fix: reject non-finite isoValue and origin in Extract

samples and cellSize were validated but isoValue and origin were not:
iso = NaN or +inf silently returned an empty mesh, and origin = NaN gave
NaN positions. Extend Extract's existing top-of-method validation authority
to reject non-finite isoValue and non-finite origin components with
ArgumentException, matching the existing style, with tests for each
component.

Overflow at extreme magnitudes (cellSize ~3e38, or finite samples whose
interpolation overflows to inf) is a separate, float-domain limit rather
than a validated-input error; documented in the XML doc and provenance
notes, deliberately not range-checked.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitattributes

@@ -1,2 +1,31 @@
 # Auto detect text files and perform LF normalization
 * text=auto
+
+# Shell scripts keep LF in the working tree as well as in the index. Left to
+# `text=auto`, a Windows clone writes them with carriage returns, and the
+# documented Linux path then dies inside the container in under a second: the
+# shebang reads as the interpreter `bash\r`, which does not exist. Nothing about
+# that failure names line endings, and the same clone builds and tests fine
+# everywhere else, so it reads as a broken image rather than a broken checkout.
+#
+# A clone checked out before this rule keeps its carriage returns, because the
+# blob is unchanged and git has no reason to rewrite the file. The one-line
+# repair is in native/GameCult.Mesh.Quic.Native/README.md, beside the container
+# path it unblocks.
+*.sh text eol=lf
+
+# The committed CultMesh QUIC native binaries (cut 6, packaging) ride the
+# deploy `git archive` as raw bytes. `* text=auto` already autodetects them as
+# binary by content, but that autodetection is a heuristic; say so explicitly
+# so no future text-processing rule (a diff driver, an export filter) can
+# apply text conversion and poison the committed digests in SHA256SUMS.
+packages/cultmesh-ts/native/**/*.dll binary
+packages/cultmesh-ts/native/**/*.so binary
+packages/cultmesh-ts/native/**/*.so.* binary
+
+# The digest list and manifest beside them keep LF on every checkout. Left to
+# `text=auto`, a Windows clone writes them with carriage returns, and the
+# documented `sha256sum -c SHA256SUMS` then fails on every line (each filename
+# ends in `\r`) while CI, checking out on Linux, stays green.
+packages/cultmesh-ts/native/SHA256SUMS text eol=lf
+packages/cultmesh-ts/native/MANIFEST.txt text eol=lf

.github/workflows/cultmesh-portability.yml

@@ -95,3 +95,46 @@ jobs:
           dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
           --filter FullyQualifiedName~Document_OneHundredThousandDistinctLeaseCyclesLeaveNoResourcesOrCallbacks
           --logger "console;verbosity=minimal"
+
+      # The TypeScript side of the CultMesh authority rules. This job is the
+      # only one that runs on both Windows and Linux for main, codex/** and
+      # pull requests: cultnet-interop.yml is windows-latest and main-only, so
+      # until these steps existed the shared verifier's tests never ran on
+      # Linux at all, and the browser client's never ran in CI on any OS.
+      # packages/cultnet-ts verifies both vector files; cultmesh-browser proves
+      # the browser client reads the shared rules rather than its own.
+      - name: Verify the CultMesh authority rules with the TypeScript verifier
+        run: npm run test --workspace packages/cultnet-ts
+
+      - name: Verify the browser client against the shared TypeScript verifier
+        run: npm run test --workspace packages/cultmesh-browser
+
+      # The realtime frame codec. Its byte parity rests on two vector files,
+      # contracts/cultmesh/realtime-frame-vectors.json written by the C#
+      # reference and decoded by this step, and realtime-frame-vectors.ts-written.json
+      # written by this codec and decoded by the C# step below. Neither half ran
+      # in CI on any OS until these two steps existed, so a codec that agreed
+      # only with itself would have gone green.
+      - name: Verify the realtime frame codec with the TypeScript codec
+        run: npm run test --workspace packages/cultmesh-ts
+
+      # Both directions of the CultMesh authority vectors: the C#-written
+      # file (contracts/cultmesh/authority-route-vectors.json) and the
+      # TypeScript-signed file (authority-route-vectors.ts-signed.json) are
+      # verified by the C# reference here; the TypeScript side verifies both
+      # in the step above. CULTMESH_WRITE_VECTORS is never set in CI: the
+      # committed files are the contract.
+      - name: Verify the CultMesh authority vectors with the C# reference
+        run: >-
+          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
+          --filter FullyQualifiedName~AuthorityProof
+          --logger "console;verbosity=minimal"
+
+      # The other half of the frame parity: the C# reference decodes and
+      # re-encodes the vector file the TypeScript codec wrote. A fixture
+      # authored on one side alone would only agree with itself.
+      - name: Verify the realtime frame vectors with the C# reference
+        run: >-
+          dotnet test tests/GameCult.Mesh.Tests/GameCult.Mesh.Tests.csproj
+          --filter FullyQualifiedName~RealtimeWireProtocol
+          --logger "console;verbosity=minimal"

.github/workflows/cultnet-interop.yml

@@ -65,6 +65,32 @@ jobs:
           "KOTLIN_JAVA_HOME=$env:JAVA_HOME" | Out-File -FilePath $env:GITHUB_ENV -Append
           "$kotlinHome\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
 
+      - name: Verify CultNet schema contracts stayed consolidated
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $stray = git ls-files '*.schema.json' | Where-Object { $_ -notmatch '^contracts/cultnet/' }
+          # -I skips binary files: unity/org.gamecult.cultlib/Runtime/Plugins/GameCult.Networking.dll
+          # still embeds the retired namespace until it is rebuilt (REC-032 D4, deferred).
+          $oldNamespace = git grep -I -lE 'GameCult/cultnet-ts/(integration/)?contracts' -- ':!.voidbot'
+          if ($LASTEXITCODE -eq 2) {
+            throw "git grep failed"
+          }
+          if ($stray) {
+            Write-Host "Schema files found outside contracts/cultnet/:"
+            $stray | ForEach-Object { Write-Host "  $_" }
+          }
+          if ($oldNamespace) {
+            Write-Host "Files still referencing the retired GameCult/cultnet-ts contracts namespace:"
+            $oldNamespace | ForEach-Object { Write-Host "  $_" }
+          }
+          if ($stray -or $oldNamespace) {
+            throw "CultNet schema contracts drifted out of contracts/cultnet/ (REC-032). See CultLib/contracts/cultnet/ and rewrite any `$id back to https://github.com/GameCult/CultLib/contracts/cultnet/."
+          }
+          # git grep exits 1 when nothing matches, and the runner's pwsh wrapper
+          # ends the step with that $LASTEXITCODE; a clean tree must pass.
+          exit 0
+
       - name: Install Node dependencies
         run: npm install --no-package-lock
 

.github/workflows/publish-packages.yml

@@ -42,8 +42,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
+      # fetch-depth: 0 so the semver check below can see every previously
+      # published tag, not just the one that triggered this run.
       - name: Check out CultLib
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -64,6 +68,19 @@ jobs:
             exit 1
           fi
 
+      # docs/semver-policy.md: a breaking change under too small a bump, or a
+      # version that skips or reverses the previous release, fails here
+      # instead of shipping with a number that lies.
+      - name: Verify semver policy
+        if: startsWith(github.ref, 'refs/tags/cultcache-ts-v')
+        run: |
+          tagged="${GITHUB_REF_NAME#cultcache-ts-v}"
+          node scripts/check-changelog-semver.mjs \
+            --package "@gamecult/cultcache-ts" \
+            --changelog packages/cultcache-ts/CHANGELOG.md \
+            --version "$tagged" \
+            --tag-prefix cultcache-ts
+
       - name: Build and test
         working-directory: packages/cultcache-ts
         run: npm test
@@ -105,9 +122,13 @@ jobs:
             echo "run=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # fetch-depth: 0 so the semver check below can see every previously
+      # published tag, not just the one that triggered this run.
       - name: Check out CultLib
         if: steps.selected.outputs.run == 'true'
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         if: steps.selected.outputs.run == 'true'
@@ -115,6 +136,12 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Node
+        if: steps.selected.outputs.run == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+
       - name: Verify the tag matches the manifest version
         if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
         run: |
@@ -125,6 +152,19 @@ jobs:
             exit 1
           fi
 
+      # docs/semver-policy.md: a breaking change under too small a bump, or a
+      # version that skips or reverses the previous release, fails here
+      # instead of shipping with a number that lies.
+      - name: Verify semver policy
+        if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
+        run: |
+          tagged="${GITHUB_REF_NAME#${{ matrix.package }}-v}"
+          node scripts/check-changelog-semver.mjs \
+            --package "${{ matrix.package }}" \
+            --changelog packages/${{ matrix.package }}/CHANGELOG.md \
+            --version "$tagged" \
+            --tag-prefix "${{ matrix.package }}"
+
       # Lower layers install from source so a release of one package is tested
       # against the sibling revision it was cut with, not whatever PyPI has.
       - name: Install and test

.github/workflows/quic-native.yml

@@ -0,0 +1,202 @@
+name: CultMesh QUIC native
+
+# Builds and, on a tag, releases the CultMesh QUIC native binaries that
+# packages/cultmesh-ts/native/{win32-x64,linux-x64} commits (cut 6,
+# docs/typescript-quic-realtime-cut.md:2108-2159). Under Q8 Option 1 the
+# operator downloads a tagged run's Release assets, verifies every digest
+# against this workflow's own logs and SHA256SUMS, and commits the bytes;
+# nothing here writes to the tree. Under Q6 A, the Linux artifact comes only
+# from the pinned debian:13 container below, never from a local or Yggdrasil
+# build.
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "cultmesh-quic-native-v*"
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # Push to main and pull_request run this job only: it proves the tree's
+  # committed bytes still match the manifest they shipped with. A tag push
+  # also runs it, alongside the two builds and the release.
+  verify-committed:
+    name: Verify committed binaries match SHA256SUMS
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' &&
+        (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/cultmesh-quic-native-v')))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+
+      - name: sha256sum -c SHA256SUMS
+        run: |
+          set -euo pipefail
+          if [ ! -f packages/cultmesh-ts/native/SHA256SUMS ]; then
+            echo "packages/cultmesh-ts/native/SHA256SUMS is missing" >&2
+            exit 1
+          fi
+          cd packages/cultmesh-ts/native
+          sha256sum -c SHA256SUMS
+
+  # workflow_dispatch and a cultmesh-quic-native-v* tag run the two builds.
+  # A dry (workflow_dispatch) run uploads artifacts and creates no release.
+  build-win32-x64:
+    name: Build win32-x64
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/cultmesh-quic-native-v'))
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+
+      - name: Build the native QUIC bridge
+        shell: pwsh
+        run: .\scripts\build-quic-native.ps1 -OutputDirectory artifacts\quic-native\win32-x64
+
+      - name: Print toolchain version and digests
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $compilerCmake = Get-ChildItem -Recurse -LiteralPath "artifacts\quic-native-build\x64\Release" -Filter "CMakeCXXCompiler.cmake" |
+            Select-Object -First 1
+          if ($compilerCmake) {
+            Select-String -LiteralPath $compilerCmake.FullName -Pattern "CMAKE_CXX_COMPILER_VERSION" |
+              ForEach-Object { Write-Host $_.Line.Trim() }
+          }
+          Get-FileHash -Algorithm SHA256 artifacts\quic-native\win32-x64\gamecult_mesh_quic_native.dll
+          Get-FileHash -Algorithm SHA256 artifacts\quic-native\win32-x64\msquic.dll
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: quic-native-win32-x64
+          path: artifacts/quic-native/win32-x64
+          if-no-files-found: error
+
+  build-linux-x64:
+    name: Build linux-x64
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/cultmesh-quic-native-v'))
+    runs-on: ubuntu-latest
+    # Q6 A: this pinned Debian 13 container is the only permitted Linux
+    # release builder. The digest is the pin; the `debian:13` tag is only a
+    # label. The artifact links against this image's glibc (2.41); a bare
+    # ubuntu-latest runner carries glibc 2.39, which is not the deploy host's
+    # OS (docs/typescript-quic-realtime-cut.md:2192-2197).
+    container:
+      image: debian:13@sha256:f324c7ff54321e8d9c588493a20244965938ce0aa50bbd1022d38010e9ffc4b1
+    timeout-minutes: 20
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+
+      - name: Install build tools
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends cmake ninja-build g++ curl ca-certificates dpkg
+
+      - name: Build the native QUIC bridge
+        run: ./scripts/build-quic-native.sh artifacts/quic-native/linux-x64
+
+      - name: Print toolchain version and digests
+        run: |
+          g++ --version
+          sha256sum artifacts/quic-native/linux-x64/libgamecult_mesh_quic_native.so
+          sha256sum artifacts/quic-native/linux-x64/libmsquic.so.2
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: quic-native-linux-x64
+          path: artifacts/quic-native/linux-x64
+          if-no-files-found: error
+
+  # Only this job has write permission, and only a tag push runs it. It
+  # attaches a draft MANIFEST.txt: the fields both build jobs cannot know
+  # (host names, MSVC version, the pinned dependency sources) are left for
+  # the operator to fill in from this run's own logs before committing the
+  # binaries, per 11.5's manifest paragraph.
+  release:
+    name: Release native binaries
+    needs: [build-win32-x64, build-linux-x64]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/cultmesh-quic-native-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Check out CultLib
+        uses: actions/checkout@v4
+
+      - name: Download win32-x64 artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: quic-native-win32-x64
+          path: release/win32-x64
+
+      - name: Download linux-x64 artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: quic-native-linux-x64
+          path: release/linux-x64
+
+      - name: Write SHA256SUMS and a draft MANIFEST.txt
+        run: |
+          set -euo pipefail
+          cd release
+          # Relative paths matching packages/cultmesh-ts/native/ exactly, so
+          # this file is the one the operator commits verbatim (11.5, 11.7).
+          sha256sum \
+            win32-x64/gamecult_mesh_quic_native.dll \
+            win32-x64/msquic.dll \
+            linux-x64/libgamecult_mesh_quic_native.so \
+            linux-x64/libmsquic.so.2 \
+            > SHA256SUMS
+          cat > MANIFEST.txt <<EOF
+          # Draft written by ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}.
+          # The operator fills the remaining fields from this run's job logs
+          # (build-win32-x64 and build-linux-x64 each print their toolchain
+          # version) before committing packages/cultmesh-ts/native/MANIFEST.txt.
+          msquic.version=2.5.9
+          msquic.windows.source=
+          msquic.linux.source=
+          bridge.commit=${GITHUB_SHA}
+          build.workflow_run=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}
+          build.release=${GITHUB_REF_NAME}
+          build.win32-x64.host=
+          build.linux-x64.host=
+          date=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+          EOF
+          # Named after the upload-artifact names above, not after the parked
+          # scoped per-platform npm package names from the registry-publication
+          # seam (11.9): these are release archives, not npm packages, and
+          # 11.7's negative grep for that parked naming must stay clean.
+          tar -C win32-x64 -czf quic-native-win32-x64.tar.gz .
+          tar -C linux-x64 -czf quic-native-linux-x64.tar.gz .
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          cd release
+          gh release create "$GITHUB_REF_NAME" --verify-tag \
+            --title "$GITHUB_REF_NAME" \
+            --notes-file MANIFEST.txt \
+            quic-native-win32-x64.tar.gz \
+            quic-native-linux-x64.tar.gz \
+            SHA256SUMS \
+            MANIFEST.txt

.gitignore

@@ -6,6 +6,9 @@
 # dotenv files
 .env
 
+# Stryker.NET mutation-testing output
+StrykerOutput/
+
 # User-specific files
 *.rsuser
 *.suo

contracts/cultmesh/authority-route-vectors.json

@@ -0,0 +1,44 @@
+{
+  "nowUnixMilliseconds": 1800000000000,
+  "odinRoot": {
+    "keyId": "odin-vector",
+    "x": "shJLGtmRrW6D87VQKv0xYQekLIfEkeN7dVawwpmIKWM=",
+    "y": "iR6Gx3aVCghzSyo7TqXqr+1397L73KDNZuzN2cZ55IE="
+  },
+  "route": {
+    "verseId": "aetheria",
+    "authorityRuntimeId": "aetheria-daemon",
+    "endpoint": "wss://provider.example/mesh",
+    "protocolIds": [
+      "cultmesh.content.v1",
+      "cultmesh.documents.v1"
+    ],
+    "priority": 7,
+    "generation": "vector-generation-1",
+    "certificate": {
+      "providerKey": {
+        "keyId": "provider-vector",
+        "x": "6XIvgx3W1q7lJFEV0yYbeKWNFgssq54BHBuh9gCwcH8=",
+        "y": "oi1FiKraueLic+VemzOx18MNwG6thmZMUWeqNw6vNOk="
+      },
+      "odinKeyId": "odin-vector",
+      "issuedAtUnixMilliseconds": 1799999940000,
+      "expiresAtUnixMilliseconds": 1800003600000,
+      "signature": "ZHuELFuCNNfbJt1T2mx1D9ZHXyxBedacDetmryMYhWKQxfROncltymkmL5KXl+1h8tDK6NytJCGy+7mYlb/DMA=="
+    }
+  },
+  "sessionProof": {
+    "request": {
+      "schemaVersion": "cultmesh.session_open.v2",
+      "messageId": "vector-message-1",
+      "sourceRuntimeId": "vector-consumer",
+      "verseId": "aetheria",
+      "authorityRuntimeId": "aetheria-daemon",
+      "protocolId": "cultmesh.documents.v1",
+      "routeGeneration": "vector-generation-1",
+      "clientNonce": "VczqjH8NdBaOb+rh8xb6P0xZjWD1el2ReNB8Vbp52ko="
+    },
+    "providerKeyId": "provider-vector",
+    "providerSignature": "6kGxSu/pwcR4lzh/7Av9nhblVIwIwVFzB7kY34vVvkpaFAbAxt8mWqIyZDTftE28G1g+NL4Ea41C3QsuImmkaA=="
+  }
+}

contracts/cultmesh/authority-route-vectors.ts-signed.json

@@ -0,0 +1,45 @@
+{
+  "nowUnixMilliseconds": 1800000000000,
+  "odinRoot": {
+    "keyId": "odin-ts-vector",
+    "x": "lqw9TE0EyuDU5Ghe8SafIbBBYkhHMUF7HXJQUc0nXsw=",
+    "y": "nUj+Xhakih97JiJcTUNMHM9JIo7MVQaauuAkCXph+tw="
+  },
+  "route": {
+    "verseId": "aetheria",
+    "authorityRuntimeId": "aetheria-daemon",
+    "endpoint": "cultmesh-state+quic://provider.example:4433/?cert-sha256=ABCDEF",
+    "protocolIds": [
+      "cultmesh.documents.v1",
+      "cultmesh.content.v1",
+      "cultmesh.realtime.v1"
+    ],
+    "priority": 13,
+    "generation": "ts-generation-ünïcode-∞-1",
+    "certificate": {
+      "providerKey": {
+        "keyId": "provider-ts-vector",
+        "x": "JKyjtWnoE5fhSWbeqr188SbReQWCjssf5mSMEa5pV+E=",
+        "y": "vtduzojDpbT49sbxBSsBQ+f3PG3rm+CUk/MTy2MM/ws="
+      },
+      "odinKeyId": "odin-ts-vector",
+      "issuedAtUnixMilliseconds": 1799999940000,
+      "expiresAtUnixMilliseconds": 1800003600000,
+      "signature": "NS5a7X8fNqTi1CdpPAcJaMmEsozwFRoygTW4z+JlhHFq7uaZcb4G7NwoEpPqo/Fv+UA7pNl5N+qUMuSD/oAq1Q=="
+    }
+  },
+  "sessionProof": {
+    "request": {
+      "schemaVersion": "cultmesh.session_open.v2",
+      "messageId": "ts-vector-message-1",
+      "sourceRuntimeId": "ts-vector-consumer",
+      "verseId": "aetheria",
+      "authorityRuntimeId": "aetheria-daemon",
+      "protocolId": "cultmesh.documents.v1",
+      "routeGeneration": "ts-generation-ünïcode-∞-1",
+      "clientNonce": "HICtAmV++1MarssY04Tkyn1j9qVEcOMp/P5Ce1M0Yec="
+    },
+    "providerKeyId": "provider-ts-vector",
+    "providerSignature": "OgJHkmw3fhPRS5TXxZm94yZvkWAV5TPDuvG+/zIVlnU7OFENZ0Nn0Pdx0IT/vDfEWXD+8/+sCZVFIFwa4tUjsg=="
+  }
+}

contracts/cultmesh/realtime-frame-vectors.json

@@ -0,0 +1,177 @@
+{
+  "frames": [
+    {
+      "label": "reliable-ordered, small payload",
+      "fields": {
+        "channelId": "aetheria.zone-1",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "body-7",
+        "producerEpoch": 1,
+        "sequence": 2,
+        "delivery": "reliable-ordered",
+        "payload": "AH+A/yo="
+      },
+      "encoding": "Q1NUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYABQAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03AH+A/yo=",
+      "encodedLength": 83,
+      "sha256OfEncoding": "d04539b99790560e5e570208d92d3ac25f85909a36bfeb190c2080288cc9f1d4"
+    },
+    {
+      "label": "latest-only, small payload",
+      "fields": {
+        "channelId": "aetheria.zone-1",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "body-7",
+        "producerEpoch": 3,
+        "sequence": 4,
+        "delivery": "latest-only",
+        "payload": "AQID"
+      },
+      "encoding": "Q1NUMQEDAAAAAAAAAAQAAAAAAAAADwAUAAYAAwAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03AQID",
+      "encodedLength": 81,
+      "sha256OfEncoding": "2c875718cf4968979f3cd4083ba2b279e8c03815ad3447c66037ee4530b2814a"
+    },
+    {
+      "label": "unreliable, small payload",
+      "fields": {
+        "channelId": "aetheria.zone-1",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "body-7",
+        "producerEpoch": 5,
+        "sequence": 6,
+        "delivery": "unreliable",
+        "payload": "/g=="
+      },
+      "encoding": "Q1NUMQIFAAAAAAAAAAYAAAAAAAAADwAUAAYAAQAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03/g==",
+      "encodedLength": 79,
+      "sha256OfEncoding": "b932adf333a0ca73d3a9077e15cf9062070a3084a50a3a30c3baa53312d864b1"
+    },
+    {
+      "label": "empty payload",
+      "fields": {
+        "channelId": "aetheria.zone-1",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "body-7",
+        "producerEpoch": 0,
+        "sequence": 0,
+        "delivery": "reliable-ordered",
+        "payload": ""
+      },
+      "encoding": "Q1NUMQAAAAAAAAAAAAAAAAAAAAAADwAUAAYAAAAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03",
+      "encodedLength": 78,
+      "sha256OfEncoding": "06c0362f2b395bf7855522190f6a59c45c46947ce7a9a4b8be115cf54a48f419"
+    },
+    {
+      "label": "multi-byte identities",
+      "fields": {
+        "channelId": "aetheria.zöne-∞",
+        "schemaId": "cultmesh.realtime.€1",
+        "bodyId": "bødy-\uD83D\uDD25",
+        "producerEpoch": 11,
+        "sequence": 12,
+        "delivery": "latest-only",
+        "payload": "cGF5bG9hZC3iiJ4="
+      },
+      "encoding": "Q1NUMQELAAAAAAAAAAwAAAAAAAAAEgAWAAoACwAAACUAAAABAGFldGhlcmlhLnrDtm5lLeKInmN1bHRtZXNoLnJlYWx0aW1lLuKCrDFiw7hkeS3wn5SlcGF5bG9hZC3iiJ4=",
+      "encodedLength": 98,
+      "sha256OfEncoding": "90c6ae8f1362d9e000aa57682612bb1d7606cabe2cd0c0969fdd07b816f44b1c"
+    },
+    {
+      "label": "epoch and sequence at long.MaxValue",
+      "fields": {
+        "channelId": "aetheria.zone-1",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "body-7",
+        "producerEpoch": 9223372036854775807,
+        "sequence": 9223372036854775807,
+        "delivery": "unreliable",
+        "payload": "Wg=="
+      },
+      "encoding": "Q1NUMQL/////////f/////////9/DwAUAAYAAQAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03Wg==",
+      "encodedLength": 79,
+      "sha256OfEncoding": "208068a668b48dc1abde9b3d7f025e7f7b6de6c480faea25c1383b6de9fd37ca"
+    },
+    {
+      "label": "identities at exactly 65535 UTF-8 bytes",
+      "fields": {
+        "channelId": {
+          "repeat": "ä€",
+          "byteLength": 65535
+        },
+        "schemaId": {
+          "repeat": "ۊ",
+          "byteLength": 65535
+        },
+        "bodyId": {
+          "repeat": "ñ€",
+          "byteLength": 65535
+        },
+        "producerEpoch": 13,
+        "sequence": 14,
+        "delivery": "reliable-ordered",
+        "payload": "ESI="
+      },
+      "encoding": null,
+      "encodedLength": 196644,
+      "sha256OfEncoding": "e3c1a353b606e86b35169efb875e76349dcfcb2d036973ee3bbe3c601fbda3e1"
+    },
+    {
+      "label": "64 MiB payload",
+      "fields": {
+        "channelId": "aetheria.zone-1",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "body-7",
+        "producerEpoch": 15,
+        "sequence": 16,
+        "delivery": "reliable-ordered",
+        "payload": {
+          "ramp": 67108864
+        }
+      },
+      "encoding": null,
+      "encodedLength": 67108942,
+      "sha256OfEncoding": "4d99183bdb450af854d87a81ba86a3a4c92ecc1b208675d916f1b75a9f1e7928"
+    }
+  ],
+  "malformed": [
+    {
+      "label": "truncated header",
+      "encoding": "Q1NUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACUAAAAB",
+      "message": "Realtime frame header is truncated."
+    },
+    {
+      "label": "wrong magic",
+      "encoding": "vFNUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJ",
+      "message": "Realtime frame magic is invalid."
+    },
+    {
+      "label": "wire version 2",
+      "encoding": "Q1NUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACUAAAACAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJ",
+      "message": "Realtime frame wire version is unsupported."
+    },
+    {
+      "label": "header size 36",
+      "encoding": "Q1NUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACQAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJ",
+      "message": "Realtime frame wire version is unsupported."
+    },
+    {
+      "label": "delivery 3",
+      "encoding": "Q1NUMQMBAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJ",
+      "message": "Realtime frame delivery mode is invalid."
+    },
+    {
+      "label": "delivery 255",
+      "encoding": "Q1NUMf8BAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJ",
+      "message": "Realtime frame delivery mode is invalid."
+    },
+    {
+      "label": "payload length -1",
+      "encoding": "Q1NUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAgCUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJ",
+      "message": "Realtime frame length is invalid."
+    },
+    {
+      "label": "length sum off by one",
+      "encoding": "Q1NUMQABAAAAAAAAAAIAAAAAAAAADwAUAAYAAwAAACUAAAABAGFldGhlcmlhLnpvbmUtMWN1bHRtZXNoLnJlYWx0aW1lLnYxYm9keS03CQkJAA==",
+      "message": "Realtime frame length is invalid."
+    }
+  ]
+}

contracts/cultmesh/realtime-frame-vectors.ts-written.json

@@ -0,0 +1,177 @@
+{
+  "frames": [
+    {
+      "label": "ts reliable-ordered, small payload",
+      "fields": {
+        "channelId": "ts.zone-a",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "ts-body-1",
+        "producerEpoch": 21,
+        "sequence": 22,
+        "delivery": "reliable-ordered",
+        "payload": "AAH+/w=="
+      },
+      "encoding": "Q1NUMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "encodedLength": 79,
+      "sha256OfEncoding": "68c264a42ce34e540e9dbee31dab5b73dec98c767f0b44591ce6a477cd17fc04"
+    },
+    {
+      "label": "ts latest-only, small payload",
+      "fields": {
+        "channelId": "ts.zone-a",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "ts-body-1",
+        "producerEpoch": 23,
+        "sequence": 24,
+        "delivery": "latest-only",
+        "payload": "f4A="
+      },
+      "encoding": "Q1NUMQEXAAAAAAAAABgAAAAAAAAACQAUAAkAAgAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xf4A=",
+      "encodedLength": 77,
+      "sha256OfEncoding": "3d4f49f4aa2c1f132c3a09ee83555c13e0bc036d636524a972e2829cf417b959"
+    },
+    {
+      "label": "ts unreliable, small payload",
+      "fields": {
+        "channelId": "ts.zone-a",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "ts-body-1",
+        "producerEpoch": 25,
+        "sequence": 26,
+        "delivery": "unreliable",
+        "payload": "pQ=="
+      },
+      "encoding": "Q1NUMQIZAAAAAAAAABoAAAAAAAAACQAUAAkAAQAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xpQ==",
+      "encodedLength": 76,
+      "sha256OfEncoding": "2c2faec604850959d44ee65d87d2ea59462b667c5d0db8565a8c159d75301851"
+    },
+    {
+      "label": "ts empty payload",
+      "fields": {
+        "channelId": "ts.zone-a",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "ts-body-1",
+        "producerEpoch": 0,
+        "sequence": 0,
+        "delivery": "latest-only",
+        "payload": ""
+      },
+      "encoding": "Q1NUMQEAAAAAAAAAAAAAAAAAAAAACQAUAAkAAAAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0x",
+      "encodedLength": 75,
+      "sha256OfEncoding": "6d2a04b399f32db4086e728194249b0279330ffa5517cdd82228f691a0f10708"
+    },
+    {
+      "label": "ts multi-byte identities",
+      "fields": {
+        "channelId": "ts.zøne-∂",
+        "schemaId": "cultmesh.realtime.µ1",
+        "bodyId": "ts-bödy-🧊",
+        "producerEpoch": 27,
+        "sequence": 28,
+        "delivery": "unreliable",
+        "payload": "dHMtcGF5bG9hZC3iiII="
+      },
+      "encoding": "Q1NUMQIbAAAAAAAAABwAAAAAAAAADAAVAA0ADgAAACUAAAABAHRzLnrDuG5lLeKIgmN1bHRtZXNoLnJlYWx0aW1lLsK1MXRzLWLDtmR5LfCfp4p0cy1wYXlsb2FkLeKIgg==",
+      "encodedLength": 97,
+      "sha256OfEncoding": "d5d22458bd50a446c7bdce4e2598fe8e5e7bfac3646d8fcd7215363c7c5c8ca1"
+    },
+    {
+      "label": "ts epoch and sequence at long.MaxValue",
+      "fields": {
+        "channelId": "ts.zone-a",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "ts-body-1",
+        "producerEpoch": 9223372036854775807,
+        "sequence": 9223372036854775807,
+        "delivery": "reliable-ordered",
+        "payload": "Bw=="
+      },
+      "encoding": "Q1NUMQD/////////f/////////9/CQAUAAkAAQAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xBw==",
+      "encodedLength": 76,
+      "sha256OfEncoding": "2abb67a876dc4ed006f33708b4c4dda55a90a6f95da7352749225195b10d45ba"
+    },
+    {
+      "label": "ts identities at exactly 65535 UTF-8 bytes",
+      "fields": {
+        "channelId": {
+          "repeat": "ü☃",
+          "byteLength": 65535
+        },
+        "schemaId": {
+          "repeat": "☃ü",
+          "byteLength": 65535
+        },
+        "bodyId": {
+          "repeat": "ç☃",
+          "byteLength": 65535
+        },
+        "producerEpoch": 29,
+        "sequence": 30,
+        "delivery": "latest-only",
+        "payload": "M0Q="
+      },
+      "encoding": null,
+      "encodedLength": 196644,
+      "sha256OfEncoding": "8bd4cd4c5232339f76b8e394eb93b66e8d14302398ecce2ae5bdb78070ef783a"
+    },
+    {
+      "label": "ts 64 MiB payload",
+      "fields": {
+        "channelId": "ts.zone-a",
+        "schemaId": "cultmesh.realtime.v1",
+        "bodyId": "ts-body-1",
+        "producerEpoch": 31,
+        "sequence": 32,
+        "delivery": "unreliable",
+        "payload": {
+          "ramp": 67108864
+        }
+      },
+      "encoding": null,
+      "encodedLength": 67108939,
+      "sha256OfEncoding": "f2c20e0b47a7681fbaeff6fcba024363542805de4cd95eeb7fa9f125ba646af0"
+    }
+  ],
+  "malformed": [
+    {
+      "label": "ts truncated header",
+      "encoding": "Q1NUMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAAB",
+      "message": "Realtime frame header is truncated."
+    },
+    {
+      "label": "ts wrong magic",
+      "encoding": "Q1OrMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "message": "Realtime frame magic is invalid."
+    },
+    {
+      "label": "ts wire version 2",
+      "encoding": "Q1NUMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAACAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "message": "Realtime frame wire version is unsupported."
+    },
+    {
+      "label": "ts header size 38",
+      "encoding": "Q1NUMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACYAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "message": "Realtime frame wire version is unsupported."
+    },
+    {
+      "label": "ts delivery 3",
+      "encoding": "Q1NUMQMVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "message": "Realtime frame delivery mode is invalid."
+    },
+    {
+      "label": "ts delivery 128",
+      "encoding": "Q1NUMYAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "message": "Realtime frame delivery mode is invalid."
+    },
+    {
+      "label": "ts payload length -1",
+      "encoding": "Q1NUMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAgCUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/w==",
+      "message": "Realtime frame length is invalid."
+    },
+    {
+      "label": "ts length sum off by one",
+      "encoding": "Q1NUMQAVAAAAAAAAABYAAAAAAAAACQAUAAkABAAAACUAAAABAHRzLnpvbmUtYWN1bHRtZXNoLnJlYWx0aW1lLnYxdHMtYm9keS0xAAH+/wA=",
+      "message": "Realtime frame length is invalid."
+    }
+  ]
+}

contracts/cultnet/cultmesh.session-accepted.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.session-accepted.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultmesh.session-accepted.schema.json",
   "title": "CultMesh Session Accepted",
   "type": "object",
   "required": ["schemaVersion", "messageId", "accepted", "verseId", "authorityRuntimeId", "protocolId", "routeGeneration", "clientNonce", "providerKeyId", "providerSignature"],

contracts/cultnet/cultmesh.session-open.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.session-open.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultmesh.session-open.schema.json",
   "title": "CultMesh Session Open",
   "type": "object",
   "required": ["schemaVersion", "messageId", "sourceRuntimeId", "verseId", "authorityRuntimeId", "protocolId", "routeGeneration", "clientNonce"],

contracts/cultnet/cultmesh.verse-catalog-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.verse-catalog-request.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultmesh.verse-catalog-request.schema.json",
   "title": "CultMesh Verse Catalog Request",
   "type": "object",
   "required": ["schemaVersion", "messageId"],

contracts/cultnet/cultmesh.verse-catalog-response.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.verse-catalog-response.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultmesh.verse-catalog-response.schema.json",
   "title": "CultMesh Verse Catalog Response",
   "type": "object",
   "required": ["schemaVersion", "messageId", "verses"],

contracts/cultnet/cultnet.database-change-raw.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-change-raw.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.database-change-raw.schema.json",
   "title": "CultNet Raw Database Change Message",
   "type": "object",
   "required": ["schemaVersion", "messageId", "subscriptionId", "changeKind"],

contracts/cultnet/cultnet.database-subscribe.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-subscribe.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.database-subscribe.schema.json",
   "title": "CultNet Database Subscribe Message",
   "type": "object",
   "required": ["schemaVersion", "messageId", "subscriptionId", "includeSnapshot"],

contracts/cultnet/cultnet.database-subscribe.v1.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.database-subscribe.v1.schema.json",
+  "title": "CultNet Database Subscribe Message v1",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "subscriptionId", "selection"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.database_subscribe.v1" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "subscriptionId": { "type": "string", "minLength": 1 },
+    "selection": { "$ref": "cultnet.selection.schema.json" },
+    "includeSnapshot": { "type": "boolean", "default": true },
+    "consumerRuntimeId": { "type": "string", "minLength": 1 },
+    "bodyIds": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "supportedBodyTransports": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    }
+  }
+}

contracts/cultnet/cultnet.database-unsubscribe.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.database-unsubscribe.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.database-unsubscribe.schema.json",
   "title": "CultNet Database Unsubscribe Message",
   "type": "object",
   "required": ["schemaVersion", "messageId", "subscriptionId"],

