The GrantPermissionsActivity pops up during navigation and blocks the
app's event loop, preventing hub responses. Pre-grant all runtime
permissions after APK install to avoid this.
PID 28203 (rs.robius.robrix) was the actual zombie reclaiming foreground
and killing our test app - not our own package. Force-stop both the
target package and known interfering Makepad apps (Robrix) during test
setup to prevent cross-app foreground competition.
Also remove the pm disable-user approach as it doesn't help against
a different package's zombie process.
Samsung devices keep killed app processes alive and bring them back to
the foreground ~15s later, killing our fresh test instance. force-stop
and kill -9 don't prevent this. pm disable-user fully prevents the
zombie from being restarted. Re-enable before launching the new instance.
Adds the Android test runtime to makepad_test: builds the APK with
cargo-makepad's standard Java path, installs and launches via adb with
makepad.STUDIO_* intent extras (incl. STUDIO_BUILD), connects the app to an
in-process hub over adb reverse, and waits for startup + responsiveness.
Adds clean in-process hub shutdown (HttpServerHandle + GatewayHandle Drop)
and the STUDIO_BUILD intent parsing on the app side. No native-activity or
NDK APK compilation code is included.
Two knobs, both defaulting to exactly what happens today.
MAKEPAD_TEST_PARALLEL opts out of the global TEST_MUTEX. Every test
currently takes that lock for its whole body, so `--test-threads=N` has no
effect at all and there is nothing in the API that says so. Serial is the
right default — each test drives a whole app process, and oversubscribing
the machine makes timing-sensitive assertions flaky — but it should be the
suite's call.
MAKEPAD_TEST_PUMP_TICKS sets how many Ticks are forwarded before each
query. Each one costs the app a full rendered frame whenever anything is
dirty, so the hardcoded 3 is a 3x multiplier on the cost of every
`widget_snapshot()`, which is the single most common thing a test does.
Reporting the measurements honestly, from a 55-test suite downstream:
- Parallel at 4-way took it from 67 min to 11-20 min, but 2-3 tests failed
per run and the SET changed between runs — load-induced, not specific
tests. Useful for local iteration, not something to turn on by default,
which is why it is opt-in and documented as such rather than flipped.
- PUMP_TICKS=1 measured 1.47x on a fixed 10-test slice with no failures,
but broke one drag-and-drop test elsewhere in a way I could not explain,
so treat it as a tuning knob to try rather than a free win.
The flakiness above is a property of tests that wait by counting polls: how
much wall clock and how many frames a poll buys both change under load. That
is worth fixing in the tests, not by keeping the lock.
* Android: silence unused VA/OpenXR warnings
Exclude desktop-only va_dmabuf_modifier from Android/OHOS builds, cfg-gate
gpu_texture pool imports, and fix OpenXR repaint locals unused without Vulkan.
* Move D3D11 texture COM calls into os/windows helpers for windows_strip
* regenerate windows-rs by windows-strip
* Windows: use overlapped custom chrome with extended client area
* Windows: fix overlapped chrome init sizing and avoid DWM work on every NCCALCSIZE
---------
Co-authored-by: jasonqiu <jasonqiuchen@outlook.com>
* fix a pile of splash script-vm bugs: newline statements, short-circuit args, tail calls
went through the script VM and parser and fixed a batch of correctness bugs
that were biting the launcher's mini-apps:
- newline-delimited statements: a `(` or `[` at the start of the next line no
longer greedily glues onto the previous value as a call/index. leading infix
operators and `.` still continue the expression (the shader DSL needs that),
and the divert is suppressed inside ()/[] groupings.
- short-circuit `&&`/`||` used as a call argument no longer loses its value to
nil when the jump skips a multi-op right-hand side.
- a call as the very last statement of a script actually executes now, in both
end-of-parse unwind loops (also patched a zero-offset ShortCircuitEnd).
- custom widgets that deref to a base with a #[source] field now forward
script_source, so script_apply_eval works on them instead of silently no-op'ing.
plus regression tests for the newline and short-circuit cases.
* harden splash isolates: scoped timers, net gating, effective-visibility snapshots
isolate-safety work so mini-apps can't reach outside their sandbox:
- isolate-safe script-timer dispatch hook + gc for stale timers
- gate net.socket_stream on the net runtime being present
- widget-tree snapshot reports effective visibility (a widget counts as hidden
if any ancestor is hidden)
- macos_activate_app (plus a headless no-op) so the launcher can focus itself
* widen the host->splash surface: splash setters, view/glassbutton script calls
everything the host needs to poke into a running mini-app's script:
- Splash: call_script_fn, set_script_global, set_allow_net, and a cached body id
so host->script calls don't rescan for the body every time
- View.set_visible and GlassButton set_text/text are callable from script now
- makepad_test learned right-click (secondary button) so the headless tests can
exercise long-press / context menus
* fix small-size glass lens + sdf box degeneration, warn on missing glyphs
visual correctness fixes we kept tripping over:
- cap the gauss lens band at 35% of the surface's smaller side so tiny discs
degrade gracefully instead of smearing
- clamp the Sdf2d.box (and box_x/box_y/box_all) radius so an oversized radius
saturates at a circle instead of collapsing into a rotated diamond
- log once per codepoint when no loaded font can render it (was silently
drawing .notdef boxes)
* guard stale rect areas in clipped_rect/abs_to_rel/set_rect against out-of-bounds panics
* add switch_finger_capture to hand a live finger capture between widgets mid-drag
* add promote_finger_capture_over: hand a child-grabbed finger up to a co-capturing container
* splash: add validate_splash_body, a dry-run eval for externally-sourced scripts
evaluates a body in a throwaway isolate with the exact prefix/limits the
Splash widget uses and returns the captured script errors instead of logging
them. lets hosts that install source from outside (downloads, AI generation,
user input) reject bad scripts with real errors to show or feed back, where
the widget's own eval silently keeps the old view.
* strip mod.res from splash isolates; document validate_splash_body caveats
the res module's handles reach both the filesystem (abs_path loads) and the
network (web_url / http resources) without going through the gated net
runtime, so a 'no-net' isolate could still fetch and exfiltrate. found by an
adversarial review of AI-generated app installs, but it applies to any
untrusted splash source.
also note on validate_splash_body that the instruction limit bounds compute,
not heap growth, and that top-level timers live until isolate reclamation --
same exposure as actually installing the source, so validation adds nothing
new.
* splash: jailed per-app file storage (mod.fs inside isolates)
mini-apps get an OS-style private data directory, like an android app's
internal storage or an iOS container: the app sees a filesystem rooted at
"/", and that root IS its host-assigned sandbox directory
(Splash::set_sandbox_dir / SplashRef forwarder). registered as mod.fs in
isolates -- deliberately shadowing the stripped real fs module, so inside
an app "the filesystem" simply is the jail:
fs.read fs.write fs.append fs.exists fs.remove fs.mkdir fs.list
containment lives entirely in the host layer:
- lexical path resolution against the root; `..` above the root, NUL, deep
or overlong paths are errors before any I/O
- the per-VM root is rust state keyed by the isolate's heap -- script code
can neither read nor retarget it
- symlink defense in depth: nothing here can create links, and every
existing component under the root is verified non-symlink before use
- quotas: 1MB/file, 16MB/jail, 256 entries
- no root assigned (previews) -> every call errors cleanly
validate_splash_body gives dry runs a throwaway jail (temp dir, removed
after) so top-level fs.read boot loads validate instead of erroring. roots
are dropped with their isolates in the gc.
unit tests cover the containment: traversal/absolute/backslash escapes,
depth/name caps, and the symlink block.
* splash: put the jailed fs module in scope as a bare name
app scripts say fs.read("/x"), but the eval prefix only used the widgets
prelude, so bare fs resolved to a not-found error value and every storage
call failed silently. bind it in the prefix (let fs = mod.fs) for both the
plain and net variants; a script reassigning fs only shadows its own name,
the jail stays host-side.
* splash storage: quota + boundary hardening from adversarial review
three confirmed jail findings:
- mkdir bypassed every quota (target + create_dir_all, no jail_usage check)
-> unbounded inode/dir-metadata exhaustion on the shared host volume.
now charges new dirs against MAX_ENTRIES via missing_entries(); write's
entry check does the same so a deep write can't overshoot the cap either.
- write/append/mkdir lacked remove's root guard: fs.write("/", data)
resolved real == root and reached create_dir_all(root.parent()) -- one
dir above the jail (the shared app_data/). now rejected like remove does.
- validate_splash_body's scratch jail used a predictable temp name created
with create_dir_all (would follow a planted symlink out of temp). now an
exclusive create_dir on a per-process+vm name (EEXIST-safe against a
planted entry), reclaimed via gc before the dir is removed so a top-level
timer can't resurrect it.
unit tests added for missing_entries; the containment tests still pass.
* splash: empty set_text tears down the isolate instead of no-oping
set_text("") was a silent no-op (eval_body early-returns on an empty body),
so a reused Splash that goes back to empty -- the widget-gallery live preview
on Back -- left its old isolate running its timers (and holding a storage-jail
binding) behind a blank view. now an empty body reclaims the isolate: the
isolate-minted view is replaced with a fresh empty one built in the main vm
BEFORE the isolate heap is freed, then the isolate is gc'd (stopping its
timers, dropping its jail root); vm_id resets to MAIN so a later non-empty
set_text allocs a fresh isolate as before. the existing host_launcher
teardown call sites (widget picker back()/reset()) become correct unchanged.
* overlay: composite glass in draw order, not creation order
every gauss/glass surface opens its own draw list and registers it in the
window's single Overlay via store_sub_list, which hands out the first free
slot and keeps it for the life of the process. renderers walk that table in
index order, so the paint order of all glass in an app was the order the
surfaces were first *created* — permanently, with freed slots reused by
whatever registered next. draw order never came into it, so a widget rebuilt
after a layout change, or a panel opened later, could land on top of anything
drawn after it. the only workarounds available to apps were "don't draw the
thing that's winning", which looks like a bug.
the hook for fixing it was already there and unused: CxDrawList's
draw_item_reorder, honoured by every backend (metal, d3d11, opengl, vulkan,
web_gl, headless raster). so stamp each overlay sub-list with the position it
was begun in this frame (Cx2d::overlay_seq, reset in Overlay::begin) and have
Overlay::end stable-sort the table by that stamp.
this also gets parent-then-child right without special cases, which matters
because glass.GlassButton / glass.GlassSegmented call begin_overlay_reuse
unconditionally instead of checking is_drawing_overlay(), so they hold their
own slots rather than riding their parent's.
* glass.GlassSegmented: size segments to their labels, add set_selected
three things, all of them things that looked broken to a user:
- segments were width/count, so "Max" got the same room as "Default": the long
word crowded, the short one floated. each segment is now measured (DrawText
layout size_in_lpxs) and gets its text plus padding, with leftover width
shared equally so every label keeps the same margin. if the labels don't fit,
the padding shrinks (never the text) to a floor. the pill's x/width are
computed in rust and passed as uniforms since they can't come from a segment
count any more, and hit-testing is a boundary lookup rather than a division.
- `selected` was public but the pill is drawn from a private sel_pos that only
followed it via the click animation, so restoring a saved value from code
left the control showing one segment while reporting another — and a click on
the segment it really held was then ignored as "already selected". that reads
as the control eating your clicks. set_selected keeps both in step.
- the travel easing was 0.30, which arrived before the eye could follow it.
0.16.
* text_input: re-layout when max_lines changes
the laidout text was cached on width alone, so flipping draw_text.max_lines
at runtime (collapsing a composer to one line) kept the old multi-row layout
and the field never shrank. make max_lines part of the cache key.
* text_input: add set_max_lines instead of making callers script it
applying script to a TextInput re-applies its #[live] fields, and text is
one of them, so toggling max_lines through script_apply_eval! silently
wiped whatever the user had typed. give it a typed setter.
* text_input: don't drop the layout in set_max_lines
clearing laidout_text there leaves the field with no layout for the rest
of the event batch, so every cursor op in that window bails out with
"can't move cursor because layout was invalidated by an earlier event".
since set_max_lines gets called from focus/blur handling, that window is
exactly when you're clicking into the field — so the click placed no
caret at all. max_lines is already part of the layout cache key, so the
next draw re-lays out on its own.
* text_input: add scroll_to_top
for a field that folds to a fixed height when it loses focus: the scroll
offset survives the blur, so a draft last edited near its end folds
showing whichever line the caret had scrolled to rather than its first.
leaves laidout_text alone — scrolling doesn't change the layout, and
dropping it would break every cursor op for the rest of the event batch,
same trap as set_max_lines.
