ADR-0005: Land Lifecycle on Addressables — Per-Template Groups, Preload/Activate/Teardown on Tide Edges, the LandNet Object, and the Per-Template Memory Budget

Status

Accepted

Accepted 2026-08-28 — architecture-review-2026-08-28.md (verdict CONCERNS; review amendments applied before acceptance).

Date

2026-08-28

Engine Compatibility

Documents Amended by This ADR

ADR Dependencies

Context

Problem Statement

The tide is a pure function that decides what docks and when; nothing yet says how a land comes to physically exist on every machine, how it stops existing, and how that is kept inside 2 GB. The land-dock-undock quick-spec fixes the semantics and hands three things to an ADR: the Addressables group/label scheme, the per-template MB budget's owner and number (TR-ldu-007, TD-C4), and registry replication. ADR-0002 hands over a fourth: what "teardown release at drain step 3" means to the thing that despawns. ADR-0003 fixed LandInstance but not who produces it or when. This ADR closes all four and answers the question none of them asked — what is the land's network identity — because clients need one authoritative "gameplay exists" edge and the tide events fire on the host clock only.

Constraints

• Forbidden Patterns: no offline simulation; no tide-compensation; presentation clock never drives gameplay (ADR-0001 — the Presentation clock throws on a gameplay subscriber); host-rail mutations ride the one channel (ADR-0002) except as named here; layout() pure in Rules, LandLifecycle a Runtime adapter (ADR-0003); Validation.Run is pure and Addressables-free (ADR-0006).
• Tide Rule 8: arrival cosmetic only until exactly φ. Rule 9: at φ+W every player on the land is deposited at depositPoint (tone-safe). EC11: the AFK backstop at grace expiry is a hard teleport.
• Harvesting EC6/AC-31: teardown after any in-flight < φ+W resolution — ADR-0002 step 3.
• Art bible §8: one atlas per land template, 2048² cap, BC3 (RGBA32 on artifact), PPU 32, Point, no mips; home atlas BC7 (4096 permitted) persistent; UI atlas separate; draw calls < 100.
• 2 GB ceiling; Addressables approved for land load/unload; not for startup assets (engine reference).
• MVP 1 socket, 2–3 templates; Tier 1 3–4 sockets, 6–8 templates — a teardown can overlap the next preload, and one template can be docked on two sockets.

Requirements

• Preload at NextBoundary − PreloadLeadTime on every machine; activation at φ is a host-authoritative edge.
• Despawn + unload at φ+W+EvictionGrace, never earlier, only after drain step 3 released the socket; deposit at φ+W precedes teardown.
• Home + 1 docked + 1 preloading ≤ 2 GB and ≤ a per-template budget CI enforces without vacuous passes.
• LandInstance byte-identical per docking key (TR-ldu-002).
• KnownLandTemplates appends at first φ on the host only; permanent; stage-4 union; seeded.
• Missing/unloadable content is loud, never a silent Absent socket; the co-op blast radius is stated.

Decision

Alternative A: one local Addressables group per land template (visuals only), instantiated offshore as cosmetic at the preload instant, activated at φ by the host spawning a small non-addressable LandNet NetworkObject that is every peer's authoritative "gameplay exists" edge, and released at φ+W+EvictionGrace once drain step 3 has released the socket; LandLifecycle (Runtime) orchestrates and owns a 64 MB per-template budget enforced in CI from the Addressables build layout.

1. What is in the addressable, and what is not

Walkability is the prefab's TilemapCollider2D — local on every machine, identical because the asset is identical; movement is owner-authoritative so a client-local collider is right. An EditMode asset test asserts every CandidateCell and SpawnPoint lies on a walkable tile of its prefab. CandidateCells authoring: cells are exported from a designated Candidates_<band> Tilemap layer in the template prefab by an editor tool (owner: tools-programmer, first template story) — the same layer the walkability test reads; never hand-typed. CandidateCells order is load-bearing for determinism: the reader preserves authored array order (ADR-0006 explicit reads); a set/dictionary must never back this member.

