What's new

WELLE 13 SAME-PLAN-ENTITY-REF (R-1 dialog, R-2 tend). A dialog entity or a tend action can now be new:e<i>, a creature placed in the SAME batch (i = its index in the entities list). The hard part was ordering: the parser reads logic before entities, and applyOps validates each op in order against the graph so far, so a dialog/tend referencing a same-batch creature would be rejected. Fix: the parser accepts new:e<i> and emits a deferred marker (entityNewRef / a tend action with tendNewRef), an entIdxMap maps model index to entity-op ordinal, a post-pass resolves the markers to ordinals, and world-doc resolves the ordinals to the freshly assigned ids and, only when a same-batch entity ref actually exists, reorders finalOps so entity.add ops precede the first logic.add (creatures have no forward deps, so this is safe). The guard is exact: any batch without a new:e ref is byte-identical, so nothing else changed. An adversarial 5-lens sweep caught two real batch-killers that green goldens missed: a tend inside a creature's own need.actions (self or forward ref) resolved but then threw in the contract before the entity was pushed, and the op-cap trim could drop a referenced creature after ordinals were frozen. Both are now honest drops of the single unresolvable action or op instead of killing the whole build. Kernel untouched (v94), the registers for dialog and needs advertise the one-wish patterns, 5 goldens across the wave, smoke-play-make at 144 asserts.

WELLE 11 NPC NEEDS (N-1..3), the life-sim core. Kernel v93: an optional need on any creature {kind: hunger|energy|joy, rate 1-20, actions?}. s.need is per-resident pressure that rises rate*dt (cap 100), NEED_HI=70 crosses once (needFired latch, the atHp threshold pattern generalized from hostiles to ANY behavior) firing need.actions plus a need event, NEED_LO=30 re-arms. need/needFired are ephemeral run state (like enemy hp, never saved). A new tend reference action {do:'tend', value:'<creature id>'} on any edge drops the pressure to zero and re-arms, the relief side of the same EB decoupling. It composes with everything without a new gate type: the need-high fires emit/unlock, doors gate on those via the existing requiresUnlock/on_event, and a dialog choice carries tend. E2E catch during the build: the tickLogic early-return guard did not know need, so a resident-only world (a hungry farmer, no logic nodes) stood still, green goldens masked it because the first golden happened to carry a logic node, fixed with a hasNeedNpc guard and a node-less golden. N-2 makes it speakable: parser passthrough with a self-contained action whitelist mirroring atHp, a tend action case, and an own NPC NEEDS register chapter. N-3 is the theater: a mood icon over the resident driven off the live needFired latch (not the one-shot event), so it clears the instant you tend them. 11 goldens across the wave, smoke-play-make at 131 asserts.

WELLE 10 DIALOG TREES (D-1..3). Kernel v92: dialog is a logic kind {entity, lines:[{say, choices:[{label, actions?, goto?}]}]} with caps (8 lines, 4 choices, say 140, label 48). s.dlg holds the ephemeral conversation cursor, s.dlgDone is the persistent quest truth that travels through the saver, the account whitelist and restoreState. E opens within reach (enemyPos feed so wandering NPCs work, slain partners stay silent), a new one-shot dlgChoice arg (1-4) picks, goto jumps, a choice without goto ends the talk, walking away aborts without marking it done. Choice actions fire the full reference family (xp, unlock, emit, counter, item, target, entity), and requires on a dialog id gates any node on 'finished that talk' (the reqMet quest core). D-2 makes it speakable: a parser branch mirroring every cap with honest errors (no silent B39 swallow), parseActions per choice, reqAllOf, an lgIdx entry for same-plan requires, plus an own DIALOG TREES register chapter with its own trigger and the composition flagship. D-3 is the theater: a dialog panel (speaker from the entity, line, numbered buttons), the one-shot wired into the single tickLogic call, a keydown guard so 1-4 win over the hotbar while a talk is open, and nearDlg threaded through all three interact-pill gates so touch players get an [E] talk button. Build catch: the first kernel insert had left the graph-reassign line (locked-node invisibility) behind an if(false); caught at the seam review. 12 goldens across the wave including a full pipeline roundtrip, smoke-play-make at 112 asserts.

WELLE 9 XP-KURVE (X-1..3): the continuous stream beside the binary unlocks. Kernel v88/v89: s.mxp in both state lists, xp:<n> as a reference action on any edge (1-999, NO once-latch since grinding is legitimate, cap at 1e9), the curve lives in the kernel as xpFor(L)=25*L*(L-1)/2 with levelOf derived and exported so client and goldens compute the same truth and level is NEVER stored. The levelup event fires only on threshold crossing (LVLQ rides the EMITQ pattern). requiresLevel gates any node through the existing requires filter. Honest find while building: the filter's ACTIVATION gate (nodes.some) did not know requiresLevel, so the whole filter never ran for level-only worlds. The golden caught it immediately, the same class the night radar kept finding in display gates. Persistence: the saver carries mxp, the run-end wipe reduces to {meta, mxp}, the account validator takes the existing number path, restoreState turns junk into 0. Speakable end to end: parser xp case in its own namespace, requiresLevel through the reqAllOf helper into every requires branch, an own XP AND LEVELS register chapter with an honest curve table, and a second softlock guard that also catches mixed level-plus-unlock full locks. Theater: the LEVEL banner shares the unlock stagger queue so same-tick celebrations never overwrite each other, and the star chip renders the kernel's own curve. 13 goldens across the wave, smoke-play-make at 84 asserts.

RADAR-NACHT: a 23-agent adversarial workflow over the four night waves (MP rounds, late-joiner snapshot, crafting, meta progression), 18 confirmed findings, all fixed in client v329. Highlights: the run-end wipe deleted the dg_run blob including meta, so a run-ending win erased the unlock it just granted (wipe now REDUCES to {meta}); the recipe pill was dead code because the two display gates were never extended and the kernel E-priority put harvest before trade; the round loser was never counted because the done-gate discards the remote win (fixed via a 5s killer-memory); the late-join answer condition was unfulfillable on every transport because the roster never contains your own key (candidates now include self); a scope ReferenceError killed three context chips per item menu; and the routed workbench could bind to a kit tree via a planIdxMap ordinal offset. Plus: meta-filtered pill targeting, room-bound snapshot requests, match-state reset on world mount, unlock celebrations staggered on run-ending edges, requiresUnlock extended to collect/harvest, honest register wording, cost range errors, trigger regex. The meta lesson is now doctrine: green unit goldens never prove the client flow, so every wave ends with an end-to-end thread or a radar sweep. The UNLOCK GALLERY chip shipped on top: it renders when meta has entries, shows the count, and taps to a Title-Case toast of your unlock names, with the full display path pinned in the smoke gate. smoke-play-make at 71 asserts.

WELLE 8 META-PROGRESSION (M-1..3): the third layer beyond run state. Kernel v87: s.meta in both state lists (boardPos law), unlock:<slug> as a reference action on ANY edge (once-latch + UNLQ theater event, EMITQ pattern), requiresUnlock as a node gate riding the existing requires filter (locked nodes are invisible to nearest* and win paths). Contract additive with NO existence coupling (the EB decoupling pattern: the unlock can come from any edge, the gate from any node). Persistence: meta travels through the dg_run saver, the account whitelist (BOOL_MAP family) and restoreState (slug-validated; world binding comes from the per-world blob for free). Parser: unlock action in its own namespace (deliberately NOT counted against the 32-event-name cap, golden proves the 33rd slug), requiresUnlock rides the reqAllOf helper into all four requires-capable branches (junk gets an honest error; drive-by bugfix: the early requiresAll error return used to swallow the field). Register: an own META UNLOCKS chapter with its own trigger (the PM-3 colocation lesson) teaching the composition plus the SOFTLOCK RULE. Prover: walkable stays structurally permissive (never stricter than runtime), and reachabilityNote gains the softlock guard: if EVERY win path requires an unlock, the creator gets an honest line before players can get stuck (golden proves both directions). Theater: the unlock event shows an UNLOCKED banner plus a companion line. 9 goldens, smoke-play-make at 70 asserts.

WELLE 7 CRAFTING (C-1..3), judge damper #1 closed. The sounding found the whole axis was COMPOSITION away: the workbench existed as vocabulary (a trade node bound to an item) and the only missing piece was ONE kernel line, the trade-to-tool bridge (inv[tool] >= 1 counts as ownership for tool-gated harvest; FOREVER golden: without the entry, denied exactly like before). C-2 added additive recipe costs (trade.cost 1-99, kernel deduction + affordability filter in nearestTrade, parser mirror), taught the workbench recipe in the PLAYERS-CAN-BUILD and MINING register chapters, and put the full progression tier into the survival-island route (table + trade wood to pickaxe cost 3 + tool-gated rock family, 5 rocks via family resolution). C-3 ships the hand path: a 🛠 context chip on table-family items (make/unmake workbench over the ONE ops channel, id collision guard, door-chip pattern). Proven end to end in a 7-act harness: rock denied, chop, scarcity at cost 3, craft, rock falls, stone, FOREVER act. Judge rescore of the crafting axis: 7 to 8, honest remainders documented (no recipe menu per bench, no crafting UI feedback in-world, no multi-stage chains, no tool wear). Kernel v84/v85, client v328, smoke-play-make at 60 asserts.

MP-PERSIST LJ-1..2: hostless late-joiner snapshot on the pvp_kill convergence family. The joiner sends a one-shot pbreq (2s guard, re-arms on room change); every peer deterministically computes 'am I the lowest key besides the requester' so EXACTLY ONE answers; the state travels as pbsnap chunks of 30 blocks (pure pbSnapChunks, measured under the 6KB transport limit per chunk); only the addressee applies, as free place claims carrying the original owner stamps, so break-only-yours stays true. Kernel untouched; cell idempotency makes double answers and re-requests structurally harmless (golden: double apply is byte-identical); pbSync mounts meshes and colliders for free. Edge goldens: empty state sends nothing, single-player rooms stay silent. Client v326/v327, moloch only 2 delegation lines, smoke-play-make at 58 asserts.

PVP-5b MP round frame (R-1..4) + the three ops flips. Design improvement over the memo: NO host arbitration. Every client counts the SAME shared W2a outcomes (own win = NET.key, remote win now carries byKey on the result card call), so the series converges exactly like team counters (4th use of the pvp_kill convergence pattern) and the host-leave problem vanishes structurally. Between rounds: ROUND r/N banner + tally + companion line, then a 3-2-1 countdown and re-arm for everyone over the SAME studioPlay path (B160 law: identical 1300ms wait keeps countdowns aligned; team spawns included). Match end: champion card with the full tally for the whole room; leaving mid-countdown aborts silently. The counting core is a pure exported function (matchRoundStep) with convergence goldens: two independent counters fed the same event sequence produce byte-identical series state (best of 3 and the open 2:2 best-of-5 case). Solo match frame stays byte-identical (pinned); series state is ephemeral client state, never logicState or graph (doctrine pin). Ops: the player-state migration ran (table+RLS+roundtrip verified, account persistence live), NEXT_PUBLIC_MP_SDK=1 and NEXT_PUBLIC_MP_TRANSPORT=relay are set and deployed, harness 4/4 on the REAL Cloudflare relay. Client v324/v325, smoke-versus at 41 asserts.