* text_input: add set_height
for a composer that folds to one line when it loses focus. pinning the
height is the safe way to fold — unlike clamping max_lines it leaves the
laid-out text alone, and the laid-out text is what maps a click to a
caret position. fold by re-layout and the press that re-focuses the
field resolves against the folded layout while the expanded one is on
screen, so the caret and any drag-selection land on the wrong text.
* text_input: add take_key_focus, which actually shows the caret
the caret draws as (1.0 - blink) * focus, and both come from animators
that only move when the widget is dealt a Hit::KeyFocus. setting key
focus on a field that ALREADY holds it dispatches no hit — so a field
that was focused, then hidden (hiding doesn't clear Cx's key focus) and
shown again comes back typable but with no caret and no selection
highlight, animators still parked where the last focus-lost left them.
plays focus.on unconditionally rather than only when focus changed:
repairing the case where it did NOT change is the entire point.
* splash: name scripts in errors, and stop using line as an identity slot
a runtime error from a Splash app logged `:1804943384:12 - widget has
no uid`: empty file, and a "line" that is really a pointer address.
the format is {file}:{line}:{col}, and both fields were casualties of
the same hack — ScriptMod.line carried self_id so the body could be
found again (m.line == self_id && m.file.is_empty()), while ip_to_loc
adds that same field to the script's real line when reporting. so every
location came out as real_line + a pointer, and nothing said WHICH app.
identity moves to module_path, which nothing else reads for these
bodies, freeing line to be a line. file gets a real name via a new
set_debug_name the host calls with the mini-app's id.
the validator's ScriptMod gets the same treatment — its errors are
shown to the user AND fed back to the agent as repair input, so a
location offset by a vm id was actively misleading there.
* splash: document the constant offset in reported script lines
the host prefix is two lines, so a reported line is two ahead of the
app's own file. it can't be zero — a zero-line prefix would share line 1
with the app's first line, and that line is always the // name: header,
which would comment the prefix out.
* script: stop silently losing widgets emitted from branches and loops
Splash mini-apps kept rendering nothing from on_render closures with zero
errors logged. Bisected live and in pure-VM probes, this was a pile of
separate bugs in the same corner:
- an if/else whose branch emits a widget lost the taken true branch: the
statement's POP_TO_ME got fused onto the else tail, which the IF_ELSE
jump skips. Generalized last_short_circuit_target into last_jump_target
and record every branch join (if/elif/else, match, try/err), so the
commit lands standalone AT the join and every path runs it. Same disease
as the short-circuit-argument bug, new jump sites.
- elif never patched its arm's IF_ELSE jump (relative 0), so a taken arm
spun the interpreter until the instruction limit killed the whole entry.
elif now desugars into else { if ... } via IfElseExpr, which also gives
its arms the join treatment.
- for x in <non-iterable> silently skipped the body where the equivalent
while errored; now raises "for loop source is not iterable" (nil and
empty sources stay silent). for k v in <number> passed key/index swapped
and lost k after the first iteration (the advance only rebound v).
- a line-leading { after a value-ending line glued onto the previous
expression as a proto instantiation; it now starts a new statement,
same divert rule the ( and [ newline fix added.
- int literals were second-class numbers: U40/I32/F32/F16/U32 didn't
collapse to the number bucket in to_redux, so 6 .is_number() missed
method dispatch entirely and an int arg against a float default failed
with "expected number, got number". They're all just numbers now.
Regression tests in tests/on_render_emission.rs cover each shape, incl.
the exact calendar/weather patterns that were blank in the launcher.
* splash: keep an on_render closure's final widget, and say when a render fails
Two host-side halves of the emission-loss story:
- the parser turns a closure's last statement into its return value, so a
render closure that ENDS with a widget literal built it and then threw it
away (this is why wrapping a whole render in one extra View{} produced
nothing). script_result now pushes a returned widget object into me as
the last child; non-widget returns still get skipped downstream.
- a render closure that errors mid-run used to have its output discarded
with no diagnostics at all, which is what made this whole bug family
cost days to find. Now it logs the error before dropping the result.
* script: auto-close still-open fn and let states at end of source
Both parse drivers dropped EndFnExpr/EndFnBlock/EmitLetDyn through their
auto-close catch-all when the source ended with them still open. A module
whose FINAL statement was let c = <lambda> got a body whose jump-over
stayed 0 — FN_BODY_DYN re-ran, found its me already popped, logged
"me stack is empty" and fell straight INTO the body, running it inline
at definition time and ending the module eval early — and the let itself
never emitted, so the binding silently didn't exist (same for
let c = <call>). Now those states close the way the live handlers do:
return + jump patch for the body, LET_DYN/LET_TYPED for the binding, and
the let's own EndStmt no longer marks a statement value (LET consumed
it; the final RETURN would pop an empty stack).
Fun consequence: the old test idiom of reading a result via
let out = r
out
only ever worked BECAUSE the trailing let was dropped — RETURN popped
the naked value off the stack. With the let actually binding, scripts
must end on a call (echo(r)); the emission tests are updated to do that.
Regression tests in tests/auto_close_eof.rs, including the exact
deferred-boot-timer closure shape the launcher apps use (which was
already fine — it just LOOKED guilty, see the splash commit).
* splash: probe optional script hooks without spamming the error log
call_script_fn checks whether the fn exists and bails quietly — but it
probed with a trapping scope_value, which had already queued a NotFound
by the time the miss was handled. Every host broadcast of an optional
hook (on_app_resize, on_widget_resize) against a script that doesn't
define it logged
variable 00001e93e419c77c not found in scope
— maximally misleading: the hex is just id!(on_app_resize) (Rust-side
ids aren't in the reverse-lookup table so they print raw), and the
line:col is the stale ip from the end of that script's eval, which
pointed at whatever closure happened to be compiled last. In the
launcher that was the boot-timer line of every generated app, sending
the investigation down a deferred-closure rabbit hole the pure-VM tests
then cleared. Probe with NoTrap.
* script derive: don't name the eval values vec 'v'
script_apply_eval!'s generated values block bound 'let mut v' and then
spliced #(expr) interpolations in verbatim — so a caller interpolating a
variable that happened to be called v got the macro's own half-built Vec
(borrow errors if you were lucky, the wrong value if not). Obscure name
instead.
* headless: don't compile the Apple video path
Upstream's zero-copy video work put CoreVideo/Metal code in
gpu_texture.rs (plus two consumers) behind cfg(target_os = "macos")
alone. Under cfg(headless) the apple backend isn't built at all, so
every one of those symbols — ObjcId, msg_send!, CVPixelBufferRef,
CVMetalTextureCache* — is missing and makepad-platform fails to
compile with 94 errors. That takes the headless harness down with it,
which is what host_launcher's UI tests run on.
Gate the Apple blocks on not(headless) too. Nothing is lost: headless
has no Metal device to import a CVPixelBuffer into, so the whole path
is inapplicable there.
Not caused by the rebase — pristine dev has it: its headless
CxOsTexture is an empty struct while gpu_texture.rs reads .os.texture.
* android oes video zero-copy and gles shader fixes
* regenerate windows-rs by windows-strip
* fix windows video freezes with MF on an MTA worker
* regenerate windows-rs by windows-strip
* MTA MF video, COM notify, YUV texture reuse
* add local video file playback support to video-player example
* NV12 Metal present, seek warm-up gate, YUV full range
* fix Linux GStreamer video: A/V mute, HLS prepare, async teardown
* no-op SelectVideoTrack/SelectAudioTrack on non-Linux backends
* Linux ALSA/Pulse: bigger buffers, fix resample setup, report device rate
* fix some warnings
* Move XInput/DirectInput device discovery off the UI thread
* fix GLSL unpack4u8 for GLES 3.0 (#version 300 es)
* Linux GStreamer: DMA-Buf NV12 OES zero-copy, optional GLMemory path
* Linux MediaPlugin: DMA-Buf NV12 and GLMemory zero-copy present APIs
* Add Windows SourceReader DXGI NV12 zero-copy video path
* fix build error
* fix GLES: add highp precision for sampler2DArray in Linux shaders
* playback speed support for android
---------
Co-authored-by: jasonqiu <jasonqiuchen@outlook.com>
Co-authored-by: jasonqiu <jasonqiu@futunn.com>
Groundwork for the demo becoming a splash TEMPLATE. Two things the script
surface could not express, so the demo had to stay in Rust.
**`game.terrain` carried its own single-octave value noise.** That meant the
terrain an AI could reach from splash was strictly worse than the terrain the
engine could make, and the two drifted independently — every fix to
`libs/game/gen/terrain.rs` (fBm, domain warp, world-unit frequency,
slope-aware colour, rim relief) was invisible to any authored game. It now
calls that generator. One generator, one set of bugs.
New params exposed: `feature` (distance between hills, in world units —
answerable, unlike "what is a good freq"), `octaves`, `warp`, `ridged`,
`flatten`, `rim`/`rim_start`.
Two compatibility decisions worth stating:
- `freq` still works. It meant cycles per CELL INDEX, so its wavelength in
world units is span/((cells-1)*freq); translating rather than ignoring it
keeps an existing world looking like itself.
- `step` now defaults to 0, not 1.0. The old default quantised every smooth
slope into one-unit stairs, so a script asking for smooth terrain got a
contour map. Scripts that want terraces still ask for them.
**`Car` now carries a model**, as `Character` already did, and `game.car`
takes `{model}`. Without it a host could only ever draw ONE kind of car —
which is exactly why the arcade fleet had to live in Rust, and why a
splash-authored world could not have more than a single vehicle shape.
The renderer prefers the car block's own model and falls back to walking the
`parked_car` role, so the same code path serves an authored game and the
built-in demo without the script needing to know the fallback exists.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"They explode too big for the number of particles." Exactly right, and the
mistake was treating star count and break size as two knobs. They are one.
A sphere is filled by rays per steradian, so doubling the radius needs FOUR
times the stars to read equally dense. The previous commit sized the break
honestly — 30-52 m, a real 6in shell — while leaving it at 64 stars, and 64
rays spread over 40 metres is not a flower, it is a handful of unrelated
dots drifting apart.
So: 2560 beads per shell at 8 per trail = 320 stars, up from 64, and the
break pulled in to 17-28 m (a 3in shell) from 30-52. Density is the product
of both changes — five times the rays into a third of the volume.
Beads are also slightly larger (1.25 from 0.9), because a bead 60+ metres
away has to survive being a couple of pixels.
Cost is 92k triangles at the 18-shell peak, which is the honest price of
density and exactly the sort of thing the thermometer exists to cut on a
headset. Still one instance per shell on the CPU.
A test pins SPARKS_PER_SHELL / TRAIL_LEN to the star count the shader
hardcodes. Drift there does not fail loudly — the Fibonacci distribution
just covers the wrong fraction of the sphere and the break stops being
round, which looks like a tuning problem and is not one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"They don't fall this quickly." Correct, and the model was wrong rather than
mistuned: the fall term was 0.5*g*t^2, free-fall, as if each star were a
dropped rock. A star is a few grams of burning composition with a lot of
drag, so it reaches terminal velocity almost immediately and then DRIFTS.
Vertical motion is now quadratic for the first instant and a constant ~7 m/s
descent after — which is the hang every display has and ours did not.
Sized against reality, which our world happens to make easy: one unit is one
metre here (a character is 1.8 tall, houses 6-8). Real stars leave the burst
charge at 50-100 m/s and drag stops them in about a second, so the break
opens to speed/k across. At k = 3.08 the new 48-80 m/s gives a 30-52 m
diameter shell — a 3in to 6in break, what a town display actually fires. It
was 11-17 m before, which is why it read as a firecracker. Bursts moved up to
38-58 m accordingly; a real 3in reaches ~80 m, but ours stay lower so they
sit inside a camera that is pitched down at a street.
Shells are no longer all the same. A third are DUAL-COLOUR breaks, where half
the stars carry the second colour from the start rather than merely cooling
into it — the two-tone shell in every display photo. The split is per star and
stable, so a ray keeps its colour all the way out instead of shimmering. A
sixth are WILLOWS: stars thrown at half speed with a heavier drift, so they
arc over and trail down. The rest are plain peonies.
Style is chosen on the CPU, one float per shell, and applied entirely in the
splash-side `spark_color` — the engine still knows nothing about how any of
this looks.