2. Groups, labels, keys

• One local packed group per template: Land_<templateId> — Pack Together, local build/load paths, LZ4. Contents: the LandVisualPrefab and its SpriteAtlas in the same group; the atlas is referenced by exactly one addressable (this prefab), which is what makes the setup free of the duplicate-texture pitfall — necessary (same group) and sufficient (single consumer), both by construction.
• Address key land/<templateId> = TemplateDef.AddressableKey (stage 7 asserts the equality — a pure string check). Label land on every template prefab.
• No core group. Home island, player, hats: direct references; the home atlas is a scene-referenced SpriteAtlas (BC7, ≤ 4096²); the UI atlas is separate and non-addressable. Nothing else is addressable at MVP; a future remote/DLC group is a new ADR (no Required-ADR row is reserved for it).
• LandNet is not addressable — a plain prefab in NetworkPrefabsList.

3. Lifecycle — the four edges

The tide-edge carve-out (named, bounded). LandNet spawn/despawn and IKnownLandTemplates.Append are host-rail mutations that do not ride HostCommitQueue. An ICommand models a player intent with an owner and a client sequence; a tide edge has neither, and the queue's arrival-order and soft-close-drop semantics are meaningless for it. Bound: exactly these operations, all driven by ITideClock events on the Authority clock, host-only, reading no player state. Ordering: they run inside the tide adapter's Advance, which ADR-0002 step 1 already places before that tick's drain — a φ activation is visible to every command drained in the same tick. A third tide-driven host-rail mutation requires an amendment. Registered as tide_edge_carve_out; architecture invariant 4 gains this as its one exception.

The presentation-clock carve-out (named, type-checked). ADR-0001's Presentation clock throws on any gameplay subscriber. Client preload must nevertheless start before φ, and an asset load is not a gameplay decision. Mechanism: TideClock implements a second, narrow interface in both roles —

public interface IPreloadSchedule { long NextPreloadInstant(int socket); TemplateId NextTemplate(int socket); long NextEvictionInstant(int socket); }  // Driftlands.Tide

int socket, not SocketId; NextEvictionInstant on the pull surface (2026-09-07, review U1 / #13). SocketId is a Driftlands.Data type and Driftlands.Tide references nothing, so the shape as first written could not compile — the same exception as ITideClock (review F2); callers unwrap with SocketId.Value. NextEvictionInstant (= φ + W + EvictionGrace, an instant, never raw t) joins the interface because LandLifecycle's teardown timer needs it and may neither re-derive it (ADR-0001) nor reach the concrete TideClock through this seam; it shipped on TideClock (foundation-tide-scheduler story-009) and a follow-up story moves it onto the interface.

— which LandLifecycle.SchedulePreload reads by pull. LandLifecycle never subscribes to a Presentation clock's PreloadDue/DockStarted/SoftClose, and nothing reached through IPreloadSchedule may enable colliders, raise LandActivated, spawn, or gate a command. The ITideClock gameplay-subscriber guard is unchanged. Registry stance presentation_clock_driving_gameplay is amended to admit exactly IPreloadSchedule.

LandLifecycle : MonoBehaviour (Runtime, one instance per machine, injected — never a static Instance) holds one LandSlot per socket:

LandSlot { SocketId; TemplateId?; long CycleIndex; AsyncOperationHandle<GameObject> Visual; GameObject VisualRoot; LandNet Net;
           LandInstance Instance; bool DrainReleased; bool GraceExpired; SlotState State }
SlotState: Empty → Preloading → Arriving → Active → SoftClosed → TearingDown → Empty

Release is slot-driven, not solely despawn-driven. LandLifecycle releases a slot's handle on any of: LandNet despawn; a preload whose docking is superseded ((TemplateId, CycleIndex) no longer matches IPreloadSchedule/TemplateFor at the next boundary — the "preloaded but never activated" case); session end (StopHost/disconnect/OnDestroy → ReleaseAll() over every slot). A slot never reaches Empty without its release having run.

