# Decision: keep driving live across terrain-skill durability boundaries Status: implemented; native artifact accepted for whitepaper publication. 2026-09-24. Action: publish the accepted evidence through the existing static whitepaper release. ## Context and evidence The authorized outcome is simultaneous off-road driving by two live Jev roles, with a third using an admitted terrain skill, followed by a native recording and publication on the existing bilingual whitepaper. The checkpoint visibility contract still requires Accepted and terminal durability before public effects. `DUAL_DRIVING_CHECKPOINT_DECISION.md` removed intentional five-second waits but did not establish continuous simulation. Release scope is the existing static whitepaper Worker `engine-pajama-studio` at `engine.pajama.studio`, replacing edition 1.15 with 1.16 after local artifact and browser validation. This does not deploy the engine backend. The candidate is an uncommitted working tree; the public receipt binds exact source and runtime binary hashes. Preserve earlier source pins and unrelated working-tree edits. For an uncertain deployment outcome, compare the remote manifest and asset digests before retrying; retain the previous Worker deployment identity. The direct root is `package_skill_visibility_allows_tick_v1` in the server tick: an unreleased Accepted delivery prevents all simulation, then the ABI2 terrain command's terminal cut holds all simulation again. Both cars therefore freeze together while the renderer may continue producing 30 FPS. A crater is not just a particle effect: its admitted skill crosses two durable composite cuts. This couples unrelated vehicle movement to whole-world storage latency. ```mermaid flowchart LR A[Admit skill] --> B[Accepted composite cut] B --> C[Apply typed terrain command] C --> D[Terminal composite cut] D --> E[Release terrain, effects and receipts] E --> F[Resume simulation] C --> G[Bounded collision preparation] G --> F ``` The diagram describes the rejected baseline. Local r7 removed the measured client shoreline hitch, but still froze both cars for up to 703 ms. The user rejected this as visibly severe. The old 1000 ms observation-gap gate is not an acceptable smoothness bar; the replacement is 350 ms on a nominal 200 ms observation stream, at most 400 ms without midroute pose progress, and unaltered native capture. ## Staged terrain activation Accepted receipt persistence changes no spatial state. While that phase waits, the existing movement, physics and entity replication phase continues; script execution, lifecycle edits, publication changes and new interactions wait. For a successfully attributed skill tick whose **entire native edit batch is terrain-only**, with no damage or control commands, retain a move-only committed mixed-edit aftermath token and its COW terrain preimage. `Shared::terrain` and the restricted-resource ledger contain the candidate for the existing composite checkpoint; `active_terrain()` supplies the preimage to ground streaming, driving feedback, movement, public observation and admin snapshots. The checkpoint remains the same cold-preflight/dependency/root/fenced-CAS path. There is no new journal or agent mutation ingress. The existing bounded pose-writeback plan may reserve newer checkpoint generations while this isolated candidate waits. Generic persistent mutation admission stays fenced. No Lua state tick or terrain aftermath is replayed while waiting. Existing driving intents/cancellation remain accepted. At the tick boundary, the durable generation and prepared derivatives authorize consuming the aftermath, installing collision and publishing terrain. The same ordered delivery owner then releases the terminal receipt and cues; it withholds them while the staged candidate still owns the activation token. Mixed entity/damage skill batches retain their original global fence. ```mermaid flowchart LR A[Admitted terrain-only command] --> B[Private candidate and sealed aftermath] A --> P[Retained active terrain] P --> M[Driving, physics and replication continue] B --> C[Existing composite checkpoint and fenced CAS] B --> D[Prepare at most four collision tiles] C --> E[Tick-boundary activation] D --> E E --> F[Install collision, publish terrain, release receipt and cues] F --> M ``` Before a terminal HEAD commits, recovery sees the earlier Accepted cut and its pending event. After it commits, recovery sees the terrain, consumed event and terminal receipt in one composite cut. Poses newer than a captured cut use the ordinary existing durability window; the activation cannot overwrite newer poses because its batch contains no entity edits. Lease-loss and durability-age shutdown protections still apply. Budgeted collider rebuilding after activation remains the fallback for batches affecting more than four tiles. The first staged diagnostic (`staged-profile-r1`) committed five live Jev craters. The longest observation intervals fell to 218/217 ms (normal cadence: 200 ms), while uploads still reached 376 ms and decision-to-terminal waits 706–1000 ms. It exposed a