OpenZT2 Functional Specification

OpenZT2 is a clean-room, native 64-bit reconstruction of Zoo Tycoon 2 built with Bevy, a data-oriented Rust game engine. Its completion target is a faithful, runnable game with the architecture and performance expected from a new implementation. A readable recovered C++ implementation serves as a behavioral oracle: together with shipped assets, live observation, and binary investigation, it establishes what the original game did. That evidence does not prescribe Rust types, ownership, update loops, or runtime structure.

The finished game must support the complete source-driven shell, map and game mode selection, terrain and camera semantics, construction, living animals, guests, staff, facilities, economy, persistence, progression, scenarios, and expansion systems. It also adds controller support, removes the original 32-bit mod ceiling, and supplies redo alongside undo. A package is complete only when its behavior is integrated into the playable game. Green status is reserved for packages that meet their functional, allocation, mapping, and GPU acceptance contracts in the assembled application.

Native content boundary

Original Z2F game archives, Extensible Markup Language (XML) files, media, downloadable content (DLC), and mods are inputs to a separate preflight application. Preflight resolves enabled-pack precedence, inheritance, aliases, dependencies, original formats, derived data, and target-machine choices before launching the game. It writes one resolved binary profile in the exact layouts consumed by the engine: flat processor tables, graphics-upload-ready payloads, bounded streaming blocks, stable identifiers, and direct lookup indexes. Later-pack override semantics therefore leave no work for gameplay.

Native records use versioned rkyv archives and small fixed representations such as AssetId, TableRange, StringRange, and AssetRange. The game maps the resolved profile once, validates each typed family once, and retains the mapping through ordinary Bevy asset handles. Archived records are read in place. Meshes, textures, shaders, materials, audio, animation, UI documents, world definitions, terrain, navigation, and scenarios arrive in the form their CPU systems or GPU upload paths require. Runtime source parsing, decompression into an intermediate graph, mod merging, asset-instance hardcoding, and a second decoded asset cache are outside the engine boundary.

PreloadMode::Off leaves paging demand-driven. Core faults the bootstrap, menu, zoo, and resident groups within measured free-memory headroom. AllEnabled extends that policy to every enabled on-demand and streaming group. It never reaches an unselected pack because preflight has already produced the single final profile.

Bevy ownership model

Bevy's entity-component-system (ECS) world owns the live game. Each animal, guest, member of staff, facility, habitat, job, objective, vehicle, photo, effect, and other world object is an entity with small components for its current facts. Resources are limited to genuinely global policy, clocks, immutable indexes, reusable scratch, and bounded coordination. Systems query the narrow component sets required for one job and communicate through typed messages only when an operation is genuinely asynchronous.

There is one ECS world and one lifecycle relation for loaded-zoo entities. There are no compatibility hosts, domain managers, shadow runtimes, generic property bags, copied session worlds, string-command dispatchers, or Rust objects that preserve the C++ assembly shape. Package boundaries allocate parallel authorship. Integration may merge, move, inline, rename, or delete package code until the result reads like one coherent Bevy game written by one team.

Simulation uses a fixed authoritative zoo clock and deterministic domain-local random streams. Saved ages, deadlines, durations, cooldowns, calendars, and random-number-generator state use integer ticks or explicit fixed-point units compiled by preflight. Floating-point time remains appropriate for input and presentation that is deliberately independent of simulation time.

Performance contract

Performance is a product requirement. Mapped asset lookup, archived traversal, and cloning a Bevy handle perform zero heap allocations and copy no underlying asset data. Settled gameplay systems target zero allocations. Collections, route buffers, spatial indexes, render extraction, dependency-owned particle capacity, decoder surfaces, and GPU staging reserve bounded capacity before the settled measurement window. Game-content filesystem reads stop after the mapping is installed; save/profile I/O remains an explicit separate boundary.

The regression suite measures three independent categories:

• Rust heap allocations with exact counting tests and Tracy memory events.
• Mapped-page residency and page faults through Linux process counters.
• GPU texture, buffer, staging, and render work through explicit accounting and Tracy/wgpu spans.

A package cannot become green because it compiles in isolation. Green requires its observable behavior, persistence, cleanup, native-data traversal, steady allocation limit, mapped-page behavior, and GPU-resource accounting to pass in the integrated game. When all package cards are green, the expected result is a runnable complete game whose ordinary scene transitions and native save/load paths avoid repeated conversion, copying, and data reprocessing.

Evidence and implementation method

Behavior is recovered just in time from the shipped data, readable C++ oracle, analysis records, and live original. Commit d5657e5a may supply behavioral leads and previously discovered source vocabulary. Its architecture was deleted by 19dd222f and must not return. Unknown source semantics block the relevant preflight schema or gameplay acceptance until the evidence identifies a typed owner and representation.

Implementation proceeds through the package contracts below. Asset packages own one consumer-shaped native family, its preflight producer, its mapped Bevy asset, and focused contract tests. Gameplay packages own cohesive components, resources, messages, and systems under one Bevy plugin directory. Root integration owns manifests, module declarations, plugin groups, schedules, shared vocabulary, dependency changes, and destructive cleanup across package boundaries.

Library ownership

OpenZT2 buys mature commodity infrastructure and writes recovered zoo-game behavior. docs/work-packages/LIBRARY-DECISIONS.md is normative for every package and assigns physics, particles, codecs, file dialogs, mesh/shader processing, and Bevy-native rendering/UI/input/audio facilities to their off-the-shelf owners. Package workers implement only native conversion, integration, policy, and original-game semantics around those owners. They must not build a parallel solver, renderer, mixer, codec, layout engine, particle engine, optimizer, device backend, or copied library world.

Library adoption does not relax the mapping or allocation contract. The game still loads only the resolved native profile; one-time body/GPU/decoder setup is bounded and measured; capacity-stable operation remains subject to Tracy and hard allocation regressions. A failing mandatory dependency is configured, patched, or narrowly forked before bespoke replacement is considered. The audited pre-library design is preserved at commit 68a4c481 for that explicit fallback only.

Package status

The published grid is generated from the 56 normative package briefs in docs/work-packages/briefs/. A brief may declare one of these states with a Status: <state> line after its title. Absence means brief.

• brief: contract complete and ready to implement.
• active: implementation is in progress.
• implemented: code is integrated but its complete acceptance contract has not passed.
• verified: functional, persistence, allocation, mapping, GPU, and integrated gameplay acceptance has passed. This is the only green state.
• blocked: a named evidence or integration dependency prevents progress.

The package briefs are the detailed normative sections of this specification. They retain exact Rust contracts, ECS queries, binary layouts, evidence gates, behavior, and acceptance criteria so each package can be implemented in parallel without inventing an architectural boundary.

Evidence coverage gate

Package-boundary exhaustiveness is checked by tools/audit-work-package-coverage.py. Its generated docs/work-packages/EVIDENCE-CROSSWALK.tsv assigns every current binary function identity, recovered type/vtable identity, C++ oracle file, and official core/DLC archive entry to one implementation package or an explicit external, preflight-only, Bevy-replaced, non-shipping, or binary-data disposition. EVIDENCE-COVERAGE.md summarizes the result.

The audit must be regenerated whenever accepted evidence or package boundaries change, and publication rejects a stale or incomplete crosswalk. Passing means there is no known unowned domain. It is not a claim that unresolved formulas, edge cases, presentation details, or behaviors absent from current evidence have already been recovered; each owning brief retains those acceptance gates.

Detailed package contracts

A01 — Launcher

1. Identity and outcome

The separate openzt2-launcher executable lets a player choose a Zoo Tycoon 2 installation, scan its archives, select any discovered core/DLC/mod layers, convert the selected set into one resolved native profile, remove an installed profile, choose Off, Core, or All enabled fast preload, and launch OpenZT2. Core/DLC/mod presentation and progress are ordinary launcher UI; no part enters the game process. Integration wave 6; it consumes the pack assembler and the statically linked A02–A19 source frontends.

2. Exclusive ownership

The launcher package owns launcher/src/ in full. Everything else is read-only. Cargo members, dependencies, icons, converter module wiring and game binary wiring are root handoffs. In particular, do not edit converter/src/pack.rs or any family.

rfd 0.17 is mandatory for the native installation-directory picker and owns all platform dialog integration. The worker must not implement a filesystem browser, portal/GTK/Win32/Cocoa backend, or retain dialog state after selection. Root adds the minimal platform features.

3. Frozen public contract

| Symbol | Kind | Exact shape or signature | Owner and invariant | |---|---|---|---| | PreflightAppPlugin | plugin | unit struct implementing Plugin | Registers only launcher state/UI/jobs. | | PreflightPhase | state enum | ChooseLocation, ChoosingLocation, Scanning, Verifying, Ready, Converting, Launching, Failed | One launcher phase; work disables conflicting browse/remove/play actions. | | PackRole | enum | Core, Dlc, Mod | Classification established by scan evidence, never filename colour. | | PreloadMode | shared native enum | openzt2_native::contract::PreloadMode::{Off, Core, AllEnabled} | Sole launcher→engine page-fault policy; AllEnabled never includes unselected packs. | | ArchiveKey | value | pub struct ArchiveKey(pub AssetId) | Stable ID of normalized source-relative archive path. | | SourceArchive | record | { key:ArchiveKey, source_path:PathBuf, display_name:String, role:PackRole, original_bytes:u64, content_hash:[u8;32], verification:ArchiveVerification, required_for_launch:bool } | Scan result; checksumming is an explicit verification phase and only the three evidenced core archives set required_for_launch. | | InstalledProfile | record | { id:AssetId, path:PathBuf, source_fingerprint:[u8;32], optimized_bytes:u64, target:TargetProfile } | id is the verified native pack/profile identity, never a slot integer. | | ConvertedArchive | record | { key:ArchiveKey, source_hash:[u8;32], cache_path:PathBuf, output_hash:[u8;32], optimized_bytes:u64, target:TargetProfile, converter_schema:u32 } | One verified per-source conversion cache; never loaded by engine directly. | | ConversionCacheManifest | record | { version:u32, converted:BTreeMap<ArchiveKey,ConvertedArchive> } | Atomically persisted launcher cache index; a row is complete only after cache header/hash/source/schema/target validation. | | ArchiveRow | component | { key: ArchiveKey } | UI row identity; visual state is derived. | | ArchiveSelection | resource | { selected: BTreeSet<ArchiveKey> } | One selection drives conversion, deletion and launch inclusion; default empty. | | DiscoveredArchives | resource | { rows:Vec<SourceArchive>, cache:ConversionCacheManifest, installed:Option<InstalledProfile> } | Bounded scan plus per-row conversion truth and final resolved output. | | PreflightSettings | resource | { source_root:Option<PathBuf>, output_profile:PathBuf, preload:PreloadMode } | Persisted launcher preferences, not live game state. | | ConversionProgress | resource | { completed_bytes: u64, total_bytes: u64, current: Option<ArchiveKey>, failure: Option<String> } | Progress is byte based and monotonically increases for one job. | | scan_installation | function | fn scan_installation(root: &Path, target: TargetProfile) -> io::Result<Vec<SourceArchive>> | Pure scan; deterministic normalized ordering. | | convert_selection | function | fn convert_selection(source:&[SourceArchive], selected:&BTreeSet<ArchiveKey>, target:TargetProfile, cache_root:&Path, progress:impl FnMut(ArchiveKey,u64,u64))->io::Result<Vec<ConvertedArchive>> | Converts only missing selected rows to atomic cache entries; caller persists manifest then assembles profile. | | remove_converted_archive | function | fn remove_converted_archive(key:ArchiveKey, cache:&mut ConversionCacheManifest, resolved:Option<&InstalledProfile>)->io::Result<()> | Deletes that row cache, atomically persists manifest and invalidates/deletes resolved output. Core is not special. | | assemble_resolved_profile | function | fn assemble_resolved_profile(source:&[SourceArchive], selected:&BTreeSet<ArchiveKey>, cache:&ConversionCacheManifest, destination:&Path)->io::Result<InstalledProfile> | Flattens selected valid conversions in resolved precedence order into sole engine profile. | | launch_game | function | fn launch_game(executable:&Path, profile:&InstalledProfile, preload:PreloadMode)->io::Result<Child> | Passes exact --profile <absolute path> --profile-id <32 lowercase hex> --target-profile <u32> --preload <off|core|all-enabled> arguments; starts only with selected core. |

4. Data layout or ECS ownership

Launcher entities are presentation only. DiscoveredArchives is the bounded scan catalogue; ArchiveSelection is the single selection truth; one task entity owns any active conversion. No source archive bytes or converted asset graphs are retained after conversion. UI systems derive row colour, enabled buttons, original / optimized sizes and per-row progress bars. Convert is enabled only when the unified selection contains at least one missing/stale row and no job is active; a completed valid row cannot be reconverted. Remove is enabled only when the selection contains converted rows and disabled while converting. Play is disabled until all three core rows are selected and every selected row has a valid conversion represented by the current resolved profile. Once true, Play is green regardless of unselected optional rows. When anything is unselected, the informational text is exactly Unselected packs will not be loaded. Only the three core packs are required to launch.; it does not turn a valid core selection into an error.

View contents opens a modal archive viewer over an immutable snapshot of the same unified selection. It reads each chosen row from its exact source archive, uses the selected set only to resolve referenced dependencies, and cannot change selection or operate during scan, verification, conversion, or launch. The viewer shares the tooling-only source-format crate with conversion; it does not install an archive as a Bevy asset source or enter the game dependency graph.

5. Preflight producer contract

Accept installation roots chosen by a native directory picker. Scan Z2F/source archives read-only, recognize core identities by evidenced canonical paths and hashes, classify DLC/mods, and compute hashes lazily during explicit Scan—not app startup. Later selected layers override earlier ones in preflight; only the winning consumer assets enter assemble_pack. Conversion is atomic, cancelable between files, deterministic, and rejects missing core inputs, corrupt archives, unsupported producer output, source/output hash mismatch, target/schema mismatch, duplicate paths, cache-manifest inconsistency and destination verification failure. A completed valid row cannot be reconverted until removed. assemble_resolved_profile alone applies selected layer precedence; engine sees only that final output.

6. Behavioral evidence and disposition

Start at ignored vendor/original-software/ archive names/manifests, old reconstruction/game/src/bin/launcher.rs and converter sources in commit d5657e5a, and current converter/src/pack.rs. Evidence questions: exact three core archive identities; official expansion versus downloaded-content classification; original launcher naming only where player familiarity matters.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Nothing is selected on first scan. Core rows are deselectable and deletable but launch requires all three selected, converted, and present in the verified resolved profile. A valid checksum/profile is shown complete across restart; changed source/schema/target or invalid cache becomes stale. Each row shows original_bytes / optimized_bytes; no single estimate is reused. Selecting a converted row permits deletion, never reconversion. Removing it also invalidates the resolved profile. Collapsible, scrollable Core/DLC/Mods sections expose all rows. Closing/canceling never leaves a profile that passes validation. The deliberate OpenZT2 option Fast preload is passed as PreloadMode; this application does not fault pages itself.

