Control Manifest — Driftlands

Manifest Version: 2026-09-11
Engine: Unity 6.3 LTS (6000.3) · installed editor 6000.3.18f1 · URP 17.3.0 2D (Render Graph) · Shader Graph 17.3.0 · Input System 1.20.0 · Addressables 2.9.1 · Newtonsoft 3.2.2 · UI Toolkit · Netcode for GameObjects 2.13.2 · Unity Transport 2.7.3 · Multiplayer Services SDK 2.2.1 (Relay/Authentication/Core) · Multiplayer Tools 2.2.9 — pinned by ADR-0008, verified against the package source in the Gate 0 kit; not yet in UnityProject/Packages/manifest.json (NetcodeSession story 001 adds them and commits packages-lock.json)
Sources: all 15 Accepted ADRs (0001–0015) as amended 2026-09-11 (ADR-0008–0012 each amended ADR-0001/0002/0003/0004/0005/0006/0015 in their own commits) · .claude/docs/technical-preferences.md · docs/registry/architecture.yaml (69 active forbidden patterns, 8 budget entries = the 60 fps / 16.6 ms frame row + 7 per-system slices) · docs/engine-reference/unity/{VERSION,breaking-changes,deprecated-apis,current-best-practices}.md · production/playtests/gate-0-2026-09-11/ (Gate 0 GO)
Generated by: /create-control-manifest
Technical Director Review (TD-MANIFEST): CONCERNS → REVISED 2026-09-11 — C1–C6 applied; the three ADR sentences that contradicted their own ADR (ADR-0008 §4 outcome cap, ADR-0010 CarryFold.Apply arity, ADR-0012 EnemySpawner teardown trigger) were corrected as editorial amendments in the same commit

What this is. A flat rules sheet. ADRs explain why; this tells you what, in a form you can check a diff against. If a rule here and an ADR disagree, the ADR wins — and the disagreement is a bug in this file, so report it.

Stories embed the Manifest Version above. /story-done compares it and flags staleness, so regenerate this whenever an ADR is accepted or amended. Every story written before 2026-09-11 (versions 2026-09-02/03/07) is now stale against this file; the new rules are the NetcodeSession, PlayerMovement, Inventory replication, Structure registry and Enemy simulation blocks plus the amended Host-commit / Combat / Save / GameData / Land rows marked (2026-09-11).

✅ Gate 0 PASSED — confirmed GO 2026-09-11

The two-machine friend playtest ran on 2026-09-11 over Unity Relay (Jeroen host, Eric client, RTT ≈ 150–280 ms): own movement and dash instant, hits landed where seen, zero client warps; verdict GO (production/playtests/gate-0-2026-09-11/README.md, production/gate-checks/gate-0-provisional-pass-2026-09-11.md). ADR-0008–0012 are Accepted without qualification and every epic that routed through them is unblocked (production/epics/index.md). The netcode model (owner-authoritative movement, host-authoritative everything else, local-player prediction only, one ordered channel, host tick) is unchanged and binding. The one playtest observation — occasional remote stutter at that RTT — is a register item (interpolation tuning, ADR-0009 §6: offset 1→2, then SmoothDampening, players win arbitration; never extrapolation), not a blocker.

GLOBAL — applies to every layer

Naming (technical-preferences)

Global budgets

• 60 fps / 16.6 ms frame budget. The host is also a player — nothing gets a free pass for being "the server".
• < 100 draw calls.
• 2 GB memory ceiling.
• Registered per-system slices total 1.7 ms of 16.6: tide 0.1 · host-commit-drain 1.0 · save-persistence 0.2 · land-lifecycle 0.0 · netcode-session 0.2 (2026-09-11) · ui-panels 0.0 · ui-worldspace 0.2. ADR-0012 additionally budgets EnemyAI.Tick ≤ 0.3 ms per tick for 20 enemies (Feature guardrails) — inside the drain-adjacent tick work, not a registered slice yet.
• ⚠️ Combat (ADR-0015) still registers no per-frame budget — a known hole. It is plausibly the largest per-frame consumer, so a slice that hits 60 fps tells you nothing about headroom until this is closed.
• Network (ADR-0008 §8): ≈ 15 KB/s down / 2 KB/s up per client at 2 players + 8 enemies; guardrail ≤ 20 KB/s down / 5 KB/s up.

Forbidden project-wide

• No rollback / full reconciliation netcode. The model is owner-authoritative movement + host-authoritative damage, prediction for the local player only. Never design a mechanic needing server-side rewind or remote-player prediction.
• No dedicated servers, no server-side simulation. Host-and-play only.
• No host migration. Host leaves → session ends.
• No offline base simulation. Only the deterministic tide schedule advances while nobody plays.
• No tide-compensation mechanics — grace periods, partial-credit harvesting, catch-up boosts are banned by Pillar 1. Recurrence is the only legal mitigation.
• No legacy Input Manager (UnityEngine.Input) in production code (legacy_input_manager).
• No NGO 1.x APIs — NGO 2.x only. NetworkTransform.Update override is gone; use OnUpdate (non-authority must call base.OnUpdate()). RequireOwnership on [Rpc] is [Obsolete] in 2.13.2 — use InvokePermission = RpcInvokePermission.{Everyone|Owner}; the fence Net_NoObsoleteRpcFlags fails the build on it (ADR-0008 §9). NetworkObject.IsSceneObject is deprecated — use InScenePlaced.
• No distributed authority — NetworkConfig.NetworkTopology = ClientServer, always (distributed_authority_topology, ADR-0008 §1).
• No relevancy filtering — NetworkObject.CheckObjectVisibility is never assigned; every client observes every object (relevancy_filtering, ADR-0008 §8).
• No owner-written NetworkVariable/NetworkList anywhere in Runtime/Presentation — every replicated field is NetworkVariableWritePermission.Server; an owner→host fact is an ICommand on the channel (owner_written_network_variable, owner_to_host_fact_outside_channel; fence Net_NoOwnerWrittenNetworkVariables).
• No reading a NetworkVariable.Value (or ClientRegistry) inside an OutcomeRpc handler expecting it to already reflect that outcome — state replicates one tick after the outcome; act on the outcome's own payload (outcome_handler_reads_variable, ADR-0008 §2; review-checklist fence Net_NoVariableReadsInOutcomeHandlers).
• No [SerializeField] on anything but a field — compile-time error on 6.3.
• No deprecated 6.3 APIs: AccessibilityNode.selected → .invoked; AccessibilityRole is a standard enum, not flags; SetupRenderPasses → AddRenderPasses; URP Compatibility Mode is removed.

Pinned toolchain facts (verified by compiling, 2026-09-03)

Unity 6000.3.18f1 compiles C# 9.0 against .NET Standard 2.1. Three things ADR text assumes that the compiler refuses:

• No record struct — C# 10 (CS8773). Use readonly struct + IEquatable<T>. record classes are fine. (ADR-0009–0012 Key Interfaces are written with readonly record struct for brevity — implement them as readonly struct + IEquatable<T>, exactly as ADR-0003 §3's shapes were.)
• Records need the IsExternalInit polyfill — one internal static class IsExternalInit {} in System.Runtime.CompilerServices per assembly that declares a record (CS0518 otherwise). Already in Rules and Tests.EditMode; copy it into any new assembly that adds a record.
• No IReadOnlySet<T> — .NET 5+. Use IReadOnlyCollection<T>.

If an ADR names a shape, compile it before accepting the ADR. ADR-0003 §3 carried all three of the above unnoticed through review, acceptance, and a producer gate.

Pinned NGO 2.13.2 facts (read from the package source 2026-09-11 — (src) in ADR-0008–0012)

These are facts about the installed package, not recommendations. Every one of them changed a design decision; code that assumes the training-data behaviour is wrong.

• **A NetworkVariable/NetworkList written inside Drain() replicates at the next tick, not the same one.** NetworkBehaviourUpdater subscribes to NetworkTickSystem.Tick before any user code and sends already-dirty state first; Tick is a plain event Action in registration order. An OutcomeRpc flushed from drain phase 4 rides the same tick's batch, so a client can receive SwingLanded/HarvestResolved/StructurePlaced one tick before the variable/row the same drain produced. Command latency: RTT + ≤ 1 tick for outcomes, RTT + ≤ 2 ticks for state (ADR-0008 §2; amends ADR-0002's same-tick claim).
• NetworkList<T> requires exactly where T : unmanaged, IEquatable<T> — INetworkSerializeByMemcpy is inert for lists. Backing NativeList grows on demand. Indexer set → one Value event + one delta (ADR-0010 V3, source-confirmed); that a client's OnListChanged sees Index == i is V2, still to be verified in PlayMode.
• NetworkList.Remove(T) never assigns the event's Index — it is 0/meaningless on a Remove event and later elements shift. Key on Value only (list_index_on_remove, ADR-0011 V2).
• Pre-spawn NetworkVariable/NetworkList contents ride the spawn message in full (WriteFieldSynchronization → WriteField) and are readable in OnNetworkSpawn; in-scene objects deliver theirs to a late joiner at SceneEventType.Synchronize provided the list was filled before StartHost (CHANGELOG #3177) (ADR-0010 V1, ADR-0011 V1). ADR-0005's NodesReady contingency is closed.
• A byte[] field in an INetworkSerializable allocates a fresh array per receive (FastBufferReader.ReadValueSafe(out byte[])) — no pooling is possible on the read side. Wire envelopes are unsafe structs with fixed byte Payload[N] (ADR-0008 §4).
• NetworkTransform.Teleport() throws when called from a non-authoritative context. Every host-initiated reposition of an owner-authoritative body is therefore a message the owner honours (PlayerSnapped), never a host-side call (ADR-0009 §4).
• NetworkTransform.InterpolationBufferTickOffset is a static int — global to every NetworkTransform, players and enemies alike. Effective buffer = max(1, TickLatency + offset) where TickLatency is RTT-adaptive at runtime (floor 2 once measured). LegacyLerp ignores TickLatency; use Lerp (ADR-0009 §6).
• **PositionThreshold gates sending only**; there is no receive-side distance threshold in the 2.13 interpolator — a 1-cell authoritative write slides on observers (ADR-0009 V2, QQ-02).
• **NetworkVariableUpdateTraits.MinSecondsBetweenUpdates gates sends, not writes** — last value wins, host writes every frame are free; set via SetUpdateTraits(...) after construction, never a constructor argument (ADR-0008 §8, ADR-0012 V2).
• NetworkObject.Spawn() / Despawn(true) send one message per object per client — NGO does not merge spawns (the transport may pack them); Despawn sends the destroy immediately (DeferredDespawnTick is a separate opt-in this project does not use) (ADR-0012 V1, §2).
• NetworkObject.DontDestroyWithOwner defaults to false — a disconnecting client's player body despawns; the player prefab keeps the default (ADR-0008 §6).
• Reliable RPC ordering is per NetworkObject, across all its methods, not globally — the fact behind "one channel = total order" and behind giving the snapshot and the registry their own objects (ADR-0008 §3).
• UnityTransport.MaxPayloadSize defaults to 6 144 B; snapshot chunks are 4 096 B (ADR-0008 §6). EnsureNetworkVariableLengthSafety stays false — every replicated struct is fixed-size.
• SetState has a native owner-push path (SetStateClientRpc, SendTo.Owner) — considered and not used (ADR-0009 Alt H); SetState( and Teleport( appear in exactly one method (PlayerMotor.OnSnapped).
• ⚠️ Still OPEN: (a) in which player-loop stage NGO applies incoming RPCs and NetworkTransform state relative to Tick — undocumented; ADR-0008 V1 probe in NetcodeSession story 004, result recorded as an ADR-0008 amendment; RangeSlackUnits absorbs one extra tick either way. (b) whether NetworkTransformState's position accessor is reachable from Driftlands.Runtime and in world space — ADR-0009 V1; fallback documented there.

