World: canonical admission holds, typed finalization and placement

[benhook1013]

Boundary

Published 59eb1d22ac3ec906a64d2db378c79f3353e263d3, 87 unique files, stacked on Game Design prerequisite #3055 d3ec30d5de9a9011b77eaa39649ef04cf1a2e1e2. This coherent World boundary includes authenticated canonical preparation/activation carriers, operational-region allocation, canonical first-admission acquisition/readback, exact ACTIVE read, typed terminal reconciliation and placement/current-location consumers. It is not enabled activation or completed LOGIN → PLAY → LOOK proof.

The complete canonical identity comes from independent authenticated Game Design and Game Session evidence and actual World source/association/materialization storage. Private numeric IDs do not substitute for UUID ownership. Historical preparation/activation/terminal receipts do not supply current admission authority. Canonical and operational region UUIDs remain distinct.

Canonical hold and terminal handoff

• V47 binds both accepted origins, NO_PRIOR_POINTER and EXPECT_CLOSED, to the complete canonical scope, current ACTIVE instance/version/epoch, immutable operation and World hold identity. Retained legacy rows remain untyped and uninferred; termination checks still include them.
• The four exact acquire, hold-identity read, lifecycle read and terminal methods authenticate the same-namespace Game Session workload before decoding or owner access. Their explicit transport gate defaults off. The JWT interceptor bypass applies only to the exact protected methods; unrelated mutations still require their existing authentication.
• Terminalization uses the actual file-backed mTLS Game Session owner client outside World SQL. It verifies the closed response, complete request echo, outcome and immutable proof, including the checked first-open pointer increment. The client rejects wrong server workload/namespace, malformed evidence, ambient transactions and closed handles. Its independent composition gate also defaults off; missing client composition denies terminalization.
• V48 retains full immutable Game Session terminal proof bytes and a separate digest through an exact-row, transaction-bound, one-use terminal manifest. Exact retries retain the original result; PENDING is not terminal, absence is not ABORTED and counter overflow fails closed.
• Forward V50 corrects the earlier operation journal guard to accept exactly NO_PRIOR_POINTER or EXPECT_CLOSED, preserving V46/V49 history and every other canonical request/result/immutability check. New SQL negatives deny null and unknown origins without creating an operation or location.
• V49 makes placement/current-location consumers use that matching typed COMMITTED proof for either origin. EXPECT_CLOSED requires genuine Game Session proof of the exact never-OPEN catalog pointer, not missing history or a fixture assertion. Actual ACTIVE lifecycle, authored ROOM mapping, actor/assignment and immutable APPLIED readback remain independently checked.

Preparation, activation and player-location adapters remain unregistered/default-denied where their genuine held-authority producer is missing. No runtime activation, canonical writer, membership RPC, credential path or key-ring mount is enabled. Movement/occupancy delivery, family registration, replay/cleanup retention and live owner composition remain open.

Validation and preservation

Normal merge of #3055 preserved all World implementation/test hunks byte-for-byte; only the shared authoring tracker conflict was reconciled to retain both producer and consumer obligations. The composed World/Game Design local fullCheck, both boot JARs and docs gate passed in 2m 03s. World test/integration execution tasks were UP-TO-DATE: their retained XML shows 511 executed unit cases and 197 integration skips, not fresh PostgreSQL execution. Game Design source tests and static checks were included; Docker is unavailable. This head needs its own CI; the historical exact 0ace proof below is not attributed to 59eb. No preserved history was rewritten.

