting or guessing. Persistence flows on the existing rails: storage via tome/job-forward (player-scope authorization unchanged), spec mutations via RoomClientOpcode.SpecMutations.
• Room-runtime fire sites gate per fire on isSingleplayerWorld (mode can flip live): crons forward with per-cron in-flight dedupe (no autosave thundering against a frozen tab); onPlayerConnected forwards fire-and-track (awaiting would deadlock the join the delivery needs); onPlayerDisconnected forwards awaited, skipping fast when the client is gone and at shutdown (the pump — and the forward rail with it — is already stopped); onPlaceStart forwards per place in order; onPlaceShutdown is a documented singleplayer skip at teardown. CronScheduler's context is now runJob(job, cronId) so the runtime owns the execution-context decision.
• Reattach outbox prune and room reset settle queued hook.invoke frames loudly (interrupted) on the same synthetic-response channel script.exec uses; a networking-mode flip re-routes queued scripts locally (as before) and settles queued hooks mode_changed (the server-context rails run the next fire correctly).
• Fix round (adversarial review): three edges hardened. (1) Wake-replay fencing — hook.invoke carries the server's enqueue stamp (issuedAtMs), compared entry-to-entry on the server's own clockline (never against the client clock): a frozen tab that receives a minute-spaced backlog in one wake burst executes at most the newest invocation (older entries answer timeout, same-cron duplicates are superseded outright even inside the window), and the resident client queue is hard-capped at 32. (2) One-in-flight is unconditional — a started invocation is never swept at its deadline (the deadline is a reply deadline, not an overlap license), so a save can never start while a slow restore still runs; unstarted entries behind a blocked head still expire honestly. (3) Authority-epoch fencing — an invocation reaching a world whose spec says multiplayer answers mode_changed at receipt (the no-spec boot race still queues), and the runtime worker clears the queue on singleplayer exit, so a quick singleplayer→multiplayer→singleplayer flip can never replay a stale invocation. (4) Continuation fence (the common root under the first three) — queue membership alone cannot fence a STARTED invocation, whose closure retains the world/api until settlement: each started invocation now captures a monotonic generation, bumped on queue clear (reset, singleplayer exit) and when the sweep cancels a started cron superseded by a newer resident fire of the same cron, and validated at every resumption point — the ObjectAPI (first touch after cancellation aborts the resumed continuation), the settle path (a stale verdict is discarded; the server's verdict already exists), and the job callback brackets (the fence's abort is recognized and discarded, never reported as the game's job_callback_error) — so a buffered job response or a released await can no longer resume a dead invocation into the current world. Supersession is the only sweep cancellation: a started lifecycle head is never cancelled, however stale — a merely-slow restore stays a passive block (the FIFO ordering claim above is unconditional), because cancelling it would run a later autosave against un-restored state.
• Singleplayer mirror job echo-discard (specimen: dump db485cf6, Farm Island — two save-keepers wrote user/<id>/farm-save once a minute: the client authority and a mirror world permanently at spec defaults; last-writer-wins clobbered the real save). In singleplayer the server world still runs behavior scripts (simulation-authority returns true on both realms) and drained their api.job submissions into the room's real pool with real storage credentials — "read-only" was enforced only for spec mutations (spec-mutation-drain's singleplayer discard). tome/job-dispatch now applies the same precedent to the job lane: on a singleplayer server world, a builtin server-rails job submitted by a mirror-run behavior is discarded at drain (debug-visible aggregate log tome.job_dispatch.singleplayer_echo_discarded), because the client authority provably runs the same behavior code and its own submission rides tome/job-forward under the player's user/<self>/ authorization. The discarded request's callback deliberately never fires (the same silence as any skipped-at-dispatch request) — a synthetic verdict would feed the mirror's scripts a result the real job never produced.
• Exemptions, by provenance: the lifecycle/cron lane (TomeJobRequest.lifecycleSubmitted, stamped at api.job() when LifecycleContextResource is active) is not an echo — hooks and crons execute only on the server world today (ledger 1395; PR #9366 re-homes those invocations to the client authority, whose jobs ride the client-mode dispatch + job-forward rail and never enter the server world's queue, so the two fixes compose); relocated-interaction continuations (this machine holds the hook's only copy); and custom spec jobs, which stay mode-both local by design — the builtin server rails were the write-capable hole.
• Sprite apex, following #8684's text apex. Motion vectors now ride depth: on TAAU frames the depth-writing cutout sprite class stamps honest per-instance motion vectors (lume_velocity_pair over VS-computed now/prev world poses) instead of leaving the velocity MRT masked — the fix for walking-character TAA ghosting, where the resolve's closest-depth tap reprojected a depth-writing sprite with the background's velocity. Entity motion comes from a new per-instance prev block (instances.ts, 28 → 36 floats) retained by the per-frame pack; camera-dependent billboard bases resolve in the vertex shader against the new frame.prevView uniform, so camera motion stays repack-free and honest. History reseeds (zero object velocity) on first pack, cull gaps, re-homes, dimension flips, and pose-basis draw replacements (billboard/parallax/repeatX/anchor/size-presence — the retained pose was presented under the old basis and differencing across it would fabricate velocity), with ONE shared same-key adopter serving both the draw/sprite and draw/sprite-instances writers. The whole-tile repeatX camera recenter applies to both poses (a presentation re-parameterization, never differenced). Transparent sprites keep the writeMask-0 velocity doctrine.
• Composes with #9314's restored pixel-inferred 3D cutout default: the walking-character population — a prod sweep found ~2,500 pixel-classed sprites, including 56/59 3D player sprites — rides the depth-writing class this fix lives on, so pixel characters get honest motion vectors with zero authoring. Known residual (2D parity, pre-existing): authored opacity does not enter the cutout discard, so a pixel-classed sprite faded by opacity keeps writing depth (and now velocity).
• No sprite distance fade — deliberately (evaluated and dropped in review round 3): in 3D the transparent class is the DEFAULT sprite class (~3.9k live sprites across 216 games in the prod sweep), sprites have no core/fringe twin to fade honestly, and camera-attached sprites present at constant pixel size, so text's 3→6 px band would have permanently dimmed real content. Both sprite classes keep authored alpha out to the pre-existing hard distance cull.
• No creator-facing spec changes; sprite billboarding and 2D sort-band behavior are unchanged.
• Staging/dev-only debug-dump gesture (jure, 2026-07-16): five consecutive taps within 2s inside the lower-left 80×80px corner of the game view post spawn:debug-dump-gesture to the parent frame; the kiln page hosting the iframe answers by running the same debug-dump capture the studio Debug chip runs and copying the shareable dump link (touch devices have no F2/Copy path into the perf tooling). New module engine/client/debug-dump-gesture.ts — a pure corner-tap tracker (a tap qualifies only when its pointerup lands within 250ms of its pointerdown with ≤10px of travel — the movement stick's spawn region contains this corner, so stick grabs/flicks never advance the streak; out-of-zone or non-tap presses reset the streak; the window prunes stale taps) plus a hostname gate: staging.play.bigspawn.net, *.staging.bigspawn.net legacy aliases, and the localhost family install the listener; prod (play.bigspawn.net) returns null from the installer and the gesture structurally does not exist there.
• Input honesty: the listeners observe pointerdown/pointerup/pointercancel capture-phase and passive — never preventDefault/stopPropagation — so every touch (including the five taps completing the pattern) still reaches the game.
• Wired in worker-browser-host beside the F2 inspector shortcut installer, cleaned up at host dispose.
• One truth for placement (ledger 1428, the towerwood class-kill): creator-facing terrain height/surface reads now answer from the AUTHORITATIVE sampler — sampleReplicatedTerrainHeight (pure generator eval + replicated terrain:height field layers + voxel edits), the same sampler y: { terrain: N } pins resolve through (position-utils) — never from loaded chunk outputs. Flipped surfaces: api.getTerrainHeight, api.getTerrainNormal (object-api.ts), and run_script's bare getTerrainHeight/getTerrain overlay (exec/engine.ts). Previously these defaulted to sampleTerrainHeight, which prefers whatever chunk output is resident at whatever LOD the device streams (alignment.ts sampleLoadedTerrainHeight) — when the quality governor stepped a device's terrain streaming profile down (streaming.ts terrain-reach seam), hilltops shaved ~5.5m in the loaded picture and scripts planted objects at the blurry LOD surface while spec pins stayed put (towerwood, staging app e09e686e).
• The live sampler stays engine-internal, verified caller-by-caller: chunk rescue + the collider parity probe (terrain-systems-shared.ts), collider gating (collider-gate.ts), server room placeholders (room-placeholder-manager.ts), the god-mode visual overlays (selection-outline.ts, scatter-footprint.ts — drawn onto the rendered mesh), and cameraApi.getTerrainHeight/getTerrainNormal (camera-api.ts — camera scripts relate to the streamed ground on this client; doc comments now say so). NPC steering/nav never used it (nav-grid samples heightFromDefinition directly). sampleTerrainSurface's explicit source: "live" | "replicated" option is unchanged — the flip is at the creator-facing call sites.
• Consistency dividend: god-mode drag/placement lanes (default-editors, placement-flow, brush session, authoring-api) compute terrain-relative offsets via api.getTerrainHeight and bake y: { terrain: N } pins — offset math and pin resolution now read the same surface, so a drag on a stepped-down client no longer bakes an offset wrong by the LOD delta. The exec overlay lane was already answering replicated by accident (the transaction-overlay proxy's identity misses the output store's world-keyed WeakMap); it is now the explicit contract.
• Semantics note, stated honestly: scripts that RELIED on reading the render-LOD/loaded picture (if any) now see the true ground — including edit-free voxel places, where getTerrainHeight previously preferred loaded chunk samples; mid-cell heightmap reads, which now eval the generator exactly instead of bilinear-interpolating baked samples; and legacy UNTAGGED height-sculpt journal edits on old heightmap worlds (chunk builds bake them, the replicated lane does not — pins never saw them either, so reads still match pins exactly; they diverge from the rendered/collider ground on those old worlds, pre-existing pin-lane behavior now shared by reads). Red-first coverage in terrain-height-one-truth.test.ts: synthetic coarse-LOD-resident chunk (5.5m shave) — api.getTerrainHeight/getTerrainNormal/run_script answer generator truth, the internal live sampler still sees the loaded picture, and the API read equals what a terrain pin resolves against.
• Rapier corruption quarantine is now structural instead of flavor-matched (ledger 1442, dig 06a668b1): any exception escaping the wasm step itself (world.step) marks the runtime corrupted unconditionally — a stack-overflow RangeError unwinding through wasm frames poisons wasm-bindgen's borrow flags exactly like a Rust panic, but the old matcher rethrew it, leaving the world poisoned-but-unmarked and every physics-touching system throwing "recursive use of an object … unsafe aliasing" per tick until page reload (prod app 8b8a0b7d "Canyon Strike", two sessions, ~3.5 min and ~28 min of zombie physics).
• The per-tick rapier funnels that entry-check corrupted but could never SET it — syncWorldFromRapier, syncExternalTransformChanges, cleanupRemovedPhysicsEntities — now quarantine on any escaping throw and return, so a poisoning that first surfaces there self-quiets next tick and ensureRuntimeForPlace rebuilds a fresh world.
• isRapierCorruptionError additionally recognizes stack-overflow messages ("Maximum call stack size exceeded", Firefox's "too much recursion") for the remaining pattern-gated call sites (character controller, trigger overlap, sensor broadphase, warmup). Over-marking worst case is one cheap world rebuild + ECS resync — the rebuild path was already proven in prod. Both rapier lanes are covered (the runtime is shared across 3d/2d-side/2d-top).
• BREAKING (server internals): the four server-side asset-metadata fetch rails (appearance/bounds-prefetch, appearance/socket-prefetch, appearance/parts-prefetch, sprite/metadata-hydration server halves) are deleted from the multiplayer server world. Derivation re-homes to the place host's browser (client-bundle systems gated on the live place-host claim; the singleplayer authority keeps local landing), which uploads over the new rail.assetMetadata command — host-gated, budgeted (16/tick, 64KiB/command, ≤64 sockets/parts per model), validated relay-side with the same predicates the fetch rails ran, idempotent (re-sends of landed truth drop silently), reference-checked (only assets a live entity or the spec names). The relay applies through the shared spec writers (tome/asset-metadata-writes) — three-way landing + one TomeSpec revision bump per accepted command.
• Additive spec vocabulary: assets.metadata[textureId].sprite2d = { version, meta | null } (canonical-texture-id keyed; meta: null is the replicated terminal "no 2d metadata" answer). Sprite size/anchor/collider upgrades are now pure realm-local computations over the replicated entry.
• The sockets/parts warm/poll split is collapsed: one authenticated host-session fetch both triggers the MagicCDN cook and reads the sidecar (cooking-base refunds preserved: 502/504/429 × 40).
• Terminal-refusal semantics for the surviving server asset fetcher (physics/collider-assets/server, plan §(g)): a pre-I/O egress-allowlist refusal (classified by the seam's stable message contract, drift-pinned against resolveAssetFetchTarget's real throws) or a dead 4xx (isDeadAssetHttpStatus, read structurally via response.status incl. one cause hop) parks the cook request for the room's lifetime — one runtime log + deduped DM — while 202/5xx/verdict-window classes keep their existing ladders. gltf-hull-extractor non-ok answers now throw GltfFetchHttpError (structural status).
• Fixed: multi-hop asset I/O chains inside the engine isolate (the collider rail's probe → GLTF → .bin sequence) were canceled by workerd after the first hop settled — colliders silently stalled as placeholder boxes on the DO tier. Chain owners now register their end-to-end promise (adoptAssetIoChain, wired to the floating-I/O registry by the isolate entry); the workerd asset-rail truth test drives the full three-hop chain.
• The DO relay stops fetching models for metadata: the slim-server manifest's asset-authority group is down to physics/collider-assets/server + tome/authored-clip-fold (which fetches nothing — it is a patchAssets writer).
• Terrain decoration birth (the 0.25s grow-in, DECOR_TRANSITION_SECONDS) is now once-per-content instead of once-per-GPU-arena, killing the first-load whole-field pulse (jacob's report: "decorations grow and then shrink and then grow a few times"). Three re-arm paths died: (1) entry-arena rebuilds (ensureDecorationEntries on decorationPoolsKey/config-revision/device changes) now carry each layerId:itemIndex's consumed birth — and its last known draw lane — through a DecorationBirthCarry ledger instead of minting birthPending: true, so every first-load lod-pool arrival no longer re-grew the whole field from zero; (2) draw-readiness re-arms birth only on the null → non-null edge of drawReadyKey, never on value changes — a fixed→scripted material compile landing, a velocity-MRT flip, or a texture-lease upgrade keeps placements and grown scale (the texture-adoption re-arm in bindEntryTexture died with it; a FIRST texture arrival is itself the null → non-null edge); (3) a previously-occupied tile-map cell keeps its birth when chunk refinement re-allocates its pool SLOT (tileMapCellBirth no longer compares slot numbers), so streaming-era slot churn stops re-birthing chunk tiles. Genuinely new content still plays the grow-in: never-revealed items mint birthPending, previously-empty tile cells stamp fresh reveals, and content returning after a real drawability gap (or a teardown-shaped clear) re-births. Regression-pinned in decoration-firstload-pulse.test.ts (all four cases red on the pre-fix engine); steady-state quiescence (F15) untouched.
• Script timers (api.runInSeconds / api.runInTicks) now survive simulation-authority handoffs in the world that armed them (the timer half of ledger #732's lifetime-deadline work). Timer dispatch used to CONSUME a due timer whose owner another world currently simulates (state.timers.delete before the simulator skip), so any authority round-trip — an alt-tab suspension takeover that reverts, a host seat migrating away and back, a disconnect grace reverting an envelope to the server — silently killed every pending timer for good. Dispatch now retains such timers (the new isOwnerSimulatedElsewhere gate: exactly the two simulation-authority clauses of shouldSkipBehaviorEntity, without its liveness/fault clauses, which still consume) and fires them on the arming world's first simulated-here tick at or after due — the same "expired deadline reaps on the first simulated tick after the stamp" semantic as tome/lifetime-reap. A retained timer still dies with its entity, with cancelTimer/script-edit reaping, or with its world: a departed player's timers die with their tab — the callback is a closure, and code never rides the wire. That boundary is now documented on runInSeconds (generated API docs + skill reference): must-survive deadlines belong in spawn lifetime (replicated, #9051) or in state checked from update().
• Hierarchy solve is O(changes), not O(objects), per tick (#9593, ledger 1463 wall 1): steady-state ticks expand the hook-fed dirty set downward through a cached inverted TomeParent adjacency and visit only that expansion in cached topo order, instead of walking the full sorted entity list to find the dirty few. Zero per-tick allocation; boot and requestHierarchySolveAll passes still walk everything. DEADZONE-shaped bench (7,245 parented entities, 36-entity per-tick dirty set): 1.19ms → 0.058ms per tick — the prod specimen was paying 22–65ms of hierarchy solve EVERY tick, alone ≈ the whole 30Hz budget.
• Spec hash is per-node merkle with identity memos (#9595, ledger 1463 wall 2): the once-per-writing-tick TomeSpec.hash stamp hashes structurally — leaves from canonical scalar forms, containers from child hashes, memoized in an identity-keyed WeakMap — so hashing a structural-sharing successor costs O(changed path): 162ms → 0.5ms median per writing tick on an 8.4MB spec. The client's hand-synced stringify clone dies (both realms import the ONE shared module), and the two sanctioned in-place live-doc writers invalidate memos path-precisely.
• Spec mutation fold is copy-on-write with delta-confined signature invalidation (#9596, ledger 1463 wall 4): foldSpecMutations stops structuredClone-ing the whole doc per forwarded mutation batch — every mutation site owns exactly the path it writes through, untouched subtrees keep the base doc's identity, the no-op gate compares structurally with identity short-circuits, and the TomeSpec stamp goes lazy. An object-array-confined write evicts only the touched rows' diff signatures (plus their expansion-derived ids) instead of dropping all 7,263; anything unattributable falls back to the whole-map drop. Bench at DEADZONE scale: fold 45.3ms → 0.23ms, fold lane end-to-end 151.5ms → 2.7ms with zero whole-spec hashes.
• feetPosition: { attach: "camera" } now resolves in the mesh, primitive, and model render lanes (#9598, ledger 1468 — finishing the documented primitive only sprites honored): attached roots re-present each frame against the live frame camera (post-smoother, zero-lag by construction — script-driven re-posing swims ≥1 tick behind and cannot be fixed script-side), subtrees transport uniformly in the root's camera-local space (bone-attached children included), depth clamps to live near/far, physics anywhere in an attached subtree refuses loudly at the write boundary, and query() filters subtree members exactly like their root.
• The model render lane honors material: { depthTest: false } (#9607, ledger 1472 — the documented flag every other lane already read): overlay-pool semantics mirrored exactly from primitives (depthCompare always + no depth write, forced transparent class, draws in the post-alpha overlay slot, never casts shadows), across static batches (LOD + instances included), hordes, and characters with per-part subOverrides and live material-write re-resolve. Scripted materials already honored the flag; plain GLB model materials silently ignored it.
• camera-first-person skill teaches the held-item viewmodel (#9604, widened to GLB models in #9610 once #9607 landed): spawn with feetPosition: { attach: "camera", x, y, depth }, realm: "client" + audience: "local" for per-viewer items, material: { depthTest: false } for the no-clip lane (primitives, mesh parts, and GLB models all honor it), ADS = offset easing + setCamera({ fov }), bob/sway/recoil = per-tick offset math. The section opens with WHY scripts can't do the transport themselves — the fact that retires the whole re-posing class two power creators hit in 3 days.
• places skill: state that must survive a place transition rides the enterPlace call itself — seed via createIfMissing.objects or pass the instance id you hold — never a storage write you re-read on the other side of the boundary (#9602, the Diceweaver three-patches-in-four-days class).
• Interact prompts hide when their source is hidden for the viewer (#9608, ledger 1473): a display-honesty gate reads replicated client state — source not drawn (the renderer's own override ?? base visibility semantics), source riding the viewer (local player's TomeParent attachment subtree or a camera-attach subtree), source destroyed — while prompts on items held by OTHER players keep showing (steal/trade designs stay honest). Kills the permanent "Take" prompt floating on your own held gun; the distance gate is untouched.
• normalWorld is available in the vertex stage of lume scripted-material assembly (#8768, jure's shade-vocab-gaps class from the 5.2.0 mint): vertex graphs read the exact normal the fragment varying is fed (lume_normalMatrix3 cofactor transform on instanced lanes — correct under non-uniform scale — world-premultiplied skinned pose normals, raw attribute on "none"), hoisted ahead of the positionNode block, so displace-along-the-surface-normal compiles instead of parking the material to its white Std/PBR fallback. A normal-less layout parks with the honest missing-attribute error.