Invariants: (a) LandNet is gameplay existence — spawned at φ, despawned at grace expiry; every consumer keys off it or the events it drives, never off a clock. (b) On any machine that completed preload, the φ edge costs colliders-on + LandNet spawn and does no I/O; a client that has not (slow disk, late join) pays the load at activation and its LandActivated fires late — the honest degradation in §4. (c) The four identity variables on LandNet are set once by the host before Spawn() and never mutated; only SoftClosed changes during its life.

Preload budget in time: PreloadLeadTime 600 s vs a local LZ4 bundle ≤ 64 MB — three orders of magnitude of slack; no hitch at φ is the design, not a hope.

4. Failure behaviour — fail loudly, never an empty socket

• Boot catalog check — a Runtime gate, not a validation stage. Validation.Run (ADR-0006) stays pure and Addressables-free. After GameDataLoader succeeds and Addressables.InitializeAsync() completes — before the main menu, after SubsystemRegistration — LandCatalogCheck.RunAsync(IGameData) (Runtime) calls LoadResourceLocationsAsync(def.AddressableKey) for every pooled template; zero locations → the same fatal-config screen, findings in ValidationFinding shape (Stage = -1, Rule = "ldu.catalog") so one screen renders both sources. This is the common failure (renamed key, template not in a group) and it never reaches a docking. NetworkManager starts only after both gates pass.
• Runtime load failure — asymmetric (ruled 2026-08-28, TD-ADR C7). A local bundle that fails to load is a corrupt install. Host: the world's authority cannot proceed → fatal-config screen, the session ends for every connected player — the stated co-op blast radius: one corrupt file on the host ends the group's session, and this is accepted over the alternative of a silently Absent socket, which the tide's contract forbids. Client: that client alone is disconnected with a named error ("your install is missing content for <template>"); the session continues for everyone else; repairing the install and rejoining is the existing late-join path (netcode Rule 4). The tide is never delayed, faked, or compensated for either case.
• LandNet spawn before the client's visual is resident (slow disk, late join): activation waits for the load; the player sees water for its duration; intents targeting that land are legal (host truth). Accepted; measured at the playtest.

5. Memory budget — owner and number (TR-ldu-007, TD-C4)

• Owner: LandLifecycle. Number: landTemplateBudgetMB = 64 per template (knob in land-dock.json, 32–128), covering the packed bundle and its resident footprint. Worst case MVP: home + 1 docked + 1 preloading = 128 MB of land content; Tier 1 ≈ 320 MB — trivial against 2 GB, so the budget is an authoring discipline gate.
• CI gate (non-vacuous): the installed com.unity.addressables sub-version is pinned in packages-lock.json; "Debug Build Layout" and the JSON report format cannot be checked in — Addressables 2.9 persists ProjectConfigData to Library/AddressablesConfig.dat, binary and outside Assets/ — so they are asserted and corrected programmatically by Driftlands.Editor.AddressablesSetup.Ensure(), which every content build runs first (review #9); the EditMode test parses the layout file for that pinned version (2.0.x: extensionless Library/com.unity.addressables/buildlayout; 2.7+: buildlayout.json) and fails if the file is absent. Every Land_* bundle ≤ landTemplateBudgetMB; failing template named.
• Import-settings gate (three cases, the art-bible hard-limits table as code): land atlases ≤ 2048², BC3 or RGBA32, Point, no mips; home atlas ≤ 4096², BC7 or RGBA32, Point, no mips; UI atlas separate, sources ≤ 128², Point.
• Release discipline: exactly one handle per slot — the InstantiateAsync result — released by exactly one call (Verification 2 decides which). Atlas and tilemap ride the prefab's dependencies. No other module may load against land/ keys or the atlas: Harvesting and EnemyAI receive GameObjects/LandInstance, never keys; a reflection test restricts Addressables.LoadAsync/InstantiateAsync call sites on land/ to LandLifecycle (the "second handle" leak the refcount test could not otherwise see).
• Same template on two sockets (Tier 1): Addressables refcounts per key; each slot's release decrements and only the last drops the bundle. AC-U1's "refcount returns to 0" is asserted per key with exactly one holding slot; the two-socket case has its own Tier-1 PlayMode row.