WELLE 6c BLOCK-FORMEN (BF-1..2) + Create-Flow nach Owner-Spieltest. Kernel v83: closed shape catalog on the place claim (block, slab, stairs; unknown defs degrade honestly to block, also on restore) + optional rotation claim.rot to placed[id].ry (90|180|270; absent = no field, FOREVER golden proves byte identity); d+ry travel through restoreState AND the account validator. Client v322: ONE mesh factory for world and ghost (slab half-height seated on the cell floor, stairs as a two-box group, rotation.y from ry), slab COVER top = cell middle so slabs are WALKABLE steps, ghost rebuilds on shape or material change, traverse-safe disposal for groups; stairs carry TWO cover entries (rotation-aware half steps) so you genuinely walk up them, a same-day judge finding. Controls: scroll cycles the shape (wheel owned only while the build hand is armed), Q rotates (conflict-checked: editor and creator hand are gated off in build mode), touch gets shape+rotate chips (visibility ratchet consciously 49 to 51, chips only visible in active build mode). MP: the pbld broadcast carries d+ry and the mirror validates both. Create flow: the one-option category interstitial is gone (one click into the world), starter cards prefill an editable sentence instead of auto-sending (agency rule), the extra chip row was removed, and roughly 40 em-dashes were swept out of product copy (standing language rule in memory). 6 new goldens, smoke-play-make at 53 asserts.

WELLE 6b GRUND-SPIEL (GS-1..3b) + POLITUR-MEGA-SWEEP. Grund-Spiel: the night-one survival loop composed from EXISTING vocabulary only (11 ops, zero new kernel paths) and proven end-to-end in a kernel harness (9 acts: harvest→build→night→danger→survive-3-nights→win→persistence; scripts/gs1-grundspiel-probe.mjs). Shipped as a routeWishDirect entry (pre-model, zero credits): forest kit + family-resolved chop rules + nightOnly zombie spawner + B81 nights counter (counter winAt 3 + phase-dawn +1) + building/timeCycle/startInv, with a re-build guard. REAL vocabulary gap found+closed while composing: harvest could NEVER reference kit trees (parse-time vs expansion-time — the register's 'attach automatically' claim was false); new FAMILY RESOLUTION (items:['tree'|'rock'|'bush'] binds this plan's items, model path included). 2-HIGH LAW measured (npcBlocked height filter): single blocks are step-overable, 2-high walls truly stop monsters — taught in the register, pinned in the gate. Discoverability: 🌙 starter chip + the Survival category card now hit the deterministic route (emoji-proof wish normalization). Politur sweep (58 agents, 6 dimensions, adversarial verify): 50 confirmed findings, ~41 fixed across kernel v80-v82/client v315-v318 — incl. a 2h prod boot outage (TDZ class, now fenced by a boot-proof law), survive-timer wins flipping to losses, held-weapon persistence, chest actions never firing, the works. Gate grew to 45 play-make asserts + 6 new parser goldens.

WELLE 6 PLAY=MAKE (PM-1..4), the structural answer to the Minecraft-gap analysis ('bei Minecraft IST Spielen=Machen'): (1) Kernel substrate — place_block/remove_block claims over the ONE applyClaim channel (settings.building opt-in, 1 resource per block from s.inv, cap 200/run, bounds ±200/y0-60, cell idempotency, refund on break); DOCTRINE golden: the graph hash stays byte-identical — players build their RUN, never the creator work (Ladder pillar D), which makes persistence free (placed rides the P-1 saver + P-2 account validator). (2) Client verb createPlayBuild — visitor-B (creator-B stays the editor), ghost cell + Minecraft stacking (pure pbStackY), mesh+COVER colliders DIFF from state.placed so boot/reload/account-return mount for free; new gotcha class found+fenced: the final STUDIO_CLIENT export object REPLACES early attaches (regex guard now in the gate). (3) Material family v2 with zero kernel change (the claim channel was already resource-generic — proven by an end-to-end stone golden) + the register wiring gap closed: the PLAYERS-CAN-BUILD teach only fired on DOOR wishes since PM-1; it now has its own trigger chapter — z7-play-build standing live guard green 2/2. (4) MP shared building v1 via the pvp_kill convergence pattern: builder pays + broadcasts pbld, every seer applies the same claim free:true (kernel v79 prevents double-cost), state.placed converges, owner stamp o makes break-only-yours real (and survives both persistence validators). Honest v1 limits: no late-joiner snapshot (MP-persist act after the env flips), desktop-first (touch/hotbar = PM-2b), no crafting recipes yet (1 resource = 1 block). Judges (code-evidence, one adversarial): Survival 4-5→7, Crafting/Building 2→6-7, Sandbox convergence 1-3→5-6 — 'no theater at the loop itself'. Kernel v78→v79, client v309→v313, smoke-play-make 41 asserts in the gate.

WELLE 4 PVP (PVP-1..5), Audit-Hebel #4 (CoD-Nordstern): (1) SDK-Weiche — ArenaRoom routes through the orphaned-no-more B259 MP-SDK behind NEXT_PUBLIC_MP_SDK=1 (default-off, byte-identical live path; Live-Ops law), transport switch supabase|CF-relay; harness-proven 2/2 per transport incl. the real dg-relay worker (roster convergence, event roundtrip, setName-in-place with STABLE key = invite-pairing law, leave shrink). (2) Teams: key-hash parity (stable, roster-independent, no mid-game flips) + settings.spawns consumed for the first time since B6 (team-filtered deterministic spawn choice) + team puppet tint (red/blue beats personal palette only in team worlds, B162 retint chain intact). (3) Versus damage: settings.versus (three-site key WITH its golden — the Ladder condition honored), pure pvpConeHitsX cone over player puppets, victim SELF-AUTHORITY (ARROWFALL model: emit wrun{ev:pvp,t,d}, only the addressed victim feeds the ONE damage flow BEFORE the protect mask — spawn protection, lives and the respawn ladder cover PvP for free, ZERO kernel change). (4) Kill feed: 5s attacker memory, death carries `by`, kill toast + counter, 'X GOT Y' for the room (plus an English-only fix on the old German down-banner). Honest limits, documented: no server authority (stakes stay closed), MP match/rounds frame = own act (PVP-5b), no ranged PvP yet, kills not yet a win condition. Judges (code-evidence): FP-Shooter 2→4.5, Melee-Arena 2→7. Owner env flips ready & proven: NEXT_PUBLIC_MP_SDK=1, then NEXT_PUBLIC_MP_TRANSPORT=relay.

WELLE 3 PERSISTENZ (P-1/P-2), Audit-Hebel #3 (restore dropped held gear/counters/switch levels — the S5 finding): restoreState + the dg_run_ saver now carry the full run families (counters/sw/actFired/ctEm/evOn/evFired/doorOpen/gateSet/entB/held/heldTaken/slain/kills/lives), each validated against the world (ghost ids/enums fall silently); attack fields (hp/done/outcome/timerLeft) NEVER travel — the anti-softlock/cheat guard, doubly enforced (blob whitelist has no such keys + restoreState keeps them fresh). Deliberately fresh: plates (momentary), comb/phase gates (derived per tick), wave state (waves honestly re-run), felledAt (regrow re-arms). P-2 server side: studio_player_state (PK user×world, RLS service-role-only), /api/studio-3d/player-state GET/POST (auth/origin/rate/uuid, column-tolerant soft fallback while the migration awaits the owner click), ONE shared whitelist validator (8KB honest reject), client psPull/psPush/psClear (pull fills empty localStorage + refresh convergence = device switch; push 10s-throttled; 401 latch keeps guests silent; clear wipes the account blob too — the finished-run law). P-3 consciously cut per the demo-gate doctrine (no persist opt-out without an exercising golden; MP-persist = documented follow-up on the W2b claims pattern). Kernel v75, client v305, two new gate smokes (restore-truth 12, player-state 13).

WELLE 2 ITEM-STATES (IS-1..IS-4), Audit-Hebel #2 (items were stateless furniture): interact nodes learn door:true (E toggles instead of one-shot; doorOpen level in run state, both state lists) + actions on interact (edges fire on OPEN — Command-Block semantics, doors ring the bus). Locks are pure J3 composition (needs on the interact node; open pays, close is free — denied receipts intact). Client: generic doorTheater in studio-client (1.35rad swing + studioItemColOff + coverDirty — def-free; per-state visuals stay a future additive item-factory extension), one moloch delegation line. IS-4: item:<id>:open|close|toggle as a reference action on EVERY edge (DOORQ mirror of the GATEQ doctrine, idempotent-silent); IS-2 honestly CUT (on|off fully covered by the EB-3 target action + light class — orthogonality law). Hand path: 🚪 right-click chip (make/unmake, one ops channel, id-collision guard). Chests stay byte-identical (FOREVER golden). Kernel v73/v74, client v303/v304, smoke-item-states 21 asserts in the gate, z7-door-key standing live guard green n=2 on the first attempt — the wave-1 teaching patterns paid out immediately.

EVENT-BUS Welle 1 (EB-1..EB-5), Hebel #1 aus dem Sandbox-Generalität-Audit (Kuration→Komposition): emit:<name> as a reference action on every trigger + on_event listener kind (once/actions/targets/wins/loses), tick-local drain with a 16-emit cycle budget and honest event_overflow, latch truth in state (evOn/evFired — both state lists). Counters: ±n arithmetic (one kernel path), emitAt thresholds [{n,event}] with once-per-threshold + reset re-arm, actions cap 4→8. target:<id>:on|off|toggle switches gates/platforms/lights from ANY edge (gateSet level truth, one flush after the bus drain); entity:<id>:calm|hostile|stop|resume flips behavior incl. from boss atHp edges (entB override, mapped at the stepper source). Combinators nest (sequential existence = constructively acyclic, same-tick levels in node order) and accept counter>=n boolean inputs. Hand parity: 📣/🔔 logic stamps (B95 autoTarget). The road to live: 4 live-anatomy rounds each yielding a deterministic law/tolerance (parser knew neither emit nor on_event — the four-site law; alarm-indirection law; pseudo-target tolerances on both sides; 1:1 name-coherence law), z7-event-bus standing live guard green n=2 on the haiku lane. One shared proof smoke (smoke-event-bus, 68 asserts) covers contract+kernel+oracle+parser+laws+stamps; winnability oracle taught emitter anchors (never falsely refuses). Kernel v68→v72, all additive, old worlds byte-untouched.

W8-POLITUR: an 8-finder multi-agent code sweep (42 raw findings → adversarial verify → 15 confirmed) plus the owner-reported grass bug that started it. Shipped: ambient-scatter respects COVER/fluid/shaft/patches/mapBounds via a scatterOk bridge and rescatters per structure refresh (plus two self-caught fix bugs: a visible-guard that deleted-but-never-rescattered on island worlds, and the bridge landing in the wrong module ctx); boundary fence generated from mapBounds edges (rect/circle, half+8 — the real W3 clamp line) with a signature cache instead of fixed R=210; weather particles+bed damped to zero indoors via the existing _inK/_inside truth (Web-Audio ramp hardening: fixed per-kind bed base + cancelScheduledValues); NPC optics signature (skin|body|behavior|hpTier) remounts on entity.edit drift; grundriss slab keys (slabKey AND watchdog, in sync) carry groundTheme+tint; LEGO/kick bounce on surfaceAt ground truth; 🌾-brush candidates filtered through scatterOk with 3x oversampling and an honest empty-toast; ambient life on coverGround with filtered firefly anchors (signature-cached) and the stale 120 fallback fixed to the real 240 default; tuft scatter rectangular over mapBounds, area-scaled with a ?qa cap; build-bounds and editor pan clamped to the real map edge (plaza untouched); cloud wrap threshold follows half+fogF in studio (ARROWFALL byte-identical). Horizon-fog scaling consciously deferred (global look change, only pays on large night worlds). Every fix: guards, full gate, browser proof, live-prod grep. Then we reviewed our own night's work with a 32-agent adversarial pass and fixed nine follow-on defects it confirmed (weather-kind switches inheriting stale opacity/volume, circle-map corners, non-square-map axes, FogExp2 NaN, legacy-world edit bounds, a GPU leak per refresh, an over-eager coach line, and two build-story page inaccuracies), and a screenshot walkthrough added three more: horizon ridges no longer float as white blocks in the void-sky (an island in space has no horizon), and rain/snow are now fine pixel-sized particles instead of fist-sized glowing quads near the camera.

