# M0 final technical verification Local verification date: **2026-11-01**; retained run timestamps cross into **2026-11-02 UTC**. **Point-in-time M0 record:** M0 was complete against its Windows technical exit gates; M1 had not started at this verification. M1 source and later verification are recorded separately in [m1-verification.md](m1-verification.md). This M0 evidence is not user/operator approval, production authorization, clean-machine certification or a performance report. See [decisions and ledger](m0-decisions.md#verification-and-acceptance-ledger) and [roadmap](roadmap.md). ## Environment and evidence handling - Existing Windows development host; absolute Node.js **v24.22.0** executable, Node built-ins only; separately installed official Luanti **5.18.0** selected by explicit absolute `HEARTH_ENGINE`. The launcher verifies reported version, not distribution authenticity. Game **0.1.0-m0**, save schema **1**. - Final verification uses the M0-era uncommitted working tree, identified below by exact package digests, not an invented clean commit/revision. - Fresh check/smoke and GUI runs use distinct disposable `HEARTH_HOME` roots outside the repository. No original world was opened by this final pass. - Absolute Node invokes bounded subprocesses through `execFileSync`; tooling deadline 180 seconds, combined engine deadline 240 seconds, package builds 90 seconds each, verification 30 seconds. Both test output streams are retained in complete external logs, not inferred from a truncated terminal preview. - Evidence root: `%TEMP%/hearth-m0-final-VB7xU2`; tooling, engine, package and GUI logs remain there. `%TEMP%/hearth-m0-final-latest.json` records run metadata. These are local evidence locations, not public/downloadable artifacts. - Only README and the three M0/roadmap documentation files are changed by this pass. No gameplay, scripts, fixtures or default dist export is edited. - Final validation: every captured non-documentation input hash remained unchanged; all four documents were confirmed saved and their local file links resolved. Editor diagnostics reported no errors. Repository-wide `git -c core.whitespace=cr-at-eol diff --check` completed successfully with empty output (the setting accommodates Windows CRLF without rewriting files). ## Current automated and package results Commands below identify existing entry points; every invocation used the absolute Node executable, not an assumed PATH runtime. | Entry point / observation | Actual result | | --- | --- | | `--test tests/tooling.test.mjs` | **17 passed, 0 failed, 0 skipped**; 17 named tests, not an empty-file pass. | | `scripts/run.mjs test` | **PASS**; check, smoke and overall test markers, verified package-load markers and zero exits. No separate `HEARTH_LUA` interpreter was used. | | Engine compilation | **24 Lua files** compiled; compilation is not counted as unit execution. | | Isolated content suite | **19** checks. | | Schema suite | **24** checks. | | Runtime scheduler safety suite | **10** checks. | | Player lifecycle safety suite | **16** checks. | | Persistence suite | **23** checks. | | Model suite | **11** checks. | | Clock suite | **20** checks. | | Integrated unit total | **123 checks across seven suites**; live-engine registry/crafting/terrain/resources/enclosure smoke also passed. | | `scripts/run.mjs package ` twice; `verify ` | **PASS**, identical exact manifests; **57 payload files / 62 inventory entries** (manifest itself excluded). | The 17 tooling tests include repeatable assets/manifests, existing-output refusal, atomic build cleanup, missing/extra/tampered file and empty-directory rejection, binary backup/restore, offline locks and SQLite sidecars, prelaunch snapshots, unmanaged-world refusal, links/junctions/traversal, portable path selection, exact engine version checks, first-session/summer/winter/production guards and CLI backup/restore/package verification. Integrated suites additionally cover legacy/invalid/future schema behavior and runtime/player safety. ### Exact fresh package identity The stale default dist export was neither trusted nor overwritten. Two entirely new temporary destinations were built and verified. SHA-256 values: | Definition | Digest | | --- | --- | | Complete manifest file bytes | `cfd0efdc6e21d99c9f861575a65222bb52838fad38f4d61a5dd77ca034438bc9` | | Compact `JSON.stringify(manifest)`; launcher package-load marker | `167682853c55cda4a5b5e960ec5e2cf0ef0c2f69b604fdf28e8020efbb3e009d` | | Pretty-printed `manifest.entries` plus final LF; recovery-style inventory digest | `c5979ccbbaf3f2e245073927d43a44316ad2ca4f04b782658f1bbeb8219436f8` | These are different digest definitions, not