8. Performance contract

No automatic full scan or conversion on open. Directory enumeration is O(n), hashing and conversion O(total selected bytes), bounded to one conversion job. UI frames do no filesystem access and allocate nothing after row hydration unless scan progress changes. Stream source files with reusable buffers; never hold all source archives in RAM. Report converter heap peak and bytes/sec; game heap/mapping/GPU counters are out of process.

9. Acceptance criteria

All source under the owned subtree is complete formatted Rust. The demonstrated flow is: pick location → scan → select three core plus one DLC → convert with bars → play → quit → restart → scan and observe four individually valid converted rows and the same valid resolved profile. Button states and warnings obey the rules above. Non-goals: original UI styling and any runtime source parsing. No stubs, hidden auto-conversion or fake completion.

10. Required handoff

Report files/API, UI/file-dialog dependencies, static source-frontend wiring and root workspace/bin registration, game executable/environment wiring, remaining archive identity evidence, and conversion throughput/peak heap. Root should erase any temporary compatibility adapter. Archive inspection is launcher functionality and must remain source-tooling-only rather than becoming a game runtime loader.

A02 — Compiled UI Document

1. Identity and outcome

This package produces the one native representation of mod-authored UI: flat layout/style/ binding/command tables that G02 projects directly into Bevy UI. XML templates, skins and command names are completely compiled before launch. Integration wave 1; depends on A05 textures, A09 localization and A12 system-font policy.

2. Exclusive ownership

This package owns native/src/families/ui_document.rs, converter/src/families/ui_document.rs, game/src/assets/ui_document.rs, and preflight/tests/ui_document_contract.rs. All other paths are read-only; module, loader and dependency registration are root handoffs.

Bevy 0.19 UI is the mandatory runtime target and owns layout, clipping, scrolling, picking, focus and widget interaction. A02 compiles only the flat data needed to spawn ordinary Bevy Node, image, text and interaction components. It must not define a parallel layout tree, widget engine, focus engine, retained XML document, or generic UI runtime.

3. Frozen public contract

4. Data layout or ECS ownership

Little-endian rkyv root at alignment required by rkyv; frozen TableRange indexes typed records while AssetRange is reserved for payload bytes. Strings are UTF-8 in one blob and addressed by StringRange in producer-private extensions; all tables use u32 indexes and stay below u32::MAX. IDs and dependency tables are sorted. Rendering traverses archived nodes directly; textures/fonts are Bevy handles by AssetId. Only texture/font payloads upload to GPU.

5. Preflight producer contract

Accept UI XML/BFXML documents, referenced templates, replacements/skins, localization keys and image/font paths from selected resolved layers. Normalize virtual paths to lowercase /-separated UTF-8 before AssetId::from_key. Resolve includes, template expansion, skin replacements and later-layer overrides; flatten hierarchy and intern strings; validate unique IDs, acyclic templates, finite geometry, valid ranges, known tags/bindings/commands and dependency closure. Semantic documents use AssetId::from_key("ui/role/<role>") so G01/G02 discover handles without paths; later layers replace a role before output. Reject duplicate winners or a missing required splash/main/profile/ globe/map/loading/HUD role, and unknown behavior-bearing commands with source path/node. Deterministic order is document preorder then stable source order. The worker must inventory the full shipped binding corpus before freezing code: every animal, guest, staff, facility, habitat/tank, show, transport, scenario and progression binding must map to one named variant above (or a reviewed addition with an exact unit). Unknown fields fail conversion; there is no selected-field ID, generic property key or fallback reflection path.

6. Behavioral evidence and disposition

Search shipped ui/**/*.xml, *.layout, skin/replacement documents and command attributes; cpp-reconstruction UI/BFXML types via RTTI TSV; the specification; and commit d5657e5a domain/.../ui_contract.rs, presentation/ui/{commands,layout,projection,widgets}.rs. Live-check focus, modal and coordinate scaling. Questions: complete document-role and tag/widget set, command argument semantics, anchor/aspect behavior, animation representation and list templates. Unknown commands must remain named evidence failures.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Templates and overrides yield one final tree. Stable node IDs survive mod replacement; duplicate IDs in a resolved document fail. Layout preserves authored pixel coordinates against logical_size, anchors and z/tab order. Bindings exhaustively match typed live facts; commands emit fixed Bevy actions/requests. No runtime XPath, XML DOM, string dispatch or asset-instance hardcoding. Mod UI may use only the frozen node/binding/command vocabulary.

8. Performance contract

Load validates O(nodes+edges+records) once; lookup/traversal/handle clone are zero-allocation. Projection may allocate entities only on document activation; steady binding uses changed facts and indexed node entities. No per-frame strings/hash growth. Contract test counts zero allocations for archived preorder and command iteration; page-fault and mapped-byte tests distinguish mapping; texture/font GPU bytes belong to their families.

9. Acceptance criteria

The four owned files export every symbol above, convert a nested fixture with template/skin/binding/command references across every G21 presenter family, reject malformed cycles/ranges and unknown bindings/commands, and prove archived traversal returns source order without copying. Acceptance includes a documented full-corpus binding inventory with no unclassified source field. No G02 projection, XML dependency in native/Bevy, stubs or generic property bags.

10. Required handoff

Report XML/parser dependencies, module/asset/loader/plugin registration, the exact G02 projector/command mapping, references to A05/A09/A12, unresolved UI vocabulary, mapped allocation checks and any temporary field that integration should eliminate.

A03 — Species Catalogue

1. Identity and outcome

This package produces the complete immutable species, sex/age variant, compatibility and authored-biological catalogue consumed by animal gameplay without source XML or per-animal copies. It replaces the bootstrap species schema. Integration wave 3; depends on A09 localization and A14 world definitions.

2. Exclusive ownership

This package owns native/src/families/species.rs, converter/src/families/species.rs, game/src/assets/species.rs, preflight/tests/species_contract.rs. Existing native/src/species.rs and converter/src/species.rs are read-only migration inputs; root moves/deletes them and registers modules/loaders.

3. Frozen public contract

4. Data layout or ECS ownership

rkyv, little-endian target, 16-byte stable IDs and frozen TableRange typed-table ranges. Archived vectors are traversed directly. Repeated display/source strings are interned; game-facing text uses A09 key IDs. Model/material IDs are dependencies, never embedded handles. Per-animal age/sex/needs remain ECS components in G11/G12. G11 uses this exact Sex/LifeStage; G12 uses this exact NeedKind and need ranges rather than a duplicate enum or per-animal map.

5. Preflight producer contract

Accept resolved animal entity XML, variant/model bindings, BFAI state vars/need adjusts/preferences, taxonomy, biome/compatibility and adoption metadata from selected archives. Normalize canonical entity keys before AssetId::from_key. Apply source inheritance/templates and pack precedence before records. Convert authored days/rates against A14 SimulationTimingDefinition into integer ticks and signed Q16 per-tick rates, resolve all references, deduplicate inherited lists and sort. Reject missing IDs, duplicate variants, nonmonotonic stage/lifespan ticks, impossible ranges, NaN/Inf, unknown sex/life stage/need and dangling dependencies with source diagnostics. Any need outside the evidenced fixed vocabulary blocks conversion and is reported for contract revision.

6. Behavioral evidence and disposition

Search shipped entities/units/animals, lang, biome and taxonomy XML; oracle animal/animal-manager/entity-type classes and RTTI; analysis domain rows; commit d5657e5a simulation/animal.rs, startup/animals.rs, catalog sources and old species code. Questions: exact game-day age thresholds, variant probability, sex availability, breeding compatibility, exact complete need vocabulary, tick conversion, decay/update residual rules and thresholds, appetite/speed unit conversions and which fields are inherited. Resolve before encoding; do not preserve old bags.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Every selectable species has localization, a world definition and at least one valid adult variant. Variant choice filters by sex/stage then uses deterministic weighted selection supplied by gameplay. Integer tick ranges drive lifecycle but do not mutate. Each fixed tick, G12 adds the signed Q16 need rate to its per-need signed Q16 residual, applies the arithmetic whole permille toward zero, retains the fractional remainder and clamps 0..=1000; no runtime day conversion or drift-prone float accumulation occurs. Missing optional model fallbacks are explicit zero IDs; required ones fail. Mod-defined species work through identical records. Authentic values must be recovered for units and lifecycle fields before completion.

8. Performance contract

Validation O(s+v+c), find O(log s), variant/compatibility traversal O(range), all zero-allocation. No runtime strings or per-entity catalogue clones. Test allocator counts find and full traversal; mapping counters cover archive pages; no GPU ownership beyond referenced A04/A07 assets.

9. Acceptance criteria

Four owned files, full API above, fixtures covering two species/sex/stages/ needs/preferences/compatibility and rejection tests for corrupt ranges/NaN/ dangling IDs/unknown needs. Archived lookup returns mapped records without allocation. Non-goals: animal live state, behavior scoring and adoption UI. No bootstrap-only five-field schema remains in this package.

10. Required handoff

Report migration of old species modules, parser dependencies, root registrations, A04/A07/A09/A14 dependency IDs, G11/G12 field consumers, exact unresolved data semantics and allocator/mapping validation.

A04 — GPU-ready model

1. Identity and outcome

Preflight converts original NIF/BFB meshes into target-specific, meshopt- optimized vertex/index/meshlet payloads. Bevy/wgpu upload, extract, batch, cull, skin and draw them through the normal renderer. The game never reconstructs a scene graph or runs mesh optimization.

2. Exclusive ownership and mandatory dependencies

The package worker owns native/src/families/model.rs, converter/src/families/model.rs, game/src/assets/model.rs, and preflight/tests/model_contract.rs only. Root adds meshopt = 0.6 to preflight with only required features.

Meshopt exclusively owns vertex remapping, cache/fetch/overdraw optimization, quantization, LOD simplification and meshlet construction. Bevy/wgpu exclusively own render assets, GPU buffers, extraction, culling, batching and draw commands. No OpenZT2 mesh optimizer, renderer, scene graph, render world, or generic model runtime is permitted.

3. Frozen public contract

The Bevy preparation path reads mapped ranges and uploads directly to wgpu buffers. Private prepared-render values may retain GPU handles/accounting, not copied CPU vertices or an OpenZT2 renderer abstraction.

4. Data layout and ownership

All records are rkyv-compatible fixed data. Vertex/index/meshlet blocks are target-profile aligned, little-endian and directly uploadable. CPU collision, navigation and placement shapes belong to A15–A17 rather than being derived from render meshes in the game.

5. Preflight producer contract

Resolve NIF/BFB hierarchy, geometry, materials, skeletons, transforms and LODs. Bake transforms where semantics permit; normalize coordinates/units; triangulate and weld; invoke meshopt for remap, cache/fetch/overdraw optimization, quantization, optional simplification and meshlets; then emit deterministic payloads. Reject unsupported visible topology, invalid weights/ranges, missing materials/skeletons, nonfinite values, or target limit overflow.

6. Behavioral evidence and disposition

Inspect shipped models, Gamebryo/BF geometry classes, material links, earlier converter evidence and live original for coordinate conventions, LOD thresholds, billboards, alpha ordering, skinning and exceptional geometry.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Models render with correct transforms, bounds, submesh materials, LODs and skinning references. Mod meshes follow the same conversion contract. Unknown visible source semantics block conversion rather than producing placeholder geometry.

8. Performance contract

Archive lookup/traversal allocates zero. GPU preparation performs one direct upload per merged range where practical, reuses staging capacity and retains no second CPU geometry graph. Draws use Bevy batching/culling and stable pipeline keys. Track mapped pages, upload bytes/calls, retained CPU heap, GPU vertex/index bytes, draw counts and LOD behavior.

9. Acceptance criteria

Four files/API; static/skinned/multi-material/LOD fixtures, corrupt range/layout rejection, deterministic meshopt output, zero-copy CPU traversal and exact GPU accounting. Source review must find no custom optimization algorithm, renderer, scene graph, or CPU geometry cache.

10. Required handoff

Report meshopt version/options, Bevy render-asset integration, target layouts, A06/A07/A15 consumers, root registrations, unresolved model evidence and mapping/upload/GPU/render measurements.

A05 — GPU-Native Texture

1. Identity and outcome

This package produces the only runtime texture representation: target-profile GPU-compressed mip/layer payloads with exact dimensions, colour semantics and upload ranges. No DDS/TGA/BMP/JPEG decode occurs in the game. Integration wave 1; only the shared native contract is prerequisite.

2. Exclusive ownership

This package owns native/src/families/texture.rs, converter/src/families/texture.rs, game/src/assets/texture.rs, preflight/tests/texture_contract.rs. Renderer, GPU ledger and module/plugin registration are root-owned/read-only.

Existing image, ddsfile, and image_dds dependencies exclusively own source image decoding/transcoding in preflight; Bevy/wgpu own runtime images, GPU textures and upload. This package must not write an image codec, runtime source decoder, texture renderer, or second CPU pixel cache.

3. Frozen public contract

4. Data layout or ECS ownership

Metadata is rkyv; payload is contiguous, tightly packed block-compressed data in the same archive. Ranges are bytes relative to payload. Little-endian metadata; subresources have no storage padding. Mapping is kept until asset eviction. A narrow GPU-image registration bridge lets ordinary Bevy materials and ImageNode resolve the prepared texture by the native asset UUID without a CPU Image or custom renderer. Upload creates exactly one GPU texture and view set. Preparation updates GpuMemoryLedger; no external renderer wrapper or parallel texture cache exists.

5. Preflight producer contract

Accept only DDS/TGA/BMP/JPEG and loose-installation CUR, the formats evidenced by shipped archives or the original C++ loaders. PNG, KTX2, and unevidenced BFT texture inputs are not part of the source contract. Normalize virtual paths before ID. Resolve replacements and later pack layers before decode. Compatible DDS blocks and complete authored mips are copied unchanged. Decode, orient, select colour space, generate missing/invalid mips, renormalize normal maps, transcode only target-incompatible formats and compute tight row layout. CUR is decoded offline to the same D2 GPU texture while preserving its hotspot as native metadata. Reject corrupt dimensions, unsupported semantics, excessive target limits, incomplete compressed blocks and ambiguous colour space. Diagnostics name source and failing mip. Output ordering is layer then mip.

6. Behavioral evidence and disposition

Search shipped texture extensions and material slots; old commit source_format/model.rs, presentation/renderer.rs, UI visuals and terrain; oracle NiSourceTexture/BFRTexture classes and Gamebryo calls. Questions: vertical orientation, alpha modes, normal channel convention, UI filtering, terrain tile samplers and source-format coverage. Validate with UI, animal and terrain screenshots rather than guessed defaults.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Pixel orientation, alpha, colour and sampling match original presentation. Missing optional textures resolve to an explicit preflight-generated fallback asset; missing required textures fail conversion. Runtime streams declared mip subresources without decoding. Mod textures are preflight-converted identically.