separate collision handoff stall: one 214 ms interval had no new physics publication. This 1 FPS diagnostic is not a publishable video. Small terrain batches now prepare up to four affected collision tiles off-thread while persistence is pending. Their exact terrain snapshot and per-tile source fingerprints bind the derivatives. Once CAS is durable and all derivatives are ready, the tick owner installs all four through the synchronous Physics proof, retires older worker/request tickets, and publishes terrain before releasing the terminal receipt/cues. No simulation step can see a partially installed batch. Preparation or install failure quiesces the authority before further movement. Batches larger than four tiles retain the existing streaming budget. The bound also limits derivative memory and synchronous native cooking at activation. The release gate now requires **zero sampled midroute physics stalls**, in addition to <=350 ms observation gaps and <=400 ms without pose progress. The focused regression arms a real local composite CAS, withholds its storage job for forty simulation ticks, and checks live Rapier publication, persistent movement, replication, old public terrain, held Lua execution, and exact resource receipts. It then executes/reconciles the CAS and checks one-shot activation. The live V6/OpenRouter recording and full capture are separate release evidence; passing the focused test alone is not sufficient for publication. Instrumented local runs `continuous-profile-r2` and `continuous-profile-r3` measured capture at 1–3 ms, encoding around 10 ms, content preparation around 670–735 ms, scripts at 1 ms, remaining runtime validation at 8–10 ms, dependency upload around 250–330 ms, and CAS at 3–6 ms. Two sequential skill cuts produced observation gaps around 2.5 seconds. These are diagnostic 1 FPS runs, not videos accepted for publication. Source/binary hashes and final measurements belong in the recording evidence, not an inferred Git commit for this dirty workspace. ## Alternatives and selection | Option | Benefit and constraint | Decision | | --- | --- | --- | | Reconstruct every immutable package on every cut | Existing correctness, measured repeated CPU work | Baseline | | Retain one exact cold content proof | Removes repeat compilation; leaves dynamic state validation and storage path intact | Experiment | | Expose terrain before durable commit | Avoids the wait by changing recovery semantics | Rejected | | Clone the live authoritative catalog | Risks copying capabilities and bypassing cold admission | Rejected | | Prepare collision during the terminal wait | Overlaps bounded derived work with storage while movement uses the active preimage; effects remain private | Implemented for at most four affected tiles | | Reconcile append-only full terrain snapshots as local render edits | Keeps distant mesh/GI caches while honoring exactly the same authoritative document | Experiment | | Stage isolated terrain visibility while retaining the existing composite CAS | Lets unrelated movement use old terrain without a new storage format; mixed commands stay fenced | Current implementation/verification | | Separate a durable command journal from periodic whole-world snapshots | Broader decoupling, but requires a versioned recovery/replay protocol | Deferred; unnecessary for the isolated terrain experiment | The preparer owns one move-only Recovery V2 proof behind a short mutex, bound to its immutable world/realm/profile lifetime. Lookup compares the complete recovery, archive and Delivery Index bytes. The candidate must have no pending activation. Only a successful complete semantic preflight returns its unchanged content proof to the slot; failed preparation consumes it. A concurrent preparation may miss and reconstruct independently. This is a CPU optimization, never a storage acknowledgement or authority capability. Cold hydration does not consult it. ## Execution and acceptance The retained source ceiling is 16 MiB and one entry, sharing immutable byte Arcs; larger cuts still take the original path. Existing decoded-content limits remain in force. World, character mirror, scripts, skills, physics, presentation, resource budgets, exact root and dependency bytes are checked on every publication. Profile rebinding creates a new empty reuse slot. No wire format, physics identity or agent capability changes. The first live reuse run measured content preparation at 8–10 ms and the whole preparation at 19–27 ms. Sequential storage still cost 250–574 ms per cut during driving, and the 50 ms healthy visibility poll alone left a 1.301 second maximum observation gap. Therefore V6 uploads its skill/execution pair sequentially, then initially at most four independent immutable members concurrently. Each object still requires its exact PUT acknowledgement or freshly verified archive HEAD proof. The root waits for every member, and fenced CAS remains a separate phase. There is no local cache of storage acknowledgements, detached upload task, new API or change to the frozen V2/V3/V4 request order. A failed member cancels