• pushLook of a scripted look carrying fade > 0 or partial strength now teaches loudly (#9594, ledger 1465 honest floor): scripted looks are selected by priority alone (the strength ramp sweeps only built-in recipe contributions), so those options hard-snap — the authority world emits one content-deduped runtime-log warn + DM (scripted-look-fade-strength-ignored) naming the script self-mixing recipe (a ctx.param("fadeMix", 1) swept by the pushing script). Push behavior itself is unchanged; honored shapes stay silent.
• Script-edit swaps stop freezing the room (#9572, SS-B of the swap-freeze program p-d2720022): the replacement isolate boots IN PARALLEL while the old isolate keeps serving (mid-boot ticks lose nothing — the snapshot hasn't been taken yet), the handoff runs snapshot → restore → inline apply pre-flip, and flip → durable ledger append → reattach is one sync-contiguous block. The measured 331–468ms of per-swap egress silence collapses to the snapshot encode; any failure — boot, restore, apply throw, or a structured apply rejection — leaves the OLD isolate the room, unswapped and coherent.
• The singleplayer run_script/hook forward lane is honest end to end (plan p-d2720022 incs 1–2): a no-client SP room reroutes run_script into the server world's script queue with full transactional semantics instead of fast-failing (#9562); device visibility becomes its own wire fact beside projection — initial state on the socket attachment, transitions on a new opcode (#9579); forwards carry an ack fence, so a hidden/frozen tab's offer voids in ~2s with a fact verdict + script.revoke instead of a 20s "most likely backgrounded" guess — 743 of 999 weekly run_script failures were that class (#9581); and a voided forward RETARGETS to the server exec lane, so the change executes instead of merely failing fast (#9586).
• Join-honesty deadline on the DO boot lane (#9580, ledger 1460): an accepted client socket must reach its welcome within a deadline or close loudly — the forever-open zero-byte join hold (the staging UI-only-spec wedge; a boot-ladder await that hangs without rejecting, the one shape no detector covered) becomes a detected, telemetered close instead of a silent black screen. Ships the sweepSockets one-door discipline the sibling DO landings build on.
• Audio rate-limit honesty covers the payload-fetch face (#9573, pc-152aff3c): a 429 landing on the real asset fetch after the probe passed now parks the clip with the same typed quota verdict as probe 429s — no attempt burned, one scheduled re-attempt when the window lifts — instead of burning to terminal failedClips in seconds; the retry window reads from the 429 body when the Retry-After header is stripped; a windowless 429 takes one bounded 15-min fallback re-attempt, never a tight loop. The audio-quota-parked diagnostic + DM now carry the exact capped URL.
• Scripted-primitive re-mints merge runtime-diverged params on non-replace applies (#9533, ledger 1454): a script save re-minting a scripted primitive composes new script content × merged params — doc-changed keys win, runtime-diverged keys survive, the mergeRuntimeStateWithSpecDefaults three-way law applied to primitive.params — and both re-mint call sites hand the SAME effective props to appearance and physics, so colliders rebuild from exactly the params the visible mesh was minted from. Replace applies (revert_to_version) still fully reset, matching state's #296 semantics. Kills the carve-ledger class: visually-pristine hills whose collision remembered every crater.
• Content-policy asset rejections reach Savi (#9528, ledger 1453 — the engine half of #9495): getUnreadySceneAssets() grows a terminal "rejected" status (+ provider category) rendered FIRST and deliberately without an elapsed-time suffix, and the first cached-verdict 400 fires the model-load-failed teaching diagnostic immediately with a terminal park (zero further network) — instead of riding a 5-attempt retry ladder whose eventual generic message gave the wrong advice and whose oversized key was silently dropped for exactly the long-prompt ids content policy rejects.
• Savi game-alert flood mechanisms (#9523, jacob's "absurd amount of game alerts"): behavior-error DMs re-key on the unit Savi fixes — (hook, scriptRef) at session scale, re-armed by her own spec save, never by the clock or the volatile error message; [client-reported *] teach rails dedupe spec-version-scoped; idle drips coalesce. DM cadence only — the getLogs stream keeps every signal.
• The missing-target call-ignored LOG path is wall-clock once-then-count (#9529, ledger 1225): the first ignored call per (operation, target id) logs the full teach dump once per room lifetime, identical repeats fold into one compact counter note per 60s, and post-escalation summaries are time-gated per signature — a hot loop that put 35,711 rows into the kernel error lane in 2h now worst-cases ~1 line/min. run_script's exec overlay still returns every warning verbatim.
• Lume sprite-material honesty (#9506, the Diceweaver tab-away sprite vanish): failed pipeline builds retry bounded (3 attempts per budget, backoff, re-kicked on access) instead of parking permanently; texture loads carry tick-clock deadlines that abort wedged transports and hand the episode to the ordinary retry ladder; and a residency sweep (retryParked + deadline revalidation) runs on visibility hidden→visible and on projection-reset baselines. Terminal parks (tombstones, dead 4xxs) hold — re-probing them would re-open the tombstone-hammering class.
• Rapier quarantine classifies the whole wasm RuntimeError family and stops blaming scripts (#9502, ledger 1451 — extending #9471's structural quarantine): any live WebAssembly.RuntimeError is corruption structurally (message families kept for cross-realm copies, now case-insensitive), and post-quarantine hook errors reframe to physics-wasm-corruption attribution across the ops rail, behavior-error reporting (one storm = one stable dedupe key = one DM), and the client fault wire — the specimen session rained 9 wasm faults as behavior-hook errors on an innocent script and Savi built a wrong narrative for the creator off exactly that mis-attribution. Quarantine is surfaced to Savi and the player instead of physics silently going dead.
• Tint-without-albedo is the authored flat-color state for heightmap terrain materials (#9481, ledger 1446): albedo is optional when tint is present — buildMaterialPack emits the internal color layer as a first-class authored state instead of a warned fallback demotion, patchTerrain/schemas accept tint-only (albedo: null converts), deleting an inert albedo rides the shading-only fast path (zero visual change, no rebuild), and the atlas warning keeps firing only where a DECLARED albedo can't pack — a real defect signal. Kills the eternal-warning loop on intentionally flat painted ground (~92k-token hidden Savi turns).
• Place-host assignment gains adoption-confirmed tenure (#9394, p-4248883b): every assignment is provisional until the host proves adoption via a one-shot empty host-stamped delta through the normal outbox; unconfirmed-past-timeout re-elects preferring a different Streaming candidate (a sole candidate holds — no epoch churn on a timer), a shared expiry/re-seat cooldown prevents ping-pong with the 1257 forced-re-seat rail, and revocation beats expiry by rule. A join-window host that never received one snapshot can no longer hold an occupied place while a fully-Streaming joiner waits.
• DO-tier ops hardening from the 07-17 staging storm: wedge recovery gets a poison ladder — 3 consecutive terminal escalations on unchanged spec content identity inside 15 minutes parks the room cold instead of boot-looping the same poisoned spec forever (park-without-abort: workerd's output gate provably discards same-task writes, so the strike lands durably and disposal is in-process) (#9574); POST /rooms/{id}/reset is the DO-tier operator kill switch, returning a poisoned room to never-booted cold with a structural reset latch so mid-flight continuations can't re-poison it (#9577); and the shell memoizes asset-fetch allowlist refusals to one loud log row per (room, URL) with byte-identical rethrows, so frozen old-pin retry ladders stop flooding the error lane (#9560).
• Internal/observability: per-pass GPU timestamps ride the perf rollup + farm collection (#9597); SS-A swap-freeze phase split + tick-liveness instrumentation (#9565) and run_script emitter-lane counters (#9563); RoomHostLoopback RPC rejections un-blinded in the fleet logpush stream (#9517); MP visibility-aware host demotion pinned e2e (#9561); the do-sim bench's staging-floor leg tears down its room (#9576); workerd-exec settle flake fixed with signal-bound waits (#9519); an ECS delta recorder in the F3 ECS tab (#6918); DeployDefaultWorldStaging targets the static RoomDO host flavor (#9613) and stage.yml deploys the default-world-staging worker on master pushes (#9590).
• Depth-sorted sprites stay instanced (plan p-ce2385b6). sprite.ySort no longer nulls the batch key for depth-writing sprites (sprite-logic.ts getSpriteBatchKey) — every ySort sprite used to become a STANDALONE batch (own storage buffer, per-frame CPU sync, full pack), and dense top-down games stacked hundreds (overgrowth: ~371 single-instance batches/frame → 9.74 ms lume/render CPU on an L4 rig; prod F2 showed the same shape). ySort sprites now share their texture|blend|layer|order|depthMode|lit|filter batch: the per-frame full pack orders a 2D batch's instances by the standalone era's exact rank (computeSpriteSortKey, stable sort, view-depth tie-break — equal-y never flickers), and each instance carries its own sort band depth in a former pad float (instances.ts sortDepth, flagsB.z), so the vertex shader's clip-Z override is per-instance and the depth test keeps interleaving depth-sorted sprites ACROSS batch boundaries exactly like the standalone era. Cross-batch draw order stays the key's layer/order band (ySort only ever ordered within its layer/order neighborhood — zQuant clamps inside half an order stride). 3D never rank-sorts (zQuant is 0 in 3d): billboards keep physical depth and the existing back-to-front painter order; ySort in 3D is now fully inert instead of an accidental unbatcher. Scope: the batched path covers depth-WRITING sprites — cutout, the 2D alpha default and the entire dense-dressing class. A 2D ySort sprite that resolves depthMode "transparent" (authored cutout: false / alphaCutoff: 0, or a light-like blend) writes no depth — its cross-batch order is pure blend order, which only the per-sprite alpha-bucket sort preserves — so it keeps the standalone path (the pre-batching behavior, carved out in getSpriteBatchKey; pinned by the sprites-ysort fixture's soft column + store/key tests). receiveShadow/parallax/repeatX/camera-attach standalones are untouched.
• Fixture receipt (371 packed sprites, 358 ySort over 12 textures + 13 props, identical instances both arms): 361 batches → 15, 361 alpha draws → 15, 722 steady-state writeBufferCalls/frame → 15. Real-GPU ordering parity pinned by the new sprites-ysort render-harness fixture (2d-top, two textures, opposite pairwise overlap winners — impossible under whole-batch depth; negative control verified to fail) plus sprites/text-2d/emissive-2d/scripted-sprite-churn green on the L4. The A/B ceiling this chases: stripping the 358 standalone sprites measured lume/render 9.74 → 2.74 ms (−72%), draws 154 → 43, writeBufferCalls 288 → 66.
• The sprite material staging compare froze: packBatch compared the f64 band depth against its Float32Array staging, which never matched, so EVERY 2D sprite batch rewrote its material uniform every frame. The staged value is now Math.frounded; a static 2D batch settles to one instance-buffer write per frame and zero material writes. (The named non-scope follow-up — revision-gated packing so shared buffers stop full-repacking every frame, model-batch.ts:483 precedent — is deliberately NOT in this change.)
• Never-acked client-auth creates retire instead of leaking forever (#9675, ledger 1493 — jesse's peakaboom fx exhaustion): a client-auth entity CREATE rides the fire-and-forget StateDeltas lane, and a flood-dropped / outbox-pruned / chain-unwound create left a permanent local-only ghost whose spawned fx (windowless looping populations) held fx-arena population rows until the 256-row table packed solid and every new effect refused. The server drain now acks every create row it ADMITS (create.ack control on the reliable outbox); the client arms a 3s grace per published create (cleared by the ack, by the row appearing in room projection, or by projection reset), and an expired-unacked entity despawns through destroyEntityWithHook with destroy-preview semantics — the cascade takes its spawn-owned subtree (the fx it spawned die with it), frees the arena populations, and publishes delete rows so a late-applied create converges to dead instead of forking. One creator-language runtime-log line per retire. A version-skew latch arms the retire judgment only after the room demonstrates create.ack support, so a new client on an old room can never mass-retire healthy creates. Every arena population's backing entity is now room-admitted, local-realm juice, or retired within ~3s — there is no fourth state.
• The last permanent-absence collider lane with no terminator is closed (#9656, ledger 1491): a collider cook that succeeds (200 OK, valid GLB) but contains zero static geometry — every mesh skinned, or an empty cook — used to ride the flat 5s retry ladder forever (~12 req/min/asset; the live specimen held magic-cdn at ~59 req/min and 429'd the app's other assets for the room's lifetime). EmptyColliderGeometryError is a typed error at the single empty-hulls throw site, classified structurally (instanceof, one cause hop — never message sniffing), latched into the existing terminal machinery: one honest teaching line to getLogs + deduped DM ("this asset has no collider"), zero further fetches for the room's lifetime. Per-requestKey, so a manifest-signature change mints a fresh honest attempt. Fires only at the outer catch after both extractor lanes settle (the #9094 zoo-statics lesson).
• The correction blend (correction-blend.ts, projective velocity blending for authority handoffs on lease-class dynamic bodies) projected the abandoned trajectory's POSITION ballistically (fromPos + fromVelPerTick·dt) but held its ROTATION as a frozen quaternion nlerped toward the live stream — every seeded blend froze a rolling body's drawn spin, then swept it, so the roll twitched per correction and died at rest (ledger #1481, george's twitching cube). The blend state now carries fromAngVelPerTick, derived from the ring's last snapshot pair exactly like fromVelPerTick (angularVelocityPerTick: shortest-arc delta quaternion → rotation vector per tick — no wire dependency), and the abandoned rotation is projected (q(dt) = exp(ω·dt/2) ⊗ fromRot) before the shortest-arc nlerp. Zero angular velocity reproduces the previous behavior exactly; the module stays pure and mode-independent.
• squash()'s [0,1] clamp on amount at the ObjectAPI boundary (in place since #4606, verified against current master) was silent — squash(1.4) quietly became squash(1) and neither Savi nor the creator ever learned the input was out of range. Out-of-range amounts now warn through the mutation-warn rail (getLogs-visible), and the boundary behavior is pinned red-first: above 1 squashes fully, negative stays a no-op, in-range passes through untouched.
• The DO-tier behavior-compile refusal class is dead, end to end (the 07-16→07-18 staging arc): workerd only permits codegen at isolate startup, so scripts entering a live room outside the /update lane could never compile until an isolate swap — and the swap machinery had no reliable trigger and then no safe concurrency. Four merges close it: RoomDO self-pokes its own update lane on script-bearing drains, so an exec-authored setScript converges to a compiling isolate without waiting for a foreign write (#9643); adoption honesty — the scripts-hash is never adopted over compile refusals, mid-hydration specs no longer downgrade the swap to an in-place apply, and a codegen refusal forces a mandatory heal swap, converging in ≤1 swap (#9652, ledger 1488); exec-authored script edits arm the room's own bounded-backoff heal poke directly (#9661); and the heal is observable — a successful apply retracts the error ring's inert-script report instead of leaving a stale refusal row for Savi to chase (#9673).
• Script-edit swaps have exactly one arbiter (#9689, the 07-18 staging isolate-restart storm): one save used to dispatch the update lane from three independent triggers (kiln fan-out, exec-response self-poke, drain self-poke) into mandatory-swap machinery — overlapping replacement boots tore every connected client (reconnect races, iframe remounts, ~16s world reboots). Now one in-flight swap per room keyed by target scripts-hash (same-hash triggers absorb into the in-flight swap, different targets serialize), both self-poke lanes are check-then-dispatch (already serving the fetched hash ⇒ no dispatch), the blind "unknown live hash ⇒ swap" default is dead (swap only on a KNOWN differing hash; unknown live hashes apply in place and heal on positive refusal evidence), and every pre-flip swap throw logs a script_edit_swap_failed receipt — the old isolate provably keeps serving. Make-before-break preserved: one save, one replacement boot, sockets stay open.
• Cursor-need UI is now EDGE-triggered instead of level-triggered (pointer-lock-manager.ts): a visible [data-modal] / [data-needs-cursor] element frees the cursor when it APPEARS, exactly as before — but a pass-through canvas click (one that reaches the canvas rather than any UI pointer target) landing OUTSIDE the bounds of every visible cursor-need element acknowledges the visible set and re-engages pointer lock in the same gesture. Acknowledged-but-still-visible elements no longer hold mouse-look hostage; a fresh appearance (new node, hidden→visible again, attribute re-added) is unacknowledged by construction and frees the cursor again.
• Bounds-aware click gate: a pass-through click INSIDE any visible cursor-need element's rect is swallowed exactly as before (no acknowledge, no relock). This protects the common prod idiom — a fixed inset-0; pointer-events:none wrapper carrying the attribute around an interactive card — wholesale: its bounds are the viewport, so no misclick beside the card can relock over a mandatory-pick menu. Interactive full-backdrop scrims were already safe (their clicks never reach the canvas). Small ambient panels gain the click-to-relock rescue. One narrow corner trades a click: after a user-Esc unlock, a dead-zone click inside a wrapper's bounds is swallowed WITHOUT re-arming the relock gesture, so a panel that then closes without relockPointer() leaves the player one prompted click from lock where prod today relocked silently — accepted so that a click in a modal's screen region can never pre-authorize a later silent relock.
• data-modal joins AUTOMATIC_CURSOR_UNLOCK_SELECTORS as the taught vocabulary; data-needs-cursor is compat-accepted with identical mechanics plus a one-per-element deprecation nudge ([Tome] console line + cursor-attribute-deprecated engine diagnostic → getLogs, log-only).
• api.on() hitting the transactional guard inside an onSpawn that is itself running transactionally (the entity was spawned from run_script) now reports a hook-context message — register the handler from update() on its first run (guarded with a once-flag, since api.on() adds a new subscription every call) or spawn the entity from the spec — instead of the body-context "create a script with api.on(...) instead", which pointed authors at exactly what they had already done (papercut pc-21d6a350: the handler registration is permanently lost post-merge because onSpawn is never re-run live-side). failTransactionalGuard accepts an optional hook-context variant; body-context messages and the sticky exec-fault semantics are unchanged.
• Cursor-need acknowledgment now survives same-id element replacement (pointer-lock-manager.ts): when the 500ms scan finds an acknowledged element gone from the visible set and an unacknowledged visible cursor-need element carries the same non-empty id (first in document order, if the id is duplicated), the acknowledgment transfers to the replacement instead of it reading as a fresh appearance. Savi-authored UIs re-render through a morphdom-style DOM diff that can replace a modal root outright (new Element identity, same id in the markup), which previously re-freed the cursor on every render of an already-clicked-past panel — flicker plus intermittent re-capture on any UI that re-renders each second. The bridge rides the existing absence grace (the same 2-tick eviction window): an aged-out entry bridges nothing, an empty or missing id never bridges, and a fresh never-acknowledged id still frees the cursor exactly as before. Accepted trade, pinned in tests: a genuinely new modal that recycles a just-acknowledged id within the grace window inherits the acknowledgment. Teaching unchanged: a stable id on the modal root remains the recommended authoring pattern.
• Look author-colors render display-honest (#9091, ledger 1284 — jacob's waystead washout): the look pass mixed author-supplied color targets raw in tonemapped LDR-linear space with the sRGB encode applied after, so every color target displayed ~2× lighter than authored ("deep navy" presented as pastel periwinkle) and mix amounts read wildly non-perceptually on darks (a 9% haze toward cream lifted sRGB-0.10 pixels to 0.33). Authored colors are sRGB display values, so the blends toward them now happen in encoded space (encodedMix/encodedMixCpu, one shape across all six sites: grade haze, tint, both vignette colors, the fused WGSL vocabulary, and the CPU mirrors). A full-strength target displays as exactly the authored color; mix strength reads as display-referred opacity; sub-epsilon amounts are bit-exact passthrough, so looks without haze/tint/vignette render identically. Scalar grade ops (exposure/saturation/contrast/lift-gamma-gain/temperature) stay in linear with the compensated pivot. Merged on the jure/jacob taste verdict — every look-bearing world re-renders correctly.
• Place-host wedge self-heal (#9618, ledger 1478): the client-auth place-host reset/epoch cycle could wedge — resets failing while heartbeats pass — freezing replication on a stale world copy with the host's place physics never rebuilt (static colliders dead while meshes render); a sole live-uplink host was retained hosted-on-paper forever, and only a manual room restart recovered (the field specimen wedged every 40–60 min). The wedge signature is now observed, not inferred: resetDeliveryFailStreak counts consecutive wire.send_failed truth events, retired only by edges that prove recovery (socket replacement, or a live-table-corroborated host stamp reaching the drain). A sitting host with the signature (streak ≥ 5, uplink live, off Streaming) is re-assigned epoch-forward through the ordinary assignHost rail — the same machinery restart-rooms drives manually, scoped to the wedged place — preferring a different Streaming candidate when one exists, with a sole candidate re-assigning itself and restarting the retention clock. Healthy paths never touch the heal; the #9394 sole-candidate timer-hold stands untouched.
