Record ordered input field closure

docs/research/moonlight-muninn-sleipnir-study-2026-07-16.md

@@ -293,3 +293,41 @@ deliberately. CultNet's fragmented-message ID previously saturated at the
 maximum `u16`, so fragmented audio became unreassemblable after the boundary.
 Wrap-to-one plus a boundary test removed the repeatable minute-eight collapse;
 a subsequent 10-minute direct LAN run remained clean across the boundary.
+
+## 2026-07-17 ordered-input closure
+
+The quick-tap gate exposed four authorities that generic RUDP reliability had
+blurred together:
+
+- A Windows sleep requested at two milliseconds could still miss a short tap.
+  Muninn now observes XInput on a dedicated high-resolution worker; transport,
+  discovery, serialization, and logging cannot delay capture.
+- Global cumulative ACKs could not retire a reliable packet arriving more than
+  32 realtime sequence numbers late, and reliable duplicates were not ACKed
+  after application deduplication. CultNet now directly acknowledges the late
+  packet and acknowledges reliable duplicates. This collapsed a runaway field
+  trace from hundreds of thousands of resend datagrams to a bounded flow.
+- Muninn used semantic application ACK as permission to send the next edge.
+  One delayed ACK therefore serialized the entire controller. It now sends a
+  bounded window of captured edges; CultNet owns retransmission, Sleipnir's
+  epoch/sequence cursor owns ordering, and semantic ACK only retires history.
+- Sleipnir published CultMesh/Eve and Idunn state synchronously on the actuator
+  thread. Those writes produced 0.7-1.8 second visible button holds. A bounded
+  coalescing publisher worker now owns control-plane projection, leaving the
+  input thread to receive, order, actuate, and acknowledge.
+
+The resulting first-hot-plug field proof generated 100 taps with a 16 ms source
+press and 84 ms gap. Under seeded 1% independent loss, every layer observed
+exactly 100 presses and 100 releases; Raven-visible durations were 24-57 ms.
+Under eight consecutive dropped packets every 200 datagrams, every layer again
+observed exactly 100 presses and 100 releases; visible durations were 24-40 ms,
+the final virtual pad was neutral, and the impairment proxy reported no queue
+overflow. Raven ran through hidden scheduled tasks over `192.168.1.0/24`; no
+WireGuard route participated. Both daemons used the Eve/Aetheria/VoidBot
+experimental CultLib lineage pinned at `8965f3c0`.
+
+This closes ordered digital edges at one 60 Hz source frame. It does not prove
+sub-frame synthetic ViGEm pulses: eight-millisecond state-only pulses can fall
+between XInput snapshots, and `XInputGetKeystroke` was rejected after it emitted
+stale events from a reused user slot. Analog motion under a sender stall,
+mixed media/input endurance, glass-to-glass video age, and A/V skew remain open.