At exact published head 0ace6389ec0e85e1a2a29ffa0be420f7583cb1f0, CI 37577805764 completed: World Build/Test passed. Actual runner checkout f81346b7f999110404dc7a04f682e365d6da5349 has ordered #3041/head parents and a head-identical tree. Raw Graph XML proves 52 PostgreSQL cases executed with zero failures/errors/skips, including EXPECT_CLOSED placement, canonical placement/retry, null/unknown-origin no-mutation denial and retained V39/V41 history; V50 applied. Raw XML SHA-256 is 80d6b4b89a8bf1fe40254698d9f942f4744ee2b4a021e3360330fab569dfc92a. The full verifier reports 101 suites/708 tests, but the bounded captured artifacts do not establish all 197 unique integration definitions or separately capture the three operational-region cases. Do not replace those proof limits with an inferred count. Aggregate failed in Game Session, TCP and Validation Gate; their latest causes are not relabeled from older runs. Upstream owner inputs in World fixtures remain explicitly isolated, not live Game Session/Account/Game Design proof.

The corrected World full gate passed in 2m 16s with the build cache disabled: 511 unit cases executed with zero failures/errors/skips; all 197 integration definitions compiled/discovered but skipped locally without Docker. jOOQ generation, formatting, Checkstyle, SpotBugs, coverage, boot JAR, links and Markdown passed. A final documentation-only gate passed after the tracker clarification. This is not corrected PostgreSQL execution or live owner proof. Physical mTLS units retain explicit owner-store/result doubles.

Prior exact head a36b152fdaf7f5bb5447094cd72718c66f7977de CI 37573659922 executed 196 World integration cases, zero skips, with three failures. Named PostgreSQL suites: graph/application51 cases/two failures and operational-region3 cases/one failure. Runner merge a9ada9077941141a1d3f8b315d1a0bb0cb1ae0f5 has the exact base/head as ordered parents and a head-identical tree. The owned SQL omission rejected legitimate EXPECT_CLOSED placement; V50 supplies its forward correction. The changed actor/assignment fixture now expects the earlier complete-request denial and compares unchanged operation/location storage. The operational-region fixture now expects Spring’s translated integrity exception and the actual immutable-tuple denial, retaining all four attempted substitutions. The connection pool was not the failure cause. The exact current Graph execution above supersedes its corrected-state gap; full-suite and live owner limits remain explicit.

Normal source merge retains exact #3035 1b38b0d5c6c7aa5558ec985e50227bb4bf0b4258 and preserved World history without rewrites. Source adds three actual Account SQL-store/reconciliation-service cases with explicit synthetic remote-owner responses. Its focused source and composed-child checks pass; selected23 cases all skip locally without Docker. Earlier synthetic capture tests are not counted as database proof. Published migration order and Gameplay’s complete owner-proof codecs/API remain intact.

The prior aggregate was also red on Game Session’s unchanged retained-tenant suite (17 cases/three failures) and required LOGIN capture, plus TCP javac heap exhaustion. All Game Session paths are byte-identical to #3041; Gameplay owns the retained-mapping and final-playable consumer correction, with receiving PR unassigned until published. These do not justify weakening the World guard. Exact corrected CI is completed with World success and an outside-World aggregate failure; no aggregate-green or merge-ready claim is made.

Earlier source database proof — not this new migration proof

Source #3035 CI 37569958133 executed 128 PostgreSQL cases plus three non-database component cases, all without failures or skips. Database cases: Account Draft fence 19, JOIN event 7 and publication fence 20; Game Design publication operation 12 and Draft publish selection 9; World graph/application 34, association 12, Draft abort 7 and publication fence 8. Account terminal reconciliation's three cases use mocked repository/clients and a synthetic transaction manager; they are not PostgreSQL or authenticated two-owner settlement proof. The three owner jobs checked out synthetic merge 1f2788d887969c92d754a45bf5133afdd06e626c, whose tree is identical to source a9f32559f. Actual capture verifies the bounded repair removed only the redundant filtered Account rerun while retaining strict proof verification.

That source run's aggregate remains red: TCP reported 13 failures among 17 cases, including PLAY_IDENTITY_UNAVAILABLE after LOGIN; Game Session was cancelled. The component fixtures isolate upstream authority and do not establish genuine multi-owner authorization, this later V47–V49 database behavior or a playable flow. The current exact-head World result above is consumed and does not establish an enabled multi-owner flow.