• BREAKING (multiplayer parent:"player" rows): player body vocabulary — composed spec trees can BE the player (#9646, plan p-f1a81569). Every spec object tree whose root has parent: "player" instantiates once per active player in multiplayer server rooms, parented to that player's entity and owned via the spawn chain (TomeSpawnedBy stamped depth-1 on every part, so the owner's client-auth writes pass the per-row upload gate — zero latency on your own screen). Parts are ordinary AOI-replicated entities (remotes see the rig on the avatar's stream; place transfers ride the existing subtree transfer). The derivation (instantiatePlayerBodyObjects) is a pure function of (spec, live player set) run on both diff sides of applySpec — spec edits converge for every player through the existing create/update/destroy machinery; join/leave stamp and reap per player (suspension is a table stamp, never a leave). A root behavior runs per instance with api.id = that instance's id. The exactly-one-player fallback for spec rows died, and unresolvable player-scoped parents now warn (deduped) instead of silently skipping.
• The loading-curtain's worker leg (scene.readyHint) derived from LIVE simulation conditions — current-spec-hash equality AND physics-not-paused — both of which can legitimately stay false or oscillate indefinitely over a fully running world, so the curtain could park at "Starting game… 50%" forever while the sim ticked and the renderer presented frames (ledger 1485, dump 336680ea: 3+ prod occurrences 07-17, hard-refresh/incognito/room-restart immune). An oscillating blocked state also reset the ledger-771 blocked-warn's persistence throttle every flip, which is why the wedge was silent. The leg is now a monotonic content latch (createSceneReadyContentLatch): once the authoritative spec has been applied to this mount epoch's world at least once (TomeAppliedSpecHashResource present — only ever written by a successful apply), scene content is ready and stays ready; physics pause and spec churn are simulation facts that happen behind an OPEN curtain, and the gate's renderer leg (completed presented frames, self-healing per 771) still guarantees pixels before the curtain rises. The one remaining blocked state (awaiting first spec apply) has a constant fingerprint, so the 771 blocked-warn now fires reliably for it. shouldEmitSceneReadyHint and hasAppliedCurrentWorkerTomeSpec (the equality predicate) are deleted; the mount-epoch boundaries (worker dispose + mount init) reset both the latch and the hint channel so a reused worker can never mute the hint behind a stale ack.
• Instrument rider (same defect family, dig receipt): the host's scene-gate flags (rendererFirstFrameDone / workerReadyHint / domReady / sceneShown) now ride the perf rollup at the parent-relay hop (same seam as the loop census), and kiln retains them into debug dumps (sceneGate block + a Scene gate: summary line). A dump minted over a stuck loading screen now names its false flag directly — the ledger-771 console collector (__spawnCollectSceneGateSnapshot) required a live console the reporter never has, and the dig burned 20 minutes re-deriving what this one line states.
• Fixed a permanent "Starting game…" boot wedge for specs with camera: { kind: "custom" } and no runnable camera behavior (no behavior refs, or refs that fail to compile — e.g. a deleted/renamed camera script). The camera behavior system used to early-return without ever publishing a camera view, so the renderer never built a frame camera, never presented a first frame, and the scene gate's renderer leg held the boot curtain forever over a healthy running world (refresh/respawn immune — deterministic from the spec shape). A scriptless custom camera now runs an empty static behavior: the authored pose publishes every tick (projection sync, pointer-lock intent, and hideLocalPlayer all still apply), boot completes, and a camera script takes over the moment one lands. One session-scoped console.info names the state.
• setProperty('model') RETIRES the profile-avatar fallback a3dc instead of retargeting it (#9688, ledger 1496): the fallback dresses a bare player template in DrawAnimated3DCharacter at join; when a creator's script then set a custom model plus its own locomotion, the retargeted a3dc's state machine (feature order 10001, engine runThreshold 3.0 m/s) rewrote the script's identically-keyed idle/walk/run mixer channels every tick — the character ran at walk speed and no script fix could ever take effect (Savi shipped a correct fix twice into that wall). The write seam now reads the same fallback provenance predicate the dress sites use (playerTemplateWantsDefaultAvatar, extracted to player-template.ts) — component removed, its engine-authored locomotion channels (A3DC_LOCOMOTION_CHANNEL_KEYS, the frozen contract) removed with it, script channels under other keys survive. Explicit spec-authored animated3DCharacter (true or { modelId }) keeps the retarget; non-player objects unchanged; matches the spec-apply seam, which already retired a3dc when a model was authored without it (engine-never-decides-anims law).
• The SP run_script forward lane covers the real caller shape (#9692, plan p-d2720022 b1+b2): production Savi/wisp run_script always carries a userId, which kiln maps to a targeted entry — and the no-client server-exec lane (#9562) only served UNTARGETED entries, so a real Savi call against a closed-tab singleplayer room still fast-failed NO_CLIENT (≈244/week), and the fence-void retarget lane (#9586) stayed dark for the backgrounded case (~74% of the failure corpus). (b1) the no-client server-exec lane widens to provably-absent targets — no connection-table row AND nobody mid-join, decided at the forward system's verdict on unsent entries only; a target with ANY row (mid-join, detach grace, disconnect-save, backgrounded-alive) keeps its behavior byte-identically. (b2) the fence-void retarget lane widens to targeted entries — a hidden/frozen tab's voided offer retargets to server exec instead of merely failing fast, with the late-zombie-reply double-execution detector pinned at ≈0. Storage misroute is impossible by construction (no storage verb callable from any exec site; ScriptQueueEntry carries no identity); identity READS degrade honestly ({userId: null, players: 0} + no-session log note). Forward-lane failures now carry structured verdict codes.
• fx-gpu refusal telemetry names the actually-exhausted resource (#9666, the ledger 1492→1493 dig aid): an arena refusal now says whether the population/segment table (256 rows) or slot space ran out instead of hardcoding the slot ledger (the wild specimen printed "full" beside 278k free slots), and emits a one-line resident census of who holds the table. Eyes only — refused-newest, the never-cull invariant, and both relief tiers are byte-identical.
• Teaching sweeps into the GENERATION sources, not just skills (#9650, ledger 1489): the spawn() docstring carries the spawn-residency caveat (non-resident spawns can't replicate or persist in multiplayer — seed via definePlace instead), the generated API reference documents the LIVE RaycastOptions shape instead of the dead pre-tombstone type, and the place-seam criterion (contiguous multi-storey interiors stay ONE place) reaches the PlaceMode/PlaceDef docstrings. Skill teaches: place boundary is a seam — stop teaching place-per-floor (#9645); god-mode blueprint pantries bake into the place spec instead of the shape the non-resident rail rejects (#9648); uploaded-models teaches parent:"player" bone equipment stamps per player (#9655); debugging teaches fix claims hand the verdict to the creator (#9663).
• Internal/infra: headless room-host staging light-up — image build workflow + container block behind ENABLE_ROOM_HOST (#9626); the room-host shell threads the engine identity into its socket URL so cold rooms boot on the right engine hash (#9680, ledger 1467); a staging return-without-refresh probe harness measuring the pin-bump silent-fork leg (#9690); a wang-tileset staple-family drift test (#9658).
• SP forward verdict follow-up (#9701, kernel half of the #9692 consumer adoption): the fence-void retarget's honesty note is conditioned on the void's socket fact — a dead-socket no_ack retarget no longer overstates "game tab is open but hidden" when the socket is gone.
• Animated tileset frames (#9726, plan p-96b0a6ef): tilemap tilesets take tilesetFrames (2–16) + tilesetFps (positive; renderer default 12, the sprite lane's KTX2 default) — playback is a uniform V-shift in the tilemap vertex shader (floor(time×fps) % frames) riding the two spare instance pad floats: zero new bindings, and the shift moves tileUv AND tileUvBounds together so cross-row bleed is unrepresentable (the lit-normals tap shares the one shifted UV). Absent fields resolve to neutrals (frames 1, fps 0 ⇒ shift exactly 0.0), so worlds that don't author them render byte-identically (IEEE identity pinned). The fields ride the terrain apply SIGNATURE (a frames-only edit re-applies), the zod twin in tome-schemas (updateTerrain can author them — TERRAIN_PATCH_ALLOWED_KEYS derives from the schema), and the sim→renderer tilemap chunk codec at v5 (frames as u8, fps as f32, 0 = absent on both — absent round-trips as absent), with a field-by-field round-trip def-equality pin and the stacked-atlas contract pinned: shifted frame-0 rect === tilemapTileUvRect of the frame-major concat. Out-of-range values reject (the lane's tilesetColumns precedent), loop-only playback; fps-without-frames is legal and inert.
• New deleteState spec mutation kind ({ kind: "deleteState", id, paths: string[][] }, pre-split segment paths) with a shared delete law (deleteStateAtPaths in state-merge.ts) folding identically in the kernel spec fold and kiln's transcription-pinned durable route. New ObjectAPI verbs api.deleteState(path | paths) / api.deleteObjectState(id, path | paths) — dotted paths address nested keys; cross-writer deletes ride the existing client-auth unset intents (top-level and nested, no new intent kinds). The recorder now records patchState's top-level undefined deletes as this mutation kind, closing the resurrection bug (pc-b8ee37bd): deleted keys used to be stripped at record time (JSON cannot spell undefined) and reappeared on every reboot.
• New setProperties spec mutation kind: batchSetObjectProperties and setPositions now record + spec-mirror their component writes (ONE mutation per object per batch, consecutive same-object mutations coalesced at record time) instead of being silently session-only and stripped by the next spec re-apply touching those defs (pc-aa7c14d3 rider).
• Pointer-ray camera-derived axes bind the canonical presented camera explicitly (#9742): syncCameraDerivedAxes took the first DrawCamera in ECS iteration order (lexicographic by entity id), so any foreign camera entity sorting before camera/main hijacked pointerOrigin*/pointerDir* wholesale — every getInputRay-per-tick follower (cursor rings, placement ghosts, aim markers) froze at a fixed world position while the player moved. Selection is now explicit: the canonical presented camera first, id-sorted iteration only as fallback. Pinned by a deterministic pointer-follow-ring regression harness (WASD-style camera motion + stationary cursor + entity churn + foreign cameras on both sides of the sort order) plus presentation-contract pins: interpolation-disabled entities never receive a synthetic pose override, and interpolated per-tick movers present within the bounded playout delay.
• Quota-parked sprite cooks tell Savi the budget truth (#9716, dig d1bb62ac): an art-budget park now sends an art-budget-parked DM mirroring the audio-quota-parked shape instead of parking silently. The audio park DM's resume line tells each cap lane's truth (#9709): the reset time is the server-named budget window end (unclamped Retry-After carried as rateLimitResetAtMs), not the clamped 1h re-probe hold — both lanes share one honest "resume loading automatically around HH:MM UTC" shape, killing the daily-cap self-contradiction where Savi promised voices back "for the next hour" over a ~6h park.
• Skill teaches: sprite-variant economy — generate variants on demand instead of speculative pre-generation batches (#9722); NPC nameplates anchor by attachment instead of bounds-measuring (#9708, the EverSpark specimen).
• Spec-by-delta replication (#9712, ledger 1509): the game spec replicates as {revision, ops, hash} on the wire — never the full document per revision.
• RoomDO alarm-rail hydrate-failure ladder + failure-line self-identification (#9710, ledger 1488): frozen rooms converge onto fixed code instead of waking into the same failure forever, with rung guards from review — the cold-reset rung REFUSES while undrained ledger folds exist (never destroys the one non-re-derivable thing in DO storage; loud alarm_ladder_reset_refused receipt, rail re-arms and the next wake retries the drain), and the repoint rung refuses non-module repoints.
• ws close-code instrumentation (#9711, rows 1433/1463/1509 — instrument-only, zero close-behavior change): one structured room-do.ws_close row per server-side close ({code, reason, initiator, openForMs, sendFailures, connections}); every client socket-death path reports close info through the worker console relay into kiln's recent-errors ring, so debug-dump connection timelines carry the code per close; the client silence-watchdog kill closes with a distinct app code (4435) + reason instead of an anonymous bare close.
• verify-fx-gpu-coupling pins the pending-texture skip-draw law at pixel level on a real device (#9325, ledger 1376): a declared-but-unresident/failed texture renders NOTHING, never an untextured solid — previously pinned only against stub devices, now against the actual sprite WGSL in both CPU-snapshot direct draws and GPU arena indirect draws.
• Terrain anti-tiling never fired since the #7602 lume cutover (#9338): the [2,4] anti-tiling strength band expected repeats-per-chunk magnitudes but was fed repeats-per-METER, so terrain never crossed the threshold. Strength now reads an explicit per-meter band — TERRAIN_STOCHASTIC_REPEATS_PER_METER [0.125, 0.25]: full strength at texture period ≤4m, authored look preserved ≥8m — deliberately NOT keyed on pool.chunkWorldSize (production heightmap chunks are 80m; a streaming knob must not restyle worlds). The jitter lattice hashes worldPos.xz × uvScale so it is world-continuous (terrain UVs are chunk-LOCAL meters — a layerUv lattice would re-anchor at every chunk border); taps stay layerUv+offset so strength-0 is bit-exact. Scope: top-projected surfaces only (biplanar cliff sides stay plain). New verify-terrain-jitter L4 device gate: strength-0 seed identity (byte-identical), jitter-fires (dead-ramp tooth), and two-chunk border continuity against a seamless reference.
• Texture-script param number coercion is gated on exact round-trip (#9733, pc-63fe8aaa): parseTextureScriptParams coerced any finite-Number()-able string, so a long digits-only payload (e.g. a 256-char encoded pixel string) garbled to a float like 7.777e+256 before the script ever saw it — creators worked around it by prefixing payloads with a letter. Coercion now applies iff String(Number(raw)) === raw.trim() (finiteness guard kept): "4"→4, "0.5"→0.5, "-3"→-3 unchanged; long digit payloads, "007", "1e5", "0x1f" stay strings. drawn-art.md's ctx.params line states the round-trip law.
• Honest maxDistance — reach semantics for knobless spatial audio (#9378, jacob's 2026-07-15 ambient-SFX report, dig 4b487916): the WebAudio inverse distance model never consults maxDistance, so the one attenuation knob Savi actually writes on ambient components was a no-op. Emitters that author maxDistance WITHOUT refDistance/rolloffFactor now derive attenuation: "reach" — prep folds a normalized clamped-inverse curve (1/d near field, exactly 0 at maxDistance) into the voice gain, sends the panner rolloffFactor: 0, and culls the voice at maxDistance. Authoring either raw knob opts the emitter into untouched WebAudio inverse-distance semantics, exactly as before. The mode is decided at the deriver (the last place the author's optionality is visible), carried as attenuation on AudioEmitterValue.
• playSound/playSoundAt gain a maxDistance option riding the same reach semantics; audio.md's worked ambient example now teaches the complete honest shape.
• One ray, one author (ledger 1518): the renderer's canonical pointer ray (seqlocked SAB, published every render frame) is now the sole producer of the pointerOrigin*/pointerDir* input axes whenever it exists. syncCameraDerivedAxes reads it at the top of every client step — before input.sampleForTick, so every sampled frame carries it — and its sim-side re-derivation survives only as the no-renderer fallback (headless runtimes and tests register no reader). Before, the derivation paired the CURRENT event's NDC with the PREVIOUS render frame's camera pose (rendererTransform SAB feedback) and overwrote the renderer's ray before each sample, so the fresher self-consistent ray never reached a script: api.getInputRay picks made while running landed 1.5–2.5m opposite the movement direction (hunt 752d941e frame receipts, Lava Sculptor app d51a2105). Completes #9742, which bound the canonical CAMERA; this binds the canonical RAY. The old pointer-ray-axes netIngest system — whose post-sample writes were re-authored at the next step's top before any frame could carry them (dead writes) — is deleted; god-mode picking already reads the ray straight from the SAB (god-mode/systems/hover.ts).
• Evict-proof button edges (ledger 1519): the raw-event ring writers (SAB + same-thread fallback) coalesce MOUSE_MOVE under pressure — past half capacity, moves merge into one pending accumulator instead of consuming slots, flushing as a single slot once the reader catches up or a non-move event needs ordering. Deltas are additive for the one consumer (input-resolution's per-tick mouseDx/mouseDy), so merged-vs-individual is consumer-identical below and above the threshold — but position spam can no longer wrap the ring and evict button/key EDGES. Before, ~4-events/s DOWN/UP edges shared 512 slots with per-pointermove traffic (which flows exactly while a button is held or the pointer is locked), and the overwrite-oldest overflow could silently drop a MOUSE_BUTTON_UP: mouseButtonsDown stuck held, hold actions kept firing, keyup pulses never arrived (the bloom growing ~1s past LMB release, felt on prod 5.2.3 too). The SAB writer's flush saturates the accumulated delta at the Int32 encode bound (±2³¹/scale ≈ ±214,748px) — a wrap-scale window is stall artifact, not motion — and a merged tail whose motion stops mid-congestion flushes on the next append of any type: late, never lost (pre-coalescing it was evicted permanently). Known residuals, named honestly: gamepad-axis spam (changed-axes × poll rate, needs a >1.4s live-worker stall with an active stick) and wheel-momentum spam (~120/s, needs a ~4s stall) are theoretically flood-capable producers of the same class and are left alone — the receipted producer is MOUSE_MOVE, and the same coalesce shape extends to either if it ever shows up in the field.
• Tests: red-first pins at the transport layer (DOWN/UP survive an 8× ring-size flood in both writer classes, order preserved, delta conservation, healthy path unchanged, wrap-scale accumulator flushes saturated and sign-correct), end-to-end through input-resolution (a hold action releases and its keyup pulse fires when the release rides a flooded ring), canonical-ray authorship (renderer ray wins over the derivation; never-written channel falls back), and the publish-order pin (each tick's sampled frame carries the ray published before the step). The #9742 pointer-ring-freeze regression suite and camera-derived-axes suite stay green on the fallback path.
• Multiplayer spec resync is answered with ONE full tome.spec.push to exactly the asking connection — never a projection reset (the 5.2.4 farm-dusk whole-room lighting flicker, thread 1784418124, discriminator 4cb67aa5): spec-by-delta's recovery rail (spec-resync.ts) answered multiplayer gap / hash-mismatch / no-baseline requests by flagging the connection NeedsReset, so recovering a single component value rebased the client's entire world — sweepProjectionForReset despawned+respawned every projected entity, the renderer's lights map emptied (~170 ms fallback-rig flicker across the whole room), and the reset unhosted the place host → re-election → a second reset (the exactly-two-flickers cascade). The singleplayer answer — a targeted full push — was equally correct for multiplayer all along: adoptMultiplayerWorkerFullSpecPush already names resync responses as a replace-class anchor (monotonic revision gate), and a queued full push survives the reattach outbox prune by design. The mode split is deleted; every resync now emits the same targeted full push. This removes the spec-traffic→reset coupling entirely — the reset lane keeps its real callers (reattach, transport drops, wedged senders, place changes) untouched, and spec-delta-journal's "an under-describing revision degrades to full-push behavior" claim is now true in multiplayer too (it used to degrade to a full projection reset).
• Tests: e2e regression pin (client-auth-spec-resync-e2e.test.ts, adapted from the discriminator's ARM A drive — red on parent behavior): every spec-push delivery class (clean deltas, full pushes, hash-mismatch, revision gap) against a multiplayer client holding 5 authored DrawLight rows — rejection classes must recover the spec head with zero projection resets, zero DrawLight despawns, no light-count dips, and no place-host re-election; plus a reconnect-class NeedsReset phase pinning that the reset lane itself still delivers (snapshot rebuilds the projection, spec head preserved). Unit pin flipped in spec-resync.test.ts: multiplayer now expects the emitted full push and an untouched projectionState. The client-auth e2e harness gains production spec-push wiring (applyWorkerSpecPush on control ingest + registerSpecResyncCommand, registered exactly as room-runtime does).
• api.raycast hits sprite quads by default (jacob's default-on ruling, 2026-07-18): the visible thing is the hittable thing, no physics body required. billboard: "none" sprites test their authored world-space quad (feetPosition + WorldRotation via the pack's exact instance-quaternion swizzle + sprite.size × WorldScale × GeometryScale at the anchor, neutral atlas registration); billboarded sprites ("yaw"/"full") orient toward the RAY ORIGIN — a billboard faces every viewer, the ray's origin included, so the hit quad is a pure function of ray + replicated sprite state (observer-independent, deterministic on any simulator, and you can never hit one edge-on because you can never see one edge-on). 2D places use the renderer's fixed base poses (quad-orientation.ts). Hits carry objectId/position/normal/distance like any hit; the normal is the quad face sign-flipped toward the ray; outputs are f32-quantized. Opt out per call with { includeSprites: false } (byte-identical colliders-only path, pinned). Out of reach by design: camera-attached / parallax / repeatX sprites (camera-frame poses), near-invisible sprites (the shared opacity × tint-alpha render threshold), text/sign quads (DrawText, never DrawSprite), and shape sweeps. No per-texel alpha test — the authored quad is the hit surface.