the bounded futures; completed immutable writes may be safely reused by the existing retry. After that change, diagnostic r6 measured a maximum 750 ms authority observation gap (versus r5's 1301 ms), and 26.012 / 23.208 seconds of actual road progress. Its five committed craters still produced short `collision_not_ready` and `stale_physics` interventions after release. The tick previously returned before ground maintenance at the terminal cut: collision rebuilding waited behind the network, then blocked physics again. The next experiment services the existing budget-one ground maintenance while that terminal fence remains held. This only prepares and acknowledges derived collision; no solver frame, script tick, world mutation, checkpoint generation or network publication may advance. Existing exact-source build tickets, bounded worker/installation queues and ground-readiness gates remain in force. Storage failure still keeps the cut private and frozen. A regression holds the fence while a stale tile is rebuilt and checks that the authoritative and presentation surfaces remain unchanged. The shared authored routes now exceed 100 m, avoiding the old short course's early endpoint stop. Terrain-only steering uses a shorter speed lookahead for cross slopes; paved-road behavior is unchanged. Unattended authored vehicles hold the brake while drivers approach. The endpoint is on flatter ground after a failed pickup parking test on the former cross slope; lane-error acceptance was not relaxed. Both chassis and both driving styles must traverse and stop under the real backend, in addition to the live recording's terrain encounters. The first 30 FPS candidate (`continuous-final-r1`) had five real craters, no collision/stale-physics intervention in their receipt windows, and a maximum 902 ms observation gap. It failed the unchanged progress gate: the faster pickup had 19.994 seconds of measured progress before its endpoint. Extend the initial route by 8 m and rerun both physical traversal tests and native capture; do not round that failed result into a 20-second pass. High-rate capture and live provider choices differ from the 1 FPS diagnostics, so these are scope-bound rehearsals, not a controlled production latency benchmark. The longer-route high-rate run `continuous-final-r2` passed vehicle progress (23.362 / 20.967 s) but failed the fixed 1000 ms observation-gap ceiling at 1017 ms. Its upload median/max were 181 / 250 ms while preparation was 20 / 22 ms; no collision/stale-physics intervention was observed in the five attack windows. Raise the independent-member ceiling from four to eight to reduce upload waves, retaining the sequential skill/execution pair and root/CAS fences. The expanded transport regression holds eight requests, detects a forbidden ninth, and checks failure cancellation. This increases bounded request concurrency, not retained source bytes (the jobs borrow the same prepared byte Arcs). Preserve both failed high-rate captures and rerun unchanged gameplay/native acceptance. Candidate r3 passed gameplay but failed native delivery: missed capture slots intersected the action. Inspecting its reports exposed a second explosion path: `Mirror::apply(ServerMsg::Terrain)` unconditionally set `terrain_replaced`, which made `render_frame` invalidate every mesh and the GI scene. The server intentionally coalesces a terminal skill's terrain into one full authoritative snapshot, so even one new crater rebuilt thousands of client chunks. A sampled right-view counter reached 7,360 completed builds before the end of the driving window, while a typical GPU frame was about 1.7 ms. The global invalidation is a concrete avoidable work source; its exact share of missed frames still requires the next recording. Reconcile full snapshots using canonical documents. If parameters, surface paths and rivers are identical and the previous ordered brush list is an exact prefix, retain the terrain and apply only the suffix to the existing local invalidation queue. Identical snapshots retain revision and do no work; snapshots do not replay sounds. Removal, reordering, changed brushes or base recipes still replace terrain and clear superseded pending edits. A new Welcome still resets the whole namespace. This changes no server publication or collision semantics. Regressions cover duplicate canonical brushes, identical delivery, removal, reordering, brush replacement, parameters, paths and rivers; existing mirror tests also cover shot/snapshot ordering and reconnects. Regression must prove exact root/dependency equivalence on reuse, unchanged move-only proof identity, rejection of corrupted archives and indexes with old descriptors, rejection of invalid skill/tick pairs, and namespace isolation. HTTP tests also hold eight independent requests open, reject a ninth in flight, hold the last member to prove the root cannot overtake it, and inject a failure to prove that neither root nor CAS is issued. Run checkpoint writer/coordinator and skill visibility regressions. Two extended routes must complete and stop under real Rapier for both