8. Performance contract

Metadata traversal/Handle<Image> construction is zero allocation and never clones pixel data. Render preparation passes the mapped payload directly to Bevy/wgpu as &[u8]; no payload-sized Rust heap allocation is permitted. O(payload bytes) GPU transfer, O(subresources) validation, O(1) subresource access. Record mapped/resident bytes separately from exact GPU texture bytes and staging. No per-frame texture preparation after residency. Repeated render extraction of unchanged handles is allocation-free.

9. Acceptance criteria

Four files and API above; fixtures cover sRGB colour, linear normal, preserved DDS blocks, mip/layer ranges and non-tight payload rejection. Tests prove expected dimensions/formats and zero-allocation hydration view. A Bevy fixture obtains TextureAsset::bevy_image(), sets it directly on ordinary ImageNode, observes one GPU preparation, and proves no CPU pixel copy. Non-goals: material selection, renderer batching and source decode in engine. A render fixture must verify exact create/upload/remove ledger deltas and no repeated preparation.

10. Required handoff

Report image/transcoder dependencies and profile feature choices, asset/render registration, A07/A12/A16 consumers, unresolved orientation/semantic evidence, and heap/mapping/GPU measurements.

A06 — Skeletal Animation

1. Identity and outcome

This package produces compact skeleton-indexed clips, markers and graph transition tables that can be sampled directly from mapped memory. Source BF/KF/BFM parsing and name resolution end in preflight. Integration wave 3; depends on A04 model.

2. Exclusive ownership

This package owns native/src/families/animation.rs, converter/src/families/animation.rs, game/src/assets/animation.rs, preflight/tests/animation_contract.rs; all other files and schedule/render integration are read-only/root handoffs.

Bevy owns transforms, skeleton/render integration and GPU skinning. A06 owns the mapped source-authentic track sampler, selection/transition policy and presentation markers only. It must not create another scene graph, skeleton world, transform hierarchy, render extraction path, or generic animation host.

3. Frozen public contract

4. Data layout or ECS ownership

rkyv tables with frozen TableRange spans; integer milliseconds prevent float search drift. Joint indexes are A04 skeleton order. Sampling binary-searches mapped keys and writes the SkinnedPose range in AnimationPoseBuffer; the asset owns no live playback state. GPU skin matrices are transient A04 renderer data, not archived duplicates. Each system performs one operation; there is no animation manager loop.

5. Preflight producer contract

Accept BF binary clips, NetImmerse KF controller sequences, BFM XML graph documents, and TXTKEYS presentation markers after layer resolution. Prefer the winning same-stem BF clip because the shipped BFM graphs reference BF; when no BF winner exists, compile the KF sequence as the clip. KF target names bind to the final model skeleton, NiKeyframeController/NiKeyframeData become canonical translation/rotation/scale tracks, and NiTextKeyExtraData becomes presentation markers. Preflight flattens quadratic and tension/bias/continuity curves into the native linear/spherical sampling contract. KFM, KFINFO, and BIP remain authoring/controller evidence with explicit validated disposition. None of these source formats or their block graphs reach the runtime. Normalize IDs, map source node names to model joints, convert Euler tracks to canonical quaternions, quantize time to milliseconds only within evidenced tolerance, compile nonsemantic presentation markers/transitions and close clip dependencies. Any source marker with gameplay semantics must be recovered from the complete corpus and promoted to the precise owning gameplay action/message before acceptance; it cannot remain an ID or string event. Reject unknown value-bearing tracks, missing joints/clips, nonmonotonic time, invalid quaternions, graph indexes/cycles where forbidden and source duration mismatch. Deterministic clip ID then track/joint/channel ordering.

6. Behavioral evidence and disposition

Search shipped .bf/.bfm, model skeleton names; commit d5657e5a source_format/animation.rs, animation startup/AI code; oracle animation graph, sequence and controller types. Questions: time unit/quantization, Euler order, loop/end semantics, weighted clip selection, blend durations, whether each marker is presentation metadata or an exact domain action, and graph transition fallback. Live-check representative locomotion/idle clips.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Sampling at 0/end, looping, interpolation and presentation-marker crossing are deterministic. Graphs select only compiled clips; Animator owns current clip/time. Root motion is an explicit evidenced flag/track, never inferred silently. Mod clips/graphs must use the same fixed channels and selection vocabulary.

8. Performance contract

Clip lookup O(log clips), per-track sample O(log keys), zero allocations into a pre-sized pose slice. Presentation-marker traversal is linear only over the crossed range. Allocator tests cover lookup/advance/sample/presentation-marker scan; mapped pages and animation GPU matrix capacity measured separately. No per-frame strings or graph cloning.

9. Acceptance criteria

Four files; convert fixture with translation/quaternion/scale, presentation markers and an edge; validate sampled values and failure cases. A Bevy fixture advances, samples and advances presentation metadata with zero allocations after pose warm-up. Model render skinning is A04; behavior selection is a gameplay concern.

10. Required handoff

Report model archive consumption, parser dependencies, root/schedule/message registrations, graph evidence and allocation/mapping/GPU-pose validation.

A07 — Material

1. Identity and outcome

This package produces compact immutable material render state with shader variant, typed parameters and texture bindings. Material selection requires no string lookup or Gamebryo-style object graph at runtime. Integration wave 1; depends on A05 and A08.

2. Exclusive ownership

This package owns native/src/families/material.rs, converter/src/families/material.rs, game/src/assets/material.rs, preflight/tests/material_contract.rs only.

Bevy material/render-asset APIs and wgpu exclusively own bind groups, render state, pipelines and drawing. A07 supplies compact parameters, references and typed specialization keys; it must not create a material renderer, pipeline registry, graphics abstraction, or copied texture/material graph.

3. Frozen public contract

4. Data layout or ECS ownership

One rkyv root per material; fixed enums/numeric rows map to a cached Bevy/wgpu pipeline and bind group. No maps, strings or boxed values. Texture/shader IDs are pack dependencies and become handles during render preparation; GPU uniform and bind-group ownership is implemented here in Bevy's render world. A04 extracts ModelMaterial directly; no renderer service facade exists.

5. Preflight producer contract

Accept NIF material/texturing/alpha properties, BFB material blocks and material XML after override resolution. Canonical path ID; merge inherited/default properties, map texture slots and shader variant, fold UV transforms, choose blend/depth/cull and resolve dependencies. Reject contradictory states, non-finite values, missing required bindings, unsupported value-bearing shader properties and target layout mismatch. Sort by semantic for deterministic bytes.

6. Behavioral evidence and disposition

Search model material properties and texture slots; commit d5657e5a source_format/model.rs and presentation/renderer.rs BFR material records; oracle NiMaterialProperty/NiTexturingProperty/BFRMaterial classes. Questions: alpha test thresholds, blend functions, selector/variant rules, UV animation, two-sided flags, environment/detail slots and queue ordering. Verify terrain, glass/water, foliage and animal materials live.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Opaque/masked/transparent presentation, colour/emissive values, UV selection, texture dependencies and render ordering match evidence. Animated material parameters are immutable curves only if evidence requires them; live time stays outside asset. Unknown properties that change pixels fail rather than disappear.

8. Performance contract

Validation and preparation O(parameters+bindings), lookup O(log n) or bounded linear tiny table, zero allocation during steady draw extraction. Pipelines and bind groups cache by immutable archive key; no per-frame material clones or uniform Vec growth. Count mapped bytes, uniform/bind GPU bytes and cache misses. Unchanged extraction and prepared lookup allocate zero after cache warm-up.

9. Acceptance criteria

Four files/API; opaque, masked and alpha fixtures with texture/shader closure; reject duplicate semantics and invalid target layouts. Archived binding traversal and repeated prepared lookup are allocation-free. A render fixture verifies exact create/remove ledger deltas. Shader/texture production remain A08/A05; A04 owns draw batching.

10. Required handoff

Report A05/A08 IDs, parser deps, root registrations, renderer pipeline/cache requirements, unresolved original render-state evidence and memory counters.

A08 — Shader modules and variants

1. Identity and outcome

Preflight translates and validates the original FX effects and their shipped H includes, plus material-selected fixed-function variants, variant with Naga, selects a target-profile module representation, and emits exact bind/pipeline metadata. Bevy/wgpu create and cache runtime shader modules and pipelines. OpenZT2 contains no shader compiler or graphics API abstraction.

2. Exclusive ownership and mandatory dependencies

The package worker owns native/src/families/shader.rs, converter/src/families/shader.rs, game/src/assets/shader.rs, and preflight/tests/shader_contract.rs only. Root exposes to preflight the exact Naga version selected by Bevy 0.19/wgpu; a second incompatible Naga version is forbidden.

Naga exclusively owns parsing, IR, translation and shader validation. Bevy/wgpu own shader modules, bind-group layouts, pipeline layouts, specialization/cache, driver compilation and render-world integration. This package must not write a shader parser/compiler, SPIR-V/WGSL translator, pipeline cache, renderer backend, or string-based runtime variant system.

3. Frozen public contract

4. Data layout and ownership

Modules are stored in the exact representation accepted for the selected backend profile, aligned and referenced by AssetRange. Binding/variant tables are flat and directly traversed. Prepared runtime state is Bevy/wgpu state; OpenZT2 retains no parallel module or pipeline registry.

5. Preflight producer contract

Resolve original FX/H effects and material techniques. Convert supported semantics to Naga input, parse, validate capabilities/uniformity, translate to the target representation, reflect exact bindings, enumerate only reachable variants and sort deterministically. Reject unknown required shader semantics, invalid bindings, unsupported capabilities, missing entry points, variant explosion, or target/backend mismatch. Runtime source translation is forbidden; unavoidable driver module/pipeline creation is prewarmed during loading.

6. Behavioral evidence and disposition

Inspect shipped .fx, materials, shader references, Gamebryo renderer evidence, the C++ oracle and live original for techniques, blend/depth/cull policy, skinning, terrain, water, fog, shadows and expansion effects.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Every material resolves a validated compatible variant. Pipeline keys are typed and deterministic. Missing or unsupported visible semantics fail preflight; there is no runtime text substitution, fallback uber-shader, or guessed render state.

8. Performance contract

Mapped module/variant lookup allocates zero. Loading creates each required Bevy/ wgpu module and pipeline once, prewarms scene/menu pipelines, and never compiles or specializes per frame. Track mapping, module/pipeline creation count/time, pipeline-cache misses, bind-group churn and shader/pipeline GPU/driver bytes where available.

9. Acceptance criteria

Four files/API; Naga translation/validation fixtures, binding/variant rejection, deterministic output, zero-allocation lookup and Bevy pipeline preparation for representative model/terrain/water/UI effects. Source review must find no custom shader compiler, runtime source converter, or duplicate pipeline registry.

10. Required handoff

Report exact Bevy/wgpu/Naga version alignment and features, target module representations, A07 bindings/keys, root registrations/prewarm order, unsupported original semantics and mapping/pipeline measurements.

A09 — Localization

1. Identity and outcome

This package produces collision-safe, allocation-free locale lookup tables with UTF-8 text, formatting metadata and pre-resolved fallback chains. Runtime never parses lang XML, merges locales or builds a hash map. Integration wave 1; shared native contract only.

2. Exclusive ownership

This package owns native/src/families/localization.rs, converter/src/families/localization.rs, game/src/assets/localization.rs, and preflight/tests/localization_contract.rs only.

3. Frozen public contract

4. Data layout or ECS ownership

UTF-8 key/value/literal text is interned once in strings; StringRange is byte-based and validated on UTF-8 boundaries. AssetId::from_key hashes the trimmed canonical localization key, while stored key_text detects accidental collision. Fallbacks are resolved by preflight into the emitted selected-locale table; fallbacks records provenance only and runtime never searches files.

5. Preflight producer contract

Accept selected language XML/string tables and DLC/mod overrides. Normalize keys with evidenced case/namespace rules, apply later-layer overrides per key, resolve requested locale → parent/region → base fallback, parse safe format placeholders, validate UTF-8 and intern deterministic key order. Reject duplicate keys within one precedence layer, hash collisions with differing key text, malformed formats, missing required fallback and invalid locale codes.

6. Behavioral evidence and disposition

Search shipped lang/locale XML and UI text keys; oracle locale/string manager classes and functions; commit d5657e5a locale sources, UI text and formatter paths. Questions: key case sensitivity, locale fallback order, formatting syntax, plural/currency rules, escaped markup and whether region codes exist. Compare live representative UI, finance and scenario strings.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Lookup returns borrowed selected-locale text; absent optional key yields None for UI to display a diagnostic, never silently key-as-value in release. Fixed format tokens support original authored placeholders without arbitrary scripts. Mods override keys before output. User locale change selects another completed native locale asset/profile, not source remerge.

8. Performance contract

Compile O(total text log entries); validation O(entries+bytes); lookup O(log n) and zero allocation. Formatting writes into caller-provided reusable fmt::Write or byte buffer and must allocate zero after capacity. Track mapped locale pages; no GPU bytes. Regression tests cover lookup and formatted traversal counters.

9. Acceptance criteria

Four files/API; fixture covers override/fallback, UTF-8, arguments and collision rejection. Borrowed lookup and warmed formatting allocate zero. Non-goals: UI text components, locale picker and font shaping.

10. Required handoff

Report XML/parser/locale-format dependencies, root registrations, A02/A03/A14/ A19 consumers, exact unresolved key/format semantics and allocator/mapping validation.

A10 — Compiled Behavior Program

1. Identity and outcome

This package compiles data-authored animal, guest and staff behavior into fixed typed command, scoring and constant tables. Gameplay systems interpret narrow instructions against ECS components; this asset is not a shadow world or a general Lua VM. Integration wave 3; depends on A14 definitions.

2. Exclusive ownership

This package owns native/src/families/behavior_program.rs, converter/src/families/behavior_program.rs, game/src/assets/behavior_program.rs, and preflight/tests/behavior_program_contract.rs only.

3. Frozen public contract

4. Data layout or ECS ownership

All variable collections, including behavior-set program IDs, gesture templates and puzzle steps, are typed flat tables and frozen TableRanges. Fixed point is used for deterministic score/constant values; simulation durations are integer G32 ticks (gesture input windows alone remain real milliseconds) and distances are centimetres. Programs contain no entity state, closures, strings, bytecode stack or mutable instruction pointer. G13/G20 systems own current task/target/cooldown as small components.

