# voxel_stream evaluation fixes — 2026-09-12

Current disposition: **selected findings resolved within the documented evidence bounds**.
See [the final windowed follow-up](#final-windowed-follow-up--2026-09-12-integration-4a60d02);
earlier locked/pending statements below describe historical snapshots.

Invocation: “fix the voxel_stream example and eval”, following the request to
use the repository's eval-fix workflow. This authorizes corrections and follow-up
evaluation, superseding the original review-only request. The user subsequently
authorized committing the untouched example as a baseline, then the fixes.

Original report: [verbatim conversation evaluation](../reviews/2026-09-12-original.md).
Finding numbers below retain that report's numbering. All seventeen numbered
findings are selected. The minor documentation/UI findings in its concluding
notes are also addressed with the corresponding owner. No unrelated example or
SDK-wide feature work is selected.

Assistant judge: Codex in task `01a094b7-84fe-79c0-ba6e-309b58df63f5`.
Dispositions below are assistant-authored, not user judgments. Core runtime
verification passed at `163af39`; final presentation and stationary-edit timing
verification at `15d1cd9` is pending an unlocked desktop.

## Baseline and work isolation

Starting repository revision: `8efa79a`. The entire example was untracked.
Other starting changes: AGENTS.md, root README.md and skills/README.md modified;
.agents/, docs/example-suite.md and the boid_flock, bunny_mark and slime_colony
examples untracked. Those changes are excluded from example commits.

Untouched example baseline: `672233a`. Its 30 source/artifact files matched the
saved SHA256 manifest before staging. Existing whitespace in generated Markdown
was retained deliberately rather than altering the baseline. The original
receipt and screenshot remain recoverable at that revision.

Implementation agents used separate worktrees under ignored
`build/voxel-stream-fix-20260912/{mesh,worker,native}`. Root prepared scene/eval
changes separately in the same ignored capture directory. The saved baseline
and `baseline-sha256.json` record the uncommitted starting example exactly.

Original gates: nineteen pure tests and the accepted debug build passed; offline
benchmark passed; runtime gate was not run because an unrelated editor was open.
The original report retains commands and sentinels. No original runtime PASS
exists. The user closed that editor and later authorized closing old sessions;
PID 12552, a four-day-old headless contract test, was terminated with SIGTERM.
Other active task sessions are to be preserved. `ps` is checked at every launch.

## Triage and acceptance

All findings below were accepted after checking their actual source paths. Fix
commits alone do not resolve them; final evidence is recorded later in this file.