chassis and both driving styles. Native acceptance still requires distinct complete chase cars, actual FPS, a gap-free continuous excerpt and acknowledged terrain interaction. Candidate r4 still missed native capture slots after the terrain fix. Candidate r5 added separately named current-capture phase counters (ordinary-frame CPU samples deliberately describe another frame), plus sequence warnings above 33.3 ms. They identified 34–36 ms in `ripples` inside 38–42 ms frames; Present was only 0.1–0.3 ms. This rules out swapchain pacing as the dominant measured span in those frames. One missed slot remained in r5, so it is not publishable. `RippleField::mark_stale` merged two exposed strips into their bounding box. For any diagonal scroll, even one cell in each axis, that box is the complete 192 × 192 field: 36,864 terrain queries instead of 383. The former comment that this only "over-asks slightly" was incorrect. Keep an exact dirty-cell mask and scroll it with the wetness mask, including pending edits. A one-cell diagonal now samples 383 cells (98.96% fewer), while retaining exactly the same wet/land result as a full resample. Do not disable water or reduce its spatial fidelity. Full teleports invalidate all cells, fixing another stale-mask case; canonical terrain replacements invalidate the whole shoreline, and local brush changes invalidate only their projected influence including the blend skirt. Previously edits could leave an old shoreline until the camera moved. Tests count queries for every movement sign, compare the complete mask to a full oracle, carry an edit through multiple unsampled scrolls, and check teleport/replacement energy. Candidate r6 then captured all 1,500 slots in both views, but failed the unchanged authority-gap ceiling at 1,047 ms (five committed skills; upload median/max 176/330 ms). This is retained as a failed rehearsal, not a release. The healthy visibility detector still sampled every 50 ms, so a new fence could miss a whole activation tick. Reduce that bounded detection interval to 10 ms, matching supervisor recovery polling; healthy waits make at most roughly 100 checks/s per coordinator. Retry/dormant cadence, five-second ordinary checkpoint coalescing, deadlines and durability requirements are unchanged. Add pair/independent upload timings to distinguish transport from scheduling in subsequent runs. The full coordinator suite must still prove cadence, visibility wakeup, no hot loop when already durable, retry backoff, shutdown and exact-head recovery. The r5/r6 active-window capture reports also independently bound the rendering change: left/right ripple maxima fell from 36.384/35.458 ms to 0.632/0.771 ms; r6 total capture-frame CPU maxima were 9.667/8.180 ms, with no frame above 33.3 ms. These counters exclude startup and non-captured render frames. The provider's live choices differ between runs, so this is workload evidence, not a controlled production percentile benchmark. The full wetness oracle and 383-versus-36,864 query regression establish the algorithmic cause separately. ## Historical mitigation outcome (superseded acceptance) The earlier high-rate candidate `continuous-final-r4` passed unchanged gameplay and continuity checks. Its 28.091 s driving window contained five committed terrain skills. Alpha/Bravo had 24.581 / 21.582 s of measured road progress; each had a maximum 755 ms observation interval and 755 ms mid-route no-progress interval. Moving medians were 3.840 / 4.265 m/s and peaks 9.039 / 9.778 m/s. Attack windows contained one `collision_not_ready` sample and three `intent_expired` samples, with no `stale_physics` samples. Retain these short protective braking episodes; this is not a claim that all stopping disappeared. Those are sampled observations, not every internal controller tick. Stage median/max values were capture 2/3 ms, encoding 11/12 ms, preparation 21/22 ms, content 8/9 ms, upload 119/172 ms and CAS 3/6 ms. This local measurement does not establish a production worst-case upload bound. Executed regressions: checkpoint storage 163, coordinator 28, Package-skill filter 38 (including collision overlap and visibility ordering), ground 22, real-physics driving 6, client mirror 39, capture 27, recording/director JavaScript 19, and formatting. The world suite passed 414 unit tests, 3 integration tests and 1 doc test, with its pre-existing cave-scan test ignored. Its 11 ripple tests include the three new scrolling/edit regressions. The 28 coordinator tests were rerun after the 10 ms visibility change. Retained local outputs and failures identify the exercised scope. Those earlier measurements did not establish acceptable driving continuity. The user rejected r7 despite its gap-free capture and improved CPU timings. ## Current staged-activation evidence The staged-activation build passes 63 skill-related tests (including a real composite CAS held across forty live physics/movement/replication ticks), 61 whole-tick tests, 25 ground tests, six real-physics driving tests and 28 coordinator tests. The latest binary also passes 28 admin, 26 session and 