contracts/cultnet/cultnet.document-delete.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-delete.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.document-delete.schema.json",
   "title": "CultNet Document Delete Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.document-mutation-contract.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-mutation-contract.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.document-mutation-contract.schema.json",
   "title": "CultNet Document Mutation Contract",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.document-put-raw.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put-raw.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.document-put-raw.schema.json",
   "title": "CultNet Raw Document Put Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.document-put.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.document-put.schema.json",
   "title": "CultNet Document Put Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.document-record.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-record.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.document-record.schema.json",
   "title": "CultNet Document Record",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.error.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.error.schema.json",
+  "title": "CultNet Error Message",
+  "description": "R-X (docs/cultnet-selection-cut.md, fix batch 4): CultNetErrorMessage is a MessagePack-CSharp map-mode object, so every declared key is written on the wire, nil included - routingHint, code and details are `required` here the same as cultnet.raw-document-header.schema.json's nullable fields, not optional just because a given refusal leaves them null.",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "error",
+    "routingHint",
+    "code",
+    "details"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.error.v0" },
+    "error": { "type": "string", "minLength": 1 },
+    "routingHint": {
+      "description": "Optional shard routing detail for an authority failure. Null for every selection/cursor refusal code (R-N).",
+      "type": ["object", "null"],
+      "additionalProperties": false,
+      "required": ["shard", "reason"],
+      "properties": {
+        "shard": { "type": ["object", "null"] },
+        "reason": { "type": "string" }
+      }
+    },
+    "code": {
+      "description": "Machine-readable refusal code (R-N). Additive: a v0 peer that does not know this field ignores it.",
+      "type": ["string", "null"],
+      "enum": [null, "selection_invalid", "cursor_stale", "cursor_invalid", "reference_outside_target"]
+    },
+    "details": {
+      "description": "Code-specific structured detail (R-N). Every field is populated only for the code that defines it; the others are null, not omitted.",
+      "type": ["object", "null"],
+      "additionalProperties": false,
+      "required": ["field", "value", "asOf", "current"],
+      "properties": {
+        "field": { "description": "selection_invalid: the selection field that failed.", "type": ["string", "null"] },
+        "value": { "description": "selection_invalid: the offending value, when there is one string worth naming.", "type": ["string", "null"] },
+        "asOf": { "description": "cursor_stale: the cursor's own minted asOf.", "type": ["integer", "null"], "minimum": 0 },
+        "current": { "description": "cursor_stale: the answering server's current asOf.", "type": ["integer", "null"], "minimum": 0 }
+      }
+    }
+  }
+}

contracts/cultnet/cultnet.hello.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.hello.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.hello.schema.json",
   "title": "CultNet Hello Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.login-success.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.login-success.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.login-success.schema.json",
   "title": "CultNet Login Success Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.login.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.login.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.login.schema.json",
   "title": "CultNet Login Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.operation-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.operation-request.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.operation-request.schema.json",
   "title": "CultNet Operation Request",
   "type": "object",
   "required": ["schemaVersion", "messageId", "serviceId", "operation", "payloadSchema", "payload"],

contracts/cultnet/cultnet.operation-response.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.operation-response.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.operation-response.schema.json",
   "title": "CultNet Operation Response",
   "type": "object",
   "required": ["schemaVersion", "messageId", "serviceId", "operation", "status", "payloadSchema", "payload"],

contracts/cultnet/cultnet.raw-document-header.schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.raw-document-header.schema.json",
+  "title": "CultNet Raw Document Header",
+  "description": "R-S (docs/cultnet-selection-cut.md, fix batch 3): CultNetRawDocumentRecord minus payload/payloadEncoding - CultNetRawDocumentHeader has no such members at all, so a header must not $ref the record schema (which requires them). Matches MessagePack-CSharp's map-mode output: every declared key is written, nil included, so every property here is `required` even where its value may be null.",
+  "type": "object",
+  "required": [
+    "schemaId",
+    "schemaName",
+    "schemaVersion",
+    "schemaContentHash",
+    "recordKey",
+    "storedAt",
+    "sourceRuntimeId",
+    "sourceAgentId",
+    "sourceRole",
+    "tags"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaId": { "type": "string", "minLength": 1 },
+    "schemaName": { "type": ["string", "null"], "minLength": 1 },
+    "schemaVersion": { "type": ["string", "null"], "minLength": 1 },
+    "schemaContentHash": { "type": ["string", "null"], "minLength": 1 },
+    "recordKey": { "type": "string", "minLength": 1 },
+    "storedAt": { "type": "string", "minLength": 1 },
+    "sourceRuntimeId": { "type": ["string", "null"], "minLength": 1 },
+    "sourceAgentId": { "type": ["string", "null"], "minLength": 1 },
+    "sourceRole": { "type": ["string", "null"], "minLength": 1 },
+    "tags": {
+      "type": ["array", "null"],
+      "items": { "type": "string", "minLength": 1 }
+    }
+  }
+}

contracts/cultnet/cultnet.raw-document-record.schema.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.raw-document-record.schema.json",
+  "title": "CultNet Raw Document Record",
+  "description": "R-S (docs/cultnet-selection-cut.md, fix batch 3): matches MessagePack-CSharp's map-mode output for CultNetRawDocumentRecord - every declared key is written, nil included, so every property here is `required` (present on the wire) even where its value may be null.",
+  "type": "object",
+  "required": [
+    "schemaId",
+    "schemaName",
+    "schemaVersion",
+    "schemaContentHash",
+    "recordKey",
+    "storedAt",
+    "payloadEncoding",
+    "payload",
+    "sourceRuntimeId",
+    "sourceAgentId",
+    "sourceRole",
+    "tags"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaId": { "type": "string", "minLength": 1 },
+    "schemaName": { "type": ["string", "null"], "minLength": 1 },
+    "schemaVersion": { "type": ["string", "null"], "minLength": 1 },
+    "schemaContentHash": { "type": ["string", "null"], "minLength": 1 },
+    "recordKey": { "type": "string", "minLength": 1 },
+    "storedAt": { "type": "string", "minLength": 1 },
+    "payloadEncoding": { "const": "messagepack" },
+    "payload": {
+      "type": "string",
+      "contentEncoding": "base64",
+      "x-cult-runtime-type": "bytes"
+    },
+    "sourceRuntimeId": { "type": ["string", "null"], "minLength": 1 },
+    "sourceAgentId": { "type": ["string", "null"], "minLength": 1 },
+    "sourceRole": { "type": ["string", "null"], "minLength": 1 },
+    "tags": {
+      "type": ["array", "null"],
+      "items": { "type": "string", "minLength": 1 }
+    }
+  }
+}

contracts/cultnet/cultnet.register.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.register.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.register.schema.json",
   "title": "CultNet Register Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.sample-change-name.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.sample-change-name.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.sample-change-name.schema.json",
   "title": "CultNet Sample Change Name Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.sample-chat.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.sample-chat.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.sample-chat.schema.json",
   "title": "CultNet Sample Chat Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.schema-catalog-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.schema-catalog-request.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.schema-catalog-request.schema.json",
   "title": "CultNet Schema Catalog Request Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.schema-catalog-response.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.schema-catalog-response.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.schema-catalog-response.schema.json",
   "title": "CultNet Schema Catalog Response Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.schema-descriptor.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.schema-descriptor.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.schema-descriptor.schema.json",
   "title": "CultNet Schema Descriptor",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.selection.schema.json

@@ -0,0 +1,100 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.selection.schema.json",
+  "title": "CultNet Typed Selection",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "schemas": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "minItems": 1,
+      "description": "Absent means every schema. Present and empty is refused at the door (selection_invalid), never treated as \"every schema\": omit the field instead."
+    },
+    "keys": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "minItems": 1,
+      "description": "Absent means every key. Present and empty is refused at the door (selection_invalid), never treated as \"every key\": omit the field instead."
+    },
+    "fields": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/fieldPredicate" }
+    },
+    "cites": { "$ref": "#/$defs/citation" },
+    "cited": { "$ref": "#/$defs/incoming" },
+    "projection": {
+      "type": "string",
+      "enum": ["header", "document"],
+      "default": "header"
+    },
+    "descending": { "type": "boolean", "default": false },
+    "limit": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 200,
+      "description": "Clamped to 1..=200 by the answering server, not refused outside that range: an absent value or one outside the bound is treated as the nearer bound (absent = 200)."
+    },
+    "cursor": { "type": "string" }
+  },
+  "$defs": {
+    "recordRef": {
+      "type": "object",
+      "required": ["schemaId", "recordKey"],
+      "additionalProperties": false,
+      "properties": {
+        "schemaId": { "type": "string", "minLength": 1 },
+        "recordKey": { "type": "string", "minLength": 1 }
+      }
+    },
+    "fieldPredicate": {
+      "type": "object",
+      "required": ["index", "op"],
+      "additionalProperties": false,
+      "properties": {
+        "index": { "type": "string", "minLength": 1 },
+        "op": { "type": "string", "enum": ["any_of", "lt", "le", "ge", "gt"] },
+        "values": {
+          "type": "array",
+          "items": { "type": "string" },
+          "minItems": 1
+        },
+        "number": {
+          "type": "string",
+          "description": "Q-J: a canonical decimal string, never a JSON number. Matches ^-?(0|[1-9][0-9]*)(\\.[0-9]*[1-9])?$ and is not \"-0\"; any other spelling is refused typed at the door (selection_invalid), never normalised.",
+          "pattern": "^(?!-0$)-?(0|[1-9][0-9]*)(\\.[0-9]*[1-9])?$"
+        }
+      },
+      "oneOf": [
+        {
+          "required": ["values"],
+          "not": { "required": ["number"] },
+          "properties": { "op": { "const": "any_of" } }
+        },
+        {
+          "required": ["number"],
+          "not": { "required": ["values"] },
+          "properties": { "op": { "enum": ["lt", "le", "ge", "gt"] } }
+        }
+      ]
+    },
+    "citation": {
+      "type": "object",
+      "required": ["target"],
+      "additionalProperties": false,
+      "properties": {
+        "target": { "$ref": "#/$defs/recordRef" },
+        "role": { "type": "string", "minLength": 1 }
+      }
+    },
+    "incoming": {
+      "type": "object",
+      "required": ["role", "exists"],
+      "additionalProperties": false,
+      "properties": {
+        "role": { "type": "string", "minLength": 1 },
+        "exists": { "type": "boolean" }
+      }
+    }
+  }
+}

contracts/cultnet/cultnet.shard-catalog-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "cultnet.shard_catalog_request.v0",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.shard-catalog-request.schema.json",
   "type": "object",
   "required": ["schemaVersion", "messageId"],
   "additionalProperties": false,

contracts/cultnet/cultnet.shard-catalog-response.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "cultnet.shard_catalog_response.v0",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.shard-catalog-response.schema.json",
   "type": "object",
   "required": ["schemaVersion", "messageId", "shards"],
   "additionalProperties": false,

contracts/cultnet/cultnet.snapshot-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.snapshot-request.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.snapshot-request.schema.json",
   "title": "CultNet Snapshot Request Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.snapshot-request.v1.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.snapshot-request.v1.schema.json",
+  "title": "CultNet Snapshot Request Message v1",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "selection"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.snapshot_request.v1" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "selection": { "$ref": "cultnet.selection.schema.json" },
+    "shardId": { "type": "string", "minLength": 1 },
+    "shardEpoch": { "type": "integer" }
+  }
+}

contracts/cultnet/cultnet.snapshot-response-raw.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.snapshot-response-raw.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.snapshot-response-raw.schema.json",
   "title": "CultNet Raw Snapshot Response Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.snapshot-response-raw.v1.schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.snapshot-response-raw.v1.schema.json",
+  "title": "CultNet Snapshot Response Raw Message v1",
+  "description": "R-S (docs/cultnet-selection-cut.md, fix batch 3): matches MessagePack-CSharp's map-mode output for CultNetSnapshotResponseRawV1Message - every declared key is written, nil included, so every property is `required` (present on the wire) even where its value may be null. `headers`/`documents` are still exactly one populated by projection (C5), but the OTHER key is present too, as an explicit null, not absent - the prior `oneOf: [{required:[headers]},{required:[documents]}]` matched both branches on every real page (both keys always present) and so never validated at all.",
+  "type": "object",
+  "required": [
+    "schemaVersion", "messageId", "matched", "asOf", "next",
+    "headers", "documents", "edges", "shardId", "shardEpoch", "shardLogSequence"
+  ],
+  "additionalProperties": false,
+  "oneOf": [
+    {
+      "required": ["headers", "documents"],
+      "properties": { "headers": { "type": "array" }, "documents": { "type": "null" } }
+    },
+    {
+      "required": ["headers", "documents"],
+      "properties": { "headers": { "type": "null" }, "documents": { "type": "array" } }
+    }
+  ],
+  "properties": {
+    "schemaVersion": { "const": "cultnet.snapshot_response_raw.v1" },
+    "messageId": { "type": "string", "minLength": 1 },
+    "matched": { "type": "integer", "minimum": 0 },
+    "asOf": { "type": "integer", "minimum": 0 },
+    "next": { "type": ["string", "null"] },
+    "headers": {
+      "type": ["array", "null"],
+      "items": { "$ref": "cultnet.raw-document-header.schema.json" }
+    },
+    "documents": {
+      "type": ["array", "null"],
+      "items": { "$ref": "cultnet.raw-document-record.schema.json" }
+    },
+    "edges": {
+      "type": ["array", "null"],
+      "items": {
+        "type": "object",
+        "required": ["from", "role", "to", "payloadEncoding", "payload"],
+        "additionalProperties": false,
+        "properties": {
+          "from": { "$ref": "cultnet.selection.schema.json#/$defs/recordRef" },
+          "role": { "type": "string", "minLength": 1 },
+          "to": { "$ref": "cultnet.selection.schema.json#/$defs/recordRef" },
+          "payloadEncoding": { "type": ["string", "null"] },
+          "payload": {
+            "type": ["string", "null"],
+            "contentEncoding": "base64",
+            "x-cult-runtime-type": "bytes"
+          }
+        }
+      }
+    },
+    "shardId": { "type": ["string", "null"], "minLength": 1 },
+    "shardEpoch": { "type": ["integer", "null"] },
+    "shardLogSequence": { "type": ["integer", "null"] }
+  }
+}

contracts/cultnet/cultnet.snapshot-response.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.snapshot-response.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.snapshot-response.schema.json",
   "title": "CultNet Snapshot Response Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.transport-profile.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.transport-profile.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.transport-profile.schema.json",
   "title": "CultNet Transport Profile",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.verify.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.verify.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.verify.schema.json",
   "title": "CultNet Verify Message",
   "type": "object",
   "required": [

contracts/cultnet/cultnet.witness-artifact-bundle.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/contracts/cultnet.witness-artifact-bundle.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.witness-artifact-bundle.schema.json",
   "title": "CultNet Witness Artifact Bundle",
   "type": "object",
   "required": [

contracts/cultnet/interop/cultnet.interop-note.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GameCult/cultnet-ts/integration/contracts/cultnet.interop-note.schema.json",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.interop-note.schema.json",
   "title": "CultNet Interop Note",
   "type": "object",
   "required": [

contracts/cultnet/interop/selection-vectors.cs-written.json

@@ -0,0 +1,334 @@
+{
+  "vectors": [
+    {
+      "name": "any_of_plus_ge_conjunction",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHOShKVpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORpndlYXBvbqZudW1iZXLAhKVpbmRleKRtYXNzom9womdlpnZhbHVlc8CmbnVtYmVyoTWlY2l0ZXPApWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "descending_with_limit",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHPApWNpdGVzwKVjaXRlZMCqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8OlbGltaXQDpmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema",
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/zz-tie-schema"
+      ],
+      "matched": 18,
+      "hasNext": true,
+      "expectedEdges": []
+    },
+    {
+      "name": "gt_numeric_boundary",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRtYXNzom9womd0pnZhbHVlc8CmbnVtYmVyoTGlY2l0ZXPApWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-lo",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/b-hi",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass"
+      ],
+      "matched": 4,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "incoming_exists_true",
+      "selectionMessagePackBase64": "iadzY2hlbWFzkdlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmaka2V5c8CmZmllbGRzwKVjaXRlc8ClY2l0ZWSCpHJvbGWmRGVzaWdupmV4aXN0c8OqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+          "payloadBase64": null
+        },
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "incoming_negation",
+      "selectionMessagePackBase64": "iadzY2hlbWFzkdlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmaka2V5c8CmZmllbGRzwKVjaXRlc8ClY2l0ZWSCpHJvbGWmRGVzaWdupmV4aXN0c8KqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-lo",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-1",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-3",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/\uD83D\uDE02-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema"
+      ],
+      "matched": 7,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "shared_index_value_three_rows",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORpnNoYXJlZKZudW1iZXLApWNpdGVzwKVjaXRlZMCqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-1",
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/shared-2",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-3"
+      ],
+      "matched": 3,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "float_tie_exact_ge",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRtYXNzom9womdlpnZhbHVlc8CmbnVtYmVyqjIyMzM3NTkuMjWlY2l0ZXPApWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "hop_by_role_cites_exact_id",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzkadjaXRlci0xpmZpZWxkc8ClY2l0ZXOCpnRhcmdldIKoc2NoZW1hSWTZR3NoYTI1NjpmZjM1ZjNkOWQ2ZGUzZjEwNjZiOTM2OWU3M2ZlNmM3NjQ4ZTg4MzY4ZDE4ZWZjMjI3NWM5OTQ3MzBjZDg0Y2ZmqXJlY29yZEtleaRhLWVxpHJvbGWmRGVzaWdupWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "cites_target_by_name_alias",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzkadjaXRlci0xpmZpZWxkc8ClY2l0ZXOCpnRhcmdldIKoc2NoZW1hSWSpbGVhZl9hLnY5qXJlY29yZEtleaRhLWVxpHJvbGWmRGVzaWdupWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "schemas_by_name_alias",
+      "selectionMessagePackBase64": "iadzY2hlbWFzkalsZWFmX2Eudjmka2V5c8CmZmllbGRzwKVjaXRlc8ClY2l0ZWTAqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfCpWxpbWl0wKZjdXJzb3LA",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-lo",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-1",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-3",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/\uD83D\uDE02-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema"
+      ],
+      "matched": 9,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "astral_key_code_point_order",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORp3VuaWNvZGWmbnVtYmVywKVjaXRlc8ClY2l0ZWTAqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfCpWxpbWl0wKZjdXJzb3LA",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/\uD83D\uDE02-row"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "header_projection",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORp3VuaWNvZGWmbnVtYmVywKVjaXRlc8ClY2l0ZWTAqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfCpWxpbWl0wKZjdXJzb3LA",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/\uD83D\uDE02-row"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "document_projection",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORp3VuaWNvZGWmbnVtYmVywKVjaXRlc8ClY2l0ZWTAqnByb2plY3Rpb26oZG9jdW1lbnSqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/\uD83D\uDE02-row"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "row_tiebreak_schema_id_before_record_key_at_tied_ordinal",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHORhKVpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORqnRpZS1zY2hlbWGmbnVtYmVywKVjaXRlc8ClY2l0ZWTAqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfCpWxpbWl0wKZjdXJzb3LA",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/zz-tie-schema",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "shared_key_narrow_ref_resolves_leaf_within_target",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzkbVuYXJyb3ctY2l0ZXItYWNjZXB0ZWSmZmllbGRzwKVjaXRlc4KmdGFyZ2V0gqhzY2hlbWFJZNlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmapcmVjb3JkS2V5p2R1cC1rZXmkcm9sZapuYXJyb3dfcmVmpWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:ee192f6526a8f8cdec7044551aa2c8e28c612426766bb270605023bc94e2614d/narrow-citer-accepted"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:ee192f6526a8f8cdec7044551aa2c8e28c612426766bb270605023bc94e2614d/narrow-citer-accepted",
+          "role": "narrow_ref",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "shared_key_design_resolves_the_first_in_target_candidate_in_row_order",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzkbRjaXRlci1ib3RoLWluLXRhcmdldKZmaWVsZHPApWNpdGVzgqZ0YXJnZXSCqHNjaGVtYUlk2UdzaGEyNTY6ZmYzNWYzZDlkNmRlM2YxMDY2YjkzNjllNzNmZTZjNzY0OGU4ODM2OGQxOGVmYzIyNzVjOTk0NzMwY2Q4NGNmZqlyZWNvcmRLZXmnZHVwLWtleaRyb2xlpkRlc2lnbqVjaXRlZMCqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "refuses_empty_schemas_list",
+      "selectionMessagePackBase64": "iadzY2hlbWFzkKRrZXlzwKZmaWVsZHPApWNpdGVzwKVjaXRlZMCqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": "schemas",
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "refuses_blank_key_entry",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzkqRhLWVxoyAgIKZmaWVsZHPApWNpdGVzwKVjaXRlZMCqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": "keys",
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "refuses_unmatched_cites_target_schema",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHPApWNpdGVzgqZ0YXJnZXSCqHNjaGVtYUlkvHNoYTI1Njpub3QtYS1kZWNsYXJlZC1zY2hlbWGpcmVjb3JkS2V5pGEtZXGkcm9sZcClY2l0ZWTAqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfCpWxpbWl0wKZjdXJzb3LA",
+      "asOf": 1,
+      "expectedRefusalField": "cites.target.schemaId",
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "refuses_cites_target_by_hash_shaped_alias",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzwKZmaWVsZHPApWNpdGVzgqZ0YXJnZXSCqHNjaGVtYUlk2UpzaGEyNTY6ZmYzNWYzZDlkNmRlM2YxMDY2YjkzNjllNzNmZTZjNzY0OGU4ODM2OGQxOGVmYzIyNzVjOTk0NzMwY2Q4NGNmZi52MalyZWNvcmRLZXmkYS1lcaRyb2xlwKVjaXRlZMCqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8KlbGltaXTApmN1cnNvcsA=",
+      "asOf": 1,
+      "expectedRefusalField": "cites.target.schemaId",
+      "expectedEvaluationRefusal": null,
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "shared_key_narrow_ref_refuses_when_only_candidate_is_outside_target",
+      "selectionMessagePackBase64": "iadzY2hlbWFzwKRrZXlzkbRuYXJyb3ctY2l0ZXItcmVmdXNlZKZmaWVsZHPApWNpdGVzgqZ0YXJnZXSCqHNjaGVtYUlk2UdzaGEyNTY6ZmYzNWYzZDlkNmRlM2YxMDY2YjkzNjllNzNmZTZjNzY0OGU4ODM2OGQxOGVmYzIyNzVjOTk0NzMwY2Q4NGNmZqlyZWNvcmRLZXmrbmFycm93LW9ubHmkcm9sZapuYXJyb3dfcmVmpWNpdGVkwKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwqVsaW1pdMCmY3Vyc29ywA==",
+      "asOf": 1,
+      "expectedRefusalField": null,
+      "expectedEvaluationRefusal": "reference_outside_target",
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    }
+  ]
+}

contracts/cultnet/interop/selection-vectors.fixture.json

@@ -0,0 +1,105 @@
+{
+  "//": "CultNet typed selection, Cut 1 fix batch (docs/cultnet-selection-cut.md, Self's rulings for the Cut 1 fix batch, R-E and the shared-fixture ruling, 2026-09-22). The one row set both the C# reference and cultnet-rs build their parity vectors from. schemaId is each schema's real SHA-256 content-hash id, exactly as GameCult.Caching.CultDocumentRegistry computes it for the fixture's C# document types (leaf_a=ParityLeafA, leaf_b=ParityLeafB, citer=ParityCiter, citer_narrow=ParityCiterNarrow, tests/GameCult.Networking.Tests/SelectionParityVectorTests.cs) - CultCache.cs's Sha256(semanticFingerprint), which carries no '.vN' suffix of its own; the version is folded into the hash, never appended as text. Both writers read this file instead of building their own fixture rows.",
+  "//aliases": "Two DIFFERENT alias forms, now deliberate rather than a cross-runtime defect (S-12, 2026-09-22: the Rust alias port made this so - see docs/cultnet-selection-cut.md, 'Self's ruling, 2026-09-22: the C# reference's alias rule is the rule'). Both runtimes resolve a schema alias the same one way: strip a trailing .vN and compare the remainder against the descriptor's declared SchemaName (CultNetSchemaAliasMatching.Matches(candidate, CultDocumentDescriptor), src/GameCult.Networking/CultNetDatabase.cs:74-87; cultnet_rs::selection::schema_alias::matches ports it name-for-name and deletes the hash-stripping overload it used to carry). nameAlias is <SchemaName>.v9 and resolves through both runtimes under that one rule. hashAlias is <schemaId>.v1 and is refused as unmatched by both - it is not a wire form either runtime's production call sites ever produce or accept, and it is kept in the fixture specifically to pin that neither runtime resolves it.",
+  "//references": "R-AF, 2026-09-23: a reference's `references[].targetKey` is the only thing a stored edge actually carries on the wire - GameCult.Caching.MessagePack.CultRecordRefFormatter<T> serializes a CultRecordRef<T> as a bare key string (probed: MessagePackSerializer.Serialize on a real Design field produced the single msgpack string 'a-eq', nothing else). This fixture used to also carry a `targetSchema` per reference; it was never anything but documentation - SelectionParityVectorTests.BuildDocument and cultnet-rs's build_row both read only targetKey to construct the edge - and it is removed rather than kept as a field the wire does not have. Resolving which row an edge names is by targetKey alone, filtered to the declared role's target leaves (D9); see citer_narrow below for the shared-key shape that rule is pinned against.",
+  "schemas": {
+    "leaf_a": {
+      "schemaId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff",
+      "nameAlias": "leaf_a.v9",
+      "hashAlias": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff.v1",
+      "indexes": [
+        { "name": "kind", "numeric": false },
+        { "name": "mass", "numeric": true }
+      ]
+    },
+    "leaf_b": {
+      "schemaId": "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42",
+      "nameAlias": "leaf_b.v9",
+      "hashAlias": "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42.v1",
+      "indexes": [
+        { "name": "kind", "numeric": false },
+        { "name": "mass", "numeric": true }
+      ]
+    },
+    "citer": {
+      "schemaId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc",
+      "nameAlias": "citer.v9",
+      "hashAlias": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc.v1",
+      "roles": [
+        { "name": "Design", "targets": ["leaf_a", "leaf_b"] }
+      ]
+    },
+    "citer_narrow": {
+      "//": "R-AF: a citer whose declared reference target is one leaf only (leaf_a), so a record key shared by a leaf_a row and a leaf_b row has exactly one candidate inside the declared target and exactly one outside it - the shape neither runtime's parity vectors covered before this cut (zero duplicate record keys across the original ten rows).",
+      "schemaId": "sha256:ee192f6526a8f8cdec7044551aa2c8e28c612426766bb270605023bc94e2614d",
+      "nameAlias": "citer_narrow.v9",
+      "hashAlias": "sha256:ee192f6526a8f8cdec7044551aa2c8e28c612426766bb270605023bc94e2614d.v1",
+      "roles": [
+        { "name": "narrow_ref", "targets": ["leaf_a"] }
+      ]
+    }
+  },
+  "rows": [
+    { "schema": "leaf_a", "key": "a-lo", "ordinal": 1, "fields": { "kind": "weapon", "mass": "4" } },
+    { "schema": "leaf_a", "key": "a-eq", "ordinal": 2, "fields": { "kind": "weapon", "mass": "5" } },
+    { "schema": "leaf_b", "key": "b-hi", "ordinal": 3, "fields": { "kind": "armor", "mass": "6" } },
+    { "schema": "leaf_a", "key": "shared-1", "ordinal": 4, "fields": { "kind": "shared", "mass": "1" } },
+    { "schema": "leaf_b", "key": "shared-2", "ordinal": 5, "fields": { "kind": "shared", "mass": "1" } },
+    { "schema": "leaf_a", "key": "shared-3", "ordinal": 6, "fields": { "kind": "shared", "mass": "1" } },
+    {
+      "schema": "citer",
+      "key": "citer-1",
+      "ordinal": 7,
+      "references": [ { "role": "Design", "targetKey": "a-eq" } ]
+    },
+    {
+      "//": "R-D: 2233759.25 is exactly representable as an f32 and sits on a round-to-even tie between two shortest-form spellings; its exact canonical decimal is 2233759.25 either way. kind=tie so no weapon/armor/shared case can sweep it up.",
+      "schema": "leaf_a", "key": "tie-mass", "ordinal": 8, "fields": { "kind": "tie", "mass": "2233759.25" }
+    },
+    {
+      "//": "R-C: BMP private-use key (U+E000), same ordinal as the astral row below so the tiebreak - not the ordinal - decides order. kind=unicode, mass=0 so no unfiltered or mass>1 case reaches these.",
+      "schema": "leaf_a", "key": "-row", "ordinal": 9, "fields": { "kind": "unicode", "mass": "0" }
+    },
+    {
+      "//": "R-C: astral key (U+1F602, encoded as a surrogate pair whose high half 0xD83D is less than 0xE000 - a UTF-16 code-unit compare sorts this first; code-point order sorts it after the BMP row above).",
+      "schema": "leaf_a", "key": "😂-row", "ordinal": 9, "fields": { "kind": "unicode", "mass": "0" }
+    },
+    {
+      "//": "R-AF shape 1: the only row at this key is outside citer_narrow's declared target (leaf_a only) - resolving the edge below must refuse reference_outside_target in both runtimes, not silently accept an empty page. kind=narrow-fixture (not \"shared\") so this row never sweeps into shared_index_value_three_rows, which pins an exact count of 3.",
+      "schema": "leaf_b", "key": "narrow-only", "ordinal": 10, "fields": { "kind": "narrow-fixture", "mass": "1" }
+    },
+    {
+      "//": "R-AF shape 2: two rows share this key, one inside citer_narrow's declared target and one outside it - resolving the edge below must accept, deterministically picking the leaf_a row, in both runtimes.",
+      "schema": "leaf_a", "key": "dup-key", "ordinal": 11, "fields": { "kind": "narrow-fixture", "mass": "1" }
+    },
+    {
+      "schema": "leaf_b", "key": "dup-key", "ordinal": 12, "fields": { "kind": "narrow-fixture", "mass": "1" }
+    },
+    {
+      "schema": "citer_narrow",
+      "key": "narrow-citer-refused",
+      "ordinal": 13,
+      "references": [ { "role": "narrow_ref", "targetKey": "narrow-only" } ]
+    },
+    {
+      "schema": "citer_narrow",
+      "key": "narrow-citer-accepted",
+      "ordinal": 14,
+      "references": [ { "role": "narrow_ref", "targetKey": "dup-key" } ]
+    },
+    {
+      "//": "R-AJ: a tied ordinal across two DIFFERENT schemas (leaf_a and leaf_b), not two rows of the same leaf like the astral/BMP pair above - the shape the row order's schemaId tiebreak needs and the original ten rows never had. Keys are anti-correlated with the real schema ids on purpose: leaf_b's real id sorts before leaf_a's (sha256:b1f2... < sha256:ff35...), so leaf_b gets the alphabetically-*later* key (\"zz-tie-schema\") and leaf_a gets the *earlier* one (\"aa-tie-schema\") - a schemaId-first order and a recordKey-first order disagree here on purpose, so only the correct composition produces leaf_b's row first.",
+      "schema": "leaf_b", "key": "zz-tie-schema", "ordinal": 15, "fields": { "kind": "tie-schema", "mass": "1" }
+    },
+    {
+      "schema": "leaf_a", "key": "aa-tie-schema", "ordinal": 15, "fields": { "kind": "tie-schema", "mass": "1" }
+    },
+    {
+      "//": "R-AO, 2026-09-23: 'dup-key' already carries two rows (leaf_a ordinal 11, leaf_b ordinal 12) - both are in citer's Design role's declared target ([leaf_a, leaf_b], unlike citer_narrow's narrow_ref above, which only ever had one in-target candidate at a shared key). This citer is the first row in this file (hence in both runtimes' row order) to name 'dup-key' through Design, so resolving it must deterministically pick the leaf_a row - the first in-target candidate in the caller's order - never the leaf_b row, in both runtimes.",
+      "schema": "citer",
+      "key": "citer-both-in-target",
+      "ordinal": 16,
+      "references": [ { "role": "Design", "targetKey": "dup-key" } ]
+    }
+  ]
+}

contracts/cultnet/interop/selection-vectors.rs-written.json

@@ -0,0 +1,282 @@
+{
+  "vectors": [
+    {
+      "name": "any_of_plus_ge_conjunction",
+      "selectionMessagePackBase64": "g6ZmaWVsZHOSg6VpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORpndlYXBvboOlaW5kZXikbWFzc6JvcKJnZaZudW1iZXKhNapwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "descending_with_limit",
+      "selectionMessagePackBase64": "g6pwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nw6VsaW1pdAM=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema",
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/zz-tie-schema"
+      ],
+      "matched": 18,
+      "hasNext": true,
+      "expectedEdges": []
+    },
+    {
+      "name": "gt_numeric_boundary",
+      "selectionMessagePackBase64": "g6ZmaWVsZHORg6VpbmRleKRtYXNzom9womd0pm51bWJlcqExqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfC",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-lo",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/b-hi",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass"
+      ],
+      "matched": 4,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "incoming_exists_true",
+      "selectionMessagePackBase64": "hKdzY2hlbWFzkdlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmalY2l0ZWSCpHJvbGWmRGVzaWdupmV4aXN0c8OqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+          "payloadBase64": null
+        },
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "incoming_negation",
+      "selectionMessagePackBase64": "hKdzY2hlbWFzkdlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmalY2l0ZWSCpHJvbGWmRGVzaWdupmV4aXN0c8KqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-lo",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-1",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-3",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/😂-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema"
+      ],
+      "matched": 7,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "shared_index_value_three_rows",
+      "selectionMessagePackBase64": "g6ZmaWVsZHORg6VpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORpnNoYXJlZKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-1",
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/shared-2",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-3"
+      ],
+      "matched": 3,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "hop_by_role_cites_exact_id",
+      "selectionMessagePackBase64": "hKRrZXlzkadjaXRlci0xpWNpdGVzgqZ0YXJnZXSCqHNjaGVtYUlk2UdzaGEyNTY6ZmYzNWYzZDlkNmRlM2YxMDY2YjkzNjllNzNmZTZjNzY0OGU4ODM2OGQxOGVmYzIyNzVjOTk0NzMwY2Q4NGNmZqlyZWNvcmRLZXmkYS1lcaRyb2xlpkRlc2lnbqpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "hop_by_role_cites_name_alias",
+      "selectionMessagePackBase64": "hKRrZXlzkadjaXRlci0xpWNpdGVzgqZ0YXJnZXSCqHNjaGVtYUlkqWxlYWZfYS52OalyZWNvcmRLZXmkYS1lcaRyb2xlpkRlc2lnbqpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-1",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "schemas_by_hash_alias",
+      "selectionMessagePackBase64": "g6dzY2hlbWFzkdlKc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmYudjGqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "schemas_by_name_alias",
+      "selectionMessagePackBase64": "g6dzY2hlbWFzkalsZWFmX2EudjmqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-lo",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/a-eq",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-1",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/shared-3",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/😂-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema"
+      ],
+      "matched": 9,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "float_tie_exact_ge",
+      "selectionMessagePackBase64": "g6ZmaWVsZHORg6VpbmRleKRtYXNzom9womdlpm51bWJlcqoyMjMzNzU5LjI1qnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfC",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/tie-mass"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "astral_key_code_point_order",
+      "selectionMessagePackBase64": "g6ZmaWVsZHORg6VpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORp3VuaWNvZGWqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/-row",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/😂-row"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "row_tiebreak_schema_id_before_record_key_at_tied_ordinal",
+      "selectionMessagePackBase64": "g6ZmaWVsZHORg6VpbmRleKRraW5kom9wpmFueV9vZqZ2YWx1ZXORqnRpZS1zY2hlbWGqcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:b1f2407d0227a79dcbffdf7ea317f827eec64be38a3f61b7d4e99e81e3b24b42/zz-tie-schema",
+        "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/aa-tie-schema"
+      ],
+      "matched": 2,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "shared_key_narrow_ref_resolves_leaf_within_target",
+      "selectionMessagePackBase64": "hKRrZXlzkbVuYXJyb3ctY2l0ZXItYWNjZXB0ZWSlY2l0ZXOCpnRhcmdldIKoc2NoZW1hSWTZR3NoYTI1NjpmZjM1ZjNkOWQ2ZGUzZjEwNjZiOTM2OWU3M2ZlNmM3NjQ4ZTg4MzY4ZDE4ZWZjMjI3NWM5OTQ3MzBjZDg0Y2ZmqXJlY29yZEtleadkdXAta2V5pHJvbGWqbmFycm93X3JlZqpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:ee192f6526a8f8cdec7044551aa2c8e28c612426766bb270605023bc94e2614d/narrow-citer-accepted"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:ee192f6526a8f8cdec7044551aa2c8e28c612426766bb270605023bc94e2614d/narrow-citer-accepted",
+          "role": "narrow_ref",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "shared_key_design_resolves_the_first_in_target_candidate_in_row_order",
+      "selectionMessagePackBase64": "hKRrZXlzkbRjaXRlci1ib3RoLWluLXRhcmdldKVjaXRlc4KmdGFyZ2V0gqhzY2hlbWFJZNlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmapcmVjb3JkS2V5p2R1cC1rZXmkcm9sZaZEZXNpZ26qcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedIds": [
+        "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target"
+      ],
+      "matched": 1,
+      "hasNext": false,
+      "expectedEdges": [
+        {
+          "fromId": "sha256:9d0bc9aebc3619b07aabf564f98667afde41444c1b866661d777687d443608dc/citer-both-in-target",
+          "role": "Design",
+          "toId": "sha256:ff35f3d9d6de3f1066b9369e73fe6c7648e88368d18efc2275c994730cd84cff/dup-key",
+          "payloadBase64": null
+        }
+      ]
+    },
+    {
+      "name": "refuses_empty_schemas_list",
+      "selectionMessagePackBase64": "g6dzY2hlbWFzkKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedRefusalField": "schemas",
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "refuses_blank_key_entry",
+      "selectionMessagePackBase64": "g6RrZXlzkqRhLWVxoyAgIKpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedRefusalField": "keys",
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "refuses_unmatched_cites_target_schema",
+      "selectionMessagePackBase64": "g6VjaXRlc4KmdGFyZ2V0gqhzY2hlbWFJZLlzaGEyNTY6bm90LWEta25vd24tc2NoZW1hqXJlY29yZEtleaRhLWVxpHJvbGWmRGVzaWduqnByb2plY3Rpb26maGVhZGVyqmRlc2NlbmRpbmfC",
+      "asOf": 1,
+      "expectedRefusalField": "cites.target.schemaId",
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "refuses_cites_target_by_hash_shaped_alias",
+      "selectionMessagePackBase64": "g6VjaXRlc4KmdGFyZ2V0gqhzY2hlbWFJZNlKc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmYudjGpcmVjb3JkS2V5pGEtZXGkcm9sZaZEZXNpZ26qcHJvamVjdGlvbqZoZWFkZXKqZGVzY2VuZGluZ8I=",
+      "asOf": 1,
+      "expectedRefusalField": "cites.target.schemaId",
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    },
+    {
+      "name": "shared_key_narrow_ref_refuses_when_only_candidate_is_outside_target",
+      "selectionMessagePackBase64": "hKRrZXlzkbRuYXJyb3ctY2l0ZXItcmVmdXNlZKVjaXRlc4KmdGFyZ2V0gqhzY2hlbWFJZNlHc2hhMjU2OmZmMzVmM2Q5ZDZkZTNmMTA2NmI5MzY5ZTczZmU2Yzc2NDhlODgzNjhkMThlZmMyMjc1Yzk5NDczMGNkODRjZmapcmVjb3JkS2V5q25hcnJvdy1vbmx5pHJvbGWqbmFycm93X3JlZqpwcm9qZWN0aW9upmhlYWRlcqpkZXNjZW5kaW5nwg==",
+      "asOf": 1,
+      "expectedEvaluationRefusal": "reference_outside_target",
+      "expectedIds": [],
+      "matched": 0,
+      "hasNext": false,
+      "expectedEdges": []
+    }
+  ]
+}