| ID | Accepted defect and required verification | Owner / current disposition |
|---|---|---|
|1|Retirement breaks linear-probing chains. Every retained coordinate remains findable after moves; no duplicate or unreachable chunks.|Native scheduling; verification pending|
|2|Negative faces use the wrong winding. All six outward directions are clockwise; actual engine bytes and lit rendering agree.|Mesher + runtime readback; verification pending|
|3|Mailbox overflow drops needed results and QueueFull loses stationary coverage. Delayed draining, cancellation and radius-six settlement complete without lost jobs.|Worker + scheduler; verification pending|
|4|Multiple voxel edits can outrun the submitted snapshot. Final mesh matches all stored changes, including a border carve and edits while queued.|Native revisions + runtime edit; verification pending|
|5|Ordinary dig misses terminate the demo. Unavailable/out-of-layer or unchanged voxels return0, real edits count changed voxels.|Native + input; verification pending|
|6|Reconfigure loses storage allocations. Repeated configure/replay has stable storage/RID counts and shutdown reaches zero.|Native lifecycle + runtime replay; verification pending|
|7|Raw Tick units made0.5 seconds become0.5 milliseconds. A real 500ms deadline controls ring changes; same-ring movement does not rearm it.|Native timer + tests; verification pending|
|8|Hot meshing/jobs allocate and staging owners are always replaced. Retained workspaces/result/payload/chunk storage have measured zero warm Odin allocation; staging reuses equal extents. Engine copies/resizes stay explicit.|Mesher + worker + native; verification pending|
|9|Opaque material boundaries emit hidden geometry and inflate the naive denominator. Only solid/air interfaces count and emit.|Mesher regression; verification pending|
|10|Actual buffers are smaller than the checked limit. Fragmented input refuses before overflow and workspace recovers.|Mesher regression; verification pending|
|11|Empty-chunk shortcut disagrees with direct meshing. Both emit no outside-owned geometry, regardless of aprons/bedrock.|Mesher + worker regression; verification pending|
|12|Worker OOM paths can free stack data or leak payloads. Partial-create and failure cleanup preserve allocator ownership; blocked producer shuts down.|Worker lifetime tests; verification pending|
|13|Eval claims digest equality it does not check. All original coordinates/LODs replay; every worker result matches a reference; native verification covers every settled chunk and AABB; engine reads back representative uploads.|Offline + native + runtime eval; verification pending|
|14|frame_avg measures only the driver's callback. Measure full frame intervals and p95 separately from driver cost, preserving the original flight window.|Runtime eval; verification pending|
|15|Worker, pump, shutdown and process failures are swallowed. Error propagation and exit diagnostics fail the gate; clean teardown checks native and Host owners.|All integration owners; verification pending|
|16|Fabricated probes print unconditional PASS and leak RIDs/materials. Compare actual mesher uploads with engine readback and six independent ArrayMesh normal encodings; retain Resources and native RID ownership.|Runtime eval; verification pending|
|17|LOD border watertightness and distances are overstated; interactive workaround omitted. Exact border-shell occupancy agrees at all LOD pairs; verify emitted shared walls and fast flight; document real ring distances and GL launch.|Mesher + docs + runtime; verification pending|

The mesh ownership/topology correction groups 2,8,9,10,11,17 because workspace
capacity, output ownership and exact-border occupancy share the same emitter
and regression oracle. Worker bounded-slot ownership groups 3,8,12. Native
bookkeeping/revisions/ownership are integrated only after both interfaces settle.
Changes to the eval and documentation retain the old inputs and old receipts;
correcting an invalid old algorithm necessarily starts a new digest series.

## Fix commits and focused checks

- `1f309c0`: mesh ownership/winding/borders, findings 2/8/9/10/11/17.
  Locked Odin integrated subsystem run:25tests, exit0.
- `396e247`: canonical all-air fast path, finding 11. Focused
  `-define:ODIN_TEST_NAMES=mesh_all_air_owns_no_neighbor_faces`:1test, exit0.
- `a9708fb`: worker backpressure and leased storage, findings 3/8/12.
  Integrated `odin test examples/voxel_stream/subsystem -o:speed -vet
  -vet-style -vet-semicolon -out:build/voxel-stream-fix-20260912/worker-tests`:
  33tests, exit0,44.981ms.
- `6745f06`: offline replay/payload equality and allocation assertions, finding 13.
  Agent checked192replay pairs and192worker pairs with all warm counts0; a
  cached deliberately corrupted worker digest correctly exited1. Unsupported
  `--write`, invalid bounds, duplicate arguments and the old `--heights` also
  fail. No frozen receipt was rewritten. Integrated gate remains pending.

A focused pinned-Godot `--headless --rendering-driver opengl3 --check-only
--script res://main.gd` found a missing Image type in the new eval script.
That was corrected and the same parse check then exited0 without diagnostics.
The initial failure returned process status0, reinforcing why the runner must
inspect diagnostics as well as status. A separate agent reviewed the scene/eval
code and found a warm/measure timestamp boundary error and probe radius UI
mismatch; both were corrected before integration.