5. Preflight producer contract

Accept resolved AI XML/task graphs, gesture/puzzle documents and the evidenced supported subset of Lua behavior scripts. Normalize program/asset keys, expand inheritance/macros, constant-fold expressions, compile recognized queries/actions, resolve asset references and reject any command with effects outside the fixed vocabulary. Resolve source behavior-set membership and idle fallback, then convert authored wait/cooldown/think durations with A14 timing before serialization; runtime does no milliseconds/day conversion. Before implementation, exhaustively inventory every behavior and puzzle command in the shipped/mod corpus and oracle. Each behavior-bearing command must become an explicitly named enum variant with only its genuine typed payload; an AssetId event name, string opcode, generic dispatcher or catch-all variant is not an admissible representation. Later packs replace definitions before compilation. Reject recursion, unbounded loops, dynamic global access, arbitrary I/O, unknown fields, missing references, invalid curves, malformed gesture geometry, puzzle cycles and action sequences with no terminal/yield. Stable program/template/puzzle ID then authored order.

6. Behavioral evidence and disposition

Search shipped AI/task XML and Lua, command strings and entity definitions; oracle BFAI task/evaluator/controller and script callback functions; analysis function domains; commit d5657e5a simulation/behavior.rs, simulation/ai.rs, infrastructure/lua*, gesture/mode dispatch and scripting startup. Questions: complete command/query vocabulary, score formula/tie breaks, task cooldown/interrupt semantics, random distribution, supported Lua expressions, exact gesture normalization/matching, puzzle reset/completion semantics and emitted events. Add opcodes only after evidence and version bump review.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Given identical component observations and RNG input, scoring and chosen action are deterministic. Unknown source behavior fails conversion rather than becoming no-op success. Mod authors may extend programs using the fixed vocabulary, not native code. Action execution is divided among precise gameplay systems; this package supplies immutable instructions only. G30 traverses compiled templates/steps and translates PuzzleCommand to natural domain messages; it does not parse source text or operate a generic puzzle VM.

8. Performance contract

Program lookup O(log n), score O(considerations), action traversal O(actions), all zero allocation. Constants use sorted lookup, not HashMap. Gameplay may evaluate candidates in bounded spatial sets and fixed timestep; no full-world dispatcher. Allocator tests cover lookup/score traversal; mapped pages tracked; no GPU resources.

9. Acceptance criteria

Four files/API; fixture compiles needs/distance behavior plus gesture template and multi-step puzzle, rejects unsupported Lua/I/O/loop/gesture/puzzle command and bad ranges, and proves mapped iteration zero-allocation. Non-goals: ECS target queries, locomotion and animation state.

10. Required handoff

Report parser/compiler dependencies, module/loader registration, A03 NeedKind use and TargetKind promotion request, G13/G20 executor and G30/G31 gesture/puzzle mapping, unresolved opcode evidence and allocation/mapping checks.

A11 — Unified audio

1. Identity and outcome

Original music, ambience, speech, UI sounds, and positional effects become one native audio family consumed through Bevy's entity-based audio API. Bevy owns the device, sinks, playback and spatialization; OpenZT2 supplies mapped resident or streamed payloads plus recovered channel/priority policy. Integration wave 1.

2. Exclusive ownership and Bevy dependency

The package worker owns native/src/families/audio.rs, converter/src/families/audio.rs, game/src/assets/audio.rs, and preflight/tests/audio_contract.rs only. Root enables Bevy 0.19 bevy_audio and the selected native codec feature.

Bevy Audio exclusively owns device output, voice playback, sinks, decoding integration, looping, volume/speed, and spatial emitters/listeners. The package must not implement mix_audio_voices, an audio device backend, a software mixer, a parallel channel world, or copied playback registry. Kira is not added while Bevy Audio meets the recovered behavior; a missing measured behavior requires a root decision before changing backend.

3. Frozen public contract

Live playback uses Bevy's AudioPlayer, PlaybackSettings, AudioSink, SpatialAudioSink, and SpatialListener directly. OpenZT2 does not wrap or mirror their state. A small global policy resource may hold recovered per-usage volume/voice limits; it does not own voices.

4. Data layout and ECS ownership

Metadata and seek blocks are traversed from the mapping. Resident PCM and stream blocks remain mapped until Bevy's decoder/output path consumes them. Each sound is an ordinary playback entity spatially parented or transformed like any other Bevy entity. Completion uses component removal/despawn policy, not a central audio manager.

5. Preflight producer contract

Accept only WAV and MP3, the audio formats present in the official corpus and original loader evidence. Validate MP3 timing/headers but preserve its authored compressed bytes unchanged as the native streamed representation. Decode WAV; select resident PCM for small latency-sensitive clips and streamed Vorbis for large music/ambience. Normalize channel layout, loop points and usage. Emit deterministic ranges and reject corrupt media, invalid loops, unsupported required content, clipping beyond recovered policy, or target codec mismatch. OGG/WMA and other unevidenced source routes are absent.

6. Behavioral evidence and disposition

Inspect shipped audio, sound/music definitions, oracle audio calls and live mixing behavior. Recover usage classification, attenuation, concurrency, priority/stealing, randomness, delays, looping, fades, ducking, pause behavior, listener choice and music transitions. Bevy supplies mechanics, not these rules.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Cues create/update ordinary Bevy playback entities. Positional effects follow their world transforms; UI/music are nonspatial. Usage volumes, loop points, priority, limits, pause and transitions follow recovered policy. Missing optional clips fail quietly with a typed diagnostic; required music/voice conversion fails preflight.

8. Performance contract

Mapped lookup/block selection/handle cloning allocate zero. Playback start and decoder creation are explicit bounded exceptional operations; settled playback must not allocate per frame after decoder/output buffers stabilize. Stream only bounded upcoming blocks. Track Rust heap, mapped faults, active Bevy sinks, decoder buffers, underruns, voices and start latency. There is no OpenZT2 mix buffer or full decoded-cache copy.

9. Acceptance criteria

Four files/API; resident/streamed conversion, corrupt range/loop rejection, zero-allocation mapped lookup, and Bevy fixtures for UI, positional, loop, pause, priority, fade/transition and cleanup. Source review must find no custom mixer, device backend, voice registry, or second playback state.

10. Required handoff

Report exact Bevy audio/codec features, mapped Decodable lifetime strategy, usage policy, A13 synchronization surface, root registrations, recovered audio rules, and allocation/fault/underrun measurements.

A12 — System Font Integration

Outcome and evidence boundary

The official archives and loose installation contain no TTF, OTF, FNT, bitmap font, or other authored font payload. The recovered executable creates fonts through the operating-system font API (D3DXCreateFontA). A12 therefore does not define a source frontend, native rkyv font family, pack entry, mapped asset, or custom glyph cache. Adding any of those would duplicate bytes that do not exist in the original content and would invent a mod contract without evidence.

OpenZT2 maps the recovered UI font aliases, sizes, weights, and fallback policy onto Bevy's ordinary text components and platform/system font integration. Bevy owns shaping, glyph caching, atlas allocation, layout, and rendering. G02 projects the compiled A02 text/style facts directly into Text, TextFont, and TextColor; it does not attach an OpenZT2 font wrapper component.

Runtime and performance contract

Font selection happens once when a native UI document is projected. Unchanged text must not be reshaped or reallocated by OpenZT2 per frame. Font-face heap, glyph-cache heap, and atlas GPU memory are backend-owned measurements, not mapped-pack residency. There is no source-font parsing or filesystem lookup in the game content path.

Mod boundary

The current content contract supports the fixed font vocabulary evidenced by the original game. A future native editor may deliberately introduce authored font assets, but that is a new OpenZT2 feature and must receive its own measured contract; preflight must not silently accept unevidenced original formats.

Acceptance criteria

• Source inventory continues to prove no official font files.
• No FontArchive, MappedFontArchive, FontAsset, or ozfont loader exists.
• Representative shell, HUD, and localized text use ordinary Bevy text nodes.
• Missing system aliases follow one explicit fallback chain and produce a diagnostic rather than an injected archive font.

A13 — Video stream

1. Identity and outcome

Preflight converts original movies into one seekable AV1 elementary stream with an OpenZT2 timestamp/keyframe index and an A11 audio reference. In the game, dav1d decodes into a bounded reusable picture pool and Bevy/wgpu presents those frames. OpenZT2 does not contain a video codec or generic media framework.

2. Exclusive ownership and mandatory dependencies

The package worker owns native/src/families/video.rs, converter/src/families/video.rs, game/src/assets/video.rs, and preflight/tests/video_contract.rs only. Root adds dav1d = 0.11 and its pinned native packaging, plus the approved FFmpeg/libav or rav1e preflight conversion dependency.

The preflight media dependency owns original container demux, source codec decode, scaling/colorspace conversion and AV1 encode. Dav1d owns runtime AV1 entropy/picture decode. Bevy/wgpu own textures and GPU copies. The worker must not write a codec, runtime container parser, general media graph, or per-frame texture allocator. A mandatory dependency failure is configured or narrowly forked before the bespoke baseline at 68a4c481 is considered.

3. Frozen public contract

4. Data layout and ECS ownership

Seek metadata and AV1 packets remain mapped. Dav1d receives slices from the mapped block through an input owner that retains Arc<MappedPack>. Its custom picture allocator recycles aligned frame storage. GPU textures/staging buffers are created per pool slot and reused. VideoPlayer and A11's playback entity are the only live state; there is no media session graph.

5. Preflight producer contract

Accept only Bink (.bik), the movie format established by the executable's Bink imports and loader calls. Use the approved media dependency to demux/decode Bink, normalize dimensions, frame rate, pixel/color metadata and orientation, split audio into A11, encode AV1 with deterministic target settings, and emit packet/keyframe/timestamp blocks. Reject unsupported required source media, invalid timing, excessive dimensions, missing keyframes, A/V duration mismatch, or decoder-profile incompatibility. Never invoke media conversion in the game.

6. Behavioral evidence and disposition

Inspect Bink references, oracle Bink playback calls and live original for aspect/stretch, skippability, looping, end transitions, audio routing, pause/focus behavior and required seek accuracy.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Players start only after asset/decoder readiness, follow authored timestamps, stay synchronized to A11, skip/loop/end exactly once, and release slots on despawn or world transition. Back-pressure drops or delays presentation by an explicit policy; it never grows the pool.

8. Performance contract

Mapped seek/block lookup allocates zero. Decoder initialization and pool setup are bounded exceptional work. After warm-up, decoding reuses dav1d picture allocations and GPU staging/textures with zero recurring Rust allocation caused by OpenZT2. Prefetch only bounded upcoming blocks. Track decoder heap, mapped faults, queued packets/pictures, upload bytes, GPU texture bytes, decode/upload latency and dropped frames independently.

9. Acceptance criteria

Four files/API; deterministic conversion fixture, corrupt index/timing/profile rejection, seek lookup, decoder-pool reuse, A/V synchronization, skip/loop/end, and GPU accounting. Source review must find no codec algorithm, runtime source container parser, unbounded frame queue, or per-frame texture creation.

10. Required handoff

Report pinned dav1d/native packaging, preflight media dependency/version, picture allocator and mapped-input lifetime, Bevy texture format/upload path, A11 synchronization, root registration and allocation/fault/GPU/frame results.

A14 — World Definitions

1. Identity and outcome

This package produces the immutable typed catalogues used by every world/gameplay package: placeables, facilities, staff/jobs, guests, topology, biomes/tools, health, information, progression, expansion systems, modes/camera, simulation timing and environment. It is deliberately a set of narrow tables, not a generic entity definition graph. Integration wave 1; depends on A09 and stable IDs from the presentation families.

2. Exclusive ownership

This package owns native/src/families/world_definitions.rs, converter/src/families/world_definitions.rs, game/src/assets/world_definitions.rs, and preflight/tests/world_definitions_contract.rs only. Everything else is read-only. Root owns module/asset/plugin registration and any shared-type moves.

3. Frozen public contract

Root and common construction catalogues

Staff and guests

Topology, terrain and health

Information and progression

Expansion definitions

Modes, time and environment

Mapped/producer/Bevy surface

4. Data layout or ECS ownership

WorldDefinitionsArchive has this exact root shape and field order:

pub struct WorldDefinitionsArchive {
    version: u32,
    target: TargetProfile,
    objects: Vec<ObjectDefinition>,
    placeables: Vec<PlaceableDefinition>,
    footprint_cells: Vec<FootprintCell>,
    entrances: Vec<EntranceDefinition>,
    facilities: Vec<FacilityDefinition>,
    maintenance_definitions: Vec<MaintenanceDefinition>,
    service_maintenance_effects: Vec<ServiceMaintenanceEffect>,
    cleanliness_policy: CleanlinessPolicy,
    staff: Vec<StaffDefinition>,
    staff_jobs: Vec<StaffJobDefinition>,
    guests: Vec<GuestDefinition>,
    guest_arrivals: Vec<GuestArrivalDefinition>,
    guest_arrival_rules: Vec<GuestArrivalRule>,
    guest_archetype_weights: Vec<GuestArchetypeWeight>,
    guest_needs: Vec<GuestNeedDefinition>,
    guest_destination_weights: Vec<GuestDestinationWeight>,
    guest_reactions: Vec<GuestReactionDefinition>,
    fences: Vec<FenceDefinition>,
    paths: Vec<PathDefinition>,
    biomes: Vec<BiomeDefinition>,
    brushes: Vec<BrushDefinition>,
    diseases: Vec<DiseaseDefinition>,
    treatments: Vec<TreatmentDefinition>,
    tranquilizers: Vec<TranquilizerDefinition>,
    rampage_rules: Vec<RampageRule>,
    catalogue: Vec<CatalogueEntry>,
    zoopedia: Vec<ZoopediaEntry>,
    research: Vec<ResearchDefinition>,
    unlocks: Vec<UnlockDefinition>,
    rating_definitions: Vec<RatingDefinition>,
    rating_inputs: Vec<RatingInput>,
    fame_thresholds: Vec<FameThreshold>,
    awards: Vec<AwardDefinition>,
    award_conditions: Vec<AwardCondition>,
    tanks: Vec<TankDefinition>,
    aquatic_requirements: Vec<AquaticRequirement>,
    show_stages: Vec<ShowStageDefinition>,
    tricks: Vec<TrickDefinition>,
    show_rules: Vec<ShowRuleDefinition>,
    stations: Vec<StationDefinition>,
    tracks: Vec<TrackDefinition>,
    vehicles: Vec<VehicleDefinition>,
    tour_views: Vec<TourViewDefinition>,
    fossil_sets: Vec<FossilSetDefinition>,
    fossil_pieces: Vec<FossilPieceDefinition>,
    fossil_slots: Vec<FossilSlotDefinition>,
    clone_labs: Vec<CloneLabDefinition>,
    mode_tools: Vec<ModeToolDefinition>,
    cameras: Vec<CameraTuningDefinition>,
    simulation_timing: SimulationTimingDefinition,
    speed_multipliers: Vec<SpeedMultiplier>,
    light_keyframes: Vec<LightKeyframe>,
    fog_keyframes: Vec<FogKeyframe>,
    sky_keyframes: Vec<SkyKeyframe>,
    weather: Vec<WeatherDefinition>,
    weather_transitions: Vec<WeatherTransitionRule>,
    ambient_spawns: Vec<AmbientSpawnDefinition>,
    environments: Vec<EnvironmentDefinition>,
    asset_links: Vec<AssetId>,
}

Every TableRange addresses its declared typed table or asset_links; byte AssetRange is unused. Tables are rkyv, immutable, little-endian target data. ID lookup tables are sorted by ID; child tables addressed only by TableRange are grouped by owner and then authored order. catalogue is instead the stable category/order definition index required by G21/G23. Live cash, jobs, memories, diseases, progress, modes, weather and clocks remain small ECS facts in natural gameplay packages. Static definitions are never copied into components/resources.