Also dropped the leading-edge brightening: with uniform star speed there is no
longer a fast outer shell to distinguish, so it was tinting at random.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"Fireworks are streaks of PARTICLES, not a sphere expanded set of rects" —
and the reference photos show it plainly: every ray is beaded, a string of
glowing points strung along the path its star has flown.
So the model changed rather than the tuning. Each star is now a TRAIN of 8
beads, and a bead is simply that star's own closed form evaluated 40ms
earlier. Nothing extra is simulated and nothing extra is uploaded — the
trajectory was always a function of time, so sampling it at t - delay is free.
512 beads per shell is 64 stars with a real trail each.
Beads taper and dim toward the tail, so a ray has a bright head fading back
toward the burst centre, which is the shape every photograph shows.
I had built this as a stretched quad first — elongating the billboard along
the screen projection of the velocity. It is the standard trick and it is
wrong here: it draws one long rect per star, so the rays are smooth bars
rather than beaded, and a rect wide enough to see is also wide enough to look
like a slug. Removed.
The sprite is a round, ANTIALIASED dot. `smoothstep` rather than a linear
ramp, because a hard cutoff shows the rasteriser's stair edge on something
this small and bright, which is exactly where aliasing is most visible. Both
falloff terms reach zero at 0.8 of the half-width — inside the corners as well
as the edges — so the billboard border can never cut the dot. That was why
every spark read as a filled square.
Sound removed entirely, including the synth preset.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"Still a bit too random." It was, and the fix corrects something I took from
the wrong source last time.
Looked up how actual shells are built. Stars are packed EVENLY around the
burst charge and lit at the same instant, so they all leave with the same
force — that even spacing is precisely why a peony reads as round from every
angle. Two changes follow:
- Directions come from a FIBONACCI SPHERE instead of a per-spark hash. The
golden angle steps phi so successive stars never line up, and z steps
linearly so they spread evenly in AREA rather than in latitude (which
bunches them at the poles). Hashed directions give clumps and holes, and no
amount of extra sparks makes that look like anything but noise. A per-shell
rotation keeps two shells from being the same object twice.
- Speed is near-uniform (6% jitter) instead of a 4:1 spread. I took that
spread from the canvas demos last commit — but random(1,10) is a 2D trick
for filling a disc. In 3D, identical stars igniting together travel
together, and the spread just turns the sphere to mush.
The bang was also wrong: 900Hz of broadband noise at 0.34 gain is a shotgun
in a small room. A shell is heard from far away, so it arrives mostly low and
quiet — now a 220->38Hz thump at 0.085, falling away over 1.1s.
Sources: epicfireworks.com "The Art and Science of the Chrysanthemum Firework
Effect", liuyangfireworks.net "Ball Shell vs. Cylinder Shell"
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reported as "too squiggly — real fireworks are more symmetric, they don't
move in big waves". They were right, and the cause was mine: the arcade
style's `spark_motion` added a curl and a jitter, so every spark travelled a
visible wave.
Read how the canvas demos actually do it (CreativeJS, the codepen/thecodeplayer
lineage). The answer is that they apply NO positional noise at all: one
uniform radial angle per spark, then nothing but friction and gravity. All
the shape comes from the SPEED spread, not from moving sparks around. Three
changes follow from that:
- `spark_motion` returns zero. The hook stays, because it is the right seam
for a style that wants to be strange — a spiral shell, a jellyfish — but
the default is symmetric.
- Drag matched to the convention: `speed *= 0.95` every frame at 60fps is
exactly e^(-kt) with k = -60*ln(0.95) = 3.08, replacing a softer constant
I had guessed.
- A 4:1 speed spread instead of 1.8:1. The demos use random(1,10); a narrow
spread leaves a hollow shell with nothing in the middle.
Also reported: too fast and too far. Shells now live 3.2-4.6s (was 1.5-2.4),
throw sparks 17-27 units (was 11-19), and burst in a 25-46 unit annulus (was
out to 68).
The sprite is fully contained inside its quad. Its falloff dies at 0.8 of the
half-width, inside the corners as well as the edges, so the billboard's
straight edge can never cut the glow — which showed as square-clipped sparks.
The old cross-flare ran to the border and was the worst offender, so it is
gone. Colour is emitted unpremultiplied with zero alpha: pure additive light
under premultiplied blending, so sparks add and never occlude.
And they bang now. A shell reports its burst point exactly once, when its age
crosses zero, and the host plays a broadband noise burst there — positioned,
so it pans and attenuates like any other world sound. Noise rather than a
tone because a shell is broadband; a tone reads as a laser.
Sources: creativejs.com/tutorials/creating-fireworks,
thecodeplayer.com/walkthrough/canvas-fireworks-tutorial
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
They work. The bug was structural, not tuning: `DrawGameFirework` derefed
`DrawCube`, which brings ITS instance fields along, so the fields appended
after them sat at offsets the script-side layout never accounted for. Every
instance value read back garbage — the burst rendered at the world origin,
and the spark size ignored whatever Rust wrote, which is why scaling it 25x
changed nothing on screen.
What settled it was making the GPU report what it actually saw: encode the
instance values as colour on a fixed clip-space quad and read them back off
the framebuffer. The decoded numbers CHANGED WHEN THE CAMERA ROTATED.
Instance data cannot depend on the view, so the shader was reading view
memory. That one observation killed every "too big / too bright / too close /
wrong units" theory at once — they were all downstream of data that was never
arriving.
The fix is to follow `DrawGameShadow`, the one shader here that instances
correctly: deref `DrawVars` and declare the uniform buffers, vertex buffer
and varyings explicitly, so the instance fields are the only ones and the
layout is unambiguous. Drawn with `cx.add_instance` per shell, like it.
Tuned from what it looks like in motion: closer (annulus 37-68 units rather
than out to 120) and less sporadic (a shell every 0.2-0.6s, up to 18 alive).
Enabled by default now that it is worth seeing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Encoding the instance values as colour on a fixed clip-space quad and
reading them back off the framebuffer settles what was guesswork:
1. Scaling the spark size 25x in Rust changes nothing on screen.
2. The decoded values CHANGE WHEN THE CAMERA ROTATES.
Instance data cannot depend on the view, so the shader is not reading this
struct at all — the fields are bound at the wrong offset. That rules out
every 'wrong value' theory and points at the DrawVars::as_slice() pointer
trick and what sits at DrawCube's tail. DrawGameSky appends to DrawCube the
same way and works, so the delta between those two is the answer.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CPU launches shells; the GPU animates every spark from a closed form. Once
a shell bursts nothing in the world can influence a spark — it flies from a
known point, at a known time, along a fixed arc — so position is a function
of (spark index, seed, age) and there is no state to step and nothing to
upload per frame. Twelve shells of 320 sparks is 3,840 particles for TWELVE
instances of CPU work, against 3,840 simulation updates and a 3,840-instance
upload for the stepped path.
**The style seam is the point.** Rust owns structure — trajectory, lifetime,
billboarding — and exposes four hooks a splash script overrides by
inheritance: `spark_motion` (swirl, fizzle, drift), `spark_size`,
`spark_color`, and `spark_pixel` (the sprite program). Arcade's own styling
lives in its `script_mod!`, not in Rust: a three-stage temperature burn,
hotter on the fast outer shell than the slow core, with sparse glitter
strobing. A generated game can restyle the sky without being able to reach
the simulation.
Two real bugs fixed on the way:
- **Vec3f instance fields silently misalign.** A `Vec3f` is tightly packed in
Rust but a `vec3` obeys 16-byte alignment in the shader ABI, so the burst
origin read back as zero and every shell rendered at the world origin, on
the ground. The other shaders here get away with `Vec3f` because theirs are
`uniform`, not instance. Everything is packed into `vec4`s now, which is
the shape the hardware wants anyway and removes the class of bug.
- **Eight bare `panic!()`s in the shader backend** now name the backend, the
stage and the IO type, and the commonest case — reading a geometry
attribute from `pixel:` — gets a message saying so and showing the varying
that fixes it. Previously a shader that tripped it aborted with no text at
all, which is not a barrier, it is a wall in the dark.
**Gated off by default.** The spark SIZE instance is not reaching the shader:
scaling it 25x changes nothing on screen, so every spark draws as a
screen-filling blob and the sky whites out. That is the same class as the
Vec3f bug above and I have not found the second instance of it. The launcher,
the trajectory, the placement annulus and the whole hook surface are finished
and tested; this is one plumbing bug from working. ARCADE_FIREWORKS=1 turns
it on to work on it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
**The ramp was a solid cube.** Reported as "i dont seem to be able to walk
the character up the slanted block towards the platform" — and the wedge
had no collision handling anywhere. Movers sweep against static AABBs, so a
`Shape::Wedge` was collided as the box that CONTAINS it: the ramp built to
be walked and driven up presented a vertical wall at its low edge, and you
stopped dead against nothing you could see.
Wedges are now surfaces rather than walls, handled exactly the way terrain
already was — the symmetry is the point, since terrain had solved this
problem years earlier in the same file. They are excluded from the axis
sweeps, and a ramp floor pass sits underneath: walk up where the slope
rises less than CLIMB, blocked where it rises faster. That falls out
correctly at both ends without special-casing either — the gentle slope is
walkable, and the wedge's full-height back face is still a wall, because
there the surface jumps well past CLIMB in one step.
Sampled across the mover's whole footprint, not just its centre, so
standing with half your feet on a ramp stands you on the ramp.
**Conforming statics to terrain now ADDS the ground height instead of
replacing it.** Replacing looks equivalent, because everything is authored
resting on flat ground — right up until something is deliberately in the
air, at which point it flattens every platform, buried base and raised
ledge onto the dirt, and the failure reads as the level's fault rather than
the function's. Adding is a no-op on flat ground and rides the slope
elsewhere. Found by adding a jump course whose heights it ate.
**A crossroads and a side street.** One straight road reads as a corridor;
a junction is the smallest thing that makes a place feel like it has
somewhere else to be. The side street runs out to the yard, so the physics
corner is somewhere you drive TO rather than somewhere that is merely
nearby.
**A jump course**: a static step to read the route from, a platform that
slides across your path, one that rises and falls, and a wide still ledge
that is obviously the end. Gaps are sized against the controller's actual
jump distance rather than eyeballed, and the two movers run on different
periods so they drift in and out of phase instead of presenting the same
crossing every lap. The ramp's high edge is the run-up, which is what turns
two separate toys into one thing to do.
Three tests, one per claim: a character walks up, the back face still
stops them, and standing on the slope reports on_floor (without which the
controller silently refuses to jump). The first version of the walking test
passed for the wrong reason — its world had no ground, so the walker fell
past the ramp and met it from BELOW, where being blocked is correct.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
**A guy with a beard.** The player wears the barbarian, pinned BY NAME
rather than by cast index — the cast is assembled from whatever the asset
library contains, so an index silently becomes a different person the
moment a pack is added, and that failure reads as a cosmetic surprise
rather than a bug.
Kenney was the obvious cheaper choice and it does not work: every character
GLB in both Kenney packs has only root/torso/head/arm/leg parts, and their
colormap is flat colour swatches with no painted faces, so there is no
bearded Kenney character to pick. Verified by rendering the heads rather
than by guessing from filenames.
**The sun is fixed.** It swept a full day every 40 seconds, which looked
lively for about ten seconds and then just cost money: AO and cast shadows
are baked, and the baker rebakes whenever the sun crosses
`sun_rebake_angle`, so nothing on screen ever settled. Now one explicit
direction at 38 degrees elevation — the engine default sits at 54, nearly
overhead, where shadows barely clear their own footprint and nothing reads
as standing on anything. At 38 a shadow runs about 1.3x its caster's
height: long enough to describe the shape and show the ground's slope,
short enough that the village does not vanish into its own shade. The day
cycle survives behind ARCADE_DAYCYCLE, where it belongs until rebaking is
incremental.
**The simulated wheels now sit under the drawn ones.** Reported as the car
"not really following the landscape, wheels not really touching". The
config's track and wheelbase are authored for a generic chassis while the
mesh is scaled from whatever the pack shipped: for the stock truck the
drawn wheels sit 1.30x wider and 1.39x further apart than the simulated
ones, with a 1.33x radius. On flat ground that is invisible, which is
exactly why it survived a flat-ground test measuring a 3e-6 residual — the
model's lowest point still lands on the road. On a slope it is not
invisible: the body pitches and rolls about the SIMULATED contact points,
and a drawn wheel further out swings through a bigger arc, so it lifts off
the ground. Adding terrain is what made it visible.