The 69 registered forbidden patterns

docs/registry/architecture.yaml is canonical. Each name below is greppable; the layer sections expand the ones you are most likely to trip.

unity_refs_in_tide_assembly · static_cache_in_pure_assembly · raw_tide_time_on_consumer_surface · caching_evaluate_across_ticks · iterating_elapsed_cycles · second_authority_clock · presentation_clock_driving_gameplay · mpb_on_driftlayer_sprite · exposed_shader_global_read · non_render_graph_pass · baked_tide_state_variant · ui_event_system_present · host_rail_rpc_outside_channel · execute_on_rpc_receipt · async_or_reentrant_execute · spawn_or_send_inside_execute · save_io_inside_drain · upward_assembly_reference · code_outside_asmdef · conversion_outside_unityinterop · float_output_from_client_evaluated_rules · formula_in_runtime_assembly · reflection_serialize_gameplay_types · dictionary_iteration_into_save · second_droppable_table · unknown_key_preservation · quit_without_flush · silent_default_on_missing_key · hardcoded_gameplay_value · cross_stage_forward_reference · editing_streaming_assets_in_a_build · second_copy_of_source_template_mapping · addressable_network_prefab · land_load_outside_lifecycle · addressables_call_in_validation · vacuous_layout_gate · activation_from_local_clock · legacy_input_manager · input_system_outside_adapter · per_consumer_edge_detection · input_edges_in_fixed_update · scheme_gating_gameplay · aim_persistence_toggle · owner_to_host_fact_outside_channel · multiple_tick_subscribers · client_stamped_intent_tick · clientid_as_row_key · burst_in_rules · movement_speed_modifier_for_downed · distributed_authority_topology · relevancy_filtering · bulk_payload_on_command_channel · owner_written_network_variable · outcome_handler_reads_variable · byte_array_on_command_wire · rigidbody_driven_motion · teleport_outside_snap_path · collision_callbacks_in_movement · host_known_is_not_continuous · carry_on_wire · storage_rows_written_outside_replicator · bag_mutation_without_outcome · registry_and_colliders_never_compared · list_index_on_remove · client_registry_gating_a_commit · client_side_enemy_ai · enemy_save_table · random_in_enemy_rules · collider_queries_in_enemy_runtime

(bold = added 2026-09-11 by ADR-0008–0012)

FOUNDATION LAYER

TideScheduler · SavePersistence · GameData · LandLifecycle · Input · NetcodeSession

Required

Assemblies (ADR-0003)

• The graph is fixed. Driftlands.Tide, .Data, .Rules set noEngineReferences: true; .Runtime, .Presentation do not.
• Rules references only Tide and Data; Data references only Tide (amended 2026-09-03 — ADR-0006/0005 place Tide types inside Data; the edge is downward to the reference-free root). Runtime never references Presentation.
• All five asmdefs set autoReferenced: false — load-bearing for the no-code-outside-asmdefs fence, not cosmetic.
• No production asmdef references Driftlands.Editor (Tide, Data, Rules, Runtime, Presentation) — a stated fence, asserted by Asm_NoUpwardReferences; test assemblies may (EditMode does; PlayMode reaches editor setup by reflection). Five production + two test + one Editor-only assembly (ADR-0003, amended 2026-09-07).
• (2026-09-11) Driftlands.Runtime.asmdef gains Unity.Netcode.Runtime, Unity.Networking.Transport, Unity.Services.Multiplayer/.Core/.Authentication/.Relay (assembly names verified when the package lands — NetcodeSession story 001's first task; Unity.Services.* referenced only from RelaySessionLauncher), UnityEngine.Physics2DModule, UnityEngine.TilemapModule (ADR-0008 Migration 2, ADR-0009 Documents Amended).
• (2026-09-11) New engine-free namespaces in Rules: Rules.Movement (Locomotion, Sweep, Facing, ISweepQuery, IDisplacementSink, LocomotionMode, DisplacementRequest), Rules.Enemy (EnemyBrain, Composition, Steering, BrainState, Senses, BrainActions), Rules.Build (Footprint, BuildRules, StationPresence, StructurePlaced/Demolished, DemolishCommand), Rules.Inventory additions (CarryFold, CarryDelta, EquipCommand/UnequipCommand, EquipmentChanged, CarrySync, EquipmentSlot). Anything that names NGO, Physics2D or a UnityEngine type lives in Runtime (ADR-0009/0010/0011/0012).
• (2026-09-11) HostContext has exactly 19 members — QueueDespawn(DespawnRequest) added beside QueueSpawn (ADR-0010); HostContextMemberCountTests moves 18 → 19 in the same story. ADR-0009/0011/0012 add no member. SpawnKind { SharedStorage, Enemy }. ADR-0010 fixes the storage shape (SpawnRequest { SpawnKind Kind; uint StructureInstance; Cell Origin; int Slots }); ADR-0012 §2 extends it for enemies (SpawnRequest.Enemy(EnemyActorId, EnemyId archetype, Cell, byte facing)) but does not state the merged field list — the first story that needs both kinds fixes the union and records it as an ADR-0010 amendment (TD-MANIFEST C1). DespawnRequest(uint StructureInstance).
• (2026-09-11) IHostPositions signature is unchanged (HostKnown(ulong clientId), All()); clientId there is a within-tick lookup handle every drained command carries, never a row key (ADR-0009 §7).
• A formula needed by both a Data-stage validation rule and a Rules consumer lives in Driftlands.Data; Rules calls in. Until a second Rules consumer exists, a duplicated arithmetic pinned by a mutation-verified agreement test is the accepted interim; the third consumer forces the move (ADR-0003 §1, 2026-09-07).
• Folder layout mirrors the graph: Assets/Driftlands/{Tide,Data,Rules,Runtime,Presentation}/, each with its asmdef at the root; tests under Assets/Driftlands/Tests/{EditMode,PlayMode}/. Editor-only tooling under Assets/Driftlands/Editor/ (Driftlands.Editor, never referenced by production — ADR-0003 addendum 2026-09-03).
• Vector2 in Rules is System.Numerics.Vector2. Rules never sees a UnityEngine vector.
• Cell is readonly record struct Cell(int X, int Y) in Data; gridCellSize = 1 world unit.
• UnityInterop (in Runtime, static) is the only place Numerics↔Unity conversion lives — including Physics2DSweep's cast boundary (ADR-0009 §3).
• Adapters (TilemapTerrainQuery, RegistrySnapshot, HostPositions) are thin and never cached by Rules across commands.
• Command records hold only intent-time data; everything else is read from ctx inside Execute.
• Reflection fences run every CI pass, each with a companion negative test proving it fails when violated: Asm_PureAssembliesHaveNoUnityReferences, Asm_NoUpwardReferences, Asm_NoCodeOutsideAsmdefs, Purity_NoStaticMutableFields, Commands_ExecuteIsSynchronous, Interop_SingleConversionSite, Schema_; (2026-09-11) Net_OnlyChannelDeclaresServerRpc is replaced by Net_RpcSurfaceIsClosed and joined by the Net_, Move_, Inv_, Bld_, Ai_ fence families listed in the layer blocks below (ADR-0008 §9, 0009 §9, 0010 §7, 0011 §8, 0012 §7).
• ≥ 80 % coverage on Tide, Data, Rules via the code-coverage assembly filter — Runtime/Presentation excluded by filter, not by omission.

Tide (ADR-0001) — implemented; see Assets/Driftlands/Tide/

• Tide math uses only System.Math and long/ulong/double. Implement F0–F8 exactly as specified.
• Caches are instance-scoped, never static, evicted when roundIndex advances, ≤ 2 rounds resident.
• TideClock is main-thread only.
• AdvanceEpoch is the only method that increments EpochIndex (called only by GameData/Save on an N change); Restore(TideState) assigns the persisted value. Both are reached only through IEpochAdvancer / ISaveClock, which TideClock implements explicitly. AdvanceEpoch throws unless activationT == t (ADR-0001 + ADR-0006 §5, 2026-09-07).
• TideClock.ApplyPoolChange(in TideConfig) is the tide-EC13 pool-change surface: applies at the next round boundary; refuses an N change (→ AdvanceEpoch) and a W/G change (not a pool change) (ADR-0001, 2026-09-07).
• The only impure input is long hostUtcNow passed into Advance.
• Advance has exactly one caller: HostTickOrchestrator step 1, once per NetworkTickSystem.Tick.
• (2026-09-11) t replicates as NetworkVariable<long> on the in-scene TideClockAdapter, WritePerm = Server, default traits (delta on change — t changes once per second by construction); TideClockAdapter is one of the in-scene objects a joiner receives at synchronisation (ADR-0008 §5/§6; tide story 010 is Ready).
• ITideClock never exposes raw t, φ, C, W (AC-27).
• Never cache Evaluate() across ticks; never construct a second Authority clock.
• A Presentation-role clock throws if a gameplay consumer subscribes to its events.
• The AC-2 fixed-vector fixture is generated from production constants, pinned, and must be byte-identical on Mono Editor and one IL2CPP standalone build.

Save (ADR-0004)

• Exactly one host-owned file per world at persistentDataPath/Driftlands/worlds/<worldId>/, with save.1/2/3.json rolling backups. No merge/import path may ever exist.
• Newtonsoft only, and only through ISaveWriter/ISaveReader — never JsonConvert.SerializeObject(gameplayType).
• Key order is deterministic — owners emit keys in fixed order; never iterate a Dictionary into the file.
• An unknown key in a supported version is an error, never round-tripped.
• Dirty-marking is main-thread, O(1), inside the critical section. File I/O is background, one job at a time, in drain order.
• TideClockAdapter calls Persist(tideTable) after every Advance that changes t, and after AdvanceEpoch.
• Session end flushes synchronously — the one place a blocking wait is allowed, bounded to ≤ 2 × flushDeadlineMs. (2026-09-11) The host's ISessionLauncher.LeaveAsync() awaits Save.FlushAllAsync() before NetworkManager.Shutdown() (ADR-0008 §1).
• macOS: fcntl(fd, F_FULLFSYNC) before File.Replace — plain fsync does not flush the drive cache there.
• Load order is fixed: 0 pick file → 1 version gate → 2 clock guard → 3 epoch check → 4 union → 5 droppable → 6 permanent → 7 inventories → 8 placement → 9 counters/StartHost. (2026-09-11) A late joiner runs only the step-9-equivalent deserialisation of the SnapshotDocument: steps 0–2 are replaced by the connection (t from TideClockAdapter; configVersion/dataHash mismatch → disconnect ConfigVersion), step 3 rides epochState, steps 4–7 are skipped (the host reconciled), step 8 (tide EC1 placement) moves to SessionReadyCommand.Execute — the only place it runs for a joiner (ADR-0008 §6).
• (2026-09-11) SnapshotDocument is written through the same ISaveWriter from the same Serialize methods as the save file = {worldSeed, configVersion, dataHash, t, epochState} + the reconciled tables of lastFullDoc minus every CARRY, sharedStorage, harvestDiffs and structures (all four have live replicated forms) plus a sessionActors section ({Hp, State, BleedOutRemainingTicks, OnLand} per PlayerKey in CombatState, connected or not — written by CombatState through ISaveWriter but never registered with SaveRegistry). Built on the main thread at a drain boundary, once per join (ADR-0008 §6, amended by 0010/0011).
• (2026-09-11) The structures table writes a footprint column (w, h) per row from the def at save time — a writer column, never a StructureInstance field (AC-24 stays literal). Reconcile: a row whose def is missing keeps its column values (relic); a row whose def exists is re-derived from the def; a pre-column save (none exist) reads as 1×1 + KeptOrphan (ADR-0004 stage 6 via ADR-0011).
• (2026-09-11) carries.equipment is live: two instanceId strings (weapon, armor) — CarriesSaveTable._equipmentPassThrough becomes the persisted half of ADR-0010 §5.
• (2026-09-11) Nothing about enemies is ever saved — no ISaveable/IReconcilable in Runtime.Enemy, no TableId containing enem (enemy_save_table; fence Ai_NoEnemySaveTable, ADR-0012 §2).
• SaveRegistry asserts at close that exactly one Droppable table exists and its TableId == "harvestDiffs".
• Reconcile is NOT on ISaveable. ISaveable (Driftlands.Data) is TableId/Class/Serialize/Deserialize only; the reconcile half is Driftlands.Rules.Reconcile.IReconcilable : ISaveable because ReconcileContext names Rules types. HostContext.Persist takes ISaveable; SaveRegistry.Register takes IReconcilable (ADR-0004 §2, 2026-09-07).
• Every reconcile outcome is a typed finding: ctx.Report(ReconcileFinding { TableId, RowKey, Kind, Detail }) with FindingKind { Dropped, KeptOrphan, Stale }. Never a prose string (ADR-0003 §3 / ADR-0004 §5, 2026-09-07).
• Load full-restore gives full HP, clears Downed, places per tide EC1.

GameData (ADR-0006)

• Data lives under StreamingAssets/data/, read with File.ReadAllText (desktop only).
• Shipped data is read-only. Overrides live at persistentDataPath/Driftlands/data-overrides/<file>.json and replace the whole file — no key-level merge. Every active override is logged loudly at boot and shown on the main-menu debug line.
• GameDataLoader runs from [RuntimeInitializeOnLoadMethod(SubsystemRegistration)].
• A manifest-listed file that is missing is an error; an unlisted *.json is a warning.
• Validators run in fixed dependency order (stages 0–10); a stage runs only if every stage it references produced no errors.
• Boot and CI call the identical Validation.Run.
• Any validation error halts boot on the fatal-config screen; NetworkManager never starts. Warnings allow boot, logged, counted on the debug line.
• CI fails on errors, on stage-10 gate breaches, and when the warning-set snapshot changes without being updated.
• configVersion is a hand-bumped integer in manifest.json — for derived-state/stored-key-meaning changes only, never for tuning. (2026-09-11) A joiner whose configVersion or dataHash differs from the host's is disconnected (ConfigVersion) — never silently mis-mapped (ADR-0008 §6, 0010 §1, 0011 §1).
• (2026-09-11) Five new required files, each added to ManifestRules.RequiredFiles AND both TestJson fixtures (EditMode and PlayMode) in the story that introduces it — the core-camera story-001 lesson: netcode.json (NetConfig, ADR-0008), movement.json (MovementConfig, ADR-0009), structures.json (StructureDef/BuildConfig, ADR-0011), enemies.json (EnemyDef/AttackDef) and enemy-ai.json (AiConfig) (ADR-0012).
• (2026-09-11) Every wire/movement/AI number is a data field, none a C# constant — with one stated ceiling: MaxCommandPayloadBytes = 64 / MaxOutcomePayloadBytes = 128 are the fixed-buffer sizes (compile-time) (ADR-0008 §4's prose originally read 64 for outcomes; corrected 2026-09-11 — 128 since ADR-0010's CarrySync; the §4 diagram, NetConfig and the ADR-0010 amendment already said 128); netcode.json may lower the accepted Length, never raise it (ADR-0008 §4, 0010).
• (2026-09-11) New validation rows (finite-only, per the NaN lesson): TickRate 20–60 and Time.fixedDeltaTime == 1 / TickRate; SnapshotChunkBytes ≤ 6000; RangeSlackUnits 0–2; bagSlots ≤ 14 (the 128 B CarrySync cap — a data tweak can never overrun the wire); the movement reader is schema-negative (rejects any key containing modifier, stamina, encumbr, weight, penalty); the home island's placeable Region fits short (Bld_RegionFitsShort); AttackDef.TelegraphMs ≥ 400 per attack — hard reject (combat AC-20); guardDensityByBand monotonic (reject on non-monotonic); deep spawn points > shore spawn points per template (warning); EnemyDef values inside combat.json's HP/damage bands (warning); separationRadius finite/in range.
• **Every duration, distance, rate, fraction or modifier on a *Config record is double.** float only where a Unity API demands it (shader/tint floats, TintFloats). ADR-0003 §2's "gameplay geometry is float" is spatial, not durations. HarvestConfig shipped as float before this rule and is retyped by a follow-up story (ADR-0006 §2a, 2026-09-07). ADR-0008–0012's Key Interfaces write float on several config records for brevity — apply this rule when implementing them.
• Epoch order is exactly: Restore(TideState) → Advance(hostUtcNow) → epoch check. socketCount lives in the save's tide block, never inside TideState.