5. Preflight producer contract

Accept the resolved entity/unit/object/fence/path/biome/AI/disease/research/ expansion/mode/camera/time/environment XML and data families. Normalize canonical paths and aliases before AssetId; flatten inheritance/templates and selected pack precedence; map every behavior-bearing property into the exact typed table; convert authored simulation durations to G32 ticks and continuous guest/disease rates to signed Q16 per tick before writing records; close dependencies and sort deterministically. Integer *_cents_per_day fields are deliberate calendar charges applied exactly once on G32 ZooDayAdvanced, not continuous rates and require no runtime division. filtration_per_day is likewise an exact integer daily tank-care capacity consumed on that event, not a continuous float rate. Preflight derives the stable catalogue/Zoopedia index, guest inline-memory bound, fixed timing/calendar, environment curves and ambient eligibility. Reject unknown semantic properties/enums, opaque flag bits, missing required prefab/name/assets, duplicate IDs, cycles, nonfinite or unordered ranges, table overflow and any guest definition exceeding GUEST_MEMORY_CAPACITY. Guest-arrival conversion also rejects empty policies, zero or overflowing weight totals, invalid guest IDs, overlapping rules without recovered precedence, zero intervals, unordered group bounds, absence of a terminal catch-all rule, and a policy not referenced by any selected A19 map. The producer worker must resolve the memory-capacity literal before implementing/serializing the schema; it may not deliver a placeholder. Diagnostics include family, source path and property. Conversion never emits a generic fallback record. Maintenance conversion additionally rejects permille overflow, zero capacity with nonzero waste rules, empty_at_units > waste_capacity_units, duplicate service IDs within one owner, loose litter without a resolved litter definition, zero total cleanliness weight, and a zero litter reference with nonzero litter weight. Its exact daily cadence/effects/thresholds are evidence gates from shipped definitions/oracle, never defaulted by the producer.

6. Behavioral evidence and disposition

Search all selected shipped entities, units, objects, AI/task, disease, biome, research, expansion, camera/mode, environment/light/weather/ambient and catalog/Zoopedia sources. Search oracle typed-object/entity/type registry, placement/facility/staff/guest/disease/progression/tank/show/transport/fossil/ camera/time/environment classes and analysis TSV domains. Mine commit d5657e5a only for already-found source keys/formulas in corresponding domain modules. Live observation settles presentation and timing where source/oracle do not.

Evidence gates include the complete definition and flag vocabularies, units, guest need/reaction/memory retention and the numeric GUEST_MEMORY_CAPACITY, staff job effects/durations, disease/rampage formulas, catalogue ordering, rating/fame/award formulas, expansion rules, camera values, fixed frequency, ticks/day, speed tiers/calendar, light/fog/sky interpolation, weather transitions and ambient bounds. Workers must recover these; familiar defaults are forbidden.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Every player-selectable/static gameplay concept resolves to exactly one narrow record and required dependencies. Source inheritance and overrides are absent at runtime. G10 directly receives ArchivedPlaceableDefinition; G16/G17/G20/G21/ G23/G25–G27/G29/G31–G33 use the named mapped records above. Guest memories use inline fixed-capacity G17 storage and definition capacity/retention. G32 is the only live clock; environments and expansion state are ordinary entities. Unknown mod semantics fail conversion until assigned a typed owner and schema revision.

8. Performance contract

Validation is O(total records+links); each typed ID lookup O(log n); range traversal O(len), all zero allocation. Stable catalog indexes avoid runtime sorting/hashing. No per-frame catalogue clone/string/property lookup. Consumers use changed filters, fixed schedules and bounded spatial indexes. Regression tests count zero allocations for every typed lookup and representative range walk, track mapped pages/faults, and attribute referenced GPU bytes to A04–A08.

9. Acceptance criteria

The four files export every symbol and exact root field above. Fixtures cover at least one valid record from every table, inheritance/override flattening, cross-family dependencies, timing/environment links and guest memory bounds. Tests reject cycles, dangling links, unknown semantic flags/need/job/mode, nonfinite/bad ranges and excess guest memory; mapped typed access is allocation-free. No live gameplay, source registry, generic value bag, stubs or unresolved silent defaults are delivered.

10. Required handoff

Report files/API, parser dependencies, module/asset/loader/plugin registration, the recovered numeric memory/timing/calendar constants, exact downstream symbol alignment, evidence still unresolved and allocator/mapping checks. Root may move genuinely shared enums into the frozen native contract and must remove any temporary family router after integration; no engine adapter is retained.

A15 — Scene Prefab

1. Identity and outcome

This package produces flat, directly iterable entity/component spawn records for scenery, facilities, animals, staff, guests and map dressing. Source scene graphs are flattened; G04 creates ordinary ECS entities without a prefab VM or reflected property bag. Integration wave 1; depends on A04, A07 and A14.

2. Exclusive ownership

This package owns native/src/families/scene_prefab.rs, converter/src/families/scene_prefab.rs, game/src/assets/scene_prefab.rs, and preflight/tests/scene_prefab_contract.rs only.

3. Frozen public contract

4. Data layout or ECS ownership

All relation spans use frozen TableRange; strings use StringRange; byte AssetRange is not needed. Tables are read directly from rkyv. A prefab is immutable construction data. Spawned entities receive only natural G04/Gxx components and retain asset handles/IDs; there is no persistent PrefabEntityBag or scene-tree runtime.

5. Preflight producer contract

Accept resolved scene/entity/map-object documents and model hierarchies. Normalize prefab and stable child keys. Resolve templates/inheritance, compose transforms, flatten parent hierarchy, produce stable child IDs, map recognized source properties to typed A14 definition links, resolve model/material/collision and attachment dependencies, and discard editor-only nodes only when proven nonsemantic. Reject cycles, duplicate stable IDs, nonfinite transforms, unresolved attachment/required assets, invalid material slots and unknown behavior-bearing components. Deterministic preorder and per-entity table order.

6. Behavioral evidence and disposition

Search shipped object/entity XML, NIF/BFB scene nodes and map object lists; oracle entity/type/component/world placement classes; analysis RTTI/function domains; commit d5657e5a model parser, world/templates/startup and placement sources. Questions: coordinate transforms, node visibility flags, attachment semantics, component inheritance, collision source, editor-only nodes and stable identity across save/load. Compare representative facility/animal/scenery spawns.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

One archive traversal gives G04 all entities and exact typed component rows. Parent/child and attachments cleanly resolve; deleting a spawned root lets ECS despawn its hierarchy. Source inheritance is absent at runtime. Unsupported semantic component data fails conversion and is assigned to a natural package before extending the schema. Mods compile to identical rows.

8. Performance contract

Validation/spawn traversal O(entities+components), zero allocation in archived iteration; entity creation necessarily allocates ECS storage only during spawn. Repeated steady frames do no prefab work. Spawn batches reserve entity/component capacity from table lengths. Track mapped pages, spawn heap/entity counts and A04/A07 GPU resources separately.

9. Acceptance criteria

Four files/API; fixture with hierarchy, renderable override, definition, collider/attachment; reject cycle/dangling/invalid transform. Archived traversal allocates zero and exposes exact counts for reservation. Non-goals: ECS spawn systems, terrain and live component state.

10. Required handoff

Report parser dependencies, root registrations, A04/A07/A14 links, exact G04 spawn component mapping, unknown source components/evidence and mapping/spawn/GPU validation. Root should inline any package-only spawn adapter.

A16 — Streamable Terrain

1. Identity and outcome

This package produces streamable terrain chunks with quantized heights, biome blends, water, collision samples and GPU-upload-ready mesh/texture payloads. G05 edits live terrain from this immutable base without reparsing maps or rebuilding the entire world. Integration wave 1; depends on A05, A07 and A14.

2. Exclusive ownership

This package owns native/src/families/terrain.rs, converter/src/families/terrain.rs, game/src/assets/terrain.rs, preflight/tests/terrain_contract.rs only.

3. Frozen public contract

4. Data layout or ECS ownership

rkyv metadata is followed by aligned payload ranges: u16 height grids, R8/RGBA8 biome blend blocks, TerrainVertex, u32 indices and compact collision samples. Byte ranges use AssetRange; record links use TableRange. Chunks map directly. G05 prepares these exact ranges into its persistent TerrainGpuAsset and owns dirty-span extraction and partial GPU writes. Live edits never mutate or copy the archive into a second base terrain graph.

5. Preflight producer contract

Accept original terrain/map records, biome paint, water and referenced material/ texture definitions after override resolution. Normalize ID, recover dimensions, orientation and units, chunk with overlap required for normals, quantize heights within target error, bake mesh normals/indices/blends/collision and water chunk links, resolve biomes/materials. Reject unknown record layout, truncated grids, NaN, invalid dimensions, quantization beyond tolerance, >profile biome channels, dangling dependencies and nonmanifold derived mesh. Deterministic row-major chunks and layer ordering.

6. Behavioral evidence and disposition

Search shipped map/terrain files and biome XML/textures; oracle BFTerrain*, terrain data/mesh/composite/water/brush classes; byte-range map and function domains; commit d5657e5a simulation/terrain.rs, placement and save terrain. Questions: grid record layout, cell/height scale, axis orientation, texture tile scale (avoid tiny repetition), normal/water rules, cliff blending, chunk seams, collision precision and brush effects. Validate representative maps live.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Base surface geometry, texture scale/blends, water height and collision match the original. Adjacent chunks are seam-free. Runtime may stream/fault chunks and G05 may apply transactional edits, but archive bytes stay immutable. Missing biome assets fail. Mods/maps compile through the same record contract. Terrain editing authentic constants are recovered in G05/A14, not guessed here.

8. Performance contract

Chunk lookup O(1), payload slicing zero allocation; validation O(chunks+payload ranges). G05 consumes mapped ranges through persistent resources and reusable staging with no recurring allocation after capacity. Residency is bounded by visible/preload policy. This package tracks mapped/resident pages and faults; G05 tracks edit heap, exact terrain GPU bytes and chunk upload time.

9. Acceptance criteria

Four files/API; multi-chunk sloped/biome/water fixture, seam and height decode checks, corrupt range/alignment/dependency rejection, zero-allocation lookup/ traversal. Non-goals: live brush commands/camera/culling systems.

10. Required handoff

Report format/parser dependencies, TerrainVertex placement/root registration, A05/A07/A14 IDs, G05/G17 residency consumers, unresolved grid/scale evidence and mapping/edit/GPU measurements.

A17 — Navigation

1. Identity and outcome

This package produces precomputed navigation tiles, compact graphs, portals and spatial lookup ranges for walkers/vehicles. Runtime pathfinding traverses mapped records and bounded scratch; it never rebuilds a source nav world. Integration wave 1; depends on A15 and A16.

2. Exclusive ownership

This package owns native/src/families/navigation.rs, converter/src/families/navigation.rs, game/src/assets/navigation.rs, and preflight/tests/navigation_contract.rs only.

This package is deliberately bespoke. bevy_landmass is rejected because its owned validated navmesh/Archipelago model would duplicate the final mapped A17 graph and synchronize agent state with G14. oxidized_navigation is rejected in the game because runtime tile generation is preflight work. A17 emits the final borrowed graph representation; it must not retain a library nav world. A small algorithm crate is acceptable only after root proves it operates directly on borrowed mapped slices without retained graph state.

3. Frozen public contract

4. Data layout or ECS ownership

rkyv fixed records and frozen TableRange adjacency/spatial spans. Centimetre/mm integer coordinates/costs make graph traversal deterministic. Runtime dynamic closures/reservations are sparse ECS/topology overlays keyed by node/edge, not a copy of the graph. A* scratch is caller-owned reusable arrays/heap capacity.

5. Preflight producer contract

Consume A16 terrain collision/water plus A15 static obstacles, gates/paths and any evidenced authored nav records. Normalize ID, rasterize/walk-test target agent profiles, build nodes/edges/portals/clearance/spatial cells, remove unreachable duplicates and deterministically order by tile/position. Reject missing source assets, invalid geometry, asymmetric accidental links, zero cost, out-of-range indexes and target graphs exceeding u32. Pack precedence is already resolved for inputs.

6. Behavioral evidence and disposition

Search shipped path/fence/gate/terrain definitions and map nav records; oracle navigation/pathfinding/influence/path classes and function domains; commit d5657e5a AI navigation manager contracts, pathing, path/fence/transport sources. Questions: grid/node scale, path preference/cost formula, animal versus guest clearance, diagonal/corner rules, gates/portals, swimming, elevated paths and vehicle networks. Live-check route shape/stuck behavior.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Eligible agents find routes consistent with terrain/path/gate restrictions; unreachable requests fail explicitly. Dynamic topology toggles overlay static flags and invalidates only affected routes. No full graph clone per agent. Mods alter inputs before nav build. Authentic cost/clearance semantics must be recovered before path behavior is called done.

8. Performance contract

Tile/cell lookup O(1); adjacency O(out-degree); A* O((V+E)log V) over bounded candidate region using preallocated scratch and zero steady allocations. Changed topology invalidation is event-driven. Count mapped pages, scratch heap capacity and path query time/expanded nodes; no GPU ownership.

9. Acceptance criteria

Four files/API; two-tile fixture with portal, blocked edge and traversal profiles; reject corrupt references/costs; prove lookup/route after warm scratch allocates zero. Non-goals: live steering/reservations and topology editing systems.

10. Required handoff

Report geometry/build dependencies, A15/A16 inputs, root registration, G08/G14 overlay/path API needs, unresolved routing evidence and mapping/scratch/timing validation.

A18 — GPU-ready effects

1. Identity and outcome

Preflight converts original particle/effect controllers into compact, bounded, Hanabi-facing effect records. In the game, bevy_hanabi performs particle storage, GPU simulation, compute dispatch, extraction, and rendering; OpenZT2 entities only select an authored effect and carry zoo-clock/lifecycle policy. Integration wave 1; depends on A04–A08.

2. Exclusive ownership and mandatory dependency

The package worker owns native/src/families/effect.rs, converter/src/families/effect.rs, game/src/assets/effect.rs, and preflight/tests/effect_contract.rs only. Root adds bevy_hanabi = 0.19 with minimal 3D features and registers its plugin.

Hanabi exclusively owns particle buffers, spawning execution, per-particle simulation, GPU compute pipelines, batching, culling, and particle rendering. This package must not implement CPU particle arrays, a GPU particle pool, emitter simulation kernels, particle extraction, or a second effect renderer. Configuration or a narrow Hanabi fork precedes any bespoke fallback; the deleted custom design remains only at commit 68a4c481.