Fitted from measured bounds at model-load time, the same discipline as
sitting the mesh on measured bounds rather than on the collision box.
I first read "floaty" as suspension bounce and stiffened the springs. That
was the wrong problem; reverted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
**The flat plane is gone.** Terrain existed all along — heightfield collision
via box3d, AO and shadow raymarching against it, a mesh path, a
`game.terrain` verb — and arcade simply spawned a flat slab instead. That is
the fourth capability this week that was built and never called.
Turning it on was not enough, because the generator had faults that a
screenshot explains faster than prose:
- **Single-octave value noise.** Detail at exactly one scale reads as melted
blobs. Now fBm with domain warp, which is the single highest-value knob
here: warping the sample point bends contours into ridges and valleys
instead of round lumps on a visible grid.
- **`step` defaulted to 1.0**, quantising every smooth slope into 1-unit
stairs. The old default renders as a literal contour map. Off by default.
- **Noise was indexed by CELL INDEX, not world position**, so asking for a
finer mesh silently generated a different landscape. Resolution should buy
detail, never a new world.
- **Colour came from height alone**, which paints terrain in horizontal
stripes like a contour map. Now height AND slope, so rock lands on cliff
faces and grass on the shelf above them.
Generation moved to `libs/game/gen/terrain.rs` as a pure function. Beyond
testability that was forced: arcade's demo world has no script VM, so the
only generator in the tree was one it could not reach.
`rim_relief` is the load-bearing idea. Terrain interesting everywhere is
terrain you cannot put a town on; terrain flat enough to build on is a green
table. Growing the relief outward gives a playable basin ringed by something
worth looking at, and doubles as a soft boundary. It SCALES the noise rather
than adding a radial ramp — the ramp version has no noise in it and renders
as a smooth machined ring between two flat plains, which I built first and
threw away after looking at it.
Two things the tests taught me rather than confirmed:
- Normalising fBm by the sum of octave amplitudes — the textbook form — makes
five octaves come out FLATTER than one, because summing decorrelated fields
concentrates them about the mean. Normalising against the field's own
extents makes `amp` mean literal relief at any octave count.
- The octave test measures CURVATURE, not slope. At gain 0.5 / lacunarity 2
every octave contributes equally to slope — that is what self-similar
means — so a slope-based test reports no difference while the terrain
visibly gains detail. My first version of that test was wrong, not the code.
Statics get one conform pass after composition; movers already clamp to the
terrain every tick in `step.rs`, so the player, villagers and car find the
ground themselves.
**Cars now touch the road.** Kenney authors vehicles origin-at-the-contact-
patch — tyres exactly on y=0, with each wheel node lifted by its own radius —
and every vehicle in every kit measures min.y == 0, verified across all 4442
GLBs in the library. We were dropping the model by `half.y` instead, a rule
that is right for a walker (a Mover's box bottom really is its feet) and
wrong for a raycast vehicle, whose suspension probes from the chassis origin.
The float was suspension travel plus wheel radius, 0.341 units, predicted in
closed form and matched by simulation to 1e-5. The same line also shifted in
world Y after rotation, so the mesh slid out from under a leaning chassis.
Both now derive from measured bounds along the body's own down axis — no
constant anywhere. Note the convention is real but NOT universal: track and
road pieces go to min.y = -1.0, so it must be read, never assumed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- win32: do_callback queues re-entrant events (WM_DPICHANGED pumped inside
Present, nested WM_SIZE) instead of dropping them; the drops left dpi/geometry
stale, the window blank, and hit-testing offset after display-scale changes.
- win32: WM_DPICHANGED applies the OS-suggested rect and returns 0; removed the
duplicate-delivery compensations the lossless queue obsoletes.
- d3d11: no unbounded Present(1) block after a timed-out frame-latency wait
(DO_NOT_WAIT + paced retry); DXGI errors log instead of panicking.
- dnd: Drag/Drop events carry WindowId and are remapped via dpi_override_scale,
fixing drop-zone offset under UI zoom (Windows OLE, macOS external drops,
Wayland internal drags).
- win32: packaged-build window icons load at native shell sizes via LoadImageW.
**The HUD was never drawn.** `libs/game/render::hud` has existed and
gamemaker has called it all along; arcade simply never did. So the
interact prompt was computed every tick, published to `world.hud_slots`,
and thrown away — the get-in-a-car mechanic was discoverable only by
guessing the key. Same shape as the gamepad never being polled: the
capability was there and the app never called it.
Two things found while wiring it:
- The prompt asked for `size: 1.0`, which reads like a scale but is an
absolute point size to the renderer — any value above zero is taken
literally. It would have drawn a one-point speck. Now 17.0, deliberately
above the 12.0 default, since this is the one line a player has to
notice without being told to look.
- Added a standing controls hint. Nobody sits a child down with a manual,
and the affordance prompt only appears once you are already next to
something; this is what tells you how to get there.
**Arcade could not build headless.** The gamepad poll was added without
the `cfg(headless)` split gamemaker uses, and arcade had no `build.rs` to
define the cfg at all, so `MAKEPAD=headless` failed to compile and the
render-to-PNG path went with it.
**The walking camera sat too close** — at 6.5m the character filled a
fifth of the frame and hid the world behind them. Now 9.0m.
That broke a test asserting `car.distance > on_foot * 1.5`, and the fix
is the test, not the number. That ratio read like a decision but was
really the quotient of two values that happened to be current, so
correcting the walking boom on its own merits broke an assertion about
driving while nothing about driving had changed. Restated as a margin:
what has to hold is that getting into a car visibly widens the view, and
several metres does that at any walking distance.
Also logs gamepad connect/disconnect on change, so "the pad does nothing"
is answerable from a release log — either the app never saw the device or
it saw it and the mapping is at fault.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A game gets a walkable character that can get into a car and drive it
in three lines and never mentions a camera:
let id = Character::new(...);
player_rigs.insert(PlayerId(0), PlayerRig::new(id));
Everything crafted is engine-side with defaults nothing has to specify:
coyote time, jump buffering, variable jump height, asymmetric accel and
decel, air control, landing recovery, a boom that snaps in and eases
out, look-ahead, speed pullback, and delayed recentring.
Script surface grows by three verbs (115 -> 118): game.player_character,
game.interactable, game.interact_prompt. Cars and doors-with-interiors
are derived affordances, so a generated game with a car and a house
declares nothing; game.interactable is only for chests and switches.
The prompt and the press share one search so they cannot disagree, and
it picks the nearest candidate in front rather than merely the nearest.
Four bugs found by looking at what ran, not by reading:
- Arcade never polled the gamepad at all. No game_input_states() call
existed anywhere in the app, so the pad's state never entered the
process and every binding downstream read a struct nobody filled.
- LT drove both brake and negative throttle, and brake force opposes
reverse motion. Measured: clean reverse covers 13.8m in 2s against
22.25m forward; with brake held, 0.63m. car.rs is unchanged -- a foot
on the brake winning is a car behaving like a car.
- Mount cleared `hidden`, which means "solid to everything, drawn by
nothing" -- so boarding left the driver as an invisible collider at
the kerb. Now uses attached_to, the sim's seat pin, and saves and
restores hidden rather than asserting a value.
- GameWorld::new() never set gravity; only reset_content() did. All 70
new() call sites floated, and four files had each independently grown
their own `world.gravity = 30.0`. A floating character never reports
on_floor, so the controller silently refused to jump.
The in-vehicle boom goes 9.0 -> 13.0. The boom is a time budget, not a
length: at the car's top speed 9m was 0.37s of road ahead, too little to
plan a turn. The test states it against CarConfig::top_speed, so raising
the car's speed fails the test instead of quietly making the view tight
again. The pivot deliberately does not rise with it -- eye.y is
pivot.y + sin(pitch)*boom, so the longer boom already buys the height,
and driving should sit lower and more planted than walking.
Player rigs now survive Blocks::clear(): where you are sitting and where
you are looking are the player's state, not the game's content, so a
script edit no longer ejects the driver mid-corner.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
THE LEAD I GAVE WAS WRONG, AND THE REAL BUG WAS BIGGER. DrawGameSkinned was
never mis-set — `git show HEAD:...shaders.rs` confirms it has always culled.
The defect was DrawGameCube: it inherits `..mod.draw.DrawCube`, which never
declares culling, so it silently took the PLATFORM-WIDE DEFAULT OF FALSE
(platform/src/draw_shader.rs:41). That is the shader drawing every slab, crate,
ground plane, primitive and rigid body — most of the screen — and all of it was
rasterising its hidden back faces. The trap is that the default is OFF, so not
mentioning culling means two-sided.
Verified safe BEFORE enabling rather than after: geometry.rs already asserted
outward winding against an interior point for every shape, and the measured win
over the real geometry is EXACTLY 50.0% of cube-path triangles back-facing, per
shape, averaged over 2000 view directions. The precision of that number is
itself the winding proof — one flipped triangle anywhere would have skewed it
off 50. A Quest pays this twice, once per eye.
Three shaders stay two-sided ON PURPOSE and now record why at the declaration,
which matters because DrawGameAlpha inherits `true` from DrawGameCube now, so
its `false` became load-bearing rather than incidental: the sky is a cube the
camera sits INSIDE, so every visible face is a back face and culling erases it
entirely; foliage is two-sided cards; the alpha batch carries flat blob shadows
and water where culling changes the composite. A test reads the shader source
and asserts all six choices, so a future audit that flips one must change the
stated intent too.
THERMOMETER (thermometer.rs): p90 over a 120-frame window, never a mean — that
is what makes "hiccups ignored" true rather than aspirational, and two tests pin
it (a single hiccup and scattered hiccups both never cut). Budget from refresh
at 80% (13.9 ms on a 72 Hz Quest, 8.3 ms at 120 Hz). Cuts after 2 bad
evaluations, restores only after 30 good ones with real headroom: degrade
quickly, recover reluctantly, never flap.
The safety property is enforced BY THE TYPE, not by care: Quality's six fields
cannot remove a collider, NPC, player, interactable or HUD element. Cutting is
structurally incapable of changing what the game IS — which is also what lets a
Quest run three levels leaner than the PC beside it while both stay in lockstep.
Opt-in: dormant until a host calls report_frame_ms, and a test asserts level 0
is a bit-for-bit no-op, so linking it cannot change how the game looks on a
machine that never had a problem.
One trap documented at the API: do NOT feed it a vsync-locked frame interval.
That signal is quantised to the refresh rate — it reads ~16.6 ms whether the
frame took 3 ms or 16 ms of real work — and would make a governor targeting 80%
cut forever without ever seeing improvement. Better uncalled than fed a
quantised number.
Three Quality dials (decor_distance_scale, foliage_scale, draw_distance_scale)
are inert until the world-build side can say which props are decoration and
which are structure. Exposed via quality() for whoever picks that up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A game gets walking, jumping, a follow camera, mounting and dismounting without
ever touching a camera itself:
blocks.player_rigs.insert(PlayerId::LOCAL, PlayerRig::new(character_id));
blocks.tick_player_rigs(&mut world, &raw_inputs);
blocks.pre_step(&mut world);
rig.apply_camera(&mut world);
PlayerRig::tick fills BOTH the walking and driving fields of DriveInput every
tick, so changing seat needs no second code path — whichever block is listening
reads its own fields.
The character craft already existed in character.rs and passed; what was missing
was anything consuming it. The camera side is CameraConfig::on_foot (rotates
faster than it translates, so position lag reads as weight while aim stays
crisp; no recentring — the player aims it and it stays) and ::in_vehicle (lower,
35% speed pullback, recentring after a 0.9s delay so it yields to your hand and
only takes over once you let go). Mounting blends with smoothstep.
FOUR REAL BUGS, three of which no existing test could have caught:
- The camera blend never interpolated: `blend / blend.max(0.0001)` is always
1.0, so the rig held its old shape for the whole transition and snapped at the
end — precisely the cut the blend exists to prevent. It needed the blend's
ORIGINAL length, not the remainder
- The blend timer froze when its subject vanished, because tick bailed on the
entity lookup before advancing time. A car despawning mid-blend would have
frozen the camera permanently
- **heading_to_right returned LEFT** — the exact negation of forward x up. Its
doc said "+X" and its test asserted `r.x < -0.99 || r.x > 0.99`, which accepts
BOTH SIGNS and so could never fail. A test that cannot fail is worse than no
test, because it is counted as coverage
- The renderer and the sim use opposite yaw AND pitch signs. Derived by matching
the two eye-position expressions component-wise rather than guessing; the
conversion now lives in heading.rs as heading_to_camera_yaw/pitch — ONE named
boundary, never a negation at a call site. That discipline is why heading.rs
exists, and this is the same bug class that produced the reversed steering
Two changes from peer review: DriveInput.run is f32 so stick deflection gives a
real walk-to-run continuum instead of snapping at a threshold; and pre_step
gained a modality gate, because a player owning both a character and a car was
driving AND walking simultaneously — the stick steering your car was also
walking the body you left in the seat, invisible until you got out somewhere you
had never been.
