Files
Project-M/Docs/Vault/07_Sessions/2026/2026-08-07_Audit_Remediation.md
T
kronic c87dd04e87 Docs: truth pass over CLAUDE.md, DRs and the MOCs (audit M13/M14/M15/M16/M19/L11/L12)
CLAUDE.md — it is loaded every session, so its errors cost the most:
- M13: it still said "No world code until the world-model spike passes
  its design review" while DR-049 has been `accepted` since 07-13 and the
  roadmap says PASSED. A hard contradiction between the two authority
  docs, with CLAUDE.md winning by being always-loaded — plausibly part of
  why Phase 2 never started. Now points at the build spec, warns it needs
  re-anchoring, and links the parked engine fork.
- Records the H2 hazard as a rule: a socket whose SparkId is missing from
  the baked AbilityDatabase silently reads Damage/Range/Cooldown 0.
- L12: the asmdef table was stale on all four rows; also notes the fifth
  compilation unit (Scripts/Editor has no asmdef) and that tests now
  reference Authoring.
- M19: per-machine setup — the machine-loss recovery checklist — was
  missing Blender + blendermcp (which the committed /art-dev skill
  hard-requires) and ctx7, and claimed a ${CLAUDE_PROJECT_DIR} in
  .mcp.json that isn't there.
- Structures / harvest / persistence / BefourStudios bullets rewritten:
  they described deleted subsystems.
- Net-zero rule honoured: the additions pushed it to 41,057 (over the
  40,960 hard limit), so two long art-pipeline bullets moved verbatim to
  the gotchas archive under a dated heading. 39,661 now — inside the
  file's own 39,936 soft ceiling.

- M14: DR-053 files the Bevy fork as PARKED. The guide was reachable from
  NOTHING — one file, zero inbound links, and its gating instruction
  lived only in machine-local memory, which CLAUDE.md explicitly forbids
  as a sole home. It now has a committed home and inbound links.
- DR-054 records this purge, including the three files that were in the
  delete set until their consumers were checked and turned out to be
  load-bearing.
- M15: 13 superseded DRs re-statused with `superseded_by`. Only DR-002
  carried the field before, though the project's own template prescribes
  it.
- M19: Home.md stated three wrong facts (latest DR, latest session, date)
  — refreshed. Pillars.md and Systems_Index.md now carry warning banners:
  both assert things the purges falsified, and Systems_Index still claims
  to be "the accurate map of what exists in code today".
- L11: the 4 genuinely-broken wikilinks fixed (typo'd DR filenames). Zero
  broken vault-internal links now.
- Session log written — the last three commits before today had none,
  breaking the protocol's own bookend rule.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-07 13:44:18 -07:00

6.7 KiB

2026-08-07 — Full-stack audit + remediation

The ask (operator): "Do a comprehensive audit of the current state of the project at multiple layers… then produce a concise report… Be unbiased, concise, and above all accurate. Don't make assumptions if you can verify." Then: "Go through and fix ALL issues… Be complete and thorough."

The audit

8 parallel dimension auditors (code, netcode, tests, docs, process, design, art, infra), each adversarially re-verified by an independent agent — 16 agents, 0 errors — plus my own live Play-mode verification across all three player-facing scenes. 46 findings: 1 critical, 6 high, 20 medium, 19 low. Report + full evidence: scratchpad/AUDIT_2026-08-06.md, published as an artifact.

The headline, found by playing the game rather than reading it: the LANTERN pivot (locked 07-13) had reached the design docs and combat internals and almost nothing a player touches.

  • MainMenu said "PROJECT M — Frontier colony — co-op" (the Awakening-Engine tagline, two directions stale) with Warrior/Ranger buttons and a "Replay Tutorial" button arming a system DR-051 deleted.
  • Game.unity was the co-op-Hades expedition game: AT BASE, meta shop, prep loadout, Tab BUILD.
  • All four ability sockets in the shipping scene read Damage=0 Range=0 Cooldown=0 — the 5 Sparks were in GymSub.unity and never in Gameplay.unity. Melee and dash were the only working verbs in the built game.
  • Expedition rooms scattered 47 Synty desert props (cacti, tumbleweeds) into the seabed murk.
  • Enemy variety was structurally inert — Charger/Spitter/Swarmer authoring on ZERO prefabs, so ~272 lines of Bursted AI, BossAISystem and the whole escalation curve could never match a chunk, while 734 lines of green tests certified them.

Three things I got wrong and corrected

Worth recording, because the pattern (verify, don't trust the report) is the point.