3. Frozen public contract

The Bevy bridge creates/caches one Hanabi EffectAsset per native emitter during asset preparation. This one-time small configuration construction is analogous to GPU resource preparation and is not a second content graph. Live instances use Hanabi's normal ParticleEffect/spawner components directly rather than an OpenZT2 wrapper hierarchy.

4. Data layout and ECS ownership

Archived tables remain mapped. Texture, mesh, material, curve, and modifier references use stable IDs/ranges. Hanabi owns every live particle and GPU byte. OpenZT2 owns only mapped authoring facts, the entity lifecycle relation, clock selection, and conversion of gameplay effect requests into ordinary Hanabi components.

5. Preflight producer contract

Resolve NIF particle controllers, BFB/effect XML, materials, meshes, textures, curves, and overrides. Convert supported source operations into the closed Hanabi-facing record vocabulary, normalize units/coordinates, derive safe capacities, and sort deterministically. Reject recursive triggers, missing dependencies, invalid curves/capacities, unsupported visible modules, or a target profile without required compute/render support. The game never parses a Hanabi text/serde format.

6. Behavioral evidence and disposition

Search shipped effects and particle controllers, Gamebryo particle identities, effect/material documents, the C++ oracle and live original. Recover spawn timing, lifetime, shapes, forces, collision/kill behavior, curves, clock source, overflow policy, blending, alignment, and attachment semantics.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

Effects start, stop, loop, attach, detach, and clean up according to authored facts. Zoo-clock effects pause and change speed with G32; presentation effects remain real-time. Capacity overflow follows an explicit recovered policy. Missing dependencies or unsupported modules fail preflight rather than silently changing the visible effect.

8. Performance contract

Mapped lookup and archive traversal allocate zero. Hanabi configuration creation occurs once during preparation; settled instances allocate no Rust heap after capacity stabilizes. Particle simulation/rendering stays GPU-side and is batched/culling-aware. Track native mapping, Hanabi asset/config heap, particle GPU buffers, dispatch duration, instance counts and overflow. A settled effects scene must pass the frame allocation ceiling without an OpenZT2 particle pool.

9. Acceptance criteria

Four files/API, archive corruption tests, source conversion fixtures, and live fixtures for rate/burst, curves, attachment, both clocks, pause/speed, cleanup, capacity and GPU accounting. Source inspection must show no custom particle simulation, compute shader, pool, extraction pipeline, or renderer.

10. Required handoff

Report minimal Hanabi features/version, root plugin order, native-record to Hanabi preparation mapping, A04–A08 dependencies, unsupported source modules, clock integration, and allocator/GPU/dispatch measurements.

A19 — Worlds, Scenarios and Imported Starts

1. Identity and outcome

This package produces immutable map catalogues, starting-zoo snapshots, campaign/challenge metadata and fixed scenario objective/action programs. Original map/save import exists only here in preflight; G01/G04/G24 consume native records immediately. Integration wave 4; depends on A14–A17.

2. Exclusive ownership

This package owns native/src/families/world_scenario.rs, converter/src/families/world_scenario.rs, game/src/assets/world_scenario.rs, and preflight/tests/world_scenario_contract.rs only.

3. Frozen public contract

4. Data layout or ECS ownership

The exact root declaration is the WorldScenarioArchive shape above. All variable record spans use frozen TableRange; text uses StringRange. Maps reference A14–A17 handles. Objective records are immutable typed programs; live counters, rule state and current scenario belong to G24 components/resources, not this asset. Every action range indexes ScenarioActionRecord. G24 queues an action by ScenarioActionKey, sends that same key to the natural owner selected by ScenarioActionCompletion, and marks the index applied only after the matching success acknowledgement (Immediate completes synchronously). Rejection never counts as application. ScenarioResult is emitted only after every required terminal action index reaches its correlated terminal state.

5. Preflight producer contract

Accept resolved map/starting-zoo/scenario/campaign XML and original save/map formats. Normalize canonical IDs, apply source precedence, parse original binary only here, resolve referenced definitions/prefabs/terrain/nav/localization, compile scenario commands/tests into ScenarioRuleKind/typed actions, compile photo rules, and convert mutable initial values plus time/calendar/seed into closed spawn rows and sort deterministically. Reject unsupported original state/commands, zero/duplicate assigned persistent IDs, non-earlier parent indexes, spawn-value indexes outside their owning start range, dangling assets, invalid transforms, rule/objective cycles/ranges, invalid timing/calendar, challenge policies with unknown scenarios/maps/prerequisites, zero timing/weight or impossible eligibility, photo capacity overflow, impossible counters and map/start mismatches. Diagnostics name source rule/command. Later-layer semantics are fully resolved before output. Assign the canonical completion kind to every action, reject invalid action/completion pairs and preserve table indexes across deterministic output. Before implementation, inventory every scenario rule/action in the full corpus and oracle. Any additional semantic operation becomes an explicitly named enum variant with only its genuine typed payload. Event IDs, string opcodes, catch-alls and a generic runtime dispatcher are forbidden.

6. Behavioral evidence and disposition

Search shipped maps, freeform/challenge/campaign/scenario XML and original saves; oracle BF/ZT scenario managers/rules/actions/map entries and save/map readers; analysis function domains/byte ranges; commit d5657e5a simulation/scenario.rs, interaction/shell_content.rs, persistence/save.rs, scenario startup. Questions: complete command/test vocabulary/units, globe coordinate projection, campaign ordering, starting money/time/calendar/seed, rule visibility/transitions, photo scoring/capacity, challenge selection/delay, save record units/relationships and map availability. Live-check shell and representative objective progression.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

7. Required behavior

G01 can enumerate maps/campaigns/markers with no file access and select an exact map/start/scenario. G04 spawns stable parent-before-child initial entities. G24 matches ScenarioRuleKind exhaustively, converts G18 cents and G23 half-stars/ normalized ratings to frozen integer units, and issues actions exactly once. Unknown original rule/action blocks conversion. Imported original saves preserve every supported player-visible fact and explicitly diagnose unsupported facts; native ongoing saves are G22. Mods extend only the fixed vocabulary.

8. Performance contract

Catalogue lookup O(log n), starting spawn/objective/rule/challenge/photo traversal O(range), all zero-allocation. Scenario evaluation is event/changed-fact driven in G24, not a full archive scan per frame. Spawn reserves ECS capacity. Track mapped pages, spawn heap/entity counts and referenced terrain/model GPU bytes separately; allocator tests cover map/scenario lookup and traversal.

9. Acceptance criteria

Four files/API; fixtures cover freeform map/start, ordered campaign, objective typed rule tree/actions, weighted challenge-offer policy, photo scoring/challenge and an original-import subset; each action fixture carries its canonical completion kind and a simulated out-of-order acknowledgement proves only the matching ScenarioActionKey completes. Reject unknown command, dangling parent/dependency and bad ranges. Mapped lookup/traversal zero allocation. Non-goals: live shell UI, ECS spawning, native save writer and objective systems.

10. Required handoff

Report original parser dependencies, module/loader registration, A14–A17/A09 links, G01/G04/G22/G24 API mapping, unsupported save/rule evidence and allocation/ mapping/spawn/GPU validation. Root must remove any import adapter from engine dependency closure.

G01 — Source-driven game shell

1. Identity and outcome

The player reaches the authentic splash and main menu, chooses a profile and freeform, challenge, or campaign play, sees the source-defined globe and world markers, selects a map, and enters GamePhase::Loading. The shell owns only this application flow; UI projection belongs to G02 and world creation to G04. Integration wave 2. Prerequisites: A02, A09, A19, G02, G03 and G22's focused native-profile index/operation contract. G34 owns display/graphics settings; A11 owns audio settings and G03 owns input bindings.

2. Exclusive ownership

The worker owns game/src/plugins/shell/ and no other path. Crate declarations, plugin registration, state initialization and ordering are root handoffs.

3. Frozen public contract

Root contract requests: A02 exposes UiDocumentRole semantic discovery, A19 must expose WorldScenarioAsset and allocation-free AssetId lookup, G02 must expose ShowUiRole/UiCommandActivated, G22 owns ProfileIndex and every profile request/result named below, and G04 owns BeginWorldLoad/WorldLoadFinished/WorldLoadFailed. G01 consumes or writes those exact G04 messages and must not redeclare them. G34 applies display and graphics settings; G01 owns only navigation into/out of the options document.

4. ECS ownership

ShellSelection is genuinely global bounded navigation state. ShellScreen, ProfileChoice, and WorldChoice are facts on projected UI entities.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Start with shipped ui/ shell XML/images, globe/map/campaign/challenge records, localization keys and profiles; search the oracle and analysis TSVs for ZTMainMenu, ZTWorldSelect, campaign, challenge, freeform, globe and profile functions. Inspect commit d5657e5a only in app/launch.rs, features/core/app_flow.rs, interaction/menu.rs, ui/native.rs and world selection code. Live observation settles splash duration/skipping, back-stack, marker layout, disabled choices and transition timing.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Evidence questions: exact startup screen order; profile-slot limits; whether each product mode shares the globe; world-marker selection/default/focus rules; and original loading failure presentation. Resolve from shipped documents and live behavior, not guessed timeouts or hardcoded marker positions.

7. Required behavior

Every visible item/marker comes from A02/A19/G22 data. StartSelected is ignored unless profile, mode and scenario are all present and compatible. Back returns one authentic level without retaining hidden screen trees. A matching load completion enters the game; stale completions cannot. Missing/corrupt native assets produce an explicit disabled/error UI state, never fake success. Controller navigation is through G03/G02. The options screen presents G34/A11/ G03 settings and returns through the authentic shell back flow; G01 never owns their live values or application. OpenZT2 adds no new shell rule here.

8. Performance contract

No filesystem access, source parsing, string construction, asset-payload clone, or per-frame scan of scenarios. Screen entry may allocate Bevy UI entities; settled shell frames and command routing allocate zero. Marker creation is O(visible worlds) once; command routing is O(messages). Allocation tests cover idle shell and a command without transition; mapped-page counters cover A02/A19 faults, and shell adds no GPU bytes beyond referenced UI assets.

9. Acceptance criteria

Deliver ordinary formatted Rust under the owned directory exporting every item above. A deterministic system test must prove invalid start is rejected and a valid selection emits one BeginWorldLoad. No placeholder screens, guessed coordinates, todo!, silent stubs, or source-format dependency. Bulk handoff: integrate with A02/A11/A19/G02/G03/G04/G34 and verify the complete navigable shell.

10. Required handoff

Report files/API; dependencies/features; root module/plugin/message/state/order registrations; consumed A02/A19/G02/G03 and requested G04 symbols; unresolved evidence; G34/A11/G03 options seams; seams to erase; and expected allocation, mapping, GPU and navigation validation.

G02 — Native game UI

1. Identity and outcome

Compiled A02 UI documents become ordinary Bevy UI entities with authored layout, style, focus, bindings and fixed commands. Modded documents work because preflight compiles the same fixed vocabulary; XML never enters the game. Integration wave 2. Prerequisites: A02, A05, A09 and A12.

2. Exclusive ownership

The worker owns game/src/plugins/ui/ only. Root owns module/plugin, asset-loader, reflection and schedule registration.

Bevy 0.19 UI is the exclusive layout/widget/picking/focus implementation. Use its ordinary nodes, flex/grid engine, clipping, scrolling, interactions and automatic directional navigation directly. G02 owns document projection and Zoo Tycoon bindings/commands only; no custom layout pass, widget hierarchy, focus graph, UI scene, or egui/third-party UI world is permitted.

3. Frozen public contract

A02 freezes UiDocumentAsset, UiCommand, UiBinding and its typed source enums, archived node/style records, zero-copy indexed accessors, and UiDocumentRole::native_asset_path(self) -> &'static str. Preflight writes the single precedence-resolved document for every supported role at that semantic native virtual path. Do not invent local command strings, JSON-like values, widget traits, a DOM, a binding property bag, or a role-to-handle store. Projection exhaustively converts each UiBinding variant into the corresponding typed component above once. A05's stable native-ID Handle<Image> is the sole bridge to Bevy ImageNode, while a retained Handle<TextureAsset> owns its mapped source through preparation; A12 resolves the recovered system-font policy into ordinary Bevy TextFont beside Text.

4. ECS ownership

All live UI is Bevy Node, Text, ImageNode, interaction and small marker components. Only per-screen focus is retained.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect shipped UI XML/styles/hotkeys/localization and images; oracle/TSVs for BFUI, UIManager, layout, widget, message and focus classes; and commit d5657e5a presentation/ui/{native,layout,tree,widgets,interactions}.rs only for discovered vocabulary. Live observation settles scaling, layering, clipping, hover/pressed/disabled visuals, focus wrapping and modal input capture.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Evidence questions: coordinate origin/anchor rules, logical-resolution scaling, z/layer ordering, nine-slice behavior, modal focus escape and command repeat. Resolve them in A02 records or observation; never approximate layouts in code.

7. Required behavior

Projection preserves authored parent order, anchors, clipping, visibility, enabled state, style and localized text/image/font references. Unknown validated commands are rejected by preflight, not ignored here. Bindings are precise property sink components, not a generic range, property/source-key dispatcher or copied UI state table. G02 does not read economy, selection, profile, progression, scenario or other gameplay state. G21 owns selected-entity, information and catalogue presenters; G01/G22/G23/G24 and later natural domain owners query their own narrow facts plus the exact G02 sink component and write ordinary Bevy Visibility, Text, ImageNode, UiValue or UiSelected. Hidden/despawned roots cannot retain focus or activate commands. Pointer, keyboard and controller produce identical typed activation facts.

8. Performance contract

Projection may allocate exactly once per created tree; idle UI, focus movement, activation and binding presentation allocate zero. Archived traversal is direct; handles clone without payload allocation. No per-frame tree rebuild, text key formatting, hash growth or asset lookup by constructed path. Role resolution is startup/screen-transition work and loads a fixed &'static str. Work is O(changed nodes + input messages). Counters cover idle UI and focus/confirm; mapped faults remain attributed to A02/A05; backend font/glyph memory is measured under A12.

9. Acceptance criteria

Deliver all symbols above. Pure/system tests prove deterministic projection order, disabled targets never activate, controller and pointer emit the same command, and teardown removes the entire owned tree. No DOM, command router, runtime XML, placeholder widget or generated source. Root performs visual comparison and bulk compile.

10. Required handoff

Report files/API, dependency and registration requests, A02/A05/A09/A12 symbols, command consumers needing root wiring, evidence gaps, integration seams, and allocation/mapping/GPU/visual validation.

G03 — Device-independent input

1. Identity and outcome

Keyboard, mouse and any connected controller drive the same fixed game actions, including controller UI focus, camera controls, undo and redo, with rebinding. The package translates devices only; it does not route domain commands. Integration wave 2. Prerequisite: frozen Bevy contracts.