108 tests across sim and blocks (from 88), including the full walk-in-drive-out
journey, analog deflection landing within 10% of the true midpoint, a reload
keeping you seated with the camera where it was, a vanished car putting you back
on your feet with working controls, and the affordance prompt agreeing with the
button at every distance on the approach.
Known gaps, reported not hidden: dismount picks a side but doesn't check the
GROUND there (spot_clear tests overlap, not floor), recentring uses velocity
heading so slow reversing can hunt, and PlayerRig assumes one local player
because world.cam_yaw is a single device field — split-screen needs a per-player
write path that doesn't exist yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Character feel went into character.rs rather than a fork — its own doc comment
argues a second controller would drift, and it was right. Acceleration and
deceleration ramps, deliberately ASYMMETRIC (starts have weight, stops are
crisp), partial air control, coyote time, jump buffering, variable jump height,
asymmetric gravity via the sim's own gravity_scale, landing damp.
New controller.rs: FollowCamera with separate position and rotation smoothing,
clamped pitch, a boom that snaps IN but eases OUT, look-ahead, speed pullback,
and delayed recentring that yields to the player's hand. Mount/Seat with camera
blending. movement_intent with deadzone and diagonal normalisation, so
diagonal WASD can't outrun cardinal.
ELEVEN FEEL TESTS, each named for the complaint it prevents: speed ramps
monotonically rather than stepping; stopping is crisper than starting; a late
jump off a ledge still registers; a jump pressed before touchdown fires on
landing; releasing early measurably lowers the apex; falling takes fewer ticks
than rising; air control is neither zero nor total; the camera cannot invert or
bury itself; dismounting puts you BESIDE the car, not inside it; the boom
recovers gradually rather than popping.
Two bugs it found in its own work, both invisible to endpoint-only tests:
- Variable-height jump broke an existing test: callers who set jump_pressed but
never hold `jump` — the older single-flag convention, and what a generated
game will most likely write — had their jump cut on the next tick. Now cutting
requires evidence the button is genuinely held; full height for everyone else
- THE CAMERA BLEND NEVER ADVANCED. `blend / blend.max(eps)` is always 1.0, so t
was pinned at 0: the rig held its old shape and then snapped — precisely the
cut the blend exists to prevent. Tracked against blend_total with smoothstep
Four of its own tests were wrong before the code was: air control limits the
RATE, so enough air time still reaches full speed (the real claim is that the
same input builds speed slower airborne); the buffer window genuinely cannot
survive a long fall; two needed the character settled on the ground first.
NOT DONE, deliberately: the controller is not yet exposed as verbs
(game.player_character({})) and arcade still uses its own camera and WASD path.
The prefab and its defaults exist and are tested; binding is the remaining step,
and stopping beat half-wiring input routing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
INTERIORS ARE POCKETS, NOT IN-PLACE ROOMS — a generated room lives at its own
origin elsewhere in the same GameWorld, and a door is a portal to it.
Rejected building the room under the house shell for three reasons. The roof is
the blocker: a third-person camera outside sees the shell, so a character who
walks in vanishes under it, and fixing that needs roof cutaway or per-object
culling — a real renderer feature, not a detail. Kenney footprints are only a
few units across, so an in-place room is whatever the walls leave over, while a
pocket can be bigger inside than out. And a pocket introduces NO NEW CONCEPTS:
it is coordinates in the same world, so host-authoritative replication,
determinism and eval rollback are unchanged, and two players in two different
houses are just two players standing far apart. That last was a hard
requirement and it falls out for free.
DOOR ALIGNMENT is a parameter, deliberately: libs/game/gen must not depend on
libs/game/render, or layout generation would require a GPU. door_side_from_
colliders() takes the boxes as plain data, walks each edge just inside the
footprint, and picks the side with the longest run no box covers — that is the
doorway. Inside the generator the door cell is FORCED via a role-filtered fit,
because a door and a wall segment carry the same connection mask, so an
unrestricted fit sprinkles doors randomly along a room's wall ring. Kit::fit
now delegates to fit_where(target, allow, rng) so rotation arithmetic stays in
one place with one set of tests on it.
Two NPC defects surfaced by testing indoors, both real:
- A door that LEADS somewhere scored the same as a decorative one, and since
the wander fallback sits near 0.5, a lone doorway only tempted homebody
personalities — 4 of 24 seeds. Doors with `leads_to` now score 2.2x: 9 of 24
for a single door in an empty field, and a real village has one per house
- FOLLOW'S SCORE PEAKS AT DISTANCE ZERO while its steering parks at 2.2 units,
so an NPC already standing beside someone picks "go stand beside them" and
then does nothing for up to eight seconds. Outdoors that is invisible. In a
room, where everyone is permanently within 2.2, FOUR NPCS FROZE SOLID for the
entire run. Follow is now only considered when the target is worth walking to.
This would have shipped as "NPCs stand still indoors"
Blocks never reposition an entity: Npc::tick emits DoorUse{entity, poi, to,
entering} and the host performs the write — the same queue-and-drain shape the
audio emitter uses. Coming back out is unconditional, so an NPC can never be
lost behind a door; while inside, decide() short-circuits to a local wander,
because every POI, friend and home is outside and scoring them would aim the
NPC at an interior wall.
Release cost per interior: 4x4 room 20 us / 41 tiles, 12x10 407 us / 186 tiles.
Twenty houses is well under a millisecond. Always exactly two layers — shell
and furniture — so one kit is one batch, as everywhere else in levelgen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
AO — ZERO EXTRA BYTES. It lives in the alpha byte of the packed colour lane,
which was already dead weight: model.rs wrote the glTF baseColorFactor alpha
there, the skinned shader multiplied it into v_tint.w, and the pixel shader
threw it away by returning a hardcoded 1.0. We were paying for the channel and
never reading it. 24 bytes/vertex before and after.
The multiply scales AMBIENT ONLY — `albedo * (ambient * ao + direct)`. Folding
AO into direct as well would darken a sunlit wall twice, and direct light is
already zero where a surface faces away, which is precisely where occlusion is
the ambient term's job.
Static-only holds BY CONSTRUCTION without touching skin.rs: that file writes
pack_unorm8x4(1,1,1,1), so characters get ambient * 1.0 — an exact no-op
through the shared shader.
Cost over the real catalogue (4,442 models, 2.5M verts): 2.64 ms/model average,
102 ms worst case — down from 409 ms. Dense interior kits get a reduced ray
budget, and the hemisphere distributes over the ACTUAL ray count rather than
the nominal one; without that fix a reduced budget samples only near the normal
and reads as uniformly unoccluded. The 4x speedup moved the crevice share
14.7% -> 15.0%, i.e. cost nothing visually. Nothing in the library falls below
0.40 occlusion — the floor clamp is what keeps low-poly art out of the mud.
Contact AO needed one fix found by rendering it: an ellipse inscribed in a
square footprint pulls away from the corners, so a castle piece read as
standing in a spotlight rather than touching the ground. It is a squircle now
(|x|^4+|z|^4=1) with segments landing on the corners and edge midpoints.
STEERING FIXED ONCE, AT THE SOURCE. New libs/game/sim/heading.rs states the
convention in one place — forward is -Z, right is +X, POSITIVE YAW TURNS LEFT —
with heading_to_forward/right, forward_to_heading, steer_to_yaw_rate,
heading_delta. Seven tests read as statements of intent ("steering right
decreases heading") so a future sign flip fails loudly. The car's torque and
its autodrive route-follower both route through it and the inline atan2 calls
are gone. The inversion was exactly the trap the module now documents: positive
steer produced positive yaw, which turns left.
DOUBLE BRAINS, found by wiring: spawn_blocks ran unconditionally after
build_world, so every villager got a SECOND Npc block — two brains steering one
body — plus a second car. 28 NPCs for 14 entities; now 14.
The car is a real mesh (toy-car-kit/vehicle-truck) found by description and
scaled from its own bounds onto the chassis, box hidden. The rigid body stays
the physics.
BIG WORLD RENDERS: ARCADE_WORLD=big, street demo still default. 596 props, 217
colliders, 64 draw items (per-pack atlas batching working), 611 shadow casters,
14 NPCs, 63 of 64 models loaded, 15 ms to plan. 506,962 TRIANGLES — that will
not fit a Quest, and roads are 382 of 596 placements, so road decoration and
distant woods scatter are the first cuts a governor should make.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
8 new verbs (table now 115): find_model (DISTINCT ids, not ranked duplicates),
find_palette (matched set from one pack), model, kits, cast, road_network,
town, dungeon. game.find was ALREADY TAKEN by entity-by-tag lookup — the
duplicate-name test caught the clash before it shipped, and find_model/
find_palette now match the agent TOOL names, so the model's knowledge
transfers between the tool it calls and the verb it writes.
Verbs run synchronously (search and layout are pure CPU); only GLB load and
draw need a host, so placements queue through the same mechanism as audio and
particles — which also means a scene composes headlessly with no renderer
attached. Tiles carry their own collider from the kit pitch, so scripted props
are as solid as hand-placed ones.
THE MOST IMPORTANT EDIT WAS A DELETION. splashgame.md said "Everything is
procedural... No image, model, or audio files" — the doc was actively telling
the model it had no models, which is why generated games were bare primitives
while 4,442 models sat unused. Replaced with an instruction to reach for the
library before game.box, three rules (never place result #1 five times; one art
pack per region; generate layouts rather than hand-placing) and a wrong-vs-
right example. A test asserts that claim cannot come back.
Two bugs found by probing the REAL library rather than reasoning:
- town() would have placed ZERO buildings, silently: it selects
TileRole::Building, but every role-less model mapped to Prop — and
city-kit-suburban is 40 whole buildings with no parsed roles. A role-less
model is genuinely ambiguous (a building on a lot, or a cone at a kerb), so
kit_from_index now takes a KitUse hint. Against the real library: 104
buildings, 136 road tiles, 0 adjacency errors
- the index folds crossroads and T-junctions into one `junction` role, but a
4-way cell needs four open edges; a T standing in for a crossroad leaves a
road stub pointing at nothing. Disambiguated by name
village.splash is the scenery counterpart to racing.splash: a town, a wood of
four different conifers, a dungeon, a playable character — and not one model id
written by hand.
NOT BOUND, and why: game.tree/rock/blob and game.scatter generate MESHES, and
set_models takes an asset id, not geometry — there is no mesh-upload path for
generated meshes yet, so binding them would have meant faking it. Additive once
a generated-mesh queue exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A POST-PASS, not a sweep change. The sweep carries the 0.55 step-up,
CONTACT_SKIN and the terrain-cliff logic, and every existing contract was
written against it, so it is untouched. separate_movers runs after the whole
integration loop — which also makes the result independent of who stepped
first — and before rider pinning, which stays authoritative.
HORIZONTAL ONLY, resolving the least-penetration axis of x/z. Resolving
vertically is exactly how characters end up standing on each other's heads; an
overlapping pair is pushed apart on the ground plane and a stack unpicks
itself.
Three FIXED relaxation passes, deliberately not convergence-based: an
early-exit on "nothing moved" makes the result depend on iteration order, and
this has to be bit-reproducible. Broad phase is a uniform grid sized 2x the
widest half, with buckets as a sorted (cell_key, index) array rather than a
hash map — allocation-light AND ordered without a second sort. That replaced a
hash map of per-cell Vecs and took allocations from 617/tick to ~15.
Each shove is clamped by sweep_axis against the solid world. Without that, a
crowd pressed against a wall squeezes its outermost members straight through.
push_mass weights the split by the OTHER body's mass, so equals each give half
and a player at 4.0 shoulders through NPCs at 1.0. 0.0 — the Default — READS
AS 1.0, not as weightless: a literal zero would make every default-constructed
mover infinitely shovable and divide by zero when two met. Same discipline as
`hidden` over `visible`.