6. KnownLandTemplates

IKnownLandTemplates : ISaveable is declared in Driftlands.Data (a HostContext member — Rules cannot name a Runtime type; ADR-0003 amended), implemented by LandContent (Core, owner), with Append called by LandLifecycle at φ on the host — a clean one-way, idempotent call from the only module that knows when φ happened. Persist: permanent class, stage-4 union with manifest.startingTemplates. Removal: no API exists (schema-negative). Replication is ADR-0008's row; this ADR fixes only the authority (host appends, clients read) and requires a single mechanism — a live mirror makes a snapshot row redundant, and both is a drift source.

Architecture Diagram

 host clock (Authority)                              client clock (Presentation)
   PreloadDue ─────────────────────────┐              IPreloadSchedule.NextPreloadInstant (pull) ──┐
   InstantiateAsync("land/<id>") offshore, colliders OFF, drift-in            (same)
        │ φ: DockStarted                                                       │
   Build(Instance) → SeedNodeState → spawn LandNet ═══(NGO)═══► LandNet.OnNetworkSpawn → Build(Instance)
   colliders ON → Append → LandActivated ──► Harvesting, IEnemySpawner        colliders ON → LandActivated → node views
        │ φ+W: SoftClose → SoftClosedNV=true → SoftCloseDeposit (ADR-0009)     SoftClosed → violet held
   drain step 3 → DrainReleased      grace timer → GraceExpired
        │ both: EvictionExpired (EC11 backstop) → despawn LandNet ═══════► OnNetworkDespawn
   LandTornDown → release slot                                                 LandTornDown → release slot

Key Interfaces

namespace Driftlands.Tide
{
    /// The ONLY Presentation-role surface a non-tint/HUD consumer may read; asset scheduling only (ADR-0001 amended).
    public interface IPreloadSchedule { long NextPreloadInstant(int socket); TemplateId NextTemplate(int socket); long NextEvictionInstant(int socket); }
}

namespace Driftlands.Data
{
    // ADR-0006 TemplateDef — AMENDED (two added members)
    public sealed record TemplateDef(
        TemplateId Id,
        string AddressableKey,                                        // == $"land/{Id}" — stage 7, pure
        IReadOnlyDictionary<Band, int> NodeCounts,
        IReadOnlyDictionary<Band, IReadOnlyList<Cell>> CandidateCells, // NEW — authored order is load-bearing; Count ≥ NodeCounts[band] (stage 7)
        IReadOnlyList<SpawnPoint> SpawnPoints,
        SocketLayout Sockets,
        TraversalProfile Traversal);

    /// Declared here so HostContext (Rules) can name it; implemented by LandContent (Runtime); Append called by LandLifecycle at φ on the host.
    public interface IKnownLandTemplates : ISaveable
    {
        bool Contains(TemplateId t);
        void Append(TemplateId t);                                    // idempotent; no Remove exists
        IReadOnlyCollection<TemplateId> All { get; }
    }
}

namespace Driftlands.Rules.Land
{
    public static class Layout
    {
        /// Pure. Same (def, seed, socket, cycle, epoch) → byte-identical LandInstance everywhere (TR-ldu-002).
        /// Picks NodeCounts[band] cells from CandidateCells[band] by seeded Fisher–Yates over a splitmix stream from variationSeed;
        /// scatter likewise; SpawnPoints and Traversal copied verbatim. All generated members are Cell/int/ulong (ADR-0003 C9 intact).
        public static LandInstance Build(TemplateDef def, ulong variationSeed, SocketId socket, long cycleIndex, int epochIndex);
    }
}

