# 2026-08-07 — Full-stack audit + remediation

**The ask** (operator): *"Do a comprehensive audit of the current state of the project at multiple layers… then
produce a concise report… Be unbiased, concise, and above all accurate. Don't make assumptions if you can verify."*
Then: *"Go through and fix ALL issues… Be complete and thorough."*

## The audit

8 parallel dimension auditors (code, netcode, tests, docs, process, design, art, infra), each adversarially
re-verified by an independent agent — 16 agents, 0 errors — plus my own live Play-mode verification across all three
player-facing scenes. **46 findings**: 1 critical, 6 high, 20 medium, 19 low. Report + full evidence:
`scratchpad/AUDIT_2026-08-06.md`, published as an artifact.

**The headline, found by playing the game rather than reading it:** the LANTERN pivot (locked 07-13) had reached the
design docs and combat internals and almost nothing a player touches.

- `MainMenu` said **"PROJECT M — Frontier colony — co-op"** (the Awakening-Engine tagline, two directions stale) with
  Warrior/Ranger buttons and a "Replay Tutorial" button arming a system DR-051 deleted.
- `Game.unity` was the co-op-Hades expedition game: AT BASE, meta shop, prep loadout, `Tab BUILD`.
- **All four ability sockets in the shipping scene read `Damage=0 Range=0 Cooldown=0`** — the 5 Sparks were in
  `GymSub.unity` and never in `Gameplay.unity`. Melee and dash were the only working verbs in the built game.
- Expedition rooms scattered **47 Synty desert props** (cacti, tumbleweeds) into the seabed murk.
- Enemy variety was **structurally inert** — Charger/Spitter/Swarmer authoring on ZERO prefabs, so ~272 lines of
  Bursted AI, `BossAISystem` and the whole escalation curve could never match a chunk, while 734 lines of green
  tests certified them.

## Three things I got wrong and corrected

Worth recording, because the pattern (verify, don't trust the report) is the point.

1. **"Server runs at 120 Hz"** — my own first measurement. It was a `NetworkTick.SerializedData` validity-bit
   artifact (the field advances by 2 per tick). Real rate: **60.0**. Caught before it reached the report.
2. **"10 test files leak ECS Worlds"** — an agent finding, from counting `.Dispose()` tokens, which misses
   `using (world)`. Measured empirically: `World.All` is 6 before the suite and 6 after. **Refuted.**
3. **"gitea lacks the LFS locking API, so backup completeness is unproven"** — the remote reports locking support;
   `git lfs push --dry-run` returns **0 pending objects**. The 8.3 GB backup is genuinely complete. **Refuted.**

## Remediation — 8 commits, all green

| Batch | What |
|---|---|
| B0 | PAT stripped from `.git/config`; `lfs.allowincompletepush` unset; `*.glb`/`*.gltf`→LFS; deny-list widened to `git restore`/`checkout --`/`stash`; `settings.local.json` cleaned; pushed gitea; **LFS completeness proven** |
| B2+B3 | **~140 files deleted** — run FSM, meta shop, prep, boons, build/structures, storage, inventory/equipment, route/portal, ready-check, enemy variants, boss. Scripts 335→233, Tests 77→47 |
| B4 | 5 Sparks into `Gameplay.unity`; 6 orphaned authoring objects + `RoomDressing` removed; 4 dead prefabs; **Warrior/Ranger → Bathynaut/Harpooner** (93 sites, byte values pinned); menu re-titled LANTERN |
| B1 | Two systems timing INTERPOLATED ghosts on the PREDICTED tick, fixed; **terminal RPC reaper** + 3 regression tests; `Simulate` filter made unconditional |
| B5 | Tuning-invariant tests (knob round-trip, reserved indices, melee coupling); `ProjectM.Authoring` reachable from tests |
| B6 | `EmissiveGloam` DOTS instancing + DepthOnly pass; `EnemyRigTools` revived; 19 dead materials |
| B7 | **Assets 14 GB → 5.5 GB** — BefourStudios (4 reachable files of 8.2 GB), 92 vendor demo scenes, toon-shader pkg, Screenshots out of `Assets/`; MCP package pinned to a SHA |
| B8 | CLAUDE.md truth pass (back under its own budget); DR-053/054; 13 DRs re-statused; Home/Pillars/Systems_Index |

**304/304 EditMode green, 0 compile errors**, `Game.unity` plays with live socket stats and no leaked RPCs.

## Verified live, not inferred

- Ability sockets after the fix: Vortex 8dmg/6range/420cd · Blink 20range/1cd · Hook&Pull 15/25/120 · Light Zone 6/5/480.
- RPC leak reproduced *before* the fix (one `ReadyToggleRequest` in DevSandbox → pending count 0→1 permanently, with
  the exact `MaxRpcAgeFrames` warning), and the reaper proven *after* (planted unconsumed request gone in frames).
- Server 59.6 ticks/s against 60 Hz; the tick-batching warnings are transient at subscene stream, not standing.

## New gotchas banked

- **A socket whose SparkId is missing from the baked `AbilityDatabase` silently reads Damage/Range/Cooldown 0.** No
  error, no warning — the HUD even renders the slot as ready. Every gameplay subscene needs the full Spark set.
- **Netcode's stale-RPC warning `Consume()`s but never destroys, and is `#if UNITY_EDITOR`-gated** — so an unhandled
  RPC is a *permanent entity leak*, and it is worst in a player build where the warning does not exist.
- **`script_apply_edits` multi-line regex anchors do not match reliably**, and its structured router can silently
  truncate a line-range replacement. Single-line anchors are solid; for multi-line spans use `apply_text_edits` with
  `precondition_sha256` and re-read the result. Twice today a "successful" edit left the file half-changed.
- **Removing `com.unity.ai.assistant`/`ai.inference` from the manifest crashed two AssetImportWorkers** (half the AI
  Toolkit stays resolved in `Library/PackageCache`). Restored; not worth it for editor-only tooling.

## Still open — needs the operator

1. **Revoke the PAT** at github.com/settings/tokens. I removed it from the remote URL; revocation is the step that
   actually matters, and only you can do it.
2. **A0 style-proof sign-off** (~20 min in ArtStaging: flicker-cadence, and "this game and no other game").
3. **Phase-1 fun gate** — now actually runnable: the kit works in the shipping scene for the first time.
4. **GitHub mirror** is 235 commits / 8 weeks stale. Before pushing, check that repo's visibility — it tracks
   licensed Synty/Rukhanka content.
5. **Art decisions I deliberately did not make**: `MakeMat`'s per-pack Synty atlas vs the A0 palette keystone; the
   poly budget (Player 10,178 tris vs 6k, Grindylow 4,330 vs 3k); stripping the 16-19 disabled Synty SMRs per
   character prefab. All three change how things look — your call, not a mechanical fix.

**Next:** [[World_Model_Build_Spec]] steps 1-5 (re-anchor first — its step 1 assumes a SaveData version DR-051
already shipped past, and its RegionTag→PocketTag line anchors have moved).

## Related

[[DR-054_Audit_Purge_2026-08]] · [[DR-053_Engine_Fork_Bevy_Parked]] · [[Roadmap_Lantern_Slice]] ·
[[CLAUDE_Build_Gotchas_Archive]]