Projectiles are excluded, and that is CORRECTNESS not taste: collect_touches
reports a strike from the overlap itself, so separating projectiles would mean
a bullet could never touch anyone. Sensors, collide:false decor and attached
riders are skipped too.
50 packed movers 0.023 ms/tick
200 packed movers 0.123
12 villagers + 500 static 0.107
200 movers + 500 static 2.020
Packed crowds where everyone overlaps a neighbour — the honest worst case. The
200-among-500-statics figure is dominated by the per-shove static clamp; at the
realistic 12-50 NPCs it is 0.1-0.25 ms. The fix if 200+ becomes normal is
accumulating pushes and clamping once per mover per pass, deliberately not done
because it changes Gauss-Seidel to Jacobi and the numbers don't justify it.
THE GOLDEN HASHES DID NOT CHANGE, and that is genuine rather than lucky:
mover_scene's walkers start 1.7 apart with 0.4 halves and diverge, and its only
other mover is an attached rider, so no pair ever overlaps and the pass is
inert. Nine new tests prove separation works; the unchanged goldens prove it
does nothing where movers never meet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Eight Kenney civilians (character-female-a..f, character-male-a..b) plus the
KayKit knight as a standout — nine kinds across eleven villagers. Picked
through AssetIndex::casts() by taking the rig with the MOST members rather
than by naming a joint count, so a library that later grows a better-populated
rig gets used without editing this. Townsfolk are civilians because a village
wants people, not nine fantasy heroes; the knight stays because he is the
figure the player already knows, and having him on the other rig is what makes
the multi-rig path real rather than theoretical.
CLIPS RESOLVED BY NAME, PER MODEL. The rigs name locomotion differently —
Kenney's 7-joint civilians use idle/walk/sprint, KayKit's 41-joint heroes use
Idle/Walking_A/Running_A. clip_index is case-insensitive, so one ordered
fallback list covers both. Borrowing an index across rigs would have animated
a spellcast or a death pose.
TEXTURE BINDING was the real bug this exposed: SkinnedBatch carried ONE texture
for all items, which silently renders one character in another's atlas. It now
carries a texture palette with a per-item index, clamped rather than indexed
blindly so a bad slot cannot panic mid-frame. (KayKit embeds its atlas and
ships a sidecar; Kenney characters reference a pack-shared colormap — both
arrive as bytes, so the distinction disappears at load, but the BINDING had to
become per-item.)
Cost went DOWN: 17,440 verts skinned per frame, 408 KB/frame, against 958 KB
for the eleven-knight village, because a civilian is ~1,300 verts to the
knight's 3,716. The shape of the cost is unchanged and still doesn't scale —
GPU skinning remains the right fix.
Found by looking, not by testing: height normalisation was INVERTED, and the
first capture showed villagers about half the height of their own front doors
(Kenney's "mini" characters are ~1 unit against the knight's ~1.8). That
normalisation is keyed off joint count, which is crude — a third rig would want
measured rest-pose bounds, and SkinnedModel exposes none today.
63 props, 58 colliders, 11 NPCs of 9 kinds, 19 draw items, 12,244 triangles,
88 shadow casters.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
THE FINDING THAT CHANGES THE PREMISE: "1 rigged model in 4,442" was measured
with the BROKEN GLB probe (the gLUF magic bug). With the probe fixed the
library holds 36 rigged models across three rigs:
41 joints — 9 KayKit heroes + undead, up to 95 clips
7 joints — 22 KENNEY civilians (male/female a-f, orc, human, archer, shop
employees, skaters, soldiers), 32 clips
6 joints — 5 Kenney platformer characters, 25 clips
So a village can be populated with 22 visually distinct civilians TODAY, with
no third-party pack at all. Every conclusion drawn from that probe before it
was fixed needs re-checking, not just this one.
KayKit: 9 characters fetched (Adventurers + Skeletons), pinned by commit +
sha256, 37 MB, gitignored. CC0 verified by READING LICENSE.txt at each pinned
commit, recorded in the script header and CREDITS.toml.
THE SHARED RIG HOLDS ACROSS PACKS, proven rather than assumed: hashing the
joint-name list of all nine files yields the SAME digest — 41 joints, same
names, same order — despite two separate repositories. Skeleton clips are a
strict superset (95 = the adventurers' 76 + 19 undead extras: awaken,
resurrect, spawn, taunt). So a clip authored for the knight plays on the
skeleton warrior and one animation path drives the cast. A test pins this,
including that both packs are present, so a version bump cannot silently break
it.
The texture trap that cost the Kenney fetch three attempts does NOT apply:
KayKit GLBs EMBED their atlas (image/png in a bufferView), verified by parsing
all nine.
tests/rigged.rs parses all 36 rigged models through makepad_game_render::skin
— the loader the app actually runs — and asserts the index's joint and clip
counts match it. Deliberate: the index's own probe was wrong for the entire
library once and survived because the fixture encoded the same error.
find_cast groups by JOINT COUNT rather than pack, because the valuable fact is
cross-pack interchangeability. Cast states are the INTERSECTION, not the union
— advertising a state one member cannot perform is worse than a shorter list.
Added the state words the skeletons needed (spawn/resurrect/taunt/use):
Skeletons_Awaken_Floor previously matched nothing, so "an undead that rises
from the ground" was unfindable.
One bug found in its own work: casts_to_json emitted a doubled closing brace —
malformed JSON that still looked fine in a log. Fixed with a structural test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Eleven villagers as Movers driven by the Npc block — no special-casing, so they
collide with houses, benches and the fence exactly as the player does. Between
tick 120 and 300 they redistribute along the street, TWO PAIR UP AND TRAVEL
TOGETHER (the Follow behaviour), one settles by a bench, and an east-bench
cluster disperses. The rigid crate pyramid topples in the same window, so the
physics demo is still live underneath.
Knight split into a shared rig + per-villager pose: model, atlas and clip
indices load once; Villager holds only pose buffers, walk phase, tint and
build. follow() reads velocity back off the entity AFTER the sweep, so facing
comes from actual travel and the walk cycle advances with distance covered —
a villager stopped against a bench stops its legs instead of moonwalking. The
old hardcoded triangle-wave patrol is gone.
Per-villager tint (one vec4, one multiply in the vertex stage), because one rig
serves the whole village and without it every passer-by is the same knight in
the same colours — the identical-clones failure the prop variety work had just
fixed.
Scene faults fixed: the fence ran along z=17 while the yard sits at z 14..26,
crossing the green and enclosing nothing — now two legs meeting at a corner.
The yard is dressed with stock crates and barrels so it reads as a working yard
rather than a physics harness. The stray teal/orange lozenge is fixed AT THE
SOURCE: "rock stone" used Spread::Mixed, which round-robins across families,
and the neighbouring family is cliff_blockCave_rock — a cave-mouth tile that
reads as a small teal-roofed building. Variants keeps it inside
nature-kit/rock_largeA..F. Camera pulled 56 -> 44 units; a third of the frame
was bare lawn.
63 props, 58 colliders, 11 NPCs, 19 draw items, 12,244 triangles, 88 shadow
casters.
KNOWN COST, left documented at the call site rather than buried: CPU skinning
is ~41k verts and ~958 KB uploaded EVERY FRAME for eleven villagers. Fine here,
wrong for a town or a Quest. The bone palette is already computed, so the GPU
swap is this one loop plus a shader.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
THE WALK-THROUGH BUG WAS NOT THE COLLIDERS. Knight::tick wrote a triangle wave
straight into self.pos, and find(|e| e.tag == "knight") returned None — no
mover, no sweep, no Character block. He passed through benches, houses and
trees alike because there was nothing to collide WITH. The collider maths was
right all along, which is exactly why the house-wall and tree-trunk tests
passed while the user kept reporting walk-through three times over.
Dumping the bench's real collider before changing anything confirmed it:
graveyard-kit/bench yields 1.36 x 0.9 x 0.78 at ground level — a perfectly good
obstacle that nothing was ever tested against.
The Knight is now a BodyKind::Mover (hidden, so the mesh stays his appearance).
tick sets a HEADING; desired_velocity feeds entity.vel; his rendered position
is read back AFTER the sweep. Intent goes in, physics decides where he ends up.
Two things that fell out: his half-extents would have been 1.4 m wide and 3.6 m
tall, because spawn takes FULL size; and his patrol line ran straight through
the bench row, which — now that he genuinely collides — would jam him against
the first bench forever, so he walks the pavement between road edge and
furniture. Walking AROUND obstacles is NPC behaviour, not layout.
prop_collision.rs loads the real bench GLB, reproduces compose_village's
scaling, and walks a Knight-sized mover into it. spawn() now routes through
push_entity rather than entities.push, so the sorted-id invariant is asserted
rather than assumed.
VARIETY WIRED: 5 house designs instead of one model five times, 4 distinct
pines, a real lamp post instead of a CACTUS, two real benches instead of a
coaster-train carriage and a park entrance. Two genuine bugs in the variety
layer, both making find()'s correct answer worse:
- dominant_pack SUMMED 60 hits, so mass beat quality: nature-kit's incidental
"tall" matches out-summed racing-kit's three lightPosts, and a lamp query
returned a cactus. Only hits within 25% of the top score count now
- Spread::Mixed wanders on multi-word queries — "park bench wooden" let bench,
coaster-train-wooden and park-entrance each pass on one word
RANKING: whole_query_bonus tested only the ENTIRE query, so "fence" scored the
real fence 28 while "wooden fence" scored it 8 — tied with everything and
decided alphabetically, which is how asking for a fence returned arena/wall.
STATIC SHADOWS 15 -> 69 CASTERS: base_y was the MAXIMUM static top, and the
per-prop colliders are static entities, so the receiver plane sat at roof
height and every prop projected onto a plane above itself. Each prop now uses
its own lowest point — also correct on a slope.
Fog 0.004 -> 0.0015 (24% -> ~10% wash at the treeline), set on the demo rather
than SkyConfig::default() which gamemaker also reads. Fence spacing derived
from the panel's own scaled width. Crate stack is a 3-2-1 pyramid, not a
six-high chimney. Aspect guard so a short wide model can't explode sideways
into a coloured slab — any library picked by description eventually returns
something oddly proportioned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
blocks/npc.rs + sim/sense.rs. Utility scoring re-run every ~0.45s per NPC,
staggered so a crowd doesn't re-plan on one tick. Candidates scored additively:
visit a POI (tag appeal x distance falloff x novelty x jitter), loiter near
someone (gated on sociability), go home (grows with time away), wander (the
fallback, so a world with no POIs still moves).
Three things do the legibility work. POIs, so NPCs walk to THINGS rather than
coordinates. Per-NPC seeded personality (haste/patience/sociability/curiosity/
homebody) so identical config still yields unlike villagers. And a day clock
with a per-NPC phase offset — benches read as afternoon, doors as evening —
which is what stops ten villagers doing the same thing in unison. Activities
are deliberately only four (Idle/Travel/Dwell/Follow); routines come from
sequencing them, not from twenty verbs.
Sensing reads THE SAME SOLID FILTER the mover sweep uses, so perception and
collision cannot disagree. obstacle_ahead sweeps the NPC's own box rather than
casting a ray, because a ray through a doorway reports "clear" for a body twice
its width. Blocked -> jump if the top is in reach with landing room, else
sidestep toward the side with clearance (blended with the goal so it curves
rather than turning 90 degrees), else a stuck timer abandons the goal.
Reading the existing tests caught a bug in the new logic: "low obstacle -> walk
over it" is wrong, because the 0.55 step-up is a TERRAIN contract and
sweep_axis blocks against static boxes at any height. That branch is gone —
it was exactly the perception/physics disagreement this module exists to avoid.
Two bugs the tests caught:
- MUTUAL SOCIAL LOCK: two sociable NPCs each chose to loiter near the other,
permanently. One moved exactly 0.0 units in 90 seconds. A social cooldown
stops Follow being re-picked immediately
- VILLAGE DRIFT: an unbiased random walk has no centre, and a trace showed a
villager 43 units out with every POI inside 18. Wander steps past a 26-unit
leash now aim home
Cost against a 16.6 ms budget: 50 NPCs 0.007 ms/tick, 200 NPCs 0.046 ms/tick
(full sim step — a pre_step-only figure would be a lie, since without
step_world the NPCs never move and re-decide more often).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
THE RANKING WAS NEVER WRONG. "suburban house building" already returned 21
distinct houses at equal score and "pine tree" six distinct pines. The API had
no way to say "give me five DIFFERENT ones", so callers took hit #1 and placed
it five times — with 4,753 models installed, a scene used about six.
find_many(query, VarietyParams{count, spread, seed, filters}) never returns the
same model twice. Spread::Mixed spreads across variant families before
repeating a shape, which handles both real cases with one rule: five houses
come back as building-type-p/r/s/t/u, eight trees as pine/oak/palm/fat/cone/
detailed. palette(query, seed) returns a matched set from ONE pack.