contradictory checksums. The package is a game directory, not an archive, engine bundle or installer. It excludes worlds, launcher scripts and the full test suite. Documentation-only edits do not affect its payload inventory. ## Current GUI verification `scripts/run.mjs play` used a fresh disposable external home and explicit engine, not the user's original world. The launcher repackaged the current inputs; its required package-load marker matched the **exact compact manifest digest above**. Thus GUI evidence covers identical verified payload bytes, not a direct launch of an exported directory containing no launcher tooling. The log records client join, client leave and server shutdown. An external, bounded process called `CloseMainWindow` only after join output; the launcher exited successfully and its owned embedded game copy was removed. No sleep or gameplay/script modification was used. This is a startup/save/shutdown check, not a movement, fun, long-session or performance playtest. Earlier launcher-agent evidence separately records **two** GUI launches of a disposable persistent-style world: metadata stayed byte-exact, a sentinel was retained, two prelaunch snapshots were retained and embedded copies were cleaned. That is earlier regression evidence, not two additional launches claimed here. ## Retained recovery evidence The newest sanitized report was read from the external runtime backups area; recovery was **not rerun against the original world** during this final pass. Report identity: timestamp **2026-11-02T01:43:35.559Z**, token `fa103b35-9f98-45e5-b429-2ecb6f38c29c`; publication mtime **2026-11-02T01:43:56.319Z**. It is a sibling report outside the immutable snapshot. Only sanitized summary fields were exposed; no source paths, raw records, coordinates, credentials or player identities are reproduced here. | Retained fact | Report result | | --- | --- | | Engine / public readiness | 5.18.0 / `publicReady: false`. | | Source preservation | `sourceUnchanged: true`; nine source files. This is the earlier runner's inventory comparison, not a new source inspection. | | Snapshot integrity | `backupVerified: true`; immutable legacy backup bytes verified. | | Restores / engine shutdowns | **2 byte-exact restores**, **2 successful engine shutdowns**, no clients. | | Assertions | **79 seed + 81 restart = 160**. | | Existing / legacy records | **2 existing keys, 2 legacy keys**; migrated records preserved. | | Existing source claims | **0**. No assertion that nonempty source claim ownership was preserved. | | Additional fixture evidence | Saved spawn, protection checks, synthetic player adapter, node metadata/inventory and absolute fire expiry verified. | That report identifies **57 package files** and recovery-style package inventory SHA-256 `a8c1c4e1459f37ed49ca882d6b7aa68a6ddc1e2bfd0ad66c7c534b6566163ed1`. It **differs from the fresh final inventory digest**. The report therefore proves the earlier recovery run only; it is not relabeled as recovery of the final export. Current final code is covered by the fresh 123 integrated checks, 17 tooling tests and GUI/package evidence above. No unsupported claim of byte identity between earlier and final gameplay inputs is made. Because the source had zero claims, claim-owner integration/protection evidence comes from regression fixtures and mocked coverage, not preservation of actual source claims. Synthetic player-adapter and node fixtures are not a live-client recovery rehearsal. Neither this report nor current tests promise transactional metadata writes or crash durability. Private backup custody/ACLs, encryption, retention, capacity and an eventual operator-controlled cutover remain separate. ## Scope closed at M0; work retained for later milestones - **Windows:** current native automated and GUI verification passed on the existing development host. No clean checkout on a new machine was tested. - **Linux/macOS:** portable path selection has unit coverage only; native execution remains unverified. No broader support certification is claimed. - **M1:** not started. Hardware/network figures remain provisional review targets, not measured/accepted budgets. No FPS, p95, multiplayer load or latency measurements were taken. Measure and review them in M1. - **Before M2:** the user/operator must approve community coordinates before climate staging. Synthetic fixtures do not choose that location and the decision is not a blocker to completed M0 technical work. - **Approval and release:** no user sign-off is fabricated. Browser parity, production hardening, full F17–F19 launch acceptance and clean-machine certification are not implied by M0 completion.