docs/mutation-testing.md

@@ -0,0 +1,159 @@
+# Mutation Testing
+
+CultLib measures its C# test suites with Stryker.NET, pinned as a repo-local
+tool in `dotnet-tools.json`. Coverage is added project by project; a project
+with no `stryker-config.json` next to its test project has not been scoped
+yet (see "Follow-ups" below for what's outstanding).
+
+## Running it
+
+Restore the tool once per checkout:
+
+```powershell
+dotnet tool restore
+```
+
+Run a full mutation pass from a covered test project's directory, for
+example CultMath:
+
+```powershell
+cd packages/cultmath/tests/CultMath.Tests
+dotnet stryker -t mtp
+```
+
+`-t mtp` selects Stryker's Microsoft.Testing.Platform runner. It is required
+for test projects on `xunit.v3` (CultMath.Tests is one): Stryker's default
+`vstest` runner's coverage capture does not work against xunit.v3's native
+test host and the run stalls retrying test sessions indefinitely. Projects
+still on `xunit` v2 with `xunit.runner.visualstudio` can use the default
+`vstest` runner.
+
+For a single cut, scope the run to what changed instead of the whole
+project:
+
+```powershell
+dotnet stryker -t mtp --since:<base-commit-or-branch>
+```
+
+Use a full commit SHA for `--since`, not an abbreviation: `git rev-parse
+<short-sha>` first, then pass the full result. Stryker resolves `--since`
+through the same git plumbing a short SHA can resolve ambiguously (or fail to
+resolve at all) depending on the checkout's object database, and a
+misresolved base silently changes what "since" means instead of erroring.
+
+In a container, also set `git config --global --add safe.directory '*'`
+before running Stryker (or any other command that shells out to `git`
+against this checkout) - git refuses to operate on a repository owned by a
+different user by default, which is the common case for a bind-mounted
+checkout in a container.
+
+Reports land in `StrykerOutput/` next to the test project (git-ignored).
+Open the `reports/mutation-report.html` file for a browsable view, or read
+`reports/mutation-report.json` for a scriptable one.
+
+## Triage rules
+
+The mutation score is not a gate (`break` threshold is 0). Every surviving
+mutant is a finding about the tests, not a build failure, and gets triaged
+into one of:
+
+- **missing behavioural test** — name the test that should exist and what
+  branch, edge case, or component it would exercise.
+- **degenerate fixture** — the code path is exercised, but the fixture's
+  values make two different mutants produce the same observable result (a
+  zero component that erases a `+`/`-` distinction, an already-normalized
+  input that erases a `*`/`/` distinction, all-equal or all-same-sign inputs
+  that erase a boundary or `&&`/`||` distinction). Fix the fixture, don't
+  invent a new one that only kills that one mutant.
+- **equivalent** — the mutant cannot change behaviour. Float-threshold
+  boundary flips (`>` to `>=`) are equivalent by default. A reasoned
+  equivalence claim (for example, `>>` and `>>>` on an already-unsigned
+  operand) needs its one-line reason recorded, not assumed.
+
+Do not write a hand-rolled mutation suite or anchor test as a substitute.
+Where the tool can't reach (native/shader/editor code), the defence is a
+behavioural test at the layer the rule is decided, not a committed mutation
+harness.
+
+## Known tool caveat
+
+Stryker 5.0.0's `mtp` runner is documented as preview. Its per-test coverage
+capture was found to report false "Survived" verdicts specifically for
+mutations inside `static readonly` field initializers that a test does
+cover (confirmed by hand-mutating `bool3.@false` and `bool4.@true` and
+running the full suite directly with `dotnet test`, both of which fail
+against the mutation that Stryker reported as surviving). Treat a survivor
+inside a `static readonly` field initializer as unproven until confirmed
+with a direct `dotnet test` run against the same mutation; do not triage it
+as a missing test without that check.
+
+A survivor that looks like it must be covered is unproven until confirmed
+with a direct `dotnet test` run against the same hand-applied mutation - but
+confirm what the mutant actually is before drawing a tooling conclusion from
+it. An earlier pass here reported three survivors in
+`CultGeometrySurfaceNets.TryGetOtherEndpoint`'s per-axis `if (x + 1 >=
+sizeX) return false;` guards and initially triaged them as a `vstest`
+coverage false-survivor (the same shape as the `mtp`/`static readonly`
+caveat above). That triage was wrong: the actual mutant Stryker reports
+there is `return false` -> `return true` inside the guard, which is
+equivalent, not a coverage miss. Returning `true` from
+`TryGetOtherEndpoint` still leaves the out `other` coordinate equal to the
+current coordinate (see the method: `other` is cloned from `coord` and only
+one component is incremented when the method returns `true`), so the caller
+compares a sample against itself, the inside/outside flags always match,
+and the crossing is skipped exactly as it would have been had the method
+correctly returned `false`. No test can distinguish the two branches because
+there is nothing to distinguish - it is a legitimate equivalent mutant, not
+evidence of a `vstest` false survivor.
+
+`CultGeometrySurfaceNets.Extract`'s `if (inside == (OrientationSign[axis] <
+0))` (the sole authority for quad winding after the geometric cross-product
+fallback was deleted) has three mutants on that line: `==` -> `!=`, and `< 0`
+negated to `> 0` or widened to `<= 0`. The first two, `inside != (OrientationSign[axis]
+< 0)` and `OrientationSign[axis] > 0`, are both reported `Killed`. The third,
+`OrientationSign[axis] <= 0`, survives, but it is an equivalent mutant, not a
+coverage gap: `OrientationSign` is the fixed table `{ 1, -1, 1 }` and never
+holds `0`, so `< 0` and `<= 0` agree on every value the table can actually
+produce. There is nothing for a test to distinguish, the same shape as the
+`TryGetOtherEndpoint` equivalent mutant above.
+
+No `vstest` coverage-based false survivor has actually been confirmed for
+GameCult.Geometry. Every survivor triaged here so far has turned out to be a
+genuine equivalent mutant once hand-mutated and checked directly against
+`dotnet test`; treat any survivor that looks like it must obviously be
+covered as unproven until confirmed the same way, but do not cite this
+project as precedent for the `vstest` caveat itself - that caveat is
+`mtp`-runner-specific and documented above for `static readonly` field
+initializers, and GameCult.Geometry has never actually hit it.
+
+## Follow-ups
+
+CultMath.Tests and GameCult.Geometry.Tests are the only projects currently
+scoped. GameCult.Geometry's `stryker-config.json` has no `test-runner`
+entry: the project is NUnit 4 with `NUnit3TestAdapter` and
+`Microsoft.NET.Test.Sdk`, so Stryker's default `vstest` runner applies
+directly (no `mtp` workaround needed, unlike CultMath.Tests's xunit.v3
+suite).
+
+GameCult.Geometry has only ever been run `--since:`-scoped to the cut that
+added surface nets; a full-project baseline (running mutation against all of
+`CultGeometryIsoSurface`, `CultGeometryDocuments`, and
+`CultGeometryPrimitives`, not just the diff) is a recorded follow-up, not
+something either cut did.
+
+That first `--since` pass did not actually stay diff-scoped: adding
+`stryker-config.json` itself in the same cut that first used it made Stryker
+log "391 mutants will be tested because: Non-CSharp files in test project
+were changed" and mutate the whole `mutate` glob (all four existing
+GameCult.Geometry source files), not just the new surface-nets files. A cut
+that changes a non-C# file inside the test project (a fixture, this config
+file, anything under `Fixtures/`) loses `--since` line-level scoping for that
+run; a future cut whose diff is C#-only, against a base commit that already
+has `stryker-config.json`, should scope correctly.
+
+`GameCult.Caching`, `GameCult.Mesh` (+ `.Quic`, `.Quic.Native`),
+`GameCult.Networking` (+ `.WebSockets`), and the non-.NET runtimes
+(`cultcache-rs/py/ts`, `cultmesh-*`, `cultnet-*`) each still need their own
+`stryker-config.json` (or ecosystem-equivalent tool: `cargo-mutants` for
+Rust, `StrykerJS` for TypeScript, `mutmut` for Python) and a baseline pass.
+None of that is wired into CI yet.

docs/nuget-packaging.md

@@ -1,5 +1,8 @@
 # NuGet Packaging
 
+See `docs/semver-policy.md` for what a version bump on these packages is
+required to mean and how a release is checked against that before it ships.
+
 CultLib publishes the managed dependency graph as separate packages. The leaf
 package is `GameCult.Mesh`; its NuGet dependencies preserve the CultMesh,
 CultNet, and CultCache ownership boundaries.
@@ -19,5 +22,5 @@ closure through UPM rather than NuGet restore.
 Install the Unity package from the immutable release tag:
 
 ```text
-https://github.com/GameCult/CultLib.git?path=/unity/org.gamecult.cultlib#cultlib-unity-v1.0.46
+https://github.com/GameCult/CultLib.git?path=/unity/org.gamecult.cultlib#cultlib-unity-v1.0.57
 ```

docs/runtime-parity-scope.md

@@ -62,6 +62,17 @@ to speak CultNet or participate in CultMesh.
   shared transport port and expand RUDP adoption beyond the core proof.
 - `packages/cultmesh-kotlin/README.md` records Kotlin's runtime role and
   ergonomic surface, including the explicit non-claim around C# SoA storage.
+- CultNet typed selection (`cultnet.snapshot_response_raw.v1`, C#/Rust only;
+  docs/cultnet-selection-cut.md, R-AY): byte parity for the
+  `snapshot_response_raw.v1` envelope and its nested record types, verified at
+  populated and absent optional values, plus semantic parity over the named
+  field subset. `packages/cultnet-rs/tests/selection_wire_parity.rs` and
+  `tests/GameCult.Networking.Tests/SelectionWireParityTests.cs` carry the byte
+  vectors; `packages/cultnet-rs/tests/selection.rs`'s
+  `write_selection_vectors_for_the_reference` and
+  `tests/GameCult.Networking.Tests/SelectionParityVectorTests.cs` carry the
+  semantic ones. A single rows-to-bytes path driving both halves in one call
+  remains its own cut (R-AR) and is not part of this claim.
 
 ## Expansion Work Outside The Current Parity Claim
 

docs/semver-policy.md

@@ -0,0 +1,213 @@
+# Semantic Versioning Policy
+
+Operator ruling, 2026-09-17: **semantic versioning is policy** for every
+package CultLib publishes, strictly. A release that removes or changes public
+surface incompatibly is a major bump, full stop — not a judgment call left to
+the person cutting the release.
+
+This document says what "breaking" means for each kind of surface this repo
+actually ships, and how a release is checked against it. See
+`docs/nuget-packaging.md` for how the managed/Unity packaging mechanics work;
+this document is the versioning contract those mechanics must satisfy.
+
+## The scar
+
+`org.gamecult.cultlib` 1.0.60 removed `CultInspectorAssetPath` — public API —
+and shipped as a patch bump. Its own changelog entry is titled "Breaking"; the
+version number said otherwise. A reviewer relying on the number alone would
+have missed it. This is recorded as history, not fixed by renumbering: `1.0.60`
+stays `1.0.60`. This policy, and the check below, exist so the next one is
+caught before it ships instead of written up afterward.
+
+## Packages in scope
+
+| Package | Kind | Tag prefix | Published by |
+| --- | --- | --- | --- |
+| `org.gamecult.cultlib` | Unity UPM | `cultlib-unity` | `scripts/build-unity-package.ps1`, consumed by git tag |
+| `org.gamecult.caching.unity` | Unity UPM | `caching-unity` | tagged directly (no build script; see "Coverage gaps") |
+| `org.gamecult.cultmath` | Unity UPM | `cultmath-unity` | `packages/cultmath/scripts/build-unity-package.ps1`, consumed by git tag |
+| `@gamecult/cultcache-ts` | npm | `cultcache-ts` | `.github/workflows/publish-packages.yml` |
+| `cultcache-py` | PyPI | `cultcache-py` | `.github/workflows/publish-packages.yml` |
+| `cultnet-py` | PyPI | `cultnet-py` | `.github/workflows/publish-packages.yml` |
+| `cultmesh-py` | PyPI | `cultmesh-py` | `.github/workflows/publish-packages.yml` |
+
+Rust crates are consumed as pinned git revisions (see `publish-packages.yml`'s
+own header comment) and are out of scope for tagged-release semver policing;
+a `Cargo.toml` version still exists and should follow this policy by
+convention, but nothing in this repo checks it mechanically today.
+
+Tag naming stays `<package>-v<version>` for every package above, matching the
+prefixes already in use.
+
+## What counts as breaking
+
+Semver's ordinary rule — additive is minor or patch, anything a consumer's
+existing code or data can no longer rely on is major — applies per surface as
+follows.
+
+### Managed public API (`org.gamecult.cultlib`, NuGet packages, `cultmath`)
+
+Breaking: removing or renaming a public type/member, changing a public
+member's signature or observable behavior in an incompatible way, tightening
+a public contract (new required parameter, narrowed accepted input),
+or moving a type across assemblies/namespaces without a compatible forwarder.
+
+Not breaking: adding a new public member, type, or overload; widening an
+accepted type; deprecating (marking obsolete) without removing.
+
+### Unity package inspector attributes (`org.gamecult.cultlib`,
+`org.gamecult.caching.unity`)
+
+These ship as ordinary public API by the rule above, but get their own
+callout because they are easy to mistake for "just editor tooling": an
+attribute class, its constructor shape, and the serialized value shape it
+reads/writes are all public surface a consumer's `[CultInspectorX(...)]`
+usage and serialized scene/prefab data depend on. Removing or renaming an
+attribute, or changing what it expects a annotated member's persisted value to
+look like (as `CultInspectorAssetPath` to `CultInspectorAssetGuid` did in
+1.0.60) is breaking.
+
+### Persisted wire format / store compatibility (CultCache)
+
+Governed by `src/GameCult.Caching/Contracts/cultcache-schema-compatibility.md`
+and `cultcache-persistence-format.md` — read those for the authoritative
+rules. In semver terms: anything those documents classify as **hard
+rejection** (type change, reference/value change, one-vs-many change, target
+schema change, name/index lookup semantics change, a persisted schema with no
+compatible local candidate) is breaking for any package that reads or writes
+the format. Anything classified as **soft-migratable drift** (compatible
+schema id drift, an ignorable missing slot, a defaultable missing slot) is not
+breaking on its own, but changing what counts as soft-migratable — loosening
+or tightening the drift rules themselves — is breaking for whichever package
+owns that classification logic.
+
+### CultNet protocol surface
+
+Breaking: a wire-incompatible change to a CultNet message, frame, or
+handshake shape; removing or repurposing a message type or field that another
+runtime's implementation depends on; changing routing, authority, or trust
+semantics such that a peer built against the previous protocol version
+misbehaves rather than cleanly failing. Additive, backward-compatible framing
+changes (a new optional field a receiver may ignore) are not breaking.
+
+### Native bridge exported functions (`GameCult.Mesh.Quic.Native`)
+
+Breaking: removing or changing the signature/ABI of a `CULTMESH_API`
+(`extern "C"`) exported function, or changing an exported function's
+behavior such that the existing managed P/Invoke caller (`GameCult.Mesh.Quic.Native`'s
+C# side) or Rust caller (`cultmath-core`'s equivalent `#[no_mangle] extern "C"`
+surface) no longer gets what it asked for. Swapping the underlying TLS/QUIC
+implementation (as 1.0.60 did, Schannel to OpenSSL MsQuic) is not breaking
+*by itself* as long as the exported v1 functions keep their signatures and
+behavior — 1.0.60's actual breaking change was the inspector attribute
+removal, not the bridge swap, and its changelog correctly filed the bridge
+swap under "Changed" rather than "Breaking".
+
+## Pre-1.0 packages
+
+A package at `0.y.z` (currently `org.gamecult.cultmath`, at `0.2.x`) uses the
+standard pre-1.0 convention: `MAJOR` stays `0` during initial development, so
+`MINOR` carries what `MAJOR` means once the package reaches `1.0.0`. Concretely:
+
+- a breaking change bumps `MINOR` (and resets `PATCH` to `0`);
+- a non-breaking change bumps `PATCH`.
+
+Leaving `0.y.z` for `1.0.0` is a deliberate, separate decision (the API is now
+considered stable), not something the checker infers on its own.
+
+## What a release changelog entry must contain
+
+Every published package keeps a `CHANGELOG.md` beside its manifest
+(`unity/org.gamecult.cultlib/CHANGELOG.md` and
+`src/GameCult.Unity/Assets/Caching/CHANGELOG.md` are the existing precedent).
+Each release adds a `## [<version>]` section containing:
+
+- a category subsection per change (`### Added`, `### Changed`, `### Fixed`,
+  etc., following Keep a Changelog style);
+- **`### Breaking`** — this exact heading, this exact spelling — for any
+  change that meets the "what counts as breaking" rules above. This heading
+  is not decorative: the CI check below greps for it by name.
+- enough detail that a consumer can tell what to change, in the style of the
+  1.0.60 entry (name the removed/changed symbol and its replacement).
+
+A version with no changelog entry at all fails the check below, the same as
+a mislabelled one — an undocumented release is not a smaller sin than a
+mislabelled one.
+
+## Enforcement
+
+`scripts/check-changelog-semver.mjs` is the mechanical check. Given a
+package name, its `CHANGELOG.md` path, the version being released, and a git
+tag prefix, it:
+
+1. resolves the previous published version from the highest existing
+   `<prefix>-v*` tag older than the version being released (or treats the
+   release as a package's first if none exists);
+2. requires a `## [<version>]` changelog entry to exist at all;
+3. classifies the version bump (major/minor/patch) against the previous
+   version, refusing anything that is not exactly the next version in some
+   lane — a skip, a reversal, or a repeat are all refused, not just wrong
+   bump sizes;
+4. if the changelog entry has a `### Breaking` section, requires the bump to
+   be at least major (or, pre-1.0, at least minor);
+5. fails loudly, naming the package, the previous and new version, and (when
+   relevant) the changelog heading that triggered the requirement.
+
+Run it directly: `node scripts/check-changelog-semver.mjs --package <name>
+--changelog <path> --version <x.y.z> --tag-prefix <prefix>`. Its own tests
+live in `scripts/check-changelog-semver.test.mjs` (`node --test
+scripts/check-changelog-semver.test.mjs`).
+
+It is wired into:
+
+- `.github/workflows/publish-packages.yml`, right after each job's existing
+  "tag matches manifest version" check, for `cultcache-ts`, `cultcache-py`,
+  `cultnet-py`, and `cultmesh-py`;
+- `scripts/build-unity-package.ps1`, for `org.gamecult.cultlib`;
+- `packages/cultmath/scripts/build-unity-package.ps1`, for
+  `org.gamecult.cultmath`;
+- `scripts/verify-caching-unity-release.ps1`, for `org.gamecult.caching.unity`.
+
+### Coverage gaps
+
+`publish-packages.yml` only triggers on `cultcache-ts-v*`, `cultcache-py-v*`,
+`cultnet-py-v*`, and `cultmesh-py-v*` tag pushes — it does not build or gate
+the Unity UPM packages at all; those are consumed directly by git tag
+(`unity/org.gamecult.cultlib`, `packages/cultmath/unity/org.gamecult.cultmath`,
+`src/GameCult.Unity/Assets/Caching`), so a workflow trigger on their tags
+cannot be added to that file without also giving it a reason to check out and
+build Unity content it currently has no job for. The check is instead wired
+into the scripts that already run at Unity-package release time:
+`build-unity-package.ps1` and `packages/cultmath/scripts/build-unity-package.ps1`
+already verify version consistency between the built assembly and
+`package.json`, so the semver check runs alongside that as one more release
+gate. `org.gamecult.caching.unity` has no build script at all today — it is
+pure C# source tagged directly with no compile step — so
+`scripts/verify-caching-unity-release.ps1` exists solely to run this check
+before that package is tagged; it is not a build script and does not become
+one.
+
+None of this is enforced by a git hook or branch protection rule: it runs
+when someone remembers to run the Unity release scripts, the same way the
+existing assembly-version check does. A tag pushed by hand without running
+the release script bypasses both checks equally; closing that gap is a CI
+trigger on tag push for the Unity packages, not something this change adds.
+
+Rust crates (consumed as pinned git revisions, not tagged releases in the
+usual sense) and the CultNet protocol surface itself (no automated wire
+compatibility test currently gates a release) are policy by convention only —
+described above, not mechanically checked. Extending the checker to a Rust
+crate's `Cargo.toml`/`CHANGELOG.md` or to an automated CultNet interop
+compatibility gate is future work, not part of this change.
+
+`@gamecult/cultcache-ts`, `cultcache-py`, `cultnet-py`, `cultmesh-py`, and
+`org.gamecult.cultmath` currently have **no `CHANGELOG.md` file at all**. This
+is a real, pre-existing gap, not something introduced by this policy: their
+next tagged release will fail the new check for exactly that reason ("no
+changelog entry for version X") until each package's `CHANGELOG.md` exists.
+That failure is intended — a release with no changelog is not a smaller
+problem than a mislabelled one — but it does mean the very next release of
+any of these five packages needs a `CHANGELOG.md` created first. Backfilling
+changelog content for their past releases is not part of this change: it
+would mean inventing release-note prose for history this pass has no
+first-hand knowledge of, which is worse than leaving the gap named.

docs/typescript-quic-realtime-target.md

@@ -0,0 +1,160 @@
+# TypeScript QUIC Realtime Plane Target
+
+Date: 2026-09-16
+
+Status: target accepted by the operator (2026-09-16), ready for Eureka. No cut
+map exists yet. When the pipeline starts, Imagination maps the cut into
+`docs/typescript-quic-realtime-cut.md` against `main` at `a0813c6` or later.
+
+The TypeScript runtime gains the CultMesh QUIC realtime state plane that the C#
+runtime already has: a provider that serves frames and a consumer that receives
+them, byte-compatible with `GameCult.Mesh.Quic` and the native MsQuic connector
+the Unity package ships. This document states the end state and the invariants
+that constrain getting there.
+
+Operator ruling, 2026-09-16, on providing QUIC for a Node service: "Option 2 all
+the way, this is what CultLib is supposed to be, we're not half assing it." A
+separate .NET provider process and a WebSocket shortcut were both rejected.
+
+## Why now
+
+The first consumer is StreamPixels. Its service (Node 24, TypeScript, on
+Yggdrasil) must publish realtime state to a Unity overlay running on a
+streamer's machine. The overlay is a receive-only client using the Unity
+package's `CultMeshNativeQuicRealtimeTransportConnector`. Today no TypeScript
+path exists:
+
+- Node v24.15.0 has no `node:quic`, with or without `--experimental-quic`.
+- `packages/cultmesh-ts` and `packages/cultnet-ts` contain no QUIC code.
+- `GameCult.Mesh.Quic` (.NET 10, `System.Net.Quic`) is the only QUIC provider.
+- The C# TCP control and content connectors are plaintext and restricted to
+  loopback (`src/GameCult.Mesh/docs/transport-planes.md`, "Security and release
+  gate"), so they cannot carry the overlay's remote session either.
+
+## This touches the foundation
+
+- **Wire parity is an invariant.** The C# codec is the reference:
+  `src/GameCult.Mesh/CultMeshRealtimeWireProtocol.cs`. The TypeScript runtime
+  must produce and accept identical bytes:
+  - ALPN `cultmesh-state-v1`; connection close code `0x43554c54`, stream abort
+    code `0x53544154`; reliable stream type `1`, latest-only stream type `2`.
+  - Frame: magic `0x31545343`, then a 37-byte little-endian fixed header
+    (delivery byte, producer epoch i64, sequence i64, channel/schema/body id
+    lengths u16, payload length i32, header size i32 = 37, wire version u16 =
+    1), then UTF-8 channel id, schema id, body id, then payload.
+  - Limits: payload at most 64 MiB; each identity at most 65,535 UTF-8 bytes;
+    decode rejects wrong magic, unknown version, out-of-range delivery, and any
+    length that does not sum exactly.
+- **Delivery semantics are an invariant**
+  (`src/GameCult.Mesh.Quic/README.md`, `CultMeshRealtimeTransports.cs`):
+  - `ReliableOrdered`: one persistent ordered stream; broadcast is
+    completion-bearing.
+  - `LatestOnly`: independent streams; at most one pending frame per
+    `(channel, body)`, replaced by a newer `(producer epoch, sequence)`
+    generation; a keyed coalescing outbox per physical peer, so a slow or
+    departed consumer never backpressures the producer.
+  - `Unreliable`: fails closed until datagrams are exposed, matching the managed
+    C# adapter.
+- **Trust is an invariant.** No remote session comes online without the chain
+  in `transport-planes.md`: an Odin-signed `CultMeshRouteCertificate` (Verse,
+  authority runtime, protocol set, endpoint, generation, validity, provider
+  P-256 key) checked against consumer-pinned Odin roots, TLS 1.3, and the
+  endpoint certificate bound to that route, including the
+  `cultmesh-state+quic://host:port?cert-sha256=<uppercase SHA-256>` pin.
+  Signatures are ECDSA P-256 over SHA-256 with P1363 `r || s` encoding and the
+  length-prefixed canonical transcript. Unsigned traffic exists only under an
+  explicit `LocalDevelopment` policy on loopback.
+- **One implementation of TypeScript route verification.** `cultmesh-browser`
+  already verifies Odin route certificates and provider nonce possession with
+  WebCrypto (`packages/cultmesh-browser/src/index.ts`, `verifyAuthorityRoute`,
+  `canonicalRoute`, `canonicalSession`, `verifyP256`). The Node QUIC path must
+  reuse that owner, not grow a second verifier.
+- **The realtime plane carries state frames only.** Schemas, commands,
+  receipts, manifests, and immutable content do not travel through it
+  (`ICultMeshRealtimeTransport` doc comment). RUDP is never installed
+  implicitly in its place.
+- **Existing consumers survive.** The StreamPixels service already imports
+  `cultcache-ts`, `cultnet-ts`, and `cultmesh-ts` (`verse-state.ts`,
+  `idunn-rudp-health.ts`) for Odin advertisement and Idunn health over RUDP.
+  Imagination audits every other TypeScript consumer across `F:\Projects`
+  before sizing the cut.
+
+## Target state
+
+- `cultmesh-ts` exposes a QUIC realtime provider and a QUIC realtime consumer
+  with the same ergonomic shape as the C# `CultMeshQuicRealtimeServer`
+  (listen, broadcast with an explicit delivery mode) and
+  `ICultMeshRealtimeTransportConnector` (connect by advertised candidate,
+  receive frames), under the branded `CultMesh` entrypoint.
+- QUIC comes from native MsQuic bindings owned by CultLib, not from a Node
+  polyfill or a third-party QUIC stack with different semantics. How the binding
+  is built and shipped is the means (Imagination probes it); what it must
+  deliver is TLS 1.3, ALPN, independent unidirectional or bidirectional streams,
+  certificate validation with a caller hook, and clean close and abort codes.
+- Frame encoding and decoding exist once in TypeScript and are tested against
+  bytes produced by the C# codec.
+- Application code never picks endpoints, ranks routes, or writes reconnect
+  loops; `CultMeshSessionManager`-equivalent route selection owns that, as in C#.
+- The build produces binaries for the hosts that run them: Windows x64 for
+  local development, and Linux x64 for Yggdrasil, built on Linux or the deploy
+  path's builder, not cross-compiled on Starfire.
+
+## Not in this migration
+
+One foundation per pipeline. These are separate, named pipelines or consumer
+work:
+
+- **TypeScript content plane** (a provider in `cultmesh-ts`, a verifying HTTPS
+  reader in `cultmesh-browser`) for exported character artifacts. HTTPS content
+  transport and single-host trust on Yggdrasil were already ruled.
+- **Authenticated remote control plane** (TLS on the TCP schema and content
+  connectors). See Q1.
+- **Browser QUIC** (WebTransport). Browsers keep the verified WebSocket path.
+- **Python, Rust, and Kotlin QUIC.** The parity scope is role-scoped; this
+  migration claims TypeScript and C# only.
+- **StreamPixels integration** (service publication, overlay subscription, and
+  the catalog and scene-intent schemas) is consumer work in StreamPixels after a
+  released `cultmesh-ts` exists.
+
+## Verification the cut must reach
+
+- Golden frame bytes from the C# codec decode in TypeScript, and TypeScript
+  encodings decode in C#, for every delivery mode and at the length limits.
+  Malformed inputs are rejected identically.
+- Separate processes, both directions: a TypeScript provider to the C# native
+  connector (the one Unity uses) and to the managed connector, and a C# managed
+  provider to the TypeScript consumer. Extend the existing parity harnesses
+  (`CULTMESH_NATIVE_EXTERNAL_ENDPOINT`, `packages/cultnet-ts/test/interop`) rather
+  than adding a parallel one.
+- `LatestOnly` coalescing: a stalled consumer does not delay the producer, and
+  the consumer converges on the terminal generation.
+- Trust negatives: an expired or unsigned route, the wrong Odin root, a
+  mismatched `cert-sha256` pin, and a replayed nonce are each refused, with a
+  mutation per rule.
+- The Linux x64 binary runs on the Yggdrasil deploy path, verified on that host.
+
+## Rulings (operator, 2026-09-16)
+
+The operator accepted every recommendation below ("You got it"). Each question
+is kept with its options as the record of what was decided against.
+
+- **Q1. Which remote plane carries the overlay's non-frame data?** The realtime
+  plane forbids schemas, commands, and content, and the TCP planes are
+  loopback-only. A: publish her character, the subathon window, and scene
+  intents as QUIC state frames with their CultCache schema id and payload, and
+  ship the costume catalog as a versioned immutable artifact on the HTTPS
+  content plane; the overlay sends no commands, so it needs no remote control
+  plane. B: add TLS to the TCP schema and content connectors as its own
+  pipeline first. **Recommended: A.** It needs no new plane for M1, matches a
+  receive-only client, and leaves TLS TCP to the first consumer that sends
+  commands.
+- **Q2. Where does shared TypeScript route verification live?** It is inside
+  `cultmesh-browser` today, and `cultmesh-ts` is Node-only. A: move it to a
+  browser-safe shared module that both import (for example beside
+  `cultnet-ts/contracts`). B: have `cultmesh-ts` depend on `cultmesh-browser`.
+  **Recommended: A**, so neither transport package owns the other's trust.
+- **Q3. Which platforms must the native binding support at release?**
+  **Recommended: Windows x64 and Linux x64 only**, the two hosts that run it
+  today.
+- **Q4. Are QUIC datagrams (`Unreliable`) in scope?** **Recommended: no.** Fail
+  closed like the managed C# adapter; no consumer needs them.

dotnet-tools.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "dotnet-stryker": {
+      "version": "5.0.0",
+      "commands": [
+        "dotnet-stryker"
+      ],
+      "rollForward": false
+    }
+  }
+}

native/GameCult.Mesh.Quic.Native/CMakeLists.txt

@@ -1,20 +1,118 @@
 cmake_minimum_required(VERSION 3.24)
 project(gamecult_mesh_quic_native LANGUAGES CXX)
 