• One quad math, shared: the core ray-vs-oriented-quad test was extracted from the lume render-picking module (engine/lume/sprites/raycast.ts intersectSpriteQuad) and is now the single implementation under both the render picking path and the sim lane (tome/api/sprite-raycast.ts) — the two cannot diverge. Sharing exposed a latent sign flip in the mirror's billboard basis (right = −(worldUp×forward), opposite the vertex shader): invisible for centered quads but it mirrored the anchor origin offset, so default-anchor billboards ([0.5, 0] → oy = sy/2) picked BELOW their feet. Fixed to the shader's exact basis and pinned. Math.hypot was also replaced with correctly-rounded Math.sqrt chains (hypot rounding is implementation-defined across JS engines — now the math is realm-deterministic by IEEE-754).
• Candidate pruning: the per-place spatial octree gains a padded ray-segment walk (SpatialOctree.queryRayInto — slab node prune + exact point-to-segment leaf test), padded by a world-level running max of hittable sprite quad radii (component hooks on DrawSprite/WorldScale/GeometryScale, mounted with the spatial-index hooks; never shrinks, so staleness only widens the walk). No O(all-sprites) scan per cast; per-candidate cost is the shared ~20-flop quad test behind a bounding-sphere reject.
• Tests: realm-determinism pin (server and client worlds derive the byte-identical hit), ray-facing billboard semantics (two origins → two orientations, each facing its viewer), authored billboard:"none" orientation, opt-out byte-equality, text-defs-never-hit, octree pruning, miss cases, big-quad radius tracking, and the shader-parity billboard-basis sign pin.
• Completed terrain builds now pass a currency check before installing (the voxel stale-install flicker — tiger's 5.2.4 walk finding, pre-existing since voxel-10x #6622): a full chunk rebuild carries a SUBMIT-TIME edit snapshot; when the chunk's inputs changed while the job was in flight (routine where automata block ticks interleave replicated edit echoes into chunks a player is building in — the /zoo ponds), Phase 1a/1b installed the stale output anyway, overwriting the voxel edit fast lane's same-tick remesh. On screen: the player's edit showed for 1–2 frames, a pre-edit mesh replaced it for a full job round trip (~23 frames ≈ 380 ms on the recording), then the convergence rebuild put it back — edit-direction-agnostic (place AND clear). Both build systems now compare a completed output's inputsHash against the chunk's CURRENT inputs at install time: unmarked chunks are current by construction (terrain-dirty marks are the exhaustive input-event source and park while a build is pending) and install with zero extra hash work; marked chunks re-evaluate (memoized under the mark stamp, so Phase 2 never pays twice); a stale output is discarded and the surviving mark resubmits with current inputs the same tick. Marked-but-hash-matching outputs still install — neighbour halo marks are routinely spurious under automata churn, and discarding on the mark alone would starve installs. No budgets, queues, or debounces: a correctness check, not a throttle.
• Client twin guards the rendered mesh + local collider (client-terrain-system.ts Phase 1a/1b); server twin guards the authoritative collider (server-terrain-system.ts consumeCompletedServerJobs — a discarded build records a superseded build state, no failure warn/backoff). Place-level dirty flags now expand into per-chunk marks before completed jobs are consumed on both sides, so definition installs and place-mode flips are visible to the check like any per-chunk event.
• Tests: deterministic A→B→A pin (full build in flight + mid-flight local edit → the stale completion must not overwrite the fast lane's newer output; red on parent), automata-echo discard + same-tick resubmit + convergence (client and server twins), and the spurious-halo-mark guard (marked-but-current completions still install; no churn loop).
• Sprite metadata hydration respects client-authored sprite fields on avatars (ledger 1517): avatars (TomeBehaviorRef.specId: "player") now classify sprite authoredness by VALUE — the same lane as spec-less entities — instead of by the shared spec.player def. Avatar runtime writes are session-local by design (a player's skin never folds into the shared player def via the persist mirror), so def-derived authoredness was structurally blind to the owning client's writes: a brain wearing a hero at an explicit gameplay-constant size (the zoo's [1.1, 1.1]) got re-stamped to the mint's world_height guess ([1.7, 1.7]) by the upgrade pass (tiger's avatar small→big mid-walk, 2026-07-18). Value classification is the honest signal: hydration is the only writer of hydrated values, so any other value proves an author. Unsized avatar sprites (iso skins) still hydrate; spec-object sprites keep def-derived authoredness unchanged. authoredSpriteFieldsForDef returns undefined for "player"; the unconditional player-def indexing is gone.
• Sizing/grounding authorship is per canonical art identity (buildSpriteValue, derive-appearance.ts): the writer's implicit whole-object merge no longer carries size/pixelsPerUnit/anchor across a canonical-identity change (facing/animated variants share identity and keep the carry; dotted writes restate fields explicitly and are unaffected). Without this, the engine's unconditional carry manufactured authorship the writer never expressed, and the value lane latched stale sizes across skin swaps: the zoo's farm→isoTown jump would have pinned the deliberately-unsized iso skin at the farm's [1.1, 1.1], and an unsized spec.player template iteration (the interpreter's player-diff whole-object write) would have latched each avatar's previous size. Both pinned red-first. Remaining residual, named honestly: a write that explicitly restates a stale value onto a new identity classifies as authored — which is what a restatement is.
• Same disease family as the farm-dusk light flicker (spec-object light entities lack ClientEntity protection): engine-side re-derivation machinery writing over live client-owned runtime state. This change fixes only the sprite-hydration instance.

technical notes

• God mode no longer enforces a phantom terrain floor at y=0 in terrain-off games (ledger #1329, dump dd9ad1f0). The god-mode behavior duplicated the spec-side terrain predicate (spec.places[placeId]?.terrain !== undefined) which counted terrain: { kind: "off" } as terrain-on, while the interpreter removes the world terrain definition for kind:"off" — so getTerrainHeight returned 0 and the per-tick clamp snapped god-entity feet to y=0 forever (entry teleported the creator up; fly-mode descend netted zero every tick via same-tick snap-back; ascend still worked because the clamp only pushes up). The duplicate predicate is deleted: the behavior now derives terrain-liveness from the world's installed definitions via hasTerrain(world, placeId) (engine/features/terrain/alignment.ts), the same predicate every terrain system uses. Terrain-off (and failed-generator) places now take the designed no-terrain branch: parked hover in walk mode, free flight below y=0. Real-terrain places keep the clamp exactly as before. Pinned in no-terrain-floor.test.ts (entry below y=0, fly-descend across y=0, walk-mode park, real-terrain clamp control).
• Presentation motion-juice restore is convergent instead of one-shot (ledger #1316, dig bda7b9f7). The squash/shake deformation channel (draw/motion-juice) refreshed per client frame while live but relied on exactly one component-REMOVE-triggered restore frame — and that REMOVE rides a droppable render-channel hop (frame decode failure, lost string refs, stream-reset snapshots that re-encode only still-live components). On degraded clients (quality ladder 5/5, halfRate, frame-budget fallback, tab supersession) a lost REMOVE left the composer's MotionJuiceState stale forever, recomposing the crushed pose over every later authoritative scale write — invisible to script-side scale guards because authoritative WorldScale was never wrong (presentation-only by design, ledger #951, unchanged). The composer now holds each deformation under a liveness lease (MOTION_JUICE_LEASE_MS, 1s of display time, renewed by every ingest): when the refresh stream goes silent without an ending frame, the deformation expires and the drawn pose converges to identity through the existing restore paths. Zero cost for entities without live deformation. Pinned in synthetic-transform-motion-juice.test.ts (lost-REMOVE squash/shake/hierarchy-child convergence + refresh-keeps-alive).
• Shading-only terrain-materials fast path (#9171, ledger 1324): a materials delta that changes only shading fields (tint/color, texture refs, tile/textureScale, metalness, normal/roughness params) now swaps the material pack into the installed terrain definition in place instead of flipping the definition revision — the revision derives from a STRUCTURAL signature (material ids/order + generator source/deps + marks + seed + rooms — everything chunk builds and colliders actually consume), so a tint-class patchTerrain pays no whole-place reinstall, no dirty marks, no collider-readiness churn, no spec re-expansion or anchor/scatter refresh. The renderer re-reads the swapped pack through the existing per-place TerrainPlaceRenderConfig channel (content-hash deduped). Measured on the ledger-1323 driver's tint-tick phase: 220.06ms mean / 256.75ms max per call (20/20 ticks spiked) → 18.58ms mean / 26.53ms max, zero spikes. Structural changes and validation failures fall through to the full reinstall byte-identically.
• Aesthetic-band renderResolution ceilings render raw pixels again (#9158, ledger 1322 — enfeul's First Light). Since 5.2.0 made TAAU the sole 3D production AA mode, games with an authored engine.graphics.renderResolution ceiling (the PS1/N64 look) went soft — Halton jitter + temporal history erase exactly the aliased stairs the look is made of. An authored ceiling with short axis ≤ 480 now declares raw-pixels intent: those 3D frames run the msaa topology (no jitter, no history, direct composite — the same production lane 2D scenes run), and the governor's renderScale rungs become inapplicable there, so nothing ever renders below the authored ceiling. Above-band ceilings (540/720/900/1080 — the perf-cap population) stay perf caps on TAAU; the authored↔unauthored edge invalidates TAAU history like the 2D↔3D cut. No new spec surface.
• Savi's Blender-5 game-asset system (#9187): the blender-game-assets skill (hidden, runtime: chat) teaches natives-first professional 3D asset work — Blender 5.0 geometry-nodes scatter modifiers and SDF grid damage, 5.1 dilate/erode — over a vetted addon short-stack (BagaPie, Cell Fracture, Modular Tree, Mio3 UV, UniV) in the bpy dialect (append node groups, enable addons in-script), with game-ready export truths and a render-verify loop. Workshop upload lines become exact-URL read grants, so Savi can view her own rendered proofs the moment their URL prints. The savi-workshop image bumps Blender 4.2.22 → 5.1.2 alongside (companion-side), with an idempotent provisioning script for the vetted stack.
• Scripted liquid shaders on terrain marks (#8749, plan p-520aae28): LiquidSpec.material?: ScriptedMaterialSpec — a river/pond/ocean mark's liquid can reference a Savi-authored scripted material, the exact { kind: "scripted", script, params } shape objects use. kind stays the substance (physics/audio/particles); material is look-only and replaces the whole liquid visual while the declarative knobs style the fallback. Attach/detach/param edits rebuild surfaces (the interpreter's liquid signature carries script + params), scripted refs on marks (top-level + every place) reach the renderer's material library, a parked/unclaimed scripted Water/Surface bespoke routes onto the water preset look (never the grey vertex-PBR lanes), scripted claims pass params only and keep castShadow false, and patchTerrain refuses a liquid.material.script that doesn't resolve.
• scripts/ texture refs resolve as game-UI image sources (#9154): ui.js HTML now accepts texture-script refs in img src and style url() — the dom-host substitutes the baked blob URL (transparent placeholder until the bake lands, never a broken glyph), bakes ride a renderer-host RPC on the existing bake transport (same compile cache, budget rails, and park diagnostics as world bakes), and setTextureScriptLibrary's changed/retired delta re-bakes changed families live and revokes stale blob URLs. The drawn-art skill's HUD ban drops — the taught exception this deletes.
• Game output ducks while the voice recorder holds the mic (#9152): speaker output ducks to 15% over a 50ms ramp while kiln's recorder is live, restoring over 200ms on release — game audio bled into the mic and poisoned voice-message transcription.
• Per-cascade sun-shadow GPU culling (#9163, slices 1+2 of the moving-frame shadow plan): shadow select joins the lume GPU cull as a fourth variant classifying by occupancy + 6-plane cascade box only (no maxDistance, no LOD pKeep, no ring — the contract is "current set minus outside-the-box"), with per-cascade cull cameras, args ranges, and survivor buffers sharing group data with the main view, dispatched only for scheduled cascades whose view is dirty. Receipts (Apple M-series): cool-basis sun-cascade GPU −45% on the moving-frame bench, net −8.7% GPU on the valley pack at realistic load (dpr-3), GPU power −13% / energy −11%. Ships with the bench-shadow-moving rail: an always-orbiting UGC-shaped caster fixture and occurrence-correct per-pass windows (amortized cost over all frames, not just when-present means).
• Internal/observability: the 5.2.0→5.2.2 tick-budget attribution dossier + full-stack A/B tick profiler (#9184, dig 47285eae); server_behind episode payloads carry room load counts + egress stage means (#9174, ledger 1326); netcode-egress bench TomeWorldReplicated registry fix + specimen-1326 config (#9173); perf-capture rig mutes audio by default (#9169); engine-version tooling's r2Read downloads via temp file — the prod catalog outgrew execSync's 1MB maxBuffer (#9147, ledger 1318).
• Animated texture scripts play in game-UI imgs (#9222, the #9154 follow-on): an atlas bake that declares fps (ctx.atlas or the meta export — the same declaration a bare sprite plays world-side) now animates in ui.js HTML. The one deterministic bake additionally slices its default clip into per-frame PNG blobs renderer-side (off the page main thread), and the img lane ticks tracked <img> srcs between pre-made blob URLs — nothing re-bakes per frame, and the requestReapply pipeline stays first-arrival/invalidation only. Rails: declared fps clamps to 10 UI-side; 8 concurrently animated refs (overflow holds frame 0 + one loud fault on the ui-fault rail); 64 frames per clip (over-cap serves the still sheet + one renderer diagnostic, re-keyed on clip length so an edit re-reports). Ticking starts on fragment substitution, stops on the first tick with no live element, dies with dispose; zero timers for games with no animated refs.
• Costume-keyed diagnostic emitters re-keyed to their CONDITION (#9228, the Shimmerwilds storm — 132 emissions in 90 min from one boneless model): model-not-animatable and the model-clip warns key on the MODEL (model-not-animatable:${modelId}, ref-only-key doctrine), entity id demoted to the data payload, so a population spawner minting fresh entity ids no longer turns one broken asset into an unbounded error-DM storm — the existing key#contentSignature dedupe collapses it to ≤1 admitted log entry per broken model per window and one hidden Savi turn. Transient sprite-atlas warns re-keyed per BASE in the same pass.
• Authored-clip bind problems re-keyed per MODEL (#9237, same class): reportAuthoredClipProblems' three bind codes keyed (and worded) per entity; now keyed on state.modelId with the entity in the payload/console line only. The cap wraps the assembled variable suffix via diagnosticKeyRef at 172 chars so the longest prefix still fits MAX_KEY_LENGTH. Also fixes a stale physicsEngine-default comment.
• New warn when a player-model clear resolves to the profile-avatar fallback (#9242, dig d3f2d32c — the removal that summons the thing): patchPlayer({properties:{model:null}}) is exactly ledger 936's fallback trigger, so Savi's removal verb re-summoned an avatar while her verification read honest nulls. warnPlayerAvatarFallbackRedress fires at the write transition only (setObjectProperty seam + patchPlayer/applySpec diff seam, gated on prev-template-had-body → next-template-bare — never ambient spawn-time, where account avatars are the legitimate normal), keyed per player per the #9228 convention, and the message teaches the cure (animated3DCharacter:false on the player template, plus that already-joined sessions keep the old body).
• removed-api-tombstones grows 5 entries feeding the new chat-side draft-gate lint (#9200): tombstoned/phantom api calls are blocked at Savi's write time with the teaching error, before a broken script ever reaches the engine.
• Savi's file tool surface renamed from the command-enum str_replace_editor to Claude Code-shaped Read/Write/Edit/Delete tools. Engine-side teaching text follows: skill sources (drawn-art, creator-ui, custom-materials, 3d-sprites, 2d-mode, workshop) and the runtime diagnostics that steer toward file creation (scripted material/texture/look script-not-found errors, the ObjectAPI memory side-door rejection) now name the Write/Edit tools. Rooms pinned to older engine versions keep the old steering text until this version reaches them; the live tool registry itself ships with the chat deploy, and a stale steer degrades to a recoverable unknown-tool error.
• Material slots (#9213, plan p-04342ee6): model.materials — the object form paints PARTS of a model. Entries are keyed by the GLB's own material names (model: { id: "cdn/car.glb", materials: { BrakeLights: { emissive: "oklch(0.65 0.25 25)", emissiveIntensity: 4 } } }), mount Magic-CDN textures and packed PBR pairs onto named slots (materials: { marble: { texture: "cdn/texture-marble-white-veined.png", pbr: true } }), and are live-writable via setProperty("model.materials.marble.texture", …). Works on static and rigged (skinned) models; sharing is batch identity; swap-in follows the existing placeholder-then-swap law; a name that matches no material in the GLB reports instead of failing silently. Re-writing model without materials clears them. Savi's write-time PBR prewarm derives the packed pair for every material entry whose cdn raster texture and pbr flag share one object, so slot-mounted PBR doesn't cook on first client fetch.
• Mod remove refuses while surviving scripts still require() the mod's files (#9261, badgerblunts/the-workshop 07-14): an uninstall deleted the mod's lib files in one write while ui.js + 3 other scripts still carried top-level require()s — ~3 minutes of [Tome] Module not compiled render failures until the dangling refs were cleaned by hand. remove now scans every surviving script's require()s (the adopt path's resolveRequireTarget, mirroring the kernel's caller-scoped resolution) against exactly the script keys the uninstall will delete; any ref that stops resolving refuses by default listing each dependent with its exact require, force: true removes anyway and reports the same list as a warning. Matches the family's safe-by-default shape.
• Place-host assignment splits RETENTION from ELECTION (ledger #1327, dig efad3b28). isEligibleConnection — Streaming (or the never-streamed join window), attached, Ready — is the right bar for electing a NEW host (it must be able to take the make-before-break snapshot), but reconcilePlace used the same predicate to decide whether a SITTING host kept its TomePlaceHosts entry. Any transient transport boundary — the make-before-break NeedsReset its own assignment sets, a ws delivery-fail reset hold, a client self-heal reset, a hidden tab — fired the host the same tick, deleting the entry for an OCCUPIED place: every unowned create then rejected at the drain's table-stamp gate ("Tome spawn: place X is not resident"), the displaced host's in-flight writes died at the stale-epoch gate ("previous host epoch skipped"), and re-election at epoch+1 flipped NeedsReset again and cut another full-place snapshot into the same congested socket (a self-sustaining flap: 3 elections in 7s, then 10+ minutes unhosted, on live DD receipts). A sitting host now retains its entry — same clientId, same epoch — while its connection is Ready and attached, its PlaceMembership still names the place, it is not suspension-stamped past the takeover grace, it is not silent on both upload cadences past the existing health window, and it has not been off Streaming past the retention ceiling (HOST_NOT_STREAMING_RETENTION_CEILING_TICKS, 600 ticks ≈ 20s at the 30Hz default — the in-system bound for the heartbeats-pass/resets-fail backpressure wedge that input-frame health cannot see) (isRetainedSittingHost; no new timers, tick arithmetic only). Genuine session boundaries — detach, suspension-stamp, place-leave, disconnect, opt-out, sustained silence — revoke exactly as before, and election is unchanged (including ledger #1237's hostEligible: false gate).
• All 34 builtin/primitives helpers return the spawned entity id (api.spawn's resolved return — parent/mod/place-qualified where applicable), enabling const roofId = p.box(...) capture for hide-lists, door registries, and destroy/patch calls. Previously the internal _spawn discarded the id. Skill teaching updated in the same change (the mangled-ids workaround is gone from the corpus).
• platformer-movement skill teaches moving-platform carry as position-snap, never velocity-borrow (#9227, ledger 1341): riders inherit the platform's per-tick displacement by snapping with it, instead of borrowing platform velocity (which overshoots on direction changes and strands riders at endpoints).
• Walk-independent iso-town teaching corrections from the eval (#9204): interactive-objects, structures, and 4 sibling skills correct the mis-teaches the iso-town eval surfaced.
• New savi-craft skill (#9243, plan p-7074adc5): the creator-facing structural-rebuild pass behind the /skill command — find what's grown tangled through many small patches, map every behavior it carries, rebuild the minimal clean shape; honest no when the build is already sturdy. Includes the ambient-offer discipline (when to offer the rebuild unasked).
• game-ui skill drops the desktop-only framing for Savi surfaces (#9220 — mobile is part of whole).