2. Exclusive ownership

The worker owns game/src/plugins/input/ only. Root owns plugin/schedule and reflection registration and persistence integration.

Bevy Input and bevy_gilrs exclusively own keyboard, mouse, touch, gamepad discovery and raw device state. G03 only maps those facts to GameAction, rebinding and active-device policy. It must not add an input backend, poll an OS API, or mirror device state through Leafwing or another input framework.

3. Frozen public contract

ActionRequest, ActionSource, GameAction are the sole shared semantic actions. Domain-specific input remains owned by its feature, not added here.

4. ECS ownership

Resources are genuinely global device/configuration facts and fixed-size during settled play. No entity input state is mirrored.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect shipped hotkey/input XML and original options, oracle/TSVs for input, hotkey and camera-command readers, and commit d5657e5a interaction/controller.rs, ui/hotkeys.rs, input_actions.rs solely for known bindings/tokens. Observe original press/repeat/modifier and mouse-camera semantics. Controller support is the deliberate OpenZT2 extension.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Evidence questions: original default keys, action repeat, wheel sign/scale, mouse buttons and mode-dependent capture. Controller dead zones, glyph choice and default layout are new policy and must be documented, deterministic and data-free, not guessed as original behavior.

7. Required behavior

Digital actions emit once on press unless the original binding explicitly repeats. Opposing axes cancel; analog magnitude survives normalization outside dead zone. Last meaningful device wins without flicker from noise. Rebinding rejects invalid slot and collisions atomically. Disconnect clears axes and falls back safely. Undo and Redo are first-class. No gameplay mutation or UI traversal occurs here.

8. Performance contract

All steady input systems allocate zero and perform O(bindings + connected controllers) bounded work. No action-name strings, maps grown per frame or message buffering outside Bevy. The binding box changes only on load/rebind. Allocator regressions cover idle, keyboard edge, analog frame and controller disconnect. No mapped pages or GPU resources are owned.

9. Acceptance criteria

Deliver all symbols above and tests for edge triggering, opposing axes, dead-zone stability, duplicate rejection, disconnect and equivalent keyboard/ controller actions. No command dispatcher, hidden context world, placeholder bindings or polling allocations. Root bulk-validates live devices and G02/G06/ G07 integration.

10. Required handoff

Report API/files, root registrations, any Bevy feature needs, persistence fields, original binding evidence and controller policy, integration seams and exact allocation/device validation.

G04 — World instantiation

1. Identity and outcome

A selected native scenario/map is instantiated directly as Bevy entities with typed components and asset handles, then loading completes. This owns the one-time immutable-record-to-ECS boundary, not a retained prefab world. Integration wave 2. Prerequisites: A14, A15 and A19.

2. Exclusive ownership

The package worker owns game/src/plugins/world_spawn/ only. Root owns declarations, registrations, schedule wiring and cross-plugin type registration.

3. Frozen public contract

G04 consumes G01's already frozen PlayMode; the load request/result messages above remain G04-owned and must not be redeclared by G01. A15/A19 expose ScenePrefabAsset, WorldScenarioAsset, fixed spawn-kind records and allocation-free ID lookup.

4. ECS ownership

Components are durable identity/bounds facts. PersistentIdAllocator is the one focused coordination resource for the active world and contains only its root and monotonic cursor. A bounded PendingWorldSpawn resource may privately retain one scenario handle and next record index during loading; it must be removed at completion and is not a world representation.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Start with shipped map/scenario/entity instance data and save maps; oracle/TSVs for world/entity factory, placement, load and ID functions; commit d5657e5a startup/world.rs, simulation/world.rs, presentation/world.rs only for record coverage and discovered transforms. Observe map orientation, entrance, parenting, initial visibility and mode-specific starting conditions.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: original coordinate/rotation convention, stable-ID derivation, instance parent/attachment order, absent optional dependency handling and exact mode overrides. Resolve in A15/A19/preflight; do not keep generic component bags.

7. Required behavior

One request creates one world or one failure. Record order and IDs are deterministic. A19 (or G22 for a save) validates imported IDs for matching root, nonzero value and duplicates before allocator mutation; reserve_imported only advances the high-water mark. Every fixed spawn-kind becomes its natural component bundle and typed handle; unknown kinds were rejected preflight. Parent/attachment links resolve without linear name lookup. Completion waits for required native asset availability, not GPU residency. Every later package spawn attaches WorldMember; every live-created entity that G22 can save obtains its ID only through PersistentIdAllocator (direct allocate while exclusively borrowed or AssignPersistentId) before its owning domain acknowledges creation. IDs are never reused after despawn during that world lifetime. Unload removes all matching members regardless of transform hierarchy plus pending/allocator state. Save IDs never depend on Bevy Entity bits.

8. Performance contract

Loading may allocate ECS storage and GPU handles but never reconstructs an intermediate graph. Record traversal is direct, O(records + dependencies), with bounded per-frame batching and pre-sized temporary lookup. Fresh ID allocation and validated import reservation are O(1) and zero-allocation. Settled frames have zero G04 work/allocation. Measure total load allocations, mapped faults and time; GPU bytes remain owned by asset families. A post-load allocation test must show zero.

9. Acceptance criteria

Deliver exports above and tests for deterministic allocation, imported-ID high-water advancement, upstream duplicate validation, exhaustion rejection, typed spawn coverage and complete unload. No second ID allocator, domain-local counters, generic authored entity, property map, source parser, retained spawn mirror or fake completion. Root validates a real map from G01 through InGame in bulk.

10. Required handoff

Report files/API, registrations, A14/A15/A19 and G01 types, every spawn-kind and G22/live-creation owner needing allocator integration, unresolved records, temporary cursor seam, and load allocation/page/GPU/gameplay validation.

G05 — Editable terrain and water

1. Identity and outcome

Native terrain chunks render with authentic scale and blending, answer height/ surface queries, support terrain/biome/water brushes, update collision and GPU data, and emit reversible changes. Integration wave 2. Prerequisites: A16, G04, G07's frozen atomic edit protocol and G18's Money.

2. Exclusive ownership

The package worker owns game/src/plugins/terrain/ only. Root owns module/plugin/render feature and schedule registration. Do not edit A16 or G07.

3. Frozen public contract

A16 freezes TerrainAsset archived grids/GPU payload and biome layer IDs. G07 owns PrepareConstruction, EditApplication, payment/rollback coordination and history; G18's Money is the only cost type.

4. ECS ownership

Only a chunk changed by gameplay owns editable samples. Unedited sampling, collision and initial GPU preparation read A16 mapped arrays/payload directly through the handle. Each chunk also has the unit TerrainRenderChunk marker. TerrainDirty is a monotonic change fact: collision and render consumers compare its revision with their last-applied revision, so retaining it cannot cause idle work or repeated upload.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect shipped terrain/map/biome/brush data; oracle/TSVs for terrain manager, height interpolation, cursor, biome paint, water and undo; commit d5657e5a simulation/terrain.rs and terrain source records only for equations/tokens. Observe tile scale, brush falloff, smoothing, water plane, texture scale/blend, clamps, cost and collision timing.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: exact grid dimensions/axis orientation; centimetre quantization; height clamps; each brush kernel; biome channel normalization; water depth and terrain transaction cost. Recover before implementing those branches.

7. Required behavior

Sampling is continuous across chunk seams. Brush influence uses recovered kernel and clamps; preparation records exact before/after values once without touching live terrain. Only CommitTerrainEdit after the G18 debit may materialize an overlay and apply after; undo/failure rollback applies before and redo applies after. Undo/redo restores identical samples. Dirty bounds coalesce, update collision before agents navigate, and upload only affected ranges. Surface texture world scale comes from A16/material data, never guessed tiling. Corrupt dimensions fail at asset validation, not with partial terrain.

8. Performance contract

Settled systems allocate/do work only on changed chunks. Sampling is O(1) and zero-allocation; a stroke is O(samples in radius). An overlay allocates once on first write to that chunk; unedited maps remain zero-copy. Deltas allocate only during per-player-edit preparation and are discarded without world mutation if preparation/debit fails. A16 payload preparation creates persistent GPU buffers once. Dirty extraction copies only the changed rectangle into reused staging and RenderQueue::write_buffer updates only corresponding ranges; it never rebuilds a Mesh, vertex buffer, or full chunk. Tests count idle frame, sample and unchanged-revision upload allocations; smaps/page faults cover A16; the GPU ledger covers exact persistent buffers, textures and update bytes.

9. Acceptance criteria

Deliver all exports, mapped-versus-overlay sampling/seam/kernel/round-trip tests, prepare-without-mutation, debit-gate and atomic multi-chunk acknowledgement, proof unedited load/sampling allocates no sample arrays, and a no-dirty no-op test. A changed 8x8 rectangle must produce only the corresponding height/blend/ water queue writes, while a repeated revision produces none. No source parsing, whole-map rebuild/reupload per stroke, CPU Mesh mutation, per-frame GPU asset creation, renderer wrapper, guess constants or eager second terrain graph. Root bulk-validates original map appearance, editing, collision and history.

10. Required handoff

Report API/files, Bevy/render/physics dependencies, A16/G04/G07 symbols, registrations/order, evidence gaps, copy-on-first-write rationale, and allocator/ mapping/GPU/visual validation.

G06 — Authentic game cameras

1. Identity and outcome

The in-game camera pans, edge-scrolls, rotates, zooms, fits terrain, respects map bounds and performs source-authored transitions with original overhead semantics. It also exposes clean mode transitions for later immersive modes. Integration wave 2. Prerequisites: G03 and G05.

2. Exclusive ownership

The package worker owns game/src/plugins/camera/ only. Root owns registration/schedule/reflection.

3. Frozen public contract

Camera tuning comes directly from A14 CameraTuningDefinition selected by the A19 map/scenario record; an absent or invalid reference is a load failure, never a runtime default.

4. ECS ownership

Rig/tuning/bounds/transition are facts on the actual Bevy camera entity; there is no camera resource shadowing its transform.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect camera XML/hotkeys/options and map records; oracle/TSVs for ZTCameraCommandReader, overhead/UDV/ground-fit/bounded-object components; commit d5657e5a domain/interaction/camera.rs and features/presentation/camera.rs for evidence only. Live comparison is required for pan axes, acceleration, zoom, pitch, fit, edge thresholds and transitions.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: units/signs and zoom-dependent speed curve; wheel accumulation; camera anchor clamp vs frustum; soft-fit equations; initial yaw/focus; easing; sky/frustum switches. Resolve exact values from native assets/oracle.

7. Required behavior

Inputs accelerate/decelerate per tuning, remain frame-rate independent, clamp zoom/pitch/anchor and terrain-fit without penetrating water/ground. Rotation is around focus. Transition interpolation uses shortest angular path and reaches the exact endpoint. Invalid/deleted target returns safely to overhead. The component Transform is the authoritative pose used by Bevy rendering and ray casting. Camera motion and transitions always use Time<Real> and therefore continue consistently while simulation speed or pause changes G32 time. No guessed 24/70-style limits.

8. Performance contract

All steady camera systems allocate zero and are O(1) plus at most the terrain chunk spatial lookup, which must not scan all chunks. Only changed poses emit. No strings, path lookup or transform clone collections. Allocation tests cover idle, pan/rotate/zoom and transition frames. Camera owns no mapped or GPU data.

9. Acceptance criteria

Deliver all exports with pure tests for clamp, acceleration, shortest-angle easing, exact transition completion and immersive capture/restore. No camera god resource, fixed guessed semantics, per-frame terrain scan or renderer wrapper. Root validates against live original at several map edges/zoom tiers and controller input.

10. Required handoff

Report API/files, source tuning contract, G03/G04/G05 and later G31 symbols, root registrations/order, evidence gaps, temporary mode seams and allocation/ camera-comparison validation.

G07 — Construction interaction and history

1. Identity and outcome

The player selects a build/delete tool, sees a validated preview, commits or cancels it, and can undo and redo every accepted world edit. G07 owns the generic edit lifecycle, atomic coordination and history; each domain owns its typed transaction component and application system. Integration wave 2 foundation. Prerequisites: A14, A15, G03, G04 and G18. G05/G08/G10 build on this protocol; they are not prerequisites of G07.

2. Exclusive ownership

The package worker owns game/src/plugins/construction/ only. Root owns registrations, schedules and cross-domain transaction ordering.

3. Frozen public contract

G10 owns placement-rule evaluation; G05 owns TerrainEdit, TerrainEditPrepared/TerrainEditPreparationRejected, CommitTerrainEdit and TerrainEditAcknowledged; G08 owns the corresponding Topology* types; G10 owns the corresponding Placement* types. Every acknowledgement has exact shape { transaction:Entity, application:EditApplication, accepted:bool }. G18 owns Money, TransactionRequest, TransactionCompleted, TransactionRejected and cash mutation. This is the complete atomic policy; there is no unresolved root decision, Box<dyn Command>, closure or blob.

4. ECS ownership

Only current tool and bounded entity-ID history are resources. Preview and transaction facts are entities/components, enabling typed domain systems.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect build-mode/UI data, placement cursors, failure localization and entity rules; oracle/TSVs for placement, delete and undo functions; commit d5657e5a domain/simulation/placement.rs, features/simulation/{placement,delete,undo}.rs only for discovered commands/rules. Observe drag, single-placement, right-click, refund, selection, confirmation and undo granularity.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: which actions are transactional together; history bound; redo-tail behavior; refund ratios; preview LOD/colors; continuous placement; deletability and dependent cleanup. Recover, do not infer generic editor behavior.

7. Required behavior

Only valid current previews commit. Preparation freezes typed before/after records and checked signed net cost but cannot mutate the world. G18 transfer completes before any initial/redo forward application. The three named domain acknowledgement lanes are counted from fixed fields; history records only after all expected lanes accept. Any rejection reverses only lanes that acknowledged application, waits for their rollback acknowledgements, then reverses the completed transfer through G18. Undo applies exact inverses before its compensation; redo completes its transfer before exact forwards. Failure during history application restores the pre-request world/economy state and leaves cursor/state unchanged. A new commit after undo deletes the redo tail. History stores transaction entities, never snapshots of the world. Deletion uses domain cleanup and records sufficient data for exact restoration.

8. Performance contract

Idle construction/history systems allocate zero. Cursor update is O(1) plus indexed terrain hit. History allocation occurs only on edit and retains a configured bound; dropping redo/old entries recursively frees their components. No per-frame world scan, payload cloning or generic serialization. Counters cover idle/cursor/undo request; transaction heap is measured per edit. No mapped or GPU bytes beyond preview handles.

9. Acceptance criteria

Deliver exports and tests for invalid/no-domain preparation, economy-before-world ordering, exact cursor progression, multi-domain acknowledgement counting, partial rollback/compensation, undo/redo, stale/duplicate acknowledgement rejection, redo-tail disposal and history bound. No generic command trait, opaque operation enum collecting every domain, world snapshot or fake success. Root bulk-tests terrain/topology/object/economy edits.