-if(NOT WIN32)
-  message(FATAL_ERROR "The current CultMesh native QUIC connector supports Windows desktop only")
-endif()
-if(NOT DEFINED MSQUIC_ROOT)
-  message(FATAL_ERROR "MSQUIC_ROOT must point at the extracted Microsoft.Native.Quic.MsQuic.Schannel package build/native directory")
+# Two platforms, one source. Windows takes MsQuic from the pinned OpenSSL NuGet
+# layout (MSQUIC_ROOT); Linux takes it from the extracted libmsquic deb, whose
+# headers and library land in unrelated places, so they are named separately.
+if(NOT WIN32 AND NOT (CMAKE_SYSTEM_NAME STREQUAL "Linux"))
+  message(FATAL_ERROR "The CultMesh native QUIC bridge supports Windows x64 and Linux x64")
 endif()
 
 add_library(gamecult_mesh_quic_native SHARED cultmesh_quic_native.cpp)
 target_compile_features(gamecult_mesh_quic_native PRIVATE cxx_std_20)
-target_compile_definitions(gamecult_mesh_quic_native PRIVATE GAMECULT_MESH_QUIC_NATIVE_EXPORTS WIN32_LEAN_AND_MEAN NOMINMAX)
-target_include_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_ROOT}/include")
-target_link_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_ROOT}/lib/x64")
-target_link_libraries(gamecult_mesh_quic_native PRIVATE msquic crypt32 bcrypt)
+# include/cultmesh_quic_native.h is the host-facing contract, not an internal
+# detail: the bridge includes it, and so does any consumer that can.
+target_include_directories(gamecult_mesh_quic_native PUBLIC include)
+
+if(WIN32)
+  if(NOT DEFINED MSQUIC_ROOT)
+    message(FATAL_ERROR "MSQUIC_ROOT must point at the extracted Microsoft.Native.Quic.MsQuic.OpenSSL package build/native directory")
+  endif()
+  # Static CRT. A Node or Unity host without the Visual C++ redistributable
+  # installed cannot load a DLL that imports vcruntime140.dll, and the failure
+  # arrives as "the specified module could not be found" with nothing naming the
+  # missing runtime. The bridge carries its own instead.
+  set_property(TARGET gamecult_mesh_quic_native PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
+  target_compile_definitions(gamecult_mesh_quic_native PRIVATE WIN32_LEAN_AND_MEAN NOMINMAX)
+  target_include_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_ROOT}/include")
+  target_link_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_ROOT}/lib/x64")
+  # crypt32 and bcrypt belong to the v1 shim alone: CryptHashCertificate2
+  # compares the Unity pin. Nothing in the v2 path needs them. ntdll carries
+  # RtlIpv4/6StringToAddressEx, which msquic_winuser.h's inline QuicAddrFromString
+  # calls to parse the listener host; the Linux header parses it in-tree instead.
+  target_link_libraries(gamecult_mesh_quic_native PRIVATE msquic crypt32 bcrypt ntdll)
+  # The DLL is committed beside its source, so a rebuild must reproduce it: /Brepro drops the link timestamps.
+  target_compile_options(gamecult_mesh_quic_native PRIVATE /Brepro)
+  target_link_options(gamecult_mesh_quic_native PRIVATE /Brepro)
+else()
+  if(NOT DEFINED MSQUIC_INCLUDE_DIR OR NOT DEFINED MSQUIC_LIB_DIR)
+    message(FATAL_ERROR "MSQUIC_INCLUDE_DIR and MSQUIC_LIB_DIR must point at the msquic v2.5.9 headers and the extracted libmsquic library directory")
+  endif()
+  target_include_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_INCLUDE_DIR}")
+  target_link_directories(gamecult_mesh_quic_native PRIVATE "${MSQUIC_LIB_DIR}")
+  target_link_libraries(gamecult_mesh_quic_native PRIVATE msquic pthread)
+  # Only the CULTMESH_API exports leave the .so; everything else stays internal.
+  target_compile_options(gamecult_mesh_quic_native PRIVATE -fvisibility=hidden -fvisibility-inlines-hidden)
+  # libmsquic.so.2 ships beside the bridge rather than being installed
+  # system-wide, so the loader is pointed at the bridge's own directory.
+  set_target_properties(gamecult_mesh_quic_native PROPERTIES
+    BUILD_WITH_INSTALL_RPATH TRUE
+    INSTALL_RPATH "$ORIGIN")
+endif()
 
 set_target_properties(gamecult_mesh_quic_native PROPERTIES
   OUTPUT_NAME "gamecult_mesh_quic_native"
-  RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
+  RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin"
+  LIBRARY_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
+
+# The runtime-lifetime scenarios. Off by default: the shipped artifact is the
+# library alone, and a delivery build has no business producing an executable.
+# CULTMESH_QUIC_DEBUG_ASSERTS goes with them, never into a shipped binary — it
+# makes the bridge state the quiesce invariant instead of leaving it to whatever
+# a sanitizer happens to catch.
+option(CULTMESH_QUIC_BUILD_TESTS "Build the runtime-lifetime scenario runner" OFF)
+option(CULTMESH_QUIC_DEBUG_ASSERTS "Abort the bridge on a violated internal invariant" OFF)
+
+if(CULTMESH_QUIC_DEBUG_ASSERTS)
+  target_compile_definitions(gamecult_mesh_quic_native PRIVATE CULTMESH_QUIC_DEBUG_ASSERTS)
+endif()
+
+if(CULTMESH_QUIC_BUILD_TESTS)
+  add_executable(cultmesh_quic_native_tests tests/cultmesh_quic_native_tests.cpp)
+  target_compile_features(cultmesh_quic_native_tests PRIVATE cxx_std_20)
+  # The header only. The scenarios drive the bridge as a host does, so they get
+  # no more of it than a host has.
+  target_link_libraries(cultmesh_quic_native_tests PRIVATE gamecult_mesh_quic_native)
+  # The scenarios see the development seam (section 7 of the header) exactly when
+  # the library has one, so `holdclose` compiles out of the same builds the
+  # bridge's own assertions compile out of.
+  if(CULTMESH_QUIC_DEBUG_ASSERTS)
+    target_compile_definitions(cultmesh_quic_native_tests PRIVATE CULTMESH_QUIC_DEBUG_ASSERTS)
+  endif()
+  set_target_properties(cultmesh_quic_native_tests PROPERTIES
+    RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
+  if(WIN32)
+    # gamecult_mesh_quic_native.dll imports msquic.dll, and the scenario
+    # runner loads it from its own directory (or PATH) at process start, not
+    # from MSQUIC_ROOT. build-quic-native.ps1's packaged output gets a copy
+    # from its own recipe; a test build has no packaging step, so without this
+    # the loader falls through to whatever msquic.dll happens to already be on
+    # PATH — silently running the scenarios against an unpinned, wrong-version
+    # MsQuic instead of failing to start. CMake already knows MSQUIC_ROOT, so
+    # it places the pinned DLL itself instead of leaving the reader to guess
+    # why a scenario passed against the wrong binary.
+    add_custom_command(TARGET cultmesh_quic_native_tests POST_BUILD
+      COMMAND ${CMAKE_COMMAND} -E copy
+        "${MSQUIC_ROOT}/bin/x64/msquic.dll"
+        "$<TARGET_FILE_DIR:cultmesh_quic_native_tests>/msquic.dll")
+  else()
+    target_link_libraries(cultmesh_quic_native_tests PRIVATE pthread)
+    # The linker resolves the bridge's own NEEDED libmsquic.so.2 while linking
+    # this executable, and the runtime copy only lands beside the binaries after
+    # the build; point it at the extracted package instead.
+    target_link_options(cultmesh_quic_native_tests PRIVATE "-Wl,-rpath-link,${MSQUIC_LIB_DIR}")
+    set_target_properties(cultmesh_quic_native_tests PROPERTIES
+      BUILD_WITH_INSTALL_RPATH TRUE
+      INSTALL_RPATH "$ORIGIN")
+    # Both binaries carry INSTALL_RPATH "$ORIGIN" and expect libmsquic.so.2
+    # beside them at load time. build-quic-native.sh's packaged output gets
+    # that copy from its own recipe; a test build has no packaging step, so
+    # the runner would otherwise die at once with "cannot open shared object
+    # file". CMake already knows where MSQUIC_LIB_DIR is, so it places the
+    # file itself instead of leaving the reader to run an extra cp by hand.
+    add_custom_command(TARGET cultmesh_quic_native_tests POST_BUILD
+      COMMAND ${CMAKE_COMMAND} -E copy
+        "${MSQUIC_LIB_DIR}/libmsquic.so.2"
+        "$<TARGET_FILE_DIR:cultmesh_quic_native_tests>/libmsquic.so.2")
+  endif()
+endif()

native/GameCult.Mesh.Quic.Native/README.md

@@ -1,10 +1,168 @@
 # GameCult.Mesh.Quic.Native
 
-This Windows desktop bridge keeps MsQuic's callback-heavy C API below the
-managed runtime boundary. It accepts a discovery-authorized SHA-256 certificate
-pin, negotiates `cultmesh-state-v1`, and emits complete CultMesh realtime frame
-payloads. It owns transport only; frame meaning remains in `GameCult.Mesh`.
+One MsQuic body for every CultMesh host that is not .NET: two roles (provider
+and consumer), two platforms (Windows x64 and Linux x64), and no callbacks
+across the host boundary.
 
-The build consumes Microsoft's pinned
-`Microsoft.Native.Quic.MsQuic.Schannel` package. It does not contain
-Aetheria-specific code.
+The bridge owns MsQuic registration, configuration, listener, connection and
+stream handles, TLS credential loading, the `cultmesh-state-v1` ALPN, the
+1-byte-kind plus 4-byte-LE-length QUIC stream framing, and one event queue per
+runtime. It owns transport and nothing else: it never decodes a CultMesh frame,
+never decides delivery semantics, never coalesces, never reconnects, and in the
+v2 path never decides whether to trust a certificate. Frame meaning stays in
+`GameCult.Mesh` and in the TypeScript codec; trust stays with the host.
+
+## No host callbacks
+
+Every crossing is the host calling in, including the one blocking wait. MsQuic's
+worker threads only ever push onto the queue and wake that wait, so no host
+runtime is called from a thread it does not own. That is what lets one binary
+serve a Node process through FFI and a Unity player through P/Invoke without
+either one's threading rules leaking into the other.
+
+It is also why nothing here includes a Node header, a Unity header, or a
+JavaScript engine: the bridge does not know what is on the other side.
+
+## Two ABIs
+
+**v2** is the runtime-neutral queue API, and the one new hosts should use. It is
+stated once, in [`include/cultmesh_quic_native.h`](include/cultmesh_quic_native.h):
+the 64-byte event struct with its field order and asserted offsets, the thirteen
+exports with their signatures, the id and return-code conventions, the object
+lifetime rules and the threading rules. That file is the contract. This README
+does not restate it, and where the two ever disagree the header is right.
+
+A host that can include it should. A host that cannot — koffi, Unity's
+P/Invoke — declares the same thing in its own FFI and is checked against the
+header by a test rather than by eye.
+
+Two things worth reading before writing a host, because they are easy to get
+wrong from the outside:
+
+- **Return codes are negative on a bad call, on every platform.** `-1` is a bad
+  call, `-2` a rejected argument, `<= -1000` a MsQuic refusal. `QUIC_STATUS`
+  itself is not portable — a negative HRESULT on Windows, a positive errno on
+  POSIX — so it never reaches a host; `cultmesh_quic_last_status` hands over the
+  raw value for diagnostics and nothing else.
+- **`cultmesh_quic_runtime_close` quiesces.** It marks the runtime closing, wakes
+  every blocked `cultmesh_quic_next_event`, and waits for every in-flight call to
+  return before it frees anything. No host call may begin after it starts.
+
+A client connection defers certificate validation: the bridge indicates the
+certificate, emits event 3 carrying the DER, and answers MsQuic only when the
+host calls `cultmesh_quic_connection_certificate_complete`. If the host never
+answers, MsQuic's 10-second handshake timeout closes the connection and event 4
+reports it. Providers load their certificate as PKCS12; the advertised
+`cert-sha256` pin is computed by the host from that same PKCS12, not here.
+
+**v1** is the five exports the shipped Unity package imports by name
+(`cultmesh_quic_open`, `_state`, `_poll`, `_error`, `_close`). They are Windows
+only, matching `CultMeshNativeQuicRealtimeTransport.CanConnect`, and are
+implemented on top of a private v2 runtime holding one connection. They decide
+nothing the v2 path does not, with one exception: a v1 connection carries a
+SHA-256 pin that is compared here, in C, because that is the contract the
+managed connector was built against. A v2 connection never carries one.
+
+## Building
+
+Windows x64, from the repo root:
+
+    powershell -File scripts/build-quic-native.ps1
+
+MsQuic comes from `Microsoft.Native.Quic.MsQuic.OpenSSL` 2.5.9, pinned twice: the
+NuGet zip by digest and size, and the `msquic.dll` inside it by digest and size,
+because the archive is what the download is checked against and the DLL is what
+actually ships beside the bridge. The OpenSSL flavour rather than Schannel
+because Schannel's MsQuic refuses `QUIC_CREDENTIAL_TYPE_CERTIFICATE_PKCS12`,
+which is the only credential type a provider has on both platforms.
+
+The build uses MSVC with `/Brepro` so that a build reproduces itself: the link
+timestamps are dropped, and building the same source twice gives the same bytes.
+It links the CRT statically (`/MT`), because a Node or Unity host without the
+Visual C++ redistributable cannot load a DLL that imports `vcruntime140.dll`,
+and the failure it reports names no missing runtime; the bridge carries its own.
+
+The committed Unity plugin
+(`unity/org.gamecult.cultlib/Runtime/Plugins/x86_64/gamecult_mesh_quic_native.dll`)
+is this build: 302,080 bytes, `/MT`, OpenSSL MsQuic, no CRT import. It replaced
+an older 40,448-byte build — before `/MT` and before the move off Schannel,
+still importing `VCRUNTIME140.dll` and `MSVCP140.dll` — at the CultLib 1.0.60 /
+Studio 1.4.0 release.
+
+Linux x64, on a Debian 13 host:
+
+    scripts/build-quic-native.sh
+
+MsQuic comes from Microsoft's Debian 13 pool as a pinned `.deb`, and the POSIX
+headers from the msquic source tree at the matching tag; all four downloads are
+verified by SHA-256. The bridge is linked with `-fvisibility=hidden` so only the
+v2 exports leave the `.so`, and with `RPATH $ORIGIN` so the `libmsquic.so.2`
+shipped beside it resolves without being installed system-wide.
+
+A Linux host still needs MsQuic's own runtime dependencies present:
+`libssl3t64`, `libnuma1`, `libxdp1`, `libnl-route-3-200`.
+
+The development loop for it is one committed image,
+[`scripts/quic-native-linux-dev.Dockerfile`](../../scripts/quic-native-linux-dev.Dockerfile),
+pinned to the same `debian:13` digest the release workflow builds in. It carries
+the toolchain, MsQuic's runtime dependencies, and `setarch`, because a
+sanitizer build of the runtime-lifetime scenarios needs `personality(ADDR_NO_RANDOMIZE)`
+and a container that cannot ask for that cannot run them:
+
+    docker build -t cultlib-quic-native-dev -f scripts/quic-native-linux-dev.Dockerfile scripts
+    docker run --rm --security-opt seccomp=unconfined -v "${PWD}:/src" -w /src cultlib-quic-native-dev bash -lc "
+      scripts/build-quic-native.sh
+      cmake -S native/GameCult.Mesh.Quic.Native -B artifacts/quic-native-tests/linux-x64 -G Ninja \
+        -DCMAKE_BUILD_TYPE=Release -DCULTMESH_QUIC_BUILD_TESTS=ON -DCULTMESH_QUIC_DEBUG_ASSERTS=ON \
+        -DMSQUIC_INCLUDE_DIR=\$(pwd)/artifacts/dependencies/msquic-linux-2.5.9/include \
+        -DMSQUIC_LIB_DIR=\$(pwd)/artifacts/dependencies/msquic-linux-2.5.9/package/usr/lib/x86_64-linux-gnu
+      cmake --build artifacts/quic-native-tests/linux-x64
+      for scenario in closerace holdclose holdtimeout polltimeout pollbusy pollhammer zerotimeout payloadfit latecall waitseam; do
+        setarch -R artifacts/quic-native-tests/linux-x64/bin/cultmesh_quic_native_tests \"\${scenario}\" || exit 1
+      done
+    "
+
+Both lines are run from the repository root, and the mount is that root wherever
+it is: `${PWD}` in PowerShell, `$(pwd)` in a POSIX shell. `MSQUIC_INCLUDE_DIR`
+and `MSQUIC_LIB_DIR` need `$(pwd)` too, even though the `cmake` invocation
+itself already runs from `/src`: CMake resolves a relative path passed as a
+cache variable against the CMakeLists.txt that consumes it
+(`native/GameCult.Mesh.Quic.Native`), not against the directory `cmake` was
+invoked from, so a bare `artifacts/...` here looks for the dependency one level
+too deep and fails the compile before it reaches the loader. The test target's
+own build now copies `libmsquic.so.2` from `MSQUIC_LIB_DIR` beside the built
+binaries, so nothing else here needs the packaged output directory `scripts/build-quic-native.sh`
+produces. `CULTMESH_QUIC_BUILD_TESTS`
+is off in the shipped configuration (see the CMakeLists.txt option comment); it
+turns on the scenario runner `tests/cultmesh_quic_native_tests.cpp` compiles into,
+and `CULTMESH_QUIC_DEBUG_ASSERTS` turns on both the bridge's internal invariant
+assertions and the four scenarios (`holdclose`, `latecall`, `holdtimeout`,
+`waitseam`) that need the development seam in section 7 of the header. Each
+scenario name is a positional argument to the built binary; run them individually
+to bisect a failure, or all ten as shown to cover the runtime-lifetime rules.
+
+A Windows clone made before `.gitattributes` kept shell scripts at LF still has
+`scripts/build-quic-native.sh` with carriage returns, and pulling does not fix
+it: the script's content did not change, so git neither rewrites it nor reports
+it modified. The container then dies at once on the interpreter `bash\r`. From
+the repository root, in either shell, this checks the script out again under the
+current attributes:
+
+    git rm --cached -q scripts/build-quic-native.sh; git checkout HEAD -- scripts/build-quic-native.sh
+
+`--security-opt seccomp=unconfined` is load-bearing, not caution. A
+ThreadSanitizer configuration needs the process's address space where it expects
+it, so a TSan run must be re-executed under `setarch -R`, which asks the kernel
+for `personality(ADDR_NO_RANDOMIZE)`. Docker's default seccomp profile denies
+that call. Without it ThreadSanitizer dies before `main` with "unexpected memory
+mapping" — a configuration that never starts, not a scenario that passed.
+
+A win32-x64 build of the scenario runner needs the checkout somewhere short —
+near a drive root rather than under a deep temporary directory. MSVC builds the
+bridge and its scenario runner through MSBuild, whose file tracker gives out on
+long paths, and the build then fails outright rather than naming the path as the
+cause.
+
+Where an artifact was built is part of what it is. The Linux binary is linked
+against Debian 13's glibc, so a build from anywhere else is a different artifact
+whatever the file name says.

native/GameCult.Mesh.Quic.Native/include/cultmesh_quic_native.h

@@ -0,0 +1,371 @@
+/* GameCult.Mesh.Quic.Native — C ABI v2, the runtime-neutral CultMesh QUIC bridge.
+ *
+ * This header is the contract. It is the single place the event layout, the
+ * exports, the id and return-code conventions, the object lifetime rules and the
+ * threading rules are stated; `cultmesh_quic_native.cpp` includes it, the README
+ * points at it, and a host that cannot include it (koffi, P/Invoke) declares the
+ * same thing in its own FFI and is checked against this file by a test.
+ *
+ * It is C. It includes nothing of MsQuic, nothing of Node, nothing of Unity, and
+ * nothing platform-specific: a host binds these twelve queue exports plus
+ * `cultmesh_quic_last_status` and needs no other build input.
+ *
+ * The v1 Unity exports (`cultmesh_quic_open`, `_state`, `_poll`, `_error`,
+ * `_close`) are deliberately not here. They are a Windows-only shim for a
+ * shipped managed connector, not a contract offered to new hosts.
+ */
+
+#ifndef CULTMESH_QUIC_NATIVE_H
+#define CULTMESH_QUIC_NATIVE_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#if defined(__cplusplus)
+#define CULTMESH_QUIC_STATIC_ASSERT(condition, message) static_assert(condition, message)
+#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
+#define CULTMESH_QUIC_STATIC_ASSERT(condition, message) _Static_assert(condition, message)
+#else
+#define CULTMESH_QUIC_STATIC_ASSERT(condition, message)
+#endif
+
+/* `CULTMESH_QUIC_BUILD` is defined by the bridge's own translation unit and by
+ * nothing else. A consumer gets plain declarations and links by name, which is
+ * what every host here does: all three load the library at runtime. */
+#if defined(CULTMESH_QUIC_BUILD)
+#  if defined(_WIN32)
+#    define CULTMESH_QUIC_API __declspec(dllexport)
+#  else
+#    define CULTMESH_QUIC_API __attribute__((visibility("default")))
+#  endif
+#else
+#  define CULTMESH_QUIC_API
+#endif
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+/* ---------------------------------------------------------------------------
+ * 1. The event
+ *
+ * Exactly 64 bytes, no implicit padding, field order below is the ABI. A host
+ * that reorders a field reads a different struct; the offsets are asserted here
+ * so a compiler that pads differently fails the build rather than the wire.
+ * --------------------------------------------------------------------------- */
+
+struct cultmesh_quic_event {
+    uint32_t type;           /* offset  0 — one of the cultmesh_quic_event_type values */
+    uint32_t stream_kind;    /* offset  4 — 1 reliable, 2 latest-only; 0 when not a stream event */
+    uint64_t listener_id;    /* offset  8 — 0 for an outbound connection */
+    uint64_t connection_id;  /* offset 16 */
+    uint64_t stream_id;      /* offset 24 */
+    uint64_t code;           /* offset 32 — meaning depends on `type`; see below */
+    int32_t  status;         /* offset 40 — the raw platform QUIC status, diagnostics only */
+    int32_t  payload_length; /* offset 44 — bytes written into the caller's payload buffer */
+    uint8_t  reserved[16];   /* offset 48 — zero today; do not read meaning into it */
+};
+
+CULTMESH_QUIC_STATIC_ASSERT(sizeof(struct cultmesh_quic_event) == 64,
+    "the event struct is a 64-byte ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, type) == 0,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, stream_kind) == 4,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, listener_id) == 8,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, connection_id) == 16,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, stream_id) == 24,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, code) == 32,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, status) == 40,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, payload_length) == 44,
+    "event field offsets are an ABI contract");
+CULTMESH_QUIC_STATIC_ASSERT(offsetof(struct cultmesh_quic_event, reserved) == 48,
+    "event field offsets are an ABI contract");
+
+enum cultmesh_quic_event_type {
+    /* A listener accepted an inbound connection. `listener_id`, `connection_id`. */
+    CULTMESH_QUIC_EVENT_LISTENER_NEW_CONNECTION = 1,
+    /* The handshake completed. `connection_id`. */
+    CULTMESH_QUIC_EVENT_CONNECTION_CONNECTED = 2,
+    /* Payload: the peer's DER certificate. The handshake is blocked until the
+     * host answers with `cultmesh_quic_connection_certificate_complete`. */
+    CULTMESH_QUIC_EVENT_CONNECTION_CERTIFICATE_RECEIVED = 3,
+    /* The connection is gone, whoever ended it, and its id no longer resolves.
+     * Payload: a UTF-8 reason. `code` is the QUIC application error code — the
+     * peer's when the peer ended it, and the code the host passed to
+     * `cultmesh_quic_connection_shutdown` when the host did. Emitted exactly
+     * once per connection id, including for the initiator of a local shutdown:
+     * every connection id's end is observable from the host that owns it. */
+    CULTMESH_QUIC_EVENT_CONNECTION_SHUTDOWN = 4,
+    /* An inbound stream's first byte named its kind. `stream_id`, `stream_kind`. */
+    CULTMESH_QUIC_EVENT_STREAM_STARTED = 5,
+    /* Payload: one whole encoded frame, the 4-byte length prefix stripped. */
+    CULTMESH_QUIC_EVENT_STREAM_FRAME = 6,
+    /* One per `cultmesh_quic_stream_send_frame` call that returned 0, and never
+     * for the bridge's own kind byte. `code` is a cultmesh_quic_send_result. */
+    CULTMESH_QUIC_EVENT_STREAM_SEND_COMPLETE = 7,
+    /* The stream is gone. `stream_id`, `stream_kind`. */
+    CULTMESH_QUIC_EVENT_STREAM_SHUTDOWN = 8,
+    /* The listener stopped. `listener_id`. */
+    CULTMESH_QUIC_EVENT_LISTENER_STOPPED = 9
+};
+
+/* The `code` of event 7. A canceled send is a send MsQuic released without
+ * putting on the wire — the stream was aborted or the connection ended under it.
+ * It is reported, not silently dropped. */
+enum cultmesh_quic_send_result {
+    CULTMESH_QUIC_SEND_COMPLETED = 0,
+    CULTMESH_QUIC_SEND_CANCELED = 1
+};
+
+/* The first byte of every CultMesh QUIC stream. */
+enum cultmesh_quic_stream_kind {
+    CULTMESH_QUIC_STREAM_RELIABLE = 1,
+    CULTMESH_QUIC_STREAM_LATEST_ONLY = 2
+};
+
+/* ---------------------------------------------------------------------------
+ * 2. Ids
+ *
+ * Listeners, connections and streams are named by `uint64_t` ids drawn from one
+ * per-runtime counter that starts at 1 and never repeats. 0 is never a valid id
+ * and is what an out parameter holds when a call fails. An id is the only thing
+ * a host ever holds: there is no host-visible pointer to a connection or stream,
+ * so a host cannot outlive an object it is naming. An id whose object is gone is
+ * a bad call (-1), not undefined behaviour.
+ * --------------------------------------------------------------------------- */
+
+/* ---------------------------------------------------------------------------
+ * 3. Return codes — negative on a bad call, on every platform
+ *
+ * Every int32_t-returning export returns:
+ *
+ *    0                        the call succeeded
+ *    1, 2                     `cultmesh_quic_next_event` only; see its comment
+ *   -1                        a bad call: a null handle, a null out parameter,
+ *                             or an id whose object is gone
+ *   -2                        an argument the bridge rejects on its own terms:
+ *                             an unknown stream kind, an oversized frame, a
+ *                             listener host that is not an IP literal
+ *   <= -1000                  MsQuic refused. The bridge code is
+ *                             -(1000 + (raw_status & 0xffff)); the raw
+ *                             platform status is available from
+ *                             `cultmesh_quic_last_status` and a sentence about
+ *                             it from `cultmesh_quic_last_error`.
+ *
+ * This mapping exists because `QUIC_STATUS` itself is not portable: it is a
+ * negative HRESULT on Windows and a positive errno on POSIX, so a host that
+ * checked for a negative value saw every Linux failure as success.
+ *
+ * What the mapping makes portable is the sign, and only the sign. A failure is
+ * negative everywhere, and that is what a host may branch on. The magnitude of a
+ * <= -1000 code is diagnostic and platform-specific: the same MsQuic failure
+ * carries different numbers on different platforms (a TLS error is -12032 on
+ * win32-x64 and -1126 on linux-x64; an ALPN already in use is -1009 against
+ * -1091), and the 16-bit mask can give two distinct statuses the same code
+ * (`QUIC_STATUS_USER_CANCELED` and `QUIC_STATUS_FILE_NOT_FOUND` are both -1002
+ * on Windows). Switching on a particular code is therefore not portable and not
+ * a reliable identification of the failure. Report it, log it, and read
+ * `cultmesh_quic_last_status` and `cultmesh_quic_last_error` beside it.
+ * --------------------------------------------------------------------------- */
+
+#define CULTMESH_QUIC_RESULT_BAD_CALL (-1)
+#define CULTMESH_QUIC_RESULT_BAD_ARGUMENT (-2)
+#define CULTMESH_QUIC_RESULT_MSQUIC_BASE (-1000)
+
+/* ---------------------------------------------------------------------------
+ * 4. Object lifetime — resolved from an id, kept alive across the call
+ *
+ * The bridge's objects are shared-owned. The runtime's maps hold one reference
+ * each; an export that names an id takes its own reference under the lock and
+ * holds it for the whole MsQuic call, so an object cannot be freed under a host
+ * thread that is using it. MsQuic's worker, on shutdown-complete, removes the
+ * map entry and drops the map's reference only — it never frees an object a host
+ * call is inside.
+ *
+ * The MsQuic handle follows the object: it is closed exactly once, by whichever
+ * holder drops the last reference (or by `cultmesh_quic_runtime_close`), under a
+ * one-shot exchange guard. A handle is therefore valid for as long as any holder
+ * has a reference to its object, which is the property the host thread needs. A
+ * stream holds a reference to its connection, so stream handles are always
+ * closed before the connection handle they belong to.
+ *
+ * `cultmesh_quic_runtime_close` quiesces before it tears anything down. It marks
+ * the runtime closing, wakes every blocked `cultmesh_quic_next_event`, and waits
+ * for every in-flight export to return before it closes a handle or frees a
+ * byte. No host call may begin after `cultmesh_quic_runtime_close` starts. That
+ * ordering is the host's, and it is a prohibition rather than a race the bridge
+ * arbitrates: once the close returns, the handle names freed memory, and a call
+ * made with it has nothing left to refuse it. A call that races the start of the
+ * close, while it is still running, is refused with -1 and touches nothing; that
+ * narrows one mis-ordering and does not make the prohibition optional.
+ * --------------------------------------------------------------------------- */
+
+/* ---------------------------------------------------------------------------
+ * 5. Threading
+ *
+ * There are no host callbacks. Every crossing is the host calling in.
+ *
+ *  - MsQuic's worker threads run inside this library only. They push events onto
+ *    the runtime's queue and wake the one blocking wait. No host code is ever
+ *    called from a thread the host does not own.
+ *  - `cultmesh_quic_next_event` is called from host threads, one or many. It is
+ *    the only blocking export. Concurrent callers each get a distinct event.
+ *  - Every other export may be called from any host thread at any time, except
+ *    during or after `cultmesh_quic_runtime_close`.
+ *  - `cultmesh_quic_runtime_close` is called once, from one thread, and
+ *    quiesces as described above.
+ * --------------------------------------------------------------------------- */
+
+/* ---------------------------------------------------------------------------
+ * 6. The exports
+ * --------------------------------------------------------------------------- */
+
+/* Opens a runtime: one MsQuic registration, one event queue. `app_name` may be
+ * null. `*out_runtime` is the opaque handle every other export takes. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_runtime_open(
+    const char* app_name, void** out_runtime);
+
+/* Quiesces, tears down and frees the runtime. Safe to call with null. After it
+ * returns, the handle is dead; see section 4 for the ordering rule. */
+CULTMESH_QUIC_API void cultmesh_quic_runtime_close(void* runtime);
+
+/* Opens a provider listener on `host`:`port` with a PKCS12 credential. `host`
+ * may be null or empty for any address, otherwise it must be an IP literal.
+ * `port` 0 binds an ephemeral port, which `*out_bound_port` reports. A failure
+ * leaves no listener behind and no id allocated to the host. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_listener_open(
+    void* runtime, const char* host, uint16_t port,
+    const uint8_t* pkcs12, int32_t pkcs12_length, const char* password,
+    uint64_t* out_listener_id, uint16_t* out_bound_port);
+
+/* Stops and closes a listener. Its accepted connections are not affected.
+ * Emits event 9. Unknown ids are ignored. */
+CULTMESH_QUIC_API void cultmesh_quic_listener_close(
+    void* runtime, uint64_t listener_id);
+
+/* Starts an outbound connection. Certificate validation is deferred: the host
+ * gets event 3 and must answer. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_connection_open(
+    void* runtime, const char* host, uint16_t port, uint64_t* out_connection_id);
+
+/* Answers event 3. `accept` non-zero continues the handshake; zero fails it with
+ * a bad-certificate alert. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_connection_certificate_complete(
+    void* runtime, uint64_t connection_id, int32_t accept);
+
+/* Ends a connection with a QUIC application error code. The initiator gets its
+ * own event 4 carrying `code`, as the peer does. Unknown ids are ignored. */
+CULTMESH_QUIC_API void cultmesh_quic_connection_shutdown(
+    void* runtime, uint64_t connection_id, uint64_t code);
+
+/* Opens an outbound unidirectional stream and puts `kind` on the wire as its
+ * first byte. That byte is the bridge's own and never produces an event 7. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_stream_open(
+    void* runtime, uint64_t connection_id, uint8_t kind, uint64_t* out_stream_id);
+
+/* Queues one whole encoded frame, length-prefixed by the bridge. A call that
+ * returns 0 produces exactly one event 7 later, completed or canceled. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_stream_send_frame(
+    void* runtime, uint64_t stream_id,
+    const uint8_t* encoded_frame, int32_t length, int32_t fin);
+
+/* Aborts a stream with a QUIC application error code. Unknown ids are ignored. */
+CULTMESH_QUIC_API void cultmesh_quic_stream_shutdown(
+    void* runtime, uint64_t stream_id, uint64_t code);
+
+/* The one blocking crossing.
+ *
+ *   0   nothing within `timeout_ms`. A poller already blocked here when
+ *       `cultmesh_quic_runtime_close` starts is woken and returns 0. A poll that
+ *       begins after the close starts is forbidden by section 4, and is not a
+ *       case this return code covers.
+ *   1   `*out_event` filled and up to `payload_capacity` payload bytes copied;
+ *       `*out_required` is the payload size
+ *   2   `payload_capacity` is too small. Nothing is consumed and nothing is
+ *       written to `*out_event`; `*out_required` is the size to allocate. Ask
+ *       again with a big enough buffer and the same event is delivered.
+ *  -1   a bad call, including a null `payload` with a non-zero
+ *       `payload_capacity`, which is a lie about the buffer and is refused
+ *       rather than treated as a discard.
+ *
+ * `payload` may be null when `payload_capacity` is 0: that is the two-phase
+ * poll's first ask. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_next_event(
+    void* runtime, int32_t timeout_ms, struct cultmesh_quic_event* out_event,
+    uint8_t* payload, int32_t payload_capacity, int32_t* out_required);
+
+/* The last error sentence, NUL-terminated, truncated to `capacity`. Returns the
+ * number of bytes written, or -1 on a bad call. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_last_error(
+    void* runtime, char* destination, int32_t capacity);
+
+/* The raw platform `QUIC_STATUS` behind the last <= -1000 return, as its own
+ * bits: a negative HRESULT on Windows, a positive errno on POSIX. Diagnostics
+ * only; what is portable about the return code is its sign, not its value. 0
+ * when nothing has failed. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_last_status(void* runtime);
+
+/* ---------------------------------------------------------------------------
+ * 7. The development seam
+ *
+ * Present only in a library configured with `CULTMESH_QUIC_DEBUG_ASSERTS`, which
+ * a shipped build never is. It exists for the runtime-lifetime scenarios: the
+ * quiesce is a promise about host calls that are inside the library, and the
+ * wait scenarios need the same kind of promise about the exact duration the
+ * bridge hands its own condition wait. A scenario that can only sleep and hope
+ * cannot tell a bridge that counts and waits correctly from one that does not.
+ *
+ * It is process-wide, not per-runtime, because the numbers outlive the runtime
+ * they describe: `cultmesh_quic_runtime_close` frees the runtime, and the count
+ * it waited on is read afterwards. The scenarios open one runtime at a time.
+ * --------------------------------------------------------------------------- */
+#if defined(CULTMESH_QUIC_DEBUG_ASSERTS)
+
+/* Non-zero arms the hold and resets both counters: every call that reaches the
+ * blocking wait in `cultmesh_quic_next_event` parks inside the library instead
+ * of returning. Zero releases every held call and disarms it. A held call
+ * returns 0 and touches the runtime no further. */
+CULTMESH_QUIC_API void cultmesh_quic_debug_hold_calls(int32_t hold);
+
+/* The high-water mark of host calls counted inside the library since the hold
+ * was armed. Zero means no call was ever counted. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_debug_peak_calls(void);
+
+/* How many host calls were counted inside the library when the last
+ * `cultmesh_quic_runtime_close` began its wait, or -1 if no close has begun one
+ * since the hold was armed. This is the number the wait exists for. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_debug_calls_at_close(void);
+
+/* The whole duration, in milliseconds, most recently handed to the condition
+ * wait inside `cultmesh_quic_next_event`, recorded at the point the wait is
+ * entered rather than observed from outside. A poll whose queue is not empty,
+ * or whose `timeout_ms` is not greater than zero, never enters that wait and
+ * leaves this unchanged. -1 until the first such wait, or after
+ * `cultmesh_quic_debug_reset_last_wait_ms` — tracked by a separate internal
+ * flag, not by -1 being stored here, so a wait that ever recorded exactly -1
+ * itself could not be confused with nothing having been recorded.
+ *
+ * This exists because a wall-clock probe cannot tell the host's timeout from
+ * any function of it that is the identity at the probe's own value — a floor,
+ * a round, a clamp, a later-poll fault, there is always another one that
+ * matches. This reads what the bridge actually handed its wait instead of
+ * inferring it from how long a call took. */
+CULTMESH_QUIC_API int32_t cultmesh_quic_debug_last_wait_ms(void);
+
+/* Resets the value `cultmesh_quic_debug_last_wait_ms` reports to -1, without
+ * touching the hold or the two call counters above. */
+CULTMESH_QUIC_API void cultmesh_quic_debug_reset_last_wait_ms(void);
+
+#endif /* CULTMESH_QUIC_DEBUG_ASSERTS */
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif /* CULTMESH_QUIC_NATIVE_H */