Remaining mission and review limits

All four Gameplay handoffs remain OPEN: original Account-authorized World APPLIED; genuine immutable Game Design release; authenticated World prepare/ACTIVE with actual Game Session/Entity actor and operational-region delivery; and Account settlement after both exact owner outcomes. Frozen Game Design realm-entry policy delivery is a concrete producer gap recorded in the authoring tracker, not inferred from a roster or numeric source version.

This draft remains outside the configured queue. No provider review, corpus taper, merge readiness, deployment or live owner proof is claimed. FireController retains the bounded Luna implementation/verification records and historical checkpoint evidence.

FireMUD LOC impact

Compared d3ec30d5de9a → 59eb1d22ac3e (PR merge-base → head).
PR scope: 87 changed files · 22,809 added textual lines / 71 deleted textual lines.

Section	Base LOC	Head LOC	Δ LOC	Change
Overall	1,022,100	1,042,957	+20,857	+2.0%
Source	929,344	950,167	+20,823	+2.2%
↳ Code	388,827	396,456	+7,629	+2.0%
↳ Tests	540,517	553,711	+13,194	+2.4%
Markdown	60,186	60,220	+34	+0.1%
Design	62,874	62,908	+34	+0.1%
↳ Architecture	45,554	45,571	+17	+<0.1%
↳ Project management	6,043	6,060	+17	+0.3%
↳ Observability	2,147	2,147	0	0.0%
↳ Operator runbooks	579	579	0	0.0%
↳ gRPC API documentation	7,086	7,086	0	0.0%
↳ Product requirements and user journeys	926	926	0	0.0%
↳ Developer workflows	460	460	0	0.0%
↳ Other design	79	79	0	0.0%

Rows are hierarchical and overlapping views; do not add them together.
LOC means cloc code lines; blank and comment-only lines are excluded.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 66fa9d2b-69ae-464a-8ca7-4d02b72953cc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 78.24710% with 206 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...mon/world/WorldCanonicalInitialPlayerLocation.java	78.57%	22 Missing and 38 partials ⚠️
...mmon/world/WorldCanonicalInitialAdmissionHold.java	81.28%	21 Missing and 14 partials ⚠️
...world/CanonicalWorldInstancePreparationClient.java	67.10%	8 Missing and 17 partials ⚠️
...icalGameInstanceLaunchAssociationReadEvidence.java	62.96%	6 Missing and 14 partials ⚠️
.../CanonicalGameInstanceLaunchAssociationClient.java	69.49%	10 Missing and 8 partials ⚠️
...ld/CanonicalWorldInstancePreparationGrpcCodec.java	82.10%	6 Missing and 11 partials ⚠️
...ssionCanonicalInitialAdmissionOwnerProofCodec.java	75.00%	10 Missing and 4 partials ⚠️
...calGameInstanceLaunchAssociationReadGrpcCodec.java	91.74%	6 Missing and 3 partials ⚠️
...ameSessionCanonicalInitialAdmissionOwnerProof.java	74.19%	3 Missing and 5 partials ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

Validation Summary

❌ One or more validation checks failed

• ❌ Validation gate: failure
• ✅ Buf generation: success
• ✅ Dockerfile lint: success
• ✅ ShellCheck: success
• ✅ Python script validation: success
• ✅ Dev tool contract checks: success
• ⏭️ Dev Tools README contract: skipped
• ✅ YAML lint: success
• ✅ Metrics cardinality policy check: success
• ✅ Flyway migration sanity checks: success
• ✅ gRPC transport configuration sanity checks: success
• ✅ GitHub workflow lint: success
• ✅ Helm chart lint: success
• ✅ Helm render validation: success
• ✅ Helm transaction proof: success
• ✅ Validate Documentation: success
• ✅ Frontend checks: success
• ❌ Service build/test matrix: failure

Coverage reports and failure logs are available in the workflow artifacts.