• Spawn-then-act ordering contract: commands referencing a not-yet-known entity park server-side for a 3s create grace (a sim-tick window, stamped at first park and carried through re-parks — one window per command) and re-adjudicate through the full live authorization gate the tick the create lands, exactly as a network-delayed command would (generalizes the rail.destroy-only 1s park to entity-referencing commands; RAIL_DESTROY_GRACE_SECONDS deleted). Parks are bounded per client AND per room in count and bytes (oldest evicted loud at a room ceiling). The client's synthetic-create flush now walks TomeSpawnedBy ancestors, so same-tick spawn chains ship in program order. Commands referencing recently destroyed entities are dropped quietly via the despawn ledger instead of surfacing error DMs (client-uploaded despawns; entities destroyed by server-side commands still report with honest text until the ledger covers them — named follow-up); self-destroys whose create never arrived expire silently (the world already converged).
• Batch-ineligible primitive materials (unknown/legacy material keys like "Scripted" without a script ref, wireframe, alphaTest, non-front side, unknown override keys, depthWrite:false while opaque) now draw a degraded Std/PBR fallback recipe instead of resolving a null representation — the 5.2.0 lume port skipped these classes to invisible (the three-era standalone mesh path drew them, deleted in #7602; #8830 fixed the pbr:true subclass, this covers the residue). The degraded resolve strips exactly the rejected bits and keeps every mappable param (color/map/tint/PBR scalars/transparency); flash appearance writes resolve through the same fallback.
• The primitives-material-unsupported diagnostic now names the offending entity id and material key (or the exact offending override keys) in the message that reaches Savi's DM — the previous static generic text was unactionable (dig 9a59bc78: Savi answered "." to it or misattributed the invisibility to stale room state).
• Rebuilt terrain decorations around compact 24-byte candidate records and 4-byte survivor refs, bytes-first adapter-limit admission, shared packed frustum culling, and live allocation-free quality uniforms. The measured desktop baseline requests 1.25× authored density across 1.75× distance; 3M candidates or the adapter's lower byte limit is a hard safety ceiling, while the default meadow builds about 1.07M. Tablet and phone remain unchanged.
• Replaced hard near/mid/far population swaps with deterministic cumulative density strata and guarded root-collapse bands. Terrain tiles and newly ready sprite assets reveal through bounded birth ramps, wind/root transitions write real motion vectors, and stationary scenes return to zero decoration placement/cull work.
• Decoration placement now honors authored slope/height ranges and terrain clear-scatter exclusions in addition to material, paint, noise, cluster, and water gates. Slopes use Spawn's normalized 0-flat to 1-vertical scale, with compatibility conversion for legacy degree values. Sprite decorations also accept normalized uvRect and anchor controls shared semantically with entity sprites.
• Ground-cover is full through 175m on the measured desktop baseline and collapses to zero by 245m through a root transition. Cards grow modestly near the field rim to cover the remaining bare band without floating or scaling distant props.
• Pixel-inferred 3D sprites such as Pixel Kart's trees again use depth-writing cutouts by default, eliminating camera-sensitive whole-batch ordering flips while explicit soft and linear sprites remain blended.
• The SFX bus now routes through a DynamicsCompressor safety limiter into the master bus (ledger #1386) — the clip-voice mirror of the vibe sampler's safetyLimiter, same settings family (threshold −3dB, ratio 3:1, knee 8dB, attack 5ms, release 120ms). Script gains stay unclamped; stacked looping voices with gains >1 that previously summed past full scale and hard-clipped the destination (crackle/popping) now degrade gracefully through the limiter. Transparent on normal content: single voices at gain ≤1 sit below the −3dB threshold on the bus (and −9dB more headroom follows at the default master gain), so the limiter idles.
• Clip-voice set-command updates (gain, pitch, reverb send) now land as an anchor plus 20ms linear ramp (CLIP_PARAM_RAMP_SEC) instead of instantaneous setValueAtTime steps — the same shape the vibe lane already used. Scripts that ease these params every tick no longer produce a waveform discontinuity per tick (zipper noise).
• Also aboard from the jul-15 freight (merged without changesets): AOI rides the octree — per-tick O(world) egress scans are gone (#9210); lume slash-lane instance stride fix — CPU packed 256 B against the WGSL struct's 240 B (ledger 1306, #9292); the external-URL audio load-failure verdict tells the truth — no allowlist exists, live streams are a category error (#9298); cold-load 429s take a boot-window short-retry lane instead of the 5-minute tombstone park (ledger 1379, #9329); storage teach carries the user/<id>/ placement constraint in the server-context steer (ledger 1381, #9333); audio skill re-cut hook + AudioSpec breadcrumb so diegetic music asks route pre-load (#9339); wisp blender charters mechanically load blender-game-assets (#9330); spawn-then-act follow-up — #9251 review nits: name-based dispatch lookup, overflow-warn throttle, refs hygiene pin (#9343).

KNOWN OPEN (5.2.3 staging draft — minted 2026-07-14, sha last folded 2026-07-15 ~20:48Z with the jul-15 freight aboard; named honestly for the walk and the release packet; the draft:false flip is the train's separate human-gated step):

• Ledger 1333 tick-budget hold — RESOLVED FALSE-READ, PROMOTE GATE LIFTED (2026-07-15): tucker's local bisect and a staging A/B canary agree — no regression rides this sha (the 3× read was an evolved-world comparison, "a poisoned test"); ledger 1333 closed as false-read, the #9026 suspect cleared. 5.2.3 promoted to prod 2026-07-15 (run 29464253946, green).
• FrameBudgetGuard now treats hidden-tab time as non-evidence, in both hidden regimes. Throttled-flow (samples keep arriving ~1Hz): FrameBudgetSample.documentHidden (fed from the renderer worker's visibility state) takes the same early-return as the grace windows — flush the judged window, reset the fallback timers, drop the chronic span anchor. Fully-parked (no compositor begin-frames, zero samples): the visibility handler's hidden branch calls frameBudgetGuard.notePause() beside the governor's and hitch detector's, so a fallback timer armed by a pre-hide struggle can't bridge the gap and park instantly on the first post-return sample. A backgrounded tab's inflated presentedIntervalMs read as the idle-CPU GPU-bound shape (#199), so a few hidden minutes fired false frame-budget-warning chronic DMs to Savi and false fallback parks of scripted materials. The quality governor and hitch detector already kept this law; the guard was the one visibility-blind judge on the frame rail.
• The visible edge of the visibility handler reseeds the renderer stats sampler (statsSampler.reset(), the same parked-tab-time law renderFrame's >2.5s loop-pause reseed keeps), so a short hidden gap or a throttled-flow tab's boundary window can never manufacture a gap-sized "presented interval" on return.
• Player identity now resolves through one verified rail (resolvePlayerIdentity: server-populated TomePlayerProfilesResource, else owner-replicated SessionClient) on every surface — api.userId, getPlayers() (ObjectAPI, CameraAPI, and run_script exec), getProfile(), getUsername(). On client-simulated worlds (all behaviors in singleplayer; host-run world behaviors in multiplayer) the session's own player now reads the same real account id everywhere instead of null/"".
• getProfile() no longer coins "" for unknown userIds and no longer parrots script-writable TomeState.userId as identity: PlayerProfile.userId is now optional — real where verified, absent where withheld. Other players' account ids stay off client worlds by design (SessionClient owner-only replication is unchanged); jsdoc + generated API reference now state that contract explicitly and route cross-player identity work to server context (lifecycle/cron).
• Place-transition presentation reset (ledger 1387, dig 499c9122): duration-less api.pushLook layers — the one layer class with no scheduled end — are flagged clearOnPlaceTransition and begin their normal fade-out on spec-sync's placeChanged edge (client-side, netIngest, so destination arrival hooks that push layers land after the sweep). Duration'd pushes keep their armed cleanup timer; juice sugar layers stay engine-managed; atmosphere.look untouched.
• enterPlace across places now removes the traveler's (and god mirror's) TomePlayerCameraOverride at the transfer — the session override previously persisted until session end, which parked a mid-ease setCamera({ fov }) on the player in the destination forever. applyPlaceSpawnRotation re-seeds the view direction after the clear; mint-transaction compensation restores the captured override exactly on rollback.
• NaN guard on the renderer camera smoother's FOV chase: a non-finite ingested view.fov no longer poisons renderFov for the rest of the session (exponential filter memory) — the smoother holds the last finite fov, keeps rendering, and reports once through the engine-diagnostic rail (new log-only code camera-fov-nonfinite, visible in getLogs).

technical notes

• The client atmosphere apply is at-least-once, engine-owned (ledger 1297: session-permanent washed white/grey sky when ONE row was swallowed during the fresh-room boot window — deterministic for affected boots, value-independent, healed by any live patchAtmosphere). Every stage of the apply is change-gated (lastHash/lastAtmosphereRef latches, the lastLookRef look-library ensure, plainValueEquals on the skybox row, the ECS structural-shallow equals gate), so a boot-window loss made every later pass read the atmosphere as already-applied. Now, once per render-channel epoch, when world-residency first reads true — the renderer is provably up and quiet — tome/systems/atmosphere-sync.ts resets its apply latches and force-re-emits every live atmosphere row (sun/ambient/hemisphere lights, fog, skybox, cloud/star sprites, transforms, and the LookScripts library) via markComponentUpdated, the engine's value-identical force-emit — the honest version of the creator-space ~1e-7 fog-density-jitter bandaid, never a value perturbation. The epoch signal rides the existing sim-side renderer seam (tome/world-residency.ts), bumped by the runtime worker on every render-channel attach; steady state pays two module reads and one compare per pass, the re-assert never repeats inside an epoch, and a renderer-worker swap (new channel epoch) re-asserts once more. 2D and 3D ride the same system and channel; no new spec surface.
• Boot-window sky losses are LOUD now: an UPDATE for draw/skybox or draw/fog arriving while the lume store holds no active entity means the session's first apply (the ADD) never landed — the renderer handlers report atmosphere-apply-lost through the existing engine-diagnostic rail (allowlisted, log-only: the arriving row already healed the sky), once per component per renderer session. The code also rides SERVER_CONSOLE_BREADCRUMB_CODES, so the accepted report prints one server-console line per room per deduped condition — the kernel container's stdout is what observability ingests — making the class visible to BOTH getLogs and DD (fleet-level heal counts validate the fix in prod).
• Script-authored animation clips (#7986) now deliver in MULTIPLAYER rooms (ledger 899 — the frozen 5.1.11 zoo swimmer). The mechanism: in client-auth multiplayer the server simulates nothing — a hosted NPC's updateChannel(fn) play executes on the PLACE HOST (a client), and canMintAuthoredClips correctly forbids clients from writing the spec. The host resolved the identity string only; the identity fanned out through its DrawMixer upload while the sampled tracks existed nowhere, so every renderer warned clip "…#swim" not found forever. The played function is typically a closure over the simulator's own rig reads (getBones() names/amplitudes — the taught rig-adaptive pattern), so no other machine can re-derive it from script source; the sampled ENTRY has to travel. Fix, all on existing rails: the simulating client samples locally (its own renderer plays the clip immediately, 0-RTT), stages the entry as a new AuthoredClipOffers component on the playing entity, and the offer rides its normal StateDeltas upload; the server re-validates the untrusted entry from scratch (structure, caps, contentHash recomputed — never trusted) and mints it through the existing pending→fold path (single spec writer intact, mint-velocity guard included); TomeSpec replication fans the entry to every client; the simulator sweeps the offer once the replicated spec carries it at the same hash (ratification ack — offers never linger in snapshots). Malformed offers reject loudly once (runtime-log warn, memoized) and never reach the spec. Singleplayer and server-side plays are untouched (direct mint, no offers). Pinned end-to-end through the production client-auth harness: real host election, real upload validation, real fan-out, real sweep — the delivery assert fails on master. Offers respect the room wire's per-component-value budget at stage time (MAX_STATE_DELTA_VALUE_BYTES, 64KiB — enforced decode-side only, where a breach rejects the simulator's ENTIRE delta message for the tick, delivering nothing and warning nowhere client-side): a legal-by-float-caps clip that would serialize past the budget (a full rig at defaults gets there) is REFUSED with a creator-visible runtime-log warn naming the clip, the size, the limit, and the cure (shorter duration / lower fps / fewer tracks); the refusal is memoized per content so a re-resolving channel never re-offers or re-warns per tick, and the simulator's own renderer keeps its local play. Known residual gaps, stated honestly: raw-tracks plays ({ name, tracks }) from a client simulator deliver through the same offers path, but the offer path as a whole only runs where a play call executes — places nobody hosts stay paused (unchanged semantics). And the offer IDENTITY is unbound to the offering simulator in client-auth: a modified client that simulates any entity can overwrite an existing scriptRef#fn entry with valid-shaped junk of its own, or squat identities toward the 48-clip cap — bounded by the per-value wire budget × the clip cap and by full server-side re-validation, and a legit re-sample is indistinguishable from a hostile overwrite, so client-auth cannot close it airtight; a per-client offer budget and a purge story for squatted entries are fast-follow material.
• api.getWaterLevelAt(x, z, place?) — the world point query for liquid height (#9142, ledger 1315): wraps the engine-internal getLiquidHeightAtPoint over resolved marks (revision-cached per place) plus the voxel liquid sampler (topmost surface in the column), and works from ANY calling context — exec entities included. Fills the instrument gap that produced false "liquid system dead" verdicts: getLiquidLevel takes no arguments (it's entity-bound and only answers for entities the liquid detector tracks via onLiquidEnter/onLiquidExit), so probing open water with getLiquidLevel(x, z) from run_script's untracked exec entity silently swallowed the args and answered null in every game. getLiquidLevel called WITH arguments now records a getLogs-visible warn (throttled per entity) pointing at getWaterLevelAt. Docs ride types.ts JSDoc → api-reference §Terrain/§Movement via the generator; zero always-on prompt tokens.
• Music load-failure honesty (music-apex design D2.1): music.play of a plausible-but-unloadable ref used to be a silent forever-lie — clients failed the load with console-only errors while music.now() reported the dead layer as playing for the rest of the session (loop defaults true; the duration never mirrors). Clients now report a trust-gated load-failed verdict on the existing engine.soundDuration wire (authority-referenced clips only, same per-connection rate budget, first-verdict-wins; fired only on TERMINAL failure — 3 real attempts or an unresolvable ref, never for Magic-CDN still-generating/pre-session parks). On verdict the authority marks the layer failed in replicated state, writes a creator-visible runtime log (music layer "default": no client could load "<ref>". Is the asset loadable?), and every read excludes it (music.now(), the census, client playback); the next verb write prunes it. A fresh music.play of the same clip re-arms the verdict (fresh chance after an asset fix; failing clients re-offer on a 30s per-clip cooldown, so a still-broken clip is re-told). Deliberately verdict-driven, never TTL-driven: a bare timeout would false-kill honest music in empty rooms and during long Magic-CDN generation. A known duration always beats a verdict (the clip provably loaded somewhere) — order-independently: a trusted duration arriving AFTER an accepted verdict clears it, revives the failed layers with an epoch bump (clients rebuild the voice mid-clip), and tells the creator the earlier warn is void.
• Zero-match music.stop is TOLD (design D2.2): stopping when nothing is playing — or naming a layer that isn't live — now writes a mutationWarn teaching line into the runtime log (music.stop: nothing was playing (music.now() => null) — no-op / no live layer "x"), once per (entity, kind) with value-free dedupe keys. The miss path still writes no replicated state.
• The audio census (design D3): api.audio.playing(): AudioCensus — one read, any realm, returning { music, loops, emitters, shifts }. music === music.now(); loops enumerates live playSound(loop:true) voices as { soundId, ref, entityId?, bus } — previously enumerable by NO read anywhere (the returned soundId was the only handle and the start event expired after 180 ticks); emitters lists standing audio: components as { entityId, ref, bus, spatial } (vibes report their script path; paused vibes excluded; gain-0 emitters included deliberately — the hidden-rig hunt is the point); shifts lists the standing legacy per-listener musicShift/ambience channels as { entityId, music: {clip,volume}|null, ambience: {clip,volume}|null } (TomePlayerJuiceState, one entry per listener with an audible channel — the second-largest audio population in prod, previously the census's one blind spot). Census = authority truth (what the server told clients to play); client-local hatch audio deliberately excluded. Backed by a new replicated loop-voice registry (TomeSoundLoops on tome/spec, replicate:"always" / clientAuthWrite:"never" — the TomeMusicState chassis), written at the verb sites on authority worlds and by a server-side juice-event sweep for client-auth-authored loops; capped at 128 entries (oldest evicts, ops-logged). Standing loops are now snapshot-visible to late joiners (their enumerability no longer depends on catching a 180-tick event window).
• run_script declaration collisions with injected globals teach (design D1.6): const music = … used to die with a stock Identifier 'music' has already been declared / Cannot declare a const variable twice and teach nothing (the Waystead specimen — Savi renamed her variable and never learned the namespace existed). The exec error now appends what the global is: 'music' is the engine music API (music.play/stop/now — audio skill); rename your variable. Original error text preserved; user-vs-user redeclarations untouched.
• music.duck now carries the same settled-layer prune every other music verb write performs (the documented prune-on-verb-write contract; previously duck writes skipped it).
• Pending/failed DECLARED textures render nothing — never an untextured solid (the QA "Paws of Fury" P1: a decal plane with a still-cooking alpha-mask map drew its whole plane as a 0.85-alpha dark slab, and blend:"alpha" dust/petal/KO sprites drew unmasked dark quads while art streamed). Two sites, same law:
  • Primitives (batched lanes, primitive entities + bespoke mesh slots): a slot whose declared albedo (map) has no resident canonical asset carries PrimitiveTextureState.albedoPending and is not presentable — excluded from cull-bounds occupancy (radius −1), draw windows, shadow survivors, picks, and outline masks — instead of resolving to the masked layer 0 and drawing solid instance color. Residency is the gate, not placement fidelity: budget/profile flat-floor degradations of RESIDENT textures keep drawing exactly as before, layer-0 "no texture declared" solid-color semantics are byte-identical, and pending normal/height maps still stream in without hiding the instance (shading detail, not coverage). Zero per-frame cost: the bit is written at reconcile time and flows through the existing visibility rails.
  • FxVM sprite batches (GPU indirect + CPU snapshot paths): collectDraws skips a batch until its declared texture is applied (single-texture lease resident, or composited pack ready), instead of drawing with the opaque-white 1×1 fallback that the fragment shader's curve-alpha × tex.a multiply turns into solid quads. Skip-draw rather than a transparent fallback texture: no fragment cost, no blend-mode edge cases. The white fallback and pack placeholder remain as bind-group filler only and are never rendered; a texture that never arrives (silent magic-cdn failure) now renders nothing forever instead of a slab forever.
• Crossing into a 2D-mode place now resets the player's rotation to identity unless the place's authored spawn rotation actually applied (#9125, the farm-dusk stuck-rotation walk find, 07-13). A player's 3D heading yaw is meaningless in 2D and nothing in 2D ever rewrites it (facing is flipX/clip/texture-swap vocabulary), so whatever rotation the traveler carried at switch time parked on the entity forever — replicated to every client and displayed, since the 2D quad pin passes entity twist through (sprite and parented nameplate spin together). The reset gates on an actual place change and on the spawn rotation having been WRITTEN, not merely authored — same-place respawns keep script-set yaw, and an authored-but-unresolvable rotation can't suppress the reset. Non-players keep their rotation (authored yaw on 2D objects — top-down cars, ships — is the twist pass-through's whole point).
• The animated-character locomotion/facing feature forgets its previous-position state when an entity's place changes: a place transfer teleports the entity, and a prev-pos spanning the teleport read the jump as phantom velocity — the facing system wrote the jump direction as yaw on the first post-transfer tick, and locomotion read the same jump as a speed spike.
• A throwing renderer handler is now contained to its own lane (#9128, ledger 1307 — izkimar's dump 6fb847c7: whole-scene Std/PBR material mute mid-session that neither a script edit nor the join watchdog could wake, only a tab refresh healed). Frame-prep ops are drained destructively from the SAB ring, so one handler throw used to drop the whole frame's drained ops for EVERY handler — never re-applied, silently desyncing the renderer's stores from the sim for the rest of the session, deduped to a single frame-loop error. Each handler's collect now runs in its own try/catch: a failing handler degrades its own lane for one frame, every other handler keeps applying, the frame still renders, and the failure reports once per (handler, message) on the existing frame-loop diagnostic rail.
• The scripted-material refresh retries instead of stranding: the material-scripts handler swapped the library BEFORE the refresh walk, so an aborted walk left library="current" with the scene still muted — identical re-deliveries (edit heals, join-watchdog re-requests) diffed to zero changed refs and never rebuilt anything. Changed refs now queue before the walk and drain on every collect: a throwing refresh retries next frame (idempotent re-refresh), bounded at 8 attempts, then one loud named gave-up diagnostic instead of a silent walk per frame forever.