package-lock.json

@@ -489,6 +489,326 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@koromix/koffi-android-arm64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-android-arm64/-/koffi-android-arm64-3.3.0.tgz",
+      "integrity": "sha512-lHXE2mq+uG6CVeX1iepn2ATcAWMZPagr+J0ICYge7wTMDYc5pPRQMq0Rr/16775i6QlUqQqpk8c5Gu66+u3gGA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-android-x64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-android-x64/-/koffi-android-x64-3.3.0.tgz",
+      "integrity": "sha512-7EeVK/KS9XNbOsUfy0B3uuSjPQZenjJ35y9QSi6R6eK4Fv0oGvREQaBzIJRJwonxp7sJfGObnwnQTnKTVK2DWA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-darwin-arm64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-darwin-arm64/-/koffi-darwin-arm64-3.3.0.tgz",
+      "integrity": "sha512-2R9bihYmYFyRP98wRG2m5WQVKMONf7DoPJI8RkGCOUB2afOXJEVXFepiSKxBZGPml8i1USwAxMUwkzbJ5uMG1A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-darwin-x64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-darwin-x64/-/koffi-darwin-x64-3.3.0.tgz",
+      "integrity": "sha512-OecYCQfzhUx+XyAtatIHlk0jIz87wKNjtYvwlwgMwgaGQwO/TxFeReNo+s3167Rh1a9c8rUIOjq1jfzAPBxbKA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-freebsd-arm64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-freebsd-arm64/-/koffi-freebsd-arm64-3.3.0.tgz",
+      "integrity": "sha512-6ytHzV1DuyxTP5LtFmQ3imBk71j/F/Nb0Hcwhjcn35esnknm5rQbgRl6tNRldrkGnM4GIAJpsagooUBh1xAzYg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-freebsd-ia32": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-freebsd-ia32/-/koffi-freebsd-ia32-3.3.0.tgz",
+      "integrity": "sha512-hINo5z1Iz2u3Rx3oHfzcmi5A03gYAoYf4nCJJYaY0bb5IuGdIC7noQTyyI9YxfyTJgoqw3wKFWWYtvsAmEo9Hw==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-freebsd-x64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-freebsd-x64/-/koffi-freebsd-x64-3.3.0.tgz",
+      "integrity": "sha512-7XQYAZh828nW6+y3IdyUNdo2VbVHL5ZC8Qb+yqHrlDjTjVXSyGYZJHAyJZ5c7eSTTKBhtIMTX238rIsdexxrog==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-arm": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-arm/-/koffi-linux-arm-3.3.0.tgz",
+      "integrity": "sha512-NbahRKKKFkHoFN/ZpLY+w4F6eYSqV4KMN40PmjZ1xQjG/XjYb6PIYgE41c7/acAPxOYqujrcaI3B4BAgWYm5/A==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-arm64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-arm64/-/koffi-linux-arm64-3.3.0.tgz",
+      "integrity": "sha512-Eo/+wGeawGICzJkUlkzi/KerAJ6U1L/Hf7cnJKH7aGgCOY5RRnjUqXs/eL+UDpRcFHzGeUn+Fq+8q2VxYxvAfw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-ia32": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-ia32/-/koffi-linux-ia32-3.3.0.tgz",
+      "integrity": "sha512-u9tKuj42RFWJU8ZgZqcBhkFCkIZE/SE6oR1ljpukttJUhOVuaf/lmsWxyOxiVu3U8T1gtD658FlLgrbMVIn6aQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-loong64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-loong64/-/koffi-linux-loong64-3.3.0.tgz",
+      "integrity": "sha512-2hKlNZ6OXkTUp6fcueZcP0sQ6yhpdfANg9/mWxDKzT1o8qIj4qJD7UcZLCcRIC8JXiP8JQwZBtlPuyXIqofDQg==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-ppc64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-ppc64/-/koffi-linux-ppc64-3.3.0.tgz",
+      "integrity": "sha512-bIVAoHgzyRN7xs529BK7rF3BbZUTJgIr0t/wvBvAgaIpreKsdZ/QWxhedKRbTN7ljlDHkPZFmu5XcCjb/vqUag==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-riscv64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-riscv64/-/koffi-linux-riscv64-3.3.0.tgz",
+      "integrity": "sha512-2niYAe+TBXbvf7yog/aiHiDUrKQn+RkMSH5x3ZYo65OQyII1CY3Jk2kP3Pe735gq0LzIYJsDuGMW+02ighSadQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-linux-x64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-x64/-/koffi-linux-x64-3.3.0.tgz",
+      "integrity": "sha512-apU8ZMOrOh1eqMP/Pp0sDZ/WY6A4r6JWph26h63VM9nZ+5KCTYuPgojfoLPNvrfI/bn1PY3+bpXKRhZHI3gxbQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-openbsd-arm64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-openbsd-arm64/-/koffi-openbsd-arm64-3.3.0.tgz",
+      "integrity": "sha512-iTyHMCSSs+X579sWJv7XVFMp9gOfROI8IUEwp09YxJpGvmiSoipI0J7kytFuFq6dyuwO0Ymy4JdlmKnCM0qkxg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-openbsd-ia32": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-openbsd-ia32/-/koffi-openbsd-ia32-3.3.0.tgz",
+      "integrity": "sha512-xCvMV+4VNHjTxgVPEsBzU0k8dlA7aoFO5QjRF9lVU/NzGhUedlYvFgaF6IWsGOoWEaNt9hgP4KK/wxMbm9v8EQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-openbsd-x64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-openbsd-x64/-/koffi-openbsd-x64-3.3.0.tgz",
+      "integrity": "sha512-xItIwx1elM8k1pTudEfuV/1U2gQ06+rFfxCVXrZkyWYYGTzmA5To00f8garJFR+E9gbjQJbn8QDFvWMI+i2sMA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-win32-arm64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-win32-arm64/-/koffi-win32-arm64-3.3.0.tgz",
+      "integrity": "sha512-fD41LgKBx5i1YlJDuds4tRHAaG5vV55tvagzJwKFDR/5BDeaFvH9QFMUMDoNl2LkmVyeug0dIElHr/oxejh3IA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-win32-ia32": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-win32-ia32/-/koffi-win32-ia32-3.3.0.tgz",
+      "integrity": "sha512-BfDbDVEuQwPZOvWXawc3JT/7i9cN7QHYotgo014jjXb9pNv46Ykhb0RRglkcHg+SdytW/7pxYn18YwcQP6LLvQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
+    "node_modules/@koromix/koffi-win32-x64": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@koromix/koffi-win32-x64/-/koffi-win32-x64-3.3.0.tgz",
+      "integrity": "sha512-D+ORp73rTmvGVfq01+4uBmgVZqrPqU9N9xCZCfexaCDlVk0WQsaqid1dGsi6eScJuHt4Cp8s1i5/4CsecxFTKQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      }
+    },
     "node_modules/@msgpack/msgpack": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/@msgpack/msgpack/-/msgpack-3.1.3.tgz",
@@ -715,6 +1035,38 @@
       "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "license": "MIT"
     },
+    "node_modules/koffi": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/koffi/-/koffi-3.3.0.tgz",
+      "integrity": "sha512-UeyQtptuPeCP0BqKD+Q8ftTQhIUBHO7bXyK9DVIaW9hJSg0BrICm4K5N8Qtn7zKk20sb5vpnES9KBqVksM2kpQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://liberapay.com/Koromix"
+      },
+      "optionalDependencies": {
+        "@koromix/koffi-android-arm64": "3.3.0",
+        "@koromix/koffi-android-x64": "3.3.0",
+        "@koromix/koffi-darwin-arm64": "3.3.0",
+        "@koromix/koffi-darwin-x64": "3.3.0",
+        "@koromix/koffi-freebsd-arm64": "3.3.0",
+        "@koromix/koffi-freebsd-ia32": "3.3.0",
+        "@koromix/koffi-freebsd-x64": "3.3.0",
+        "@koromix/koffi-linux-arm": "3.3.0",
+        "@koromix/koffi-linux-arm64": "3.3.0",
+        "@koromix/koffi-linux-ia32": "3.3.0",
+        "@koromix/koffi-linux-loong64": "3.3.0",
+        "@koromix/koffi-linux-ppc64": "3.3.0",
+        "@koromix/koffi-linux-riscv64": "3.3.0",
+        "@koromix/koffi-linux-x64": "3.3.0",
+        "@koromix/koffi-openbsd-arm64": "3.3.0",
+        "@koromix/koffi-openbsd-ia32": "3.3.0",
+        "@koromix/koffi-openbsd-x64": "3.3.0",
+        "@koromix/koffi-win32-arm64": "3.3.0",
+        "@koromix/koffi-win32-ia32": "3.3.0",
+        "@koromix/koffi-win32-x64": "3.3.0"
+      }
+    },
     "node_modules/lodash": {
       "version": "4.18.1",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
@@ -867,7 +1219,8 @@
       "dependencies": {
         "@gamecult/cultcache-ts": "^0.14.0",
         "@msgpack/msgpack": "^3.1.2",
-        "cultnet-ts": "^0.2.0"
+        "cultnet-ts": "^0.2.0",
+        "koffi": "3.3.0"
       },
       "devDependencies": {
         "@types/node": "^24.0.0",

