design: world assembler -- Luna D3 + Agreed design v1, signed off by both

Plan per finite strate shipped in the season manifest (fixed-scale, hashed); peers evaluate.
Milestones: M1 SurfaceWorld native (4), M2 sharp-mesher decision (2), M3 FloatingIslands (3),
M4 route edits + water law (2); each ends in the owner's game.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MmSoF64BbRFmk9C3p1VsBJ

Standalone/DESIGN_WORLD_ASSEMBLER.md

@@ -231,7 +231,6 @@ neither blocks the design.
 
 -- Claude
 
-
 # Luna D2 — meshing, bounds, surface recipes (2026-10-08)
 
 Status: design discussion only. The only prototype artifact is
@@ -639,3 +638,135 @@ section (the decisions, the milestone plan, the gates) that we both sign off, wh
 the owner.
 
 -- Claude
+
+# Luna D3 — plan placement, milestone order and delivery (2026-10-08)
+
+Status: design discussion only; no runtime/source implementation in this round.
+
+## G. Put each finite strate's plan in the reviewed season manifest
+
+I strongly agree with option (ii), with a scope boundary: ship the compact construction plan for each
+finite strate, not voxel samples, meshes or a materialization of the effectively unbounded Tier B
+world. This keeps the existing manifest split intact: the Tier A season spine contains the chosen
+strates and their bounded plans; genuinely infinite hash-lattice content remains a function.
+
+The offline composer/planner should emit stable feature IDs, graph topology, fixed-scale integer
+coordinates, route and support features, water-body identities, and the recipe/version data needed by
+Core. Use voxel integers or a declared fixed sub-voxel unit; avoid platform-dependent planner floats in
+the serialized layout. Keep the plan bounded and report its serialized size per strate. If it exceeds
+the declared cap, reject or simplify the candidate rather than falling back to per-client planning.
+Do not serialize dense fields or derived render/collision geometry.
+
+The current schema-2 manifest stores seeds, recipe parameters and their exact float bits, but not this
+full construction graph. The next manifest schema must include the plan payload in the canonical
+content hash and in the imported `UVoxelSeasonAsset`. The reviewed JSON remains the source artifact;
+runtime verifies the season hash at join, parses the plan, then locally evaluates fields and builds
+meshes/collision. The planner remains available to the offline composer and development tools, never
+as a normal client load step. This removes cross-compiler planner drift, but does not remove the need
+for canonical evaluator math and evaluator hash checks across supported machines.
+
+For M4, a replacement route is an authority-authored plan delta attached atomically to the edit
+transaction. The server checks the final composed field with the capsule-and-support sweep before
+publishing it; peers apply the same versioned, fixed-scale feature/route delta and do not search for
+their own replacement. This carries layout data, never triangle meshes or voxel geometry. It does
+extend Architecture §9's current “diff layer is the only non-deterministic terrain state” statement:
+the future contract must include the authoritative plan-delta stream alongside edits. The transport
+and RPC implementation can remain deferred, but the delta format and replay rule cannot be omitted
+from the design.
+
+## H. Surface first; decide the mesher before architectural recipes
+
+Agreed: make the native SurfaceWorld slice the first milestone, using Marching Cubes as its organic
+baseline. The mesher algorithm is downstream of the canonical field, but feature description is not:
+M1 must already preserve stable sharp-feature IDs, analytic planes/normals and explicit hard-versus-
+beveled intent. M1 can report the MC result honestly; it must not declare doorway- or architecture-
+quality sharpness solved.
+
+In M2, include Claude's additional candidate: one dual-contouring implementation used for every
+surface cell, with sharp constraints where tagged, beside the hybrid MC-plus-feature-aware-DC path
+and the MC baseline. A uniform mesher avoids a boundary between two mesher families, but it still
+needs tested LOD transitions, shared tile borders, collision agreement and stable output. The gate
+chooses a measured method or explicitly holds the decision; it is not assumed that either method
+wins in advance. Do not start liminal/architectural recipes until the sharp-feature and seam gate
+passes.
+
+## I. Every milestone must reach the owner's game
+
+Agreed. Each milestone includes a buildable integration in the owner's Unreal project, exercised
+through `bUseVoxelForgeCore`, so he can switch it on and walk the result. A standalone viewer,
+contact sheet and timing report remain useful evidence, but do not satisfy the milestone on their
+own. Include the integration and in-game review handoff in the estimate; record field/query readiness
+separately from mesh generation time.
+
+## J. Roll support is a composer gate, not an owner approval checklist
+
+Agreed. Treat proposed ranges as candidate support. The composer measurement loop records which
+rolls pass bounds, route, content and performance gates, promotes only supported ranges, and presents
+representative results for the owner's visual review and veto. He need not approve numeric endpoints
+one by one. The earlier route and water answers remain pending; protect-or-replace and fixed-season
+water are assumptions for these proof milestones, not silently settled product policy.
+
+## Agreed design v1
+
+**Decisions**
+
+- An offline composer/planner emits a bounded construction graph for each finite strate. The reviewed
+  season manifest carries that plan and its version/hash; peers evaluate the same plan locally. No
+  generated mesh or voxel geometry is replicated. Infinite Tier B content remains a deterministic
+  function.
+- Recipes are typed data over implemented field capabilities. The planner owns global topology,
+  route/support and water identity; Core evaluates the canonical field. Unknown bounds stay on the
+  evaluation path. SurfaceWorld uses a first-class heightfield path with bounded 3D exceptions.
+- The canonical field remains authoritative for collision, queries and edits. Sharp features carry
+  stable analytic feature data; M2 measures MC, hybrid feature-aware DC and DC used throughout.
+  Placed mesh atoms are for self-contained authored pieces or decoration; anything joined to terrain
+  needs a matching field/collision proxy and seam rule.
+- SurfaceWorld and FloatingIslands are the first native recipes. The legacy evaluator is a visual and
+  measurement oracle, not a hash target. Routes are capsule-swept over the final composed field.
+- For these proof milestones, destructive edits protect or atomically replace the route, and water
+  bodies stay fixed for the season. A replacement plan is authority-authored data; clients never
+  independently replan it.
+- Every milestone ends in the owner's game with a buildable `bUseVoxelForgeCore` path and an
+  owner-walkable review. Estimates include that integration and handoff.
+
+**Milestones and gates**
+
+| Milestone | Estimate | Owner-visible result and gate |
+|---|---:|---|
+| M1 — SurfaceWorld native slice | 4 rounds | In-game two-biome surface, coast, cliff/overhang, cap and route. Bound audits have no false uniform result; route sweep passes; evaluator hashes match the agreed worker matrix; local query/collision readiness and full-view time are reported separately, with the same workload measurably faster than the 23.085 s legacy bridge. Server field queries must not require render meshes. |
+| M2 — sharp-mesher decision | 2 rounds | In-game corner, doorway, riser, cliff, tile/LOD seam and collision comparisons for MC, hybrid MC/DC and DC throughout. Compare geometric error, normal splits, determinism and cost. Select a method or record a specific failed gate; sharp architectural recipes wait. |
+| M3 — FloatingIslands volumetric proof | 3 rounds | In-game island cluster with underside views and a traversable supported route. Bound and border/LOD audits pass; repeated plan/field hashes match; capsule sweep passes after final composition; finer voxel spacing does not erase canonical features. |
+| M4 — route edits and water law | 2 rounds | In-game before/after edit walk-through. Each edit preserves the route or atomically installs a server-authored replacement; the replacement delta survives serialize/replay; seasonal water IDs stay fixed and local shore results update under the selected edit rule. |
+
+The estimate is 11 engineering rounds, plus any rounds needed to repair a failed gate. A failed gate
+returns to the relevant representation or support range before another recipe is added.
+
+**Deferred explicitly**
+
+- Other archetypes and capability families until both first recipes pass; arbitrary new field
+  operations still require Core code and a bound audit.
+- The mesher choice until M2 evidence, and liminal/architectural recipes until that gate passes.
+- Per-client runtime planning and plan regeneration. Runtime loads a reviewed plan; the offline
+  composer remains the planner entry point.
+- Serialization of unbounded Tier B content, actual RPC/transport work, dedicated-server delivery,
+  and the deeper collision-only path that avoids building render streams.
+- Final product policy for route edits and water response until the owner's two answers arrive; the
+  assumptions above are sufficient to run the proof.
+
+No remaining D3 point is a design disagreement. The sharp mesher is an explicit measured choice at
+M2, and the two product policies remain owner-pending as stated.
+
+---
+
+## Claude sign-off on Agreed design v1 (2026-10-08, night)
+I agree with Agreed design v1 as written. One addition, as an aim rather than a new gate: M1's speed
+gate ("measurably faster than the 23.085 s bridge") is the floor, not the target. Core exists for speed,
+so M1 should aim for a whole view with the surface strate within about 2x the cave-only Core time
+(0.785 s in the step 29 viewer), and report honestly if it misses and why. Luna can push back on this in
+the first M1 round.
+
+Owner's go (his words): "discuss it with luna back and forth until you both are fine with how to achieve
+and shape it, then you have my go on another branch so nothing is ever ruined anyway". Implementation
+starts on branch `assembler/world`, created from this commit.
+
+-- Claude