W7-MATCH v1, the top lever from the sandbox analysis (verbs existed, game-sentences didn't). Architecture: a round IS a kernel run — the one-win-per-run doctrine, replays and the winnable oracle stay untouched; the frame lives in studioResultCard where the card and rearmRun already coexist (zero new bridges). settings.match {rounds:2-9} typed through all three gates (contract closed-keys, parser object channel ahead of the whitelist, situational prompt teaching) + EN/DE sentence law incl. word numbers (two..nine/zwei..neun), silent on model hits. Mid-series: banner + companion line + rearmRun, no card; decided: card with tally line, matchState cleared (GO AGAIN starts a fresh series). Solo-gated (NET.on = byte-identical legacy). Proven end-to-end in the browser mock (win → 1:0 armed round 2 without card → win → 'match 2:0 (best of 3)' card) plus contract goldens 4/4 and 9 functional guard pins. Two measurement lessons for the doctrine: goal-worlds boot behind the 3-2-1 freeze (burn it with fixed-dt ticks before probing), and compressed test pacing overlaps the 1.4s/1.2s card/rearm timers into phantom races — probe at real timer pace.

Wave 6 'systemic depth', five deploys (kernel v66→v67, entities v13→v14, client v294). W6-1 MATTAB: visible flammability table (the TotK move) — MAT_FLAM_DEFAULT def-class in the kernel + settings.matprops override that beats even declared harvest-fx:burn, per-def MERGE, ignition/propagation/burnout generalized to free items (run-scoped: felled+regrow for harvest members, itemHidden for the rest), sentence laws EN+DE, closed property keys at all three gates (contract, world-doc chain, parser object channel — the B127 silent-drop class). W6-2 OFFTICK: the solo save blob had neither timestamp nor felledAt — regrow was dead across sessions; now at+fAt travel, a boot catch-up resolves regrow clocks against real elapsed time BEFORE restoreState (kernel stays Date-free), unripe clocks continue in-session via negative felledAt. W6-3 NEEDS v1: schedule residents without work auto-commute to the nearest harvest/build_site/trade/deposit within 60u (st.autoWork, runtime-only; two traps caught live: the entityStep copy-list dropped the field, and a mount race froze null). W6-4 RULES: settings.rules with a closed vocabulary — fear {who,what,r} (entities: forbidden ground, radial edge-pin, proven at exactly r in-engine) and fireSpread {mult} (kernel: ignition-delay multiplier, tempo golden 3/2/5 ticks for 1×/2×/0.5×); per-key merge, sentence laws, no scripting by design. W6-5 WIRES: editor overlay draws every logic edge as a terrain-riding bezier (mint targets / amber actions / cyan combinator inputs) with direction dots, ED.on-gated, signature-cached, disposed on exit. Every batch: goldens + functional law smokes + browser proofs + live-prod source greps.

First community bug report, and a real one. The arena's quit button posts pe-worlds-nav {to:'plaza'} to its parent — but only the ARROWFALL wrapper ever listened; the /w player-world wrapper (WorldTogether) ignored it, so the click collapsed to closePause() = Resume. Fix: WorldTogether now handles pe-worlds-nav (plaza/discover → /discover; the pagehide session beacon fires as on any exit), and openPause labels the button honestly per context (hub: 'Leave to Discover', player world: 'Leave the game', match: 'Back to Lobby'). One guard pins both sides. Bonus lesson for the gate's hall of fame: the first fix attempt put an inline // comment mid-line inside openPause — a ONE-LINE function — commenting out the rest of the body including the closing brace; smoke-arena-syntax caught the unparseable module and the broken state never reached prod.

Wave 5, all five gaps from the honest sandbox verdict, one deploy (client v293). W5-1: drawer rows post pe-studio-undo/pe-studio-history to the parent; undo hits the existing ledger-linear /undo route, history opens a new EARLIER VERSIONS sheet over GET/POST /snapshots (restore-diff through the ONE write channel, itself undoable; auto-snapshots per build/hand-edit/publish already existed server-side). W5-2: the solo stage + genre tiles were locked behind a ?flow=c experiment param nobody saw — now the default for any world without user history, plus a castle tile that teaches dungeon/switch-gate phrasing. W5-3: ✨ ideas panel in the drawer (8 tappable capability wishes, they land EDITABLE in the composer, never auto-send) + a deterministic TRY_NEXT rotation seeding the existing follow-chips channel when the LLM sends none. W5-4 turned out to be built but invisible — struct select/drag/rotate/scale/delete all existed; the select toast and the ❔ card now teach all four verbs (desktop+touch). W5-5: the engine posts two fingerprint-free perf beacons per session (30s/150s: fps EMA, renderScale, glow census, DPR, coarse class) → /api/telemetry/perf → perf_profiles (column-tolerant until the migration click). Guards: 6-pin W5 block, fixed-surface budget consciously 46→47 (the ideas panel), ratchet 947/15/9179, version ritual to v293.

B250, the render-budget pass behind the owner-reported look-around stutter. (a) The adaptive resolution controller is BACK, but resolution-only: a frame-time EMA on hitstop-immune realDt steps renderScale by 0.1 between 0.55 and the KeyO ceiling, 2.5-4s cooldowns, applyRenderScale only on change — the old adaptive loop died for toggling shadows/bloom (shadow-map rebuild = the walk freeze), so feature toggles stay banned and guards pin their absence. (b) An emitter census (~2x/s scene.traverse counting BLOOM_LAYER bits) gates bloom pass A: no live emitter means no darken/restore material-swap traversal, no half-res blur chain, no full black-scene render — pass B (grade+ACES) always runs, so there's no color jump when the census flips, and the mix pass is disabled so no stale glow texture bleeds in. ARROWFALL (moon/torches/blade always glow) is untouched by design. Perf overlay now shows % res and 'glow idle'. Verified: full gate green, kit-worlds harness 14/14 against the new path, 4 live-prod source proofs.

Wave 4 C+D+E. C: CreateStudio posts pe-studio-say on successful builds and job completions; the client (v292) renders a canvas-sprite bubble (two lines, 4.6s, one at a time) that FOLLOWS the live camera every 50ms — a one-shot pose read proved wrong in browser runs the moment QA-teleports/swoops move the camera, and even a test mesh at the stale position stayed invisible; the follow anchor is the truth. Gated off in the editor bird view. D: the edit↔play switch runs a 450ms veil (independent setTimeout chains, not rAF — headless/throttled tabs stall rAF and left the veil stuck) so the void-island↔sky flip reads as one breath; the ⋯ drawer persists across both modes (DOM-proven). E: an anti-clutter ratchet joined the gate — the client's position:fixed surface count is pinned (≤46); any new floating chip must either become a drawer row or consciously raise the pinned budget in the same commit.

Wave 4 'ONE grammar', steps A+B. A: the fixed grid (320-380px chat column + world) died — the world iframe is the inset-0 layer, chat is an absolutely positioned overlay (min(420px,94vw), max 58vh, blur panel, collapsed = one pill with the live build-beat), empty worlds center the single panel, mobile is a bottom sheet. B: found that the embed had already hidden the iframe's own mode-pill bar (no double buttons) — which made ⚙ pause, ❔ controls and 🤝 invite UNREACHABLE on /create; a single ⋯ drawer (client v290) now hosts 🧍 look / ❔ controls / ⚙ pause / 🤝 invite / ☰ outliner (build-only), the standalone avchip stays standalone-only. Proven in an embedded browser run (drawer mounts, chip gone, rows fire — controls card opens). An anti-accretion doctrine is now pinned by guards: future surfaces must be drawer rows, a new fixed chip in the embed fails the gate.

Client v289 + engine. Clouds: the frame-loop visibility gate grew galaxy/void next to night. Horizon: studioHorizonMount's MeshBasicMaterial ring (deliberately unlit, 'fog tints it') never re-tinted per sky — recolorRidge now also colors STUDIO_HORIZON (fog.lerp(ridgeTint,.5)×ridgeDark, TDZ-guarded) and the mount tints into the ACTIVE sky immediately; browser-proven under galaxy (cloud InstancedMesh visible:false, silhouettes dark). Bounds: the studio walk clamp moves from the 210u sandbox ring to the actual mapBounds edge +8u — rectangle per-axis with velocity kill, circle radial (shape:'circle'), CDP-proven: teleports to ±500 settle at exactly r=68 on a 120-circle world; ARROWFALL keeps its own ring untouched. Wheel: fpbWheel early-returns on an unarmed hand (FPB.def null) — palette/R-pick arm as before. Four W3-RUNTIME source guards pin all of it; version ritual to v289 enforced by the gate.

Wave 3 of owner playtesting. Starter worlds: createGame({starter:false}) — STARTER_WORLD_OPS stays for existing worlds' replay ledgers (forever-compat), new games get the blank meadow graph. UI: Add-app chip + iOS A2HS banner removed (silent pwa_standalone telemetry survives), the ⏱ restore-points header panel (restore list, description, audience, export) is out of the header — all server routes live on for the future ⋯-menu; the manual 👻 preview toggle is gone (destructive wishes still auto-preview with keep/discard), the EN/DE voice-language toggle fell (navigator.language decides). Voice: a deterministic friendlyVoice() softener now runs over every outgoing say/receipt (em/en-dashes become comma pauses, word-hyphens untouched) plus a VOICE doctrine in the build prompt (casual, contractions, plain punctuation, max one emoji) — five new smoke guards pin it.

qa-kit-worlds-probe.mjs grew to 14 numeric probes (CDP + static mock, on-demand — never in the verify gate). New this round: the first WIRING proof (switch targets a dungeon gate: closed blocks a real W-walk, E opens via STUDIO.gateOpen, the same walk then passes), a dug-basin proof by elevation delta (arena terrain carries base height — absolute y lies), and the full survival loop against the real kernel: defend-breach → logicState.outcome 'lose'; fist-kill clearing the single-wave spawner → the wave-clear win edge (world-logic: all waves-spawners done). Hard-won harness doctrine now in comments: lose is terminal (fresh run = page reload, the mock world persists), the late mount after reload resets the player to spawn (re-teleport inside the loop), spawner distance is stage design (default aggro eye is 18u), and teleporting INTO a solid does not eject — wall tests must walk and block.

B322 is the series' first browser proof: qa-kit-worlds-probe.mjs (CDP + static mock + __test.tp/tick, yaw self-calibration by measuring actual movement, and a hard-won lesson — teleporting INTO a wall does not eject, so wall tests must be walk-and-block, not eject checks). It caught npcProximitySay never running in prod (the player object is P.pos, not P.position — the guard swallowed it silently; client v288 with the full 4+1 version ritual) and the sealed-castle class (gate ops compile as role-gate wings that stay CLOSED until wired — right for dungeons, wrong for a peaceful castle; castleKitOps now uses ring_wall gates:1 plus a wall opening on the keep, entrance axis east). B320 gave B115b hunters vision.range 36 and added the ENTITY-AS-ITEM normalizer (models writing {def:'hostile'} into the plan lane get real entities with their hp/dmg/vision carried over). B321 taught the def-mention quality gate the logic chain — equip/tool/yields/resource satisfy a mention, so 'mine stone with a pickaxe' can't be flagged for missing stone items again — and the keys-gate watch accepts any gate-bearing structure as a wiring target.