packages/cultmath/README.md

@@ -26,13 +26,13 @@ shader semantics.
   acceleration and semi-implicit Euler integration
 - `math` intrinsics: `radians`, `degrees`, `abs`, `floor`, `ceil`, `frac`,
   `min`, `max`, `clamp`, `saturate`, `lerp`, `step`, `smoothstep`, `dot`,
-  `cross`, `length`, `distance`, `normalize`, `reflect`, `csum`, exponential
+  `cross`, `length`, `distance`, `normalize`, `reflect`, `csum`, `erf`,
+  `erfinv` (scalar only), exponential
   `decay`/`damp`, intercept/segment helpers, Catmull-Rom, Bezier curves, and
   deterministic value-noise primitives
 - `shaders/CultMath.hlsl`, a canonical HLSL mirror include for shader-side
   parity. HLSL already owns `float2`, `float3`, and `float4`; the include
-  exposes `cultmath_*` functions for shared semantics, including CultMath's
-  safe `normalize` contract.
+  exposes `cultmath_*` functions for shared semantics HLSL does not provide.
 - `Voronoi.SampleTones`, a C# batch surface that calls the Rust
   `cultmath-core` native kernel when `cultmath_core` is available and falls back
   to the managed parity path otherwise.
@@ -59,7 +59,7 @@ float grain = math.value_noise_bicubic(math.float2(12.0f, 3.5f));
 ```hlsl
 #include "CultMath.hlsl"
 
-float3 normal = cultmath_normalize(float3(0.25, 1.0, -0.1));
+float3 normal = normalize(float3(0.25, 1.0, -0.1));
 float rim = cultmath_saturate(1.0 - dot(normal, float3(0.0, 0.0, -1.0)));
 float glow = cultmath_smoothstep(0.2, 1.0, rim);
 float grain = cultmath_value_noise_bicubic(float2(12.0, 3.5));

packages/cultmath/docs/design.md

@@ -52,7 +52,26 @@ That makes these HLSL rules, not options:
   operand returns the other (so `saturate(NaN)` is 0), `clamp(x, a, b)` is
   `min(max(x, a), b)`, and `saturate(x)` is `min(1, max(0, x))`, which maps -0
   to +0; `any`/`all` accept numeric vectors (a component is true when it is
-  not 0); `min`, `max`, and `abs` on int vectors return int vectors.
+  not 0); `min`, `max`, and `abs` on int vectors return int vectors; int
+  `clamp` is `IMin(IMax(x, a), b)`, so inverted bounds return `b`.
+- Same-size vector conversions (`intN(floatN)`, `floatN(intN)`, `boolN(floatN)`,
+  `boolN(intN)`, `floatN(boolN)`, `intN(boolN)`) exist as constructors and
+  `math` functions and follow dxc: float to int is `fptosi`, truncating toward
+  zero; numeric to bool is `!= 0` (`fcmp une`, so NaN is true); bool to numeric
+  is 0 or 1. DXIL leaves float-to-int undefined for NaN and out-of-range values,
+  and so does C#; CultMath does not pin them.
+- `normalize(x)` is `x * Rsqrt(Dot(x, x))`, which is how dxc lowers it, and
+  DXIL.rst defines `Rsqrt` as `1 / sqrt(src)`. A zero vector therefore
+  normalizes to NaN (`0 * inf`), and a NaN component makes every component NaN.
+  (The special-value table under `Rsqrt` in DXIL.rst is a copy of the `Round`
+  table and contradicts that definition, so CultMath follows the definition.)
+  `length` and `distance` are `Sqrt` of the summed squares, so a zero vector
+  gives 0. Callers that can meet zero-length vectors guard them before calling
+  `normalize`.
+- dxc demotes double `frac`, `exp`, `lerp`, and `floor` to float. CultMath's
+  double overloads keep double precision instead: `frac(double)` is
+  `x - floor(x)` in double. That is a deliberate divergence for CPU simulation
+  time, which shaders do not carry.
 
 dxc marks float arithmetic and compares `fast` (no NaNs) unless a value is
 `precise`, so drivers may optimize NaN handling away and NaN results on real
@@ -64,9 +83,7 @@ GPU. Because `min`, `max`, and `saturate` return the non-NaN operand, some
 functions turn NaN or infinity into numbers: `smoothstep(a, a, a)` is 0;
 infinite inputs to `smoothstep` and the intercept helpers give numbers; the
 bezier, `smoothstep01`, and `smootherstep` functions return finite values for
-NaN input; and `normalize((NaN, 2.41))` is `(NaN, 2.41e20)`, because the NaN
-length is clamped to the epsilon and the other component is divided by it.
-Callers that must detect bad data should check `isnan` before calling these
+NaN input. Callers that must detect bad data should check `isnan` before calling these
 functions.
 
 Deferred until a consumer needs them: `float4x4`, `transpose`, `determinant`,
@@ -103,9 +120,20 @@ compiled under `using static CultMath.math;`, so its intrinsics are C# `math`
 itself: the test proves the composition in the text, not the intrinsic rules,
 which only `HlslSemanticsTests` pins.
 
+Integer hashing uses the PCG hashes from Jarzynski and Olano, "Hash Functions
+for GPU Rendering" (JCGT 9(3), 2020): `pcg(uint)` is O'Neill's RXS-M-XS 32/32
+permutation over one LCG step, and `pcg3d`/`pcg4d` are the paper's (3 → 3) and
+(4 → 4) hashes. They use only uint multiply, add, xor, and shifts. dxc wraps
+uint multiply and add modulo 2^32 exactly as C# unchecked arithmetic does, so
+they are integer-exact in HLSL and on the CPU, GPU included, unlike the
+`sin`-based `hash`. CultMath has no uint vectors, so `pcg3d(int3)` and
+`pcg4d(int4)` carry uint bit patterns in int components. The `float2`/`float3`/`float4`
+overloads hash the IEEE-754 bits (`asuint`), so -0 and 0 hash differently.
+`pcg3d(float2)` holds z at 0, which is the paper's route for (2 → N) inputs.
+Seeds and other scalar uses take one output component.
+
 Where HLSL is silent, CultMath keeps its own decisions and does not defer to
-Unity.Mathematics: `normalize` is safe (divides by `max(length, 1e-20)`),
-`hash` returns float, and `Random` is CultMath's own xorshift32. Engine-shaped
+Unity.Mathematics: `hash` returns float, and `Random` is CultMath's own xorshift32. Engine-shaped
 helpers that HLSL lacks (`float2x2.Rotate`, `float3x3.Euler`, `quaternion`,
 `snoise`) enter only when a consumer needs them, with their semantics stated in
 code.

packages/cultmath/scripts/build-unity-package.ps1

@@ -27,6 +27,25 @@ if (Test-Path -LiteralPath $outputRoot) {
   Remove-Item -LiteralPath $outputRoot -Recurse -Force
 }
 
+# docs/semver-policy.md (CultLib root, two levels up from this script):
+# refuse to build a release whose CHANGELOG.md entry claims a breaking change
+# under too small a bump, or whose version skips or reverses the previous
+# published tag. Runs before the build below so a bad version number fails
+# fast. cultmath is pre-1.0 (0.y.z): a breaking change must be at least a
+# minor bump. $repoRoot above is this package's own root (packages\cultmath),
+# not CultLib's; the shared checker script lives one level above that.
+$cultLibRoot = Split-Path -Parent (Split-Path -Parent $repoRoot)
+$cultmathVersion = (Get-Content -LiteralPath (Join-Path $templateRoot "package.json") -Raw | ConvertFrom-Json).version
+& node (Join-Path $cultLibRoot "scripts\check-changelog-semver.mjs") `
+  --package "org.gamecult.cultmath" `
+  --changelog (Join-Path $templateRoot "CHANGELOG.md") `
+  --version $cultmathVersion `
+  --tag-prefix "cultmath-unity" `
+  --cwd $cultLibRoot
+if ($LASTEXITCODE -ne 0) {
+  throw "CultMath Unity package failed the semver policy check (see docs/semver-policy.md)."
+}
+
 # The tracked DLL and pdb are committed beside their source, so neither may name a commit: Source Link
 # writes the commit SHA into the pdb, and the DLL carries that pdb's content id.
 dotnet build $projectPath -c $Configuration -f netstandard2.1 -o $buildRoot --no-incremental `

packages/cultmath/shaders/CultMath.hlsl

@@ -11,7 +11,6 @@
 static const float CULTMATH_PI = 3.14159265358979323846;
 static const float CULTMATH_TAU = 6.28318530717958647692;
 static const float CULTMATH_HALF_PI = 1.57079632679489661923;
-static const float CULTMATH_NORMALIZE_EPSILON = 1.0e-20;
 
 float cultmath_radians(float degrees_value) { return degrees_value * (CULTMATH_PI / 180.0); }
 float cultmath_degrees(float radians_value) { return radians_value * (180.0 / CULTMATH_PI); }
@@ -171,10 +170,6 @@ float cultmath_distance(float2 left, float2 right) { return length(left - right)
 float cultmath_distance(float3 left, float3 right) { return length(left - right); }
 float cultmath_distance(float4 left, float4 right) { return length(left - right); }
 
-float2 cultmath_normalize(float2 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
-float3 cultmath_normalize(float3 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
-float4 cultmath_normalize(float4 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
-
 float2 cultmath_reflect(float2 incident, float2 normal_value)
 {
     return incident - 2.0 * dot(normal_value, incident) * normal_value;
@@ -286,6 +281,38 @@ float cultmath_hash(float value) { return cultmath_frac(sin(value) * 43758.5453)
 float cultmath_hash(float2 value) { return cultmath_hash(dot(value, float2(127.1, 311.7))); }
 float cultmath_hash(float3 value) { return cultmath_hash(dot(value, float3(127.1, 311.7, 74.7))); }
 
+// PCG hashes (Jarzynski and Olano, JCGT 2020), written over scalar uints so CultMath's int3/int4 carry the bits.
+uint cultmath_pcg(uint value)
+{
+    uint state = value * 747796405u + 2891336453u;
+    uint word = ((state >> (int)((state >> 28) + 4)) ^ state) * 277803737u;
+    return (word >> 22) ^ word;
+}
+
+int3 cultmath_pcg3d(int3 value)
+{
+    uint x = (uint)value.x * 1664525u + 1013904223u, y = (uint)value.y * 1664525u + 1013904223u, z = (uint)value.z * 1664525u + 1013904223u;
+    x += y * z; y += z * x; z += x * y;
+    x ^= x >> 16; y ^= y >> 16; z ^= z >> 16;
+    x += y * z; y += z * x; z += x * y;
+    return int3((int)x, (int)y, (int)z);
+}
+
+int3 cultmath_pcg3d(float2 value) { return cultmath_pcg3d(float3(value, 0.0)); }
+int3 cultmath_pcg3d(float3 value) { return cultmath_pcg3d(int3((int)asuint(value.x), (int)asuint(value.y), (int)asuint(value.z))); }
+
+int4 cultmath_pcg4d(int4 value)
+{
+    uint x = (uint)value.x * 1664525u + 1013904223u, y = (uint)value.y * 1664525u + 1013904223u;
+    uint z = (uint)value.z * 1664525u + 1013904223u, w = (uint)value.w * 1664525u + 1013904223u;
+    x += y * w; y += z * x; z += x * y; w += y * z;
+    x ^= x >> 16; y ^= y >> 16; z ^= z >> 16; w ^= w >> 16;
+    x += y * w; y += z * x; z += x * y; w += y * z;
+    return int4((int)x, (int)y, (int)z, (int)w);
+}
+
+int4 cultmath_pcg4d(float4 value) { return cultmath_pcg4d(int4((int)asuint(value.x), (int)asuint(value.y), (int)asuint(value.z), (int)asuint(value.w))); }
+
 float cultmath_value_noise(float2 position)
 {
     float2 cell = floor(position);

packages/cultmath/src/CultMath/CultMath.csproj

@@ -8,7 +8,7 @@
     <RootNamespace>CultMath</RootNamespace>
     <AssemblyName>CultMath</AssemblyName>
     <PackageId>GameCult.Math</PackageId>
-    <Version>0.2.0</Version>
+    <Version>0.2.4</Version>
     <Description>Clean-room C# math shaped for HLSL-style renderer code.</Description>
     <Authors>GameCult</Authors>
     <PackageReadmeFile>README.md</PackageReadmeFile>

packages/cultmath/src/CultMath/Swizzles.g.cs

@@ -7,6 +7,8 @@ namespace CultMath;
 public partial struct float2
 {
     public float2(float2 xy) : this(xy.x, xy.y) { }
+    public float2(int2 value) : this(value.x, value.y) { }
+    public float2(bool2 value) : this(value.x ? 1.0f : 0.0f, value.y ? 1.0f : 0.0f) { }
     public float r { readonly get => x; set => x = value; }
     public float g { readonly get => y; set => y = value; }
     public readonly float2 xx => new(x, x);
@@ -72,6 +74,8 @@ public partial struct float3
     public float3(float x, float2 yz) : this(x, yz.x, yz.y) { }
     public float3(float2 xy, float z) : this(xy.x, xy.y, z) { }
     public float3(float3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public float3(int3 value) : this(value.x, value.y, value.z) { }
+    public float3(bool3 value) : this(value.x ? 1.0f : 0.0f, value.y ? 1.0f : 0.0f, value.z ? 1.0f : 0.0f) { }
     public float r { readonly get => x; set => x = value; }
     public float g { readonly get => y; set => y = value; }
     public float b { readonly get => z; set => z = value; }
@@ -320,6 +324,8 @@ public partial struct float4
     public float4(float2 xy, float2 zw) : this(xy.x, xy.y, zw.x, zw.y) { }
     public float4(float3 xyz, float w) : this(xyz.x, xyz.y, xyz.z, w) { }
     public float4(float4 xyzw) : this(xyzw.x, xyzw.y, xyzw.z, xyzw.w) { }
+    public float4(int4 value) : this(value.x, value.y, value.z, value.w) { }
+    public float4(bool4 value) : this(value.x ? 1.0f : 0.0f, value.y ? 1.0f : 0.0f, value.z ? 1.0f : 0.0f, value.w ? 1.0f : 0.0f) { }
     public float r { readonly get => x; set => x = value; }
     public float g { readonly get => y; set => y = value; }
     public float b { readonly get => z; set => z = value; }
@@ -1001,6 +1007,8 @@ public partial struct float4
 public partial struct int2
 {
     public int2(int2 xy) : this(xy.x, xy.y) { }
+    public int2(float2 value) : this((int)value.x, (int)value.y) { }
+    public int2(bool2 value) : this(value.x ? 1 : 0, value.y ? 1 : 0) { }
     public int r { readonly get => x; set => x = value; }
     public int g { readonly get => y; set => y = value; }
     public readonly int2 xx => new(x, x);
@@ -1066,6 +1074,8 @@ public partial struct int3
     public int3(int x, int2 yz) : this(x, yz.x, yz.y) { }
     public int3(int2 xy, int z) : this(xy.x, xy.y, z) { }
     public int3(int3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public int3(float3 value) : this((int)value.x, (int)value.y, (int)value.z) { }
+    public int3(bool3 value) : this(value.x ? 1 : 0, value.y ? 1 : 0, value.z ? 1 : 0) { }
     public int r { readonly get => x; set => x = value; }
     public int g { readonly get => y; set => y = value; }
     public int b { readonly get => z; set => z = value; }
@@ -1314,6 +1324,8 @@ public partial struct int4
     public int4(int2 xy, int2 zw) : this(xy.x, xy.y, zw.x, zw.y) { }
     public int4(int3 xyz, int w) : this(xyz.x, xyz.y, xyz.z, w) { }
     public int4(int4 xyzw) : this(xyzw.x, xyzw.y, xyzw.z, xyzw.w) { }
+    public int4(float4 value) : this((int)value.x, (int)value.y, (int)value.z, (int)value.w) { }
+    public int4(bool4 value) : this(value.x ? 1 : 0, value.y ? 1 : 0, value.z ? 1 : 0, value.w ? 1 : 0) { }
     public int r { readonly get => x; set => x = value; }
     public int g { readonly get => y; set => y = value; }
     public int b { readonly get => z; set => z = value; }
@@ -1995,6 +2007,8 @@ public partial struct int4
 public partial struct bool2
 {
     public bool2(bool2 xy) : this(xy.x, xy.y) { }
+    public bool2(float2 value) : this(value.x != 0.0f, value.y != 0.0f) { }
+    public bool2(int2 value) : this(value.x != 0, value.y != 0) { }
     public bool r { readonly get => x; set => x = value; }
     public bool g { readonly get => y; set => y = value; }
     public readonly bool2 xx => new(x, x);
@@ -2060,6 +2074,8 @@ public partial struct bool3
     public bool3(bool x, bool2 yz) : this(x, yz.x, yz.y) { }
     public bool3(bool2 xy, bool z) : this(xy.x, xy.y, z) { }
     public bool3(bool3 xyz) : this(xyz.x, xyz.y, xyz.z) { }
+    public bool3(float3 value) : this(value.x != 0.0f, value.y != 0.0f, value.z != 0.0f) { }
+    public bool3(int3 value) : this(value.x != 0, value.y != 0, value.z != 0) { }
     public bool r { readonly get => x; set => x = value; }
     public bool g { readonly get => y; set => y = value; }
     public bool b { readonly get => z; set => z = value; }
@@ -2308,6 +2324,8 @@ public partial struct bool4
     public bool4(bool2 xy, bool2 zw) : this(xy.x, xy.y, zw.x, zw.y) { }
     public bool4(bool3 xyz, bool w) : this(xyz.x, xyz.y, xyz.z, w) { }
     public bool4(bool4 xyzw) : this(xyzw.x, xyzw.y, xyzw.z, xyzw.w) { }
+    public bool4(float4 value) : this(value.x != 0.0f, value.y != 0.0f, value.z != 0.0f, value.w != 0.0f) { }
+    public bool4(int4 value) : this(value.x != 0, value.y != 0, value.z != 0, value.w != 0) { }
     public bool r { readonly get => x; set => x = value; }
     public bool g { readonly get => y; set => y = value; }
     public bool b { readonly get => z; set => z = value; }
@@ -3102,9 +3120,15 @@ public partial struct double3
 public static partial class math
 {
     public static float2 float2(float2 xy) => new(xy);
+    public static float2 float2(int2 value) => new(value);
+    public static float2 float2(bool2 value) => new(value);
+    public static float2 float2(int value) => new(value, value);
     public static float3 float3(float x, float2 yz) => new(x, yz);
     public static float3 float3(float2 xy, float z) => new(xy, z);
     public static float3 float3(float3 xyz) => new(xyz);
+    public static float3 float3(int3 value) => new(value);
+    public static float3 float3(bool3 value) => new(value);
+    public static float3 float3(int value) => new(value, value, value);
     public static float4 float4(float x, float y, float2 zw) => new(x, y, zw);
     public static float4 float4(float x, float2 yz, float w) => new(x, yz, w);
     public static float4 float4(float x, float3 yzw) => new(x, yzw);
@@ -3112,10 +3136,17 @@ public static partial class math
     public static float4 float4(float2 xy, float2 zw) => new(xy, zw);
     public static float4 float4(float3 xyz, float w) => new(xyz, w);
     public static float4 float4(float4 xyzw) => new(xyzw);
+    public static float4 float4(int4 value) => new(value);
+    public static float4 float4(bool4 value) => new(value);
+    public static float4 float4(int value) => new(value, value, value, value);
     public static int2 int2(int2 xy) => new(xy);
+    public static int2 int2(float2 value) => new(value);
+    public static int2 int2(bool2 value) => new(value);
     public static int3 int3(int x, int2 yz) => new(x, yz);
     public static int3 int3(int2 xy, int z) => new(xy, z);
     public static int3 int3(int3 xyz) => new(xyz);
+    public static int3 int3(float3 value) => new(value);
+    public static int3 int3(bool3 value) => new(value);
     public static int4 int4(int x, int y, int2 zw) => new(x, y, zw);
     public static int4 int4(int x, int2 yz, int w) => new(x, yz, w);
     public static int4 int4(int x, int3 yzw) => new(x, yzw);
@@ -3123,10 +3154,16 @@ public static partial class math
     public static int4 int4(int2 xy, int2 zw) => new(xy, zw);
     public static int4 int4(int3 xyz, int w) => new(xyz, w);
     public static int4 int4(int4 xyzw) => new(xyzw);
+    public static int4 int4(float4 value) => new(value);
+    public static int4 int4(bool4 value) => new(value);
     public static bool2 bool2(bool2 xy) => new(xy);
+    public static bool2 bool2(float2 value) => new(value);
+    public static bool2 bool2(int2 value) => new(value);
     public static bool3 bool3(bool x, bool2 yz) => new(x, yz);
     public static bool3 bool3(bool2 xy, bool z) => new(xy, z);
     public static bool3 bool3(bool3 xyz) => new(xyz);
+    public static bool3 bool3(float3 value) => new(value);
+    public static bool3 bool3(int3 value) => new(value);
     public static bool4 bool4(bool x, bool y, bool2 zw) => new(x, y, zw);
     public static bool4 bool4(bool x, bool2 yz, bool w) => new(x, yz, w);
     public static bool4 bool4(bool x, bool3 yzw) => new(x, yzw);
@@ -3134,4 +3171,6 @@ public static partial class math
     public static bool4 bool4(bool2 xy, bool2 zw) => new(xy, zw);
     public static bool4 bool4(bool3 xyz, bool w) => new(xyz, w);
     public static bool4 bool4(bool4 xyzw) => new(xyzw);
+    public static bool4 bool4(float4 value) => new(value);
+    public static bool4 bool4(int4 value) => new(value);
 }

packages/cultmath/src/CultMath/math.cs

@@ -105,6 +105,9 @@ public static partial class math
     public static float2 frac(float2 value) => value - floor(value);
     public static float3 frac(float3 value) => value - floor(value);
     public static float4 frac(float4 value) => value - floor(value);
+    // dxc has no double Frc: it demotes to float, as it does for exp and lerp. CultMath's double
+    // overloads keep double precision instead, so frac(double) is x - floor(x) in double.
+    public static double frac(double value) => value - Math.Floor(value);
 
     // dxc lowers float min/max/clamp to DXIL FMin/FMax (saturate to Saturate, defined as FMin(1, FMax(0, x))).
     // DXIL.rst: FMin(a, b) is a < b ? a : b, FMax(a, b) is a >= b ? a : b, and a NaN operand returns the other.
@@ -130,6 +133,11 @@ public static partial class math
     public static float2 clamp(float2 value, float2 minimum, float2 maximum) => min(max(value, minimum), maximum);
     public static float3 clamp(float3 value, float3 minimum, float3 maximum) => min(max(value, minimum), maximum);
     public static float4 clamp(float4 value, float4 minimum, float4 maximum) => min(max(value, minimum), maximum);
+    // dxc lowers int clamp to IMin(IMax(x, a), b): inverted bounds return b rather than throwing like Math.Clamp.
+    public static int clamp(int value, int minimum, int maximum) => min(max(value, minimum), maximum);
+    public static int2 clamp(int2 value, int2 minimum, int2 maximum) => min(max(value, minimum), maximum);
+    public static int3 clamp(int3 value, int3 minimum, int3 maximum) => min(max(value, minimum), maximum);
+    public static int4 clamp(int4 value, int4 minimum, int4 maximum) => min(max(value, minimum), maximum);
 
     // DXIL Saturate is FMin(1, FMax(0, x)); that operand order, unlike clamp(x, 0, 1), maps -0 to +0.
     public static float saturate(float value) => min(1.0f, max(0.0f, value));
@@ -205,9 +213,10 @@ public static partial class math
     public static float distance(float3 left, float3 right) => length(left - right);
     public static float distance(float4 left, float4 right) => length(left - right);
 
-    public static float2 normalize(float2 value) => value / max(length(value), 1.0e-20f);
-    public static float3 normalize(float3 value) => value / max(length(value), 1.0e-20f);
-    public static float4 normalize(float4 value) => value / max(length(value), 1.0e-20f);
+    // dxc lowers normalize(x) to x * Rsqrt(Dot(x, x)), and DXIL Rsqrt is 1 / sqrt(src): a zero vector is 0 * inf = NaN.
+    public static float2 normalize(float2 value) => value * (1.0f / MathF.Sqrt(dot(value, value)));
+    public static float3 normalize(float3 value) => value * (1.0f / MathF.Sqrt(dot(value, value)));
+    public static float4 normalize(float4 value) => value * (1.0f / MathF.Sqrt(dot(value, value)));
     public static quaternion normalize(quaternion value)
     {
         var length = MathF.Sqrt(value.x * value.x + value.y * value.y + value.z * value.z + value.w * value.w);
@@ -373,6 +382,43 @@ public static partial class math
     public static float hash(float2 value) => hash(dot(value, new float2(127.1f, 311.7f)));
     public static float hash(float3 value) => hash(dot(value, new float3(127.1f, 311.7f, 74.7f)));
 
+    public static uint asuint(float value) => (uint)BitConverter.SingleToInt32Bits(value);
+
+    // PCG hashes from Jarzynski and Olano, "Hash Functions for GPU Rendering" (JCGT 9(3), 2020). Integer-only, so
+    // dxc and C# agree bit for bit. pcg3d/pcg4d carry uint bit patterns in int3/int4; float overloads hash IEEE bits.
+    public static uint pcg(uint value)
+    {
+        var state = value * 747796405u + 2891336453u;
+        var word = ((state >> (int)((state >> 28) + 4)) ^ state) * 277803737u;
+        return (word >> 22) ^ word;
+    }
+
+    public static int3 pcg3d(int3 value)
+    {
+        uint x = (uint)value.x * 1664525u + 1013904223u, y = (uint)value.y * 1664525u + 1013904223u, z = (uint)value.z * 1664525u + 1013904223u;
+        x += y * z; y += z * x; z += x * y;
+        x ^= x >> 16; y ^= y >> 16; z ^= z >> 16;
+        x += y * z; y += z * x; z += x * y;
+        return new int3((int)x, (int)y, (int)z);
+    }
+
+    // The paper hashes 2 -> N inputs through pcg3d with the unused component held constant.
+    public static int3 pcg3d(float2 value) => pcg3d(new float3(value, 0.0f));
+    public static int3 pcg3d(float3 value) => pcg3d(new int3((int)asuint(value.x), (int)asuint(value.y), (int)asuint(value.z)));
+
+    public static int4 pcg4d(int4 value)
+    {
+        uint x = (uint)value.x * 1664525u + 1013904223u, y = (uint)value.y * 1664525u + 1013904223u;
+        uint z = (uint)value.z * 1664525u + 1013904223u, w = (uint)value.w * 1664525u + 1013904223u;
+        x += y * w; y += z * x; z += x * y; w += y * z;
+        x ^= x >> 16; y ^= y >> 16; z ^= z >> 16; w ^= w >> 16;
+        x += y * w; y += z * x; z += x * y; w += y * z;
+        return new int4((int)x, (int)y, (int)z, (int)w);
+    }
+
+    public static int4 pcg4d(float4 value) =>
+        pcg4d(new int4((int)asuint(value.x), (int)asuint(value.y), (int)asuint(value.z), (int)asuint(value.w)));
+
     public static float log(float value) => MathF.Log(value);
     public static float2 log(float2 value) => new(log(value.x), log(value.y));
     public static float3 log(float3 value) => new(log(value.x), log(value.y), log(value.z));
@@ -475,6 +521,74 @@ public static partial class math
             a._m20 * b._m01 + a._m21 * b._m11 + a._m22 * b._m21,
             a._m20 * b._m02 + a._m21 * b._m12 + a._m22 * b._m22);
 
+    // Abramowitz & Stegun 7.1.26, a single-precision rational/exponential fit with a stated
+    // max absolute error of 1.5e-7. erf is odd, so only x >= 0 is fit and the sign is restored.
+    // Measured against an independent reference: worst absolute error 6.621e-7, inside the
+    // 2e-6 bar this package's tests pin.
+    public static float erf(float value)
+    {
+        const float p = 0.3275911f;
+        const float a1 = 0.254829592f;
+        const float a2 = -0.284496736f;
+        const float a3 = 1.421413741f;
+        const float a4 = -1.453152027f;
+        const float a5 = 1.061405429f;
+
+        var s = sign(value);
+        var x = abs(value);
+        var t = 1.0f / (1.0f + p * x);
+        var poly = ((((a5 * t + a4) * t + a3) * t + a2) * t + a1) * t;
+        var result = 1.0f - poly * exp(-x * x);
+        return s * result;
+    }
+
+    // Giles, "Approximating the erfinv function" (GPU Computing Gems, 2010): a single-precision
+    // minimax polynomial in two ranges of w = -ln((1-x)(1+x)), central and tail.
+    // Domain is [-1, 1]. Outside it, including +-infinity, the result is NaN (there is no real
+    // inverse). At the edges the mathematical limit is infinite: erfinv(1) = +infinity and
+    // erfinv(-1) = -infinity. The unguarded polynomial hits log(0) = -infinity at those edges and
+    // the tail branch's leading coefficient is negative, so it delivers the wrong sign; guard the
+    // edges explicitly instead of trusting the fit through the singularity.
+    // Measured against an independent reference: worst absolute error 5.066e-7, and the
+    // erf(erfinv(y)) round trip 6.109e-7 worst case, both inside the 2e-6 bar this package's
+    // tests pin.
+    public static float erfinv(float value)
+    {
+        if (value >= 1.0f) return value > 1.0f ? float.NaN : float.PositiveInfinity;
+        if (value <= -1.0f) return value < -1.0f ? float.NaN : float.NegativeInfinity;
+
+        var w = -log((1.0f - value) * (1.0f + value));
+        float p;
+        if (w < 5.0f)
+        {
+            w -= 2.5f;
+            p = 2.81022636e-08f;
+            p = 3.43273939e-07f + p * w;
+            p = -3.5233877e-06f + p * w;
+            p = -4.39150654e-06f + p * w;
+            p = 0.00021858087f + p * w;
+            p = -0.00125372503f + p * w;
+            p = -0.00417768164f + p * w;
+            p = 0.246640727f + p * w;
+            p = 1.50140941f + p * w;
+        }
+        else
+        {
+            w = sqrt(w) - 3.0f;
+            p = -0.000200214257f;
+            p = 0.000100950558f + p * w;
+            p = 0.00134934322f + p * w;
+            p = -0.00367342844f + p * w;
+            p = 0.00573950773f + p * w;
+            p = -0.0076224613f + p * w;
+            p = 0.00943887047f + p * w;
+            p = 1.00167406f + p * w;
+            p = 2.83297682f + p * w;
+        }
+
+        return p * value;
+    }
+
     // Ashima Arts / Ian McEwan 3D simplex noise (MIT), mirrored by cultmath_snoise(float3)
     // in shaders/CultMath.hlsl with the same float32 evaluation order.
     public static float snoise(float3 value)

packages/cultmath/tests/CultMath.Tests/BatchMathTests.cs

@@ -0,0 +1,427 @@
+using System;
+using CultMath;
+using Xunit;
+
+namespace CultMath.Tests;
+
+// Stryker's mtp baseline on hands/adopt-stryker found BatchMath undefended in three ways:
+// both existing tests used 2-3 particles while LaneCount >= 4, so the vector body never ran
+// and only the scalar tail executed; both held y at 0 for every particle, so every y-axis
+// mutation was invisible; and the guard branches (early return, negative deltaTime, length
+// mismatch) were never exercised. These tests read LaneCount at runtime, use
+// LaneCount * 3 + 1 particles (a non-empty vector body AND a non-empty remainder), give every
+// particle distinct nonzero x and y, and pin results against a scalar reference computed here
+// rather than by calling the code under test.
+public sealed class BatchMathTests
+{
+    private const float Tolerance = 1e-4f;
+
+    [Fact]
+    public void RadialFalloffMatchesScalarReferenceAcrossVectorBodyAndRemainder()
+    {
+        var lanes = BatchMath.LaneCount;
+        var count = lanes * 3 + 1;
+        Assert.True(count > lanes, "fixture must exceed one lane to exercise the vector body");
+        Assert.True((count % lanes) != 0, "fixture must leave a non-empty scalar remainder");
+
+        var px = new float[count];
+        var py = new float[count];
+        var ax = new float[count];
+        var ay = new float[count];
+        // Distinct, asymmetric per-particle values: x and y follow different formulas so an
+        // x/y swap mutation is observable, and no particle sits at the falloff center.
+        for (var i = 0; i < count; i++)
+        {
+            px[i] = i * 1.3f - 4.0f;
+            py[i] = i * -0.7f + 2.5f;
+        }
+
+        const float centerX = 3.0f;
+        const float centerY = -1.0f;
+        const float strength = 5.0f;
+        // Chosen so some particles fall inside the radius and some fall outside it, exercising
+        // both the ConditionalSelect(inRange, ...) vector path and the scalar "continue".
+        const float radius = 6.0f;
+
+        // The scalar remainder is exactly one particle (index count-1). The generator above puts
+        // it far outside the radius, which would leave any y-axis mutation in the scalar tail's
+        // "in range" arithmetic unobserved (the only remainder particle never reaches it). Pin it
+        // inside the radius with a nonzero, non-degenerate y offset instead.
+        px[count - 1] = centerX + 2.0f;
+        py[count - 1] = centerY + 1.5f;
+
+        BatchMath.AddRadialFalloffAcceleration2D(px, py, centerX, centerY, strength, radius, ax, ay);
+
+        var insideCount = 0;
+        var outsideCount = 0;
+        for (var i = 0; i < count; i++)
+        {
+            var dx = centerX - px[i];
+            var dy = centerY - py[i];
+            var distanceSquared = Math.Max(dx * dx + dy * dy, 1.0e-8f);
+            var distance = MathF.Sqrt(distanceSquared);
+
+            if (distance > radius)
+            {
+                outsideCount++;
+                Assert.Equal(0.0f, ax[i], Tolerance);
+                Assert.Equal(0.0f, ay[i], Tolerance);
+                continue;
+            }
+
+            insideCount++;
+            var falloff = Math.Max(0.0f, 1.0f - distance / radius);
+            var magnitude = strength * falloff;
+            var expectedAx = dx / distance * magnitude;
+            var expectedAy = dy / distance * magnitude;
+            Assert.Equal(expectedAx, ax[i], Tolerance);
+            Assert.Equal(expectedAy, ay[i], Tolerance);
+        }
+
+        Assert.True(insideCount > 0, "fixture must include particles inside the radius");
+        Assert.True(outsideCount > 0, "fixture must include particles outside the radius");
+    }
+
+    [Fact]
+    public void RadialFalloffAccumulatesOntoExistingAcceleration()
+    {
+        // Guards against a mutation that assigns instead of accumulating: seed a nonzero
+        // acceleration and confirm the falloff contribution is added to it, not overwritten.
+        var px = new[] { 0.0f };
+        var py = new[] { 0.0f };
+        var ax = new[] { 10.0f };
+        var ay = new[] { -20.0f };
+
+        BatchMath.AddRadialFalloffAcceleration2D(px, py, 1.0f, 0.0f, 4.0f, 8.0f, ax, ay);
+
+        var dx = 1.0f - 0.0f;
+        var dy = 0.0f - 0.0f;
+        var distance = MathF.Sqrt(dx * dx + dy * dy);
+        var falloff = Math.Max(0.0f, 1.0f - distance / 8.0f);
+        var magnitude = 4.0f * falloff;
+        Assert.Equal(10.0f + dx / distance * magnitude, ax[0], Tolerance);
+        Assert.Equal(-20.0f + dy / distance * magnitude, ay[0], Tolerance);
+    }
+
+    [Fact]
+    public void RadialFalloffValidatesEqualSpanLengths()
+    {
+        var px = new float[3];
+        var py = new float[2];
+        var ax = new float[3];
+        var ay = new float[3];
+
+        Assert.Throws<ArgumentException>(() =>
+            BatchMath.AddRadialFalloffAcceleration2D(px, py, 0.0f, 0.0f, 1.0f, 1.0f, ax, ay));
+    }
+
+    [Fact]
+    public void RadialFalloffIsNoOpWhenRadiusIsNonPositive()
+    {
+        var px = new[] { 1.0f, 2.0f };
+        var py = new[] { 3.0f, -4.0f };
+        var ax = new[] { 5.0f, 6.0f };
+        var ay = new[] { 7.0f, 8.0f };
+
+        BatchMath.AddRadialFalloffAcceleration2D(px, py, 0.0f, 0.0f, 9.0f, 0.0f, ax, ay);
+
+        Assert.Equal(new[] { 5.0f, 6.0f }, ax);
+        Assert.Equal(new[] { 7.0f, 8.0f }, ay);
+    }
+
+    [Fact]
+    public void RadialFalloffIsNoOpWhenStrengthIsZero()
+    {
+        var px = new[] { 1.0f, 2.0f };
+        var py = new[] { 3.0f, -4.0f };
+        var ax = new[] { 5.0f, 6.0f };
+        var ay = new[] { 7.0f, 8.0f };
+
+        BatchMath.AddRadialFalloffAcceleration2D(px, py, 0.0f, 0.0f, 0.0f, 10.0f, ax, ay);
+
+        Assert.Equal(new[] { 5.0f, 6.0f }, ax);
+        Assert.Equal(new[] { 7.0f, 8.0f }, ay);
+    }
+
+    [Fact]
+    public void RadialFalloffIsNoOpWhenSpansAreEmpty()
+    {
+        var px = Array.Empty<float>();
+        var py = Array.Empty<float>();
+        var ax = Array.Empty<float>();
+        var ay = Array.Empty<float>();
+
+        // Must not throw for a valid but degenerate zero-length batch.
+        BatchMath.AddRadialFalloffAcceleration2D(px, py, 0.0f, 0.0f, 1.0f, 1.0f, ax, ay);
+
+        Assert.Empty(ax);
+        Assert.Empty(ay);
+    }
+
+    [Fact]
+    public void EulerIntegrationMatchesScalarReferenceAcrossVectorBodyAndRemainder()
+    {
+        var lanes = BatchMath.LaneCount;
+        var count = lanes * 3 + 1;
+        Assert.True((count % lanes) != 0, "fixture must leave a non-empty scalar remainder");
+
+        const float deltaTime = 0.25f;
+        var dynamicMask = new float[count];
+        var px = new float[count];
+        var py = new float[count];
+        var vx = new float[count];
+        var vy = new float[count];
+        var ax = new float[count];
+        var ay = new float[count];
+
+        for (var i = 0; i < count; i++)
+        {
+            // Every third particle is frozen (mask 0) so the mask branch is exercised across
+            // both the vector body and the remainder, not only at the array's edges.
+            dynamicMask[i] = i % 3 == 0 ? 0.0f : 1.0f;
+            px[i] = i * 0.4f - 1.0f;
+            py[i] = i * -0.6f + 3.0f;
+            vx[i] = i * 0.2f + 1.0f;
+            vy[i] = i * -0.3f - 2.0f;
+            ax[i] = i * 0.5f - 2.5f;
+            ay[i] = i * -0.9f + 1.5f;
+        }
+
+        // The scalar remainder is exactly one particle (index count-1). The mask pattern above
+        // would leave it frozen for lane counts divisible by 3, which masks every y-axis (and
+        // x-axis) mutation in the scalar tail's arithmetic to zero regardless of the mutation.
+        // Force it dynamic so the remainder actually exercises the scalar tail's math.
+        dynamicMask[count - 1] = 1.0f;
+
+        // Independent copies for the scalar reference; the arrays under test are mutated in place.
+        var expectedPx = (float[])px.Clone();
+        var expectedPy = (float[])py.Clone();
+        var expectedVx = (float[])vx.Clone();
+        var expectedVy = (float[])vy.Clone();
+
+        BatchMath.IntegrateSemiImplicitEuler2D(deltaTime, dynamicMask, px, py, vx, vy, ax, ay);
+
+        var anyFrozen = false;
+        var anyMoving = false;
+        for (var i = 0; i < count; i++)
+        {
+            var mask = dynamicMask[i];
+            expectedVx[i] += ax[i] * deltaTime * mask;
+            expectedVy[i] += ay[i] * deltaTime * mask;
+            expectedPx[i] += expectedVx[i] * deltaTime * mask;
+            expectedPy[i] += expectedVy[i] * deltaTime * mask;
+
+            if (mask == 0.0f) anyFrozen = true; else anyMoving = true;
+
+            Assert.Equal(expectedVx[i], vx[i], Tolerance);
+            Assert.Equal(expectedVy[i], vy[i], Tolerance);
+            Assert.Equal(expectedPx[i], px[i], Tolerance);
+            Assert.Equal(expectedPy[i], py[i], Tolerance);
+        }
+
+        Assert.True(anyFrozen, "fixture must include masked-off (frozen) particles");
+        Assert.True(anyMoving, "fixture must include dynamic particles");
+    }
+
+    [Fact]
+    public void EulerIntegrationRejectsNonPositiveDeltaTime()
+    {
+        var dynamicMask = new[] { 1.0f };
+        var px = new[] { 0.0f };
+        var py = new[] { 0.0f };
+        var vx = new[] { 0.0f };
+        var vy = new[] { 0.0f };
+        var ax = new[] { 0.0f };
+        var ay = new[] { 0.0f };
+
+        Assert.Throws<ArgumentOutOfRangeException>(() =>
+            BatchMath.IntegrateSemiImplicitEuler2D(0.0f, dynamicMask, px, py, vx, vy, ax, ay));
+        Assert.Throws<ArgumentOutOfRangeException>(() =>
+            BatchMath.IntegrateSemiImplicitEuler2D(-1.0f, dynamicMask, px, py, vx, vy, ax, ay));
+    }
+
+    [Fact]
+    public void EulerIntegrationValidatesEqualSpanLengths()
+    {
+        var dynamicMask = new float[3];
+        var px = new float[3];
+        var py = new float[3];
+        var vx = new float[2];
+        var vy = new float[3];
+        var ax = new float[3];
+        var ay = new float[3];
+
+        Assert.Throws<ArgumentException>(() =>
+            BatchMath.IntegrateSemiImplicitEuler2D(0.5f, dynamicMask, px, py, vx, vy, ax, ay));
+    }
+
+    [Fact]
+    public void Float2RadialFalloffMatchesScalarReferenceWithNonzeroYAndOutOfRangeParticles()
+    {
+        var count = 5;
+        var positions = new float2[count];
+        for (var i = 0; i < count; i++)
+        {
+            positions[i] = new float2(i * 1.1f - 2.0f, i * -0.8f + 1.0f);
+        }
+
+        var center = new float2(1.5f, -0.5f);
+        const float strength = 3.0f;
+        const float radius = 3.0f;
+        var acceleration = new float2[count];
+
+        BatchMath.AddRadialFalloffAcceleration2D(positions, center, strength, radius, acceleration);
+
+        var insideCount = 0;
+        var outsideCount = 0;
+        for (var i = 0; i < count; i++)
+        {
+            var delta = center - positions[i];
+            var distanceSquared = Math.Max(delta.x * delta.x + delta.y * delta.y, 1.0e-8f);
+            var distance = MathF.Sqrt(distanceSquared);
+
+            if (distance > radius)
+            {
+                outsideCount++;
+                Assert.Equal(0.0f, acceleration[i].x, Tolerance);
+                Assert.Equal(0.0f, acceleration[i].y, Tolerance);
+                continue;
+            }
+
+            insideCount++;
+            var falloff = Math.Max(0.0f, 1.0f - distance / radius);
+            var expected = delta / distance * (strength * falloff);
+            Assert.Equal(expected.x, acceleration[i].x, Tolerance);
+            Assert.Equal(expected.y, acceleration[i].y, Tolerance);
+        }
+
+        Assert.True(insideCount > 0, "fixture must include particles inside the radius");
+        Assert.True(outsideCount > 0, "fixture must include particles outside the radius");
+    }
+
+    [Fact]
+    public void Float2RadialFalloffAccumulatesOntoExistingAcceleration()
+    {
+        // Guards against a mutation that assigns instead of accumulating (BatchMath.cs:115):
+        // seed a nonzero, per-element-distinct acceleration and confirm the falloff
+        // contribution is added to it, not overwritten. An out-of-range particle must be left
+        // exactly at its seed value, not reset to zero.
+        var count = 5;
+        var positions = new float2[count];
+        var seedAcceleration = new float2[count];
+        for (var i = 0; i < count; i++)
+        {
+            positions[i] = new float2(i * 1.1f - 2.0f, i * -0.8f + 1.0f);
+            seedAcceleration[i] = new float2(i * 2.3f + 4.0f, i * -1.7f - 6.0f);
+        }
+
+        var center = new float2(1.5f, -0.5f);
+        const float strength = 3.0f;
+        const float radius = 3.0f;
+        var acceleration = (float2[])seedAcceleration.Clone();
+
+        BatchMath.AddRadialFalloffAcceleration2D(positions, center, strength, radius, acceleration);
+
+        var insideCount = 0;
+        var outsideCount = 0;
+        for (var i = 0; i < count; i++)
+        {
+            var delta = center - positions[i];
+            var distanceSquared = Math.Max(delta.x * delta.x + delta.y * delta.y, 1.0e-8f);
+            var distance = MathF.Sqrt(distanceSquared);
+
+            if (distance > radius)
+            {
+                outsideCount++;
+                Assert.Equal(seedAcceleration[i].x, acceleration[i].x, Tolerance);
+                Assert.Equal(seedAcceleration[i].y, acceleration[i].y, Tolerance);
+                continue;
+            }
+
+            insideCount++;
+            var falloff = Math.Max(0.0f, 1.0f - distance / radius);
+            var contribution = delta / distance * (strength * falloff);
+            Assert.Equal(seedAcceleration[i].x + contribution.x, acceleration[i].x, Tolerance);
+            Assert.Equal(seedAcceleration[i].y + contribution.y, acceleration[i].y, Tolerance);
+        }
+
+        Assert.True(insideCount > 0, "fixture must include particles inside the radius");
+        Assert.True(outsideCount > 0, "fixture must include particles outside the radius");
+    }
+
+    [Fact]
+    public void Float2EulerIntegrationMatchesScalarReferenceWithNonzeroYAndMask()
+    {
+        const float deltaTime = 0.2f;
+        var dynamicMask = new[] { 1.0f, 0.0f, 1.0f };
+        var position = new[] { new float2(0.0f, 0.0f), new float2(1.0f, 1.0f), new float2(-2.0f, 3.0f) };
+        var velocity = new[] { new float2(1.0f, -1.0f), new float2(2.0f, 2.0f), new float2(-1.0f, 0.5f) };
+        var acceleration = new[] { new float2(0.5f, 1.5f), new float2(3.0f, -3.0f), new float2(2.0f, -0.5f) };
+
+        var expectedPosition = (float2[])position.Clone();
+        var expectedVelocity = (float2[])velocity.Clone();
+
+        BatchMath.IntegrateSemiImplicitEuler2D(deltaTime, dynamicMask, position, velocity, acceleration);
+
+        for (var i = 0; i < position.Length; i++)
+        {
+            var mask = dynamicMask[i];
+            expectedVelocity[i] += acceleration[i] * deltaTime * mask;
+            expectedPosition[i] += expectedVelocity[i] * deltaTime * mask;
+
+            Assert.Equal(expectedVelocity[i].x, velocity[i].x, Tolerance);
+            Assert.Equal(expectedVelocity[i].y, velocity[i].y, Tolerance);
+            Assert.Equal(expectedPosition[i].x, position[i].x, Tolerance);
+            Assert.Equal(expectedPosition[i].y, position[i].y, Tolerance);
+        }
+    }
+
+    [Fact]
+    public void Float2EulerIntegrationRejectsNonPositiveDeltaTime()
+    {
+        var dynamicMask = new[] { 1.0f };
+        var position = new[] { float2.zero };
+        var velocity = new[] { float2.zero };
+        var acceleration = new[] { float2.zero };
+
+        Assert.Throws<ArgumentOutOfRangeException>(() =>
+            BatchMath.IntegrateSemiImplicitEuler2D(0.0f, dynamicMask, position, velocity, acceleration));