## Integrated fixes and executed evidence

- `f1d5906`: native scheduling, tombstones, revisions, real hysteresis, staging
  reuse and symmetric ownership; regenerated the bridge (1/3–8/13/15).
- `7f062e9`: runtime outcome assertions, actual upload/readback checks, full-frame
  timing, UI/input/error propagation and an accepted-artifact runner (5/13–17).
- `69eb70b`: README claims bounded to actual implementation and workload.
- `2a2816f`: include ARRAY_FORMAT_INDEX in the single native surface format
  authority; actual engine array readback requires this bit (13/16).
- `4ba7b4e`: monotonic phase deadlines and upload-rate denominator; camera delta
  remains simulated time and README says so (14).
- `711c431`: ArrayMesh synthesizes tangents, so reference normals require the
  engine's offset/stride rather than a contiguous-normal assumption (13/16).
- `163af39`: force a second carve after the first remesh snapshot is submitted,
  assert a stale result was rejected, then verify every final chunk (4).
- `07a2e4e`: controls and rate counters follow reconfiguration; radius-six
  runtime phases previously still showed radius four.
- `577abf2`: existing material tint, sky/ground horizon, sunlight/ambient balance,
  distance/height fog and initial camera adjusted after frontmost inspection
  found the corrected landscape too bright/flat. No new rendering pass.
- `15d1cd9`: remove the artificial750ms settling floor from stationary edit
  measurement; the original successful762ms value must not be called remesh
  latency (14). Camera/replay phases retain their settling floor.

### Gate sequence and failed attempts

`./test.sh` and `./test.sh eval` passed at `2a2816f`, `4ba7b4e`, `163af39`,
`577abf2`, and `15d1cd9`. The final pure gate has33 subsystem tests and4 native
bookkeeping tests. Doctor names the official dev5 identity, generate reports
changed=false, check reports generated=clean, and the debug build is accepted.
Full retained logs at the latter three revisions are in
[followups/20260912](../followups/20260912/receipt.json).

An initial gate attempt stopped before doctor because a bare `godot` executable
was still running: PID63715 was a three-day-old orphaned contract test. It was
terminated under the user's authorization for old sessions. One mistaken
`./test.sh` invocation at repository root exited127 without running any test;
the corrected example-directory invocation passed. A negative-check invocation
initially found no binary because `odin run` removes its executable; explicitly
building the cache-only negative-check executable resolved that harness issue.

`./test.sh run` at `4ba7b4e` exited1 on the reference-normal stride error;
[the failed log](../followups/20260912/run-4ba7b4e-failed-normal-stride.log) retains
its zero-Host-owner cleanup. This was an eval bug, corrected in `711c431`.
CUA selected the app after that fast failure had exited and launched a Project
Manager window; it was closed immediately. No concurrent eval was then running.

`./test.sh run` at `163af39` exited0, frontmost under CUA inspection, using
`--rendering-driver opengl3`. Its accepted build is
`25d831a8d7c38512146b253d5b24ac93aadca295cc6045a829001a08860a8c56`.
The actual run reports:

```text
GODODIN_VOXEL_STREAM_QUEUED_EDIT_PASS changed=33 discarded=2
GODODIN_VOXEL_STREAM_EDIT_RETIRE_PASS verify=243
GODODIN_VOXEL_STREAM_REPLAY_PASS radius=6 resident=169 digest=-6073291538211619108 storage_bytes=7276508 rids=338
GODODIN_VOXEL_STREAM_PASS chunks=81 meshed=57 chunks_per_sec=7.11 frame_avg_usec=9730.5 frame_p95_usec=18104.0 driver_avg_usec=51.1 verify=750 readbacks=3 normal_mask=63 edit_voxels=33 edit_settle_usec=762419 fast_speed=80 fast_resident=169 frames=824
GODODIN_VOXEL_STREAM_TEARDOWN_PASS owned_rids=0 storage_bytes=0 staging_bytes=0
```

The Host additionally reports instances=0, owned_foreign_values=0, references=0,
active_callback_scopes=0, host_allocations=0, image_allocations=0. See the complete
[run log](../followups/20260912/run-163af39.log) and
[inspected rendered frame](../followups/20260912/flight-163af39.png).

`./test.sh run` at `577abf2` was stopped with SIGTERM (harness exit241) after
CUA reported that the Mac was locked and could not be unlocked. It is retained
as [unqualified interrupted evidence](../followups/20260912/run-577abf2-interrupted-lock.log),
not a visual pass. The user was asked to unlock the desktop. The subsequent
`15d1cd9` changes are built and pass pure gates; no windowed launch is attempted
while the required access is unavailable.