B318 reuses VillagePlan.housePlan (door opening + window + solid roof, BFS-walkable since the village solver) as the deterministic floor for the building family, with a numeric-role strip (solver roles are channel-foreign) and a south-edge gate surgery for doorless model structures — castle/village/city keep their own channels, floors/resize wishes stay edits. B319 fixed a double root: no law used the existing B100 say vocabulary, AND a say-entity was mute without trigger wiring — which is impossible to add in the same turn since entity ids are server-assigned. The runtime half is the proximity bubble (client v287): npcProximitySay iterates live NPC records at 400ms, 4.5u radius, 12s per-NPC cooldown, an approach flag against re-triggering, one speaker per approach; physTick feeds the player position. The version ritual (index pin, three smoke pins, sha manifest, winnable pin) was enforced by the gate itself — both forgotten spots went red before deploy, exactly as designed. The law extracts quoted lines verbatim (a plural-s regex find: 'says' never matched \bsay\b) and gives voiceless model NPCs a friendly default.

B314 taught the canon matcher three tricks: entries can carry functional presence guards (maze skips when the world already has 8+ walls, race when a checkpoint exists), size words are stripped from the noun before matching and applied via the size hook, and the mandatory leading article fell (bare 'zombie survival' never hit the 0-token lane). B315 gave the B113 mining law an acted-branch: plan rocks without a chain get harvest(pickaxe, ore, 3 hits) on their refs, world rocks by id, a missing sink gets crate+deposit (wins only when no other win exists), equip only when the law lays the chain — with a FOREVER guard pinning the empty-plan recipe byte-identical. B316 is the twelfth kit kind, born from live anatomy (fp-lane runs showed 0 structures once, an 8-op hut the next time): ring wall + 4 corner towers + south gate + walk-in keep (gate+roof), ~17 ops, no combat per the peaceful-castle doctrine. Building it surfaced two ordering traps now pinned by guards: 'make the towers taller' must stay an edit (resize words + existing tower/ring_wall structures silence the kit), and the size law MUST run below every kit law — it sat above the new castle law and silently dropped 'giant'.

Three law batches. B310 wires size through all three layers: the router maps big/huge→3 and small/little/tiny→1 onto kit.size (it was matching those words and discarding them), a central law scales any law-injected kit (DE words included, model-set size always wins, compositions inherit), and the forest-density quality bar rises to 20 trees for 'big' wishes — with the existing kit counting as +40 so kits stay silent. B311 injects the live-proven spawner(waves)+defend pair for survival wishes (wave count parsed from the wish, skin from the enemy word) and goal_zone(hold:30) for KotH; live run 3 found the defend-word rule: if the wish literally says 'defend', a model kill-counter does not replace the protection ring. B312 adds the treasure chain (plan-chest by ref, world-chest by id, or a hidden chest + interact-wins node) plus mode canon entries where router patches carry logic nodes (an existing parse key — no contract risk). Bonus matcher fix: the canon required a leading article, so bare forms like 'zombie survival' or 'forest' never hit the 0-token lane — the article is now optional while questions and edit forms still pass through to the model.

Graveyard and arena kits follow the station pattern (seeded generators, injection laws with preventive surgery, prompt lessons, adversarial z7 scenarios, live n≥2 both lanes — arena's run 3 found a missing practice-corner surgery that shipped the same hour). Composition is the structural step: the kit channel accepts an object OR an array of at most 2, with a mechanized FOREVER guard proving kit-[x] emits byte-identical ops to kit-x. The forest law composes [forest@player, camp@clearing] where the clearing is recomputed exactly (the channel's seed formula plus one LCG step gives the angle; distance is R*0.35) — and a model that answers with a single camp or forest kit gets upgraded to the pair, keeping its position. Live anatomy of three deterministic reds exposed three roots, all fixed deterministically: the B224 forest-density quality gate was kit-blind (a kit IS a forest — now counts +40 trees, killing a 77-op repair spiral); kit+giant-plan turns now trim the plan to 24 before the plan lane so kit ops never get capped away; and the agenda-TTL line in the build route appended up to 2 settings ops AFTER the 64-op clamp, hard-killing any exactly-full batch with "65 > 64" — a headroom clamp at 62 plus a position-pinned guard keeps that class dead.

Six new deterministic kit generators (LCG-seeded, ≤48 ops, group kit-<kind>-N) in the pure server module, each shipped with the station pattern: injection law (build-verb OR article form, editish silent, existing-kit silent, model-acted threshold), preventive surgery stages baked in from day one (corn+barn+animals, firepit centroid, pool underlay + rowboats, torch rows + chest, bench pairs + flower beds, pine grove + snowman + ground=snow), a prompt lesson, an adversarial z7 scenario with a lazy negative graph, and live proof n≥2 against prod. Winter got an honest dual design: NEW scenes get the kit, but transformation wishes ("make it snowy") and winter-flavored subjects ("a winter village") only receive a settings overlay (ground+weather=snow) — the subject keeps its own channel (SUBJECT-BEATS-SETTING), and a resize trap guard keeps "make the snowy hill bigger" untouched. The Pre-Model-Router grew to 15 canonical short wishes answered with ZERO LLM tokens (all nine kits + village, city, town, market — a new coverage guard asserts every kit kind stays canon-reachable forever). Series review: all nine kit scenarios sampled live in one sweep, 9/9 green (one city flake absorbed on retry).

One new graph channel {"kit":{"kind":"forest|city|war","at","size"}} with seeded deterministic generators in a pure server module (lib/studio3d/world-kits.mjs — no client cut, ops travel the graph as always). Structures carry group kit-<kind>-N, so the proven structureWhere{group} lane addresses a whole kit ("make the forest snowy"). Each kit shipped with the live-anatomy method: injection law for empty/thin plans, plus surgical repair stages found in eval anatomy — B294b clearing-camp placement ≥7u from every planted tree, B295b road-axis inference from the furniture bounding box, B296b trench line at the layout's south edge, B296c field-weapon top-up. Three new adversarial scenarios (z7 #26-28) with lazy negative graphs went 4/4, 3/3 and 4/4 live. Budget law ≤48 ops per kit, real-path guards through applyWorldBatch including the compile gate.

The C6 avatar track shipped in four cuts. A deterministic rig contract (lib/studio3d/avatar-rig.mjs) assigns each def box a bone role from pure geometry — thresholds documented, same input same rig forever, with a mechanized parity gate against the client copy. The renderer groups the def's boxes into pivot-anchored bone groups (hips/shoulders from the rig anchors) exposing the SAME userData channels the classic knight uses, so the existing biped animator drives custom avatars unchanged; stature normalizes to 4.6u so camera, capsule and feel stay honest. playerSkin opened for u_-slugs at both value gates (function-gate on the chat channel; existence checked at runtime with a silent classic fallback). The sentence law matches def NAMES only on exactly one hit, and live eval anatomy produced two normalizer repairs: a ground-lift for center-thought bodies (models place torsos at y=0) and name-as-def adoption into the asset lane. The new adversarial scenario went 4/4 live after the repairs. Banner duration is clamp(1.5s, 70ms/char, 4s) — short banners byte-identical.

The math dimension found a truth break: the melee cone pushed the same target m times per swing, so hammer/war-axe/mace dealt 2× their displayed damage — inspector, prompt and the 'deals X damage' sentence law all lied. One hit per target per swing now, and the presets were re-tiered around honest niches (light = DPS ~25, heavy = burst with DPS below light, sword = anchor at 26); the boss time-to-kill band (4-9s melee) is enforced by a computing gate smoke, not vibes. Throw tumble switched from world-X rotation (only correct facing south) to an absolute quaternion spin around the flight's crosswise axis, with a full rest-pose restore on landing plus an earth-tone dust burst. Multiplayer throws ride the existing wfx cosmetic event line (fly/boom pattern) with authority guards: remote flights never hit and never commit — damage and the landing item.move stay with the thrower. Onboarding hints are one-shot session flags appended to the existing equip banner.

The first full combat-flow E2E in a real headless browser (pickup → throw → landing → re-pickup → belt → X-swap, 6/6) flushed out three shipped bugs. (1) The B266 KeyX handler sat INSIDE the editor key layer with a !editor guard — provably dead code; it moved to the run-key group with a placement pin so it can't wander back. (2) The throw flight ran on a requestAnimationFrame self-loop with a fixed 1/60 step — frame-rate-dependent speed and frozen mid-air in throttled tabs; it now integrates in the main tick with real clamped dt, same pattern as ranged shots. (3) Mid-run landing commits broadcast the editor's refresh signal, which reloads the world and re-inits the whole kernel run state — a quiet ops channel now commits throw and kick rest positions silently (plus a direct itemsForLogic write so the kernel sees the new spot without any reload), while genuine CAS conflicts still resync loudly on purpose.

The hotbar's second slot lives in kernel run-state (stashed) with the swap as a one-shot tick input — the existing equip event carries the new truth plus a stash field, so the viewmodel/stats consumers needed ZERO changes; the old swap-drop golden was consciously lifted to the new behavior (both-slots-full still drops the active one). Thrown weapons shipped through all four gate sites with a kernel throw input, a 1.5s flight window (a sim-found class: without it the throw tick re-picked the weapon at the thrower's feet), client arc ballistics with in-flight hits, and the landing committed as item.move through the one ops channel — published worlds honestly stay run-local. The full cycle (throw → lands → re-pickup) is measured, 11/11. Plus robot/golem palettes across both skin enums, taught to the sentence normalizer in EN+DE.

goal_zone.hold shipped end-to-end (contract 3-300s, kernel hold clock in run state, HUD marks at start/30s/10s, prompt recipe, publish-proof carries it unchanged — the goal bot stands and the clock runs). The playtest ghost rides the oracle path with RAF interpolation and honest v0 scope (glides, no walk anim — closure boundary documented). The match frame lives entirely on the existing generic net-event line: host emits one wmatch event, every client counts the same endsAt, the scoreboard reads scores that already travel in presence beats. Plus the proven 10-player Cloudflare relay finally has a code adapter: a second MpTransport implementation behind a build flag, live-proven 3/3 (roster, events, leave) against the real relay — Supabase stays the default.

A per-kind WEAPON_SFX shelf drives the whoosh weight (frequency/length scale with heft) and the impact particle color+count; the spark burst gained a backward-compatible tint parameter so untouched paths stay byte-identical. No new audio sources — the QA-mute doctrine is untouched.

playerScale (0.5-2) shipped through all three gate sites with FOUR scaled eye-height paths and measured proof (headless eye at exactly 4.7×1.6). The tier table lives ONCE in the kernel (dual-export) and feeds inspector chips, the boss stamp and the prompt — which now teaches exact numbers. Boss presence exposed a legacy bug: the biped animator stomped ANY group scale every frame (even the enrage +15% was one-frame-flickery) — a baseScl channel fixes it additively. The entity per-turn cap went 4→8 with an honest army→spawner pointer, the equipSpeed sentence law closed the B52 chain (plural word-boundary regex class documented), and shelf favorites/recents ride a column-tolerant profile route that activates itself the moment the migration is clicked.

The category question is the vertical-model decision finally shipped as UI: one glass panel, one active option, same server action, the locked instant-flow untouched. The install chip rides beforeinstallprompt (accepted installs land as a funnel event), standalone launches report themselves once per game, and iOS gets an honest hint since it never fires the event. The funnel route/type grew two additive events.

entity.edit learned body and catch as in-place editable fields (null clears, biped = absence — legacy graphs untouched); the weapon panel writes full-merge item.setp-shaped p mutations through the session chain with undo pushes (setp REPLACES p — the merge discipline is pinned). The gear-tab placement now attaches p.weapon {kind} for weapon-tag defs only, so 'walk over to wield it' is true without breaking tools. Resident colors also went stable: palette now hashes the entity id instead of the volatile array index.

settings.vehicleTint shipped through all three gate sites with priority world-tint > account palette > factory color, inherited by peer karts. The axis-stretch chips mirror the modifier-wheel semantics exactly (×1.22, clamp 0.3-6, undo push, collider rebuild) and appear only on stretchable defs.

