A foreign connection id, a malformed frame, a sender no Connect admitted, a
Connect with the peer table full, and any packet the session refuses ended
the transport loop with an Err. Odin died twice this way after nginx reloads
moved its UDP flows (require_connection: connection id does not match).
The hub and the socket transport now drop such packets and count them in
CultNetTransportStats::packets_dropped. Only socket I/O errors leave the
loop. The socket transport checks the connection id before it touches the
peer endpoint or session, so a stray Connect can no longer move the endpoint
or reset the session.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Imagination rebuilt the writer-thread scheduler Soul pass 3 proposed: it
deadlocks exactly as bcae483 did (deleted in 4562340). The map keeps per-writer
delivery, validates getters before minting, isolates observers, and moves the
shard log onto a gate-held journal. Q-P1..Q-P4 open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul: merge. The drop gate calls the model's one candidate rule; every ref write
ends in CreateRecordRef; node ids injective (69,905-string brute force, 0
collisions). Operator click-through still owed (steps in the Cut 2 report).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stryker on the escaping showed the pair-skip branch uncovered and the run
offset unpinned; the kinds now include a valid pair, a replacement character
before a lone low surrogate, a reversed pair, and two unpaired surrogates.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The record list draws GroupRecords as foldouts (fold state keyed by listed
type and node id), each with Create through CreateInGroup; an ungrouped type
lists RecordCandidates flat under the model's notice. Add, Create and
Duplicate reveal the new record's path. Rows start the record drag.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A record row dragged onto a CultRecordRef value sets it when the ref's picker
would offer that record (IsRecordCandidate), refusing in a disabled scope, a
foreign model, or the key already held. The ref popup's None/Missing label
now comes from RecordRefLabel.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Uri.EscapeDataString maps every unpaired surrogate to %EF%BF%BD, so distinct
values shared one node id. An unpaired surrogate now spells %uXXXX.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Ids that differ only by %2F versus /, keys that differ only by case, and
unpaired surrogates each get a test; the ungrouped list stays flat.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Soul: no defect; independent port of stegu 22434e04d7 matches (3D and 2D), goldens
confirmed independently, value jump 2.2e-6 over 20k crossings, gradient FD 9.7e-6,
every hand mutant killed. 2D follows upstream by ruling. Release follow-ups: rebuild
the Unity CultMath.dll, CHANGELOG entry, pin the two HLSL copies equal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul: merge. [CultInspectorGroupBy], GroupingOf/GroupRecords/CreateInGroup,
IsRecordCandidate (one candidate predicate), RecordRefLabel; variants group by
resolved value and follow their base. Follow-ups in Cut 2: pin '%' escaping and
case-distinct keys, distinct ids for lone surrogates, fold state keyed by type+id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closed after three Soul passes: the double iterate and progress stop hold over
~9000 cases against exact enumeration, zero allocation, deterministic; the stall
rule and fScale are now pinned (all six survivors killed). Ships in the next
CultMath release with Asura. Recorded, outside the documented range: 18/6000
gap misses at cond 1e5-3e5 with A scaled 1e-4..1e4 (solver or reference unknown).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stryker survivors on the grouping diff: the no-declaration path, the
null-string identity, the inherited [CultGlobal] check and the id separator.
GroupLevel takes text and tie as optional arguments so the scalar kinds
stop passing constant strings that could be swapped without any effect.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Batches of small boxed problems whose passes end with the KKT test failing and
the cost unmoved (dependent free columns, releases the factor drops, weak-direction
noise-floor problems). They must report Converged, and land within the documented
gap of an exact active-set enumeration. Pins the stall comparison and the cost
scale in Objective, which no test reached before.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Seven values change: four snoise(float3) in HlslSemanticsTests and three snoise(float2)
in MathTests (the 2D (0,0) golden is 0 either way). Regenerated from the code after the
continuity probe passed. The tests no longer claim to match Unity.Mathematics, whose
snoise keeps the old constants.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
[CultInspectorGroupBy(nameof(A), nameof(B))] on a document class names the
members its record list groups by, outermost first. CultInspectorModel owns
the rest: GroupingOf validates the declaration (a refused one gives a flat
list and a notice), GroupRecords partitions RecordCandidates by value
identity with occupied values only, CreateInGroup builds the record a node
holds, RecordRefLabel owns None and Missing <key>. A variant groups by its
resolved Document.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drops the unreproducible floors and detection-scale claims, and the seam-fluke
consistency filter (the spikes it hid were the snoise seam, now fixed and pinned by the
continuity probe). Tightens the tolerances to at least 5x the harness maximum (ridged
0.5 -> 0.05), corrects the point count in the bit-equality test, and caps the ridged
compounding loop so a mutant fails loudly instead of hanging.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
RecordCandidates and the new IsRecordCandidate share one rule, so a
picker's candidates and a drop's acceptance cannot disagree. Member
attributes are read with Attribute.GetCustomAttributes(member, true):
PropertyInfo.GetCustomAttributes ignores inherit, so a base abstract
property's inspector attributes never reached the override.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Re-anchored to current main and Aetheria fire-control-12. Grouping gets its own
[CultInspectorGroupBy] attribute; CultIndex stays unique. Sequenced with variants
C2a/C2b/C3 into one joint release (cultlib 1.0.61, Studio 1.5.0); Aetheria
annotations fold into variants C4. Q6 and Q7 open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The map carried only on codex/studio-grouping moves to main. The operator
ruled Q2 A, Q3 A, Q4 A on 2026-09-30. Q5 is overtaken: one Studio release
with variants C3. A refresh pass is due before Hands.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kernel radius^2 0.6 -> 0.5, scale 42 -> 105, permute (34x+1)x -> (34x+10)x, per
stegu/webgl-noise 22434e04d7 (fix 21d9fe23d7, scale ff3b5d34ea, permute a3e6d57095).
