Round 38 milestone: owner_epoch — ownership as a durable fence (#432 + #413/#379/#384)
CORRECTS A FALSE SAFETY CLAIM. Three pages asserted that state_version
"fences stale writes, so a mis-fired handoff or a zombie owner can never
clobber a newer record". It never did: state_version is contention control,
and every caller answered a CAS loss by rebasing, so a stale writer rebased
exactly as a legitimate one did.
- Persistence-and-Durability: "The state_version guard" reworked into "Two
guards" — state_version (contention) vs owner_epoch (ownership, at the
SINK). Documents the rollback primitive it closed (a stale shard 60s-old
logout snapshot force-writing over the live owner, repeatable), why the
fence had to be a SECOND column (a rebase moves state_version and cannot
reach a separate conjunct), why the mint is atomic (a read-then-bump would
look fixed), the three-outcome SaveResult, terminal epoch loss on both save
paths, the max(directory,row) floor, fail-closed login, the checkpoint tier
ownership guard (it had NO CAS and was a full bypass one rung up; detects a
double-own ~6x sooner), the (owner_epoch, state_version) load ordering, and
the honest residual (an epoch on row X cannot fence a write to row Y).
- Distributed-Systems-Model + Overview: same correction; adds a "do not confuse
the two epochs" invariant (directory epoch fences ROUTING and is evictable;
owner_epoch fences WRITES and is durable).
- Cross-Shard-Handoff: handoff mints the epoch AFTER destination resolution
(minting first evicted legitimate players mid-move); an unreadable store now
fails the handoff closed; concurrent claims derive distinct epochs hence
distinct handoff tokens, closing the shared-pending race structurally.
- Zone-Runtime: #413 extends the resolve-then-deliver claim to login attach and
Prepare (incl. why neither may reuse claimTransferTarget, and Prepare needing
a release on post failure); #379 refuses a reconnect racing an in-flight
transfer in TWO layers, since a probe reproduced a dupe the resolve-time
check alone cannot see.
- #384: documents why the drain-reservation margin is not bound by step 1
duration (the hold is rebased per accumulate and anchored to the redirect it
covers) and the WARN added to falsify it; corrects the Round 31 "stamped once
and never refreshed" wording on three pages.
Round 36 milestone: instanced zones (#72)
New deep-dive page Instanced-Zones, plus corrections to two pages that
asserted "instancing is deferred / not implemented".
- NEW Instanced-Zones: template-vs-id identity and the ownsZoneRef locality
chokepoint (with the build-failing AST lint); why the id is <template>#<128-bit
random> (# outside the ref charset, unguessable so it is not a farming oracle);
unleased by construction; async 3-hop mint + quiescence reaper; the
instanceable content opt-in; the isolation exclusions (persistent resets fail
closed vs a durable item dupe, per-mint RNG salting, withheld director
schedule events, refused signal_region/world, drain/reload/off-box-ingress);
THE ANCHOR (template projection was killed because placement is the gate ROUTING
key); exit paths; and the security posture.
- Distributed-Systems-Model + Running-at-Scale (x2): instancing now exists but is
ISOLATION, not transparent load-sharding — the public hot-zone ceiling stands.
- Zone-Runtime: quiescence gains the third `incoming` counter for in-flight
intra-shard transfers, claimed under the same mutex teardown checks.
- Cross-Shard-Handoff + RPC-and-Protobuf: signed-snapshot optionals now written
UNCONDITIONALLY — a second append-if-non-empty optional made
digest(tier="",account=X) == digest(tier=X,account="") (length prefixes solve
boundaries, not presence); instances rejected at every off-box ingress.
- Persistence: an instance is never a durable location; the anchor + COALESCE.
- Pack-Entity-Reference: zone `instanceable` flag, start_room respawn semantics.
- Pack-Lua-Scripting: mud.zone(), mud.send_to_instance (self-only).
- Orchestration: instances withheld from reserved schedule fan-out.
- Sidebar + Engine-Developer-Reference index entries.
Round 27: the AdoptZone fence cluster (#316/#288/#327)
The round self-documented #315 (generation fence) on RPC + Sysadmin. Closing
the rest:
- Cross-Shard-Handoff: new 'Zone adoption: build, confirm, or un-adopt' — the
destination requires from_shard_id to be the zone's live owner and refuses
before building (#316, a correctness precondition, not a security barrier since
owner+gen share one read); adoption is confirmed by observing the lease flip
LAND (via ClaimZone), never by the RPC returning; an unconfirmed runtime
adoption is un-adopted when its confirm deadline expires, gated on an 'adopted'
flag so boot zones fence rather than self-delete (#327).
- Zone-Runtime-and-Actor-Model: new 'Runtime zone teardown' — UnhostZone + the
per-zone actor context; the four guards (disposable-not-unowned; quiescence is
not pop==0; post selects on a dead channel or the saver drainer wedges the whole
shard; publish+arm under one lock) (#288).
- RPC-and-Protobuf: the from_shard_id line now notes the live-owner precondition.
- Running-at-Scale: the source tears down a rebalanced-away zone (no zombie per
migration).
Engine Dev: entity/component model, zone runtime, targeting
- Entity-Component-Model: the universal Entity, component set, flyweight+COW
- Zone-Runtime-and-Actor-Model: actor-per-zone single-writer loop, post(),
pulse scheduler (flat slice, not a timer wheel), zoneGen reserved
- Command-Parser-and-Targeting: Diku targeting grammar, visibility chokepoint,
act() perspective messaging + sound-vs-presence split (no $s/$e/$m, no me/self token)
Scaffold wiki + author About and Getting Started
- 48-page skeleton across all audiences (flat files + grouped _Sidebar)
- Every page carries an Audience + Status banner (Ready/Draft/Placeholder)
- About: Overview, History of MUDs (Ready)
- Getting Started: Getting-Started, Running-Locally, First-Admin-Setup,
Content-Packs-Intro (Ready) — dev bypass, local GitHub OAuth, bootstrap
admin, promote/demote, content-pack model, all grounded in code
- SRD5/WoW/D6 pack pages are honest placeholders (packs not yet built)