Lots of content

docs/m0-verification.md

@@ -0,0 +1,150 @@
+# M0 final technical verification
+
+Local verification date: **2026-11-01**; retained run timestamps cross into
+**2026-11-02 UTC**. **Point-in-time M0 record:** M0 was complete against its
+Windows technical exit gates; M1 had not started at this verification. M1 source
+and later verification are recorded separately in [m1-verification.md](m1-verification.md).
+This M0 evidence is not user/operator approval,
+production authorization, clean-machine certification or a performance report.
+See [decisions and ledger](m0-decisions.md#verification-and-acceptance-ledger)
+and [roadmap](roadmap.md).
+
+## Environment and evidence handling
+
+- Existing Windows development host; absolute Node.js **v24.22.0** executable,
+  Node built-ins only; separately installed official Luanti **5.18.0** selected
+  by explicit absolute `HEARTH_ENGINE`. The launcher verifies reported version,
+  not distribution authenticity. Game **0.1.0-m0**, save schema **1**.
+- Final verification uses the M0-era uncommitted working tree, identified below
+  by exact package digests, not an invented clean commit/revision.
+- Fresh check/smoke and GUI runs use distinct disposable `HEARTH_HOME` roots
+  outside the repository. No original world was opened by this final pass.
+- Absolute Node invokes bounded subprocesses through `execFileSync`; tooling
+  deadline 180 seconds, combined engine deadline 240 seconds, package builds
+  90 seconds each, verification 30 seconds. Both test output streams are retained
+  in complete external logs, not inferred from a truncated terminal preview.
+- Evidence root: `%TEMP%/hearth-m0-final-VB7xU2`; tooling, engine, package and GUI
+  logs remain there. `%TEMP%/hearth-m0-final-latest.json` records run metadata.
+  These are local evidence locations, not public/downloadable artifacts.
+- Only README and the three M0/roadmap documentation files are changed by this
+  pass. No gameplay, scripts, fixtures or default dist export is edited.
+- Final validation: every captured non-documentation input hash remained
+  unchanged; all four documents were confirmed saved and their local file links
+  resolved. Editor diagnostics reported no errors. Repository-wide
+  `git -c core.whitespace=cr-at-eol diff --check` completed successfully with
+  empty output (the setting accommodates Windows CRLF without rewriting files).
+
+## Current automated and package results
+
+Commands below identify existing entry points; every invocation used the
+absolute Node executable, not an assumed PATH runtime.
+
+| Entry point / observation | Actual result |
+| --- | --- |
+| `--test tests/tooling.test.mjs` | **17 passed, 0 failed, 0 skipped**; 17 named tests, not an empty-file pass. |
+| `scripts/run.mjs test` | **PASS**; check, smoke and overall test markers, verified package-load markers and zero exits. No separate `HEARTH_LUA` interpreter was used. |
+| Engine compilation | **24 Lua files** compiled; compilation is not counted as unit execution. |
+| Isolated content suite | **19** checks. |
+| Schema suite | **24** checks. |
+| Runtime scheduler safety suite | **10** checks. |
+| Player lifecycle safety suite | **16** checks. |
+| Persistence suite | **23** checks. |
+| Model suite | **11** checks. |
+| Clock suite | **20** checks. |
+| Integrated unit total | **123 checks across seven suites**; live-engine registry/crafting/terrain/resources/enclosure smoke also passed. |
+| `scripts/run.mjs package <new-external-destination>` twice; `verify <fresh-package>` | **PASS**, identical exact manifests; **57 payload files / 62 inventory entries** (manifest itself excluded). |
+
+The 17 tooling tests include repeatable assets/manifests, existing-output refusal,
+atomic build cleanup, missing/extra/tampered file and empty-directory rejection,
+binary backup/restore, offline locks and SQLite sidecars, prelaunch snapshots,
+unmanaged-world refusal, links/junctions/traversal, portable path selection,
+exact engine version checks, first-session/summer/winter/production guards and
+CLI backup/restore/package verification. Integrated suites additionally cover
+legacy/invalid/future schema behavior and runtime/player safety.
+
+### Exact fresh package identity
+
+The stale default dist export was neither trusted nor overwritten. Two entirely
+new temporary destinations were built and verified. SHA-256 values:
+
+| Definition | Digest |
+| --- | --- |
+| Complete manifest file bytes | `cfd0efdc6e21d99c9f861575a65222bb52838fad38f4d61a5dd77ca034438bc9` |
+| Compact `JSON.stringify(manifest)`; launcher package-load marker | `167682853c55cda4a5b5e960ec5e2cf0ef0c2f69b604fdf28e8020efbb3e009d` |
+| Pretty-printed `manifest.entries` plus final LF; recovery-style inventory digest | `c5979ccbbaf3f2e245073927d43a44316ad2ca4f04b782658f1bbeb8219436f8` |
+
+These are different digest definitions, not contradictory checksums. The package
+is a game directory, not an archive, engine bundle or installer. It excludes
+worlds, launcher scripts and the full test suite. Documentation-only edits do not
+affect its payload inventory.