namespace Driftlands.Runtime.Land
{
    /// Runtime-only (carries GameObject) — never a HostContext member.
    public interface ILandLifecycle
    {
        event Action<LandInstance, GameObject> LandActivated;   // each machine, at its own activation instant
        event Action<SocketId>                 SoftCloseDeposit; // host only, at φ+W — tide Rule 9 deposit (ADR-0009 performs it)
        event Action<SocketId>                 EvictionExpired;  // host only, at grace expiry — EC11 backstop
        event Action<SocketId>                 LandTornDown;     // after LandNet despawn, before release
        SlotState StateOf(SocketId socket);
        LandInstance? InstanceOf(SocketId socket);
    }

    /// The land's network identity. Non-addressable prefab in NetworkPrefabsList. Spawned at φ, despawned at grace expiry.
    /// Resolves ILandLifecycle by injection (scene-registered instance), never a static.
    public sealed class LandNet : NetworkBehaviour
    {
        public NetworkVariable<int>   Socket, Template, EpochIndex;   // write-once by the host before Spawn()
        public NetworkVariable<long>  CycleIndex;                     // write-once
        public NetworkVariable<bool>  SoftClosed;                     // the only mutable member
        // ADR-0010 adds: NetworkList<NodeState> Nodes — populated before Spawn()
        public override void OnNetworkSpawn()   => _lifecycle.OnLandNetSpawned(this);
        public override void OnNetworkDespawn() => _lifecycle.OnLandNetDespawned(this);
    }
}

Data-flow classification (architecture §3.2): tide → LandLifecycle is a host C# event / client pull via IPreloadSchedule; LandNet spawn is NGO shared state; LandActivated/LandTornDown local C# events; Addressables loads are main-thread async — no Driftlands code crosses a thread boundary.

Alternatives Considered

Alternative B: Each template as an additive Addressable scene

• Description: LoadSceneAsync("land/<id>", Additive) at preload; UnloadSceneAsync at teardown.
• Pros: Scene-level isolation; per-land lighting/audio in-scene; one unload call.
• Cons: A scene loads in place — the cosmetic drift-in needs the root re-parented after load; the Tier-1 same-template-on-two-sockets case needs two instances of one scene, which additive loading handles awkwardly; scene loading couples to NGO's NetworkSceneManager, which must not manage land visuals.
• Rejection Reason: Drift-in and same-template-twice fit prefab instantiation naturally; nothing a scene offers is needed.

Alternative C: All templates always resident — no Addressables at MVP

• Description: Direct references, prefabs disabled in the home scene, enable/disable at the edges.
• Pros: Zero Addressables surface; no catalog check.
• Cons: Tier 1's 6–8 templates and the atlas-per-template rule exist because of unload; the lifecycle edges and LandNet are identical in both designs, so deferring buys nothing but a later migration under pressure.
• Rejection Reason: Addressables adds one load call and one release to a state machine that must exist anyway.

Alternative D: The addressable land prefab is itself the NetworkObject

• Description: The template prefab carries NetworkObject; host loads and Spawn()s it; clients substitute via NetworkPrefabHandler.
• Pros: One object, one lifecycle; NGO's spawn is the activation edge.
• Cons: Specialist-verified against NGO 2.x's NetworkPrefabHandler docs: the nearest built-in mechanism explicitly warns against relying on its ~1 s spawn-message timeout for asset readiness ("assets should be expected to be loaded before they're needed") — NGO 2.x has no supported primitive for gating a spawn on a client-side async load, which is precisely the coupling this needs; every client's disk speed lands on the host's φ edge.
• Rejection Reason: A 200-byte non-addressable LandNet gives the same authoritative edge with zero NGO/Addressables interaction; unready clients activate late, honestly.