+    }
+
+    [Fact]
+    public void Float2EulerIntegrationValidatesEqualSpanLengths()
+    {
+        var dynamicMask = new float[3];
+        var position = new float2[3];
+        var velocity = new float2[2];
+        var acceleration = new float2[3];
+
+        Assert.Throws<ArgumentException>(() =>
+            BatchMath.IntegrateSemiImplicitEuler2D(0.5f, dynamicMask, position, velocity, acceleration));
+    }
+
+    [Fact]
+    public void Float2RadialFalloffValidatesEqualSpanLengths()
+    {
+        var positions = new float2[3];
+        var acceleration = new float2[2];
+
+        Assert.Throws<ArgumentException>(() =>
+            BatchMath.AddRadialFalloffAcceleration2D(positions, float2.zero, 1.0f, 1.0f, acceleration));
+    }
+
+    [Fact]
+    public void Float2RadialFalloffIsNoOpWhenRadiusIsNonPositiveOrStrengthIsZero()
+    {
+        var positions = new[] { new float2(1.0f, 3.0f), new float2(2.0f, -4.0f) };
+        var acceleration = new[] { new float2(5.0f, 7.0f), new float2(6.0f, 8.0f) };
+
+        BatchMath.AddRadialFalloffAcceleration2D(positions, float2.zero, 9.0f, 0.0f, acceleration);
+        Assert.Equal(new float2(5.0f, 7.0f), acceleration[0]);
+        Assert.Equal(new float2(6.0f, 8.0f), acceleration[1]);
+
+        BatchMath.AddRadialFalloffAcceleration2D(positions, float2.zero, 0.0f, 10.0f, acceleration);
+        Assert.Equal(new float2(5.0f, 7.0f), acceleration[0]);
+        Assert.Equal(new float2(6.0f, 8.0f), acceleration[1]);
+    }
+}

packages/cultmath/tests/CultMath.Tests/FirstOrderInterceptTests.cs

@@ -0,0 +1,182 @@
+using CultMath;
+using Xunit;
+
+namespace CultMath.Tests;
+
+// math.first_order_intercept_time / first_order_intercept had one happy-path test before this
+// (MathTests.FirstOrderInterceptSolvesSimpleClosingTarget). Stryker's baseline on
+// hands/adopt-stryker found L264 (zero relative velocity), L270 (the a-approx-zero linear
+// fallback), L280/L283 (the quadratic determinant and its roots) and L285 (the t1>0 branch)
+// all undefended by fixtures that never varied relative velocity, never went linear, never
+// lacked a solution, and never used off-axis/off-origin shooter and target state.
+//
+// For the closing cases (a genuine positive root exists), the assertion is behavioural: the
+// returned aim point, fired at shotSpeed from a moving shooter, and the target's own motion
+// must put the shot and the target at the same place at the returned time. That is verified by
+// computing both positions independently in the test from math.first_order_intercept's own
+// contract (targetPosition + time * targetRelativeVelocity is the aim point; the shot's actual
+// world position folds in the shooter's velocity), not by re-deriving a second copy of the
+// production formula.
+//
+// For the no-solution branches, there is no physical coincidence to check (the fallback is not
+// a root of the intercept equation), so the assertion instead pins the contract read directly
+// from the source at math.cs:264-298: velocitySquared < 0.001 => 0; determinant < 0 => 0;
+// determinant > 0 with both roots <= 0 => 0 (via max(t2, 0)).
+public sealed class FirstOrderInterceptTests
+{
+    private const int Precision = 4;
+
+    [Fact]
+    public void ZeroRelativeVelocityReturnsZeroTime()
+    {
+        // Target and shooter share a velocity: targetRelativeVelocity is exactly zero, well
+        // under the 0.001 lengthsq guard, regardless of either party's absolute speed.
+        var time = math.first_order_intercept_time(
+            shotSpeed: 50.0f,
+            targetRelativePosition: new float3(12.0f, -7.0f, 3.0f),
+            targetRelativeVelocity: float3.zero);
+
+        Assert.Equal(0.0f, time);
+
+        var aimPoint = math.first_order_intercept(
+            shooterPosition: new float3(1.0f, 2.0f, 3.0f),
+            shooterVelocity: new float3(4.0f, 4.0f, 4.0f),
+            shotSpeed: 50.0f,
+            targetPosition: new float3(13.0f, -5.0f, 6.0f),
+            targetVelocity: new float3(4.0f, 4.0f, 4.0f));
+
+        // Contract: with time 0, the aim point is exactly the target's current position.
+        Assert.Equal(13.0f, aimPoint.x, Precision);
+        Assert.Equal(-5.0f, aimPoint.y, Precision);
+        Assert.Equal(6.0f, aimPoint.z, Precision);
+    }
+
+    [Fact]
+    public void LinearFallbackWhenRelativeSpeedMatchesShotSpeedProducesPhysicalIntercept()
+    {
+        // velocitySquared == shotSpeed*shotSpeed makes a == 0 (|a| < 0.001), forcing the
+        // linear branch: time = -lengthsq(pos) / (2 * dot(vel, pos)), clamped to >= 0.
+        var shooterPosition = new float3(2.0f, -3.0f, 1.0f);
+        var shooterVelocity = new float3(1.0f, 0.5f, -0.5f);
+        var targetRelativePosition = new float3(10.0f, 0.0f, 0.0f);
+        var targetRelativeVelocity = new float3(-2.0f, 0.0f, 0.0f);
+        const float shotSpeed = 2.0f; // |targetRelativeVelocity| == 2 == shotSpeed => a == 0
+
+        var time = math.first_order_intercept_time(shotSpeed, targetRelativePosition, targetRelativeVelocity);
+
+        // -100 / (2 * -20) = 2.5, computed independently of the production formula's code path.
+        Assert.Equal(2.5f, time, Precision);
+
+        var targetPosition = shooterPosition + targetRelativePosition;
+        var targetVelocity = shooterVelocity + targetRelativeVelocity;
+
+        var aimPoint = math.first_order_intercept(shooterPosition, shooterVelocity, shotSpeed, targetPosition, targetVelocity);
+        AssertShotAndTargetCoincideAtTime(shooterPosition, shooterVelocity, shotSpeed, aimPoint, targetPosition, targetVelocity, time);
+    }
+
+    [Fact]
+    public void NegativeDeterminantReturnsZeroWhenTargetOutrunsTheProjectile()
+    {
+        // Target moving fast and mostly sideways, with a slow shot, so no real root of the
+        // intercept quadratic exists. b = 2*dot(vel, pos) is deliberately nonzero (-40): if it
+        // were 0, a mutant that drops the "determinant < 0" branch entirely and falls through to
+        // `max(-b / (2a), 0)` would coincidentally also compute 0 and this test would not
+        // distinguish the two.
+        var time = math.first_order_intercept_time(
+            shotSpeed: 1.0f,
+            targetRelativePosition: new float3(10.0f, 0.0f, 0.0f),
+            targetRelativeVelocity: new float3(-2.0f, 30.0f, 0.0f));
+
+        Assert.Equal(0.0f, time);
+    }
+
+    [Fact]
+    public void BothQuadraticRootsPositiveReturnsTheEarlierOne()
+    {
+        // velocitySquared > shotSpeed*shotSpeed (a > 0): the target is relatively faster than
+        // the shot, but closing almost head-on, so both quadratic roots are real and positive
+        // (lengthsq(pos) >= 0 forces same-signed roots whenever a > 0). This is the only shape
+        // that reaches the `t1 > 0` branch's `t2 > 0 ? min(t1, t2) : t1` line at all; every other
+        // fixture in this file keeps t1 <= 0.
+        var shooterPosition = new float3(4.0f, -2.0f, 1.0f);
+        var shooterVelocity = new float3(0.5f, -0.5f, 0.0f);
+        var shotSpeed = 5.0f;
+        var targetRelativePosition = new float3(10.0f, 0.0f, 0.0f);
+        var targetRelativeVelocity = new float3(-20.0f, 0.0f, 0.0f);
+
+        var time = math.first_order_intercept_time(shotSpeed, targetRelativePosition, targetRelativeVelocity);
+
+        // a = 400 - 25 = 375, b = -400, c = 100, determinant = 10000, root = 100:
+        // t1 = (400 + 100) / 750 = 0.6667, t2 = (400 - 100) / 750 = 0.4. Both positive; the
+        // earlier one (0.4) is the physically correct intercept time.
+        Assert.Equal(0.4f, time, Precision);
+
+        var targetPosition = shooterPosition + targetRelativePosition;
+        var targetVelocity = shooterVelocity + targetRelativeVelocity;
+        var aimPoint = math.first_order_intercept(shooterPosition, shooterVelocity, shotSpeed, targetPosition, targetVelocity);
+        AssertShotAndTargetCoincideAtTime(shooterPosition, shooterVelocity, shotSpeed, aimPoint, targetPosition, targetVelocity, time);
+    }
+
+    [Fact]
+    public void RecedingTargetWithBothRootsNonPositiveReturnsZero()
+    {
+        // Target moving directly away from the shooter, faster than a slow shot: a real
+        // determinant exists but both quadratic roots are negative, so t1 > 0 is false and the
+        // function falls through to max(t2, 0) == 0.
+        var time = math.first_order_intercept_time(
+            shotSpeed: 1.0f,
+            targetRelativePosition: new float3(10.0f, 0.0f, 0.0f),
+            targetRelativeVelocity: new float3(5.0f, 0.0f, 0.0f));
+
+        Assert.Equal(0.0f, time);
+    }
+
+    [Fact]
+    public void ClosingCaseWithOffOriginOffAxisPositionsProducesPhysicallyConsistentIntercept()
+    {
+        // Neither shooter nor target sits at the origin, no vector is axis-aligned, and both
+        // parties are moving. This is the fixture shape ("degenerate fixtures are how these
+        // survived") the earlier single test never exercised.
+        var shooterPosition = new float3(2.0f, 3.0f, -1.0f);
+        var shooterVelocity = new float3(1.0f, -1.0f, 0.5f);
+        var shotSpeed = 10.0f;
+        var targetPosition = new float3(15.0f, 8.0f, 4.0f);
+        var targetVelocity = new float3(-3.0f, 2.0f, 1.0f);
+
+        var targetRelativePosition = targetPosition - shooterPosition;
+        var targetRelativeVelocity = targetVelocity - shooterVelocity;
+        var time = math.first_order_intercept_time(shotSpeed, targetRelativePosition, targetRelativeVelocity);
+
+        Assert.True(time > 0.0f, "fixture must produce a genuine closing solution");
+
+        var aimPoint = math.first_order_intercept(shooterPosition, shooterVelocity, shotSpeed, targetPosition, targetVelocity);
+        AssertShotAndTargetCoincideAtTime(shooterPosition, shooterVelocity, shotSpeed, aimPoint, targetPosition, targetVelocity, time);
+    }
+
+    /// <summary>
+    /// Fires from <paramref name="shooterPosition"/>, inheriting <paramref name="shooterVelocity"/>
+    /// and adding <paramref name="shotSpeed"/> toward <paramref name="aimPoint"/>, and asserts the
+    /// shot's world position at <paramref name="time"/> coincides with the target's own actual
+    /// motion (<paramref name="targetPosition"/> + time * <paramref name="targetVelocity"/>).
+    /// This is the behavioural contract first_order_intercept exists to serve: aim here, and the
+    /// target will be there when the shot arrives.
+    /// </summary>
+    private static void AssertShotAndTargetCoincideAtTime(
+        float3 shooterPosition,
+        float3 shooterVelocity,
+        float shotSpeed,
+        float3 aimPoint,
+        float3 targetPosition,
+        float3 targetVelocity,
+        float time)
+    {
+        var direction = math.normalize(aimPoint - shooterPosition);
+        var shotVelocity = shooterVelocity + shotSpeed * direction;
+        var shotPositionAtTime = shooterPosition + time * shotVelocity;
+        var targetPositionAtTime = targetPosition + time * targetVelocity;
+
+        Assert.Equal(targetPositionAtTime.x, shotPositionAtTime.x, Precision);
+        Assert.Equal(targetPositionAtTime.y, shotPositionAtTime.y, Precision);
+        Assert.Equal(targetPositionAtTime.z, shotPositionAtTime.z, Precision);
+    }
+}

packages/cultmath/tests/CultMath.Tests/HlslMirrorTests.cs

@@ -31,7 +31,6 @@ public sealed class HlslMirrorTests
             "cultmath_smootherstep",
             "cultmath_lengthsq",
             "cultmath_distance",
-            "cultmath_normalize",
             "cultmath_reflect",
             "cultmath_rotate",
             "cultmath_csum",
@@ -41,6 +40,9 @@ public sealed class HlslMirrorTests
             "cultmath_quadratic_bezier",
             "cultmath_cubic_bezier",
             "cultmath_hash",
+            "cultmath_pcg(uint",
+            "cultmath_pcg3d(int3",
+            "cultmath_pcg4d(int4",
             "cultmath_value_noise",
             "cultmath_snoise(float2",
             "cultmath_snoise(float3",
@@ -54,8 +56,8 @@ public sealed class HlslMirrorTests
             Assert.Contains(symbol, include);
         }
 
-        Assert.Contains("CULTMATH_NORMALIZE_EPSILON", include);
-        Assert.Contains("max(length(value), CULTMATH_NORMALIZE_EPSILON)", include);
+        // HLSL's normalize intrinsic is the contract; a mirror copy would only restate it.
+        Assert.DoesNotContain("cultmath_normalize", include);
     }
 
     private static string GetCultMathRoot()

packages/cultmath/tests/CultMath.Tests/HlslSemanticsTests.cs

@@ -187,6 +187,33 @@ public sealed class HlslSemanticsTests
         Assert.Equal(DoubleBits(-0.0), DoubleBits(math.max(-0.0, 0.0)));
         Assert.Equal(DoubleBits(0.0), DoubleBits(math.min(-0.0, 0.0)));
 
+        // dxc: normalize(x) is x * Rsqrt(Dot(x, x)); length and distance are Sqrt of the summed squares.
+        static bool AllNaN(float4 value) =>
+            float.IsNaN(value.x) && float.IsNaN(value.y) && float.IsNaN(value.z) && float.IsNaN(value.w);
+        var n2 = math.normalize(float2.zero);
+        Assert.True(float.IsNaN(n2.x) && float.IsNaN(n2.y));
+        var n3 = math.normalize(float3.zero);
+        Assert.True(float.IsNaN(n3.x) && float.IsNaN(n3.y) && float.IsNaN(n3.z));
+        Assert.True(AllNaN(math.normalize(float4.zero)));
+        var nanX = math.normalize(new float2(float.NaN, 2.41f));
+        Assert.True(float.IsNaN(nanX.x) && float.IsNaN(nanX.y));
+        Assert.True(AllNaN(math.normalize(new float4(1.0f, float.NaN, 2.41f, 1.0f))));
+        var skew = new float3(0.25f, 1.0f, -0.1f);
+        var inverseLength = 1.0f / MathF.Sqrt(skew.x * skew.x + skew.y * skew.y + skew.z * skew.z);
+        var normalized = math.normalize(skew);
+        Assert.Equal(Bits(skew.x * inverseLength), Bits(normalized.x));
+        Assert.Equal(Bits(skew.y * inverseLength), Bits(normalized.y));
+        Assert.Equal(Bits(skew.z * inverseLength), Bits(normalized.z));
+        Assert.Equal(Bits(0.0f), Bits(math.length(float2.zero)));
+        Assert.Equal(Bits(0.0f), Bits(math.length(float3.zero)));
+        Assert.Equal(Bits(0.0f), Bits(math.length(float4.zero)));
+        Assert.Equal(Bits(0.0f), Bits(math.distance(new float3(1.0f, 2.0f, 3.0f), new float3(1.0f, 2.0f, 3.0f))));
+
+        // asuint(float) reinterprets the IEEE-754 bits.
+        Assert.Equal(0x80000000u, math.asuint(-0.0f));
+        Assert.Equal(0x3FC00000u, math.asuint(1.5f));
+        Assert.Equal(0x7FC00000u, math.asuint(BitConverter.Int32BitsToSingle(0x7FC00000)));
+
         Assert.Equal(0, math.sign(float.NaN));
         Assert.Equal(-1, math.sign(-0.5f));
         Assert.Equal(new int3(-1, 0, 1), math.sign(new float3(-2.0f, 0.0f, 4.0f)));
@@ -311,6 +338,43 @@ public sealed class HlslSemanticsTests
         Assert.Equal(new int4(5, 5, 5, 5), math.int4(5));
     }
 
+    [Fact]
+    public void VectorConversionsFollowDxc()
+    {
+        // fptosi truncates toward zero; NaN and out-of-range inputs are undefined in DXIL and not pinned.
+        Assert.Equal(new int2(-1, 2), math.int2(new float2(-1.7f, 2.9f)));
+        Assert.Equal(new int3(0, 0, 3), new int3(new float3(-0.5f, 0.5f, 3.99f)));
+        Assert.Equal(new float4(1.0f, -2.0f, 3.0f, 0.0f), math.float4(new int4(1, -2, 3, 0)));
+        // Numeric to bool is `!= 0` (fcmp une for float, so NaN is true); bool to numeric is 0 or 1.
+        Assert.Equal(new bool2(true, false), math.bool2(new float2(float.NaN, -0.0f)));
+        Assert.Equal(new bool3(false, true, true), math.bool3(new int3(0, 5, -1)));
+        Assert.Equal(new float2(1.0f, 0.0f), math.float2(new bool2(true, false)));
+        Assert.Equal(new int4(0, 1, 1, 0), math.int4(new bool4(false, true, true, false)));
+        // intN(intN) is exact; it must not promote through float and lose 2^24 + 1.
+        Assert.Equal(new int2(16777217, -16777217), math.int2(new int2(16777217, -16777217)));
+        float2 splat = math.float2(0);
+        Assert.Equal(float2.zero, splat);
+    }
+
+    [Fact]
+    public void FracAndIntegerClampFollowHlsl()
+    {
+        // frac(double) keeps double precision; a float frac of 1e9 + 0.25 would return 0.
+        Assert.Equal(0.25, math.frac(1.0e9 + 0.25));
+        Assert.Equal(0.75, math.frac(-0.25));
+        Assert.Equal(0.5f, math.frac(2.5f));
+
+        // IMin(IMax(x, a), b): the result stays int, and inverted bounds return b.
+        int clamped = math.clamp(7, -1, 3);
+        Assert.Equal(3, clamped);
+        Assert.Equal(-1, math.clamp(-5, -1, 3));
+        Assert.Equal(0, math.clamp(1, 3, 0));
+        Assert.Equal(new int2(0, 3), math.clamp(new int2(-4, 9), 0, 3));
+        Assert.Equal(new int3(1, 2, 3), math.clamp(new int3(1, 2, 3), new int3(0, 0, 0), new int3(5, 5, 5)));
+        Assert.Equal(new int4(2, 2, 4, 4), math.clamp(new int4(1, 2, 5, 4), new int4(2), new int4(4)));
+        Assert.Equal(1.0f, math.clamp(2.0f, -1, 1));
+    }
+
     [Fact]
     public void MatrixMulFollowsHlslRowMajorConvention()
     {

packages/cultmath/tests/CultMath.Tests/HlslSourceCompatibilityTests.cs

@@ -78,26 +78,33 @@ public sealed class HlslSourceCompatibilityTests
             foreach (var input in cases)
             {
                 var slot = 0;
-                var args = types.Select(t => t == typeof(float) ? (object)input(slot++)
-                    : Activator.CreateInstance(t, Enumerable.Range(0, Components(t)).Select(_ => (object)input(slot++)).ToArray())!).ToArray();
-                var expected = Floats(counterpart.Invoke(null, args)!);
-                var actual = Floats(mirror.Invoke(shader, args)!);
-                if (expected.Length != actual.Length || expected.Zip(actual).Any(p => !(float.IsNaN(p.First) && float.IsNaN(p.Second))
-                    && BitConverter.SingleToInt32Bits(p.First) != BitConverter.SingleToInt32Bits(p.Second)))
+                var args = types.Select(t => Scalars.Contains(t) ? Scalar(t, input(slot++))
+                    : Activator.CreateInstance(t, Components(t).Select(f => Scalar(f.FieldType, input(slot++))).ToArray())!).ToArray();
+                var expected = Values(counterpart.Invoke(null, args)!);
+                var actual = Values(mirror.Invoke(shader, args)!);
+                if (expected.Length != actual.Length || expected.Zip(actual).Any(p => p.First is float a && p.Second is float b
+                    ? !(float.IsNaN(a) && float.IsNaN(b)) && BitConverter.SingleToInt32Bits(a) != BitConverter.SingleToInt32Bits(b)
+                    : !p.First.Equals(p.Second)))
                 {
-                    mismatches.Add($"{mirror.Name}({string.Join(", ", args.Select(a => string.Join(" ", Floats(a))))}): C# {string.Join(" ", expected)}, mirror {string.Join(" ", actual)}");
+                    mismatches.Add($"{mirror.Name}({string.Join(", ", args.Select(a => string.Join(" ", Values(a))))}): C# {string.Join(" ", expected)}, mirror {string.Join(" ", actual)}");
                 }
             }
         }
 
         Assert.True(mismatches.Count == 0, $"{mismatches.Count} mismatches:{Environment.NewLine}{string.Join(Environment.NewLine, mismatches.Take(12))}");
-        Assert.Equal(26, compared.Count);
+        Assert.Equal(28, compared.Count);
     }
 
-    private static int Components(Type t) => t.GetFields().Count(f => f.FieldType == typeof(float) && !f.IsStatic);
+    // Integer arguments take the bit pattern of the float input, so specials become 0, 0x80000000, NaN bits, ...
+    private static readonly Type[] Scalars = { typeof(float), typeof(int), typeof(uint) };
 
-    private static float[] Floats(object value) => value is float f ? new[] { f }
-        : value.GetType().GetFields().Where(field => field.FieldType == typeof(float) && !field.IsStatic).Select(field => (float)field.GetValue(value)!).ToArray();
+    private static object Scalar(Type t, float f) => t == typeof(float) ? f
+        : t == typeof(int) ? BitConverter.SingleToInt32Bits(f) : (object)(uint)BitConverter.SingleToInt32Bits(f);
+
+    private static FieldInfo[] Components(Type t) => t.GetFields().Where(f => !f.IsStatic && Scalars.Contains(f.FieldType)).ToArray();
+
+    private static object[] Values(object value) => Scalars.Contains(value.GetType()) ? new[] { value }
+        : Components(value.GetType()).Select(field => field.GetValue(value)!).ToArray();
 
     /// <summary>The documented HLSL-to-C# transformations, and nothing else.</summary>
     internal static string TransformHlslToCSharp(string hlsl)

packages/cultmath/tests/CultMath.Tests/MathTests.cs

@@ -12,6 +12,41 @@ public sealed class MathTests
         Assert.Equal(0.75f, math.frac(-1.25f));
     }
 
+    // Expected values come from a Python transcription of the paper's pcg3d/pcg4d (JCGT 9(3) 2020, p. 32) and
+    // O'Neill's pcg_output_rxs_m_xs_32_32 with PCG_DEFAULT_MULTIPLIER_32/INCREMENT_32, independent of this code.
+    [Fact]
+    public void PcgHashesMatchReferenceTranscription()
+    {
+        static int3 U3(uint x, uint y, uint z) => new((int)x, (int)y, (int)z);
+        static int4 U4(uint x, uint y, uint z, uint w) => new((int)x, (int)y, (int)z, (int)w);
+
+        Assert.Equal(0x07BB2FE2u, math.pcg(0u));
+        Assert.Equal(0xA8BEEA3Cu, math.pcg(1u));
+        Assert.Equal(0x995312E1u, math.pcg(0x12345678u));
+        Assert.Equal(0xE62A4902u, math.pcg(0xFFFFFFFFu));
+        Assert.Equal(U3(0x9BAFD7C6u, 0xA8E88A6Bu, 0x3F15482Cu), math.pcg3d(new int3(0, 0, 0)));
+        Assert.Equal(U3(0xFA9F79A6u, 0x48F2F44Cu, 0x596F5AB1u), math.pcg3d(new int3(1, 2, 3)));
+        Assert.Equal(U3(0x67DCF282u, 0x49E87E17u, 0x10018917u), math.pcg3d(U3(0xFFFFFFFFu, 0x80000000u, 0x7FFFFFFFu)));
+        Assert.Equal(U4(0x0F02F829u, 0x2D568769u, 0x32B0C43Bu, 0xD32548EAu), math.pcg4d(new int4(0, 0, 0, 0)));
+        Assert.Equal(U4(0x3622CD16u, 0xF11471D8u, 0xE1109B3Fu, 0x02B94C2Fu), math.pcg4d(new int4(1, 2, 3, 4)));
+        Assert.Equal(U4(0x72180037u, 0x81D493E6u, 0xD9BA7226u, 0x14C9ABA7u), math.pcg4d(U4(0xFFFFFFFFu, 0x80000000u, 0x7FFFFFFFu, 0xDEADBEEFu)));
+        Assert.Equal(U3(0xA7B40FEEu, 0x9B70DFC0u, 0x3106C2C5u), math.pcg3d(new float3(1.5f, -2.25f, 1e7f)));
+        Assert.Equal(U3(0x5A09E5C6u, 0x53EC0DABu, 0x4BE4A1ECu), math.pcg3d(new float2(3.0f, 4.0f)));
+        Assert.Equal(U4(0x1849E380u, 0xF199DEE0u, 0x6C6B4934u, 0x34AF16DFu),
+            math.pcg4d(new float4(-0.0f, BitConverter.Int32BitsToSingle(0x7FC00000), 0.5f, 1e-7f)));
+    }
+
+    [Fact]
+    public void Pcg3dSeparatesAPositionGrid()
+    {
+        // A single 32-bit component is subject to birthday collisions (x has one here); the full output is distinct.
+        var hashes = new HashSet<int3>();
+        for (var i = 0; i < 100; i++)
+        for (var j = 0; j < 100; j++)
+            hashes.Add(math.pcg3d(new float2(i * 0.5f - 25.0f, j * 0.5f - 25.0f)));
+        Assert.Equal(10000, hashes.Count);
+    }
+
     [Fact]
     public void VectorOperationsAreComponentWise()
     {
@@ -332,4 +367,160 @@ public sealed class MathTests
         Assert.Equal(0.0f, px[1], precision: 5);
         Assert.Equal(0.0f, py[1], precision: 5);
     }
+
+    // Tabulated to 16 significant figures (Abramowitz & Stegun table 7.1 lineage / standard erf tables).
+    [Theory]
+    [InlineData(0.0f, 0.0)]
+    [InlineData(0.5f, 0.5204998778130465)]
+    [InlineData(-0.5f, -0.5204998778130465)]
+    [InlineData(1.0f, 0.8427007929497149)]
+    [InlineData(-1.0f, -0.8427007929497149)]
+    [InlineData(2.0f, 0.9953222650189527)]
+    [InlineData(-2.0f, -0.9953222650189527)]
+    [InlineData(3.0f, 0.9999779095030014)]
+    [InlineData(-3.0f, -0.9999779095030014)]
+    public void ErfMatchesReferenceValues(float x, double expected)
+    {
+        Assert.True(
+            Math.Abs(math.erf(x) - expected) <= 2e-6,
+            $"erf({x}) = {math.erf(x)}, expected {expected}");
+    }
+
+    [Fact]
+    public void ErfIsOdd()
+    {
+        for (var i = -30; i <= 30; i++)
+        {
+            var x = i / 10.0f;
+            Assert.Equal(-math.erf(x), math.erf(-x));
+        }
+    }
+
+    [Fact]
+    public void ErfApproachesItsLimitsOfPlusMinusOne()
+    {
+        Assert.Equal(1.0f, math.erf(6.0f));
+        Assert.Equal(1.0f, math.erf(20.0f));
+        Assert.Equal(-1.0f, math.erf(-6.0f));
+        Assert.Equal(-1.0f, math.erf(-20.0f));
+    }
+
+    [Fact]
+    public void ErfinvInvertsErf()
+    {
+        for (var i = -999; i <= 999; i++)
+        {
+            var y = i / 1000.0f;
+            var x = math.erfinv(y);
+            var roundTrip = math.erf(x);
+            Assert.True(
+                MathF.Abs(roundTrip - y) < 1e-5f,
+                $"erf(erfinv({y})) = {roundTrip}");
+        }
+    }
+
+    // Reference values from bisecting the platform's double-precision erf (Python's math.erf,
+    // glibc-backed), not this package's own erf, to 200 iterations over [-6, 6] -- effectively
+    // exact at float precision. This is what ErfinvInvertsErf cannot be: a check against this
+    // package's own erf only proves the two functions agree with each other, not that either is
+    // numerically correct. Soul measured the round-trip test alone to be blind to a coefficient
+    // change that degraded erfinv's worst error 300-400x (5.0e-7 to 2.0e-4).
+    [Theory]
+    // Expected values are computed for the actual float32-rounded input (e.g. the literal
+    // 0.999f is really 0.9990000128746033 as a double), not the decimal literal, because
+    // erfinv's derivative diverges near +-1: at y = 0.999f that rounding alone moves the
+    // true answer by ~2.6e-6, larger than the test's own error bar, if ignored.
+    [InlineData(0.0f, 0.0)]
+    [InlineData(0.1f, 0.08885599182530649)]
+    [InlineData(-0.1f, -0.08885599182530649)]
+    [InlineData(0.3f, 0.2724627261055238)]
+    [InlineData(-0.3f, -0.2724627261055238)]
+    [InlineData(0.5f, 0.4769362762044699)]
+    [InlineData(-0.5f, -0.4769362762044699)]
+    [InlineData(0.7f, 0.7328690598827587)]
+    [InlineData(-0.7f, -0.732869059882759)]
+    [InlineData(0.9f, 1.1630870719457724)]
+    [InlineData(-0.9f, -1.1630870719457729)]
+    [InlineData(0.95f, 1.3859037522360764)]
+    [InlineData(-0.95f, -1.3859037522360773)]
+    [InlineData(0.99f, 1.8213866009002766)]
+    [InlineData(-0.99f, -1.8213866009002793)]
+    [InlineData(0.999f, 2.3267563267961435)]
+    [InlineData(-0.999f, -2.3267563267961657)]
+    [InlineData(0.9999f, 2.751035437903192)]
+    [InlineData(-0.9999f, -2.751035437903383)]
+    public void ErfinvMatchesReferenceValues(float y, double expected)
+    {
+        Assert.True(
+            Math.Abs(math.erfinv(y) - expected) <= 2e-6,
+            $"erfinv({y}) = {math.erfinv(y)}, expected {expected}");
+    }
+
+    [Fact]
+    public void ErfinvAtDomainEdgesAndBeyond()
+    {
+        // Domain is [-1, 1]. The edges are the correctly-signed infinite limits; anything
+        // outside, including +-infinity itself, has no real inverse and is NaN.
+        Assert.Equal(float.PositiveInfinity, math.erfinv(1.0f));
+        Assert.Equal(float.NegativeInfinity, math.erfinv(-1.0f));
+        Assert.True(float.IsNaN(math.erfinv(1.0001f)));
+        Assert.True(float.IsNaN(math.erfinv(-1.0001f)));
+        Assert.True(float.IsNaN(math.erfinv(2.0f)));
+        Assert.True(float.IsNaN(math.erfinv(-2.0f)));
+        Assert.True(float.IsNaN(math.erfinv(float.PositiveInfinity)));
+        Assert.True(float.IsNaN(math.erfinv(float.NegativeInfinity)));
+        Assert.True(float.IsNaN(math.erfinv(float.NaN)));
+    }
+
+    // The deleted ErfinvIsMonotonicallyIncreasing asserted a property erfinv does not have:
+    // Soul measured 9662 backward steps scanning every representable float32 in [0, 0.999999],
+    // first at y = 0.00022214651, worst drop 5.960464e-8 (one ULP at that scale) -- invisible
+    // only because that fixture stepped by 0.001. erf has the same shape: 100 backward steps
+    // over [0, 4.5], worst drop 1.192093e-7. Pin what is actually true: monotone to within a
+    // tolerance comfortably above that measured noise floor.
+    [Fact]
+    public void ErfinvIsMonotonicWithinFloatingPointTolerance()
+    {
+        const float tolerance = 1e-6f;
+        var previous = float.NegativeInfinity;
+        for (var i = -999; i <= 999; i++)
+        {
+            var y = i / 1000.0f;
+            var x = math.erfinv(y);
+            Assert.True(
+                x >= previous - tolerance,
+                $"erfinv({y}) = {x} dropped more than {tolerance} below previous value {previous}");
+            previous = x;
+        }
+    }
+
+    // One property the consumer needs, not the whole of correctness: fire control turns
+    // adjacent erf values into a cell's probability mass, so a backward step in erf would
+    // show up as a negative mass. An erf that returned a constant would pass this and is
+    // caught by ErfMatchesReferenceValues instead.
+    // Soul checked these geometries clean: 16/64/256/1024/4096 cells over
+    // +-4 sigma, plus a tight 1 sigma spread and a very tight 0.25 sigma spread.
+    [Theory]
+    [InlineData(16, 4f)]
+    [InlineData(64, 4f)]
+    [InlineData(256, 4f)]
+    [InlineData(1024, 4f)]
+    [InlineData(4096, 4f)]
+    [InlineData(256, 1f)]
+    [InlineData(64, 0.25f)]
+    public void ErfCellMassesStayNonNegativeAcrossRealisticGeometries(int cells, float sigmaRange)
+    {
+        var lo = -sigmaRange;
+        var hi = sigmaRange;
+        var step = (hi - lo) / cells;
+        var previous = math.erf(lo / MathF.Sqrt(2f));
+        for (var i = 1; i <= cells; i++)
+        {
+            var edge = lo + step * i;
+            var current = math.erf(edge / MathF.Sqrt(2f));
+            var mass = current - previous;
+            Assert.True(mass >= 0f, $"cell {i} of {cells} over +-{sigmaRange} sigma has negative mass {mass}");
+            previous = current;
+        }
+    }
 }

packages/cultmath/tests/CultMath.Tests/VectorEqualityTests.cs

@@ -0,0 +1,583 @@
+using System;
+using CultMath;
+using Xunit;
+
+namespace CultMath.Tests;
+
+// Hand-verified on hands/adopt-stryker: weakening float3.Equals from `&&` to `||` passes the
+// whole existing suite. The same shape of Equals/GetHashCode, ==/!=, and </>/<=/>= exists (with
+// no shared base type) across float2/3/4, double2/3, int2/3/4, bool2/3/4, quaternion,
+// float2x2 and float3x3. These tests are data-driven per component position rather than one
+// method per type: each type supplies a base value and, per component index, a value that
+// differs at exactly that index and agrees everywhere else, plus (for the four ordered numeric
+// families) a left/right pair whose relational result differs per component. bool2/3/4 and
+// quaternion have no ordering operators and are not included in the comparison-operator cases.
+// float2x2/float3x3 have no == / != operators (Equals and GetHashCode only) and are covered
+// separately, at row granularity.
+public sealed class VectorEqualityTests
+{
+    // ---- shared, type-agnostic assertions -------------------------------------------------
+
+    private static void AssertEqualsAndHashCodeContract<T>(T a, T b, bool expectedEqual, string label)
+        where T : IEquatable<T>
+    {
+        Assert.True(a.Equals(b) == expectedEqual, $"{label}: a.Equals(b) expected {expectedEqual}");
+        Assert.True(b.Equals(a) == expectedEqual, $"{label}: b.Equals(a) expected {expectedEqual} (symmetry)");
+        if (expectedEqual)
+        {
+            Assert.True(a.GetHashCode() == b.GetHashCode(), $"{label}: equal values must share a hash code");
+        }
+    }
+
+    private static void AssertElementwiseEqualityOperators<TLeft, TRight, TBool>(
+        TLeft a,
+        TRight b,
+        int count,
+        Func<int, bool> expectedEqualAt,
+        Func<TLeft, TRight, TBool> eq,
+        Func<TLeft, TRight, TBool> neq,
+        Func<TBool, int, bool> at,
+        string label)
+    {
+        var eqResult = eq(a, b);
+        var neqResult = neq(a, b);
+        for (var i = 0; i < count; i++)
+        {
+            var expectedEqual = expectedEqualAt(i);
+            Assert.True(at(eqResult, i) == expectedEqual, $"{label}: == component {i} expected {expectedEqual}");
+            Assert.True(at(neqResult, i) == !expectedEqual, $"{label}: != component {i} expected {!expectedEqual}");
+        }
+    }
+
+    private static void AssertElementwiseComparisonOperators<TLeft, TRight, TBool>(
+        TLeft left,
+        TRight right,
+        double[] leftVals,
+        double[] rightVals,
+        Func<TLeft, TRight, TBool> lt,
+        Func<TLeft, TRight, TBool> gt,
+        Func<TLeft, TRight, TBool> le,
+        Func<TLeft, TRight, TBool> ge,
+        Func<TBool, int, bool> at,
+        string label)
+    {
+        var ltResult = lt(left, right);
+        var gtResult = gt(left, right);
+        var leResult = le(left, right);
+        var geResult = ge(left, right);
+        for (var i = 0; i < leftVals.Length; i++)
+        {
+            var less = leftVals[i] < rightVals[i];
+            var greater = leftVals[i] > rightVals[i];
+            Assert.True(at(ltResult, i) == less, $"{label}: < component {i} (left={leftVals[i]}, right={rightVals[i]})");
+            Assert.True(at(gtResult, i) == greater, $"{label}: > component {i} (left={leftVals[i]}, right={rightVals[i]})");
+            Assert.True(at(leResult, i) == !greater, $"{label}: <= component {i} (left={leftVals[i]}, right={rightVals[i]})");
+            Assert.True(at(geResult, i) == !less, $"{label}: >= component {i} (left={leftVals[i]}, right={rightVals[i]})");
+        }
+    }
+
+    // ---- float2 -----------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    public void Float2EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new float2(3.0f, -7.0f);
+        var b = a;
+        b[index] += 5.0f;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "float2 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"float2 differing at {index}");
+        AssertElementwiseEqualityOperators<float2, float2, bool2>(
+            a, b, 2, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float2 vector==vector");
+
+        // Scalar overloads: a scalar equal to exactly one component, on both operand sides.
+        var scalar = a[index];
+        AssertElementwiseEqualityOperators<float2, float, bool2>(
+            a, scalar, 2, i => a[i] == scalar, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float2 vector==scalar");
+        AssertElementwiseEqualityOperators<float, float2, bool2>(
+            scalar, a, 2, i => a[i] == scalar, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float2 scalar==vector");
+    }
+
+    [Fact]
+    public void Float2ComparisonOperatorsDifferPerComponent()
+    {
+        var left = new float2(1.0f, 5.0f);
+        var right = new float2(2.0f, 3.0f);
+        var leftVals = new double[] { 1.0, 5.0 };
+        var rightVals = new double[] { 2.0, 3.0 };
+
+        AssertElementwiseComparisonOperators<float2, float2, bool2>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float2 vector-vector");
+
+        const float scalar = 2.0f;
+        AssertElementwiseComparisonOperators<float2, float, bool2>(
+            left, scalar, leftVals, new double[] { scalar, scalar },
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float2 vector-scalar");
+        AssertElementwiseComparisonOperators<float, float2, bool2>(
+            scalar, left, new double[] { scalar, scalar }, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float2 scalar-vector");
+
+        // A value compared against an exact copy of itself: every component ties. This is the
+        // complementary fixture to the no-tie one above. A tie is where < and <= (or > and >=)
+        // actually disagree, so it catches a strict/non-strict boundary swap (e.g. < mutated to
+        // <=) that a fixture with no equal components cannot: unlike a threshold compared against
+        // an arbitrary float, an exact self-tie is neither rare nor equivalent here, since these
+        // are general-purpose comparison operators (bounds/containment checks compare against
+        // literal endpoints routinely, as CultMath's own touching-edges rect test does).
+        AssertElementwiseComparisonOperators<float2, float2, bool2>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float2 tied vector-vector");
+
+        // The scalar overloads need their own tie: a uniform vector against a scalar equal to
+        // every component, so every component of the vector-scalar and scalar-vector overloads
+        // ties too (the vector-vector tie above does not cover them).
+        var uniform = new float2(4.0f, 4.0f);
+        var uniformVals = new double[] { 4.0, 4.0 };
+        AssertElementwiseComparisonOperators<float2, float, bool2>(
+            uniform, 4.0f, uniformVals, uniformVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float2 tied vector-scalar");
+        AssertElementwiseComparisonOperators<float, float2, bool2>(
+            4.0f, uniform, uniformVals, uniformVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float2 tied scalar-vector");
+    }
+
+    // ---- float3 -----------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    public void Float3EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new float3(3.0f, -7.0f, 4.5f);
+        var b = a;
+        b[index] += 5.0f;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "float3 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"float3 differing at {index}");
+        AssertElementwiseEqualityOperators<float3, float3, bool3>(
+            a, b, 3, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float3 vector==vector");
+
+        var scalar = a[index];
+        AssertElementwiseEqualityOperators<float3, float, bool3>(
+            a, scalar, 3, i => a[i] == scalar, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float3 vector==scalar");
+        AssertElementwiseEqualityOperators<float, float3, bool3>(
+            scalar, a, 3, i => a[i] == scalar, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float3 scalar==vector");
+    }
+
+    [Fact]
+    public void Float3ComparisonOperatorsDifferPerComponent()
+    {
+        // No component is tied: a tie makes strict < and strict > agree (both false), which
+        // would hide a direction-flip mutation (< swapped for >) at that component.
+        var left = new float3(1.0f, 5.0f, 7.0f);
+        var right = new float3(2.0f, 3.0f, 4.0f);
+        var leftVals = new double[] { 1.0, 5.0, 7.0 };
+        var rightVals = new double[] { 2.0, 3.0, 4.0 };
+
+        AssertElementwiseComparisonOperators<float3, float3, bool3>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float3 vector-vector");
+
+        const float scalar = 4.0f;
+        AssertElementwiseComparisonOperators<float3, float, bool3>(
+            left, scalar, leftVals, new double[] { scalar, scalar, scalar },
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float3 vector-scalar");
+        AssertElementwiseComparisonOperators<float, float3, bool3>(
+            scalar, left, new double[] { scalar, scalar, scalar }, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float3 scalar-vector");
+
+        // Tied against itself (see the float2 tied-fixture comment above).
+        AssertElementwiseComparisonOperators<float3, float3, bool3>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float3 tied vector-vector");
+
+        // The scalar overloads need their own tie (see the float2 uniform-vector comment above).
+        var uniform = new float3(4.0f, 4.0f, 4.0f);
+        var uniformVals = new double[] { 4.0, 4.0, 4.0 };
+        AssertElementwiseComparisonOperators<float3, float, bool3>(
+            uniform, 4.0f, uniformVals, uniformVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float3 tied vector-scalar");
+        AssertElementwiseComparisonOperators<float, float3, bool3>(
+            4.0f, uniform, uniformVals, uniformVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float3 tied scalar-vector");
+    }
+
+    // ---- float4 -----------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    [InlineData(3)]
+    public void Float4EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new float4(3.0f, -7.0f, 4.5f, 9.0f);
+        var b = a;
+        b[index] += 5.0f;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "float4 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"float4 differing at {index}");
+        AssertElementwiseEqualityOperators<float4, float4, bool4>(
+            a, b, 4, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float4 vector==vector");
+
+        var scalar = a[index];
+        AssertElementwiseEqualityOperators<float4, float, bool4>(
+            a, scalar, 4, i => a[i] == scalar, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float4 vector==scalar");
+        AssertElementwiseEqualityOperators<float, float4, bool4>(
+            scalar, a, 4, i => a[i] == scalar, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "float4 scalar==vector");
+    }
+
+    [Fact]
+    public void Float4ComparisonOperatorsDifferPerComponent()
+    {
+        // No component is tied (see the float3 comment above for why a tie hides a
+        // direction-flip mutation at that component).
+        var left = new float4(1.0f, 5.0f, 7.0f, 2.0f);
+        var right = new float4(2.0f, 3.0f, 4.0f, 9.0f);
+        var leftVals = new double[] { 1.0, 5.0, 7.0, 2.0 };
+        var rightVals = new double[] { 2.0, 3.0, 4.0, 9.0 };
+
+        AssertElementwiseComparisonOperators<float4, float4, bool4>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float4 vector-vector");
+
+        const float scalar = 4.0f;
+        AssertElementwiseComparisonOperators<float4, float, bool4>(
+            left, scalar, leftVals, new double[] { scalar, scalar, scalar, scalar },
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float4 vector-scalar");
+        AssertElementwiseComparisonOperators<float, float4, bool4>(
+            scalar, left, new double[] { scalar, scalar, scalar, scalar }, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float4 scalar-vector");
+
+        // Tied against itself (see the float2 tied-fixture comment above).
+        AssertElementwiseComparisonOperators<float4, float4, bool4>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float4 tied vector-vector");
+
+        // The scalar overloads need their own tie (see the float2 uniform-vector comment above).
+        var uniform = new float4(4.0f, 4.0f, 4.0f, 4.0f);
+        var uniformVals = new double[] { 4.0, 4.0, 4.0, 4.0 };
+        AssertElementwiseComparisonOperators<float4, float, bool4>(
+            uniform, 4.0f, uniformVals, uniformVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float4 tied vector-scalar");
+        AssertElementwiseComparisonOperators<float, float4, bool4>(
+            4.0f, uniform, uniformVals, uniformVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "float4 tied scalar-vector");
+    }
+
+    // ---- double2 ----------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    public void Double2EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new double2(3.0, -7.0);
+        var b = a;
+        b[index] += 5.0;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "double2 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"double2 differing at {index}");
+        AssertElementwiseEqualityOperators<double2, double2, bool2>(
+            a, b, 2, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "double2 ==");
+    }
+
+    [Fact]
+    public void Double2ComparisonOperatorsDifferPerComponent()
+    {
+        var left = new double2(1.0, 5.0);
+        var right = new double2(2.0, 3.0);
+        var leftVals = new double[] { 1.0, 5.0 };
+        var rightVals = new double[] { 2.0, 3.0 };
+
+        AssertElementwiseComparisonOperators<double2, double2, bool2>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "double2 vector-vector");
+
+        // Tied against itself (see the float2 tied-fixture comment above).