### Current findings and bounds

All original numbered defects have concrete fixes. Pure regressions resolve
1/3/7–12 at the latest source. The successful `163af39` runtime corroborates
1–6/13–17: full coverage after movement, queued-edit recovery, replay, actual
surface bytes and zero-owner cleanup. The final integrated visual/UI and changed
edit-timing checks remain pending, so this batch is **not yet closed**.

The latest offline eval compares192 replay pairs and192 worker/reference pairs;
all warm allocation counters are0 and teardown_owned_bytes=0. Combined digests
are stable across repeated runs: LOD0 `b4fd7bc140edbe5c`, LOD1
`419ef077b2d44d64`, LOD2 `6b876c3537723538`. Geometry averages are
892.5/450.1/223.0 quads, naive_ratio0.347. Exact border shells reduce geometry
but no longer give the old coarse-LOD CPU savings. Worker peak storage is
11,039,744bytes; native retained storage at radius6 is7,276,508bytes, excluding
worker and engine storage. These are explicit costs.

The cache-only [corrupted-digest negative check](../followups/20260912/offline-digest-corruption.log)
flips one worker digest bit and exits1. Four
[invalid-argument cases](../followups/20260912/offline-invalid-arguments.log)
also exit1. The frozen original receipt is unchanged.

Native storage counters measure current owners, not independently tracked lost
CPU pointers; the reconfigure leak correction additionally rests on reviewed
symmetric frees. Producer allocation measurements exclude staging/Host/engine
copies. Equal-extent staging reuse is source-reviewed. Thread-creation failure
is structurally safe because startup precedes payload allocation; pthread
failure itself was not injected. Full-radius settlement after flight does not
assert no transient missing chunk on every intermediate frame. There is no
GDScript comparison, other-platform evidence or Forward+/Metal qualification.

### Next action

After the user unlocks the Mac, run `./test.sh run` on the accepted `15d1cd9`
source, keep it frontmost, inspect the changed presentation, then run `probe`
and interactive `play` as needed. Verify actual dig/miss/reseed controls, quit
fully, record final `ps`, retain a fresh screenshot and final receipt, and close
all findings against the last relevant integrated source. Do not claim the
new visual treatment or edit timing has passed before that capture.


### Later runner correction and expanded review

While reviewing the other three examples, `b0668ca` corrected the optional empty
argument array in voxel `test.sh play` for macOS Bash 3. The change passes shell
syntax checking; interactive launch remains pending the existing locked-desktop
condition. The final voxel visual and stationary-edit timing assessment above
is unchanged. Bunny Mark, Boid Flock and Slime Colony now have separate dated
reviews, fix commits and follow-up receipts; their limited headless evidence does
not close this voxel batch.

## Final windowed follow-up — 2026-09-12, integration `4a60d02`

The user resumed with “continue (mac is unlocked now)”. This section supersedes
all earlier pending/locked dispositions in this batch; earlier judgments and
receipts remain historical evidence. No example source, generated file or SDK
artifact changed during this capture. The accepted builds and source hashes
match the previous receipts. The existing pure/offline/build checks are reused.

[Windowed receipt](../followups/20260912-windowed/receipt.json) binds the exact
accepted image, source files, toolchain executables, command logs and fresh
screenshots. Every final game and ordinary `play` exit returned 0 with zero
instances, foreign values, references, callback scopes and Host/image allocations.
The final `ps -axo pid=,comm=` check found no Godot process. OpenGL3 remained pinned.
The screenshot controls are actual rendered UI; no artwork was substituted.

CUA selected the live game windows. Some short comparison runs finished before
CUA could return a screenshot, so their engine-generated PNGs were inspected
separately. Two early Bunny field runs lacked live inspection and are retained
as earlier attempts. A CUA observation after one Boid GD run exited reopened the
Project Manager; the runner correctly refused its final process check (exit 1).
That attempt is retained, the extra process was closed, and the unchanged GD
campaign was rerun successfully. No continuous foreground instrumentation or
statistically controlled performance campaign is claimed. CUA call latency also
prevents exact input-to-visible latency claims. Failed CUA screenshots and a
modifier-only flight key refusal were tool limitations, not fabricated UI passes.