• Reverted 5.2.0's adaptive remote-view playout (#8339, squash 4f96889a; dig 8151b070, jacob's Waystead field report). The depth estimator read scheduled server quietness as feed lateness — the server skips empty StateDeltas, so a quiet scene flaps the overdue gauge constantly — and while overdue, tickStaleRecord un-converged every held transform ring and dead-reckoned it along its newest snapshot-pair velocity (up to REMOTE_STREAM_EXTRAPOLATION_TICKS = 2.5 ticks). A hop-and-stop critter parks with full pre-stop velocity in that pair, so every flap lurched the parked sprite 5–10px along its last hop vector, then eased it back when the feed caught up. Remote-view presentation returns to exact pre-#8339 semantics: fixed 1-tick playout delay, clock extrapolation bounded to 0.25 tick for rings current to the feed head, and the resting-entity law — a ring stale versus the head holds its newest pose and never extrapolates. The burst-move-then-rest scenario is pinned in synthetic-transform-delta.test.ts as the acceptance criterion for any adaptive-playout re-land (tucker's redesign).
• GPU validation-burst recovery now distrusts cached shadow depth (#9124, the zoo lights walk — ledger-1303 residue present since the 5.2.0 lume cut, not a 5.2.1 regression). The frame is one submit, so each validation-invalid encoder in a burst discarded shadow-atlas and sun-cascade render passes the scheduler had already recorded as rendered — after recovery, lights sampled depth from before the burst (or from a prior slot owner) until the ordinary refresh aged every face out, which read as lights jumping or shadows going wrong for a stretch. Recovery now calls ShadowAtlasScheduler.invalidateCachedFaces() and forces the next sun-cascade renders — pure CPU flag writes, hoisted above the disposals so a dispose throw can never skip them. Slots, fades, and assignments stay put; every cached face re-renders through the ordinary per-frame shadow budget.

technical notes

• Killed the TAAU history NaN-poisoning class (ledger 1195): one non-finite scene texel entered the temporal resolve, was written to history, and the Catmull-Rom resample + neighborhood taps spread it ~2 texels/frame until it consumed the canvas — reload-immune, since it re-seeded deterministically. The resolve (lume/post/taau.ts) now scrubs non-finite values at all three feedback boundaries: non-finite scene taps carry zero weight in the 3×3 filter and the moments, a non-finite history resample collapses to the current frame's filtered color, and nothing non-finite is ever written to history (branchless self-equality selects + a 65504 ceiling for ∞ in rgba16float).
• Hardened the known seed sites: all three wave-derived normalize() calls in water-wgsl.ts route through a safe-normalize with an up-vector fallback, and the bloom prefilter (bloom.ts) stops relying on WGSL max() NaN semantics — the vendor lottery where spec-faithful adapters propagate NaN and the "scrub" was a no-op.
• Clamped five fBM remaps in the realistic-sky night stack to the [0, 1] domain the surrounding math assumes (3 in the night bake sky-night.ts, 2 in the moon layer sky-radiance.ts): 4–5-octave fractal noise swings past ±1, and feeding the remap into WGSL pow() is indeterminate for negative bases — NaN texels baked into the night sky texture blacked out everything at that view direction, stars included (ledger 1185). Day and twilight rendering unchanged; the out-of-domain texels become deterministic and finite on every adapter.
• pbr: true textured primitives draw on lume again (ledger 1191): normalizeMaterialSpec canonicalizes pbr: true into a spent overrides.pbr marker, and the batch gate (SOLID_BATCH_OVERRIDE_KEYS in lume/primitives/store.ts) rejected the marker — recipe null, entity silently skipped, zero fetches. The marker is now accepted at the gate. The skip's diagnostic primitives-material-unsupported is allowlisted (it was emitted since the lume port but server-dropped), and a pbr: true cube exhibit joined the zoo's primitives zone.
• The behavior park watchdog gains a rolling-window trigger (ledger 1197): it still parks on 3 consecutive over-budget ticks, and now also parks when total over-budget excess across the last 3 seconds of ticks passes 20 budgets on ≥2 ticks that each overflowed their full tick interval. Duty-cycled heavy lanes (if (tick % 3 === 0) around a 1.5s step) used to run unthrottled until Chrome killed the tab; they now park on their second heavy beat. A single spike of any magnitude never parks (one-time init stays safe), and sustained just-under-budget work bills nothing.
• The watchdog's nudge text teaches total-budget pacing ("spreading the work out doesn't reduce the total — shrink it") instead of chunk-scheduling, which was coaching scripts into exactly the evasion the old consecutive-only trigger couldn't see. The tome.behavior.budget_parked telemetry line now carries the trigger and window numbers.
• Present-heartbeat watchdog (ledger 1186): a visible canvas whose frame loop stops posting its ~1Hz heartbeat for 30s while other worker messages still flow now fires the loading-state reload prompt, a renderer-present-stall engine diagnostic for Savi, and a DD-countable render_present_stall console error — the frozen-canvas-while-worker-alive class was previously invisible to every watchdog (they all ticked inside the dead render loop) and unlogged in prod. Fires at most once per session; hidden/occluded pages and never-stamped old bundles are never judged.
• Frame-prep errors name their profiler step: the frame profiler keeps an always-on active-step stack, and the render-loop diagnostic's catch now carries frameStep (stream/read-ops, handler/*, assets/tick, …) in the console line, creator-facing message, and data — the next caught frame-prep throw names its subsystem outright instead of needing a fleet dig.
• User volume settings apply unconditionally (ledger 1187, standing since 5.1): bus gains were applied only by rewriting bus commands inside live audio.update lists, so when the prep loop swapped empty lists or stopped swapping, no volume change could land while already-playing WebAudio kept ringing at old gains. WebAudioRendererHandle grows setBusGain, and the renderer host subscribes the six bus gains directly to the user sound settings store — main-thread, worker-independent, applied at attach and on every change. The old command path stays; both compute gains from the same computeUserBusGains().
• Tome-UI DOM <audio>/<video> elements now obey master volume (authored volume × master, via a MutationObserver in dom-host.ts) — they previously played at element volume entirely outside the bus graph. Kiln's default master aligned to the engine's deliberate 0.35 (the slider showed 50% while sessions actually played at 0.35).
• Restored two silent 5.1→5.2 scripted-material parity breaks (dig ac9a3f41), both "author's instruction silently ignored" class:
• material.fog = false is honored again: fog is real ShadeMaterial render state (the assignment used to land on a dead expando while assembly fogged every material unconditionally). The assembler compiles the fog mix out when fog = false, and the bit rides the pipeline key — an additive sun in dense fog can no longer be swallowed to a silhouette.
• Authored depthWrite: true on blended materials is honored when alphaTest > 0 (the cutout discard-then-depth-write idiom, e.g. dome shells occluding interiors) — exact 5.1 semantics for the cutout class. A blended material with alphaTest === 0 still gets the alpha-bucket contract's depth-write override; the policy is documented at the site.
• Room reattach re-arms terminally parked model retries (ledger 1183): RendererAssetService latches retryAfter = Infinity after the dead-4xx budget or pre-session park cap — reachable purely from outage artifacts during a room container restart, after which the models never re-requested for the life of the process. The authenticated attach now relays through the host chain to assets.service.notifyRoomAttached(), which clears exactly the infinite parks: one re-probe per re-armed id per successful attach, the ladder's own backoff governs from there. Finite clocks and server-stated windows (quota deadlines, cook-kill tombstones) are untouched.
• Camera skills teach pointer-lock truthfully (r-224, skill sources only): camera-first-person.md no longer claims mouse look needs pointerLock: true (mouse-delta axes feed whenever a button is held), teaches the first-class mixed mode — cursor game + hold-to-look via edge-triggered hideCursor()/showCursor() — and warns that cursor verbs are last-write-wins within a frame (a per-frame showCursor() silently stomps an edge-triggered hide).
• God-mode pick ray sees scripted-material meshes again (ledger 1201, 5.2.0/lume regression): a scripted-material binding swapped the entity to the standalone scripted lane (lume/primitives/scripted.ts), which kept GPU-side geometry only — the CPU renderer raycast walked only the batched lanes + oversized pools, so the ray passed straight through and selected terrain behind. The scripted lane now retains a CPU pick source (zero-copy position + index references, local AABB) with a lazily built BVH, and raycastPrimitives / primitiveWorldBounds traverse it alongside the lanes. The pick source is minted from geometry alone, independent of the material record — a still-compiling, parked, or failed binding picks identically to a healthy one; bespoke meshes ride the same lane. The stale "falls through to the sim pick" fiction is removed from the docs.
• replaceSpecWithStarter grows a convert mode for built worlds (plan p-7d8c9abb): replaceSpecWithStarter(id, { convert: true, dryRun: true }) returns a manifest of exactly what would change with zero writes; { convert: true, consent: {...} } executes the consented conversion. The merge is a pure function of (birth seed × target seed × current spec) with one law throughout — a facet is register-bound iff the seeds disagree on it: register-bound authored config replaces with a migration record, edited seeded files park under scripts/parked/<birthId>/ (never deleted), register-agnostic and creator work survives, absent seeded pieces never resurrect. Lands mode/gravity/camera/inputs/ground/embodiment explicitly and regenerates lineage plus a fresh authoring.architecture snapshot carrying the migration records.
• One-shot fx volleys no longer burn during the pipeline compile window (ledger 1200): while any fx pipeline was still building, the pass group skipped but stepEffect kept consuming spawn state — persistent beds (spawn.count) and burst volleys latched their fired flags CPU-side with no spawn pass ever running, so the work was overwritten unconsumed. Silent, never throws, permanent — and live-shaped: every effect in a joining client is created during exactly this window (the join snapshot arrives while the arena's pipelines compile). The fx spawn timeline now freezes until passes.ready() — elapsed, rate accumulators, burst timers, and persistent volleys don't advance while the pass group can't run; anchors keep refreshing so the first live frame spawns at the authored transform. Pinned by a permanent verify-fx-gpu-coupling scenario that runs a five-role brazier program verbatim through the compile window.
• The engine's own god-mode effect decks shipped the wall-of-cards bug the fx skill teaches against: pre-streaked textures on align: "velocity" sprites (a velocity-aligned quad keeps its painted streak a constant ~67° off the motion axis on every particle — nothing decorrelates). All 12 velocity-aligned deck sites swap to round paints (rain spatter → effect-droplet-round-soft; sparks/magic/portal/embers/fireworks flares → effect-ember-glow) — motion supplies the streak. The kiln round-subject gate also recognizes explicit round tokens mid-name, so effect-droplet-round-soft-style mints hit the round gate instead of skipping it on head-noun matching.
• The heightmap edit applier skips journal commands whose payload isn't a height edit: terrain-edit journals are kind-blind, shared per place, and survive terrain-kind flips by design — so after a tilemap → heightmap flip, a tile-set command's [[x,0,y],[x,0,y]] bbox was applied as a height clamp, pinning heightmap columns to height 0 (the corruption flowed into the chunk mesh, the heightfield colliders, and the horizon ring, which all sample through the same applyEdits composition). The tilemap and voxel appliers already filtered foreign kinds; the heightmap applier was the one hole of the three.
• Pressing interact no longer fires an action's toast twice on setups where a key and a controller/touch gesture share a binding (ledger 1205). Each input source is edge-triggered per its own press edge, so one physical press could land the same logical interact in the interaction queue twice in one tick — and onInteract ran once per entry, doubling everything the hook emits (toast + announce on the staging zoo's exhibits). Interaction dispatch now coalesces duplicate queue entries per (source entity, target entity) within a tick. Legitimate distinct interacts are untouched: two different players pressing the same tick both land; only one player's duplicate sources collapse.
• Cliff and steep terrain textures no longer smear on 5.2 (a porting bug inverted the side-projection axis): the biplanar side projection now samples the coordinate running across the face again — three-era parity — instead of the one along its normal, so carved cliffs, craters, and pond walls show their strata instead of vertically stretched streaks.
• effect("blur") works again — the blur juice beat in death flashes and dashes was lost in the 5.2 renderer swap. The look resolver kept resolving blur, but the new renderer had nothing that consumed it, so the screen just stayed sharp (55 worlds call it). Blur now rides the look pass as a gaussian gather with the 5.1.x kernel's gaussian core (σ 9.5 texels per axis at full intensity; intensity 0..1 scales the radius exactly like before, and fading it never hitches) and a slightly tighter tail — support stops at 2σ instead of 5.1.x's 2.84σ, the disclosed tradeoff for a well-sampled single-pass gather. Scripted looks get blur(ctx.scene, amount) back in builtin/postfx (it re-samples the scene, like pixelate), and the skill teaches the verb again. Known boundary: blur composes with grades/vignette/grain, but stacking it with a discarding resampler (pixelate / chromatic aberration — the vhs, glitch, chromatic, speedLines, pixelate recipes carry one) silently drops the blur.
• Large water sheets no longer draw over nearby transparent objects at certain camera angles: a transparent water surface used to sort by the signed view depth of its transform origin, so a big lake whose center sat behind the camera sorted as the nearest draw in the scene and stamped over bushes and foliage in front of it. Water now sorts by the farthest forward extent of its bounds (never negative), so shore objects composite on top of the water behind them at every angle.
• Scripted materials reach models + decoration layers (the #8783/#8784 persist-gate parity fix): the shared zod schema now mirrors the engine's material types exactly. model.materials/parts accept ScriptedMaterialSpec (previously every taught per-part scripted write died at the kiln persist gate with properties.model: Invalid input), and DecorationLayerSchema gains its material field (zod stripped it silently on save — live-looks-right, reload-loses-it). A parity test pins both fields against the engine types.
• Slash and shockwave effects no longer flash a black wedge from certain angles (ledger 1210, the staging-zoo juice aisle video). Every slash/shockwave spawned a vestigial invisible 1×1 plane alongside the real effect — a three-era leftover whose only remaining job was carrying a size the effect already reads from its transform. If that plane ever reached the renderer without its effect material tag, it drew as a plain untextured plane: black from its unlit side, the wedge in the video. The vestigial plane is gone; the effect draws from its own component and transform alone, so the wedge class is unrepresentable.
• TAAU scrub fallback epsilon → f16 min normal (jure's find, ledger 1195 rider): the resolve's division guards used 1e-5, which sits below the f16 min normal (2^-14 ≈ 6.104e-5) — under the shader-f16 aliases the literal materializes as an f16 subnormal, WGSL permits flushing subnormals to zero, and an all-invalid 3×3 then computed 0/0 = NaN, re-seeding exactly the NaN class the scrub exists to contain. One untyped WGSL const (EPS_MIN_NORMAL_F16 = 6.103515625e-5, exactly 2^-14 — exact in f16 AND f32) replaces all three epsilon literals; a test pins the constant and sweeps every kernel axis for surviving flushable guards.
• Fixed static objects visibly bouncing for some players while terrain was being edited live (ledger 1204). Terrain-anchored objects (feetPosition.y: { terrain: offset }) were re-resolved locally by EVERY client whenever the composed terrain height under them changed, while the place host's re-anchor writes also replicated in — two writers for one row. When two clients' terrain state briefly disagreed (live wisp edits, or plain join-time replication ordering), the writers fought and "static" props ping-ponged between the two grounds, differently on each player's screen. Re-anchor writes now belong to the entity's simulator only (owner/lease/place host); other clients receive positions over the normal replication lane. Cost: non-host players see anchored props settle one round-trip after a terrain edit — the standard latency class for host-simulated state. Singleplayer and server behavior unchanged. Toasts and announcements raised by behaviors no longer show twice for you in your own world. When a behavior fired a toast, the copy your game showed instantly and the copy the server reflected back were supposed to be recognized as the same event — but a toast with no icon/color set was recorded in one shape and came back over the wire in another, so the reflection slipped past the duplicate check and rendered again. The echo check now compares events the way the wire actually carries them, so behavior toasts, announcements, and every other behavior-fired effect land exactly once for the person whose game fired them (everyone else always saw them once). run_script toasts were never affected. Captures and Savi's live view no longer drop text and sprite objects that use motion/MRT rendering. On sessions whose scene pass carries the TAAU motion-vector target, some lanes' pipelines carry a second color attachment — and the capture pass declared only one, so any such pipeline handed to a capture faulted the whole submit with a GPU validation error ("[pipeline] is not compatible with [RenderPassEncoder capture/scene-view]") and the object went missing from screenshots, thumbnails, and view_live_scene. The capture pass now mirrors the live scene pass's attachment state (the motion vectors land in a scratch attachment that is discarded), so every live pipeline — text, sprites, and any future MRT lane — draws into captures unmodified. First captures also get slightly more complete: the capture reuses the live pipelines directly instead of waiting on capture-only twins to compile. When a script keeps using the wrong entity ids, Savi now gets told once clearly instead of the problem hiding in logs. The engine already taught the fix per call ("entity not found — call ignored. Use entity IDs, not array indices"), but a behavior looping over bad ids — sequential array indices, generated name suffixes — repeated that lesson thousands of times into the runtime log and nowhere else, so the game silently did nothing for hours while nobody noticed. Now a loop of misses from the same call site counts as one problem: after the tenth ignored call, Savi gets a single direct notification naming the object, the script, the ids it tried, and the fix, and the per-call warnings drop to a compact summary every 500 ignored calls. One-shot typos keep the full per-call teaching, exactly as before. A model told to play a clip that contains no motion now says so instead of silently freezing in a T-pose. Some GLB exports bake broken clips as a single static keyframe per track (a Blender/Mixamo action that never made it into the export as real animation) — the clip exists, binds, and "plays" its one bind-pose sample, so the model just stands frozen with zero errors anywhere, and the only way to find out was debugging clip-by-clip. Now the first time a script plays such a clip, Savi gets one clear diagnostic naming the clip and the entity and pointing the fix where it lives: the source file's export, not the script. Deliberate one-frame pose clips that are never played stay silent, auto-play behavior is unchanged, and the horde path reports the same truth instead of a misleading "clip not found".
• World text stops shimmering/ghosting against its moving parent under TAAU (ledger 1222 — the "nameplate blurs when I run" pair). Text never wrote the velocity MRT (the alpha lanes' writeMask-0 default) and never writes depth, so the TAAU resolve's closest-depth dilation reprojected nameplate pixels with the OPAQUE surface behind them — a runner's nameplate rode the streaming terrain's motion while the body reprojected on its own, and the thin-feature lock preserved the stale glyph copies as a per-frame double image. The text lane is now the alpha bucket's cutout exception: instances carry the previous packed block pose (position + resolved billboard rotation, the primitive lanes' prevTransforms discipline), the MSDF fragment writes true per-glyph object motion via lume_velocity_pair, and the store runs one settle rebuild after motion stops so a resting text parks with zero velocity. First-time packs seed prev := current (zero object velocity on the spawn frame); hidden/refonted/dimension-flipped texts reseed instead of differencing across the gap.
• Renderer scripted-texture library replaces now split changed-source refs from RETIRED refs (dropped from the library because nothing references them). Retired families keep their last-good texels and atlas grammar, leave the re-bake sweep, and never fire the "was not found" diagnostic — that teach is now reserved for refs never present in any received library (true typos). Previously a projection reset re-derived the library without retired scripts and the invalidation sweep re-baked every cached family variant into simultaneous false not-found reports (dig 20b7b07c: ~129 doomed bakes, one wasted Savi turn chasing a phantom).
• The TextureScripts derivation dropped its carryover rule: the library is now a pure function of (spec + live draw state + live compiled fx programs) on every derivation path, instead of depending on session history (live tabs kept retired entries forever; post-reset re-derivations starved them). FX sink refs are now collected by walking FxCompiledProgram.
• Client-reported engine.diagnostic rows are stamped with the reporting client's held spec revision + dbVersion (data.specRevision / data.specDbVersion), relay-stamped in the runtime worker — stale-client-vs-propagation questions become one read.
• The variant-change room recycle in GameRoomRuntime.setSdkConfig now recycles the WHOLE room scope — host, SDK identity, and the room binding itself — and runs BEFORE bindRoomId (pc-42951396). The old order half-reset the scope: a different variant claiming the runtime tore the world down and reset identity but kept this.roomId, and the bind ran first — so an app switch that also moves the room id (local dev runs every app through one kernel container, and a live-mode session leaves the singleton runtime scoped to live-room-1 while the next game's dev room is room-1) died at the cross-room protection ([room-runtime] room mismatch: runtime is scoped to live-room-1, received room-1) instead of recycling. Same-room variant switches (the June #6757 behavior prod rides on kiln variant reassignment) are unchanged; the recycle no longer requires a live simulation host (a variant change with no host previously fell through to mergeSdkIdentity, which never clears fields — stale updateSlug/keys from the old game could leak into the new scope). The misroute protection is untouched: within ONE variant, a mismatched room id still throws — pinned in per-room-sdk-identity.test.ts, whose "stray rooms are refused" contract is now scoped to same-variant strays (the old pin's cross-variant stray was the app switch itself). On a cross-room recycle the new binding lands before onRoomReset fires (in-process/NO_WORKER relays the reset synchronously; an unbound runtime would be re-claimed by the old room's re-activation, first-bind-wins), so the old room parks "failed" and heals on its next real join, which carries SDK identity and lands back in the recycle.