Three new entity stamps ride the existing entity.add channel (the boss bundles hp+lunge-pattern+atHp-enrage as one click; a real-apply guard proved every field lands, and caught a dead field — dist is patrol-only, so the dog stamp doesn't carry it). Separately the publish gate's blind spot closed: hasWinIntent and proveWinnable now know the discrete-waves win — a combat-bot farms the waves kinematically before publishing; endless spawners honestly stay sandboxes.

The look dialog was extracted into one function both surfaces call — across a client-closure boundary, which the headless runtime proof caught as a ReferenceError while source pins stayed green (the bridge now goes through the window registry). The plane choice mirrors the chat normalizer exactly: controller flips to fly only when it was walk/empty.

One exported kind→damage truth in the kernel (sword stays 10 — the old constant, so the most common weapon never changes) read by hitDmgOf AFTER held.dmg and equipDamage. FOREVER by design: the presets only fire when settings.weaponPresets is set, which only the new-world template carries — legacy graphs stay byte-true at 10. Proven by simulated combat: 5 hits per dagger kill and 2 per hammer kill in new worlds, 3 and 3 in legacy ones.

The tile branch reuses the same compiled-plan thumbnail machine that already powers the building cards (emoji stays as fallback; logic and creature markers keep theirs on purpose — they ARE markers). The icon map is guarded measured: every def-metadata tag must have an icon or the gate goes red, so future factory categories can't ship faceless.

New settings.playerSkin (closed enum, knight = the classic account look) gated at all three sites per the batch-death doctrine (contract allowlist + world-doc value gate + chat key map) and taught to the model (schema + a situational PLAY-AS recipe). A deterministic normalizer catches the literal wish in four tight trigger classes (EN+DE) without ever hijacking plain enemy sentences ('a zombie that chases me' stays an entity). Applied to the player rig (world beats account palette, ghost = reversible transparency), the side/top-down puppets (previously hard-white), and proven headless (the fixture player renders bone-white) plus LIVE n=2 on the fast lane. A TDZ lesson came free: the puppet bridge sat before the STUDIO declaration and only the runtime proof caught it — source pins were green.

The two newest equip kinds were missing from BOTH class tables (WEAPON_STATS reach/cone/impact and WEAPON_CD swing cadence) and silently fell to fist defaults. Beyond the fix, a drift guard now derives the weapon list from the generated def metadata and goes red if ANY weapon def ever ships without rows in both tables — new factory weapons can no longer arrive feeling like hands.

The edit-mode picker and the global search only read the factory catalog; user defs were reachable solely through the FP-build palette. Now one merged pool (the proven getDefs pattern) feeds a mine tab (appears only when you own defs), the all view, and the search index (hits jump into the tab). Thumbnails came free — the thumb renderer walks the same mesh builder that has known u_ defs since the render bridge landed. Proven headless end-to-end: def.register through the ops channel → tile appears → search finds it.

The spawner stamp family gained a waves tile (the kernel's discrete-waves win as ONE placed marker), the wire-panel got a spawner branch posting a single logic.edit, and the contract learned waves/rest as in-place editable scalars (null clears back to an endless spawner — FOREVER stays byte-true). Proven by driving the real panel headless: type 3 waves + 10s rest, hit save, the graph carries both.

The skin vocabulary (schema, inspector, prompt, parser) existed since the Creatures tab but had ZERO render consumers — grep found no e.skin read anywhere in the runtime. Now ONE module-level palette truth drives both consumers: the NPC mount and the spawner-clone mount. Ghosts clone their materials (shared metals never mutated) at opacity 0.5 without shadow casting; enemy skins on ranged bipeds get the hostile ember eyes. The spawner node carries a validated skin field through contract → parser (pre-checked, field-drop instead of batch death) → kernel spawn event (literal push kept so the event-inventory guard still parses it) → clone mesh. Proven headless in a real renderer (7/7 mesh introspection) and LIVE n=2: 'survive 3 waves of skeletons' builds the full wave frame with skin on the fast lane — which also exposed and closed a real vocabulary gap (the WAVES recipe was only defend-triggered; 'survive N waves' now injects it).

The biggest hand-parity gap of the audit: defeat/timer/score and the controller were chat-only. Each form row is exactly ONE logic.add/edit/remove through the single ops channel (new logicOps sibling of gameSet, rev + flush included), scoped to rules the form owns (the terminal timer, defeat without entity references, the score node) so chat-built specials stay untouched. The controller select offers only the six implemented modes — reserved enum strings are honestly absent. Proven by driving the REAL form headless: typing 90 into survive produced {kind:timer,seconds:90,survive:true} in the graph, 5 into defeat produced {kind:defeat,count:5,wins:true}.

A production bug found by the mission audit: canonicalizeOps (the persistence canonicalizer every live write passes through) copied only kind/dmg/reach/speed off the weapon block — ranged/pColor/pSpeed died before the graph, and sanitizeP stripped the same three fields at all four parse sites. The old smoke tested applyOps directly, bypassing the canonicalizer: a false-green class. Both carriers fixed, the smoke now runs through the REAL path (applyWorldBatch + memory store) with a negative control proving it catches exactly this strip, and a new adversarial scenario ('place a magic staff that shoots white balls') passes LIVE n=2 end-to-end.

47 defs — ALL 8 weapons, 12 foods, 11 tools, 16 dungeon props — fell into the unlabeled 'More:' bucket of the catalog prompt because four tags were missing from TAG_LABELS. Adding the groups would have burst the static-prompt headroom floor (2500 chars) by 21, so a SEVENTH lossless compression class paid for it: comma-tight list joins (~330 chars) — headroom ended BETTER than before (2814). All 25 tags are labeled now; the 'More' bucket is empty and guarded.

Four cuts from a user-pain forensics pass over real chat logs + build telemetry (48h): (1) a race-frame entry in the plan-quality oracle turns thin or empty race plans into targeted repair food — proven LIVE n=2, the exact reported user wish now passes in 1 turn on the fast lane; (2) receipt honesty — internal object ids and model-facing repair jargon can no longer leak into chat, and the silent-empty class gets an honest retry line; (3) the interior anchor law learned the 'interior design/furniture' vocabulary and clamps absolute out-of-hull coordinates onto the proven rel-inside solver (verified against the affected user's actual world); (4) inside-vs-outside wall colors are a taught liner-wall recipe now instead of a lucky improvisation. Plus an owner decree landed in code: the LLM path is SURPLUS-only forever — the dead foreign-provider fallback is deleted, outages degrade honestly instead of switching providers silently.

Every handle axis is now proven end-to-end in a real browser run: x-pull ring r 18→20.7 (exactly ×1.15), height k=1.45 → block h 3→4.4, rotation snap 90→180 through the ONE rotate source, door slide cell 6→7 with the wall rebuilding around it. The ring fix lives in the SHARED stretch grammar (UMD): single-ring plans fell through the extent early-return and r was never touched — the chat verb 'make it wider' profits too. plan-stretch pin v1→v2 (the immutable cache would never have shipped the fix otherwise).

The whole overlay class got role=dialog + honest aria-labels + focus jumping to the primary action AFTER append (measured: activeElement lands on '▶ PLAY'). Toasts and banners ride aria-live=polite containers — a real toast was proven to land inside one. Plus WCAG contrast math on the chrome (weakest texts lifted .6→.7 = ~5.1:1 worst-case, computed inside the guard itself), a ✓ shape-signal on the active category tab for color-blind builders, and kid-sized touch targets (everything ≥40px on coarse pointers).

Two finds from a real 375px screenshot pass: the palette rows used 92vw + panel padding = wider than the viewport (fixed to 84vw; desktop unchanged via the 640px cap), and two row buttons (mirror + asset builder) were never styled — native white UA buttons killing the Save hierarchy. Both joined the glass-pill rule; the pause and terms cards also left their blue-black outlier color for the warm studio family.

An event-completeness audit diffed all 50 kernel event types against their consumers: 'used' was the one genuinely user-facing silent sender (the heal flash fired, the WHAT didn't). One additive branch in the event loop closes it; the other 12 unconsumed events are documented state-redundancy (HUD reads state directly) and stay as stable API. The MP parity map (what travels to peers: checkpoints+laps, deaths, wins, race starts — never your inventory) is now guard-pinned.

The publish-time question stays the first path; the new toggle PATCHes maturity through the same validated API and mirrors both ways (answering the publish question updates the toggle, the toggle syncs the ask-gate). The DB truth now travels into the studio boot, so an already-answered audience never re-asks — and the age-gate coverage got a full un-truncated audit: discover, create and the /w player path all carry the (flag-dormant) gate; a wrong 'gap' note from an earlier truncated grep was corrected.

proveWinnable learned the counter route: it finds the feeder triggers (switch = only the ON edge fires, plate = re-entry, or a set:n jump), walks there, pendulums and pulses E, and lets the kernel count — five cases measured (switch winAt=2 in 2.1s, plate winAt=3 in 6.2s, set in 1.1s, two honest refusals). The old 'unknown limitation' pin was deliberately flipped; the board puzzle solver is the one remaining honest gap.

The scouting found ~80% already existed (shared race start, progress broadcasts, shared finish) — the waves closed the honest gaps: the race sender now waits the same 1.3s as every receiver so all countdowns align; checkpoint broadcasts carry lap/of only in laps races (empty spread keeps every other world byte-identical); remote peers render via the car rig when the world's avatar is 'car' — with all three biped paths gated (retint/anim/emotes; the car group has no legs and would have killed every peer tick); and the position rank is a pure, Node-measured function: ties never count against you, absent peers decay after 20s, solo shows nothing.

Disciplined one-axis feel pass over the pure drive kernel in sim time: ramp 0→95% vmax in 2.1s, corner radii 38.6u at speed vs 11.9u slow (healthy 3.2 tension ratio), true brake phase 1.15s, U-turn 2.8s, 45° direction change 0.88s — one finding (roll-out 4.4s/68u, corner overshoot) fixed by raising roll drag 7→10 to exactly 3.1s/47u, with ramp and U-turn regressions byte-identical.

Onboarding psychology round: the conversion screen was a bare auth card with zero value proposition, and its headline said 'Sign in' while the Sign-up tab was active. Fixed with a value-first headline and a friction-calming subline; the email-code flow (no password) was already the right call and is now said out loud.

goal_zone.laps (2-9) turns the ordered checkpoint ring into laps: a full ring bumps the lap counter (kernel event feeds the banner), re-arms the ring below the target — the respawn anchor survives — and gates the finish until lap >= laps. Kernel v58 with the lap field in BOTH run-state copy lines (the copy-list doctrine), contract gate + additive schema snapshot, parser pass-through incl. word numbers, and the kart recipe now teaches laps:3. Fully measured in Node: ring completion, re-arm, blocked finish, final win — and worlds without laps behave byte-identically.

The countdown rides the real pause switch (world AND timer frozen — same truth as the pause card) and always releases, even if the overlay is torn down mid-count. Only worlds with laps get it; everything else starts word-for-word as before. The winnability bot learned laps too: it now drives the checkpoint ring N times before parking at the finish — race worlds would otherwise have been falsely unprovable in the KPI harness (measured: a 2-lap world proves winnable in 4.1 simulated seconds; laps without a ring get an honest refusal).