+        AssertElementwiseComparisonOperators<double2, double2, bool2>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "double2 tied vector-vector");
+    }
+
+    // ---- double3 ----------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    public void Double3EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new double3(3.0, -7.0, 4.5);
+        var b = a;
+        b[index] += 5.0;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "double3 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"double3 differing at {index}");
+        AssertElementwiseEqualityOperators<double3, double3, bool3>(
+            a, b, 3, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "double3 ==");
+    }
+
+    [Fact]
+    public void Double3ComparisonOperatorsDifferPerComponent()
+    {
+        // No component is tied (see the float3 comment above).
+        var left = new double3(1.0, 5.0, 7.0);
+        var right = new double3(2.0, 3.0, 4.0);
+        var leftVals = new double[] { 1.0, 5.0, 7.0 };
+        var rightVals = new double[] { 2.0, 3.0, 4.0 };
+
+        AssertElementwiseComparisonOperators<double3, double3, bool3>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "double3 vector-vector");
+
+        // Tied against itself (see the float2 tied-fixture comment above).
+        AssertElementwiseComparisonOperators<double3, double3, bool3>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "double3 tied vector-vector");
+    }
+
+    // ---- int2 -------------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    public void Int2EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new int2(3, -7);
+        var b = a;
+        b[index] += 5;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "int2 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"int2 differing at {index}");
+        AssertElementwiseEqualityOperators<int2, int2, bool2>(
+            a, b, 2, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "int2 ==");
+    }
+
+    [Fact]
+    public void Int2ComparisonOperatorsDifferPerComponent()
+    {
+        var left = new int2(1, 5);
+        var right = new int2(2, 3);
+        var leftVals = new double[] { 1, 5 };
+        var rightVals = new double[] { 2, 3 };
+
+        AssertElementwiseComparisonOperators<int2, int2, bool2>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "int2 vector-vector");
+
+        // Tied against itself (see the float2 tied-fixture comment above); integers make an
+        // exact tie the routine case, not the rare one.
+        AssertElementwiseComparisonOperators<int2, int2, bool2>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "int2 tied vector-vector");
+    }
+
+    // ---- int3 -------------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    public void Int3EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new int3(3, -7, 4);
+        var b = a;
+        b[index] += 5;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "int3 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"int3 differing at {index}");
+        AssertElementwiseEqualityOperators<int3, int3, bool3>(
+            a, b, 3, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "int3 ==");
+    }
+
+    [Fact]
+    public void Int3ComparisonOperatorsDifferPerComponent()
+    {
+        // No component is tied (see the float3 comment above).
+        var left = new int3(1, 5, 7);
+        var right = new int3(2, 3, 4);
+        var leftVals = new double[] { 1, 5, 7 };
+        var rightVals = new double[] { 2, 3, 4 };
+
+        AssertElementwiseComparisonOperators<int3, int3, bool3>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "int3 vector-vector");
+
+        // Tied against itself (see the int2 tied-fixture comment above).
+        AssertElementwiseComparisonOperators<int3, int3, bool3>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "int3 tied vector-vector");
+    }
+
+    // ---- int4 -------------------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    [InlineData(3)]
+    public void Int4EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new int4(3, -7, 4, 9);
+        var b = a;
+        b[index] += 5;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "int4 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"int4 differing at {index}");
+        AssertElementwiseEqualityOperators<int4, int4, bool4>(
+            a, b, 4, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "int4 ==");
+    }
+
+    [Fact]
+    public void Int4ComparisonOperatorsDifferPerComponent()
+    {
+        // No component is tied (see the float3 comment above).
+        var left = new int4(1, 5, 7, 2);
+        var right = new int4(2, 3, 4, 9);
+        var leftVals = new double[] { 1, 5, 7, 2 };
+        var rightVals = new double[] { 2, 3, 4, 9 };
+
+        AssertElementwiseComparisonOperators<int4, int4, bool4>(
+            left, right, leftVals, rightVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "int4 vector-vector");
+
+        // Tied against itself (see the int2 tied-fixture comment above).
+        AssertElementwiseComparisonOperators<int4, int4, bool4>(
+            left, left, leftVals, leftVals,
+            (x, y) => x < y, (x, y) => x > y, (x, y) => x <= y, (x, y) => x >= y, (v, i) => v[i], "int4 tied vector-vector");
+    }
+
+    // ---- bool2/3/4 (no ordering operators) ---------------------------------------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    public void Bool2EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new bool2(true, false);
+        var b = a;
+        b[index] = !b[index];
+
+        AssertEqualsAndHashCodeContract(a, a, true, "bool2 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"bool2 differing at {index}");
+        AssertElementwiseEqualityOperators<bool2, bool2, bool2>(
+            a, b, 2, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "bool2 ==");
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    public void Bool3EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new bool3(true, false, true);
+        var b = a;
+        b[index] = !b[index];
+
+        AssertEqualsAndHashCodeContract(a, a, true, "bool3 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"bool3 differing at {index}");
+        AssertElementwiseEqualityOperators<bool3, bool3, bool3>(
+            a, b, 3, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "bool3 ==");
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    [InlineData(3)]
+    public void Bool4EqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new bool4(true, false, true, false);
+        var b = a;
+        b[index] = !b[index];
+
+        AssertEqualsAndHashCodeContract(a, a, true, "bool4 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"bool4 differing at {index}");
+        AssertElementwiseEqualityOperators<bool4, bool4, bool4>(
+            a, b, 4, i => i != index, (x, y) => x == y, (x, y) => x != y, (v, i) => v[i], "bool4 ==");
+    }
+
+    [Fact]
+    public void BoolVectorFalseAndTrueConstantsHaveEveryComponentSet()
+    {
+        // bool2.@false/@true and bool4.@false/bool3.@true have no other consumer in this suite
+        // (bool3.@false and bool4.@true are read by HlslSemanticsTests), so a wrong component in
+        // their field initializers would otherwise go unnoticed.
+        Assert.Equal(new bool2(false, false), bool2.@false);
+        Assert.Equal(new bool2(true, true), bool2.@true);
+        Assert.Equal(new bool3(false, false, false), bool3.@false);
+        Assert.Equal(new bool3(true, true, true), bool3.@true);
+        Assert.Equal(new bool4(false, false, false, false), bool4.@false);
+        Assert.Equal(new bool4(true, true, true, true), bool4.@true);
+    }
+
+    // ---- quaternion (== and != return a plain bool, not a component vector) -----------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    [InlineData(3)]
+    public void QuaternionEqualsHashCodeAndOperatorsDetectSingleComponentDifference(int index)
+    {
+        var a = new quaternion(1.0f, 2.0f, 3.0f, 4.0f);
+        float4 asFloat4 = a;
+        asFloat4[index] += 5.0f;
+        quaternion b = asFloat4;
+
+        AssertEqualsAndHashCodeContract(a, a, true, "quaternion self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"quaternion differing at {index}");
+
+        // quaternion's == / != are scalar bool, defined in terms of Equals: confirm they
+        // actually delegate rather than reimplementing (and weakening) the comparison.
+        var aCopy = new quaternion(a.x, a.y, a.z, a.w);
+        Assert.Equal(a.Equals(aCopy), a == aCopy);
+        Assert.Equal(!a.Equals(aCopy), a != aCopy);
+        Assert.Equal(a.Equals(b), a == b);
+        Assert.Equal(!a.Equals(b), a != b);
+    }
+
+    // ---- float2x2 / float3x3 (Equals/GetHashCode only, row granularity) ---------------------
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    public void Float2x2EqualsAndHashCodeDetectSingleRowDifference(int row)
+    {
+        var row0 = new float2(1.0f, 2.0f);
+        var row1 = new float2(3.0f, 4.0f);
+        var a = new float2x2(row0, row1);
+
+        var differingRow0 = row == 0 ? row0 + new float2(10.0f, 0.0f) : row0;
+        var differingRow1 = row == 1 ? row1 + new float2(0.0f, 10.0f) : row1;
+        var b = new float2x2(differingRow0, differingRow1);
+
+        AssertEqualsAndHashCodeContract(a, a, true, "float2x2 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"float2x2 differing at row {row}");
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(1)]
+    [InlineData(2)]
+    public void Float3x3EqualsAndHashCodeDetectSingleRowDifference(int row)
+    {
+        var row0 = new float3(1.0f, 2.0f, 3.0f);
+        var row1 = new float3(4.0f, 5.0f, 6.0f);
+        var row2 = new float3(7.0f, 8.0f, 9.0f);
+        var a = new float3x3(row0, row1, row2);
+
+        var differingRow0 = row == 0 ? row0 + new float3(10.0f, 0.0f, 0.0f) : row0;
+        var differingRow1 = row == 1 ? row1 + new float3(0.0f, 10.0f, 0.0f) : row1;
+        var differingRow2 = row == 2 ? row2 + new float3(0.0f, 0.0f, 10.0f) : row2;
+        var b = new float3x3(differingRow0, differingRow1, differingRow2);
+
+        AssertEqualsAndHashCodeContract(a, a, true, "float3x3 self");
+        AssertEqualsAndHashCodeContract(a, b, false, $"float3x3 differing at row {row}");
+    }
+}

packages/cultmath/tests/CultMath.Tests/stryker-config.json

@@ -0,0 +1,14 @@
+{
+  "stryker-config": {
+    "project": "CultMath.csproj",
+    "mutate": [
+      "**/packages/cultmath/src/CultMath/**/*.cs",
+      "!**/packages/cultmath/src/CultMath/Swizzles.g.cs",
+      "!**/packages/cultmath/src/CultMath/*.meta"
+    ],
+    "mutation-level": "Standard",
+    "reporters": [ "progress", "html", "json" ],
+    "thresholds": { "high": 80, "low": 60, "break": 0 },
+    "test-runner": "mtp"
+  }
+}

packages/cultmath/tools/generate-swizzles.ps1

@@ -21,6 +21,19 @@ $families = @(
     @{ Scalar = "bool"; Sizes = @(2, 3, 4); Functions = $true },
     @{ Scalar = "double"; Sizes = @(2, 3); Functions = $false }
 )
+# Same-size vector conversions, as dxc lowers them: float to int is fptosi (toward zero; NaN
+# and out-of-range are undefined in DXIL), int to float is sitofp, numeric to bool is `!= 0`
+# (fcmp une, so NaN is true), bool to numeric is 0 or 1. Keyed "target<-source"; {0} is a
+# source component. Identity forms (intN(intN), ...) come from the composition loop, which
+# also keeps an int vector argument off the lossy intN(floatN) overload.
+$conversions = [ordered]@{
+    "float<-int" = "{0}"
+    "float<-bool" = "{0} ? 1.0f : 0.0f"
+    "int<-float" = "(int){0}"
+    "int<-bool" = "{0} ? 1 : 0"
+    "bool<-float" = "{0} != 0.0f"
+    "bool<-int" = "{0} != 0"
+}
 $componentFields = @("x", "y", "z", "w")
 $namings = @(@("x", "y", "z", "w"), @("r", "g", "b", "a"))
 
@@ -86,6 +99,20 @@ foreach ($family in $families) {
             }
         }
 
+        foreach ($source in @("float", "int", "bool")) {
+            $expression = $conversions["$scalar<-$source"]
+            if (-not $expression) { continue }
+            $converted = for ($i = 0; $i -lt $size; $i++) { $expression -f "value.$($componentFields[$i])" }
+            Line "    public $type($source$size value) : this($($converted -join ', ')) { }"
+            if ($family.Functions) {
+                $functionLines.Add("    public static $type $type($source$size value) => new(value);")
+            }
+        }
+        if ($scalar -eq "float" -and $family.Functions) {
+            # floatN(int) splat: without it floatN(0) is ambiguous between floatN(float) and floatN(intN).
+            $functionLines.Add("    public static $type $type(int value) => new($((@('value') * $size) -join ', '));")
+        }
+
         # Single-component color aliases; x/y/z/w are the fields themselves.
         $letters = $namings[1]
         for ($i = 0; $i -lt $size; $i++) {

packages/cultmath/unity/org.gamecult.cultmath/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to this package are documented in this file.
+
+Earlier releases (0.2.0-0.2.3) predate this package's changelog and are not
+backfilled here; see `docs/semver-policy.md` for why.
+
+## [0.2.4]
+
+### Added
+
+- `math.erf` and `math.erfinv`: single-precision error function and its
+  inverse. `erf` is the Abramowitz & Stegun 7.1.26 rational/exponential fit
+  (max absolute error 1.5e-7 by that source, 6.621e-7 measured here against
+  an independent reference). `erfinv` is Giles' minimax polynomial
+  ("Approximating the erfinv function", GPU Computing Gems, 2010), guarded
+  explicitly at the domain edges (`erfinv(1) = +Infinity`,
+  `erfinv(-1) = -Infinity`, outside `[-1, 1]` is `NaN`); measured worst
+  absolute error 5.066e-7, worst `erf(erfinv(y))` round trip 6.109e-7.

packages/cultmath/unity/org.gamecult.cultmath/CHANGELOG.md.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 0a6d25c5f7894c0d8e83f2b9d69358a4

packages/cultmath/unity/org.gamecult.cultmath/Shaders/CultMath.hlsl

@@ -11,7 +11,6 @@
 static const float CULTMATH_PI = 3.14159265358979323846;
 static const float CULTMATH_TAU = 6.28318530717958647692;
 static const float CULTMATH_HALF_PI = 1.57079632679489661923;
-static const float CULTMATH_NORMALIZE_EPSILON = 1.0e-20;
 
 float cultmath_radians(float degrees_value) { return degrees_value * (CULTMATH_PI / 180.0); }
 float cultmath_degrees(float radians_value) { return radians_value * (180.0 / CULTMATH_PI); }
@@ -171,10 +170,6 @@ float cultmath_distance(float2 left, float2 right) { return length(left - right)
 float cultmath_distance(float3 left, float3 right) { return length(left - right); }
 float cultmath_distance(float4 left, float4 right) { return length(left - right); }
 
-float2 cultmath_normalize(float2 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
-float3 cultmath_normalize(float3 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
-float4 cultmath_normalize(float4 value) { return value / max(length(value), CULTMATH_NORMALIZE_EPSILON); }
-
 float2 cultmath_reflect(float2 incident, float2 normal_value)
 {
     return incident - 2.0 * dot(normal_value, incident) * normal_value;
@@ -286,6 +281,38 @@ float cultmath_hash(float value) { return cultmath_frac(sin(value) * 43758.5453)
 float cultmath_hash(float2 value) { return cultmath_hash(dot(value, float2(127.1, 311.7))); }
 float cultmath_hash(float3 value) { return cultmath_hash(dot(value, float3(127.1, 311.7, 74.7))); }
 
+// PCG hashes (Jarzynski and Olano, JCGT 2020), written over scalar uints so CultMath's int3/int4 carry the bits.
+uint cultmath_pcg(uint value)
+{
+    uint state = value * 747796405u + 2891336453u;
+    uint word = ((state >> (int)((state >> 28) + 4)) ^ state) * 277803737u;
+    return (word >> 22) ^ word;
+}
+
+int3 cultmath_pcg3d(int3 value)
+{
+    uint x = (uint)value.x * 1664525u + 1013904223u, y = (uint)value.y * 1664525u + 1013904223u, z = (uint)value.z * 1664525u + 1013904223u;
+    x += y * z; y += z * x; z += x * y;
+    x ^= x >> 16; y ^= y >> 16; z ^= z >> 16;
+    x += y * z; y += z * x; z += x * y;
+    return int3((int)x, (int)y, (int)z);
+}
+
+int3 cultmath_pcg3d(float2 value) { return cultmath_pcg3d(float3(value, 0.0)); }
+int3 cultmath_pcg3d(float3 value) { return cultmath_pcg3d(int3((int)asuint(value.x), (int)asuint(value.y), (int)asuint(value.z))); }
+
+int4 cultmath_pcg4d(int4 value)
+{
+    uint x = (uint)value.x * 1664525u + 1013904223u, y = (uint)value.y * 1664525u + 1013904223u;
+    uint z = (uint)value.z * 1664525u + 1013904223u, w = (uint)value.w * 1664525u + 1013904223u;
+    x += y * w; y += z * x; z += x * y; w += y * z;
+    x ^= x >> 16; y ^= y >> 16; z ^= z >> 16; w ^= w >> 16;
+    x += y * w; y += z * x; z += x * y; w += y * z;
+    return int4((int)x, (int)y, (int)z, (int)w);
+}
+
+int4 cultmath_pcg4d(float4 value) { return cultmath_pcg4d(int4((int)asuint(value.x), (int)asuint(value.y), (int)asuint(value.z), (int)asuint(value.w))); }
+
 float cultmath_value_noise(float2 position)
 {
     float2 cell = floor(position);

packages/cultmath/unity/org.gamecult.cultmath/package.json

@@ -1,7 +1,7 @@
 {
   "name": "org.gamecult.cultmath",
   "displayName": "CultMath",
-  "version": "0.2.0",
+  "version": "0.2.4",
   "unity": "2021.3",
   "description": "Precompiled CultMath numeric primitives and matching HLSL semantics for GameCult Unity runtimes.",
   "license": "MPL-2.0",

packages/cultmesh-browser/src/index.ts

@@ -15,42 +15,28 @@ import {
   type CultMeshSessionAcceptedMessage,
   type CultMeshSessionOpenMessage,
 } from "cultnet-ts/contracts";
+import {
+  base64ToBytes,
+  bytesToBase64,
+  isLoopbackEndpoint,
+  isUnsignedCertificate,
+  routeCertificateView,
+  verifyAuthorityRoute,
+  verifyProviderSessionProof,
+  type CultMeshAuthorityIdentity,
+  type CultMeshAuthorityRouteCertificate,
+  type CultMeshAuthorityRouteView,
+  type CultMeshAuthorityTrustMode,
+  type CultMeshAuthorityTrustPolicy,
+  type CultMeshP256PublicKey,
+} from "cultnet-ts/authority";
 
-export interface CultMeshBrowserIdentity {
-  verseId: string;
-  authorityRuntimeId: string;
-}
-
-export interface CultMeshBrowserRoute extends CultMeshBrowserIdentity {
-  endpoint: string;
-  protocolId?: string;
-  protocolIds?: readonly string[];
-  priority?: number;
-  generation: string;
-  certificate?: CultMeshBrowserRouteCertificate;
-}
-
-export interface CultMeshBrowserP256PublicKey {
-  keyId: string;
-  x: string;
-  y: string;
-}
-
-export interface CultMeshBrowserRouteCertificate {
-  providerKey: CultMeshBrowserP256PublicKey;
-  odinKeyId: string;
-  issuedAtUnixMilliseconds: number;
-  expiresAtUnixMilliseconds: number;
-  signature: string;
-}
-
-export type CultMeshBrowserAuthorityTrustMode = "authenticated-remote" | "local-development";
-
-export interface CultMeshBrowserAuthorityTrustPolicy {
-  mode: CultMeshBrowserAuthorityTrustMode;
-  odinRoots?: readonly CultMeshBrowserP256PublicKey[];
-  now?: () => number;
-}
+export type CultMeshBrowserIdentity = CultMeshAuthorityIdentity;
+export type CultMeshBrowserRoute = CultMeshAuthorityRouteView;
+export type CultMeshBrowserP256PublicKey = CultMeshP256PublicKey;
+export type CultMeshBrowserRouteCertificate = CultMeshAuthorityRouteCertificate;
+export type CultMeshBrowserAuthorityTrustMode = CultMeshAuthorityTrustMode;
+export type CultMeshBrowserAuthorityTrustPolicy = CultMeshAuthorityTrustPolicy;
 
 export interface CultMeshBrowserRendezvous {
   resolve(
@@ -794,19 +780,6 @@ export function decodeCultNetOperationPayload<T>(response: CultNetOperationRespo
   return decode(base64ToBytes(response.payload)) as T;
 }
 
-function bytesToBase64(bytes: Uint8Array): string {
-  let binary = "";
-  for (let offset = 0; offset < bytes.length; offset += 0x8000) {
-    binary += String.fromCharCode(...bytes.subarray(offset, offset + 0x8000));
-  }
-  return btoa(binary);
-}
-
-function base64ToBytes(value: string): Uint8Array {
-  const binary = atob(value);
-  return Uint8Array.from(binary, character => character.charCodeAt(0));
-}
-
 function requireWebSocketEndpoint(value: string, field: string): URL {
   let endpoint: URL;
   try {
@@ -898,17 +871,7 @@ async function selectOdinRoute(
       protocolIds: route.protocolIds,
       priority: route.priority,
       generation: route.generation,
-      ...(route.certificate ? { certificate: {
-        providerKey: {
-          keyId: route.certificate.providerKeyId,
-          x: route.certificate.providerPublicKeyX,
-          y: route.certificate.providerPublicKeyY,
-        },
-        odinKeyId: route.certificate.odinKeyId,
-        issuedAtUnixMilliseconds: route.certificate.issuedAtUnixMilliseconds,
-        expiresAtUnixMilliseconds: route.certificate.expiresAtUnixMilliseconds,
-        signature: route.certificate.signature,
-      } } : {}),
+      ...(route.certificate ? { certificate: routeCertificateView(route.certificate) } : {}),
     };
     try {
       await verifyAuthorityRoute(candidate, trust);
@@ -941,136 +904,26 @@ async function validateSessionAcceptance(
       `expected '${request.verseId}/${request.authorityRuntimeId}/${protocolId}/${route.generation}'.`,
     );
   }
-  if (trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint) && !route.certificate) return undefined;
+  // `CultMeshVerifiedAuthorityRoute.IsLocalDevelopment` in C#: an unsigned
+  // loopback route under local-development needs no provider session proof.
+  if (trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint) && isUnsignedCertificate(route.certificate)) {
+    return undefined;
+  }
   const providerKey = route.certificate?.providerKey;
   if (!providerKey || message.providerKeyId !== providerKey.keyId || !message.providerSignature) {
     return new Error("CultMesh authority did not prove possession of the Odin-certified provider key.");
   }
-  if (!await verifyP256(providerKey, canonicalSession(request, route.endpoint), message.providerSignature)) {
+  if (!await verifyProviderSessionProof(request, route.endpoint, providerKey, message.providerSignature)) {
     return new Error("CultMesh provider session proof is invalid.");
   }
   return undefined;
 }
 
-async function verifyAuthorityRoute(
-  route: CultMeshBrowserRoute,
-  trust: CultMeshBrowserAuthorityTrustPolicy,
-): Promise<void> {
-  const certificate = route.certificate;
-  if (!certificate) {
-    if (trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint)) return;
-    throw new Error("Remote CultMesh routes require an Odin-signed authority certificate.");
-  }
-  const endpoint = new URL(route.endpoint);
-  if (endpoint.protocol !== "wss:" && !(trust.mode === "local-development" && isLoopbackEndpoint(route.endpoint))) {
-    throw new Error("Authenticated remote CultMesh browser routes require wss:// channel protection.");
-  }
-  const now = trust.now?.() ?? Date.now();
-  if (now < certificate.issuedAtUnixMilliseconds || now >= certificate.expiresAtUnixMilliseconds) {
-    throw new Error("The Odin route certificate is not currently valid.");
-  }
-  const root = trust.odinRoots?.find(candidate => candidate.keyId === certificate.odinKeyId);
-  if (!root) throw new Error(`Odin key '${certificate.odinKeyId}' is not trusted by this consumer.`);
-  if (!await verifyP256(root, canonicalRoute(route), certificate.signature)) {
-    throw new Error("The Odin route certificate signature is invalid.");
-  }
-}
-
-function canonicalRoute(route: CultMeshBrowserRoute): Uint8Array {
-  const certificate = route.certificate!;
-  return canonicalFields(
-    "gamecult.cultmesh.route-certificate.v1",
-    route.verseId,
-    route.authorityRuntimeId,
-    route.endpoint,
-    [...(route.protocolIds ?? [route.protocolId ?? "cultmesh.documents.v1"])].sort().join("\u001f"),
-    String(route.priority ?? 0),
-    route.generation,
-    certificate.providerKey.keyId,
-    certificate.providerKey.x,
-    certificate.providerKey.y,
-    certificate.odinKeyId,
-    String(certificate.issuedAtUnixMilliseconds),
-    String(certificate.expiresAtUnixMilliseconds),
-  );
-}
-
-function canonicalSession(request: CultMeshSessionOpenMessage, endpoint: string): Uint8Array {
-  return canonicalFields(
-    "gamecult.cultmesh.session-proof.v1",
-    request.clientNonce,
-    request.messageId,
-    request.sourceRuntimeId,
-    request.verseId,
-    request.authorityRuntimeId,
-    request.protocolId,
-    endpoint,
-    request.routeGeneration,
-  );
-}
-
-function canonicalFields(...values: string[]): Uint8Array {
-  const encoder = new TextEncoder();
-  const encoded = values.map(value => encoder.encode(value));
-  const total = encoded.reduce((sum, value) => sum + 4 + value.byteLength, 0);
-  const result = new Uint8Array(total);
-  const view = new DataView(result.buffer);
-  let offset = 0;
-  for (const value of encoded) {
-    view.setUint32(offset, value.byteLength, false);
-    offset += 4;
-    result.set(value, offset);
-    offset += value.byteLength;
-  }
-  return result;
-}
-
-async function verifyP256(
-  key: CultMeshBrowserP256PublicKey,
-  payload: Uint8Array,
-  signatureBase64: string,
-): Promise<boolean> {
-  try {
-    const x = base64ToBytes(key.x);
-    const y = base64ToBytes(key.y);
-    const signature = base64ToBytes(signatureBase64);
-    if (x.byteLength !== 32 || y.byteLength !== 32 || signature.byteLength !== 64) return false;
-    const raw = new Uint8Array(65);
-    raw[0] = 4;
-    raw.set(x, 1);
-    raw.set(y, 33);
-    const publicKey = await crypto.subtle.importKey(
-      "raw",
-      raw.slice().buffer as ArrayBuffer,
-      { name: "ECDSA", namedCurve: "P-256" },
-      false,
-      ["verify"],
-    );
-    return await crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-256" },
-      publicKey,
-      signature.slice().buffer as ArrayBuffer,
-      payload.slice().buffer as ArrayBuffer,
-    );
-  } catch {
-    return false;
-  }
-}
-
 function randomNonce(): string {
   const bytes = crypto.getRandomValues(new Uint8Array(32));
   return bytesToBase64(bytes);
 }
 
-function isLoopbackEndpoint(value: string): boolean {
-  try {
-    const host = new URL(value).hostname.replace(/^\[|\]$/g, "").toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "::1";
-  } catch {
-    return false;
-  }
-}
-
 function requireText(value: string, field: string): void {
   if (!value || value.trim().length === 0) throw new Error(`CultMesh browser ${field} is required.`);
 }

packages/cultmesh-browser/test/cultmesh-browser.test.ts

@@ -236,6 +236,54 @@ test("browser client rejects a credential-free authority impersonator", async ()
   );
 });
 
+test("browser client opens an unsigned-certificate loopback session under local-development without a provider proof, as in C#", async () => {
+  const connect = (route: CultMeshBrowserRoute, trust: { mode: "local-development" | "authenticated-remote"; odinRoots: CultMeshBrowserP256PublicKey[] }) =>
+    CultMeshBrowserClient.connect({
+      ...route,
+      runtimeId: "browser-unsigned-certificate-test",
+      rendezvous: { resolve: async () => route },
+      trust,
+      socketFactory: () => handshakeOnlySocket(route),
+    });
+  const blank = (route: CultMeshBrowserRoute, signature: string) =>
+    ({ ...route, certificate: { ...route.certificate!, signature } });
+
+  const loopback = await createSignedRoute("ws://127.0.0.1:4501/mesh");
+  const localTrust = { mode: "local-development" as const, odinRoots: [loopback.odinPublic] };
+  const remote = await createSignedRoute("wss://provider.example/mesh");
+
+  // Empty is the easy case. The whitespace signatures are the ones that catch a
+  // local re-reading of "unsigned" here: an inline `signature === ""` passes
+  // every other test in this file and fails these, and U+0085 also separates
+  // `String.prototype.trim` from the C# `char.IsWhiteSpace` the shared
+  // `isUnsignedCertificate` uses. Both sides of the session check have to read
+  // "unsigned" the same way, or the route verifier accepts a session the
+  // acceptance check then demands a provider proof for.
+  for (const signature of ["", "   ", "\u0085", "\u00a0\t\n"]) {
+    const label = JSON.stringify(signature);
+    const client = await connect(blank(loopback.route, signature), localTrust);
+    assert.equal(client.state, "connected", label);
+    await client.dispose();
+    await assert.rejects(
+      connect(blank(remote.route, signature), { mode: "local-development", odinRoots: [remote.odinPublic] }),
+      /Odin-signed authority certificate/,
+      label,
+    );
+    await assert.rejects(
+      connect(blank(remote.route, signature), { mode: "authenticated-remote", odinRoots: [remote.odinPublic] }),
+      /Odin-signed authority certificate/,
+      label,
+    );
+  }
+  // U+FEFF is whitespace to JavaScript and not to C#, so it is a signature, not
+  // an unsigned route, and the loopback route is refused for its bytes.
+  await assert.rejects(connect(blank(loopback.route, "\ufeff"), localTrust), /not base64|not IEEE P1363/);
+
+  // A signed loopback certificate is an authenticated route even under
+  // local-development; the provider must still prove its key.
+  await assert.rejects(connect(loopback.route, localTrust), /did not prove possession/);
+});
+
 test("browser client rejects a mutated or expired signed route before opening a provider socket", async () => {
   const fixture = await createSignedRoute("wss://provider.example/mesh");
   let opened = false;

packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt

@@ -1359,7 +1359,7 @@ fun defineCultNetSchemaDescriptor(
     schemaJson = schemaJson,
 )
 
-private const val cultNetSchemaBase = "https://github.com/GameCult/cultnet-ts/contracts"
+private const val cultNetSchemaBase = "https://github.com/GameCult/CultLib/contracts/cultnet"
 
 private data class CultNetBuiltInSchemaSpec(
     val schemaVersion: String,
@@ -1377,58 +1377,58 @@ private val cultNetBuiltInSchemaSpecs = listOf(
         title = "CultNet Hello Message",
         schemaId = "$cultNetSchemaBase/cultnet.hello.schema.json",
         requiredFields = listOf("schemaVersion", "runtimeId", "runtimeKind"),
-        contentHash = "1d2114bf0c92a2dd5e07dd735778ceeb939402c6424550d6d281d9db423f56b3",
+        contentHash = "f660ef803f293e2882650b3981c6eed835bd8e595c9b880d6c6271e0dcbd79e4",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.document_delete.v0",
         title = "CultNet Document Delete Message",
         schemaId = "$cultNetSchemaBase/cultnet.document-delete.schema.json",
         requiredFields = listOf("schemaVersion", "messageId", "schemaId", "recordKey"),
-        contentHash = "037f7cf1b30756904e0bfada6bcff486269378997afbe3c4b6fc5c573fc8a4df",
+        contentHash = "ed7dc202e4f1ebe0d88c5d60c81c53005b44a2557698d3d3c5d2126c01b40f08",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.document_put_raw.v0",
         title = "CultNet Raw Document Put Message",
         schemaId = "$cultNetSchemaBase/cultnet.document-put-raw.schema.json",
-        contentHash = "b61e7e6cce8508653fbeccc4d956ef211c853a174d67c7e1903ce294e15985a2",
+        contentHash = "34b61b14b49cfc887728673f08aa0f33df7ccd401e79c77d3bc324c72e547177",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.snapshot_request.v0",
         title = "CultNet Snapshot Request Message",
         schemaId = "$cultNetSchemaBase/cultnet.snapshot-request.schema.json",
-        contentHash = "9f6546f51a1aab85978554e6908d7a59e96b3329feff7b35022be210495dd721",
+        contentHash = "05267d9b5eb450d4aa8979179f74ba3aec2f3a82fead7ba4a16ab5462c7750fa",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.snapshot_response_raw.v0",
         title = "CultNet Raw Snapshot Response Message",
         schemaId = "$cultNetSchemaBase/cultnet.snapshot-response-raw.schema.json",
-        contentHash = "0dbca3338a3ae5d4011aed2c973c75b9b47b6b9dfc0874459ac56da01fef4582",
+        contentHash = "fdefbdf5d6b0844dd0eabe2c7430d054295d78e41289f96b227dc39f4aab78b9",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.schema_catalog_request.v0",
         title = "CultNet Schema Catalog Request Message",
         schemaId = "$cultNetSchemaBase/cultnet.schema-catalog-request.schema.json",
         wireContracts = listOf("cultnet.schema.v0", "gamecult.networking.v0"),
-        contentHash = "bdd49b44428daf24b514c521e53027ec944aecfebb39ca0d10967661c303e096",
+        contentHash = "ed6d63e29de2d492bb831f030b26ff49ba6883cd2be791ec4936c385f765c76a",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.schema_catalog_response.v0",
         title = "CultNet Schema Catalog Response Message",
         schemaId = "$cultNetSchemaBase/cultnet.schema-catalog-response.schema.json",
         wireContracts = listOf("cultnet.schema.v0", "gamecult.networking.v0"),
-        contentHash = "b158de53d1ca614eacf2e05767122fb4b9e06504c037ad76c649cffdf71dd648",
+        contentHash = "10b4835d33181fe4b93a33e39b63886c5514899e93682de786e298f7e4a213e9",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.shard_catalog_request.v0",
         title = "CultNet Shard Catalog Request Message",
-        schemaId = "cultnet.shard_catalog_request.v0",
-        contentHash = "0abd131a1db12f6731010333b86e104d550160bd58f539b18413a2b61198fa38",
+        schemaId = "$cultNetSchemaBase/cultnet.shard-catalog-request.schema.json",
+        contentHash = "b4edecd8a24f68ebccf0aca9b429d234618ff7e8858a10123d0b328aeae7eb3f",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.shard_catalog_response.v0",
         title = "CultNet Shard Catalog Response Message",
-        schemaId = "cultnet.shard_catalog_response.v0",
-        contentHash = "93a0e90ac81bc6ab21b68925ad25e381edfac8773232333679d3275141cff37b",
+        schemaId = "$cultNetSchemaBase/cultnet.shard-catalog-response.schema.json",
+        contentHash = "d86a94c57d7820483912b8b5cef6214ac951d34cb2641d2d21dcb1f1bc0263c0",
     ),
     CultNetBuiltInSchemaSpec(
         schemaVersion = "cultnet.shard_log_request.v0",
@@ -1468,7 +1468,7 @@ private val cultNetBuiltInSchemaSpecs = listOf(
         schemaId = "$cultNetSchemaBase/cultnet.transport-profile.schema.json",
         kind = "shared_contract",
         requiredFields = listOf("schemaVersion", "runtimeId", "transports"),
-        contentHash = "84473264f543ca3443267999e43d72b7993b61b7b2ac53c642c9cbe8b6de0217",
+        contentHash = "63dfd484e1fd332c167caadf52cb5b4fe12d5ffea4415206c3ef111c196507aa",
     ),
 )
 
@@ -3717,16 +3717,16 @@ private fun cultNetReconnectControllerSchedulesAttemptsAndReset() {
 private const val interopDocumentType = "cultnet.interop-note"
 private const val interopSchemaVersion = "cultnet.interop_note.v0"
 private const val interopMutationIntentType = "cultnet.interop-note-mutation-intent"
-private const val interopMutationIntentSchemaId = "https://github.com/GameCult/cultnet-ts/integration/contracts/cultnet.interop-note-mutation-intent.schema.json"
+private const val interopMutationIntentSchemaId = "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.interop-note-mutation-intent.schema.json"
 private const val interopMutationIntentSchemaVersion = "cultnet.interop_note_mutation_intent.v0"
 private const val interopMutationReceiptType = "cultnet.interop-note-mutation-receipt"
-private const val interopMutationReceiptSchemaId = "https://github.com/GameCult/cultnet-ts/integration/contracts/cultnet.interop-note-mutation-receipt.schema.json"
+private const val interopMutationReceiptSchemaId = "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.interop-note-mutation-receipt.schema.json"
 private const val interopMutationReceiptSchemaVersion = "cultnet.interop_note_mutation_receipt.v0"
 private const val interopFireCommandType = "cultnet.interop-fire-weapon-command"
-private const val interopFireCommandSchemaId = "https://github.com/GameCult/cultnet-ts/integration/contracts/cultnet.interop-fire-weapon-command.schema.json"
+private const val interopFireCommandSchemaId = "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.interop-fire-weapon-command.schema.json"
 private const val interopFireCommandSchemaVersion = "cultnet.interop_fire_weapon_command.v0"
 private const val interopFireReceiptType = "cultnet.interop-fire-weapon-receipt"
-private const val interopFireReceiptSchemaId = "https://github.com/GameCult/cultnet-ts/integration/contracts/cultnet.interop-fire-weapon-receipt.schema.json"
+private const val interopFireReceiptSchemaId = "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.interop-fire-weapon-receipt.schema.json"
 private const val interopFireReceiptSchemaVersion = "cultnet.interop_fire_weapon_receipt.v0"
 private const val rudpInteropConnectionId = 0x43554c54L
 private const val rudpInteropMaxFragmentBytes = 1024
@@ -4627,11 +4627,11 @@ private fun cultNetBuiltInSchemaCatalogAdvertisesWireContracts() {
     check(schemaCatalogRequest["wireContracts"] == listOf("cultnet.schema.v0", "gamecult.networking.v0"))
     check(!schemaCatalogRequest.containsKey("schemaJson"))
     val shardCatalogRequest = schemas.single { it["schemaVersion"] == "cultnet.shard_catalog_request.v0" }
-    check(shardCatalogRequest["schemaId"] == "cultnet.shard_catalog_request.v0")
+    check(shardCatalogRequest["schemaId"] == "$cultNetSchemaBase/cultnet.shard-catalog-request.schema.json")
     check(shardCatalogRequest["wireContracts"] == listOf("cultnet.schema.v0"))
-    check(shardCatalogRequest["contentHash"] == "0abd131a1db12f6731010333b86e104d550160bd58f539b18413a2b61198fa38")
+    check(shardCatalogRequest["contentHash"] == "b4edecd8a24f68ebccf0aca9b429d234618ff7e8858a10123d0b328aeae7eb3f")
     val shardCatalogResponse = schemas.single { it["schemaVersion"] == "cultnet.shard_catalog_response.v0" }
-    check(shardCatalogResponse["schemaId"] == "cultnet.shard_catalog_response.v0")
+    check(shardCatalogResponse["schemaId"] == "$cultNetSchemaBase/cultnet.shard-catalog-response.schema.json")
     check(shardCatalogResponse["wireContracts"] == listOf("cultnet.schema.v0"))
 
     val inlineCatalog = cultNetBuiltInSchemaCatalog(includeSchemaJson = true)
@@ -4644,7 +4644,7 @@ private fun cultNetBuiltInSchemaCatalogAdvertisesWireContracts() {
     )
     val transportProfile = mapList(transportResponse.body["schemas"]).single()
     check(transportProfile["kind"] == "shared_contract")
-    check(transportProfile["contentHash"] == "84473264f543ca3443267999e43d72b7993b61b7b2ac53c642c9cbe8b6de0217")
+    check(transportProfile["contentHash"] == "63dfd484e1fd332c167caadf52cb5b4fe12d5ffea4415206c3ef111c196507aa")
     check(!transportProfile.containsKey("schemaJson"))
 
     val filteredTransportCatalog = CultMesh.createBuiltInSchemaCatalog(

packages/cultmesh-py/tests/test_cultmesh.py

@@ -1759,11 +1759,11 @@ class CultMeshTests(unittest.TestCase):
             )
             self.assertEqual(
                 builtins.list()[0].schema_id,
-                "https://github.com/GameCult/cultnet-ts/contracts/cultnet.transport-profile.schema.json",
+                "https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.transport-profile.schema.json",
             )
             self.assertIsNone(builtins.list()[0].schema_json)
             peer_exchange_schema_id = (
-                "https://github.com/GameCult/cultnet-ts/contracts/cultmesh.peer-exchange-request.schema.json"
+                "https://github.com/GameCult/CultLib/contracts/cultnet/cultmesh.peer-exchange-request.schema.json"
             )
             filtered_builtin = CultMesh.create_builtin_schema_catalog(
                 include_schema_json=True,
@@ -4033,7 +4033,7 @@ class CultMeshTests(unittest.TestCase):
         self.assertIn("cultmesh.peer_exchange_response.v0", wire_descriptors)
         self.assertIn("cultnet.error.v0", {descriptor.schema_version for descriptor in synced_wire_descriptors})
         self.assertIn("cultnet.document_put_raw.v0", {descriptor.schema_version for descriptor in synced_wire_descriptors})
-        self.assertIsNotNone(synced_schema_catalog.get("https://github.com/GameCult/cultnet-ts/contracts/cultnet.document-put-raw.schema.json"))
+        self.assertIsNotNone(synced_schema_catalog.get("https://github.com/GameCult/CultLib/contracts/cultnet/cultnet.document-put-raw.schema.json"))
         self.assertEqual(snapshot_response["documents"][0]["recordKey"], "note:1")
         self.assertEqual(typed_snapshot_response.documents[0].record_key, "note:1")
         self.assertEqual(typed_snapshot_response.documents[0].schema_id, "mesh.server_note.v1")
@@ -4317,6 +4317,14 @@ class CultMeshTests(unittest.TestCase):
                 {"schemaVersion": "cultnet.document_delete.v0", "messageId": "bad-delete", "schemaId": "mesh.error_note.v1"},
                 expected_schema_version="cultnet.error.v0",
             )
+            # R-2, owed by Cut 1 (docs/cultnet-selection-cut.md, section 9): this v0-only Mesh server
+            # refuses a cultnet.selection.v1 carrier message through the same delegating path
+            # (_handle_connection_message -> handle_message) as any other unsupported schema, not a
+            # silent empty response.
+            unsupported_v1 = raw_client.request(
+                {"schemaVersion": "cultnet.snapshot_request.v1", "messageId": "bad-v1-selection"},
+                expected_schema_version="cultnet.error.v0",
+            )
         finally:
             server.stop()
 
@@ -4328,6 +4336,9 @@ class CultMeshTests(unittest.TestCase):
         self.assertEqual(malformed_put["code"], "malformed_document_put")
         self.assertEqual(malformed_delete["messageId"], "bad-delete")
         self.assertEqual(malformed_delete["code"], "malformed_document_delete")
+        self.assertEqual(unsupported_v1["messageId"], "bad-v1-selection")
+        self.assertEqual(unsupported_v1["code"], "unsupported_schema_version")
+        self.assertEqual(unsupported_v1["details"]["schemaVersion"], "cultnet.snapshot_request.v1")
 
     def test_cultmesh_authority_lease_requires_live_matching_lease(self) -> None:
         peer = CultMeshPeerCard(

packages/cultmesh-rs/src/lib.rs

@@ -820,7 +820,7 @@ pub fn request_raw_snapshot_from_rudp_catalog(
                     } if received == &message_id => {
                         snapshot_response = Some(message);
                     }
-                    cultnet_rs::CultNetMessage::Error { error } => {
+                    cultnet_rs::CultNetMessage::Error { error, .. } => {
                         let _ = client.disconnect(b"snapshot-error".to_vec());
                         anyhow::bail!("CultMesh RUDP snapshot failed: {error}");
                     }

packages/cultmesh-ts/native/MANIFEST.txt

@@ -0,0 +1,9 @@
+msquic.version=2.5.9
+msquic.windows.source=https://www.nuget.org/api/v2/package/Microsoft.Native.Quic.MsQuic.OpenSSL/2.5.9 sha256=FEE9A664C0052DEEE66D40CED2E19BFE20BC423DE5AE5234CFC0CEBC22CA3F5E
+msquic.linux.source=https://packages.microsoft.com/debian/13/prod/pool/main/libm/libmsquic/libmsquic_2.5.9_amd64.deb sha256=1baa61ade0b7b4a99f6dcb6b00d9aedb12b5566d00918a325be7425e878e51ba
+bridge.commit=e5bf1c9243acb6b76de72c7864e3b79214177199
+build.workflow_run=https://github.com/GameCult/CultLib/actions/runs/35912386052
+build.release=none (TEMPORARY push-to-quic-cut6 trigger, no tag; see quic-native.yml history for the tagged release path)
+build.win32-x64.host=windows-2025-vs2026, cl.exe (MSVC) 19.51.36256.0
+build.linux-x64.host=ubuntu-24.04, container debian:13@sha256:f324c7ff54321e8d9c588493a20244965938ce0aa50bbd1022d38010e9ffc4b1, g++ (Debian 14.2.0-19) 14.2.0
+date=2026-09-23T19:54:08Z

packages/cultmesh-ts/native/MSQUIC-LICENSE.txt

@@ -0,0 +1,21 @@
+Copyright (c) Microsoft Corporation.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/cultmesh-ts/native/SHA256SUMS

@@ -0,0 +1,4 @@
+9dae391a44d59f12e19baa08a44d86c7e8b4916ca5d40007a42d65913ce0896f *win32-x64/gamecult_mesh_quic_native.dll
+c17c65813fe007eb486a5270d244f3659261355795b27abb99bd19ff77539263 *win32-x64/msquic.dll
+0ee3d28324c79a5b0135368187e7bd75c1969ad94fc6985755e81de4ec96e430 *linux-x64/libgamecult_mesh_quic_native.so
+c09a72f9b3bfd9119044b305c6064731c1e1879411e6f54276474fb58b524b68 *linux-x64/libmsquic.so.2