  1. "Server runs at 120 Hz" — my own first measurement. It was a NetworkTick.SerializedData validity-bit artifact (the field advances by 2 per tick). Real rate: 60.0. Caught before it reached the report.
  2. "10 test files leak ECS Worlds" — an agent finding, from counting .Dispose() tokens, which misses using (world). Measured empirically: World.All is 6 before the suite and 6 after. Refuted.
  3. "gitea lacks the LFS locking API, so backup completeness is unproven" — the remote reports locking support; git lfs push --dry-run returns 0 pending objects. The 8.3 GB backup is genuinely complete. Refuted.

Remediation — 8 commits, all green

Batch What
B0 PAT stripped from .git/config; lfs.allowincompletepush unset; *.glb/*.gltf→LFS; deny-list widened to git restore/checkout --/stash; settings.local.json cleaned; pushed gitea; LFS completeness proven
B2+B3 ~140 files deleted — run FSM, meta shop, prep, boons, build/structures, storage, inventory/equipment, route/portal, ready-check, enemy variants, boss. Scripts 335→233, Tests 77→47
B4 5 Sparks into Gameplay.unity; 6 orphaned authoring objects + RoomDressing removed; 4 dead prefabs; Warrior/Ranger → Bathynaut/Harpooner (93 sites, byte values pinned); menu re-titled LANTERN
B1 Two systems timing INTERPOLATED ghosts on the PREDICTED tick, fixed; terminal RPC reaper + 3 regression tests; Simulate filter made unconditional
B5 Tuning-invariant tests (knob round-trip, reserved indices, melee coupling); ProjectM.Authoring reachable from tests
B6 EmissiveGloam DOTS instancing + DepthOnly pass; EnemyRigTools revived; 19 dead materials
B7 Assets 14 GB → 5.5 GB — BefourStudios (4 reachable files of 8.2 GB), 92 vendor demo scenes, toon-shader pkg, Screenshots out of Assets/; MCP package pinned to a SHA
B8 CLAUDE.md truth pass (back under its own budget); DR-053/054; 13 DRs re-statused; Home/Pillars/Systems_Index

304/304 EditMode green, 0 compile errors, Game.unity plays with live socket stats and no leaked RPCs.

Verified live, not inferred

  • Ability sockets after the fix: Vortex 8dmg/6range/420cd · Blink 20range/1cd · Hook&Pull 15/25/120 · Light Zone 6/5/480.
  • RPC leak reproduced before the fix (one ReadyToggleRequest in DevSandbox → pending count 0→1 permanently, with the exact MaxRpcAgeFrames warning), and the reaper proven after (planted unconsumed request gone in frames).
  • Server 59.6 ticks/s against 60 Hz; the tick-batching warnings are transient at subscene stream, not standing.

New gotchas banked

  • A socket whose SparkId is missing from the baked AbilityDatabase silently reads Damage/Range/Cooldown 0. No error, no warning — the HUD even renders the slot as ready. Every gameplay subscene needs the full Spark set.
  • Netcode's stale-RPC warning Consume()s but never destroys, and is #if UNITY_EDITOR-gated — so an unhandled RPC is a permanent entity leak, and it is worst in a player build where the warning does not exist.
  • script_apply_edits multi-line regex anchors do not match reliably, and its structured router can silently truncate a line-range replacement. Single-line anchors are solid; for multi-line spans use apply_text_edits with precondition_sha256 and re-read the result. Twice today a "successful" edit left the file half-changed.
  • Removing com.unity.ai.assistant/ai.inference from the manifest crashed two AssetImportWorkers (half the AI Toolkit stays resolved in Library/PackageCache). Restored; not worth it for editor-only tooling.

Still open — needs the operator

  1. Revoke the PAT at github.com/settings/tokens. I removed it from the remote URL; revocation is the step that actually matters, and only you can do it.
  2. A0 style-proof sign-off (~20 min in ArtStaging: flicker-cadence, and "this game and no other game").
  3. Phase-1 fun gate — now actually runnable: the kit works in the shipping scene for the first time.
  4. GitHub mirror is 235 commits / 8 weeks stale. Before pushing, check that repo's visibility — it tracks licensed Synty/Rukhanka content.
  5. Art decisions I deliberately did not make: MakeMat's per-pack Synty atlas vs the A0 palette keystone; the poly budget (Player 10,178 tris vs 6k, Grindylow 4,330 vs 3k); stripping the 16-19 disabled Synty SMRs per character prefab. All three change how things look — your call, not a mechanical fix.

Next: World_Model_Build_Spec steps 1-5 (re-anchor first — its step 1 assumes a SaveData version DR-051 already shipped past, and its RegionTag→PocketTag line anchors have moved).

DR-054_Audit_Purge_2026-08 · DR-053_Engine_Fork_Bevy_Parked · Roadmap_Lantern_Slice · CLAUDE_Build_Gotchas_Archive