Three things only visible by looking at output, not by reasoning:
- VARIETY MUST STAY ON-TOPIC. Round-robin across families returned one house
then two driveways and two fences (city-kit-suburban themes all of them
"house"). A relevance band was the obvious fix and was WRONG: an exact
one-word hit ("tree") outscores a compound sibling ("tree_blocks") merely for
being shorter, so banding cut real variety while keeping the drift. What
separates them is whether the family NAMES the thing asked for — applied only
when it leaves something, since functional queries name no shared noun
- VARIETY MUST NOT BECOME INCOHERENCE. Maximal spread gave five houses from
five packs — the junk-drawer failure reached from the opposite direction. The
dominant pack is exhausted before crossing; a test asserts a street uses
exactly one pack
- RE-SKINS AREN'T KINDS. tree_blocks/_dark/_fall is one tree in three palettes;
counting them as three kinds returned the same silhouette six times. Colour
and season tokens are stripped from the family key
Palette grouping needed a coarser key of its own: family_of produced 167 groups
of one id each — a listing, not a palette. Bucketing on tile role or first
meaningful token gives 23 usable groups.
Selection is seeded, so multiplayer replicates a scene as (query, seed) and a
re-run looks identical.
Also fixed: "boulder" returned tower-defense-kit/weapon-ammo-boulder — catapult
ammunition — because that filename says the word while landscape rocks reached
it only via a synonym. A confidently wrong top hit matters more than a miss
here, because a composer places it several times.
The perf test now takes MIN-of-N instead of an average: it shares a machine
with 23 other tests, and the same query measured 2.1 ms alone and 44 ms under
the full parallel suite — a 20x swing with no code change. The fastest run is
the one that actually got the CPU. Same protocol the box3d benchmarks use.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three complaints from looking at the running app, all one problem: the world
didn't behave like a place.
COLLIDERS COME FROM EACH PROP'S OWN PRIMITIVES, not its AABB. Kenney authors a
house as walls + roof + door frame and a tree as trunk + canopy, so
StaticModel::parts records per-primitive bounds during the existing vertex
bake (they were being merged away). collider_parts() drops boxes under 10% of
the model's span, merges near-coincident ones, caps at 8 — low-res by design.
Policy falls out of the decomposition: buildings/fences/rocks take every
qualifying box; trees keep only parts both narrow and low, so the trunk blocks
and you walk under branches; lamps and decals take none. A prop whose parts all
filter out gets a synthesised box (trees a narrow post), because silently
reverting to walk-through scenery is the bug being fixed — a real catch, since
that fallback first shipped for Solid only and colliders dropped 39 -> 20 when
single-mesh pines found no trunk.
`hidden` rather than `visible`, deliberately: Entity derives Default, so the
field defaulting to false must be the UNUSUAL case. A `visible` flag would make
every default-constructed entity invisible — the same trap as the zero-seed rng
and the zero-gravity bodies this codebase has already been bitten by twice.
Proven by test, not by eye: a walker stops at a house wall but passes through
its DOORWAY (this fails with a single AABB), a trunk blocks while its canopy
doesn't, hidden colliders still block. One test initially "failed" because 120
ticks at 4 u/s travels exactly 8 units — it was measuring the tick budget, not
the collider.
STATIC PROPS NOW CAST. rebuild_static_shadows only walked entities, and props
are ModelInstances whose colliders are hidden, so trees and houses cast
nothing. Placed models feed the same baked layer, caster points sampled from
the model mesh (extremes always kept, then strided to ~48 — a stride alone
misses roof ridges) so a pine's shadow tapers. Cached on (render_rev,
bake_generation, models_rev), merged into one geometry, one draw.
THE SCENE IS COMPOSED: five suburban houses set back from a road all FACING it
(uniform facing is the point — random yaw reads as debris), lamps on one verge,
benches on the other, a fence line, three separated tree stands rather than
uniform sprinkling, and the physics demo gathered into a builder's yard. Props
scale to a target height from their own bounds, since a fixed multiplier gives
a 12-unit bench beside a 2-unit house. Exhaust only emits above 3 u/s (a parked
car under its own smoke column read as a bug).
44 props, 39 colliders, 7 draw items, 15.8k triangles.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
THE BLOCKER WAS UPSTREAM OF THE RENDERER: zero of the 4,442 models had a
texture on disk. download_assets.sh extracted only .glb and deleted the zip,
reasoning "GLB is self-contained" — false for Kenney, where every material
points at an external Textures/colormap.png shared across the pack. PNGs are
extracted alongside now, and the resume check REQUIRES a texture, because a
pack of GLBs with no atlas renders white, which is worse than missing.
(The atlases are tiny: 212 textures, 42 KB.)
Static path (model.rs) reuses skin.rs's container/JSON/accessor code rather
than growing a second parser. A static mesh is a skinned one minus joints,
plus one difference: a prop never animates, so each node's world transform is
BAKED into its vertices at load and the model becomes one buffer. Dropping
that bake is exactly how a prop silently renders at the origin, so there is a
test for it. All 4,442 models parse: 1.31M triangles total, 294 average —
comfortably Quest-sized.
Kenney ships TWO conventions, and the second only turned up by looking at a
failure: most packs UV-map into colormap.png, but nature-kit and friends carry
no texture at all and colour each primitive with a material baseColorFactor.
Rather than branch, that factor is baked into the packed vertex's colour lane
and multiplied in the shader (albedo * v_tint) — atlas models carry white,
untextured models get a white 1x1. One shader, both conventions. A model that
DECLARES an atlas but cannot find it stays a hard error; that case really is
broken.
Batching sorts instances by model so equal geometry+texture land adjacent and
accumulate into one draw item: the demo runs 36 instances in 5 draw items,
9,887 triangles. Copies of a prop are free; cost is per distinct model.
The demo picks props BY DESCRIPTION through the asset index (find("pine
tree")), not by hardcoded paths, so it exercises the same path a generated
game takes — and it walks the ranked hits taking the first that loads, so a
pack with a missing atlas yields to the next candidate instead of leaving a
hole. Pillar ring and cone removed; they read as a test harness.
Honest read of the captures: before, coloured cylinders and spheres on a slab
— unmistakably a tech demo. After, a woodland treeline at mixed scale and
species, a suburban house with windows and a teal roof, wooden fences,
textured crates, correctly lit and shadowed. Still imperfect: "boulder"
resolves to nature-kit/cliff_blockCave_rock, a cave-mouth block that reads as
a small building scattered about — a SEARCH-QUALITY gap for the alias owner,
not a render bug.
Washed-out look diagnosed (not fixed, out of scope): it is FOG, not the bake
or the textures. SkyConfig::default()'s density mixes every surface toward the
pale horizon (0.75,0.87,0.96) over a 34-unit camera distance — the far
treeline desaturates toward sky colour while near crates keep their brown. Fix
is either a lower default density or making fog colour follow the sun's
horizon tint so it reads as haze rather than a grey wash.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
THE BUG: GLB_MAGIC was 0x4655_4C67, which spells "gLUF" — not "glTF"
(0x4654_6C67). The magic check therefore rejected EVERY REAL GLB, probe()
returned defaults, and the entire 4,442-model library indexed with
rigged:false, animated:false, size:None. Size filters silently matched
nothing; no model was ever detected as rigged. Any claim made from that
metadata — including "Kenney has essentially no rigging" — was measuring a
no-op, not the catalogue.
It stayed invisible because THE TEST FIXTURE WROTE THE SAME WRONG MAGIC, so
the test and the bug agreed with each other. Fixing the constant broke that
test, which is exactly how a fixture should behave once it stops encoding the
defect. A second bug sat behind it: bounds() searched for "max" only AFTER
"min", but Kenney's exporter writes max first, so bounds would have failed
even with the magic fixed. Both fixed, both with regression tests.
Consequence: the previously-reported 120 ms index build was timing a no-op.
Real probing is ~1.8 s for 5,309 models, now cut to the declared JSON chunk
and parallelised across <=8 threads (std-only, order preserved,
deterministic). The proper fix is caching probes by path+mtime — NOT done, and
the perf bound is now 12 s with a comment saying why rather than a tight
number the test cannot control under contention.
KIT INVENTORY — 23 kits, 2,064 tiles, grouped so a query returns a coherent
visually-matching set instead of one tile from each of five kits. Tile size is
the MEDIAN horizontal extent (kits ship occasional double-width pieces, and a
mean lands between grid pitches — a value no tile uses). Highlights:
city-kit-roads 72 tiles @1.00, coaster-kit 183 @4.00, tower-defense-kit 160
@1.00, marble-kit 162 @1.20, platformer-kit 153 @1.00, modular-buildings 108
@1.00, racing-kit 112 @1.05. The most useful single fact: modular-dungeon,
-cave and -space kits have IDENTICAL role histograms — one layout algorithm
drives all three and the kit choice is pure theming.
Honest failure: city-kit-commercial (41) and city-kit-industrial (25) yield
ZERO roles — their files are building-a..building-z, whole buildings with no
role vocabulary. Grid-placeable but not composable; arguably not kits.
Adjacency ships as DATA (ROLE_ADJACENCY) for the composition layer and is
deliberately coarse: Kenney filenames say what a piece IS, never which edges
are open, so anything finer would be invented. Also added: role/kit/clips/
joints on entries, kits()/kit_tiles() grouping, a find_kit agent tool (<2 KB
so the AI can discover a coherent set before composing), and composition-intent
vocabulary.
Inert per the Kenney-only scope cut: clip extraction, Quaternius source
support, .gltf support — tested and harmless. 64 fetched Quaternius models
were deleted after verifying they parse (46 joints/13 clips).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Procedural LAYOUT + authored TILES: the AI decides where things go, Kenney's
artwork decides how it looks. Beats both random prop scatter and purely
procedural geometry, and it is how low-poly games are actually made.
ADJACENCY HOLDS BY CONSTRUCTION, not by rules. Rather than pairwise rules
between named roles (fragile and quadratic), layout marks occupied cells, each
cell reads its target mask off its occupied NEIGHBOURS, and a tile is chosen
matching that mask at some rotation. Both sides of every shared edge derive
from the same grid, so only rotation arithmetic can be wrong — and that is
what the tests pin. Junction type is never specified by a caller: two crossing
paths yield a crossroad, one teeing in yields a T, purely from neighbour count.
The interface deliberately keys on a 4-bit N/E/S/W `mask`, not on `role`, so
these algorithms don't depend on the asset index's filename taxonomy — if a
kit classifies `road-split` oddly, setting the mask keeps everything working.
Incomplete kits fall back to a superset tile: a crossroad standing in for a
missing tee leaves a stub opening onto nothing, which reads as unfinished road
rather than a hole in the world.
Generators: road_network (polylines), road_from_spline (the authored-tile
counterpart to the existing ribbon mesh — a kart track wants the ribbon, a city
street wants tiles), town (street grid, buildings on lots that front and face
a street, props at junctions), dungeon (BSP rooms + corridors, connectivity
guaranteed by the spanning tree and PROVED by flood fill over 12 seeds), plus
place_tile as the escape hatch.
track from closed spline 13 us 120 tiles
road network (13 paths) 32 us 397
town 24x24 71 us 547
town 60x60 822 us 2710
dungeon 48x48 137 us 1180
dungeon 96x96 932 us 3616
Town road histogram: 1248 straight, 121 cross, 44 tee, 4 corner, 0 dead ends —
correct for a closed grid. Zero mismatched edges on both large levels.
Two bugs caught by its own tests: indexing one kit with another kit's
placement indices (now impossible — layers merge by kit id, invariant
documented), and a superset-fallback that allocated a Vec per cell and tripled
generation time. The allocation-free count-then-pick rewrite is faster than
before the fallback existed: dungeon 96x96 went 1952 us -> 932 us.
Seed-deterministic via GenRng, never the world rng, so a town replicates as
(kit, seed, params). Not done: walls/doors around dungeon rooms (floor-only
today), multi-cell buildings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A generated game handed box3d an infinite extent and took the whole process
down — found by the eval harness actually generating games, not by reading
code.