10. Required handoff

Report API/files, registrations/order, G03/G04/G05/G08/G10/G18 symbols, exact three-lane ordering, evidence gaps, seams and allocation/history/gameplay checks.

G08 — Fences, paths and portals

1. Identity and outcome

Players construct authentic fences, gates, portals, ground/elevated paths and supports as connected ECS topology used directly by habitats and navigation. Integration wave 2. Prerequisites: A14, A15, A17, G04, G07 and G18.

2. Exclusive ownership

The package worker owns game/src/plugins/topology/ only. Root owns declarations, registration, schedules and operation integration.

3. Frozen public contract

Definition grid scale, fence/path placement constraints and navigation-link records come from A14/A17. Every HashMap above is exactly bevy::platform::collections::HashMap. G07 owns the payment gate and coordination. Therefore every priced G08 edit reaches G18 before CommitTopologyEdit; G08 never debits cash directly and never mutates topology from PlaceFence/PlacePath.

4. ECS ownership

Topology facts live on actual nodes/edges/tiles. The resource is only a spatial index, rebuilt from components on load and never authoritative over them.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect fence/path/gate/elevated-path definitions and placement UI; oracle/TSVs for ZTFence, ZTPath, portals, rubber band and traversal; commit d5657e5a domain/runtime fence/path files only for evidence. Observe grid size, 45-degree rotation, intersections, cost, auto-gates/supports, slopes and deletion.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: exact world-to-grid formula (old evidence includes source tile quantization and a 0.785398185 rotation step); rubber-band line rule; overlaps; gate orientation; path curb variants; elevated levels, slopes/headroom/supports.

7. Required behavior

Canonical indexing rejects duplicate nodes/edges/tiles. Placement expands by authentic rules and preparation validates every segment without mutation. G07 completes one checked G18 debit before G08 applies the immutable snapshots; acknowledgement occurs only after the whole index/entity change succeeds. Gates alter traversal without destroying the fence. Elevated paths retain levels and supports. Undo/redo restores IDs/connectivity. Deleting topology cleans portals/supports and triggers containment/navigation.

8. Performance contract

Steady systems allocate/do no work without changes. Lookup is expected O(1); placement is O(new segments), affected rebuilds are regional. Index reserves on load/edit outside settled frames. No all-world connectivity rebuild per frame or path-vector cloning. Count idle/gate allocations, index heap, A14/A17 faults and mesh/support GPU bytes.

9. Acceptance criteria

Deliver exports and tests for canonical edges, duplicate rejection, recovered line expansion, preparation-without-mutation, debit-before-apply, atomic acknowledgement, gate traversal, elevated support cleanup and undo/redo identity. No topology manager world, string token state or speculative geometry. Root bulk-validates construction, habitats and navigation.

10. Required handoff

Report API/files, map/definition dependencies, root registrations/order, G04/G07/G09/G14/G18 contracts, evidence gaps, index seam and allocator/mapping/GPU/ topology validation.

G09 — Habitat containment and membership

1. Identity and outcome

Closed fence topology forms habitats; animals/objects acquire correct habitat membership, breaches update containment, and suitability systems receive exact area, biome and traversability facts. Integration wave 2. Prerequisites: A16, G05 and G08.

2. Exclusive ownership

The package worker owns game/src/plugins/habitat/ only. Root owns module/plugin/message ordering.

3. Frozen public contract

Cell conversion uses the active A16 TerrainArchive.cell_size_cm; preflight validates that G08 topology cells use that same grid. Do not add a second grid-scale resource or generic membership trait.

4. ECS ownership

Regions/summaries are live components on habitat entities; index is derived bounded acceleration data. Objects and animals carry one direct relationship.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect habitat/fence/biome/species data; oracle/TSVs for habitat manager, containment, traversable area and suitability; commit d5657e5a habitat regions and animal assessment solely for evidence. Observe enclosure recognition, gates, map boundary, multi-region fences, escape and habitat UI area calculation.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: flood-fill domain and diagonal rules; map-edge containment; gates/ portals; fence traversability by species; habitat identity persistence through edits; water/biome area integration; what objects count as members.

7. Required behavior

Closed valid boundaries produce deterministic regions; open boundaries mark breach/no enclosure according to recovered rules. Regional edits preserve unaffected habitat entities/IDs where possible. Moved/spawned entities update membership once; deleted habitats remove relationships. Summaries match terrain cells and expose facts, not a guessed suitability score. No rectangular shortcut except where evidence defines one.

8. Performance contract

No per-frame global flood fill or entity scan. Rebuild is O(affected cells + edges) on topology events; membership is changed-transform O(1) lookup. Region arrays allocate only on rebuild and replace old storage. Idle/movement allocation tests are zero; track index/region heap and terrain mapped pages; no GPU ownership.

9. Acceptance criteria

Deliver exports and tests for enclosure/breach, deterministic regions, regional preservation, membership transitions and area summaries using recovered grid rules. No habitat world mirror, bounding-box guess or per-frame rebuild. Root validates with fence edits, animals and suitability.

10. Required handoff

Report API/files, registrations/filter wiring, G05/G08/G11/G12 symbols, evidence gaps, index seam and allocator/region/gameplay validation.

G10 — Scenery and facility placement

1. Identity and outcome

Scenery and facilities use authored footprints, orientation, entrances, terrain/topology/habitat constraints, locks and costs to produce an authentic preview and atomic placed entity. Integration wave 2. Prerequisites: A14, A15, G04, G05, G07–G09 and G18.

2. Exclusive ownership

The package worker owns game/src/plugins/placement/ only. Root owns registrations/order and G18/G23 integration.

3. Frozen public contract

A14 must freeze ArchivedPlaceableDefinition including footprint cells, pivot, rotation increments, constraints, cost, unlock and entrance. G18/G23 provide affordable/unlocked facts without G10 owning money/progression copies.

4. ECS ownership

Placed entities carry their own definition, transform, footprint and entrance. The resource accelerates occupancy only and is reconstructed from components.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect entity/footprint/placement/UI/localization records; oracle/TSVs for place object, footprint, collision, affordability and research predicates; commit d5657e5a placement/world/facility files for evidence only. Observe preview LOD/colors, grid snap, free rotation, entrances, slopes, tank/habitat rules, repeated placement, cost/refund and errors.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Known original failure tokens include unaffordable, unresearched, overlap, too-steep, no-headroom and out-of-traversable-area. Questions: predicate order, cell rounding, rotation step, footprint pivot, terrain tolerance, object-object exceptions and special placement types. Recover before coding each rule.

7. Required behavior

Preview uses the same transform/footprint/rules as commit. First failing rule produces the authentic typed/localizable reason. Preparation freezes the complete edit and cost/refund without mutation. G07 completes the required G18 economy leg before CommitPlacementEdit; commit is atomic and creates natural typed prefab components/handles, not a generic entity bag. Occupancy is updated with world mutation. Undo/redo restores exact persistent identity and cells. Removal releases cells and dependent domains clean relationships.

8. Performance contract

Idle systems allocate zero. Preview validation is O(footprint cells) with O(1) indexed checks and changed-input gating. Preview handles are reused; placement arrays allocate only at commit. No whole-world collision scan, path construction or strings. Count idle/unchanged validation; track placement index heap, A14/A15 faults and referenced model/material GPU bytes.

9. Acceptance criteria

Deliver exports and tests for transform/footprint parity, predicate precedence, prepare-without-mutation, payment-before-apply, exact acknowledgement, atomic failure, occupancy, rotation and undo/redo. No guessed fallback rules, generic prefab runtime or duplicate economy/progression state. Root bulk-tests representative scenery/facilities against original behavior.

10. Required handoff

Report API/files, A14/A15/G05/G07–G09/G18/G23 contracts, registrations/order, evidence gaps, atomicity seams and allocator/mapping/GPU/placement validation.

G11 — Animal lifecycle and family

1. Identity and outcome

Animals are adopted from native species/variant data, age through authentic stages, mate, become pregnant, give birth with correct inheritance/family links, and can be released. Integration wave 3. Prerequisites: A03, A14, G04 and G09.

2. Exclusive ownership

The package worker owns game/src/plugins/animal_lifecycle/ only. Root owns declarations, registrations, schedules and later economy/health/persistence wiring.

3. Frozen public contract

A03 owns Sex, LifeStage, SpeciesCatalogAsset, variant probabilities, stage_start_ticks, breeding compatibility, gestation_ticks and litter ranges. Exact adoption inventory/cost requires an A14/A03 evidence-backed extension; G11 must not invent it. G18 owns Money; G09 membership is reused.

4. ECS ownership

Each component is one animal fact. There is no animal collection resource; lineage is queried from Parents, not mirrored child vectors.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect species entities, young/adult variants, adoption and AI reproduction data; oracle/TSVs for animal, adoption, lifecycle, family, pregnancy and birth; commit d5657e5a domain/simulation/animal.rs and animal lifecycle systems only for evidence. Observe adoption inventory, sex/variant choice, ageing morph, mating gates, gestation, litter placement, naming, release and family UI.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

G32/A03 own tick conversion. Questions: stage thresholds; conception probability/ cooldown; relatedness; litter distribution; variant inheritance; parent links beyond parents; adoption stock refresh; release restrictions/rewards. All are asset/oracle questions, not constants to invent.

7. Required behavior

Adoption validates availability, habitat and funds atomically. Age crosses each stage once and swaps only variant/presentation handles required by A03. Mating cannot self-pair, violate sex/stage/species/family/cooldown rules or overwrite a pregnancy. Birth uses stored seed, creates all children atomically where required, keeps stable parent links and emits one event each. Release cleans habitat, behavior, navigation and selection relationships through owner events.

8. Performance contract

Clock systems are linear in live/pregnant animals, fixed-step and allocation- free. Spawn/birth/release may allocate ECS entities only on transition. No per-frame species cloning, name strings, family vectors or adoption catalogue copy. Counters cover settled ageing and non-due pregnancy; A03 mapped faults and animal model GPU bytes are separately tracked.

9. Acceptance criteria

Deliver exports and deterministic tests for stage crossing, invalid pairing, gestation/litter/inheritance, parent cleanup and release eligibility using recovered fixtures. No adoption manager, animal bag, guessed rates, placeholder birth or duplicated catalogue. Root bulk-tests economy, UI, save and behavior.

10. Required handoff

Report API/files, registrations/order, A03/A14/G04/G09/G13/G18/G22/G23/G32 symbols, evidence gaps, lineage seams and allocation/mapping/GPU/lifecycle validation.

G12 — Animal needs, welfare and suitability

1. Identity and outcome

Each animal has small explicit need components that decay/recover by species rules; habitat suitability and overall welfare are derived by narrow systems and drive authentic statuses and behavior. Integration wave 3. Prerequisites: G09 and G11 plus A03 species data.

2. Exclusive ownership

The package worker owns game/src/plugins/animal_welfare/ only. Root owns registration, scheduling and information/health integration.

3. Frozen public contract

A03 owns NeedKind, SpeciesNeedRecord and exact signed Q16 permille/tick units; A10 references that same type. G09 supplies habitat facts.

4. ECS ownership

Every need is independently queryable. Suitability/welfare are derived components retained only because multiple systems/UI consume them.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect species need definitions, needAdjusts, biome/habitat preferences and status localization; oracle/TSVs for animal needs/happy factors/habitat score; commit d5657e5a animal need and habitat assessment code only as evidence. Live observation settles displayed scale, arrows, thresholds and update cadence.

Commit 19dd222f intentionally deleted the former Rust architecture. Do not restore its hosts, managers, aggregate runtime resources, generic bags, duplicated worlds, runtime source parsing, or compatibility layers.

Questions: whether source values are satisfaction or deficit; exact time scale, decay and clamping; happiness aggregation; space/biome/foliage/shelter/privacy formulas; species/group effects and critical statuses. Recover each formula.

7. Required behavior

New animals initialize from A03, not universal 100s. A03 decay_per_tick_q16 is applied once per running G32 simulation tick directly to the live Q16 component, with integer saturating clamp and no private time conversion, float residual or lost fractional decay. Each need changes only by its own rate/effects and clamps exactly. Suitability reacts to membership/ habitat changes and uses authored species preferences and measured G09 facts. Welfare aggregation and bands match evidence. Threshold messages are edge- triggered. Disease/health belongs to G16; food transactions to G15.

8. Performance contract

All steady systems allocate zero. Decay/derivation are O(relevant animals) on fixed ticks with change/event filters; suitability is O(animals in affected habitats) and must not scan every habitat for each animal. No need maps, strings, per-frame asset clones or vectors. Count representative settled need and welfare passes; A03 pages separate; no GPU ownership.

9. Acceptance criteria

Deliver all exports and tests using recovered fixtures for decay, clamp, adjustment, suitability, aggregate and single threshold emission. No generic Needs component, guessed percentages, animal update dispatcher or no-op score. Root validates status UI, feeding/behavior and habitat edits.

10. Required handoff

Report API/files, exact A03 fields/formulas, registrations/order, G09/G11/G13/ G15/G16/G21/G32 consumers, evidence gaps and allocation/mapping/gameplay validation.

G13 — Data-authored animal task selection

1. Identity and outcome

Compiled A10 rules score animal tasks through focused ECS systems, select one deterministically, and expose a changed typed task for the domain that executes it. This is not a behavior VM or animal update dispatcher. Integration wave 3. Prerequisites: A03, A10, G09, G11, G12, G14, G15 and G32.

2. Exclusive ownership

The package worker owns game/src/plugins/animal_behavior/ only. Root owns registrations, ordering and command-executor integration.

3. Frozen public contract

A10 owns BehaviorProgramAsset, exact BehaviorSet, BehaviorAction, BehaviorInput and A03 NeedKind references. BehaviorHandle::set resolves by MappedBehaviorArchive::set, and scorers traverse only MappedBehaviorArchive::set_programs plus direct program lookup. No per-entity program list or unresolved root extension remains. Executors inspect only the current mapped action on Changed<ActiveTask> and attach focused components.

4. ECS ownership

An animal carries an archive/set reference, inline disjoint candidate components, active task and RNG. Candidate writers touch different component types and can run in parallel. No manager/vector/blackboard exists.

The selector tuple above is complete for the recovered animal task families. Any newly evidenced family requires a reviewed schema/brief revision before implementation; runtime registration or a shared mutable score bag is forbidden. Pure generic score helpers may be zero-cost monomorphs.

5. Preflight producer contract

Not applicable: the engine consumes only native assets produced before launch.

6. Behavioral evidence and disposition

Inspect AI task/behavior-set/entity files; oracle/TSVs for AI thinker, evaluators, selectors, qualifiers, behavior sets and completion; commit d5657e5a domain AI and simulation/behavior.rs only to mine fixed command and formula evidence. Observe task cadence, priorities, interruption, target choice, cooldowns, weighted ties and idle behavior.