+
+## Current GUI verification
+
+`scripts/run.mjs play` used a fresh disposable external home and explicit engine,
+not the user's original world. The launcher repackaged the current inputs; its
+required package-load marker matched the **exact compact manifest digest above**.
+Thus GUI evidence covers identical verified payload bytes, not a direct launch
+of an exported directory containing no launcher tooling.
+
+The log records client join, client leave and server shutdown. An external,
+bounded process called `CloseMainWindow` only after join output; the launcher
+exited successfully and its owned embedded game copy was removed. No sleep or
+gameplay/script modification was used. This is a startup/save/shutdown check,
+not a movement, fun, long-session or performance playtest.
+
+Earlier launcher-agent evidence separately records **two** GUI launches of a
+disposable persistent-style world: metadata stayed byte-exact, a sentinel was
+retained, two prelaunch snapshots were retained and embedded copies were cleaned.
+That is earlier regression evidence, not two additional launches claimed here.
+
+## Retained recovery evidence
+
+The newest sanitized report was read from the external runtime backups area;
+recovery was **not rerun against the original world** during this final pass.
+Report identity: timestamp **2026-11-02T01:43:35.559Z**, token
+`fa103b35-9f98-45e5-b429-2ecb6f38c29c`; publication mtime
+**2026-11-02T01:43:56.319Z**. It is a sibling report outside the immutable snapshot.
+Only sanitized summary fields were exposed; no source paths, raw records,
+coordinates, credentials or player identities are reproduced here.
+
+| Retained fact | Report result |
+| --- | --- |
+| Engine / public readiness | 5.18.0 / `publicReady: false`. |
+| Source preservation | `sourceUnchanged: true`; nine source files. This is the earlier runner's inventory comparison, not a new source inspection. |
+| Snapshot integrity | `backupVerified: true`; immutable legacy backup bytes verified. |
+| Restores / engine shutdowns | **2 byte-exact restores**, **2 successful engine shutdowns**, no clients. |
+| Assertions | **79 seed + 81 restart = 160**. |
+| Existing / legacy records | **2 existing keys, 2 legacy keys**; migrated records preserved. |
+| Existing source claims | **0**. No assertion that nonempty source claim ownership was preserved. |
+| Additional fixture evidence | Saved spawn, protection checks, synthetic player adapter, node metadata/inventory and absolute fire expiry verified. |
+
+That report identifies **57 package files** and recovery-style package inventory
+SHA-256 `a8c1c4e1459f37ed49ca882d6b7aa68a6ddc1e2bfd0ad66c7c534b6566163ed1`.
+It **differs from the fresh final inventory digest**. The report therefore proves
+the earlier recovery run only; it is not relabeled as recovery of the final
+export. Current final code is covered by the fresh 123 integrated checks,
+17 tooling tests and GUI/package evidence above. No unsupported claim of byte
+identity between earlier and final gameplay inputs is made.
+
+Because the source had zero claims, claim-owner integration/protection evidence
+comes from regression fixtures and mocked coverage, not preservation of actual
+source claims. Synthetic player-adapter and node fixtures are not a live-client
+recovery rehearsal. Neither this report nor current tests promise transactional
+metadata writes or crash durability. Private backup custody/ACLs, encryption,
+retention, capacity and an eventual operator-controlled cutover remain separate.
+
+## Scope closed at M0; work retained for later milestones
+
+- **Windows:** current native automated and GUI verification passed on the
+  existing development host. No clean checkout on a new machine was tested.
+- **Linux/macOS:** portable path selection has unit coverage only; native
+  execution remains unverified. No broader support certification is claimed.
+- **M1:** not started. Hardware/network figures remain provisional review
+  targets, not measured/accepted budgets. No FPS, p95, multiplayer load or
+  latency measurements were taken. Measure and review them in M1.
+- **Before M2:** the user/operator must approve community coordinates before
+  climate staging. Synthetic fixtures do not choose that location and the
+  decision is not a blocker to completed M0 technical work.
+- **Approval and release:** no user sign-off is fabricated. Browser parity,
+  production hardening, full F17–F19 launch acceptance and clean-machine
+  certification are not implied by M0 completion.