Squash of 25 work commits (Sep 1–12):
237da90 render: the sprite lane hands the screen draw back the way it found it
895b9a7 particles: an emitter can ride a body's own frame
914471f ai-hub: a feed session whose last socket left ends on its idle timeout; skin: parent, skinned centroid and a nodes-only rig for retargets
3fcccf3 sim: the whole world is implicitly editable, and one seam says where the ground is
5692fab sim: the landform world proves itself — walker through the tunnel included
f4af6df sim: terrain knows who changed it — a plan layer over player history
adbb078 render: a water volume can be physics without a picture
c17480f render: a non-rigid body may carry its own orientation
acad401 sim: an agent with no route holds and retries instead of walking into the wall
22b2bf9 sim + chat: the composed world surface takes a map floor; the chat gets plan tools
faf8112 web path: the tessellator's lap timer, the trace span and the fusion cycle timer have no clock on the web
d3472eb tsdf: the clock-taking XR helpers are native-only — the browser has no depth camera and no Instant
4946c9e sim + render: a repaint is not a world edit — colour and glow restyles never rebake the lightmap
4317f58 sim + render + chat: walk decks as a surface, the filmed body is no obstruction, the brief never asks
9791279 render: support rigged models and custom materials across viewers
3ce2792 sim: use deck geometry for collision and sensing
c8b79ff Add portable PBR, rig and soft-body authoring support
108d423 Add transactional polygon modeling and editable asset documents
38f4d3b Refine editable modeling and firm yarn character behavior
08a2637 sim: add entity-owned lights and vehicle headlights
00d96a7 render: add clustered lights, local shadows and incremental GI
cf916af render: import glTF asset extensions and wire clustered GI
c6d2cca model: cut transaction memory and raise capacity limits
41af47a raytrace: add a CPU probe-ray BVH budget example
c963d0a libs: the game sim splits into makepad-scene and makepad-soft-body; render, model, fab and the asset importer retarget
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Squashed from work; the fine-grained history is under tag archive/work-2026-08-29:
- mp* wave: mpwm window manager + the mp app family, WM API, theme bridge, PDF engine fix
- mpwm polish wave: terminal key focus, focus-history close order, pop-back-to-origin, occupied-workspace cycling, demo
- work: land the sources the last commits reference
- route: the assistant icon the committed UI references
- fast_inflate: the benches name their dev-deps
- gif/weezl: drop the vendored benches nobody can run
- weezl: the decode tests generate their own LZW fixture
Committed together: both streams landed in libs/game/script, so splitting
them would produce two commits that don't compile.
M6 — packaging and sharing
- libs/zip_file gains a writer (store + deflate); real `unzip -t` validates
our archives in an interop test. Packing is deterministic (fixed
timestamps, sorted entries), so a package can be addressed by its own
sha256 — which is what makes the registry's digest check mean anything
- libs/game/pkg: .arcade format (game.splash + manifest.toml + assets),
total manifest parsing (attacker bytes always yield a Manifest or an
error, never a panic; non-finite numbers refused rather than defaulted),
registry client that verifies sha256 INSIDE download so tampered bytes
never reach the extractor
- Hardened extraction: absolute paths, drive letters (C:x is absolute on
Windows), UNC, backslashes, .., NUL/control chars, symlink members (via
mode bits), duplicate names (the ambiguity IS the attack), declared-size
caps checked before decompressing plus a post-decompress check, entry/
total/archive caps, and a post-join re-check that the resolved parent is
still inside the destination — which catches a pre-existing symlink the
name test cannot see. 4000-round mutation fuzz with a canary file beside
the destination; a 320 MB deflate bomb under 1 MB on the wire is refused
- Capability stripping rebinds fs/run/net to FRESH EMPTY OBJECTS rather
than shadowing known verbs, so there is no hole the day someone adds one.
Applied before the game handle is registered. Vacuity guard: an unstripped
isolate genuinely reads a file, so the sandbox tests can't pass for
unrelated reasons. Browser-installed games load Trust::Downloaded
M7 — pretty pass
- GameSun adopts draw::SceneSun (axis-converted: SceneSun is map-space
y-south/z-up, games are y-up). Shaders compute hemisphere ambient +
direct instead of each hardcoding its own split; defaults collapse the
new formula to the old constants exactly, so unifying did not restyle
existing games. write_into is the single write path — "one sun" is
compiler-enforced
- Projected shadow geometry: the caster's silhouette along the sun, fitted
in the sun's own (u,v) frame, so it stretches as the sun swings. Nearest
N casters get projection, the rest blobs; one instance in the existing
alpha batch, no extra pass. 0.6us for 24 casters
- Two pre-existing shadow bugs found via capture: the pipeline blends
premultiplied, so unpremultiplied dark RGB ADDED light instead of
removing it; and shadows were fogged, mixing them toward the bright
horizon so a distant shadow came out lighter than the ground it darkened
- Particles are structurally isolated from the sim: GameWorld has no
particle field and step_world has no particle code — the renderer owns
simulation and its own RNG. particles_never_advance_the_world_rng
interleaves particle verbs with real rand() draws over 32 rounds and
asserts both the RNG state and the drawn stream are identical
- game.sfx_at with listener-relative gain/pan and a near-field ease so a
sound at your feet doesn't flip channels; 2D verbs unchanged
- apps/arcade/BUDGETS.md: measured particle/sim costs, Quest columns marked
as estimates (the real particle limit is fill rate, not CPU)
Tape probe BYTE_IDENTICAL. Not done: arcade has no audio backend, so
positional sound is implemented and tested but not audible there yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