### Final dispositions and evidence

All seventeen selected findings are now **resolved within their named contracts**.
The prior pure regressions cover 1/3/7–12. The final actual-runtime gate corroborates
1–6/13–17, including the final presentation/UI and corrected edit-timing changes:

```text
GODODIN_VOXEL_STREAM_QUEUED_EDIT_PASS changed=33 discarded=2
GODODIN_VOXEL_STREAM_EDIT_RETIRE_PASS verify=243
GODODIN_VOXEL_STREAM_REPLAY_PASS radius=6 resident=169 digest=-6073291538211619108 storage_bytes=7276508 rids=338
GODODIN_VOXEL_STREAM_PASS chunks=81 meshed=57 chunks_per_sec=7.12 frame_avg_usec=8148.9 frame_p95_usec=15479.0 driver_avg_usec=42.2 verify=750 readbacks=3 normal_mask=63 edit_voxels=33 edit_settle_usec=40485 fast_speed=80 fast_resident=169 frames=981
GODODIN_VOXEL_STREAM_TEARDOWN_PASS owned_rids=0 storage_bytes=0 staging_bytes=0
```

`./test.sh run` and `./test.sh play` both exited 0. The 750 value counts verification
operations across phases, not 750 distinct resident chunks. Stationary edit
settlement was 40.5 ms in this run; the old artificial 762 ms value stays superseded.
The native scheduling/ownership/AABB contracts remain in
`declarations/voxel_world.odin`; actual surface upload and readback are exercised
by `project/main.gd:126` and `project/stream_eval.gd`.

Live observations: capture and Escape release worked; a second left click while
captured reported “No terrain within 12 blocks” and kept the demo running
(`project/main.gd:183`). Entering seed 20260912 and Generate visibly replaced the
terrain. Radius 3 first displayed “Press Generate to apply the radius,” then settled
at 49 resident / 0 waiting after Generate (`project/main.gd:80`, `:204`). Camera look
and short boosted movement responded. Positive carving and long 80-unit/s flight
are established by the automated run, not claimed as a prolonged manual flight.
Normal close exercises `project/main.gd:220` and ends with all Host owners zero.

[The fresh rendered frame](../followups/20260912-windowed/run.png) shows readable
sun shadows, material variation and atmospheric depth. This is a simple rolling
voxel landscape; the repeated small landforms and pale grass still limit its
artistic interest. No gross missing surface was observed in the inspected views.
Settlement checks and exact border tests do not establish absence of every
transient hole/pop on every frame of arbitrary flight.

| Area | Final verdict |
|---|---|
| Gates | Pure/native tests, offline assertions and final windowed gate pass; normal window exit is clean. |
| Eval honesty | Digest/readback/revision assertions are real, and full-frame cost is distinct from driver cost. Corrected mesh digests form a new series. |
| Engine facts | Exact-dev5 citation checks plus live surface/normal readbacks pass; the one GDScript Dictionary surface call remains an explicit deviation. |
| Code quality | Pure retained workspaces, bounded worker ownership and symmetric native RID teardown now fit the example's claims. |
| README | Claims are bounded to measured allocation domains, real LOD behavior and the actual GL workaround; no absolute transient-hole guarantee. |
| Demo experience | Visibly improved and responsive in the observed flight/edit workload: 8.15 ms mean frame,15.48 ms p95,40.5 ms edit settle on this machine. |

Would it convince a newcomer? **Yes, with the stated bounds:** a substantial pure
worker subsystem and coarse rendering boundary now have visible, interactive
results and executed ownership evidence. The highest-value next improvement is
more varied large-scale terrain composition, preserving the existing frame and
edit budgets; more post-processing is not required to establish the native case.
No selected finding remains open. Other platforms, Forward+/Metal, arbitrary
flight coverage and injected pthread-creation failure remain outside this receipt.