Land lifecycle (ADR-0005)

• No addressable prefab is ever an NGO network prefab. LandNet is a plain prefab in NetworkPrefabsList. (2026-09-11) So are SharedStorage (StorageNet), the player prefab and the enemy prefabs (ADR-0010 §3, 0009 §1, 0012 §2).
• One local packed group per template, Land_<templateId>; the LandVisualPrefab and its SpriteAtlas in the same group, atlas referenced by exactly one addressable.
• TemplateDef.AddressableKey == "land/<templateId>".
• LandNet's four identity NetworkVariables are set once before Spawn() and never mutated; only SoftClosed changes. (2026-09-11) LandNet.Nodes : NetworkList<NodeNetRow> is populated by NodeListSeeder : INodeSeeder before Spawn() (activation step 2 → 3) and written afterwards only by LandStateAdapter.Decrement; the NodesReady contingency is closed — spawn-time sync delivers the full list (ADR-0010 §4, V1 source-confirmed). Land story 009 is Ready.
• Exactly one Addressables handle per slot, released by exactly one call. Only LandLifecycle may call Addressables.LoadAsync/InstantiateAsync on land/.
• CandidateCells order is preserved as authored — an array, never a set.
• The tide-edge carve-out covers exactly LandNet spawn/despawn and IKnownLandTemplates.Append. A third tide-driven host-rail mutation needs an ADR amendment. (2026-09-11) Enemy spawns are not the carve-out: EnemySpawner buffers QueueSpawn(Enemy …) into the tick's HostContext from step 1 (LandActivated), flushed at phase 4 — deferred effects, session state, not a host-rail table (ADR-0012 §2).
• (2026-09-11) IEnemySpawner (shipped seam) is implemented by EnemySpawner; EnemyScalingContext stays empty (ADR-0012 §2).
• (2026-09-11) EvictionExpired(socket) has two named consumers and LandTornDown one: PlayerSnapService deposits anyone whose host-known position is still on the land (TideDeposit; ADR-0009 §4); EnemySpawner despawns every enemy on the socket — before the LandNet despawn, lingers dropped (ADR-0012 §2, V3); LandTornDown → CombatState.RemoveEnemiesOn(socket) + NodeTable.OnLandTornDown. SoftCloseDeposit(socket) at φ+W → PlayerSnapService deposit (ADR-0009 §4).
• LandLifecycle reads preload scheduling only via IPreloadSchedule, by pull; int socket, not SocketId; the eviction instant comes from this seam, never re-derived (ADR-0005, 2026-09-07).
• "Debug Build Layout" and the JSON report format cannot be checked in on Addressables 2.9; asserted and corrected by Driftlands.Editor.AddressablesSetup.Ensure() before every content build (ADR-0005 §5, 2026-09-07).

Input (ADR-0007)

• InputAdapter uses InputSystem.actions — never new DriftlandsControls().
• The adapter disables Player/Build/UI at Awake, then enables Player.
• Adapter reads in Update at [DefaultExecutionOrder(-1000)]. Every edge consumer runs in Update, never FixedUpdate.
• Aim resolves through exactly one pure AimResolver.Resolve shared by both schemes; it persists at prev, never resets to zero.
• Revive is the only hold-style read, modelled as ButtonState.HeldFor — not an asset-level Hold interaction.
• Strike's RT binding carries a per-binding Press at triggerPressPoint.
• LoadBindingOverridesFromJson uses default replace semantics — never pass false.
• Rebind conflicts resolve as an atomic exchange on confirm, never a clear. Menu and UI.Cancel are protected/unbindable.
• bindings.json lives beside settings, never in the world save.
• (2026-09-11) InputFrame never crosses the wire (ADR-0008 Related); UiCaptured frames reach Movement with Move = 0 from the adapter — Movement does not re-check it (ADR-0009 §2); IAimSource.AimVector is the owner's _input.Current.Aim pass-through (ADR-0009 §8).

NetcodeSession (ADR-0008) (new 2026-09-11)

• ISessionLauncher is the only type that knows how bytes reach another machine: HostAsync(maxClients) → joinCode, JoinAsync(code), LeaveAsync(), CurrentRttMs (UnityTransport.GetCurrentRtt(ServerClientId); 0 on the host). MVP = RelaySessionLauncher: UnityServices.InitializeAsync → anonymous sign-in → CreateAllocationAsync/JoinAllocationAsync → utp.SetRelayServerData(AllocationUtils.ToRelayServerData(alloc, "dtls")) → StartHost()/StartClient(). Steam at ship is a second class behind the same interface and touches nothing else (fence Net_SessionLauncherIsTheOnlyTransportToucher).
• NetworkConfig.NetworkTopology = ClientServer, ConnectionApproval = true, TickRate = 50 (from netcode.json, validated 20–60); tickDt = 0.02 s; Time.fixedDeltaTime = 1 / TickRate is set once at boot by NetcodeSession (fence Net_TopologyIsClientServer, PlayMode TickRate == netcode.json). Phase alignment between FixedUpdate and Tick is not assumed anywhere.
• PlayerKey = a client-persisted Guid (IPlayerIdentity.Key) at persistentDataPath/Driftlands/player-key — outside the world save; sent as NetworkConfig.ConnectionData (16 B) before StartClient; the host's ConnectionApprovalCallback rejects anything not exactly 16 B or Guid.Empty ("bad key") and a key already connected ("key in use"), sets CreatePlayerObject = false, and records clientId → PlayerKey in SessionState. The host trusts the approval-time mapping, never a PlayerKey inside a payload (SessionReady echoes it for the fence only).
• The RPC surface is closed at exactly three methods in Driftlands.Runtime ∪ Driftlands.Presentation (fence Net_RpcSurfaceIsClosed, by name and SendTo): HostCommitChannel.SubmitRpc(CommandEnvelope, RpcParams) [Rpc(SendTo.Server, Delivery = Reliable, InvokePermission = Everyone)] — the only inbound host-rail RPC, enqueue only, owner := rpc.Receive.SenderClientId; HostCommitChannel.OutcomeRpc(OutcomeEnvelope) [Rpc(SendTo.ClientsAndHost, Delivery = Reliable)] — the only confirmed-event broadcast, called only from the drain's phase-4 flush; SessionNet.SnapshotChunkRpc(SnapshotChunk, RpcParams) [Rpc(SendTo.SpecifiedInParams, Delivery = Reliable)] targeting RpcTarget.Single(joiner, RpcTargetUse.Temp).
• HostCommitChannel and SessionNet are two separate in-scene, always-spawned, server-owned NetworkObjects — a 40 KB snapshot burst must never sit in front of a strike envelope (bulk_payload_on_command_channel). BaseNet (ADR-0011) and TideClockAdapter are the other in-scene network objects.
• Envelopes are unsafe fixed-layout structs: CommandEnvelope { byte Kind; uint ClientSeq; byte Length; fixed byte Payload[64] }, OutcomeEnvelope { byte Kind; ulong OwnerClientId; byte Length; fixed byte Payload[128] }; NetworkSerialize writes Length bytes one at a time — never a byte[] (byte_array_on_command_wire). SnapshotChunk { ushort Index, Count; uint DocLength; byte[] Bytes } is the one byte[] on the wire (a join allocates a few dozen 4 KB arrays once).
• One sealed codec per CommandKind/OutcomeKind (ICommandCodec/IOutcomeCodec in Runtime.Net.Codecs, static read-only table keyed by kind): fixed-layout blittable fields, little-endian, WriteValueSafe field by field; no strings, no arrays, no nullable references; Vector2 → two float, ids → their int/uint, PlayerKey → 16 B, Cell → two int. The codec is where IntentTick = nowTick is stamped and where a Node-kind StrikeIntent becomes HarvestResolveCommand. The codec is the only place a Rules record meets a byte (fence Net_CodecsFitTheCap: size ≤ cap, exactly one codec per kind, round-trip identity per fixture).
• CommandRejected(ClientSeq, ReasonCode) is 5 B and carries no state — sent to the owner via the same broadcast with OwnerClientId set; other clients ignore it; a ReasonCode naming world state is rejected at review (fence Net_RejectionCarriesNoState). ReasonCode gains NotReady; CommandKind gains SessionReady, Equip, Unequip.
• Representation rule: a value whose current state a late joiner needs = server-written NetworkVariable<T>/NetworkList<T> on the object that owns it; a fact observed as an edge = OutcomeRpc. Never both for one fact — with one registered exception: InstanceMetadata (snapshot-delivered and append-only) carries its new row on CraftCommitted, applied insert-if-absent by InstanceId. Predicted FX (stance, whiff, ghost) are local only, never replicated. The full table is ADR-0008 §5 — consult it before adding any replicated field.
• Late join: approval → in-scene objects sync (HostCommitChannel, SessionNet, TideClockAdapter, BaseNet, LandNets with their lists) → SnapshotChunkRpc × N (≤ 4 096 B each; apply once every chunk is present) → client SubmitRpc(SessionReady{PlayerKey}) → SessionReadyCommand.Execute: CombatState.GetOrCreate(PlayerKey), placement per tide EC1 re-sampling ctx.SoftClosedSockets and ctx.Tide.Evaluate inside Execute, Broadcast(CarrySync) to the owner, ctx.QueueSpawn(PlayerSpawn(clientId, key, pos)). The host's own player takes the same path — StartHost enqueues a local SessionReadyCommand (ADR-0010 §2). SessionReady before the snapshot has applied → CommandRejected(NotReady), the joiner retries; any other command from a joiner without an actor row → CommandRejected(ActorDead).
• Rejoin = late join (TR-net-004): the actor row survives the disconnect; GetOrCreate finds it; HP/Downed/bleed-out restore. Disconnect: the body despawns (DontDestroyWithOwner = false), SessionState keeps PlayerKey → row, the clientId is released (NGO may reuse it — never a key); in-flight envelopes already received execute.
• Host quit: LeaveAsync() awaits Save.FlushAllAsync() then NetworkManager.Shutdown(); each client's OnConnectionEvent(Disconnected) routes to the title screen with the reason string. No host migration.
• Receipt-time validation table (inside SubmitRpc/Enqueue, no gameplay knowledge): Kind in enum range; Length ≤ MaxCommandPayloadBytes and equals the codec's fixed size; ClientSeq > last[PlayerKey]; ClientSeq ≤ last + seqWindow (64); ≤ maxEnvelopesPerTickPerClient (16) — each failure drops and counts (SessionState.DroppedByRule[Kind], exposed to the HUD debug overlay and the playtest CSV). Gameplay gates stay where ADR-0002/0015 put them.
• Proximity slack is fixed, never RTT-scaled (TR-combat-003): HostKnown(attacker) within range + RangeSlackUnits (1.0 u) of the referent — in Execute. ResolveTick sanity (≥ NowTick, ≤ NowTick + maxResolveAheadTicks 50) is an assertion, not a gate.
• Timeouts (UTP defaults, kept): DisconnectTimeoutMS 30 000, HeartbeatTimeoutMS 500, ConnectTimeoutMS 1 000 × MaxConnectAttempts 60 — a disconnect is a late join later, so a long timeout costs only a frozen remote body.
• NetworkTransform baseline (both rails): tick-rate sends, Interpolate = true on non-authority, PositionThreshold = 0.01 (players) / 0.02 (enemies), UseUnreliableDeltas = true, PositionInterpolationType = Lerp, UseHalfFloatPrecision = false, SyncPositionZ = false, rotation/scale sync off. NetworkVariable traits default everywhere except EnemyNet.AnimFrame (MinSecondsBetweenUpdates = 0.05).
• Data-file identity on the wire: dataHash = FNV-1a over each id-index table's own hash in a fixed, append-only order — items, structures, enemies (ADR-0010/0011/0012); a later table appends, never reorders; carried in the snapshot header; mismatch → ConfigVersion disconnect.
• Store the 2026-09-11 kit's RelaySession.cs as reference only — prototypes/combat-netcode-feel-concept/ is throwaway and is never refactored into production (ADR-0008 Related).

