last-hearth/docs/m0-verification.md

M0 final technical verification

Local verification date: 2026-11-01; retained run timestamps cross into 2026-11-02 UTC. Point-in-time M0 record: M0 was complete against its Windows technical exit gates; M1 had not started at this verification. M1 source and later verification are recorded separately in m1-verification.md. This M0 evidence is not user/operator approval, production authorization, clean-machine certification or a performance report. See decisions and ledger and roadmap.

Environment and evidence handling

• Existing Windows development host; absolute Node.js v24.22.0 executable, Node built-ins only; separately installed official Luanti 5.18.0 selected by explicit absolute HEARTH_ENGINE. The launcher verifies reported version, not distribution authenticity. Game 0.1.0-m0, save schema 1.
• Final verification uses the M0-era uncommitted working tree, identified below by exact package digests, not an invented clean commit/revision.
• Fresh check/smoke and GUI runs use distinct disposable HEARTH_HOME roots outside the repository. No original world was opened by this final pass.
• Absolute Node invokes bounded subprocesses through execFileSync; tooling deadline 180 seconds, combined engine deadline 240 seconds, package builds 90 seconds each, verification 30 seconds. Both test output streams are retained in complete external logs, not inferred from a truncated terminal preview.
• Evidence root: %TEMP%/hearth-m0-final-VB7xU2; tooling, engine, package and GUI logs remain there. %TEMP%/hearth-m0-final-latest.json records run metadata. These are local evidence locations, not public/downloadable artifacts.
• Only README and the three M0/roadmap documentation files are changed by this pass. No gameplay, scripts, fixtures or default dist export is edited.
• Final validation: every captured non-documentation input hash remained unchanged; all four documents were confirmed saved and their local file links resolved. Editor diagnostics reported no errors. Repository-wide git -c core.whitespace=cr-at-eol diff --check completed successfully with empty output (the setting accommodates Windows CRLF without rewriting files).

Current automated and package results

Commands below identify existing entry points; every invocation used the absolute Node executable, not an assumed PATH runtime.

Entry point / observation	Actual result
--test tests/tooling.test.mjs	17 passed, 0 failed, 0 skipped; 17 named tests, not an empty-file pass.
scripts/run.mjs test	PASS; check, smoke and overall test markers, verified package-load markers and zero exits. No separate HEARTH_LUA interpreter was used.
Engine compilation	24 Lua files compiled; compilation is not counted as unit execution.
Isolated content suite	19 checks.
Schema suite	24 checks.
Runtime scheduler safety suite	10 checks.
Player lifecycle safety suite	16 checks.
Persistence suite	23 checks.
Model suite	11 checks.
Clock suite	20 checks.
Integrated unit total	123 checks across seven suites; live-engine registry/crafting/terrain/resources/enclosure smoke also passed.
scripts/run.mjs package <new-external-destination> twice; verify <fresh-package>	PASS, identical exact manifests; 57 payload files / 62 inventory entries (manifest itself excluded).

The 17 tooling tests include repeatable assets/manifests, existing-output refusal, atomic build cleanup, missing/extra/tampered file and empty-directory rejection, binary backup/restore, offline locks and SQLite sidecars, prelaunch snapshots, unmanaged-world refusal, links/junctions/traversal, portable path selection, exact engine version checks, first-session/summer/winter/production guards and CLI backup/restore/package verification. Integrated suites additionally cover legacy/invalid/future schema behavior and runtime/player safety.

Exact fresh package identity

The stale default dist export was neither trusted nor overwritten. Two entirely new temporary destinations were built and verified. SHA-256 values:

Definition	Digest
Complete manifest file bytes	cfd0efdc6e21d99c9f861575a65222bb52838fad38f4d61a5dd77ca034438bc9
Compact JSON.stringify(manifest); launcher package-load marker	167682853c55cda4a5b5e960ec5e2cf0ef0c2f69b604fdf28e8020efbb3e009d
Pretty-printed manifest.entries plus final LF; recovery-style inventory digest	c5979ccbbaf3f2e245073927d43a44316ad2ca4f04b782658f1bbeb8219436f8

These are different digest definitions, not contradictory checksums. The package is a game directory, not an archive, engine bundle or installer. It excludes worlds, launcher scripts and the full test suite. Documentation-only edits do not affect its payload inventory.

