wip(assembler): M1 round 5 -- native SurfaceWorld manifest delivered into the Unreal Core route

Manifest imported into UVoxelSettings (hash 8933693d9560ba9f), folded into the season
content hash only when Core is on. BuildHost: W1/W8/W16 stable, 2553 surface tiles match
standalone, 432 LOD transitions, collision on all 36 expected tiles. Matched timing
96.8 s native vs 197.3 s bridge (2.04x). Collision support tiles wait for Core region admission.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MmSoF64BbRFmk9C3p1VsBJ

ARCHITECTURE.md

@@ -1157,8 +1157,8 @@ fidelity fallback while a native heightfield with fixed-order noise and per-colu
 caching is developed.
 
 The probe table in the [integration report](Standalone/UNREAL_INTEGRATION_REPORT.md) covers all
-eight generator types, five passage types, four passage styles, and three transitions. Current route
-choices for the next implementation pass:
+eight generator types, five passage types, four passage styles, and three transitions. These are the
+round-4 recommendations; the SurfaceWorld row is superseded by §8.20:
 
 | Field | Recommended Core route | Reason and current gap |
 |---|---|---|
@@ -1172,19 +1172,20 @@ choices for the next implementation pass:
 | Passage types and styles | Keep the generated control-point chains, but preserve each type's radius/floor contract and assert walkability. | The broad chain is already available. Worm and Cascading have solid centerline samples in the current Core audit. |
 | Strate transitions | Implement the three boundary functions in the Core layer field. | Gradient, Hard, and Interleaved produced different owner hashes but the same Core hash in the probe. |
 
-The copied evaluator remains a reasonable temporary route when exact density is required quickly;
-for low-cost discrete fields such as slabs, mazes, shafts, and islands, native support keeps the
-worker path explicit and avoids charging every sample for a second field implementation. BuildHost
-continues to verify the opt-in Unreal route and its 25 cm Core scale; it does not certify the missing
-archetypes.
+The copied evaluator remains a compatibility route when exact density is required and no reviewed
+native manifest is attached. For low-cost discrete fields such as slabs, mazes, shafts, and islands,
+native support keeps the worker path explicit and avoids charging every sample for a second field
+implementation. BuildHost verifies the opt-in Unreal route and its 25 cm Core scale; it does not
+certify the missing archetypes.
 
 **Standalone SurfaceWorld M1 progress (2026-10-09):** `WorldAssemblyManifest` evaluator 4 now
 serializes a finite-strate surface route with stable waypoint IDs, a 0.34 m × 1.76 m player capsule,
 a 15° grade limit and underfoot support constraints. The final composed field must pass a capsule
 sweep before a route candidate is accepted. Cliff shelves carry a two-Core-voxel minimum thickness.
 The route law applies to generation and automatic changes; player carve/fill edits remain unrestricted.
-This is standalone Core evidence; it is not yet connected to the season asset/hash path or reviewed in
-the owner's game.
+At the end of round 4 this was standalone evidence, not yet connected to the settings/content-hash
+path. Round 5 connects the reviewed manifest to `UVoxelSettings`; see §8.20. The owner still needs to
+build and review it in his game.
 
 The round-4 horizon audit traced the false low slab to the LOD8 three-dimensional marching-cubes cap
 surface sampled on a 256-voxel lattice; the Core mesh's cap classification also consulted the legacy
@@ -1195,6 +1196,51 @@ accepts `--frame-limit=1..60`, including while its window is occluded. See
 [`Standalone/ASSEMBLER_M1_REPORT.md`](Standalone/ASSEMBLER_M1_REPORT.md) for the matched up-and-out
 captures, cap tile counts, determinism hashes, route sweep and query/collision readiness split.
 