snoise_grad, fbm_grad, ridged_grad follow. C#, both HLSL copies, design.md and
THIRD-PARTY-NOTICES.md change together. The 2D snoise shares the permute helper, so
its values change too. Golden values are regenerated in the next commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
With b along the smallest left singular vector, |A^T b| is tiny, so the KKT
tolerance (1e-6 of it) sits below the gradient's rounding noise at cond(A) >=
1e6 and can never be met. The solver must stop on the progress rule, in at most
six passes, never at the cap. This is the path the progress rule exists for;
the earlier fixtures reached it only by accident.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A variant record (v2 store, slot 4 [baseKey, overrides], empty payload)
holds top-level Set overrides and is resolved in the admitting hold.
Readers see complete documents. A base edit re-resolves dependents in the
same commit. Rulings honoured: Q1 a plain Upsert at a variant key is
refused; Q4 an override follows the plain-record outcome (a dropped slot
soft-drifts and is shed, an undecodable value refuses); Q5 the v2 header
only with variants; Q6 the directory store and CultNet refuse variants
(after selection, typed, subscriptions withdrawn). Self's defaults:
invalid overrides are refused at write; R6 is extended to indexes (no
variant shares an indexed value with another record). The held index is
truthful (value to holders, smallest key wins among plain duplicates).
A conditional merge onto disk is judged on the merged set.
Soul made five passes. The held index keeping one key per value caused
three rounds of store-bricking findings until the owner was fixed.
Caching 249, Networking 293, Mesh 262, cross-runtime interop 36/36.
Follow-ups: TS/Python plain-duplicate parity, a subscription id on
per-change refusals, a removal-order test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two tolerance behaviours had no observer: the scale taken at the box point
nearest the origin (a 6e-5 release on a 1000-scale problem, in either column
position), and the strict comparisons when the scale and the gradient are both
exactly zero (b = 0 at the origin takes no iteration).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reconcile's withdrawal sent an untyped error with no subscription id and left the
peer holding the rows the subscription had delivered. It now sends removals for
those rows, then a variant_unsupported error whose details carry
field "subscriptionId" and the id (the existing details slots; no new wire key).
The subscribe and per-change paths use the same code. The error schema and the
Rust CultNetErrorCode accept variant_unsupported, so a Rust peer decodes it
instead of refusing an unknown code.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- RefuseVariantIndexSharing built its holder list per landing record by scanning
every landing record, so opening a store with one variant was quadratic. It now
groups what lands once and looks each (index, value) up once. Pinned by a count
of index-accessor reads at two sizes, not a clock.
- JudgeMerge decoded every unseen disk record before Resolve could exit early,
so a plain-only store failed a conditional commit on another writer's schema it
does not register. It now judges only when the batch, the disk (by the record's
variant header, never its payload) or this cache holds a variant.
- Plain duplicates find the holder with the smallest key (ordinal), so the choice
is the same live, after a flush and after a reopen. The comment claiming "most
recently indexed" was wrong across reload.
- A dropped slot is reported once per record, not once by the schema diff and
again by the variant.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The full-step clamp repairs an out-of-box start on a free column, so the
warm-start clamp was invisible to the old test (Stryker: five survivors). The
new table runs one column with b beyond the box and a cap of 0, where the
solver returns the clamped start untouched, across finite, infinite and NaN
starts and finite and infinite bounds.
Workspace junk (including NaN doubles) is now checked on random boxed problems
that release bounds and use the tolerance, with bit-identical x and equal
iteration counts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Measured with Stryker once Solve was actually mutated (21 survivors), most of
them were code that decided nothing:
- The finite-input loops over A and b duplicated the non-finite test on the
accumulated A^T b, which is exactly equivalent (floats cannot overflow a
double product, and NaN/infinity never cancel to a finite value). One check
on each A^T b entry remains.