Alternative E: No NetworkObject for the land

• Rejection Reason: Clients would activate gameplay from their Presentation clock — presentation_clock_driving_gameplay by definition; nodes need a replication parent anyway (ADR-0010).

Consequences

Positive

• One authority for gameplay existence (LandNet), one owner of timing (LandLifecycle), one unit of memory (the bundle); the TD split-watch's two concerns are two types in two assemblies.
• No addressable prefab is ever an NGO prefab; no Addressables call is ever inside pure validation.
• Preload has 600 s to load ≤ 64 MB locally; the φ edge does no I/O on any machine that preloaded.
• Both carve-outs (tide-edge, presentation-clock) are named, bounded, and registered — the rules stay checkable.
• The budget is a CI number with an owner, and the CI gate cannot pass vacuously.

Negative

• TemplateDef grows two members; templates need a Candidates_<band> layer and an export tool.
• A slow client can stand on a land it cannot see for a moment.
• Two clocks drive two things (Authority → gameplay; Presentation → visuals via IPreloadSchedule only); the boundary lives in two interfaces and must stay that way.
• A host-side corrupt bundle ends the group's session (ruled, stated).

Risks

• Refcount leak from a second handle outside LandLifecycle → bundle never unloads. Mitigation: the call-site reflection test (§5) + the refcount-to-0 test.
• Awaitable/Task interop undocumented by Unity. Mitigation: it is the pattern under test in AC-U1; Completed → MainThreadAsync fallback.
• Build-layout report absent (setting off, version drift) → vacuous CI pass. Mitigation: pinned sub-version, Ensure()-asserted setting, fail-on-absent.
• NGO initial NetworkList delivery may not be atomic with spawn. Mitigation: ADR-0010's NodesReady gate clause (Enables).
• Collider-enable cost unmeasured. Mitigation: frame-time assertion in the PlayMode activate test.
• Drift-in tween vs φ: activation is event-driven; the tween is cosmetic and snapped at activation.

GDD Requirements Addressed

Deferred, with owners

Performance Implications

• CPU: preload async on Addressables' worker + one main-thread instantiate; φ edge: colliders-on (budget asserted, unmeasured) + LandNet spawn + Layout.Build (≤ 60 picks — microseconds). No per-frame cost.
• Memory: ≤ 64 MB per resident template; MVP worst case 128 MB of land content + home; Tier 1 ≈ 320 MB. Ceiling 2 GB.
• Load Time: catalog check = one LoadResourceLocationsAsync per template at boot (ms); land load hidden in PreloadLeadTime.
• Network: LandNet ≈ 30 bytes of identity per docking + the node list (ADR-0010); KnownLandTemplates ≤ a few dozen ints.

Migration Plan

No production code. (1) ADR-0006 amendment: TemplateDef members + two pure stage-7 rows; IKnownLandTemplates moved to Data (ADR-0003 note); (2) IPreloadSchedule on TideClock (ADR-0001 note); (3) Rules.Land.Layout.Build + purity tests; (4) Addressables settings: Land_<id> groups, land label, local paths, Debug Build Layout on, sub-version pinned; CI layout + import-settings tests; (5) LandCatalogCheck Runtime gate; (6) LandNet prefab + LandLifecycle slot machine + ReleaseAll, PlayMode round-trip; (7) KnownLandTemplates registered with Save; (8) art-bible §8.A.5/§8.B.1 wording edit in the same change; (9) consumers as Harvesting/EnemyAI/ADR-0009 stories land.