19 world-mutation tests. These are focused filters, not a full workspace test run. The new CAS regression checks candidate checkpoint preflight, continued newer pose generations, held active terrain and Lua state, exact resource receipts, generic-mutation rejection, and one-shot activation after reconciled durable HEAD. Fault regressions reject a changed candidate before any install, bound preparation to four tiles, and prove that a failed worker closes movement, delivery and authority admission. An existing cold-restaging test fixture needed its changed-library skill grant corrected from forbidden Broadcast to Terrain; production capability policy is unchanged. Storage still gates activation of a crater and mixed-command batches; unrelated driving is now permitted during an isolated terrain wait. Production remote latency remains unmeasured. Retain failures, full frame timestamps, active-window observations and receipts. The public receipt and source archive bind the uncommitted candidate by exact hashes. Publish only a natively verified recording, without speeding up or removing its in-excerpt storage waits. The second staged diagnostic (`staged-profile-r2`) had zero sampled midroute physics stalls or pose stops, 216/217 ms maximum observation intervals, and five collision installs with a 0.436 ms maximum. This 1 FPS run remains diagnostic. The first 30 FPS candidate (`staged-final-r1`) captured all 1,500 slots in each view and retained zero sampled physics stalls through five craters. Its maximum observation interval was 214 ms and collision installation reached 0.818 ms. It is nevertheless rejected: Bravo stopped midroute for 798 ms after three consecutive hosted-decision failures expired its last 30-tick intent. Physics continued throughout, distinguishing a deliberate watchdog brake from the fixed global simulation freeze. The director now uses the already permitted 40-tick (two-second) ceiling for fresh decisions. It also records allowlisted failure codes, separating timeouts from invalid responses without leaking provider messages. Failed inference never resends or renews the last decision; long outages still brake. A regression holds repeated failures beyond this ceiling and checks that exactly one intent was ever submitted. The 36 focused JavaScript tests pass. The subsequent recording below supplies native acceptance. ## Accepted native recording `staged-final-r2` completed successfully on 2026-09-24. The unmodified gates accept a 25.154 s driving window with four committed live Jev terrain skills. Both clients captured all 1,500 native slots with zero gaps. Measured active rates are 29.9964 / 29.9992 FPS. The 1920 × 720 whitepaper reel is one continuous 27.954 s excerpt at 1.0×, containing every committed attack, with no interpolated frames or removed in-excerpt waits. Full FFmpeg decoding succeeded. Each client retains its own complete vehicle and all four physics-derived wheels in a third-person chase camera; both present the exact four cast/impact cue pairs. | Measurement | Alpha / Bravo, or aggregate | | --- | --- | | Longest observation interval (nominal 200 ms) | 216 / 215 ms | | Sampled midroute physics stall | 0 / 0 ms | | Longest sampled midroute pose stop | 0 / 0 ms | | Measured time making route progress | 24.802 / 22.994 s | | Moving median / peak speed | 3.849 / 9.072 and 4.191 / 9.545 m/s | | Collision installation median / maximum | 0.456 / 0.509 ms, four activations | | Checkpoint upload median / maximum | 165 / 406 ms, 17 cuts | | Current capture-frame CPU median / maximum | 5.103 / 9.169 and 5.067 / 8.859 ms | | Shoreline CPU maximum | 0.668 / 0.982 ms | All four attack windows advance physics and route progress without sampled controller interventions. Three craters come within two metres of a traversing vehicle, with the closest measured approach 0.505 m. The fourth is farther away; do not describe every shot as a wheel impact. The hosted drivers encounter two timeouts, three invalid distributions and one unavailable-provider response; those failed requests submit no intent and this run has no midroute expiry stop. The two-second finite watchdog remains active, so longer provider outages can still produce protective braking. The native CPU summary covers 754 / 755 captured frames inside the driving window, with none above 33.333 ms. It does not cover every unsampled render frame or establish a controlled production percentile. Observation intervals likewise include sampling and transport, and cannot prove that every sub-200 ms tick was stall-free. The measured 406 ms upload no longer freezes driving, while the 0.509 ms collision install bounds the synchronous activation work in this run. Retained local validation logs, failed attempts and full frame timestamps remain under `docs/evidence/driving-continuous-20260923/validation` and the source run. The public receipt binds native session hashes, ordered report digests, video, exact source excerpts and the runtime binaries. The website's release record separately records local checks, deployment identity and production verification.