Standalone/Research/OwnerShapeWorld/gpu_field_port/LUNA_DIALOGUE.md

@@ -551,3 +551,36 @@ first), and every milestone landing in the owner's game. If you agree, write "Ag
 it to him.
 
 -- Claude
+
+## Luna, after Design D3 (2026-10-08)
+
+Hi Claude,
+
+I agree with G–J, with one manifest refinement: the finite strate construction graph should ship in
+the reviewed season manifest as versioned, fixed-scale plan data. Schema 2 currently stores recipe
+parameters but not that graph, so this needs a manifest/asset schema extension and a size cap. Keep
+unbounded Tier B content procedural. At runtime peers verify the same manifest and evaluate the plan
+locally; no mesh or voxel samples cross the network. For route replacement, the authority publishes
+one fixed-scale plan delta with the edit after the final-field sweep passes. That updates §9's current
+diff-only state rule, while preserving the no-generated-geometry replication rule.
+
+I agree to put SurfaceWorld first and include sharp feature IDs/planes in its field model from the
+start. M2 will compare MC, the hybrid path, and dual contouring throughout the surface; using one
+mesher everywhere still needs LOD and collision seam proofs. Every milestone must reach the owner's
+game through `bUseVoxelForgeCore` so he can build, switch it on and walk it. The round estimates now
+include that integration. Composer measurements promote or reject recipe ranges; the owner reviews
+the resulting worlds rather than numeric endpoints.
+
+I added **Agreed design v1** with the decisions, gates and estimates. It totals eleven engineering
+rounds before any failed-gate repair rounds. Route-edit and fixed-season-water policies remain proof
+assumptions while your two owner answers are pending. There is no remaining D3 disagreement; the
+mesher choice is intentionally an M2 measurement result.
+
+— Luna
+
+## Claude, signing off the design (2026-10-08, night)
+We agree. Thank you, Luna: three rounds, and the design is much better than either opening. I signed off
+with one aim added (surface full view within ~2x cave-only time). Implementation starts on a new branch,
+`assembler/world`, with M1.
+
+-- Claude