Validation Criteria

• UNIT: Layout.Build byte-identical across 1,000 runs and two machines; different cycleIndex → different placement, same counts/types.
• UNIT: KnownLandTemplates appends at φ only; preloaded-never-activated absent; no Remove (reflection); fresh world contains startingTemplates.
• UNIT (CI): layout file present for the pinned version (absent = fail); every Land_* bundle ≤ landTemplateBudgetMB; three atlas-class import cases.
• UNIT (asset): every CandidateCell/SpawnPoint walkable on the prefab tilemap; CandidateCells read back in authored order.
• UNIT (reflection): Addressables.Load*Async/InstantiateAsync on land/ keys only in LandLifecycle.
• AC-U1 PlayMode: preload → activate → soft-close → teardown; refcount for land/<id> returns to 0 (one holding slot); LandNet exists exactly on [φ, φ+W+EvictionGrace); collider-enable step within its frame budget.
• PlayMode: a player on the land at φ+W receives SoftCloseDeposit before LandTornDown; one still on it at grace expiry receives EvictionExpired before LandNet despawns.
• PlayMode: a client present at φ sees swingsRemaining matching the host's post-diff values, not template defaults.
• PlayMode: preload, then end the session before φ → refcount returns to 0 (slot-driven release).
• PlayMode (Tier 1): same template on two sockets — teardown of slot A leaves slot B intact and the bundle resident.
• PlayMode: pool template with a missing key → fatal-config screen naming it; client load failure → that client disconnected with the named error, session continues.
• Playtest: drift-in reads as arrival; slow-client "water then land" measured.

Related Decisions

• ADR-0001 (events, NextBoundary, clock roles — IPreloadSchedule added), ADR-0002 (drain step 3; one-channel rule — tide-edge carve-out named), ADR-0003 (LandInstance; IKnownLandTemplates in Data), ADR-0004 (stage 4), ADR-0006 (TemplateDef amended), ADR-0008/0009/0010/0012/0013 (enabled)
• design/quick-specs/land-dock-undock-2026-08-27.md, design/gdd/tide-scheduler.md, design/gdd/harvesting-system.md, design/quick-specs/enemy-ai-2026-08-27.md, design/art/art-bible.md §8 (amended)
• docs/architecture/architecture.md §2, §3.2/3.3, invariant 4, Required-ADR row 5, QQ-06

Amendments — 2026-09-07 (architecture-review-2026-09-07.md)

• U1 IPreloadSchedule takes int socket (both declarations) — the SocketId form could not compile in Driftlands.Tide.
• #13 NextEvictionInstant(int) added to IPreloadSchedule; follow-up story moves it off the concrete TideClock.
• #9 §5: Debug Build Layout is Ensure()-asserted, not checked in (impossible on Addressables 2.9).

Amendments — 2026-09-11 (ADR-0009 player transform authority)

• SoftCloseDeposit(socket) and EvictionExpired(socket) have their consumer: the host PlayerSnapService (ADR-0009 §4) deposits every player whose host-known position is on that land at depositPoint (SnapReason.TideDeposit); EC11's backstop is the same call at grace expiry. The host commands the owner (PlayerSnapped outcome) and overrides host truth immediately — it never moves a transform itself.

Amendments — 2026-09-11 (ADR-0010 inventory replication)

• The INodeSeeder seam is implemented by NodeListSeeder: LandNet.Nodes : NetworkList<NodeNetRow> (index-aligned with LandInstance.Nodes) is written from NodeTable (kept diff rows already applied) before ILandNetSpawner.Spawn — activation step 2 → 3 as this ADR ordered. The NodesReady contingency is closed: NGO 2.13.2's spawn-time sync sends full list contents (WriteFieldSynchronization → WriteField, source-confirmed); story 009 keeps an OnNetworkSpawn count assertion instead of a gate.

Amendments — 2026-09-11 (ADR-0012 enemy simulation model)

• IEnemySpawner is implemented by EnemySpawner: LandActivated → pure Composition.Choose(template, variationSeed, spawnPoints, …) → QueueSpawn(Enemy) buffered from tick step 1 (ADR-0002 amended) → one NetworkObject per enemy after the drain. Teardown: the enemy sweep subscribes to EvictionExpired (raised before the LandNet despawn) and drops pending death lingers; LandTornDown removes the combat rows. EnemyScalingContext stays empty (enemy-ai Rule 11).