• The steady-state renderer-authoritative camera path now enforces the all-cameras-are-fully-authored ruling (ledger 1265, the 06-05 camera law): a mouse-reading custom camera classified onto the display-rate orientation path used to have its per-tick authored yaw/pitch writes structurally discarded — RendererCameraOrientation.updateConfig took "parameters only, never yaw/pitch" in steady state, so death-lock grips (the prod specimen: scripts write forceYaw/forcePitch, camera script snaps its yaw/pitch to the grip every tick) held rock-steady in sim state while the screen free-looked. Broken since the 5.0 cut; #8173 fixed only the non-lookAt sibling. The fix is the ruling's own named shape, a divergence-adoption gate at the config-ingest seam: config.yaw/pitch that is explainable as an ECHO of angles the orientation itself published (camera-sync mirrors them back through the f32 CameraAngles SAB, one-plus ticks stale, optionally advanced by the script's own look-axis integration of the same mouse motion) keeps renderer authority and display-rate mouse feel; anything else is the script authoring a different pose and it wins that same ingest — seed the divergent axes, publish so movement axes match the screen, drain pending deltas on full-pose snaps (zoom-handback semantics). The echo test keeps a per-ingest-interval envelope of published angles (tested per interval, so adoption discontinuities aren't convex-hulled over) extended directionally by the window's signed net mouse motion with 2× sensitivity headroom — a static grip behind a sweep exits immediately while a taught self-integrating orbit script never false-adopts. Per-axis adoption keeps display-rate look on the free axis under single-axis grips (horizon locks). The zoomTo sim-authority window and its handback seam are untouched.
• The renderer→sim camera-angle mirror is now universal across live-path kinds (mirrorLiveCameraAngles, extracted from the custom-kind-only writeCustomCameraAnglesBack): built-in first/third-person and god sims learn the renderer's published yaw/pitch every tick, exactly like custom scripts. This is what makes the gate's invariant hold for channel-only look sources — gamepad sticks (writeGamepadLook) and touch drag-look feed ONLY the camera-orientation SAB with no lookX/lookY trace in the sim's input ring, so an unmirrored kind froze behind the renderer and the gate read its frozen state as a script override, re-adopting every ingest (measured pre-fix: intended 64.4° stick sweep → net 2.15°, view pinned). The mirror also dissolves two sibling symptoms on built-ins: lookX integrated during a zoomTo window no longer snaps at handback (the mirror re-bases through the zoom), and the pitch-convention rederive's flipped publish can no longer be adopted back against the correction. TomeCameraState is client-plane; no replication contact.
• Known bounded residuals, pinned in tests and filed for the required sim-side authored-window latch follow-up: a player actively fighting a held grip sees wiggle-amplitude wobble (±0.83° moderate / ±4.1° hard at default sensitivity) or a one-ingest sawtooth under steady sweep (~1.7–5°), and a yank after wiggling around the grip gets up to the echo window (≈2 ingests, ~25° at hard-yank rates) of free runaway before re-adoption recovers the grip exactly. Mouse-still grips hold exactly.
• The unattributed validation-storm death class (ledger 1232 — the 07-12 destroyed-scripted-texture storm: one validation error per submit, ~an hour of frozen screen with ZERO signal to the player or Savi) is now judged. Validation errors that match no rail (not the dead-device regex, not the #187 burst classes, no scripted-material label to park) used to fall through handleDeviceError as a per-frame silent no-op; they now feed a sustained-storm window (≥24 errors spanning ≥15s inside 30s — reachable in both delivery regimes, including Dawn-muzzled sessions where errors only arrive via the #365 sentinel probe) that rides the SAME ladder the known burst classes use: bounded render-chain rebuilds first, then the honest device-lost declaration. No new walls, no new transports — the trip lands on the existing #6710 sticky reload wall for the player and the existing renderer-device-lost engine-diagnostic (getLogs + one deduped DM) for Savi.
• The renderer-device-lost diagnostic message now carries the client truth instead of a mechanism note: the player's screen is frozen on its last frame (or black) and shows nothing until they reload, suggest refreshing if they mention a stuck screen, this is a device/renderer failure — not a game bug — do not rewrite or optimize content over it, and view_live_scene may not reflect what that player actually sees. Informational, never a work order (the savi-perf-notifs-pull-not-push law). Once per death, content-deduped server-side, zero cost when healthy.
• Discard-carrying opaque draws now render on their own cutout channel AFTER plain opaque (#9055). Punch-through pipelines (fragment discard) disable early-Z and TBDR hidden-surface culling for whatever is still undrawn behind them, so mixing them through the opaque bucket in registration order wasted the depth buffer's rejection power — worst on mobile tile GPUs. MainPassDraws gains a cutout channel and collectMainDraws folds it in after every contributor's plain opaque (registration order within each class; return shape unchanged — chain and capture consumers untouched). Routed emitters: model MASK slots (static/horde/character), decoration sprite + scripted layers, the opaque voxel bucket, rooms submeshes, built-in tilemap draws, and all four scripted paths (tilemaps, models, character primitives, standalone primitives route by shade.alphaTest > 0). Both channels depth-test and depth-write, so the split is pure ordering, never correctness. Shadow passes untouched (every lume shadow caster is vertex-only depth-only — no discard exists there, already optimal).
• Made the destroy/name-resolution funnel honest (ledger 1247, dump a693ca36 — Savi aimed every kill at "5", a list POSITION, while the target was the object named "garden-music"; every wrong kill read as success). Three seams, no new vocabulary: (1) destroy(id) on an id that matches nothing in the live world AND nothing in the spec now reports on the missing-target rail (warnMissingMutationTarget, the ledger-1215 escalation funnel the other mutation verbs already ride) — visible in getLogs and in-band in run_script results; spec-declared ids stay quiet (client-realm local spawns and unmaterialized places are delivered by the clientDestroy fan-out, and double-destroy of a real object stays idempotent-silent). A bare-number miss that lands inside the caller's place objects array names the object sitting at that position ("the object at places.main.objects[5] is "garden-music"") — the error text is the teaching. (2) getSpec numeric path segments that land on an id-carrying object still resolve (positional reads keep working — nothing in-tree relies on them, but shipped worlds might) and now say which id the position landed on, once per digit-folded path shape per cooldown. Prefer ids in spec paths; the positional form on id-carrying arrays is deprecated in spirit and a candidate for removal at the next breaking window. (3) api.query gains "enumerate" visibility: with no radius, camera-attached objects match like any others (the enumerate-everything fallback was structurally blind to them); with a radius they stay excluded (their WorldFeetPosition is a bookkeeping anchor, not a place) but the exclusion is reported, naming the hidden ids. nearest() and every engine caller keep pre-1247 "sensor" visibility — byte-identical behavior.
• The stale host-epoch wedge (ledger 1257 — jacob's Waystead carried epoch 48 into a place re-epoched to 2 for an entire session; jo's Sunhollow Farm dropped 1,238 host writes on a room restart and half-built a farmhouse) now self-heals server-side. The epoch gate itself is untouched — host writes stamped with a dead epoch still drop exactly as before — but the state-delta drain now tracks continuous stale-epoch drop windows per sender, and when the skipping is provably a wedge (≥30 dropped-write messages spanning ≥10s, uninterrupted by a table-corroborated stamp) it flips the sender's projection to NeedsReset: the next egress tick ships the production reset snapshot (current TomePlaceHosts included) and the client rebases through the rail every join/migration/resume already uses. The thresholds sit an order of magnitude past the legitimate migration straggler window (~1 RTT of in-flight messages), a ≥30s quiet gap restarts the window so separate migration races never accumulate, a valid host stamp clears it, and a 60s per-client cooldown bounds re-forcing when a client is reset-proof wedged.
• Telemetry: each force emits one DD-countable netcode.state_delta.reseat_forced warn (client, place, epochs, skip counts, forcedCount), one script-visible runtime-log line for Savi ("the server re-seats the client automatically — no rejoin or tab-close needed", so she stops prescribing the close-and-rejoin remedy that triggers a host migration and drops persist:false entities), and a reseatsForced counter on the upload stats (F3 net uploads line).
• Field-chunk change tokens are content-aware — the version-ABA at the shared invalidation seam is dead (ledger 1250). applySerializedFieldToWorld pins every restored chunk to version 1 (and a recreated chunk restarts at 1), so a spec-level rewrite of an already-painted chunk (updatePlace/definePlace field patches, brush gesture-cancel, hydration of changed fields) landed v1→v1 with DIFFERENT cells and every version-keyed consumer kept stale state until an unrelated input moved. commitFieldChunk — the single seam every local chunk write funnels through — now stamps cellsHash (FNV-1a over the int16 cells mixed with the quant/cellSize they decode under, ~4.6µs per default 4096-cell chunk, on a path already O(cells)), and every change-token consumer mixes it. All seven, by name: the terrain mesh inputs-hash + horizon + spline-redrape (via getComposedFieldChunkVersionsInBounds/composedChunkChangeToken), nav's composedFieldPlaceSignature (#9019), terrain-anchor re-resolution (composedFieldVersionAt), the scatter footprint memo (bed-field layer signatures now read chunkChangeToken off live chunk components AND the terrain:height walk), the scatter-instances supertile signatures, and the decoration-density layer snapshots. Versions keep their ordering role (resim reset, predecessor+1 bumps) untouched — materialized per-layer FieldData.chunkVersions deliberately stay RAW versions because translate/write derive version + 1 from them; per-layer signature consumers read chunkChangeToken off the chunk components instead.
• Chosen over never-restarting version seeding deliberately: the hash is a pure function of the replicated chunk value — identical on client and server for the same write, stable across resim replays (a counter/timestamp scheme would diverge between realms and churn under resim, and the rollback fast path applies chunk values without set/add events, so hook-fed counters can't be trusted either — the reason field-feed-derive's destroy-epoch shield had to exist; that shield stays and keeps covering the feed + GPU field-texture path). Bonus: identical restores are byte-quiet — a spec re-apply of unchanged fields rebuilds nothing.
• The composed token also closes a max-masking hole: max(authored, runtime) hid a write to the lower-versioned layer under the higher one; the token now mixes both layers independently. Mixing quant/cellSize into the stamp closes a second pre-existing blindness: identical raw cells restored under a different grid decode to different world values, invisible to version equality.
• TomeFieldChunkValue.cellsHash rides the existing JSON encode/decode transparently; values from pre-hash builds read as 0 and re-stamp on their next commit.
• The quality governor recognizes the interval-capped regime and stops paying quality for it (ledger 1223 — the 60Hz sibling of the L19 pacing-first class). When a browser environmentally caps rAF delivery at a mixed cadence (the iPad CriOS specimen: ~35Hz arrivals on cpu 2.4ms + gpu 7.1ms of measured work), the fused wall signal read sustained overload, the ladder walked to the survival floor in ~40s, and five rungs of cuts moved the interval 32.1→28.4ms (~12% — the cuts bought nothing), then held the floor forever because calm was unreachable. The governor now keeps a relief ledger per overload down-step (predicted relief = the same live/applicable/relieving costHints the probe gate charges) and classifies the regime INTERVAL-CAPPED when consecutive steps verifiably under-deliver while the measured work explains neither the budget nor the interval — then restores the pre-descent rung in one shift (interval-cap-restore, on the transition ring and telemetry) and holds the same wall-interval gate the clean-2× environmental signature gets (the capped cadence stops entering the fused signal; a genuinely degraded ≥40ms interval still does), releasing when arrivals return to the judged display rate. The exact-2× environmental signature is untouched — this covers the mixed-cadence space it deliberately misses. Real overload is unaffected: measured work fails leg (a), and a genuinely GPU-pinned device's interval shrinks when pixel work is cut, so relief verification passes and the descent proceeds.
• The interval-capped latch (ledger 1223, #8971) finally gets SAID instead of silently absorbing the blame (two specimens in two days: the iPad CriOS ~35Hz session and a MacBook at 12fps under Low Power Mode all session, found only by luck). On latch engage: (1) PLAYER — one toast per session on the existing juice toast surface, watched at the renderer→host perf-sample relay (no new transport), mechanism-honest wording ("Your device is limiting frame rate — Low Power Mode or battery saver can cause this"; the engine detects the CAP, never claims LPM itself), never repeated on re-latch, transient by construction; (2) SAVI — one render-interval-capped diagnostic per session riding the existing engine-diagnostic rail into the perf-notify pointer DM (new render-interval-cap category: environment-not-content blame, consent-framed, on the same global 1/hr budget — any perf DM silences it for the hour), with the full verified-cap body in the runtime log for the pull side. The client-health snapshot now carries intervalCapped (strict-boolean validated) and the getClientHealth summary names the cap at any rung — including restored-to-full, where the rung-0 fast path used to hide it. The governor's classification logic is untouched; this consumes its latch state.
• Fixed the transparent-lane sort flicker class (ledger 1242, Space Craft protocell): the alpha bucket sorts translucent primitive lanes as whole batches by a centroid-anchored sortDepth, so nested translucent lanes sharing ~one world center (base shell lane + emissive-split lane + inner cubes at the same point) tie within noise — per-frame centroid drift (membership rebuilds re-snapshot displaced instance transforms; camera motion moves every distance) flipped the sign of the tie and the lane draw order flipped frame to frame, z-fighting whole translucent layers. Regressed 5.1.13 → 5.2.0 with the lume whole-batch alpha sort. Fix is a deterministic near-tie order, never a new depth model: PrimitiveLane mints a creation ordinal (alphaSortTiebreak), the lane and oversized-pool alpha draws carry it as SortableDraw.sortTiebreak, the alpha sort itself stays a consistent pure-depth comparator (an epsilon comparator is intransitive — spec-level implementation-defined sorting), and a post-pass (stabilizeAlphaTieRuns, sort-order.ts) then reorders each maximal run of consecutive carriers whose neighbor gaps are within ALPHA_SORT_TIE_EPSILON (0.25 m: comfortably above cm-scale centroid drift, far below deliberate authored separations) by ordinal — ascending, later-created lanes composite on top; deterministic and input-order-independent, and a coincident pair's mutual order is pair-local (no third lane can split their run). Sub-epsilon ladders deliberately chain-merge into one ordinal-ordered run (documented trade against already-approximate whole-batch centroid depths); gaps beyond the epsilon never form runs, so genuine separations keep pure depth order. Draws without a tiebreak (2D sprite sort bands, per-entity scripted/model depths, particles, water) never move and break runs — bit-for-bit pure back-to-front — and a lane's emitted back/front two-pass pair order rides the run sort's spec-guaranteed stability (equal depth, equal ordinal).
• Fixed dead mod HUDs after install (ledger 1271): mod install namespaces the mod's inputs (edgeX → rts-controls:edgeX) and the input proxy resolves the mod SCRIPT's bare reads to the namespaced form, but a mod HUD wired at ui.render sent BARE sendAction('select')/sendAxis('edgeX') — undeclared, dropped, dead buttons. The {modName}: send-prefix rewrite existed only for mod-installed creator tabs. The compiler now stamps uiModName on the compiled spec when ui.render points at an installed mod's script (a mods/{name}/… ref with {name} present in spec.mods), and the game UI surface carries it as actionPrefix/axisPrefix through the existing dom-host maybePrefixInputName — the same mechanism creator tabs use, no new spec state. input.actionData reads get the same mod-scope resolution the action/axis proxies already had, so payloads sent under the namespaced action land on the mod script's bare input.actionData.select. Creator-authored ui.render never matches (no mods/ prefix or no manifest entry) and stays byte-unchanged; uninstall deletes the spec.mods entry, so the prefix comes off with the mod — the fix writes nothing into the spec, leaving operation-precise uninstall untouched.
• The NPC nav floor oracle now reads sculpted terrain (ledger 1244 — jesse's Field Orders: units passed THROUGH god-mode-sculpted hills at y=0). NavGrid's heightmap column sampler composed only heightFromDefinition (generator + marks) and never consulted the replicated terrain:height field overlay, so navAt answered floorY 0 / blocked:false on field-raised ground and movers kept agents at the generator height. The sampler now composes the same ground the terrain mesh/collider build bakes — generator + marks + composed field overlay — through the same pipeline (getComposedFieldInBounds materialized once per nav chunk, readFieldValue bilinear per column), gated to heightmap generators exactly like the mesh (fields sculpt heightmap terrain only); every other generator derives byte-identical columns.
• Field writes now invalidate the nav grid: the per-place input compare gains a terrain:height place signature (new composedFieldPlaceSignature in field-store — an order-independent fingerprint over painted chunk coords/layers/versions, both layers). It is a query-time walk refreshed at tick boundaries, never a component subscription, because the prediction rollback fast path applies field-chunk values without firing set/add subscribers (the field-feed-derive rule) — so sculpt, erase (chunk despawn), and rollback-applied field state all rebuild nav on every realm. Unpainted fields cost two index probes per place per tick.
• Perf (36-chunk / 9216-column region rebuild, shared dev box): generator-only 5.2ms before → 5.6–6.8ms after (within the 4.2–5.2ms noise band measured at HEAD); field-painted 4.2ms (overlay ignored) → 8.0ms (+105µs per lazily-rebuilt chunk); steady-state refresh with a 64-chunk painted field 3.7µs → ~9–13µs per tick across 20 getNavGrid calls.
• Fixed the unanchored-pushLook permanent library miss (ledger 1241): a look script referenced ONLY by api.pushLook(scriptRef) — never anchored to any place's atmosphere.look — has exactly one lane into the renderer's LookScripts library: ensureLookScriptEntry at push time (syncLookScriptsWithSpec collects refs only from atmospheres, live overrides, and existing library keys — pushed layers are invisible to it). That ensure's component write can be lost while the layer itself survives (behaviors resim in prediction overlays that stage-and-discard component writes but leak the in-place LookLayersResource Map mutation; projection resets re-derive the library without pushed refs) — after which nothing ever repairs the miss: the renderer parks the look on scripted-look-compile-failed claiming the script "was not found in this game's scripts" with the file present in the spec, under either ref shape (scripts/look-x.js or look-x.js). The specimen (Primordia, three sessions) only escaped by anchoring the script to a place's atmosphere.look (v1761), which routes the ref through the spec-sync collector — an undocumented requirement pushLook was designed not to have. Two repair lanes now converge it, mirroring the scripted-material twin: the look resolver (client renderPrep, base world — writes stick) re-ensures a resolved ref whenever the library misses it, healing in the same frame the resolved look ships (healthy frames cost one component read + four map probes); and spec sync now collects live pushed-layer refs exactly like collectLiveMaterialRefs, so every spec application repairs lost entries. Unanchored pushLook now just works. LookLayersResource (+ ActiveLookLayer/LookLayerState) moved from systems/look-resolver.ts to resources.ts to keep look-scripts ↔ look-resolver acyclic. The compile-failed DM now only fires for scripts genuinely absent from the spec, and its fix-text names both look entry points (atmosphere.look.script and the api.pushLook arg).
• Shade compat: unknown vocabulary reads through TSL no longer throw — they return undefined with a one-time teaching warn (shader-vocabulary-unknown-symbol via getLogs), so a script written against newer vocabulary degrades instead of killing the material. Adds varying and fwidth to the shade vocabulary.
• The delta-0 short-circuit's completed-apply binding now survives coherent ObjectAPI persist mirrors (ledger 1268, PR-C #7919 follow-through). The binding veto (canShortCircuitIdenticalApply: generation record's specRef must be the exact live GameSpecResource doc) existed to prove "the world already IS this spec" — but every persist-mirrored write (persistent spawn/destroy, setProperty/updateObjectSpec persist) moved the doc head and permanently disqualified the game from the 2ms identical-apply lane, even though those mirrors write the live ECS effect and the doc in one synchronous op (the instant contract). Prod receipt: a zero-delta apply measured 5,233ms (shortCircuit false, objectsVisited 0, objectsSkipped 2050, expandPasses 2) on a live game whose applies cost 2.2ms whenever the gate binds. Now updateSpecResource advances specRef alongside the head for writers that declare worldCoherent — the persist mirrors, gated per write by isLiveCoherentPropertyKey: every persisted key must have a live runtime writer (the NO-WRITER schema keys room/collider2d are spec-valid but APPLY-DERIVED — expandRoomObjects / physics-primitive derivation materialize them only in a full pass — so their mirrors keep breaking the binding) and must not be a top-level key (behavior/parent/tags defer wiring to a requested reconcile). Spawn mirrors break the binding when the def carries place-level expansion content (room/spline). Writers that request an applySpec reconcile (updateSpecAndRequestApply: setScript, patchTerrain/Player/Camera, add/removeBehavior, definePlace/updatePlace) keep breaking the binding, so a drain of their content can never short-circuit past its own recompile/rebind — op-count-pinned in both directions in spec-apply-changed-set.test.ts, including the no-writer-key negative pin and a mixed-order burst pin (once broken, later coherent writes cannot resurrect the binding until a full apply rebinds). Note: patchState/replaceState write live TomeState only (no spec mirror), so pure state writers never touched this binding in either direction — the storm lane this fixes is the property/spawn persist mirrors.