state/evidence.jsonl

@@ -200,3 +200,5 @@
 {"ts": "2026-07-17T02:34:05+01:00", "type": "verification", "status": "ok", "note": "Receiver completed-frame tombstones eliminated false post-FEC ghost assemblies: a 7-minute LAN run forwarded 54,000 payloads with zero video assembly expiry before an experimental weighted sender scheduler independently caused audio queue eviction; the scheduler was deleted. A later genuine 24-datagram tail burst left a frame 18/33 with only the leading 8 of 16 bookended parity shards available, proving V3 frame-wide bookends still need Moonlight-style multi-block FEC."}
 {"ts": "2026-07-17T02:58:43+01:00", "type": "rejected_path", "status": "ok", "note": "Adaptive frame-wide parity was tested and removed: 32 dispersed shards still expired a frame during a 54-datagram gap, and 64-shard production recovery violated the 50 ms CPU bound. V4 must use smaller independently recoverable blocks rather than a frame-wide bandwidth/matrix arms race. Periodic audio skips were traced separately to seven orphaned Raven WASAPI capture workers left by forced parent stops; the hidden scheduled task now reaps only stale Muninn, FFmpeg, encoder, and loopback workers before launching exactly one sender tree."}
 {"ts":"2026-07-17T08:15:00+01:00","type":"verification","status":"partial","note":"Raven LAN Moonlight field pass used hidden scheduled tasks, no WireGuard, and experimental CultLib 8965f3c0. Seeded 1% media loss completed 99.93% of 14,400 additional OBS payload groups without expiry (10 expiries), with zero audio failures/skips and no impairment-proxy queue overflow. Sleipnir neutralized the non-neutral virtual Xbox pad after 1.56 s of input loss and automatically recovered. A 64-packet continuous receive drain caused 48-57 ms receive-to-apply delay; a 2 ms drain budget reduced typical live receiver-owned delay to 69-204 us. Cross-host raw clock subtraction was removed from latency telemetry. One 16 ms spike, quick-tap edge impairment, 5%/burst input, glass-to-glass age, A/V skew, and mixed soak remain open."}
+{"ts": "2026-07-17T10:37:54+01:00", "type": "verification", "status": "ok", "note": "Ordered Muninn/Sleipnir input field proof closed one-frame quick taps over Raven LAN with hidden tasks, no WireGuard, and experimental CultLib 8965f3c0. Dedicated XInput capture, bounded non-stop-and-wait reliable edges, late/duplicate CultNet ACK repair, 24 ms edge visibility, and asynchronous CultMesh/Eve publication produced exact 100/100 presses/releases under seeded 1% loss and exact 100/100 under burst-8; burst Raven-visible durations were 24-40 ms, final pad neutral, proxy queue overflow zero. Mixed media/input endurance, analog stall, glass-to-glass age, and A/V skew remain open."}
+{"ts": "2026-07-17T10:39:57+01:00", "type": "verification", "status": "ok", "note": "Raven execution is headless and LAN-only: Codex-Sleipnir-LAN-Proof and Codex-Raven-XInput-Edge-Observer are scheduled-task launches whose PowerShell actions use -NonInteractive -WindowStyle Hidden; both task metadata records are now Hidden=true. Raven exposes no WireGuard service. Remote administration used raven-local over 192.168.1.84."}

state/map.yaml

@@ -194,8 +194,23 @@ accepted_design:
     loss and recovered automatically. Bounding its continuous receive drain to
     2 ms reduced live receive-to-apply from roughly 48-57 ms to typically
     69-204 us. Cross-host source latency is now explicitly unavailable until a
-    clock offset/uncertainty model exists; a 16 ms receiver-side spike, edge
-    impairment proof, glass-to-glass age, A/V skew, and mixed soak remain open.
+    clock offset/uncertainty model exists.
+  - The 2026-07-17 ordered-input field cut removed transport and control-plane
+    stalls from the Muninn/Sleipnir path. Muninn observes XInput on a dedicated
+    1 kHz, one-millisecond-timer worker and derives exact button edges from
+    consecutive snapshots. Captured edges are sent as a bounded reliable
+    window; application ACKs retire history but never gate the next edge.
+    CultNet directly ACKs late reliable packets outside its 32-packet
+    cumulative window and ACKs reliable duplicates, preventing immortal resend
+    storms. Sleipnir actuates ordered edges for at least 24 ms and publishes
+    CultMesh/Eve/Idunn state on a separate coalescing worker. Raven field proof
+    over LAN, hidden tasks, experimental CultLib `8965f3c0`, and no WireGuard
+    produced exact 100/100 one-frame taps under seeded 1% loss and exact
+    100/100 under eight-packet bursts. Burst visible durations were 24-40 ms,
+    final state was neutral, and the impairment proxy had no queue overflow.
+    A steady-state 5% run was exact at 20/20; repeat the 100-tap 5% first-session
+    gate after the stale XInput keystroke path was deleted. Glass-to-glass age,
+    A/V skew, analog motion under stall, and mixed soak remain open.
   - Nightwing Muninn `d0eded6` now owns PSMoveAPI observation admission in each
     private Eye worker. It rejects stale, sub-2 px, out-of-frame, and
     discontinuous positions before the parent aggregates evidence; typed