Forbidden (Foundation)

• Never use System.Random, GetHashCode(), UnityEngine.Mathf, float, transcendentals, or DateTime.Now in tide schedule math — it breaks host/client determinism (AC-4).
• Never iterate elapsed cycles to "catch up" (iterating_elapsed_cycles) — it reintroduces offline simulation, which Pillar 1 bans.
• Never let a Presentation-role clock's events drive a gameplay decision (presentation_clock_driving_gameplay).
• Never reference UnityEngine/UnityEditor/Unity.* from Tide/Data/Rules (unity_refs_in_tide_assembly) — verified 2026-09-02 to be a hard CS0246 build failure, not a review discipline.
• Never put a non-const/non-readonly static mutable field in a pure assembly (static_cache_in_pure_assembly) — disabled domain reload carries stale state across Play sessions.
• Never make Execute async or re-entrant (async_or_reentrant_execute).
• Never declare a host-rail RPC outside HostCommitChannel (host_rail_rpc_outside_channel) — (2026-09-11) and never a fourth [Rpc] of any target anywhere in Runtime/Presentation (Net_RpcSurfaceIsClosed).
• (2026-09-11) Never call SetConnectionData(ip, port) on a Relay session; never reference Unity.Services.* or SetRelayServerData outside RelaySessionLauncher (ADR-0008 §1).
• (2026-09-11) Never NetworkTopology = DistributedAuthority (distributed_authority_topology); never assign NetworkObject.CheckObjectVisibility (relevancy_filtering; fence Net_NoRelevancyFilter).
• (2026-09-11) Never construct a NetworkVariable<>/NetworkList<> with NetworkVariableWritePermission.Owner (owner_written_network_variable; IL-scan fence Net_NoOwnerWrittenNetworkVariables).
• (2026-09-11) Never put a byte[], string, array or nullable reference in a command/outcome payload (byte_array_on_command_wire); never let a codec exceed the 64 B / 128 B fixed buffers (Net_CodecsFitTheCap).
• (2026-09-11) Never send bulk state (snapshot chunks, table dumps) through HostCommitChannel's object (bulk_payload_on_command_channel).
• (2026-09-11) Never give CommandRejected a payload beyond (ClientSeq, ReasonCode) (Net_RejectionCarriesNoState).
• (2026-09-11) Never trust a PlayerKey carried in a payload — the approval-time SessionState mapping is the only source (ADR-0008 §1/§4).
• (2026-09-11) Never register the drain on a NetworkUpdateLoop stage to "fix" the one-tick state lag — the lag is a known, bounded cost; an undocumented stage coupling is not (ADR-0002 drain_hook, re-affirmed by ADR-0008 §2).
• (2026-09-11) Never replicate CARRY as state (carry_on_wire; fence Inv_NoCarryOnWire) — no NetworkVariable<>/NetworkList<> whose type argument names ItemStack, StackBag, CarryRow or CarryInventory; CarryView derives from no NetworkBehaviour (ADR-0010 §2).
• Never mix Numerics and Unity vector types in one signature outside UnityInterop (conversion_outside_unityinterop).
• Never build a merge/import path for a second save file.
• Never run serialisation or a file swap inside Execute/Drain (save_io_inside_drain) — unbounded disk I/O on a 16.6 ms frame. (The snapshot is built at a drain boundary, once per join — not inside Drain.)
• Never reflection-serialise gameplay types (reflection_serialize_gameplay_types).
• Never construct partial state on a version-gate failure — refuse loudly. (2026-09-11) Same for a joiner's configVersion/dataHash mismatch — disconnect, never mis-map.
• Never let a background flush touch a live UnityEngine object.
• Never silently migrate across an unsupported saveFormatVersion/configVersion.
• Never key-level merge a data override file.
• Never fall back to a default for an unknown or missing required key (silent_default_on_missing_key).
• Never place code outside an asmdef (code_outside_asmdef).
• Never report a kept row through a channel named for drops, and never add a second reconcile channel beside Report (ADR-0003 §3 C4, 2026-09-07).
• Never reference Driftlands.Editor from a production asmdef (ADR-0003, 2026-09-07).
• (2026-09-11) Never add a required data file without adding it to both TestJson fixtures in the same change — a class-filtered run reads green while three PlayMode boot tests go red (core-camera story-001).

Guardrails (Foundation)

Engine constraints (Foundation)

• System.Text.Json is NOT shipped with Unity 6.3 (verified live) — Newtonsoft is primary; STJ stays a future swap behind the ISaveWriter/ISaveReader seam.
• FileStream.Flush(true) does not flush the drive cache on macOS — F_FULLFSYNC P/Invoke required; verify on Apple-silicon and Intel.
• File.Replace is ReplaceFile() on Windows, POSIX rename() elsewhere — atomic on one volume only.
• Application.wantsToQuit does not fire on Play-mode exit — use EditorApplication.playModeStateChanged == ExitingPlayMode for Editor parity.
• Domain-reload-disabled hazard: a static flush worker would survive Play sessions. SavePersistence is session-owned; cancel the worker and clear the queue on ExitingPlayMode. (2026-09-11) The same hazard applies to StorageNet's static spawn dictionary (ADR-0011 §4) and NetworkTransform.InterpolationBufferTickOffset (a static) — reset both on session start.
• [RuntimeInitializeOnLoadMethod(SubsystemRegistration)] before scene Awake is confirmed; that it precedes a scene-placed NetworkManager is a project ordering fact to test, not a Unity guarantee. (2026-09-11) It must: BaseNet.Structures is filled from the reconciled registry after Save.Load() and before StartHost (CHANGELOG #3177; BaseNet.Initialise throws if IsListening).
• ⚠️ UNVERIFIED: System.Numerics.Vector2 under a stripped IL2CPP build. It is scalar (no SIMD) on Mono and IL2CPP — chosen for shape, never speed.
• (2026-09-11, resolved) NGO 2.x write-permission API is verified from source: new NetworkVariable<long>(writePerm: NetworkVariableWritePermission.Server); NetworkList<T>(IEnumerable<T>, readPerm, writePerm); traits via SetUpdateTraits after construction. modules/networking.md is 1.x-era and is used for nothing — the pinned facts above and ADR-0008's (src) markers are the reference.
• (2026-09-11) PlayerKey GUID on disk is trivially copyable — a friend can impersonate a friend. Accepted: 2–5 friend co-op, no economy, no anti-cheat requirement; the host re-samples every gate regardless.
• ⚠️ UNVERIFIED: 0-alloc (AC-45) is Editor/Mono-measured, and double parity Mono↔IL2CPP is a verification item, not an assumption.

CORE LAYER

PlayerMovement · Combat · Harvesting · Inventory · LandContent · Camera

Required

Host commit model (ADR-0002, amended 2026-09-11 by ADR-0008/0009/0010/0012)

• HostCommitChannel is the only NetworkObject declaring a host-rail [Rpc(SendTo.Server)]. Exactly one inbound RPC: SubmitRpc, attributed [Rpc(SendTo.Server, Delivery = RpcDelivery.Reliable, InvokePermission = RpcInvokePermission.Everyone)] — not RequireOwnership (obsolete; a warning-producing attribute is a fence failure). Exactly one outbound: OutcomeRpc.
• The host overwrites the sender id from rpc.Receive.SenderClientId — never trusts the payload.
• Enqueue never executes. FIFO with host-assigned arrivalSeq.
• Drain() runs exactly once per tick, in fixed order: (1) SoftClose set → (1b) PendingEnemyDamage → (2) envelope loop by arrivalSeq → (3) teardown release → (4) buffered broadcast/spawn/despawn flush → (2026-09-11) (4b) StorageReplicator.AfterDrain and RegistryReplicator.AfterDrain write the StorageNet.Rows / BaseNet.Structures mirrors from the dirty set → (5) Persist dirty-mark / Save.EndOfDrain.
• (2026-09-11) Broadcast, QueueSpawn and QueueDespawn are callable from tick steps 1–3 (Advance, CombatState.Tick, EnemyAI.Tick) through the tick's HostContext as well as from Execute; the phase-4 flush drains everything buffered since the top of the tick — tick-step effects first (buffering order), then command effects (command order). ADR-0002's "a command never observes its own broadcast" is now "nothing observes a broadcast before the phase-4 flush" (ADR-0009 C1, ADR-0012 §2). spawn_or_send_inside_execute stays scoped to Execute.
• (2026-09-11) A NetworkVariable/NetworkList written in Drain() replicates at the next tick; outcomes leave in the same tick's batch. Budget the one-tick lag; never "fix" it (ADR-0008 §2).
• Every gate is re-sampled fresh inside Execute from HostContext — never cached from intent time.
• Confirmed outcomes broadcast only after Execute returns Success; a failed command is a silent honest no-op for the world — (2026-09-11) the owner alone receives CommandRejected(ClientSeq, ReasonCode), state-free, to un-predict its own FX and drop its pending bag delta.
• Dedup keys the last clientSeq per PlayerKey — clientId is unstable across reconnect. (2026-09-11) Plus the receipt-time window/flood bounds of ADR-0008 §7.
• SoftClose is evaluated first, before any command touching that socket. The drop rule is uniform across every CommandKind — no per-kind exception. (2026-09-11) SessionReadyCommand targets no socket, so the step-2 drop rule does not apply to it; its placement re-samples soft-close inside Execute instead (ADR-0008 §6).
• (2026-09-11) A HostPositions.Override (snap) is a position fact, not a gate: a queued command from an overridden player still runs under the tick-threshold rule; a position-dependent gate reads the overridden position and whiffs — it is not dropped. No command inspects Override directly (ADR-0009 §4 C2).
• (2026-09-11) CommandKind = the ADR-0002 list + SessionReady, Equip, Unequip; extended only by ADR. Per-kind fixed payload layouts are ADR-0008 §4.

Combat (ADR-0015, amended 2026-09-11 by ADR-0008/0009/0010/0012)

• Exactly one HostTickOrchestrator subscribes to NetworkTickSystem.Tick. Order: (1) tide Advance → (2) CombatState.Tick → (3) EnemyAI.Tick → (4) Drain. (2026-09-11) Enemy phase timers advance in step 2, and step 2's Telegraph → Active transition fires EnemyAttackResolver — so the brain's step-3 read of CombatPhase is the same tick's post-advance phase and PendingEnemyDamage is consumed in phase 1b the same tick (ADR-0012 C3; supersedes ADR-0015 §4's "step 3 advances").
• IntentTick is host-stamped at receipt (ctx.NowTick) — (2026-09-11) in the codec — never client-trusted (client_stamped_intent_tick). StrikeResolve's 17 B layout carries no tick.
• All combat/player rows key on PlayerKey, never clientId (clientid_as_row_key). (2026-09-11) PlayerKey is the client-persisted GUID from the connection-approval payload (IPlayerIdentity); Steam ID is a second provider at ship, same 16 B shape (ADR-0008 §1).
• Every owner→host combat fact travels as an ICommand on the channel (owner_to_host_fact_outside_channel).
• Correlate on (PlayerKey, SwingId) — SwingId is unique only within a client.
• Phase-0 enemy damage applies in step 1b, before the envelope loop, so a mutual kill resolves both.
• HitPipeline rounding uses MidpointRounding.AwayFromZero and must never be referenced from a Burst assembly (burst_in_rules).
• Knockback accumulator is cleared at the top of every drain; non-empty at entry is an assertion failure. (2026-09-11) Knockback leaves combat as IDisplacementSink.Displace(DisplacementRequest{Kind = Knockback, Velocity = vector / knockbackSecs, RemainingSecs}) on the enemy's KinematicMover2D — EmitKnockbacks(IDisplacementSink); it slides along walls like ordinary movement (no terrain kills). The dash is Displace(Dash) from the owner combat machine on Dashing entry (ADR-0009 §2).
• SwingLanded/DamageAbsorbed are raised only from the buffered flush — never from prediction, never from Tick. (2026-09-11) SwingLanded carries Victim : ActorId, StaggerFired, Lethal — the enemy hit-flash/death edge; no new OutcomeKind for enemy stagger/death (ADR-0012).
• Downed/Dead suppress Strike/Dash/Demolish inside PlayerCombatMachine.Step — never in the input adapter, never via UiCaptured.
• Crawl is a distinct locomotion mode (downedCrawlSpeed), never a multiplier on moveSpeed (movement_speed_modifier_for_downed). (2026-09-11) The owner maps PlayerState → LocomotionMode: Idle/Windup/Active/Recovery → Normal, Downed → Crawl, Dead → Frozen, Dashing → Normal + active displacement (ADR-0009 §2).
• ICombatState : ISwingerStateQuery — CanResolveHarvest(PlayerKey), AcceptsHarvestIntent(PlayerKey); Harvesting sees only these two members (ADR-0015, 2026-09-07).
• (2026-09-11) Replicated combat rows on the wire: one NetworkVariable<PlayerActorNet>{int Hp, byte State, int BleedOutRemainingTicks} on PlayerNet (server-write, written by CombatState at end of Tick/drain) and EnemyNet.Phase : NetworkVariable<byte>. Enemy HP, stagger meter and immunity never replicate (ADR-0008 §5).
• (2026-09-11) EnemyActorId(SocketId Socket, ushort Index) replaces ADR-0015's per-actor EnemyId(landSocket, index) — Data.EnemyId is the archetype string key. Closed call-site list that changes type: ActorId = … | EnemyActorId, the EnemyActor row key, ICombatState.Enemy(EnemyActorId), ApplyHit(EnemyActorId, …), PendingEnemyDamage.Attacker, step 2's angle tiebreak on .Index; EnemiesOn(SocketId) unchanged. Wire form EnemyActorIdNet{byte Socket, ushort Index} (ADR-0012 §1).
• (2026-09-11) The AI→combat boundary is exactly two calls: IEnemyCombat.EnterTelegraph(attackId) and IEnemyCombat.LeashReset() (HP to max, meter and immunity cleared) — fence Ai_BoundaryIsTwoCalls (ADR-0012; user decision).
• (2026-09-11) CombatState's single-writer rule has a fourth named site: the phase-4 deferred-spawn flush for ICombatState.AddEnemy(EnemyActorId, EnemyId archetype) / RemoveEnemiesOn(SocketId) — row creation/destruction only, never a field write on a live row; called only by EnemySpawner (ADR-0012 C2). EnemyActor.Target moves out of combat into the AI's BrainState.
• (2026-09-11) PlayerActor.Equipped{Weapon, Armor} is written only by EquipCommand/UnequipCommand.Execute through ICombatState.SetEquipped(key, slot, instanceId?); IGearHooks reads unchanged (ADR-0010 §5).
• (2026-09-11) Snap(DeathRespawn, homeSpawn) is IPlayerSnapper.Snap(key, SnapReason.DeathRespawn, homeSpawn) on PlayerSnapService (host) — combat never touches a transform (ADR-0009 §4).

