v0.89.0

Changed

• Dev-plane session scoping (🎯T175) — everything session-varying in the dev plane is now per-session, completing the 🎯T174 globals-audit campaign tests-first: per-session app-channel stores (state slices, serializers, hit-target extras, time control, perf counters, game-thread task queues) with process-default registrations inherited by every session; stable session ids (Context::sessionId()) advertised in the app-channel hello; dev RPCs address a session with an optional {"session": <id>} (sole-session default); per-session button hit-target registries (dead sessions pruned), cmdstream LiveCapture sinks (hot path unchanged via an engine-bound active cache), SensorControl accel authority, wire-fed viewer-backgrounded bit, and session-tagged metrics::Scope resolution. "Pause" now means one session, and frame_ms means one session's frame time.

Notes

• Behaviour-preserving by construction: a characterization suite (🎯T175.12) locked every touched surface before surgery and stayed green throughout; 13 new isolation tests prove two sessions hold distinct state. 427/427 unit tests; render goldens unchanged.
• docs/globals-audit.md is now all-green: every accidental global is fixed, session-addressed, or has a written concurrency decision (sprite frame cursors — safe by serialisation, documented at the commit listener).
• With 🎯T163's process-per-session architecture these were latent, not live, defects; this release keeps the in-process multi-world option genuinely open. 🎯T176 (FreeType thread safety) remains open.