Three root causes closed: prefetch was disabled on the hot links (clicks fetched nothing until the server finished — dead-feeling clicks), server-action buttons had zero pending state (now useFormStatus locks + labels instantly), and the pages ran their independent Supabase queries as CHAINS (/create ~9 round trips in sequence, /discover 5) — now parallelized with a per-request auth memo (react cache dedupes the doubled Header+page auth). Measured on prod: /discover TTFB 0.59s → 0.2-0.3s, total 1.76s → ~0.9s. Part two: the 17 versioned arena bundles carried max-age=0 and were re-fetched on every world open — they now ship public,max-age=1y,immutable (the ?v-bump discipline IS the cache-buster; a new guard forces every script tag to stay versioned).

Discover hero rebuilt (h1 26/34px, Create button left, Header gained hideDiscoverNav so only /discover drops the doubled nav), and the hero CTA now rides the shared dg-brand-button glass tokens (white 8% on black, 16% border) scaled up — one button language across the site.

TikTok as a clean white SVG (CC0 glyph) padded to the row's measured ~80% fill norm; the old bell PNG was a thin-stroke outlier at 5% canvas fill vs the X's 19% — replaced with a solid white SVG and calibrated by canvas-measuring every icon as actually rendered: all six now sit at exactly 80% (±1).

A single hook at the one place ground velocity forms hands the frame to driveShape when the car avatar is active — everything else (ARROWFALL, plaza, every non-car world) runs the byte-identical old path behind the studio gate. The physics core is a deliberately pure function the guard EXTRACTS from source and drives in Node: ramp monotonicity, vmax clamp, speed-dependent steering limit and the exact brake/roll-out constants are measured, not asserted. The live E2E probe caught a teaching bug on the way: the phrase 'runner-pace' primed the model into controller:runner, which would have put the car on rails — fixed and re-proven against the prod route. Feel verdict awaits the owner's playtest.

One-shot tool over the proven two-click stamp machinery — deliberately NOT a searchable stamp (it lives only behind the world-tab button), disarms itself before posting, writes settings.set spawn {x, y:surface, z, ry} through the one ops channel against the existing full-object gate. This closes the last deliberate non-build of the tab-structure spec.

Fail-miner round over the week's real creator sentences after the big editor rebuild: a ground-theme law (theme word + map word + want-verb → settings.ground with matching sky/weather, value-identical to the biome buttons) and a multiplier class in the selection law (double/triple/half with deixis → exact scale factors; the mined typo 'siz e' is irrelevant because the deixis carries). One truncated fragment waived with reason. Open-young prod failures: zero.

The car avatar existed as a setting since the player tab launched, but nothing consumed it — a visual no-op. Now carTick clones the proven plane-rig class: KEYLIGHT box puppet riding the walk controller, yaw from movement direction (cars don't strafe), curve-lean from yaw rate, third-person feed for free. Zero physics delta — it moves at player speed, the speedy movement preset approximates kart pace; real drive handling is wave 2 in the vehicles dossier. A situational kart/racing recipe teaches the model the full package honestly.

The kernel's ehit event always carried the remaining hp; a one-line consumer in the arena now hands it to a canvas-sprite bar (say-bubble pattern, procedural, no asset). Max-hp default 30 is pinned word-identical between kernel and client; entity.hp from the graph wins. The extraction ratchet took a justified +1 moloch line for the event wiring — the sprite itself lives extracted.

The AI kernel consumed vision.range all along (seeker cone, default 18) — what was missing were the write paths: an entity.edit vision clause (add-gate mirrored, existing angle preserved), the parser field, a deterministic chat law over all hostiles, and the inspector row. The old zombie-aggro law was modernized on the way: behavior now flips in-place (id survives), so even creatures wired into defeat goals can turn hostile without breaking the wiring.

The climb wish now rides the proven reachability-repair synthesis (the same repairFix behind the winnability oracle) — measured law parity, deterministic, silent when everything is reachable. A real misfire fell in the sweep: bare /slide/ routed playground wishes into the board-puzzle teaching. The climb/slide dossier documents the runtime truth (the ladder op is a steep walkable stair — no hand-over-hand physics yet) and the wave plan for real climbing.

A7 connections panel v1+v2: per-tab instance list over the tab's own graph channel, edges read from all six logic reference fields in both directions, click pans the editor camera. Delete is a two-step guard that names incoming references (measured: the contract permits dangling references, so this client guard is the only guardrail). Multi-select builds ONE mixed logic.remove+entity.remove batch — measured atomic: a broken batch dies whole, rev-CAS stays a single POST. Structures take their own removal path and the toast says so.

The v1 display+clear from the player-tab launch grew into the full editor: slug+count rows over settings.set startInv, client validation word-identical to the server's Z23 gate (regex pinned in both sources by the guard), cap 6, counts clamped 1-999, empty object collapses to null. Measured: valid inventory lands, 7 slugs and bad slugs throw.

Season buttons call the same shared seasonOps grammar (plan-style.js) the ⛄ pill and the chat use — one code path, three surfaces; dropped ops are named, never silent. Measured: winter yields exactly the four settings ops and the store takes them. Scenes render read-only from the games/<id>/scenes API with a here-marker; switching stays with the scene pill per the spec (switcher = chrome, not a tab).

Tab-structure spec rollout step 7/7 (the plan a 9-agent panel validated): the world category renders first in the tab row as a form over the same settings.set keys the 🌌 pill writes (KNOWN_SKIES/WEATHER/GROUNDS congruence measured against the imports). Deliberate double-listing — pill, biome buttons and terrain workbench stay untouched (forever-compat + muscle memory; removal would be a separate decision). Zero kernel work; the whole consolidation is regrouping over the one ops channel.

First form-panel-on-selection class. The contract law was deliberately flipped: entity.edit now accepts behavior switches IN-PLACE with field hygiene (behavior-bound fields pruned — the test found and closed a dmg leak — add-defaults applied, switch-to-schedule demands home) instead of the old remove+add dogma, because references (defeat targets) must survive. Undo inverts as an exact snapshot pair with the old id since key-wise inversion would be lossy. Old guard asserting the throw was lifted to assert the new law.

One stamp source (allStamps) feeds both stampFind and the global search — no second truth. Result tiles keep their data-t/data-st attributes so the existing click paths fire unchanged; a data-own attribute jumps to the owner tab via setTimeout(0) after the placement handler ran. Favorites live in localStorage next to the recents; stamp placements now travel in the recent list cross-tab. The field moved above the tab row per the spec amendment.

Form class over single settings.set ops; every option list mirrors the world-doc gates (playerHp 10-1000, lives 1-5|null, respawnDelay 0-10, protect 0-8, movement presets, KNOWN_MUSIC/AMBIENCE) with a congruence guard measuring the imports. Ownership table enforced: no startInv/equip here (Player owns them), sky/day-night only as a link to World.

Avatar select writes settings.avatar (KNOWN_AVATARS congruence pinned); starting gear renders as display-only with an honest pointer to the 🎁 button on gear tiles (single write path per key, per the ownership table); startInv shows with a null-clear (free slug editing arrived with the search step). The 'make your own asset' tile opens the existing asset builder.

The tab boundary is the def's primary tag (weapon 8 / tool 11 / food 12) — client and server read the same items.js source, so no drift guard is needed. Weapons/tools are plain item tiles (the existing walk-over pickup makes them combat-ready for free); food tiles are composed server stamps: item.place + collect{heals:25} land as ONE ops batch with server-resolved refs — zero schema change, proven against the real store. Groundwork shipped with it: the shared TERRAIN_OPS classifier and the gear-tag boundary that every later tab reuses.

Two-intent tiles (panel amendment A6): main tap places, 🎁 writes settings.equip through the ONE ops channel. Root find healed on the way: mace and wizard_staff had def-level grips but were missing from KNOWN_EQUIP (a stale factory list) — both server lists extended and a drift guard now pins every equip-def into KNOWN_EQUIP. The two new slugs pushed the static prompt under its headroom floor — the budget guard caught it, a meaning-neutral compression paid for them.

p.weapon learned ranged:true + pColor (lowercase hex) + pSpeed (10-60) with closed clamps at both gates (contract + world-doc mirror). Kernel v57 copies the fields into held on walk-over pickup and the equip event carries them; the client's two fire-decision sites read equipStats.ranged and shoot spheres in custom color/speed — damage stays on the single held.dmg path. Measured: pickup flank, FOREVER byte-neutrality for melee, junk keys still throw.

Five entity stamps over the logic-stamp pattern → entity.add through the ONE ops channel (server assigns ids, the contract holds the 48-creature cap — the client mirrors it as an honest toast, the 49th provably throws). Payloads are pure SKIN_KINDS/BEHAVIOR_KINDS presets; spawners stay in the Rules tab per the ownership table. Every channel of the world graph now has a hand path: structures, logic, gear, creatures.

First form-UI class in the picker area (inherits the collapse behavior — no new panel): each field posts ONE settings.set through the ops channel with server-side value gates; current values load from the world read. The ownership table is guard-pinned: no start-gear or sky controls here (Player and World own those), form options are congruent with the world-doc KNOWN sets, movement presets are clamped objects with chat-custom kept visible.

The fail-promotion loop with teeth: every failed prod sentence lands in a ledger with a 14-day clock — cover it with a deterministic law, or waive it with a written reason (the guard enforces non-empty reasons). Final tally: 65 law-covered, 42 reasoned waives, 0 open. Coverage is probe-measured against a typical-world fixture (incl. a no-target probe for word-anchor laws), never assumed. The weekly miner keeps feeding it.

Deterministic empty-plan laws on real factory defs (chicken/sheep/pig/goat/cow): tree-anchored placement via hash angle/radius with collision-rect avoidance and a retry loop (the single-spot hole was probe-caught), typo-tolerant defeat law that counts existing hostiles before spawning new ones, follow-law hunters on line-of-sight aggro.

The planned ridge backbone burst the 4000-part compile budget (the ghost-structure class) — empirically recalibrated to two sibling-tagged mound entries (≈2326 + ≈1403 parts, compile-pinned). Per-op earthy tints, mega class for 'massive'. And a reference guard: 'villages NEAR the mountains' now builds villages, never more mountains.

Edit-class laws with the exactly-one rule: spawner timing via logic.edit (in-place — ids and wired references survive, server clamps apply); behavior changes follow the remove+add doctrine (field sets depend on behavior) with a reference guard over defeat/entities edges. Aggro pursue-distance was honestly waived: it's a kernel constant for standard hostiles — now a line on the owner's feature list.

Three scatter laws on the shared world-rect helper: rooftop items ride the y channel (at [x, tower-height, z]), hydrants (a real city-batch def) sit at each building's rect edge, sidewalk maps to ground:stone + a concrete groundColor. All typo-tolerant ('hydrats', 'sidwalk') — real creators type fast.

Word-anchor extension of the selection net: an edit verb + a named structure class (en+de, incl. the measured 'flatform' typo) resolves against the world — exactly ONE structure carrying that plan-op becomes the anchor, feeding every existing net branch (comparative k, palette rotation, remove). Ambiguous, mass ('all…') and new-build wishes stay silent by design; selection and look-at always win.

Everything existed (harvest hits/yields, held/equip spine, ore defs, underground shafts) — the wiring was missing. Situative MINING teaching + a deterministic empty-plan law (6 veins + harvest{hits:3,tool:'pickaxe'} + deposit sink + settings.equip), proven winnable by the kinematic bot (mines 4 ore, delivers, t:9.6). New: harvest.tool on the kernel (v56) — hits only count when held.kind matches or settings.equip owns the tool; denied travels in the needs format so the existing toast renders it with zero client changes.