PlayerMovement (ADR-0009) (new 2026-09-11)

• Player prefab: NetworkObject (DontDestroyWithOwner = false) · PlayerTransform : NetworkTransform with AuthorityMode = Owner, SyncPositionX/Y = true, SyncPositionZ = false, rotation/scale sync off, Interpolate = true, Lerp, PositionThreshold = 0.01, UseUnreliableDeltas = true, UseHalfFloatPrecision = false, InLocalSpace = false · kinematic Rigidbody2D (simulated = true, useFullKinematicContacts = false, interpolation = None) that exists only so Rigidbody2D.Cast sees the collider · CapsuleCollider2D/BoxCollider2D 0.8 × 0.8 u on layer Player, isTrigger = false · KinematicMover2D · PlayerMotor (enabled only on the owner) · PlayerNet (fence Move_PrefabAuthority, YAML read).
• Enemy prefab: EnemyTransform : NetworkTransform in AuthorityMode = Server, same interpolation settings, PositionThreshold = 0.02; same kinematic Rigidbody2D + collider on layer Enemy; same KinematicMover2D, driven by EnemyMotor on the host (ADR-0012).
• KinematicMover2D is the ONLY writer of transform.position for players and enemies — Drive(move, mode, dt) = Locomotion.Step + Sweep.Move + write; Displace(DisplacementRequest), CancelDisplacement(), ResetVelocity(), CorrectTo(pos) (EC21: direct write, no Teleport).
• Locomotion is a pure step, owner-driven, per rendered frame (Rules.Movement.Locomotion.Step(state, move, mode, dt, cfg)): Frozen → 0; Crawl → normalize(move) × DownedCrawlSpeed × dt; Normal → normalize(move) × MoveSpeed × dt (accelTime 0: full speed the frame input arrives, stop the frame it ends; when > 0, a first-order approach — the code path exists so the playtest can try 40 ms without a code change); an active displacement is Velocity × dt for RemainingSecs, then input again. Swing phases do not slow movement.
• Dash = DisplacementRequest{dir × dashSpeed, dashDuration, Dash} from the owner combat machine; dir = movement input if non-zero, else aim. The sweep still applies — a wall stops the dash at its face and the remaining time is consumed (no bounce, no slide-along for dashes; ordinary movement slides). The host never reconstructs dash displacement; DisplacementRequest is never replicated; i-frames are combat's (EC16), not movement's. dashSpeed/dashDuration stay in combat.json.
• Collision — one sweep rule, pure, over an adapter: Rules.Movement.Sweep.Move(from, delta, ISweepQuery q, skin) moves along X (q.Cast(from, (dx,0), |dx| + skin), stop skin short of the first hit), then along Y from the reached point. Axis-separated sliding is deliberately naive (diagonal into a wall slides; a corner stops both axes). No penetration resolution — a body that starts inside a collider is EC21's case, never the solver's. Physics2DSweep : ISweepQuery = Rigidbody2D.Cast(dir, ContactFilter2D{layerMask = blockers, useTriggers = false}, RaycastHit2D[8] preallocated, distance), hitDistance = min(results[i].distance), zero allocation.
• Layers: Player, Enemy, Structure, Terrain, WorldBounds. Matrix (fenced from DynamicsManager.asset, Move_LayerMatrix): Player↔Player off, Player↔Enemy off, Enemy↔Enemy off (separation steering is ADR-0012's job, not the solver's); {Player, Enemy} ↔ {Structure, Terrain, WorldBounds} on; nothing else collides with anything (strike arcs are geometry in Rules, not triggers). Blockers: structures = static BoxCollider2D per registry row on Structure (ADR-0011); terrain = the land's authored TilemapCollider2D + CompositeCollider2D on Terrain; world bounds = EdgeCollider2D on WorldBounds. MovementConfig.BlockerLayers = ["Structure","Terrain","WorldBounds"].
• Physics2D.queriesStartInColliders = false project-wide (Physics2DSettings.asset, fence Move_QueriesStartOutside) — otherwise a cast whose origin overlaps a collider (a wall placed on the player) self-blocks at distance 0. A PlayMode test covers a body that starts overlapped and must still move away.
• Host-commanded snaps — the closed list, owner-honoured: triggers are exactly SoftCloseDeposit(socket) at φ+W and EvictionExpired(socket) (→ depositPoint, SnapReason.TideDeposit) and combat OnZeroHp → Dead (→ homeSpawn, DeathRespawn). PlayerSnapService.Snap(key, reason, pos) on the host does HostPositions.Override(key, pos, until NowTick + snapGraceTicks) immediately (host truth now) and ctx.Broadcast(PlayerSnapped(key, reason, pos)); the owner's PlayerMotor.OnSnapped does CancelDisplacement, ResetVelocity, _nt.Teleport(pos, transform.rotation, transform.localScale) (live rotation/scale, never identity) and raises ISnapSource.Snapped(reason, pos) (camera hard cut). The override ends when the owner's next NT state lands within snapAcceptRadius (1.0 u) or at the grace tick (25). Rejoin/late-join placement is spawn-time (QueueSpawn(player, pos)), not a snap. PlayerSnapped is 25 B (OutcomeKind).
• SnapReason is exactly {TideDeposit, DeathRespawn} — the enum the camera epic shipped; EC21 never grows it (fence Move_SnapReasonClosed).
• BB EC21 is an interpolated write, not a cut (ratified): the owner computes Rules.Build.FindCorrectionCell and calls PlayerMotor.CorrectTo(cell.Center) — a direct transform.position write on the authority, not Teleport(), not SetState; NT commits it as an ordinary delta; observers slide the one cell over the buffer; the mover snaps (velocity reset, displacement cancelled); no ISnapSource event. Triggered from the BaseNet list Add event, never from StructurePlaced (ADR-0011 §6).
• Teleport( and SetState( occur in exactly one method: PlayerMotor.OnSnapped (teleport_outside_snap_path; raw-text fence Move_TeleportOnlyFromSnap).
• Remotes interpolate, never extrapolate: non-owner instances Interpolate = true, Lerp (never LegacyLerp — it ignores TickLatency), PositionMaxInterpolationTime = 0.1 s; NetworkTransform.InterpolationBufferTickOffset = cfg.RemoteInterpBuffer (default 1, range 1–3) set once at boot — it is a static that applies to every NetworkTransform. Effective buffer = max(1, TickLatency + offset), RTT-adaptive. Amendment order if the warp counter disagrees: offset 1→2, then SmoothDampening, never extrapolation; when players and enemies want different buffers, players win — enemies get SmoothDampening instead of a larger offset (Pillar 4). If OnUpdate is ever overridden, non-authority calls base.OnUpdate().
• HostPositions.HostKnown(clientId) is the raw last-received authoritative position captured by PlayerTransform.OnNetworkTransformStateUpdated on the host (V1) — never the host's interpolated copy (a further buffer behind); the host's own player reads the live transform; a pending snap override wins until it expires. Staleness bound for every gate: ≤ 1 RTT + 1 tick. Consumers (noPlayerOccupancy, placerHasExit, ArcTest attacker position, harvest proximity, tide deposit "who is on this land", crafting stationPresent asker) are single-tick predicates — none derives velocity, continuity or a delta across ticks (host_known_is_not_continuous); a future consumer needing continuity amends ADR-0009.
• Aim is not replicated at MVP. Remote players face their last non-zero movement direction (from interpolated velocity); the owner faces its aim (Facing.Octant). Sprite facing is SpriteRenderer.flipX, never localScale.x = −1 — so a teleport can never pop the facing. Player flipbooks derive locally from PlayerActorNet.State + velocity; AnimFrame replication is enemies-only.
• movement.json / MovementConfig: MoveSpeed 6 (5–8), AccelTime 0 (0–0.08), DownedCrawlSpeed 2 (1.5–3), RemoteInterpBuffer 1 (1–3), SnapAcceptRadius 1.0 (0.5–2), SnapGraceTicks 25 (5–100), SkinWidth 0.01 (0.005–0.05), BlockerLayers; schema-negative reader; fence Schema_NoMoveSpeedModifier (no member matching MoveSpeedModifier|Stamina|Encumbrance in Rules/Runtime).
• Enemy overlap is recoverable only by steering: with Enemy↔Enemy off, two knockbacks can leave two enemies coincident; ADR-0012 owns the deterministic tiebreak (below). Never random jitter.

Harvesting (ADR-0015 / ADR-0010 §4, amended 2026-09-11)

• LandStateAdapter.Decrement (node + diff row in one call) additionally sets LandNet.Nodes[NodeIndex] = new NodeNetRow(NodeIndex, after.SwingsRemaining) in the same critical section — the list can never disagree with the table. NodeNetRow{ushort NodeIndex, byte SwingsRemaining} (3 B), index-aligned with LandInstance.Nodes (NodeIndex == NodeId.Value); swingsTotal is data, not replicated. Only NodeListSeeder and LandStateAdapter.Decrement write Nodes[ (fence Inv_NodesSingleWriter).
• HarvestResolved{Player, Socket, Node, Item, Yield} is the host-confirmed edge (Item crosses as ItemIndex); harvest yields are never predicted. The post-Decrement BagFull path spends the swing and adds nothing: the node row moves, the owner receives CommandRejected(BagFull) whose ClientSeq matches no pending entry — the fold treats that as a no-op on Confirmed, by rule (Inv_FoldHandlesUnmatchedRejection).
• A mid-docking joiner receives the whole node list with the land's spawn (EC16); staleness is bounded by the one-tick lag. harvestDiffs is host-only (save table); the list is the only node truth a client sees.
• Proximity sanity check (TR-harv-007): HostKnown within range + RangeSlackUnits — fixed, never RTT-scaled (ADR-0008 §7).