NaN was already absorbed (Rust's `max` returns the non-NaN operand), but
INFINITY survives it and poisons every plane normal to NaN. box3d's face query
then never beats its -f32::MAX starting separation, leaves max_face_index at
the -1 sentinel, and convex_manifold.rs casts that sentinel through u8 into
255 and uses it to index a 6-element array.
The port is FAITHFUL to upstream C here — convex_manifold.c does the same
(uint8_t)maxFaceIndex cast; C reads garbage where Rust panics — so box3d is
not the place to diverge. The boundary is: never hand the solver a value it
cannot reason about. sane_extent() clamps non-finite and out-of-range
dimensions (and density) to a workable range.
Regression test covers +inf, -inf, NaN, 0 and negative extents: none may panic
and all must leave a finite pose after 30 ticks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
decodable is no longer gated on format — acb315614 took the in-house Vorbis
decoder to sample-exact on every shipped file, mono and stereo. The
`undecodable` reporting path stays for a future format we might index before
we can play it; the test now asserts the CURRENT catalogue is clean rather
than asserting ogg is broken.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bug was NOT residue type 2 — that lead was a reasonable inference from
"stereo-only, transient-heavy", and it was wrong. The cause was overlap-add
placement of early long blocks.
A block's window is centred on `center` and reaches n/2 either side. A file
opening [256, 256, 2048, ...] puts the first long block's centre at 832, so it
starts at -192 — before sample zero. Those leading samples lie outside the
stream and must be DROPPED. The code used center.saturating_sub(n/2), clamping
the start to 0, which slid the whole block 192 samples later. Every sample was
corrupted until the centres grew past n/2, then decoding was perfect again.
That shape is exactly why it read as a residue fault: a wrong head with a
correct body looks like "specific blocks have wrong amplitude", and
correlation averaged it to 0.82. Mono appeared flawless only because no mono
file in this corpus happens to open with an early long block — a corpus
accident, not a decoder property.
mono 47/47 exact, mean 1.00000 -> 186 files, mean 1.00000, min 1.00000
stereo 68/107 exact, mean 0.826 -> 370 files, mean 1.00000, min 1.00000
corpus 115/160 exact -> 556/556, zero decode errors
The 73 "frame-count mismatches" are afconvert trimming further than the
container specifies; afinfo's valid-frame counts match OUR output exactly and
every file still correlates at 1.0000.
The fix is extracted into a shared overlap_add because decode and debug_raw
each had their own copy — a diagnostic that can disagree with the decoder it
diagnoses is worse than no diagnostic.
New test is fixtured on a file that opens [256, 256, 2048, ...] and asserts
PER-SAMPLE agreement, not just correlation: correlation alone hid this at 0.82.
Decode cost 5.16 ms/file; 11.5 MB compressed expands to 143.3 MB of f32 PCM.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two root causes, both found by building an oracle rather than guessing.
1. Amplitude ~75x low: the IMDCT applied a 2/n normalisation the encoder's
forward transform had already carried. Because 2/n varies with block size
it produced DIFFERENT errors on 256- vs 2048-sample blocks — exactly the
reported symptom. Removing it gives fit scale 1.0000.
2. Leading trim, the real remaining defect. The first audio packet produces NO
output (its window only primes the overlap-add) but we emitted from the
first block's centre, injecting half a priming window of garbage and
shifting everything early. And Vorbis carries encoder delay in the GRANULE
POSITION, which varies per file — afinfo confirms 128 / 1103 / 960 frames
on three samples — while our Ogg reader kept only last_granule and
discarded per-page granules, making it unrecoverable. Added per-page
granule tracking: the first page reporting a granule pins priming as
centre - granule, and valid audio starts at priming + blocksize_0/2. That
reproduces afinfo's numbers exactly on all three.
A premise in the brief was also wrong and worth recording: our output length
was already correct. afinfo reports valid frames matching OUR output — it is
afconvert that trims a further 128. The reference WAV was short, not us.
mono 47 files mean corr 1.00000 (min 1.00000) 47/47 exact
stereo 107 files mean corr 0.826 68/107 exact
Decode cost 5.13 ms/file average; 11.5 MB compressed expands to 143.3 MB of
f32 PCM, which is why the sample bank's LRU cap matters.
Honest remaining defect: ~39 stereo files decode wrongly and it is NOT
alignment — a full lag sweep peaks at 0.40-0.89 with fit scales 0.40-1.87, so
specific blocks have wrong amplitude. Mono being 47/47 rules out floor,
residue 0/1, MDCT, windowing and priming; coupling matches the spec's
square-polar mapping including reverse order; floor 0 is rejected rather than
mis-decoded; and both channels are identical in the failing files, so it is
not a swap. The failing set is transient-heavy impact/footstep sounds, so the
lead is residue type 2 partition counting on short blocks.
reference_decode.rs is no longer #[ignore]d: 3 real tests asserting mono
correlation > 0.999 and length == granule, plus a 3000-mutation fuzz that must
never panic, all skipping cleanly without fixtures.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
apps/arcade/src/lib.rs (plus the [lib] section committed alongside it in
3cef1eb29, which referenced a file that wasn't tracked yet — HEAD did not
build without this).
The point is stated in the module doc: tools/arcade_eval must send the same
system prompt and the same tool policy the app sends, or it measures a
fiction. Exporting the modules is what keeps the harness and the app from
drifting; the binary keeps its own mod declarations because app_main! owns
the process entry point.
Carries the game_script changes the harness needs alongside it (input.rs and
the dispatch/host/value edits made while wiring the headless evaluation path).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
libs/converse gains a default-on `tts` feature so gamemaker and route are
unaffected; Arcade takes default-features = false and re-enables it through
its existing `voice` feature. With tts off, SpeechOutput still exists and its
worker drains the queue silently, so no Arcade source changes were needed —
which also avoided colliding with concurrent edits to those files. No
capability is lost: speech is fully reachable under --features voice.
Arcade before 25.11 MB
Arcade after (default) 15.01 MB (-10.10 MB, -40%)
Arcade --features voice 26.18 MB
hello_world 13.46 MB
Isolated by A/B in a throwaway worktree before making the real change. Of the
10.1 MB, 2.78 MB is us_lexicon.bin embedded via include_bytes!; __const alone
was 11.2 MB, larger than __text.
Also: Kokoro construction is now lazy, deferring ~327 MB until first
utterance. That already closed the RSS gap this pass was chasing — Arcade's
max RSS measures 190 MB against hello_world's 222 MB on the same method, i.e.
BELOW the baseline app, so the premised memory problem no longer exists and
was not invented into one. The lean-isolate prelude was likewise dropped after
instrumentation showed Arcade allocates no script isolate on the demo path at
all; it should be re-measured against a loaded script game before anyone
spends effort there.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Seed-deterministic, baked at spawn, emitted straight into the 24-byte packed
vertex format. Two devices given the same seed produce byte-identical
geometry — which is what lets a forest replicate as (preset, seed, position)
tuples instead of mesh data.
- L-system plants: expansion + 3D turtle + skeleton, 8 species (oak, pine,
palm, bush, fern, cactus, dead, grass)
- Surface nets (not marching cubes — fewer, better-shaped triangles at
low-poly) for rocks, boulders, mushrooms, clouds, blobs
- Spline tracks with width, banking, curbs and rails, returning centreline
frames that carry lap distance — so spawn points and checkpoints derive
from the track instead of a second hand-written list
- Poisson-disk scatter with flatness/height rules
- Texture generator with CPU mip chains (backends never generate them)
- LRU cache keyed by FNV-1a over the full recipe with floats hashed by exact
bits; -0.0 and 0.0 normalise together (identical geometry), 4.0 and
4.000001 stay distinct. Meshes hand out as Rc so eviction cannot pull
geometry out from under a frame mid-draw
- DrawGameFoliage: growth and wind as an OPT-IN shader variant, a sibling of
DrawGameSkinned rather than a flag inside the shared shaders — wind costs
~20 vertex ALU and the cube shader draws most of the world. Growth and flex
weights share one packed nibble pair, so both animations cost zero extra
vertex bytes
A realistic forest — 150x150 m, 582 trees, 3 species, 6 seeds — generates in
1.70 ms with 470 KB resident: 6 generations and 576 cache hits.
Three bugs the unit tests had passed, found by writing an ASCII silhouette
probe because captures were out of scope: every species came out ~4x its
requested height (the test compared two sizes RELATIVELY, so a uniform
overshoot sailed through — now the finished skeleton is measured and rescaled,
and the test asserts absolute height for all 8 species at three sizes); palm
emitted no foliage at all because its L-system contained no leaf symbol; and
cactus sprawled sideways like a shrub. Pine also dropped from 4 iterations to
3 — 15032 -> 2504 triangles, 728 -> 68 us — because 15k triangles for one
background tree is indefensible.
Honest caveat: that is a silhouette judgement, not a rendered one. Shading,
leaf-card orientation and the wind/growth animation are visually unverified.
Script verbs are not wired yet — the crate is a library only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
52 packs, 4442 GLB models, 136 MB on disk — fetched sequentially with resume
(a hash-valid pack is skipped, so an interrupted run costs nothing) via
kenney.nl's content-hashed URLs with per-zip sha256. MIRROR.toml records
every pack's canonical URL, sha256, size and file count, so a mirror is
reproducible; --mirror=/ARCADE_ASSET_MIRROR redirects the base URL and fetch()
verifies the digest identically whatever host served the bytes — a mirror we
control is never trusted more than upstream. --packs= keeps a fresh clone from
being forced to pull everything.
Aliases restructured to survive the scale: per-pack theme rows (55) so every
model in a pack inherits its setting, filename-token parsing with variant-
marker stripping as the workhorse, and ~240 hand-curated query-time synonyms —
the layer whose curation compounds across the whole catalogue. 82-query suite
reports misses instead of being tuned green; the list is down to 2, both
defensible (a floor IS somewhere to stand; a bell IS a metal clang).
Three ranking bugs root-caused, not patched:
- No stemming, so "smashing" never reached the alias "smash" and "glass
smashing" returned glass PIPES. Added a conservative stemmer probed at
synonym strength (only ever adds matches), which refuses to mangle
glass/grass/class and routes "trees" to "tree", not "tre"
- An overreaching alias: `spaceship` sat on four spaceEngine SOUND families.
An engine hum is not a spaceship. Removed; "spaceship engine" still resolves
- Kind confusion on ties: spacecraft models tied with spaceTrash sounds and
lost the alphabetical tie-break. Added kind-aware tie-breaking driven by
query intent — deliberately a TIE-BREAK, not a score bonus, so it cannot
drag a weak model above a strong sound (laser gun / explosion / coins scores
verified unchanged)
Repo-policy violation fixed: all three asset .gitignore files were deny-lists
covering only .glb/.png/.jpg, leaving 302 .gltf files from 3d-road-tiles fully
committable. Converted to allow-lists — 4,744 asset files are now unstageable
by accident.
Scale at 4,999 entries: build 120 ms, search ~0.2 ms, 2.1 MB heap, and the
prompt summary still 479 chars — flat as the catalogue grows, which is what
keeps it affordable in every AI turn.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two bugs, one visible symptom — the Knight strolling through the crate stack.
1. Rigid bodies were absent from the mover sweep set and from raycast /
camera-boom queries. When box3d dynamics landed, movers kept sweeping only
against Static|Kinematic, so a character (and a bullet, and the chase
camera) passed straight through every crate. Rigid poses are read back from
box3d at the end of the previous tick, so at snapshot time a rigid is as
settled as a kinematic and belongs in exactly the same set.
2. Fixing (1) exposed a deeper one. Clamping left the two boxes EXACTLY flush
(|d| == sum of halves), where float error decides the next axis' overlap
test either way — and a "yes" sent the falling mover UP onto the crate,
straight through the documented 0.55 step-up limit. It then walked along
the crate top. CONTACT_SKIN (1e-3) makes resting contact stop a hair short
of flush, so contact is unambiguous instead of borderline. Verified: a
walker into a 1.0-tall crate now stops at its face (x 1.20, y 0.50) rather
than climbing to y 1.50.
mover_is_blocked_by_a_rigid_body pins the behaviour. The mover golden hash is
re-baselined once, deliberately — the skin shifts every clamped position by
1e-3, and the movement it now describes is correct rather than merely
different. The reason is recorded at the assertion so a future change to that
hash needs the same justification.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Kevin Boos
Jason Yau
Admin