Two deterministic empty-plan laws from real failed creator sentences: tree-fill walks a 22u grid with hash jitter (no randomness), avoiding structure rects (rings as circles), a 7u item radius and a 10u spawn bubble, capped at 14; the hunter law drops three hostiles that chase via the existing line-of-sight aggro. Both survive unusable AI replies (degraded-mode rescue).

Fail-promotion triage over 7 days of prod builds: 107 sentences — 51 now law-covered, 40 waived with written reasons (meta/noise, context fragments that need chat history, feature files collected into an owner-prio note), 16 honestly open on the 14-day clock. New laws: city accepts wish verbs, village fires on bare noun phrases, defeat is typo-tolerant and counts existing hostiles. Coverage is measured by probes (incl. a no-target probe for word-anchor laws), never assumed.

The oracle route ships the challenge read (walk distance via BFS on the walkable field — detours count, gate unlocks and teleport edges from the winnability fixpoint) alongside the repair synthesis; the coach renders it as a numbers row plus an instant-class coach line. Display only — the diagnosis channel never writes; all healing ops still travel the ONE ops channel.

The reachability proof was blind to the OPEN state: proveReachable now runs a monotone fixpoint — reachable triggers unlock their target structures (role-gate colliders drop, exactly the runtime truth), reached teleport zones seed their destination into the BFS, counter/combinator resolve through their feeders with honest key counts. The winnability bot also routes needs-sources first (collect, harvest, mixed coverage — chest targets included), so J3 rule worlds stopped timing out. Permissive doctrine holds: only truly sealed worlds get refused.

reachabilityNote runs the deterministic path proof after every applied build and appends one heads-up line to the receipt. The repair itself is ONE shared synthesis (repairFix): frontier diagnosis from the fixpoint (nearest reached cell + height delta), then class table — dy>2.7 → ladder at the frontier edge (proven 7V geometry), axis-straight wall/bigwall between → openings surgery via structure.edit (compiler clamps respected), else teleport bridge. Chat law and coach chip emit the identical result (parity-pinned); the chip posts the server-built op verbatim through the ONE ops channel, LLM-free — it works even in degraded mode. Every heal is MEASURED green by re-running the proof, never claimed.

challengeRead comes free out of the winnability fixpoint: BFS walk distance to the most demanding win anchor (detours count — not air distance), used gate-unlocks and teleport edges as puzzle depth. The instant class (<24u, zero obstacles — exactly where distances are exact) gets one coach line in the build receipt and honest number chips in the map coach ('the win is a ~15u walk · 1 gate · 0 portals'). 'Make it harder' is the measured chat lane (corpus 3/3).

The biggest empty-build cluster in 7 days of prod data (fail-sentence miner). The selection net's deliberate 'no color word → model's choice' policy measurably failed, so it fell: deterministic palette rotation (hash of id + current tint over the 8-color KEYLIGHT palette, no randomness), 'the WHITE buildings differently' treats the color word as current state and avoids it, items keep the p-merge. Explicit color wishes are untouched.

Second miner cluster: on an unparseable model reply the wish died BEFORE the law family ran — the null-parse rescue only knew the cover/roundness classes. It now covers every empty-plan law (interior rule g: 5×5 backtracker maze with sibling-tagged buckets, CITY, VILLAGE, DISTRICT); foreign wishes honestly stay null. Side effect: these classes work in degraded mode with no LLM at all.

Auto-wiring: wireTarget is a pure shared function (structure with gate/platform op first, light-item fallback via the B59 regex, 40u radius) — no target means an honest toast, never a broken op, since the contract requires wired targets. Teleport is the first two-click tool: the client holds the pending zone, the op only travels complete (contract E35 requires 'to'); Esc clears the half-state. Undo was already covered end-to-end: every stamp POST pulses the shared saved-path which pushes a {server:true} marker onto the ONE undo chain — Ctrl+Z walks the server ledger inverses.

Hand-parity part 1+2 (the biggest judge gap): stamp-plans.js is a shared pure UMD module — 7 structure stamps (house delegates to the village solver's housePlan, additively exported) + 4 standalone logic markers, every plan/op validated in CI through the REAL server apply (macroform compile + graph contract; junk plans and junk kinds provably rejected). The editor arms a cursor ghost and posts structure.place / logic.add through the ONE ops channel (flush → rev → refresh) — after the refresh the existing select/resize/rotate grips and logic rendering just work. Client capture-phase only; the monolith gained one script tag.

spawner waves:N + rest: a wave bursts 'max' clones, slaying all starts the rest pause, wave N wins exactly once (multi-spawner composition waits for all). Kernel v55, state fields in both copy lists, endless spawners byte-identical. Turret = ranged ally with targetsClones:true — the client retargets its projectile at the nearest living clone and routes the hit through the existing fist path (pendingHits), zero kernel changes.

hostile entities accept vision:{range 4-60, angle 30-180} — aggro requires the player inside the LOOK cone (forward = movement heading, stateless) AND clear line of sight (B73); hearing stays omnidirectional within 4u. catch:true turns a touch into an instant K.O. via the existing damage path (9999 through contactDamage — lose or checkpoint rewind, kernel untouched). Without the fields, behavior is byte-identical.

Attribute-level reporting duty: every set-but-rejected field surfaces as an error (entity fields on the wrong behavior, non-numeric heights on goal zones, junk p-keys, unknown weapon kinds — 15 junk classes pinned by a behavior guard that counts exact messages). Color words repair to hex via a tolerance map (repair > report > silence). Clean plans stay at zero messages.

4-lens judge panel (coverage/proof honesty, child-sentence semantics, silent losses, composition) + chief synthesis against the mission dossier. Archetype matrix went 14 green/10 yellow/2 red to 23/3/0 in one day (17 batches, 18 live adversarial scenarios, 2 measurement-infrastructure root fixes). Verdict drove the next batches directly: attribute reporting shipped same-day; quest-gate hardening and composition scenarios queued behind a provider funding click.

village/city/district channels accept k 0.3-3 (a shared scaler runs solver plans through scaleStructurePlan and re-anchors items/residents around the center; no k = byte-identical). A tiny/giant law maps scale words onto the channel. Structures finally pass 'group' through the parser (the contract field existed unused) — ensembles are mass-addressable via structureWhere.

districtOps as the 4th shared-solver path (proven building blocks: housePlan/colonnade/grove; all four kinds compile-gated). Parser channel district{at,kind} assigns group 'district-<kind>-N' so structureWhere{group} mass-transforms the quarter; a CITY-LAW twin injects the channel deterministically when the model returns an empty plan (kind inferred from the wish, EN+DE). Live-proven n=2 including the two-sentence recolor chain.

A law composes counter(winAt:N) + phase(on:'day') — the DAWN edge counts a COMPLETED night (on:'night' would win too early; kernel golden pins the edge truth). Bycatch root-fix: two same-plan reference registration sites counted GLOBAL op indexes while resolution is logic-local — any settings/items before the logic nodes shifted every reference (atomic batch death or silent mis-wiring). Both fixed + a reference-class guard.

targets accepts 'new:st<i>' counting the reply's own structure list (counter/switch/plate/combinator/phase), resolved structure-locally in world-doc before contract validation. Dangling refs and gate-less targets are honest node drops, never batch death. Plus three live hardenings for the fast lane: a widened teaching trigger, a gate-bind quality oracle, and a deterministic gate-bind law that wires collect→gate itself.

The deterministic maze law always generated a seeded 5x5 backtracker (35 walls in buckets of 18 ops — the parts budget forbids one giant structure), but the overlap guard treated sibling buckets as collisions: only bucket 1 survived. Buckets from the same law run now carry a private _law tag and may touch; the tag is stripped from model output before laws run (so a model can never smuggle it in to bypass the guard), and foreign structures still collide honestly.

The B8 mover grammar (platform dx/dz/period, mesh+collider glide, lever binding via targets) gained the vertical axis: dy 0-40 moves mesh center and collider top/bot from a recorded base. Player carry gates on feet~deck within the footprint: horizontal delta ride, vertical set-on-deck (descending follows without jitter, jumping detaches). Motion fields never change compiled geometry — old plans stay byte-identical. Live-proven n=2, both runs on the fast lane.

Three stacked failures: the region teaching missed biome words entirely, models wrote role 'desert' (an unknown role killed the whole op — batch-death class), and the taught example silently clamped. Now: deterministic role-synonym repair in the shared normalizer (desert→sand, ice→snow, rock→stone; real unknowns still error honestly), a widened trigger (EN+DE half-X-half-Y phrasing), and an honest two-patch recipe.

Bridges learned deck:true (flat span at EXACT y0 up to 58, no forced ground ramps, no pillars — old bridge plans stay byte-identical). goal_zone/checkpoint carry an optional y: the kernel (v54) only triggers them within reach of THAT level; zones without y stay height-blind forever (existing tower goals keep working). A quality oracle catches the fast-lane fake (islands as scaled block items — the scale clamp silently crushed them) and routes it through an LLM repair pass that builds real structures. Live-proven n=2.

losClear samples the aggro segment at ~1u steps over the collider truth (2u steps missed thin walls); gates BOTH hostile paths (standard + pattern boss) plus a 4u hearing radius and a 3s losLostT de-aggro. The state field initially died in the entity copy-list — exactly the boardPos lesson documented in that file. Client flips losCheck:true universally; without the flag the kernel is byte-identical.

Three silent eaters: (1) the sniper law now requires combat context and never replaces plans carrying land tools (bridge/tunnel/shaft/channel/carve); (2) goto_scene finally passes requires/requiresAll through the parser — the kernel could gate portals all along; (3) combinator inputs are collected before the targets check, so plates driven by an AND/OR need no own target. Plus rotation now travels to NEW structures (0/90/180/270, rotated-hull footprint check, honest 45° error).

Parity find via live debug: the nordstern runner called buildSystemParts without extra.wish, so the ENTIRE situational teaching register (weapons, bridges, interiors, sky islands…) was silently OFF on the measurement lane while the product had it. All four runner prompt sites now pass the turn as wish; a gate guard counts the call sites so the drift can never return.

items[].p.weapon {kind, dmg 1-50, reach 1-8, speed 0.5-2} through a FOUR-place law (parser clamp, contract validation, world-doc validateP, canonicalizeOps — the last two were silently eating object-valued p keys, a hidden batch-death class that also killed sign texts and tip axes for weeks). Kernel: walk-over pickup without any logic node, damage chain held → settings → fist, swap-light with honest re-drop. Live-proven n=2 with a strict scenario gate.

New use_item logic kind {resource, heals, below (default 35%)}: fires on the hp-drop edge between hurt and death handling, consumes from the run inventory, refires while supply lasts, never saves a killing blow. Composes with collect {yields} — 'a healing potion lies in the dungeon' is a two-node sentence. Zero client lines: the kernel co-emits the existing heal event.

Weapon-item law reads the negation-cleaned wish (a 'don't' can never apply stats), attaches p.weapon to placed weapon-def items and yields priority over the global equipDamage law when the turn carries a weapon item. Selection-scoped damage editing merges into existing p.weapon. Taught situationally; verified by an adversarial scenario with a negative control that proves the gate can go red.

Resize/move footprint guard at the structureEdit funnel (only motion/growth guarded — tint/style/shrink stay free for legacy-overlapping worlds; mass-resize updates batch solids so siblings see the NEW hull). structure.place now dodges chunky items and NPCs (decor scatter never blocks). SnapY predicts the exact nudge spiral the placement pass will take — shared resolver, so same-turn items can never snap to a pre-nudge position.