Inventory replication (ADR-0010) (new 2026-09-11)

• The host's InventoryTx tables are the only truth. Every bag/chest mutation is a command's Execute. The spec's "owner-authoritative CARRY" reduces on the wire to owner-visible and owner-predicted — this ADR states the reduction; no second authority exists.
• CARRY never rides a NetworkVariable. The owner's CarryView (Confirmed : StackBag + Pending : List<CarryDelta>; Visible = confirmed with pending applied) is seeded by the owner-addressed CarrySync{rows[bagSlots], equipment[2]} outcome sent from SessionReadyCommand.Execute — the same drain that creates the row, closing the snapshot→ready window — and thereafter is a pure fold over the ordered outcome stream: Rules.Inventory.CarryFold.Apply(confirmed, pending, outcome, self, data), total over every bag-touching OutcomeKind (switch with no default fall-through — fence Inv_CarryFoldIsPure). (ADR-0010 §2/§7 prose originally wrote a three-argument shorthand Apply(bag, outcome, data); corrected 2026-09-11 — the five-argument form is binding because only it can consume a Pending entry, which the InventoryTransferred/CommandRejected rows require.) Deltas: HarvestResolved +yield; InventoryTransferred ∓ per direction and consumes the matching Pending entry (FIFO); CommandRejected drops the entry with that ClientSeq (or no-ops); CraftCommitted −recipe inputs +output tagged InstanceId (from IGameData.Recipes); StructurePlaced −StructureDef.Cost for the placer; StructureDemolished +100 % of current cost for the demolisher, nothing when RefundIsZero; EquipmentChanged moves the tagged stack between bag and slot. CarrySync is also the only resync tool (host-initiated at rejoin; no client "request resync").
• Prediction is for the owner's own transfer clicks only: on deposit/withdraw the owner submits InventoryTransfer and pushes CarryDelta{ClientSeq, Direction, Item, Count, Tag} to Pending; Visible updates that frame. Never predicted: the storage side (StorageView renders StorageNet rows only), harvest yields, crafts, placements. transferBatchWindow (default 0) coalesces same-direction/item/tag clicks into one command if raised — no wire change.
• A future bag-touching command must broadcast a delta-bearing outcome (bag_mutation_without_outcome) — the total-switch fence catches a declared kind with no fold case; it cannot catch a mutation with no outcome, which is why this is reviewed per command. The two shipped exceptions are stated: harvest BagFull-after-Decrement and InventoryTransfer's restore path (net-unchanged, dirty-marks neither).
• Ids on the wire — two deterministic codecs: ItemId (string) ↔ ushort ItemIndex via ItemIndexTable = ordinal-sorted IGameData.Items keys, 0xFFFF = empty (fence Inv_ItemIndexIsSortedOrdinal; hash folded into dataHash); InstanceTag (string, null = untagged) ↔ uint InstanceId via TagCodec — a tag is the decimal rendering of crafting's host-monotonic instanceId (0 ⇄ null); a non-numeric tag is a fixture failure, at runtime kept + KeptOrphan (crafting Rule 9), encoded as 0 on the wire (lossy for orphans; views never write back). NodeId.Value == NodeIndex. ContainerId.Value == "s" + structureInstanceId (accepted by ADR-0011). PlayerKey = 16 B.
• SharedStorage = one StorageNet NetworkObject per container (prefab in NetworkPrefabsList, not addressable): NetworkVariable<uint> StructureInstance (set before Spawn()) + NetworkList<StackNetRow{ushort ItemIndex, ushort Count, uint InstanceId}> Rows (8 B/row), fixed length = storageSlots, one row per slot, 0xFFFF = empty; a transfer changes exactly the rows it touches via the indexer (Rows[i] = row), never Add/RemoveAt — the UI slot grid maps 1:1 (fence Inv_StorageRowsFixedLength).
• Spawn/despawn ride the drain's deferred effects: PlaceStructureCommand (storage category) → ctx.QueueSpawn(SpawnRequest.SharedStorage(instance, origin, slots)) → after the loop: instantiate, set StructureInstance, fill Rows from the table snapshot, Spawn(); DemolishCommand gates ChestNotEmpty then ctx.QueueDespawn(instance) → Despawn(destroy: true). StorageSpawned/Despawned are not outcomes — the object's existence is the state; StructurePlaced/Demolished are the presenter edges.
• StorageNet.Rows is a mirror, not host-rail state: no command gate reads it, no save table contains it, it is reconstructible from InventoryTx at any instant. StorageReplicator (host) is its only runtime writer — once after every Drain(), for every container in the dirty set (ctx.Persist(inv.StorageTable)), diffing Snapshot.Slots against Rows and writing only changed indexes (storage_rows_written_outside_replicator; raw-text fence Inv_StorageRowsSingleWriter: Rows[/.Add(/.Clear( only in StorageReplicator and StorageNet.Initialise).
• Load: the reconciled sharedStorage table is applied to tables before StartHost; containers are spawned when the registry is instantiated (ADR-0011's boot step) with Rows pre-filled; a late joiner receives every StorageNet with its rows in the spawn message — which is why the snapshot drops sharedStorage.
• Clients: StorageView per StorageNet (Rows + OnListChanged → UI grid); InventoryTransferred is the feedback edge (flyout, sound) and may arrive one tick before the row delta — the grid follows the row, the flyout the outcome.
• Equipment — two slots outside the bag, two commands, one outcome: host CarryInventory.Equipment[2] (Weapon, Armor; the tagged stack itself, moved out of the bag), persisted in carries.equipment. EquipCommand(slot, tag): stack in owner's CARRY ∧ GearDef matches slot → remove from bag (frees a bag slot — user decision), previous occupant goes into the freed slot, SetEquipped, Persist, Broadcast(EquipmentChanged). UnequipCommand(slot): slot occupied ∧ CanAdd → inverse; a bare unequip into a full bag is an honest no-op (BagFull); swaps always work. Other players' equipment is not visible at MVP.
• Wire rows are unmanaged: StackNetRow (8 B), NodeNetRow (3 B) blittable, IEquatable<T>, no reference field (fence Inv_WireRowsAreUnmanaged). OutcomeEnvelope is 128 B because of CarrySync (≈ 90 B at bagSlots 10; the range validates bagSlots ≤ 14).
• Deliberately not replicated: other players' CARRY (never on any client), enemy inventories (none), harvestDiffs, InstanceMetadata beyond snapshot + CraftCommitted row, any HUD count outside these structures.

Camera (ADR-0009 §4 / core-camera epic)

• ISnapSource (SnapReason { TideDeposit, DeathRespawn }) gets its real emitter: SnapSource.Snapped raised by PlayerMotor.OnSnapped on the owner — replaces core-camera story-003's fake. Hard cuts only for those two reasons (camera Rule 3); EC21 follows smoothly.

Forbidden (Core)

• Never add a second NetworkTickSystem.Tick subscriber (multiple_tick_subscribers) — Tick is a bare event Action with no ordering guarantee.
• Never model an owner→host fact as an owner-written NetworkVariable — delta replication carries no per-tick order, and it evades the RPC reflection test.
• Never add CheckObjectVisibility filtering to HostCommitChannel — every client must observe it for total order.
• Never let a late StrikeRevoke undo a landed hit. The hit stands; that is the design.
• Never replicate enemy HP or combat meters — only EnemyActor.Phase (and AnimFrame, Archetype, ActorId — ADR-0012) replicates.
• Never let anything but LandLifecycle load land/* addressables (land_load_outside_lifecycle).
• (2026-09-11) Never move a body through the physics solver — no Rigidbody2D.MovePosition/AddForce/velocity =, no NetworkRigidbody2D/NetworkRigidbody/AnticipatedNetworkTransform, no UseRigidBodyForMotion (rigidbody_driven_motion; fence Move_NoRigidbodyMotion). KinematicMover2D is the only position writer.
• (2026-09-11) Never call Teleport(/SetState( outside PlayerMotor.OnSnapped; never Teleport from the host on an owner-authoritative body — it throws (teleport_outside_snap_path).
• (2026-09-11) Never declare OnCollision/OnTrigger in Driftlands.Runtime.Movement or .Enemy — collision blocks, never damages; damage is commands-only (collision_callbacks_in_movement; fence Move_NoCollisionCallbacks).
• (2026-09-11) Never hand ownership to the host for a snap (ChangeOwnership round trips) and never use NGO's SetState owner-push path — the snap is an outcome with a reason, in command order, through the codec fence (ADR-0009 Alt C/H).
• (2026-09-11) Never scale moveSpeed; never add a MoveSpeedModifier|Stamina|Encumbrance|weight|penalty member or data key (movement_speed_modifier_for_downed; Schema_NoMoveSpeedModifier).
• (2026-09-11) Never derive velocity or continuity from HostKnown across ticks (host_known_is_not_continuous).
• (2026-09-11) Never grow SnapReason beyond two members (Move_SnapReasonClosed) — EC21 is not a cut. If ADR-0009 V2 fails and EC21 must join the Teleport path, that is an ADR amendment with the user's assent (it changes the shipped camera contract).
• (2026-09-11) Never replicate DisplacementRequest, aim (at MVP), or a player AnimFrame.
• (2026-09-11) Never write StorageNet.Rows or BaseNet.Structures outside their replicator/Initialise (storage_rows_written_outside_replicator); never Add/RemoveAt on Rows (slot-indexed, fixed length).
• (2026-09-11) Never predict a harvest yield, a craft, a placement, or the storage side of a transfer — only the owner's own transfer deltas are predicted (inventory Rule 7).
• (2026-09-11) Never let a bag-touching command mutate without a delta-bearing outcome (bag_mutation_without_outcome).
• (2026-09-11) Never put CARRY in the snapshot, and never build a client "request resync" — CarrySync from SessionReadyCommand.Execute is the only seed and the only resync (ADR-0010 §2).
• (2026-09-11) Never read a NetworkVariable/StorageNet row/ClientRegistry inside an outcome handler expecting the outcome already applied (outcome_handler_reads_variable).
• (2026-09-11) Never let a gate read a NetworkList mirror — HostContext.Structures/InventoryTx are the truth; the lists are for clients (ADR-0010 §3, 0011 §2).

Guardrails (Core)

Engine constraints (Core)

• NGO 2.x reliable RPCs are ordered per NetworkObject only — across all its methods, not globally. This is the fact that makes one channel the only route to total order.
• ⚠️ OPEN (ADR-0008 V1): which player-loop stage NGO applies incoming RPCs and NetworkTransform state relative to Tick. Probe in NetcodeSession story 004 (NetworkUpdateLoop.RegisterNetworkUpdate markers, documented playtest / two standalone builds); if state applies after Tick, HostKnown is one tick staler and RangeSlackUnits absorbs it (0.12 u) — recorded as an ADR-0008 amendment, not a rewrite.
• ⚠️ OPEN (ADR-0009 V1): NetworkTransformState's position accessor is a member of an internal struct — its accessibility from Driftlands.Runtime and its space (local vs world) are unverified; fallback = the host's interpolated copy plus remoteInterpBuffer ticks added to the staleness bound.
• ⚠️ MPPM 2.0.x is not fit for automated tests on 6.3 — netcode timing runs as documented playtests or two standalone builds under Network Simulator, never as a CI gate.
• (2026-09-11, resolved) NetworkList<T> initial contents arrive with the spawn message (source-confirmed, ADR-0010 V1) — NodesReady is not needed; story 1 keeps a PlayMode Nodes.Count == instance.Nodes.Count assertion in OnNetworkSpawn so a future NGO change is caught loudly.
• (2026-09-11) Rigidbody2D.Cast on a kinematic body excludes the body's own collider automatically; against a CompositeCollider2D tilemap and static BoxCollider2D walls it returns contacts non-allocating into a preallocated array (ADR-0009 V4 — PlayMode verifies).
• (2026-09-11) A BoxCollider2D created mid-frame is not queryable by the same frame's cast until Physics2D.SyncTransforms() — StructureView calls it right after creating the collider; a companion negative shows the frame gap (ADR-0011 V3). Do not rely on Physics2D.autoSyncTransforms.
• (2026-09-11) Tunnelling is not a concern of the sweep: the cast covers the whole per-frame delta (a 100 ms hitch × 22 u/s dash = 2.2 u in one cast); terrain blockers thinner than skinWidth are an authoring error caught by the land template validator.
• Addressables build-layout path differs by sub-version (buildlayout vs buildlayout.json) and is written only if Debug Build Layout is enabled — pin the sub-version or the CI gate passes vacuously (vacuous_layout_gate).

FEATURE LAYER

BaseBuilding · Crafting · EnemyAI (section new 2026-09-11 — every Feature epic was Gate-0 blocked before)

Required

Structure registry (ADR-0011)