- The tolerance scale is the gradient at the box point nearest the origin,
computed inline; the max with |A^T b| duplicated it whenever the origin is in
the box, and the scratch vector for it is gone.
- Bound violation is state * gradient, which is zero for a free column; the
three-way ternary duplicated the free-stationarity check.
- The warm-start clamp is Math.Clamp plus a NaN test.
- Workspace slices come off a cursor (Take) instead of hand-summed offsets.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stryker left the refinement step (removed, negated, or subtracted) unobserved,
and it is unobservable for a reason: refinement with a same-precision residual
does not improve forward error, and Cholesky is backward stable, so the
residual the KKT test reads is already at rounding level. Measured on n=24
problems at cond(A) 1e3..1e6, the solver with and without the step gives the
same iteration counts and the same x error against a Gram-Schmidt QR
reference (both limited by cond(A^T A) * eps).
The refinement pass, its dp buffer and the scratch vector are deleted;
WorkspaceLength returns to 4n^2 + 15n. The doc states where the normal
equations stop being optimal (cost gap below 1e-6 |b|^2 through cond(A) 3e5,
about 2e-5 at 1e6, independent of the scale of A) and that a ridge row beyond
that is the caller's policy.
status is now initialised: the unassigned local made Stryker discard every
mutant inside Solve as a compile error, so 255 mutants were never measured.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
An edge carries the reference payload of its citer's resolved document, and the
citer is never a selected row under `cited`, so a variant citer slipped past the
selected-row refusal. Edges are now checked by the same rule (typed
NotSupportedException naming the variant), on the paged and the whole-set paths.
Reconcile refused a hop subscriber whose selection selected a variant without
withdrawing it, so it was told again on every store change. It withdraws as the
subscribe path does.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The held index kept one key per value, last writer winning, and RemoveKey dropped
a value outright. Two consequences: removing or changing one of two plain
holders left the other unfindable, and the variant index rule judged a variant
against that lossy view, so a variant could land on a value a plain record still
held and the store then refused to reopen.
- _indexes maps a value to the keys holding it, oldest first. Index, Unindex and
the removal maintain the set. GetByIndex finds the most recently indexed
holder of a value, so removing the winner finds the other (behaviour change for
plain duplicates: it used to find nothing).
- One rule, RefuseVariantIndexSharing, serves both write orders. It reads the
truthful index minus what the commit replaces or removes, plus what it lands.
ResolveOne no longer judges indexes; ClaimIncomingIndexValues, HeldByVariants
and RefusePlainSharingWithVariant are gone.
- A conditional commit merged onto the file is judged by the cache's own
resolution (CacheBackingStore.Judging) on the merged set: records other writers
added, records they removed, and the batch. Another writer's variant sharing a
value with the batch, or a base removal that strands another writer's variant,
is refused with the named refusal instead of writing an unopenable store.
- Shedding is one decision at load. ToStoredDocument resolves the schema once and
returns the report with it; a variant's override of a slot the type lacks is
dropped from the delta there, so flush needs no predicate and every store
reports through the same surface (ReportVariantSheds and OverridesTheTypeHas
are gone). The directory store refuses variants and loads through the same call.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Batch commits on the cache do not reach the database's change stream, so the subscriber's citers were written with database.PutAsync; the variant goes in through UpsertVariantAsync. On the previous source the second subscriber stops receiving after the variant exists (red); it now keeps receiving.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The selection paths (SelectPage, SelectAll) refused every stored variant before the selection ran, so once any variant existed a hop-bearing subscription threw out of its change handler and went silent. They now refuse only a variant the selection selects; the subscription server delivers that as a typed error and keeps its projection. The database server no longer sends removed for a key the subscriber only ever received as an error. A flatten racing the delivery check is recorded in a comment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The index rule is about the commit's result, so it now runs for every commit that changes an indexed value: a plain record landing on a value a variant of the post-commit set holds is refused naming both keys and the index (the held index is never trusted; a plain write had already overwritten it). Plain-vs-plain is untouched. A variant sheds overrides of slots its type lacks when it is flushed, as a plain record sheds the member, and the load's report names the slot when the schema itself never had it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Hand-written and directory-store variants now override their indexed value or
name as the rules require; the subscription test writes its variant through a
committed batch so the file holds it, subscribes by key, and reports what it
saw when it times out.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The unique-index rule refuses a variant that inherits its base's [CultIndex]
value, so the vector's laser-big now carries a code override. Written by the
code under test through the production path; the other runtimes still refuse
it by version and by the laser-big key.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