Current GUI verification

scripts/run.mjs play used a fresh disposable external home and explicit engine, not the user's original world. The launcher repackaged the current inputs; its required package-load marker matched the exact compact manifest digest above. Thus GUI evidence covers identical verified payload bytes, not a direct launch of an exported directory containing no launcher tooling.

The log records client join, client leave and server shutdown. An external, bounded process called CloseMainWindow only after join output; the launcher exited successfully and its owned embedded game copy was removed. No sleep or gameplay/script modification was used. This is a startup/save/shutdown check, not a movement, fun, long-session or performance playtest.

Earlier launcher-agent evidence separately records two GUI launches of a disposable persistent-style world: metadata stayed byte-exact, a sentinel was retained, two prelaunch snapshots were retained and embedded copies were cleaned. That is earlier regression evidence, not two additional launches claimed here.

Retained recovery evidence

The newest sanitized report was read from the external runtime backups area; recovery was not rerun against the original world during this final pass. Report identity: timestamp 2026-11-02T01:43:35.559Z, token fa103b35-9f98-45e5-b429-2ecb6f38c29c; publication mtime 2026-11-02T01:43:56.319Z. It is a sibling report outside the immutable snapshot. Only sanitized summary fields were exposed; no source paths, raw records, coordinates, credentials or player identities are reproduced here.

Retained fact	Report result
Engine / public readiness	5.18.0 / publicReady: false.
Source preservation	sourceUnchanged: true; nine source files. This is the earlier runner's inventory comparison, not a new source inspection.
Snapshot integrity	backupVerified: true; immutable legacy backup bytes verified.
Restores / engine shutdowns	2 byte-exact restores, 2 successful engine shutdowns, no clients.
Assertions	79 seed + 81 restart = 160.
Existing / legacy records	2 existing keys, 2 legacy keys; migrated records preserved.
Existing source claims	0. No assertion that nonempty source claim ownership was preserved.
Additional fixture evidence	Saved spawn, protection checks, synthetic player adapter, node metadata/inventory and absolute fire expiry verified.

That report identifies 57 package files and recovery-style package inventory SHA-256 a8c1c4e1459f37ed49ca882d6b7aa68a6ddc1e2bfd0ad66c7c534b6566163ed1. It differs from the fresh final inventory digest. The report therefore proves the earlier recovery run only; it is not relabeled as recovery of the final export. Current final code is covered by the fresh 123 integrated checks, 17 tooling tests and GUI/package evidence above. No unsupported claim of byte identity between earlier and final gameplay inputs is made.

Because the source had zero claims, claim-owner integration/protection evidence comes from regression fixtures and mocked coverage, not preservation of actual source claims. Synthetic player-adapter and node fixtures are not a live-client recovery rehearsal. Neither this report nor current tests promise transactional metadata writes or crash durability. Private backup custody/ACLs, encryption, retention, capacity and an eventual operator-controlled cutover remain separate.

Scope closed at M0; work retained for later milestones

• Windows: current native automated and GUI verification passed on the existing development host. No clean checkout on a new machine was tested.
• Linux/macOS: portable path selection has unit coverage only; native execution remains unverified. No broader support certification is claimed.
• M1: not started. Hardware/network figures remain provisional review targets, not measured/accepted budgets. No FPS, p95, multiplayer load or latency measurements were taken. Measure and review them in M1.
• Before M2: the user/operator must approve community coordinates before climate staging. Synthetic fixtures do not choose that location and the decision is not a blocker to completed M0 technical work.
• Approval and release: no user sign-off is fabricated. Browser parity, production hardening, full F17–F19 launch acceptance and clean-machine certification are not implied by M0 completion.