• room-runtime's applyTomeSpec now recognizes the kiln poke-back echo: a fetch at a strictly-newer dbVersion whose content the delta-0 gate certifies as the fully-applied live generation (the room's own persist echoing back through a version the consecutive-only noteAuthoredDbVersion stamp couldn't absorb — interleaved persists) still runs applySpec (its internal short-circuit costs ~2ms and keeps the rails a real short-circuited apply owes the world: the spline-orphan sweep and the tome.apply.episode telemetry), but suppresses the tail — the revision-bumping upsert and its replicated push fan-out to every client — stamping the fetched dbVersion so the staleness guard sees the room at the echoed version. The gate is wouldShortCircuitIdenticalApply — the apply's own predicate, run conservatively on the raw doc. Replace pokes never dedupe (replace re-asserts live state, ledger #296); retry states (degraded lowering, compile errors, scatter recovery, residency growth) fail the predicate and take the normal tail; a failed apply falls through to the raw-reference upsert retry rail.
• Deliberately NOT in this change, named for the ledger: (a) the O(spec) skeleton phases (expandPlaces ×2, normalize/namespace ×2, signature rebuilds) still run whole-doc when a real delta arrives — making them O(delta) needs identity-threading through sanitize/namespace/normalize plus expansion caching with world-state (terrain/residency) validity, a separate careful change; (b) the multiplayer-relay fold lane (foldSpecMutationsIntoWorld) still breaks the binding on every forwarded batch; (c) mid-apply mirror writes (self-rebuilding creator behaviors, the vil-home-builder bench residual) still land the generation record behind the head — the binding re-forms at the next quiescent apply instead of never.
• 2D pixel-sprite aliasing/shimmer fixed at the sampler math (jacob's batch-2 felt report, 2026-07-12 — sprites in his 2D sessions crawl/shimmer under camera motion; same session family as the #8988 tilemap seams, whose screenshot pinned the zoom at ~3.65 screen px per texel). Root cause: pixel-grammar sprites sample NEAREST with no mips, and at fractional magnification the art's texel boundaries land at fractional screen positions — texel columns alternate ⌊3.65⌋=3 and 4 px wide as a function of the quad's subpixel phase, and every camera pan (or sprite move) rephases the pattern, so texel edges flip full-contrast frame to frame. Camera pixelSnap cannot cure this class: it quantizes the presented camera to the SCREEN-pixel grid, but the texel:pixel ratio stays fractional. Fix: pixel-art texel AA in the lume sprite fragment (material.texelSnap, per-batch) — the batch binds a LINEAR clamp sampler in place of the lease's nearest one, and the shader remaps each sample to its texel center (bilinear weight 1.0 — bit-identical texels) except inside a one-screen-pixel band at texel seams, where the linear tap interpolates (seam + clamp((t−seam)/fwidth(t), ±0.5)). Texel interiors stay bit-crisp, seams render at a stable subpixel position instead of re-picking texels, and the mapping is bit-identical to nearest at aligned integer zoom (pinned by f32-emulated test). The flag mirrors the asset service's sampler policy exactly via spriteTexelSnap in sprite-logic — precedence: repeatX strips never snap (they lease wrapS repeat for the −1..2 U span; the clamp AA sampler would stomp tiling — mechanical wrap need, doctrine-aligned with the plate behaviors), then authored sprite.filter both ways, then the atlas meta's manifest-authored filter both ways (explicit filter: "linear" on a grammar-pixel id is never snapped), then the texture-id grammar (plates/tiling surfaces stay linear). Linear-filtered sprites, placeholders, outline taps, and the tilemap lane are untouched.
• A null entry in terrain.marks no longer kills the server (DD sweep 01b440e6 — 396 rows in one hour, all app a6af7bb9, TypeError: null is not an object (evaluating 'mark.kind') in isHeightmapTerrainMark, emitted as both tome.terrain.anchor_refresh_failed and tome.reconcile.spawn_update_failed, cascading to 3× process.uncaughtException and [FATAL] System "tome/physics-dispatch" permanently failed after 5 retries — server restart required). Two halves, per the savi-failure-contract (a failing spec degrades exactly its own object, never a server restart):
  • Write side (root): mergeSpecPatch's replacement branch now recurses plain-object patches with an empty base, so merge-patch null-means-delete holds at EVERY depth. Before, updatePlace("main", { terrain: { marks: { old: null } } }) on a place whose terrain had no marks key stored { old: null } verbatim into the spec — a persistent poison that crashed every subsequent apply and tick. A null inside a fresh subtree deletes nothing, and nothing is what it stores now. Uniform across every merge-patch surface (updatePlace, patchPlayer/Camera/Engine, buyables, terrain materials/structures), not a marks special case.
  • Read side (seatbelt, covers already-poisoned persisted specs): the terrain family guards (isHeightmapTerrainMarkMap/isVoxelTerrainMarkMap) skip null/non-object mark entries instead of crashing inside their .every(), with one deduped [terrain/marks] diagnostic per map instance naming the offending keys — matching the skip every downstream mark consumer already does. normalizeVoxelMarks (the one other unguarded mark.kind iteration) gets the same skip; reportInvalidTerrainMarks already names the entries on terrain-content change.
  • Cascade pin in physics-dispatch.test.ts: a marks map containing null → system tick completes, diagnostic emitted, valid marks keep dispatching liquid hooks, no throw. Family-guard + resolve pins in marks-null-entries.test.ts; write-side merge-semantics pins in spec-write-contract.test.ts.
• Texture load failures reach Savi again (ledger 1264, savi-failure-contract gap — prod specimen [LumeTextureService] Failed to load texture scripts/tex-ocean.js: ctx.canvas(64, 2048) exceeds the 1024×1024 cap, fired 3× client-side while Savi shipped the broken visual). The ledger-895 retry-exhaustion emitter for texture-load-failed died in the lume port: LumeTextureService's generic retry ladder ate every non-policy failure (bake transport rejections, GPU upload throws, transient-looking fetch errors) with a client-console console.error per attempt and then looped on a long cooldown forever — no runtime-log entry, no DM, nothing Savi could see. recordRetryFailure now fires reportEngineDiagnostic('texture-load-failed') exactly once per failure episode — guarded by a reported flag on RetryState (the terminal pattern), not an exact attempts-crossing check, because the policy rail increments the same counter and a mixed budget/generic interleave could otherwise skip or re-open the crossing (review 9054); success and source edits reset the episode — carrying the underlying error text and, for scripts/*.js refs, the edit-re-bakes recovery. Degradation is unchanged — entities keep their last good image or loading placeholder and the ladder keeps retrying; this only ADDS the feedback path. The bake-fault policy taxonomy (texture-script-compile-failed/-runtime-error/-budget) already reported on park and is untouched. Contract row + harness added: the cap specimen drives the real service to exhaustion and asserts one framed getLogs entry + one DM across three reporting clients (service.test.ts), per the savi-failure-contract harness pattern.
• run_script forward-timeout copy stops teaching a false trigger model (look 1b53cc7e, same creator session): the error text said "Run it again once the game is back in view" (Savi cannot observe tab visibility and cannot run without a turn — she repeated it to the creator as a promise) and "with the script still queued" (no queue exists; the script is discarded). Both timeout reasons in script-forward.ts now state the truth: nothing is queued, the change has NOT been made, and if the creator asked for the change, tell them plainly it hasn't happened yet. Retry guidance is branch-honest: in singleplayer, retry is only possible in a turn while the creator's game tab is visible (ask them to keep the game on screen and ping); in the left-SP-mid-flight branch the room is multiplayer at timeout, so a retry runs on the server directly and the copy says so — no spurious visibility precondition (review 9054 truth-tighten). Error text is API surface; pins extended in script-forward.test.ts.
• Tile edits gain the client→server lane they never had (ledger 1248 — Jacob's Waystead garden, dig 4287dc11). In client-auth rooms, api.setTile/clearTile/resetTile called applyTilemapTileOverride bare while voxel edits rode tome/voxel-edit-rail, so gameplay-script tile edits on a client lived in local chunk state only, forever — every server-driven chunk reconcile (host-epoch NeedsReset rebase, rejoin, AOI chunk rows) wiped them. The rail now carries a tile kind alongside set|fill|stamp: the ObjectAPI tile verbs route through applyTilemapTileOverrideFromScript, which applies locally first (responsive feel, byte-identical outside client-auth) and forwards over rail.voxelEdit under the exact voxel gates (active script ref, owned/lease/host/interaction-grant source, no transactional overlays, no singleplayer). The server half validates shape + tile id range, charges the same shared per-tick voxel-rail work budget (one cell per edit), and re-applies through the same funnel — so terrain-edit persistence and AOI fan-out ride the existing rails and the reconcile RETURNS the edits instead of wiping them.
• Provenance parity with the voxel kinds: applyTilemapTileOverride gains an optional authorId stamped on the stored edit command (script paths stamp the executing source entity; the god-mode tile brush's replicated authoring-input path stays unstamped and on its own lane — it never touches the rail, so no double-apply).
• Version-skew semantics (one kernel manifest ships client + server atomically, so a 5.1.x/5.2.x pin sees neither half and behaves byte-identically to today): a newer client against an older server gets cmd.err bad_payload for the unknown kind — the local apply already happened, degrading exactly to today's local-only behavior; an older client against a newer server sends no tile forwards and nothing changes.
• 2D tilemap fractional-zoom seam lines fixed at the sampler math (jacob's dirt field, #inventors 2026-07-12: 1px grass-green vertical columns every 175 screen px through a dirt tilemap — measured in the screenshot as neighbor-tile-colored, exactly every 3rd tile boundary at a 175/3 px on-screen tile). Root cause: the built-in tilemap shader's corner UVs land EXACTLY on the atlas cell boundary (tilemapTileUvRect rects + corner uv 0/1, no gutter), so an edge pixel whose interpolated tileUv rounds onto — or, under MSAA center-eval on partially covered edge pixels, past — that boundary makes the nearest-sampled floor(u·W) read the ADJACENT atlas cell's first texel column; the quad-edge/pixel-grid subphase repeats every few tile columns at rational fractional zooms, which is why the wrong-texel column recurs periodically and only "at exactly the right zoom". Fix: the fragment clamps tileUv to the per-instance cell rect inset by half a texel (rect rides a new @interpolate(flat) varying; half-texel from textureDimensions) before the V-flip and both asset taps (tileset + lit normal companion). The inset is identity for every in-cell pixel under nearest sampling (the clamp bound is the edge texel's center — no art rescale or shift, pinned by test) and is the standard gutterless-atlas containment under linear. Square and diamond variants both carry it; the cooking wash keeps raw tileUv. Same-class exposure existed in the three-era material (uv().mul(uvRect.zw).add(uvRect.xy), no inset) — long-standing, not a lume regression.
• Fixed the zombie-host class in client-auth rooms (ledger 1237): place-host assignment elected ANY Ready client, so a non-simulating instrument client (the thin-client stress harness — it ignores host.assign controls and simulates nothing) alone in a room became the place host forever: healthy input cadence kept it "alive", nothing ever simulated, and run_script/server-write forwards died in fence timeouts — strictly worse than an empty room. Fix is a host-eligibility opt-out riding the existing join payload, never a new authority path: a client appends ?hostEligible=false to the gameplay socket URL, the network worker carries it on the existing connection.attach ingress message, and isEligibleConnection (shared by place-host assignment AND the sim-lease reconcile sweep) requires hostEligible !== false. Absent field = eligible, so old clients and pinned engines are byte-for-byte unaffected; every attach adopts the NEW socket's declaration, so a later session on the same clientId never inherits a predecessor's opt-out. A room whose only occupants are ineligible behaves exactly like an empty room today: unhosted (frozen, not server-simulated), server-originated writes final at the canonical copy (no forwards, no fence timeouts), re-hosted at a bumped epoch by the next eligible entrant. The thin-client stress harness now declares the opt-out on every socket URL. Migration/epoch machinery untouched.
• Static mesh colliders map again for schemeless cdn/… asset paths (the 5.2.1-only zoo-statics regression: playground trees/rock/swap-car collided as placeholders for the whole session with [mantle] static collider failed to map spam, A/B-isolated against 5.2.0). Two halves in the collider-asset lane (physics/systems/collider-assets.ts):
  • URL half (root): the lightweight extractor lane now roots schemeless relative CDN paths (cdn/model-x.glb → /cdn/model-x.glb, the asset service's own normalizeAssetUrl semantics) before fetching. isMagicCdnUrl accepts the schemeless form (it URL-parses against a base), but the fetch used the string verbatim — in the browser runtime worker that resolves against the client bundle directory (/v4/client/<hash>/cdn/…), a deterministic 404 for every such asset. The lane had been silently rescued by the THREE.js fallback since it shipped.
  • Classifier half (what 5.2.1 broke): #8936's verdict classification skipped the THREE.js fallback for EVERY MagicCdnFetchError, but only a classified verdict — 202 still-generating, or a server-stated window (429 quota / tombstoned generation, retryAfterMs) — is an answer about the ASSET that the fallback would just re-receive. The skip is now scoped to exactly those classes; an unclassified failure (bare 404/5xx, no verdict window) falls back to the asset-service lane again, which resolves URLs independently and holds its own cache + retry ladder. The ledger-1025 park contracts (still-generating ladder, verdict windows) are untouched and pinned.
• Rapier 3D rotation readback preserves quaternion w = 0 (#9096): readBodyRotation coerced w with toFiniteNumber(raw.w) || 1, so the legitimate w = 0 of any exact-180° rotation read back as w = 1 and re-normalized into a wrong orientation; the fallback-to-1 now applies only when w is non-finite.

KNOWN OPEN AT FOLD (5.2.1 staging draft, 2026-07-13 — named honestly for the walk and the release packet; the draft:false flip is the train's separate human-gated step):

• Houses / transform-fighting cluster — RELEASE GATE, BLOCKED: multi-part assemblies oscillate between two poses on master (the 07-13 houses briefing). Receipts: two transform families are both replicated AND forwarded, and lume reads the local family via the presentation smoother while world-family forwards exist — two writers fighting at the presentation seam. Sim state is correct per tucker; renderer-read side, not physics. The 5.2.1 released flip is blocked pending jure/tucker's local session.
• 2.5D sprite TAA blur: motion vectors are absent for sprites under TAAU, so moving sprites smear/ghost under the temporal resolve. Jure's ruling: known design gap, its own thread — P0 per tiger. (World text landed its velocity writes in this draft; the sprite lane remains.)
• Text motion vectors: the remaining text surfaces on the same MRT velocity lane — plan p-0ea8336e in flight.
• Flat-world horizon: the deck streaming radius ends before vision does, so flat worlds show a content edge at the far horizon (ledger 1276) — a design item, not a regression.
• Audio clip quota cap now parks gracefully and recovers when clips free up, with a Savi-visible budget diagnostic (Jul-13 speech findings, #9087).
• 10x decoration deck limits on desktop (Jacob's ruling, #inventors 2026-07-13: "fuck it 10x the upper limit. make sure rungs degrade so we don't blow mobile memory limits"): the desktop tier baseline carries decorationBudgetScale/decorationDistanceScale 10 (geometry-budget.ts) and the desktop scatter admission ceiling rises 200k → 2M instances (perf-static-data.ts SCATTER_BUILD_INSTANCE_BUDGETS) — the default deck builds 2,000,000 instances reaching 1,120 m (was 196,775 @ 112 m skirt). Measured basis: the 07-13 flat-meadow L4 ladder (real GPU timestamps, eye-height worst-case view) — 10x is GPU-time-flat vs 1x (far rings thin under the LOD keep, blade screen size collapses); the honest cost is instance-buffer VRAM (~200 MB at ~100 B/instance — instances 80 B + survivors 4 B + bounds 16 B — for the default deck). Tablet/phone tiers hold their shipped scales and ceilings (unmeasured silicon — the ruling's named mobile-memory hazard), and the ladder's geometry cuts compose multiplicatively on the new baseline (10 × 0.5 / 10 × 0.25), rebuilding the deck smaller so instance VRAM sheds with the rung. NEUTRAL_GEOMETRY_SCALES is now its own identity object instead of aliasing the desktop baseline (composing a baseline with identity must not square the 10s); on desktop the rung-0 admission clamp is now the routine deck shape (every shipped deck lands exactly at the 2M ceiling), not a pathology signal.
• Rim height ramp for the decoration deck (jacob's occlusion-by-height pick, #inventors 2026-07-13): ground-cover cards (grass-kind + card sprites ≤ 1.5 m — the same class that defaults to the 80 m card far) grow height-only from 1.0× to DECOR_RIM_RAMP_MAX (1.75×) over the last 30% (DECOR_RIM_RAMP_START 0.7) of the item's own draw distance, holding max through the #8691 far-skirt fade — so at eye height the taller rim occludes the bare terrain band beyond the streaming radius on flat worlds instead of the field ending flush with the ground. The sampler carries the item's far in the header's spare float (countPad.w, 0 = off) and scales only the instance matrix's up column, so width/wind/tint and the fade's own scale-to-zero are untouched; the ramp is a pure function of placement distance (deterministic per seed), placement and counts are byte-identical (zero new instances), and per-entry cull spheres grow by the ramp max so tall rim blades never pop at frustum edges. Tall cards and primitives keep their authored silhouette (rimRampFar 0).
• World text billboards now resolve current and previous camera-facing poses in the vertex shader, eliminating camera-driven instance-buffer repacks while retaining entity-motion vectors. The TAAU path splits fully opaque glyph interiors from the blended antialiasing fringe, keeps distance fading continuous, preserves motion history across appearance-only edits, and uses the renderer's cutout ordering for discard-heavy cores. Scene-view captures evaluate the fade at their final output resolution.
• text and sign.text now support the sprite-compatible sortingLayer and sortingOrder fields in 2D scenes. Explicitly layered text joins the sprite depth band; unlayered and mounted text keeps physical depth. Orthographic pixel snapping now reaches live, synthetic-harness, and recorded-replay text consistently.
• Reverted the steady-state camera divergence-adoption gate (#9059, squash 5a2d7822; ledger 1265). The gate false-adopts on self-integrating authored camera rigs that keep private angle state: a script that integrates its own yaw/pitch at its own sensitivity from its own base and publishes once per update runs a second integrator against the renderer's display-rate one — two integrators at different gains diverge without bound, the ingest-interval echo envelope only extends directionally (2× headroom in the direction of motion), so the slower integrator falls off the BACK of the envelope and adoptAuthoredAngles snaps backward every few ingests (~49.5° sawtooth reproduced while rotating). No threshold fixes cumulative unbounded divergence, and extending the envelope backward would un-fix the static death-cam grip the gate shipped for. Camera steady-state behavior is restored to exact 5.2.0 semantics: custom-kind-only angle mirror (writeCustomCameraAnglesBack), parameters-only steady-state updateConfig, no divergence-adoption path. The ruling's durable shape (write-provenance authored-authority latch, #9059's own named follow-up) is ledgered separately and rides a later fold.
• Scripted-primitive transparent draws now use the shared sort-order.ts convention (planar view depth + renderOrder fold) instead of radial camera distance, restoring paint-order parity with sprites/text/effects (resx's parity report, #8776). Draw-order change only, and only for transparent scripted-material primitives — three-era parity restored.
• Reverted the 10x desktop terrain-decoration instance raise (#9095, squash 2598900b). The raised budget overflows the default 128MiB storage-buffer binding on dense default decks: the device-budget clamp caps instance COUNT (2M) but nothing caps binding BYTES, so a new game's default meadow deck binds 2M × ~77 B ≈ 154,838,720 B > the 134,217,728 B default maxStorageBufferBindingSize (the adapter supports 4GiB, but we never request it via requiredLimits) — instant GPU validation failure at CreateBindGroup ("terrain decor sampler", entries[8], compute stage) on first load. Desktop returns to prior values (decorationBudgetScale/decorationDistanceScale 1, scatter admission ceiling 200k — geometry-budget.ts / perf-static-data.ts SCATTER_BUILD_INSTANCE_BUDGETS) while a bytes-aware budget + adapter-limit negotiation is designed. The rim height ramp (#9084) is unrelated to buffer sizing and stays.