Implement the deterministic simulation kernel

[zoeyrose]

Outcome

Build the bounded, replayable world loop on which every server-owned gameplay system depends.

Scope

• Separate game ticks, monotonic deadlines, and wall-clock/calendar time into injected typed services.
• Define seeded random streams by purpose so adding an unrelated random call cannot silently perturb combat, treasure, weather, or AI outcomes.
• Process connection, operator, persistence, and internal commands through bounded region queues with explicit ordering.
• Use stable generational handles and reject stale references.
• Define fixed and catch-up tick policy, maximum work per tick, lag accounting, overload shedding, and shutdown quiescence.
• Publish immutable snapshots/events to persistence, protocol projection, telemetry, and tests; consumers cannot mutate live entities.
• Compute a canonical test-only state digest without using raw Protobuf bytes as a content/state hash.

Failure and safety rules

• Panics are contained at the application/region boundary, recorded with safe context, and never leave half-committed gameplay state.
• Queue saturation produces a typed rejection/backpressure result.
• Clock discontinuities and wall-time changes cannot reorder simulation events.
• Random seeds, commands, content digest, and contract version are sufficient to reproduce a failing scenario.
• Work and memory limits are configuration with safe defaults and metrics.

Acceptance criteria

• Replaying the same initial snapshot, seed set, and commands yields the same ordered events and state digest across repeated runs.
• Race tests prove network/storage workers cannot mutate simulation state.
• Property tests cover stale handles, queue bounds, cancellation, tick catch-up, and shutdown.
• Benchmarks publish empty-tick and representative dense-region budgets.
• A headless harness advances fake time without sleeping and is reused by later gameplay tests.

Dependencies and parallel work

Depends on architecture issue #3. Protocol, content compiler, persistence adapter, and gameplay domain design can proceed in parallel against the injected contracts; none may create an alternate scheduler.