• Truth: StructureRegistry : IStructureRegistry, IReconcilable (Runtime.Build) — the permanent structures save table + the host-monotonic instanceId counter (persisted). IStructureRegistry.Add/Remove are called only from PlaceStructureCommand.Execute, DemolishCommand.Execute and StructureRegistry.Deserialize (fence Bld_RegistryWrittenOnlyByCommands). HostContext.Structures is this object; every F1/F2 conjunct re-samples it at commit (Rule 13). IStructureRegistry = All, AnyCovers(Cell), TryGet(uint, out StructureInstance), Add(StructureId, Cell) → uint, Remove(uint).
• Mirror: BaseNet.Structures : NetworkList<StructureNetRow{uint InstanceId, ushort StructureIndex, short X, short Y, byte W, byte H}> (14 B, unmanaged, IEquatable; fence Bld_RowIsUnmanaged) on the in-scene, always-spawned BaseNet — its own NetworkObject, never HostCommitChannel's. RegistryReplicator (host) is its only runtime writer: once after every Drain(), Structures.Add(row) per new instance, Structures.Remove(row) by value per removed one; list order is placement order and carries no meaning (fence Bld_ListSingleWriter: Structures.Add(/.Remove(/.Clear(/Structures[ only in RegistryReplicator and BaseNet.Initialise). A mirror, not host-rail state: no gate reads it, no table holds it.
• Boot: after Save.Load() reconciles structures (relics kept), BaseNet.Structures is filled from the registry before StartHost — Initialise populates the backing list directly (not a replicated write) and throws if NetworkManager.Singleton.IsListening; every storage row's StorageNet is spawned with rows pre-filled. Late join: the joiner receives BaseNet with the full list at scene synchronisation; the snapshot carries no structures table; a placement in flight during the join is an ordinary later delta.
• StructureIndexTable (Runtime): ordinal-sorted IGameData.Structures keys → ushort StructureIndex; a structureId absent from current data (relic) → 0xFFFF (fence Bld_StructureIndexIsSortedOrdinal); hash folded into dataHash after items. X, Y = the footprint's anchor cell (min corner); W, H = the footprint as it was when the row was written (def at placement; save column on load) — so a relic keeps its silhouette, collision, noOverlap and FindCorrectionCell footprint after its def is gone (user decision; not narrowed to 1×1).
• ClientRegistry (Runtime.Build, one per machine including the host's own process — no "host instantiates directly" branch): subscribes to Structures.OnListChanged; on Add creates a StructureView — a plain non-networked GameObject at Cell.Center(X, Y) with a static BoxCollider2D on layer Structure sized Footprint × 1 u (offset to the footprint centre), isTrigger = false, no Rigidbody2D, plus SpriteRenderer (def sprite; relic → fallback visual at the row's own W × H), then Physics2D.SyncTransforms() so the sweep sees it this frame; on Remove (keyed exclusively on Value.InstanceId — Index is unset on that event) destroys the view (fences Bld_NoIndexOnRemove, Bld_ViewPerRow). Exposes IStructureRegistry's read half (All, AnyCovers, TryGet; Add/Remove throw) for the ghost's provisional F1 and advisory stationPresent* — display only, never gating; a relic surfaces as StructureInstance{Structure = StructureId.Relic} (AnyCovers uses the row's W × H; StationPresence never matches it).
• Instant blocking (AC-27): the collider exists the frame the Add event fires; the next Sweep.Move on every machine stops at it. Outcome vs row: StructurePlaced may arrive one tick before the row — presenters act on the outcome, movement on the collider.
• Registry and colliders are never compared: every host gate reads HostContext.Structures (never a collider); every sweep reads colliders (never the registry); the sub-tick window on the host where the registry leads the colliders is safe because nothing reads both (registry_and_colliders_never_compared; review fence Bld_RegistryAndCollidersNeverCompared over Runtime.Build + Runtime.Enemy).
• Chests are a registry row AND a StorageNet, bound lazily: both are deferred effects of one drain on two objects with no ordering relation. StructureView for a storage row looks up StorageNet by StructureInstance (a static dictionary StorageNet registers into on OnNetworkSpawn) or subscribes to StorageNet.Spawned; StorageView binds the other way; either arrival order works (V4). Demolish removes the row and QueueDespawns the object in the same drain; a client handles either order. A client with the chest panel open closes it on the row's Remove event (StructureRemoved(InstanceId) → PanelManager) — keyed on the row, never the outcome. ContainerId = "s" + InstanceId.
• Outcomes: StructurePlaced{uint Instance, ushort StructureIndex, short X, short Y, PlayerKey Placer} (≈ 25 B) and StructureDemolished{…, PlayerKey Demolisher, bool RefundIsZero} (≈ 26 B) — both name the actor so CarryFold can apply cost/refund from data; the row carries no actor (AC-24 anonymity is a registry fact). CommandRejected reasons in F1 gate order: TooFar → OutOfBounds → Overlap → Occupied → NoWayOut → BadTerrain → SocketExclusion → NotEnoughMaterials; demolish: AlreadyGone, ChestNotEmpty, NoRoomForRefund.
• EC21 trigger (write mode is ADR-0009's): on the list Add event the local ClientRegistry checks whether the local player's cell is inside the new footprint; if so Rules.Build.FindCorrectionCell(seed, terrain, registry, placeable) (pure, reads no player positions) → PlayerMotor.CorrectTo(cell.Center); null = EC22 (socially resolved). Only the owner corrects itself. Three pins: re-check immediately before the write; at most one correction in flight, re-evaluated fresh at the post-correction cell (a second wall queues one re-check); N, E, S, W order is the binding tie-break (fence Bld_CorrectionOrderIsNESW against the GDD fixtures).
• **stationPresent* — two contexts, one function: Rules.Build.StationPresence.Exact/AtLeast(tier, asker, registry, defs, stationRange) — pure. Host: StationPresence : IStationPresenceProvider over HostContext.Structures at the commit instant inside CraftCommitCommand.Execute, never cached; asker = ctx.Positions.HostKnown(OwnerClientId); RangeSlackUnits does NOT apply** — stationRange is a design knob, not an anti-cheat reach gate. Client: the same function over ClientRegistry for greying/hints only. Exactly two predicates (AC-44).
• StructureInstance stays exactly three fields (InstanceId, Structure, Position — AC-24, fenced Schema_StructureInstance); the wire row is a different type allowed its extra fields; the footprint lives in a save-table column, never on the instance.
• structures.json / StructureDef / BuildConfig get their fields in the BaseBuilding Data story (Rule 1 + knobs: placementReach, socketNoBuildRadius, perimeterSegments; stationRange is crafting's); joins RequiredFiles + both TestJson fixtures; the placeable Region must fit short (Bld_RegionFitsShort).

Crafting (ADR-0008 §5 / ADR-0010 §1 / ADR-0011 §7)

• CraftCommit command (4+4 B: RecipeId, StationInstance?) → CraftCommitted{Player, RecipeId, InstanceId, mark row} outcome — the registered append-only exception: it carries the new InstanceMetadata row, applied insert-if-absent by InstanceId; InstanceMetadata otherwise arrives only in the snapshot.
• instanceId is issued host-side, monotonic from 1, rides stacks as the decimal-string instanceTag, crosses the wire as uint via TagCodec; nothing but crafting creates a tag.
• The craft stance/FX is client-predicted; the commit is the host's; the owner's bag delta is the fold over CraftCommitted + IGameData.Recipes (data, identical everywhere).
• Station gate: host-side StationPresence at the commit instant over HostContext.Structures (above); the client's advisory copy never pre-validates in place of the host (AC-39b).

Enemy simulation (ADR-0012)

• Identity: EnemyActorId(SocketId Socket, ushort Index) — Index is the enemy's position in the docking's composition list (0..n−1), identical on every machine and reload. Data.EnemyId = archetype key. EnemyIndexTable (ordinal-sorted IGameData.Enemies keys → ushort Archetype) is appended to dataHash after structures.
• Data: enemies.json → EnemyDef{Id, Tier, MoveSpeed, PatrolSpeed, PreferredRange (0 = melee), BackpedalsWhenClosed, Interruptible, Attacks[]} with AttackDef{AttackId, TelegraphMs ≥ 400, ActiveMs, RecoveryMs, Shape (arc | thrown-point | slam-circle), Damage, Knockback{Distance, Secs}, LungeDistance, Uninterruptible}; HP/damage bands stay in combat.json. enemy-ai.json → AiConfig{aggroRadius 6 (4–10), leashRadius 14 (10–20), deAggroSecs 6 (3–12), separationRadius 1.2 (0.8–2.0), separationStrength, separationWhileAttacking (0), maxUninterruptibleTelegraphsPerTarget 1 (fixed), guardDensityByBand {shore 0–1, mid 1–2, deep 2–3} (monotonic), deathLingerSecs, noProgressEpsilonUnits}. Rusher, Spacer and Bulwark are three parameter sets of one machine, not three classes.
• Spawn contract — deterministic composition, one NetworkObject per enemy: on LandActivated (tick step 1) EnemySpawner : IEnemySpawner runs Rules.Enemy.Composition.Choose(template, variationSeed, spawnPoints, guardDensityByBand, allowedByBand) — pure, seeded, byte-identical everywhere (fence Ai_CompositionIsPure: 100 runs identical, seed + 1 differs) — and buffers ctx.QueueSpawn(SpawnRequest.Enemy(actorId, archetype, cell, facing)) per spawn in Index order; the phase-4 flush instantiates the prefab at SpawnPoint.Cell.Center, sets EnemyNet{ActorId, Archetype, Phase = Dormant, AnimFrame = 0} before Spawn(), spawns, and calls CombatState.AddEnemy(actorId, archetype). Per point: k ∈ guardDensityByBand[band] enemies, archetype from TemplateDef.GuardArchetypesByBand, facing, 0–2-point patrol offset. ≈ 10 enemies per land at MVP; one CreateObjectMessage per object per client (V1).
• No respawn, ephemeral: the spawner runs once per activation; death removes row and object for the docking's remainder; a reload re-derives the composition and every enemy returns (accepted). Nothing in Runtime.Enemy implements ISaveable/IReconcilable (fence Ai_NoEnemySaveTable).
• Teardown order: EvictionExpired(socket) → EnemySpawner despawns every enemy on the socket (Despawn(destroy: true)) before the LandNet despawn and drops pending lingers; LandTornDown → CombatState.RemoveEnemiesOn(socket). A client handles either arrival order (the view's parent is not LandNet). (ADR-0012's EnemySpawner Key-Interfaces comment originally said LandTornDown; corrected 2026-09-11 — §2's TD C6 ruling is binding, since LandTornDown fires after the LandNet despawn.)
• Death: combat sets Phase = Dead; the brain enters Dead, stops steering; after deathLingerSecs the spawner Despawn(destroy: true)s and combat removes the row. The linger is host-timed by holding the object alive — Despawn sends the destroy immediately; clients destroy on receipt; clients observe the kill as SwingLanded{Lethal} (edge) then Phase = Dead (state, one tick later).
• The machine — Rules.Enemy.EnemyBrain.Step(BrainState, Senses, EnemyDef, AiConfig, nowTick, tickDt) → (BrainState′, BrainActions), pure. Modes Dormant | Aggro | Return | Dead. Dormant: patrol post ↔ PatrolPath at PatrolSpeed; aggro on a living non-downed player within aggroRadius on this land, or on WasHitSinceLastTick (always). Aggro: target = nearest such player at aggro time, re-targeted only when the target dies/leaves the land; approach (Spacer holds PreferredRange and backpedals when closed on; Bulwark advances slowly) ⇄ attack when in range ∧ CombatPhase == Idle ∧ cooldown elapsed ∧ the cap allows → EnterTelegraph(attackId); during Telegraph/Active/Recovery DesiredVelocity = 0 except a Rusher's authored LungeDistance as Displace(Dash-kind) on Telegraph → Active. De-aggro when dist(target, GuardPost) > leashRadius ∨ target not on this land (shore threshold absolute, Senses.TargetOnLand) ∨ no progress for deAggroSecs (LastDistToTarget not reduced by noProgressEpsilonUnits — the cliff case) → Return (toward GuardPost at PatrolSpeed; LeashReset = true once, on entry) → Dormant at the post. Re-aggro on damage overrides every non-Dead mode, including Return, targeting the attacker, evaluated before the de-aggro tests — a damaged enemy can never LeashReset in the tick after it was hit (fence Ai_DeAggroResets).
• The brain never reads or writes HP or the meter; interruptibility is combat's (IEnemyCombat.Interruptible); a hit during a Rusher's Telegraph shows up as CombatPhase → Stagger.
• Density cap is AI-side and counts intent: AiWorld.UninterruptibleTelegraphsOn(target) = enemies with BrainState.Target == target, an Uninterruptible attack pending/current, and CombatPhase == Telegraph; a Spacer/Bulwark at the cap holds range and retries next tick; Rushers exempt. It counts BrainState.Target, not resolver coverage — a player inside a second enemy's shape can take two uninterruptible hits (accepted at MVP; revisit on CC-lock reports) (fence Ai_DensityCapHolds).
• Movement — steering through the shared mover, no pathfinding, no colliders: EnemyMotor (host, one per enemy, enabled only on the server) each rendered frame takes the last tick's DesiredVelocity + Rules.Enemy.Steering.Separation(self, neighbours within separationRadius, cfg, selfIndex) (inverse-distance push from every other living enemy on the land) and calls KinematicMover2D.Drive(velocity, Normal, dt); knockback arrives via IDisplacementSink.Displace(Knockback). Attacking enemies hold their ground (separationWhileAttacking = 0). Coincident-start tiebreak: within coincidentEpsilon 0.01 u the separation direction is Steering.TiebreakDirection(Index) = unit vector at Index × 137.5° — deterministic, distinct per index, never random (fence Ai_TiebreakIsDeterministic: 16 indices → 16 distinct directions; no Random in Rules.Enemy/Runtime.Enemy). Straight-line seek only; a cliff is the deAggroSecs case (V5). GuardPost = spawn cell centre; the shore threshold is LandInstance's cell bounds via ILandBounds (pure) — the rule is the bound, not the collider.
• Replication: EnemyTransform (Server authority, X/Y, Interpolate on clients, PositionThreshold 0.02, unreliable deltas, tick rate, global buffer) · EnemyNet { Phase : NetworkVariable<byte>; AnimFrame : NetworkVariable<byte> (traits 0.05 s, written by the host EnemyAnimator from phase fraction × flipbook length); Archetype : NetworkVariable<ushort>; ActorId : NetworkVariable<EnemyActorIdNet{byte Socket, ushort Index}> } — Archetype/ActorId set before Spawn() (fence Ai_WireStructsUnmanaged). Never HP, meter, immunity, target or brain state. Cadence is full tick rate — a reduced enemy cadence is deliberately not built; PositionThreshold is the knob if bandwidth ever measures.
• Host step placement: EnemyAI.Tick(ctx) = host step 3 — for each living enemy on a docked land: build Senses (players from ctx.Positions.All() mapped to keys via SessionState, phases from ICombatState.Enemy(actorId), cap count from AiWorld, TargetOnLand), EnemyBrain.Step, apply BrainActions (EnterTelegraph/LeashReset through IEnemyCombat; DesiredVelocity/Displace into EnemyMotor). Senses is a struct over pooled lists — 0 B/tick. The AI never calls EnemyAttackResolver — combat fires it from step 2's Telegraph → Active.
• Telegraph timing: TelegraphMs ≥ 400 = ≥ 20 ticks at 50 Hz, exact host-side (tick-based phase timer); the remote read (combat AC-25, ≥ 330 ms visible at 140 ms RTT) is a playtest measurement — the fix for a miss is telegraph length/dash tuning in data, never lag compensation.
• Ai_NoClientAi: EnemyMotor/EnemyAI/EnemySpawner are IsServer-guarded (PlayMode client-mode fixture: no tick runs); EnemyView references no brain/motor type (client_side_enemy_ai).
• Party scaling lever pre-armed: EnemyScalingContext.Empty passed through; guardDensityByBand is the lever (Rule 11).