+### 8.20 Native SurfaceWorld manifest in Unreal — integration round 5
+
+`UVoxelSettings` now owns optional canonical world-assembly JSON plus its Core digest. In the editor,
+`SourceWorldAssemblyManifestJson` selects the reviewed JSON and `ImportWorldAssemblyManifestJson`
+validates, canonicalizes and stores it in the cooked settings asset. Import rejects a recipe seed that
+differs from the effective settings seed. `GetCurrentSeasonContentHash()` includes the assembly
+digest only when `bUseVoxelForgeCore` is enabled; with Core disabled, it returns the existing season
+hash before reading optional assembly data. That keeps the legacy world identity stable on switch-off.
+
+During Core initialization, `FVoxelForgeCoreAdapter` validates the manifest seed and requires each
+planned stratum to match exactly one resolved `SurfaceWorld` slot by stratum index and top/bottom
+chunk bounds. It inserts the canonical manifest and hash into the Core snapshot before the snapshot
+is moved to Core. A missing manifest leaves the existing cave-only Core layout untouched; malformed,
+wrong-seed, unmatched, duplicate or incomplete plans fail initialization. Core workers still receive
+only the immutable resolved snapshot, not UObjects.
+
+Core mesh/collision ordering has one SurfaceWorld-specific guard: a collision-support tile requested
+outside the current desired set is promoted into the next desired rebuild, then deferred until Core
+region compilation admits it. This prevents an early isolated support job from racing the native
+region compile and publishing a tile whose hash differs from the standalone region snapshot. The
+existing `Epoch` and MPSC result paths remain in force, and collision bodies are cooked by Unreal's
+RealtimeMesh/Chaos route on the game side.
+
+BuildHost passed the reviewed manifest `8933693d9560ba9f` (recipe `c37de78b759c0a4c`, plan
+`1ca84619c8600ee5`) with W1/W8/W16 determinism, cave streaming, anchor movement and carve. At the
+surface travel point `(37,165,-2011)` Core voxels, 2,553 expected visual hashes matched independent
+standalone Core output; the check covered 573 local tiles, 3,438 adjacent faces and 432 LOD
+transitions. Collision expectations covered 125 near tiles: all 36 non-empty cases had cooked bodies
+and all 89 empty cases had none. The native field sampler visited 4,096 points over 3,200 voxels and
+found three biome IDs. The complete pass log is under `Saved/BuildHost/HostProject/Plugins/VoxelForge/Saved/CoreWorldValidation/Logs/`.
+
+The switch-off audit was a source-level branch/hash review, not a flag-off actor replay. It confirms
+the legacy generation branch and previous content hash remain unchanged when `bUseVoxelForgeCore`
+is false. Same-session BuildHost timing on the same 2,553 keys with hashes enabled was 96.816887 s
+native versus 197.346153 s through the legacy bridge, including region compilation (2.038× native
+speedup). This is serial headless tile generation. The final actor rerun passed in 9m20s with a
+3.61 GiB peak sampled private working set. The approximately 1.57 s full-view aim is still
+unmet: the last matched 529-tile LOD8 stream took 4.446 s. No viewer benchmark ran in round 5.
+
+The owner handoff sets the manifest on the existing `DA_Settings` asset (seed 0), saves it, and
+enables `AVoxelWorld::bUseVoxelForgeCore`. Coordinates and expected surface/coast/cliff/cap views are
+in [`Standalone/ASSEMBLER_M1_REPORT.md`](Standalone/ASSEMBLER_M1_REPORT.md). BuildHost does not
+replace the owner's project build or visual walk; cap lighting and the pointed native ridge peaks
+remain owner review items.
+
 ## 9. Multiplayer model (listen-server first, dedicated-friendly)
 
 > **Status: transport is DESIGN ONLY — nothing is networked in-tree yet** (no `Replicated`/`HasAuthority`/RPCs; a
@@ -1207,10 +1253,12 @@ captures, cap tile counts, determinism hashes, route sweep and query/collision r
 The world is a pure function of **(seed, strate layout)** (§8.4). So terrain is reconstructed identically
 on every peer from a tiny amount of shared state — it is **never streamed as geometry over the wire**:
 - Replicate the **effective seed + strate layout identity** ONCE (at join). For a cooked season the
-  layout is the reviewed manifest, not a pool shuffle: peers must load the same season asset and compare
-  `AVoxelWorld::GetCurrentSeasonContentHash()` before accepting play. For the legacy path the layout remains
-  deterministic from the effective seed. Every peer then generates terrain locally; geometry never crosses
-  the wire. The transport/RPC that performs this join handshake remains out of tree.
+  layout is the reviewed season manifest; when Core is enabled with a native SurfaceWorld, the
+  reviewed world-assembly digest is also part of `AVoxelWorld::GetCurrentSeasonContentHash()`. Peers
+  compare that active content hash before accepting play. With Core disabled the optional assembly
+  does not change the legacy hash. For the legacy path, layout remains deterministic from the
+  effective seed. Every peer generates terrain locally; geometry never crosses the wire. The
+  transport/RPC that performs this join handshake remains out of tree.
 - The **diff layer is the ONLY non-deterministic terrain state** (§3.9, [[voxelforge-difflayer-threading]])
   → it is the only thing that must sync. Since carving is a minor feature, this traffic is small.