The #1 real-user failure cluster (107 empty builds/7 days) is dead: selection now reaches the deterministic law layer (color/size/remove nets with p-merge and clamps, fires only on empty model plans), plus a targeted repair pass that tells the model WHICH ids to edit when it returns nothing. Proven live: 3/3 adversarial scenarios against prod.

lawWish learned English contraction negations (straight+typographic apostrophes, typos) and protection spans of their own shape; a PROTECTED lesson teaches the model that protection is the opposite of removal. General comparatives ('much bigger' → 1.6x on what you look at) and question-shaped feedback got deterministic routes too.

Four settings through the three-place law (equipDamage 1-50, equipReach 1-8, equipSpeed 0.5-2, playerHp 10-1000). Kernel v48 killed the hardcoded 10-damage fist and 100-hp spawn; reach overrides the weapon-class range in the punch path, speed scales the attack cadence. Golden: a 100-hp boss falls in exactly 4 hits at damage 25 — and still 10 without the field (forever-compat).

atHp thresholds ({below: fraction} or absolute) + the shared trigger-action vocabulary on hostile entities; the kernel fires the edge exactly once on the ehp path (never on the killing blow) and emits an enrage event. The client theater came free via the existing actions event; the rage visual is a material-clone red emissive + one-time 15% scale kick + banner.

New defend logic kind (target structure auto-sizes its protect radius from the real hull). Enemies MOVE client-side, so the kernel gets a live enemyPos feed (14th tick param, built only when a defend node exists, spawner clones included). Breach = instant loss with the culprit in the event; surviving the existing survive-timer = win. Composition over new machinery.

The player is a first-class relation anchor: live playerPos travels into the parser, 'near me' decorates position-less entries with rel{anchor:'player'}, and a v2 law re-anchors model coordinates that land >20u away on near-me wishes (live measurement showed the fast model guesses far despite the lesson). Proven 1/1 against prod after the scenario guard itself got fixed — it was structure-blind while the model legitimately built tower ITEMS.

Declarative needs {resource, amount} on all five trigger kinds (switch/plate/goal_zone/interact/goto_scene) — the pure logic kernel checks the run inventory BEFORE firing, denied events throttle at 1.5s and surface as toasts. No scripting language: closed pairs, batch-death-guarded (parseNeeds throws actionable), 18 goldens. requires (quest chains) stayed untouched.

needs.consume:true deducts on the firing edge only (switch pays on ON, off stays free — a golden caught the double-gate trap; plates pay on rising edge; goals/portals on entry). Copy-on-write inventory mutation like every other inv path. Earn (harvest/trade) → pay (consume) → pass: the economy loop is closed.

The world-state prompt block computes BFS walk distances per turn on the shared walkable field (spawn → each listed structure, door-finding ring probe, 'NOT reachable on foot' as first-class truth). Deterministic, cache-law-safe (dynamic tail), 4 pins.

Top-level agenda channel (≤200 chars, T&S-scanned, "" clears) persists to settings.agenda and travels back as a YOUR-AGENDA prompt line; the multi-step lesson lives in the situational register (the static-budget guard rejected a static version — working as designed). v1 is memory, not auto-execution.

New server-expanded chat channels (editWhere pattern: 1 LLM line, no truncation): season (shared seasonOps grammar with the one-click hand buttons, byte-identical ops), editWhere predicates (near/rect regions, trees class, def-less), arrange (circle/line/grid over items AND whole structures via structure.edit-at), structureWhere (style/age/tint/resize with a per-structure compile gate), ground_patch 160u regions with blend dithering + footstep truth. 58 new gate pins.

channel ops derive flow segments at mount (pts polyline 1:1, direction downhill from y0/y1, speed 1.4 + gradient bonus, cap 3.4). Player push is STUDIO-gated, water-only, damped while wading; thrown physics props float (zone-top anchor + bobbing) and drift up to 6s before the resting spot commits through the one item.move path. Land and ARROWFALL stay byte-identical.

One world rule (studioIceNow = studio + snow weather): 9 water behaviors ice-gated (splash/wading/buoyancy/current/steps/env-extinguish/paddle-jump), ice carries via iceFloorAt in both ground clamps (player + NPCs), frost sheets render per the self-healer law, props land on the sheet. 'make everything winter' freezes every lake automatically.

studioGrassRebuild: instanced wind-shader blades (shared uT with water/leaves), deterministic LCG placement, filtered against water/shafts/ground-patches/colliders, rebuilt per structure refresh (cap 3500, QA 800). studioHorizonMount: 14 stepped voxel ridges, MeshBasic+fog so every sky palette tints them, rebuilt only on bounds change.

Regression find: the schedule behavior kernel (B35) was never routed in the live caller — the step condition predated it. One-condition fix + a routing guard pin. Entity cap also lifted 12→48 (swarm proof: 48 NPCs at 0.2–0.6ms sim) and every small loose prop (stools, skulls, pumpkins, custom assets) is now kickable/carryable/throwable via a geometry class instead of an 8-def whitelist.

Critically damped buoyancy toward the swim line (water top − 2.4) with real fluid-zone tops (fluidZones+top), SPACE/crouch override for surfacing/diving with natural bobbing, touch parity. Land jump apex byte-identical (FOREVER pin).

buildFlowField + ctx.flowAt in the pure entity interpreter: a BFS flow field per chase target (cache key = target cell, map cap 4 for MP), engaged only inside the avoidance window so open-field chases stay byte-identical. U-pocket escape proven live in 413 ticks.

Same-plan item references: trigger actions accept new:<i> against the plan's place list (REF-REMAP via planIdxMap like collect/trade), the server resolves valueRef{itemRef} to real ids after assignIds. Also fixed a silent false lesson in the prompt that claimed ops order could do this.

NPCs joined the context-menu family: edPickNpc (ground-point ray, 2.5u radius) → set/edit line via edTextOverlay (max 90 chars) + remove. Write channel is entity.remove+entity.add in one batch — the closed add-whitelist keeps it batch-death-safe; T&S runs on the existing ops text gate.

suggestNextBuilds (the never-empty floor under the LLM chips) now consults the genre-sense graph verdict BEFORE the concept text: GenreSense.deepen(sense(graph)) contributes up to 2 curated deepening wishes (≤40 chars, one per detected genre, score-ordered). Empty verdict = byte-identical legacy path, pinned by goldens.

New genre-sense.js (UMD, pure, deterministic): 5 detectors (combat arena / parkour course / collect quest / npc village / puzzle box) scored from contract truth only — logic kinds, entity behaviors, macroform ops; signature weights, min 2 points, honest [] on empty worlds. One grammar, three consumers: prompt dynamics line, #edgenre build badge, suggestion chips.

Direction-fan steering in the pure entity interpreter (22.5° steps to ±135°, hard side hysteresis + 8-tick decay, ≤12 checks/tick, deterministic; open-field paths stay byte-identical). Typed attack patterns on hostiles: lunge (approach → 0.6s telegraph → 2.2x sprint → tired) and circle (~6u orbit + ~3s stab cycle), phase time accumulated only — MP/replay-safe. U-pockets remain local minima (A* is its own file).

edNudgeY (0.5 grid, clamp 0..60, undo-integrated via the edit-text pattern) and edNudgeRy (15° steps, free ry with 0..2π wrap) as context-menu chips + touch-row ▲/▼ buttons; item.move carries at=[x,y,z] end-to-end. Q/E keep the fast 45° turns.

entity.say (one line, max 90 chars, normalized) + trigger action do:npc value:<id>:say on every trigger kind. Text runs through both moderation gates (op channel + publish). The bubble is a procedural canvas sprite over the NPC head, 3.2s, dispose-clean — pure client theater like fx, so multiplayer stays deterministic.

New trigger action do:item value:<id>:show|hide with existence checks; kernel truth s.itemHidden (initState + copy line, MP/replay-safe); client consumer reuses the collect-vanish pattern (mesh visible + collider toggle). Hand path: item dropdown in the wire panel, distance-sorted, cap 30.

The edbar panel measured 47% of a 375x812 viewport. Added a collapse grip (375→154px, save stays reachable) and auto-collapse after tile pick — gated to coarse-pointer/touch so desktop mouse workflows keep the open panel.

Two new structure ops: orb (voxel sphere, r 2-12, y 0-40 — floats or rests) and disc (flat circle/ring via inner radius). Sphere geometry pinned by a PLANET golden (equator wider than poles, deterministic hashes, parts budget under 600); situational prompt lesson covers planet/ring/dome wishes.

Wire panel on counter nodes: threshold stepper + existing gate/light target picker; counter dropdown (+1/-1/reset) on switch/plate/goal_zone, all through one logic.edit op (actionsAt lives on counter/score only, 0 clears). Counters got a visible body — an obelisk whose cube spins faster near the threshold.

New typed logic kind counter {at, max?, actionsAt?, actions?, targets?} + counter reference action <id>:+1|-1|reset on every trigger. Threshold fires once (actFired), reset re-arms for repeatable waves. Same-plan references resolve to server ids, so counter + lever land in one sentence.

Realtime push for live co-edit: the /create wrapper holds a Supabase channel per world (same bridge pattern as the multiplayer netcode); own saves broadcast the fresh graphHash, foreign broadcasts trigger the existing diff re-mount. The 12s poll stays as fallback — truth remains the single server op channel.

The selective-bloom double composer was building the entire shadow map twice per frame (occlusion pass + lit pass). Shadow updates are now stamped exactly once per frame; optics proven byte-identical across the visual regression scenes.

One-time rename gate: the existing signup username route now handles established accounts, burning a username_changed_at flag in auth user_metadata only after the rename lands. Same moderation + case-insensitive collision rules as signup; profiles stays server-written (RLS #19).

Header nav gained Discover/+Create/Updates; the wordmark routes signed-in players to /discover instead of the landing page. Discover: sort simplified (new/loved), category chips became a multi-select checkbox dropdown (filterShelf now ORs over selected badges), weekly-challenge UI removed.

Root cause: the session-refresh proxy wiped ALL auth cookies on ANY getUser() failure — a transient auth-host blip (network/timeout/5xx, e.g. right after an OAuth callback) nuked a valid session. The catch now only clears cookies when the refresh token is definitively dead (invalid_grant / refresh_token_not_found); transient errors pass through and the next request retries.

Live co-edit v1: a lightweight ?head=1 delta poll (graphHash only, no graph payload) every 12s in build mode; foreign hash → toast + diff re-mount that stages only NEW items. Own saves can't false-trigger (every POST response refreshes the local hash + a 5s quiet-guard). Last-write-wins over the single server op channel — no CRDT.

World-ceiling lift: contract caps 64→256 structures, 64→128 logic nodes, mapBounds up to 800. Roaming ring scales with mapBounds. Full-cap benchmark: mount 160ms, sim 0.55ms/tick, collision grid 0.011ms — the sim core stays healthy at max load (measured via the new __simProbe QA hook).

Custom assets end-to-end: validated user defs (24 parts, 33 closed roles) with deterministic u_<name>-<hash> slugs, def.register op + world-portable graph.defs, AI channel + hand-built ✨ builder UI with live ghost preview, T&S gate on def names at publish.

Composable logic: actions edges (time/weather/ambience/fx/spawner/music, max 4) on switch/plate/goal_zone/timer/score, AND/OR combinator nodes, same-plan references (valueRef/inputsRef) so one sentence wires lever→wave→gate. Hand path: wire panel with target picker on every logic marker.

Sound layer: p.sound emitters (6 procedural loops, distance falloff + stereo panning, pooled, cap 8 audible) + settings.music (5 generative beds on a dedicated gain bus, 3s crossfade) + do:music trigger action. All synthesized in AudioContext — zero audio assets shipped.