Round 38 milestone: owner_epoch — ownership as a durable fence (#432 + #413/#379/#384)
CORRECTS A FALSE SAFETY CLAIM. Three pages asserted that state_version
"fences stale writes, so a mis-fired handoff or a zombie owner can never
clobber a newer record". It never did: state_version is contention control,
and every caller answered a CAS loss by rebasing, so a stale writer rebased
exactly as a legitimate one did.
- Persistence-and-Durability: "The state_version guard" reworked into "Two
guards" — state_version (contention) vs owner_epoch (ownership, at the
SINK). Documents the rollback primitive it closed (a stale shard 60s-old
logout snapshot force-writing over the live owner, repeatable), why the
fence had to be a SECOND column (a rebase moves state_version and cannot
reach a separate conjunct), why the mint is atomic (a read-then-bump would
look fixed), the three-outcome SaveResult, terminal epoch loss on both save
paths, the max(directory,row) floor, fail-closed login, the checkpoint tier
ownership guard (it had NO CAS and was a full bypass one rung up; detects a
double-own ~6x sooner), the (owner_epoch, state_version) load ordering, and
the honest residual (an epoch on row X cannot fence a write to row Y).
- Distributed-Systems-Model + Overview: same correction; adds a "do not confuse
the two epochs" invariant (directory epoch fences ROUTING and is evictable;
owner_epoch fences WRITES and is durable).
- Cross-Shard-Handoff: handoff mints the epoch AFTER destination resolution
(minting first evicted legitimate players mid-move); an unreadable store now
fails the handoff closed; concurrent claims derive distinct epochs hence
distinct handoff tokens, closing the shared-pending race structurally.
- Zone-Runtime: #413 extends the resolve-then-deliver claim to login attach and
Prepare (incl. why neither may reuse claimTransferTarget, and Prepare needing
a release on post failure); #379 refuses a reconnect racing an in-flight
transfer in TWO layers, since a probe reproduced a dupe the resolve-time
check alone cannot see.
- #384: documents why the drain-reservation margin is not bound by step 1
duration (the hold is rebased per accumulate and anchored to the redirect it
covers) and the WARN added to falsify it; corrects the Round 31 "stamped once
and never refreshed" wording on three pages.
Correct transport claims: GMCP-only, no MCCP/NAWS/SSH
Code only offers/accepts GMCP (telnet option 201); MCCP2/NAWS/TTYPE/CHARSET
are skipped/refused and SSH was removed (OAuth-only). Fixes Overview + the
Edge/Engine-Dev/Player scaffolds that claimed otherwise.
Scaffold wiki + author About and Getting Started
- 48-page skeleton across all audiences (flat files + grouped _Sidebar)
- Every page carries an Audience + Status banner (Ready/Draft/Placeholder)
- About: Overview, History of MUDs (Ready)
- Getting Started: Getting-Started, Running-Locally, First-Admin-Setup,
Content-Packs-Intro (Ready) — dev bypass, local GitHub OAuth, bootstrap
admin, promote/demote, content-pack model, all grounded in code
- SRD5/WoW/D6 pack pages are honest placeholders (packs not yet built)