Forbidden (Feature)

• Never let a command's Execute read ClientRegistry — Rules cannot name it and HostContext holds no ClientRegistry (client_registry_gating_a_commit; fence Bld_ClientRegistryIsAdvisory).
• Never derive a blocker from HostContext.Structures or a gate from a collider (registry_and_colliders_never_compared).
• Never read NetworkListEvent.Index on a Remove event — key on Value.InstanceId (list_index_on_remove).
• Never write BaseNet.Structures outside RegistryReplicator/BaseNet.Initialise; never call Initialise on a listening NetworkManager.
• Never trigger EC21 from StructurePlaced — the outcome can precede the collider by a tick; correcting first could move the player into the wall (ADR-0011 Alt F).
• Never put the footprint (or a builder, or a cost snapshot) on StructureInstance (AC-24); never narrow a relic to 1×1.
• Never widen stationRange by RangeSlackUnits; never cache stationPresent host-side; never let the client copy gate a commit (AC-39b).
• Never give a structure its own NetworkObject (Alt B) or a wall Tilemap/CompositeCollider2D (Alt D — the recorded optimisation if box count ever measures).
• Never run enemy AI, prediction, or a gating timer on a client (client_side_enemy_ai; Ai_NoClientAi).
• Never query Physics2D/Collider2D/Rigidbody2D.Cast from Runtime.Enemy — movement only via KinematicMover2D (collider_queries_in_enemy_runtime; Ai_NoColliderQueries); never pathfind (A*/navmesh — Alt E).
• Never call anything on the combat surface but EnterTelegraph and LeashReset from AI code (Ai_BoundaryIsTwoCalls); never let the brain read/write HP or the meter; never let combat read the AI's aggro state (Alt F).
• Never use System.Random/UnityEngine.Random in Rules.Enemy/Runtime.Enemy (random_in_enemy_rules) — composition and the tiebreak are seeded/deterministic.
• Never save anything about enemies (enemy_save_table); never respawn within a docking.
• Never write three archetype classes or a behaviour tree — a new mode is an ADR amendment, a new parameter is data (Alts C/D).
• Never build a per-enemy transform cadence or throttle (Alt G) — PositionThreshold is the only knob.
• Never let EnemySpawner mutate a live EnemyActor field — its phase-4 site is row creation/destruction only (ADR-0012 C2).
• Never derive telegraph VFX or pose from local animation timers — drive them from the replicated Phase change (TR-combat-007).

Guardrails (Feature)

Engine constraints (Feature)

• NetworkList.Remove(T) never assigns Index and shifts later elements (src 498–522) — the whole reason clients key on InstanceId.
• In-scene NetworkObject lists reach a late joiner only if filled before StartHost (CHANGELOG #3177); NetworkConfig.EnableSceneManagement stays true (default).
• Physics2D.SyncTransforms() after creating a collider mid-frame or the same frame's Rigidbody2D.Cast does not see it (ADR-0011 V3).
• NetworkObject.Despawn(true) sends the destroy immediately — a death linger must hold the object alive host-side; DeferredDespawnTick is not used.
• MinSecondsBetweenUpdates gates sends only — the host may write AnimFrame every frame; a client sees ≥ 15 distinct frames/s over a 1 s flipbook (V2).
• ⚠️ Steering oscillation between seek and separation at PreferredRange (Spacer jitter) is a tuning risk — dead-band on PreferredRange in EnemyBrain, PlayMode fixture with two Spacers on one target (ADR-0012 Risks).

PRESENTATION LAYER

UIHUD · TideTint · FeedbackPresenters · EnemyView

Required

Tide tint (ADR-0013) — the rule that has already been wrong once

• _TideTint and _TideAmount must be declared at Shader Graph blackboard Scope = Global.
• ⚠️ Show In Inspector is NOT that control. Disabling it only adds [HideInInspector] — the property is still in the material's property block and still shadows the global; Shader.SetGlobal becomes a silent no-op. Only Scope = Global removes it from the block (review E14)*.
• The editor test asserts absence: shader.FindPropertyIndex("_TideTint") == -1 (and _TideAmount), as instance methods on the loaded Shader. Never assert GetPropertyFlags(...) == HideInInspector (review E15).
• TideTintDriver (in Presentation) writes both globals exactly twice per frame, reading only ITideClock.TintFloats(0). No tide math. No caching across frames.
• DriftLayer is exclusion by construction: excluded sprites use a different shader with no tint inputs, never a runtime branch.
• On LandTornDown(socket) the driver writes _TideAmount = 0 — a global retains its last value.
• Violet is held at 1.0 through the whole EvictionGrace window — no fade, no early neutral.
• The BB ghost's dashed state is pre-authored sprite frames in the home atlas.
• The reach grid is one procedural mesh, one unlit material (1 draw call), never a quad per cell.
• N > maxSocketsSupported (currently 1) fails boot loudly — never a runtime warning.
• SRP-batcher compatibility is asserted structurally: ShaderUtil.GetSRPBatcherCompatibilityCode(DriftLayerSprite) == 0 after one rendered frame, beside a deliberately incompatible control shader. UnityStats.batches is not a meter (ADR-0013 V2, 2026-09-07).

UI (ADR-0014)

• UI Toolkit for all screen-space UI; sprites, never UGUI, for all world-space UI.
• No uGUI EventSystem in any scene, ever (ui_event_system_present).
• World-space text uses TextMeshPro (mesh) — never TextMeshProUGUI.
• RebindingOperation.Dispose() on all four exit paths — success, cancel, timeout, screen close (V4).
• One IPanelManager owns which screen is open; it asks the InputAdapter and never touches InputSystem directly. (2026-09-11) It closes any panel bound to a structure instance on that row's Remove event (StructureRemoved(InstanceId) from StructureView teardown) — keyed on the row, never on StructureDemolished (ADR-0011 §4).
• UiCaptured is set from an Update after -1000, so capture applies from the next frame.
• hudOpacity is per-element via .hud-dimmable.
• ReasonSelector.Step lives in Rules, not Presentation (formula_in_runtime_assembly). (2026-09-11) The ghost's reason string on a refused commit comes from CommandRejected.ReasonCode in F1 gate order (ADR-0011 §5).
• Hysteresis: a string persists ≥ 250 ms; a different first-failing gate replaces it only after 2 consecutive frames. The ghost outline is never hysteretic.
• settings.json: atomic writer, no backups, no F_FULLFSYNC, never inside a tick. 14 keys, never in the world save.
• Settings failures are specific: missing file → silent defaults; malformed → defaults + loud log + settings.bad.json + notice; out-of-range → clamp and log by name; missing key → default and log by name.
• Application.targetFrameRate = 60 is pinned regardless of vsync.
• (2026-09-11) Title screen host/join consumes ISessionLauncher (HostAsync → join code, JoinAsync(code)); a client's OnConnectionEvent(Disconnected) routes to the title screen with the reason string (ConfigVersion, "bad key", "key in use", host left); the HUD debug overlay shows SessionState.DroppedByRule counters and CurrentRttMs (ADR-0008 §1/§7). The generic join-code model is preserved — no Steam primitives.
• (2026-09-11) Inventory/storage screens bind to ICarryView (Visible) and StorageView (rows); the build picker/placement screens bind to ClientRegistry + StructureIndexTable; HUD affordability reads the fold's Confirmed (ADR-0010 §2, 0011 Enables).

Feedback presenters and views (ADR-0002 §7 / ADR-0008 §2 / ADR-0012 §5) (new 2026-09-11)

• Presenters act on the outcome's own payload (DamageTaken, Yield, Instance, ReasonCode, …) and treat replicated variables/rows as state that will catch up one tick later (outcome_handler_reads_variable). The flyout follows InventoryTransferred/HarvestResolved; the grid follows the row; the wall thunk follows StructurePlaced; the wall itself follows the row.
• EnemyView (every machine): flipbook by Archetype × Phase × AnimFrame; telegraph pose/rim on Phase → Telegraph (never re-derived from local animation — TR-combat-007); Stagger White on SwingLanded{Victim == ActorId, StaggerFired}; death flipbook on Phase → Dead; facing from interpolated velocity. No client AI, no prediction, no local timers that gate anything — a client never decides a phase. EnemyView references no brain/motor type.
• Remote player bodies face their last non-zero movement direction from interpolated velocity; the owner faces its aim; facing = SpriteRenderer.flipX, never a negative localScale.x (ADR-0009 §8).
• CommandRejected un-predicts the owner's own FX only (whiff, ghost reason, dropped pending bag delta) — the world shows nothing for a rejected command.
• NodeView derives the crack stage from SwingsRemaining / swingsTotal on the list's OnListChanged for its index; the yield flash rides HarvestResolved (host-confirmed).
• StructureView sprite: def sprite, or the generic relic visual at the row's W × H for StructureIndex == 0xFFFF. No gear visuals on remote bodies at MVP.

Forbidden (Presentation)

• exposed_shader_global_read — never drive a Per Material property with SetGlobal*.
• mpb_on_driftlayer_sprite — no MaterialPropertyBlock anywhere in the DriftLayer path.
• baked_tide_state_variant — no _low/_mid/_high sprite variants.
• non_render_graph_pass — no pre-6.3 SetupRenderPasses shape. ⚠️ modules/rendering.md still contains that deprecated signature — do not copy from it.
• Never build the N > 1 per-sprite-phase route at MVP.
• scheme_gating_gameplay — InputScheme is presentation-only (glyphs), never a gameplay branch.
• input_system_outside_adapter — only InputAdapter and rebind types reference UnityEngine.InputSystem.
• input_edges_in_fixed_update — one frame in six has zero FixedUpdate calls at 60 Hz render / 50 Hz physics.
• Never add a Rotate action or a Build-map move/relocate verb.
• Never add UGUI world-space canvases for flyouts.
• Never implement uiScale via referenceResolution — use PanelSettings.scale.
• Never expose a per-player aggregate of craft/build/harvest tallies anywhere in Driftlands.*.
• Never give the fatal-config screen USS or a theme.
• (2026-09-11) Never read a NetworkVariable.Value, a StorageNet row or ClientRegistry inside an OutcomeRpc handler expecting the outcome already applied (outcome_handler_reads_variable).
• (2026-09-11) Never drive a telegraph, stagger or death visual from a local timer or animation state — only from the replicated Phase change or the SwingLanded edge (client_side_enemy_ai).
• (2026-09-11) Never show another player's bag, or predict a harvest/craft/placement bag effect in the HUD — Visible = Confirmed + own pending transfers only.
• (2026-09-11) Never close a chest panel on StructureDemolished — close on the row's Remove (the outcome can precede the row).
• (2026-09-11) Never design title-screen host/join around Steam lobbies, rich presence or friend invites — ISessionLauncher's join code is the abstraction (QQ-04).

Guardrails (Presentation)

Engine constraints (Presentation)

• Shader property precedence is per-instance → material → global — the global applies only if the material does not define the property. Spike V1 before building anything on it.
• Shader.SetGlobalColorArray does not exist on 6.3 — only Float/Vector/Matrix array setters.
• Shader Graph 17.x has no array property type — an N > 1 global array needs a Custom Function node with hand-written HLSL.
• ⚠️ SpriteRenderer exposes no vertex-stream API — the N > 1 per-sprite route is likely unavailable as designed.
• UI Toolkit's built-in scene-independent runtime event system consumes the project-wide UI map with no EventSystem. PanelEventHandler/PanelRaycaster appear only when an EventSystem exists, and then deactivate the built-in path.
• UI Toolkit matches by action role via Project Settings → Input System Package → UI Actions, not by the map's literal name — safe here only because this project explicitly assigns that reference.
• ⚠️ UNVERIFIED: whether PanelSettings.scale re-lays-out live at runtime. Spike first; the fallback is boot-time application with a "restart to apply" notice.
• 6.3's USS parser is strict — an invalid selector blocks asset import. CI asserts every .uss under Assets/UI/ imports clean.
• Input System 1.20 removed per-control pressPoint on sticks — action-level press APIs follow an explicit Press interaction's threshold.
• EditorSettings.spritePackerMode = 3 packs sprite atlases at build time only — Play Mode never renders from a SpriteAtlas; every atlas-batching claim is verified only on a built player; an EditMode test asserts the setting (ADR-0013 V8, 2026-09-07).
• (2026-09-11) NetworkTransform interpolation on non-authority instances is the only smoothing a remote body gets — Interpolate = true, Lerp, global buffer; a presenter never adds its own smoothing, extrapolation or dead-reckoning on top (TR-move-004).

Implementation status (2026-09-11 — per-layer fractions from requirements-traceability.md; suite counts from production/session-state/active.md; Gate 0 from production/playtests/gate-0-2026-09-11/)