track(dungeon): close Oracle daily-driver parity and save-proof gaps

[scawful]

Goal

Make yaze a practical daily driver for finishing the already-developed Oracle of Secrets dungeons, using a flexible beta bar rather than waiting for every general-purpose editor feature.

Landed foundation

The July object/rendering stack is now on master, including the remaining known F92/FC7/F98/stateful draw cases, state-matrix validation, room-event diagnostics, stream payload checks, and an independent Mesen room-0x012 wall ROI.

Current live validation on vanilla ALTTP and canonical OOS reports:

• 440 objects
• 6,780 size/state cases
• 0 mismatches
• 34 explicitly expected-empty traces

The committed 48x64 Mesen ROI compares all 3,072 RGBA pixels exactly. Message safety PRs #95 and #96 are also merged: clean domains are skipped, writes are preflighted, retry state is preserved, and ASM-owned Oracle expanded messages fail closed.

Landed save/session durability

• Land PR fix(editor): make project and palette sessions durable #114 after exact-head CI and review (exact head f6dec6fca93d3b05214173a9ff8e559ea82a6d0c, merged as 634729c04d717a1d6c7ce31fb633a9cf455cf5d6; 19 success / 3 intentional skips).
  • atomic/no-clobber native and WASM .yaze saves
  • transactional project creation/adoption and rollback
  • stable multi-session ownership/backing files
  • palette dirty/undo/write-range state isolated per GameData
  • lazy ROM reload/rollback palette-session rebinding
  • project-first autosave before ROM mutation

Project/session/palette durability is now on master; the native/WASM no-clobber, transactional creation/adoption, per-session palette state, lazy-reload rebinding, and project-first autosave contracts are landed.

Active dungeon palette slice

• Capture an independent Sanctuary carpet diagnostic from Mesen alongside the existing wall ROI.
• Diagnose the discrepancy as reversed destination-block versus runtime $0F Left/Right 3bpp expansion-slot selection.
• Land PR Fix dungeon graphics palette slot mapping #116 after exact-head CI and review.

PR #116 exact head 4e2b074b4dc17bfa04ef2e0dcc5ea4db8020c4cb mapped destination blocks back to runtime slots, passed the wall ROI and independent carpet pixel plus its updated custom-object render goldens, cleared 19 hosted checks with 3 intentional skips, and merged as ae766ddfa498a15c2a0d5f072702c05b83810ba2.

Daily-driver proof still required

• Land PR feat(dungeon): add safe spawn point persistence #117 for test(dungeon): fence and soak Oracle entrance saves #90: dedicated seven-record spawn-point persistence is strictly audited and merged as 589d2c69a1974e169f2914fc4f5214a179367fd2; the legacy UI view remains read-only/fail-closed until it binds to the dedicated model.
• Land PR fix(editor): harden ROM backup restoration #119 (exact head 5e82013b220ea58742cf7be9626deaee85b21385, merged as 30635c5d2ebbad7376180c0b0d291de29ba523f9; 19 success / 3 intentional skips): backup restoration stages transactionally, rejects dirty/unrelated inputs, remains dirty until explicit Save ROM / Save As, refreshes lazy/active/inactive dungeon state in place, and has a reversible disposable proof.
• Complete a multi-hour GUI editing session.
• Run representative edit/save/reopen/build cycles on OOS rooms, including the D6 set.
• Traverse the edited rooms in Mesen and verify doors, objects, sprites, pots, palettes, and room loads.
• Finish the durable editor-to-Core/message.asm handoff tracked by audit(message): make Oracle message edits durable across rebuilds #88 for expanded Oracle message bodies.

Maintenance and conditional follow-ups

• Separate ROM object-stream identity from RoomObject::LayerType to remove the remaining semantic overload.
• Land PR fix(cli): report dedicated dungeon spawn schema #120 for fix(cli): report the dedicated dungeon spawn schema #118: dedicated spawn CLI reporting and the seven-record discovery bound merged as 9a940d73d59d45b944c65121a957ae1ac7e88787 after its full default-branch matrix passed.
• Add representative independent Mesen ROIs for stateful rare objects after the palette mismatch is fixed.
• Land PR fix(cli): preflight manifest-backed dungeon object writes #122 for fix(cli): preflight growing dungeon object writes with manifest allocator #121: manifest-aware dungeon-place-object dry/write parity, protected-range fencing, and the disposable OOS room 0xA8 relocation/readback proof merged as 4303bac915bb3868e1fd21b168efa7a6c2a3969d.
• Make CLI disk-commit failure rollback and strict-backup semantics explicit under fix(cli): roll back ROM edits when disk commit or required backup fails #123; PR fix(cli): make dungeon writes transactional #124 merged strict destination backups plus whole-ROM rollback for the four dungeon edit commands.
• Expand/repoint the 128-entry pushable-block runtime/WRAM layout only if Oracle content actually needs more than 128 entries.
• Give WASM project creation and raw Save As the same no-clobber semantics as native saves (included in fix(editor): make project and palette sessions durable #114).

Beta exit criteria

• Project/session/palette durability is merged and green across required platforms.
• The confirmed Sanctuary palette discrepancy has an independent passing regression.
• Failed saves leave ROM bytes and retry state intact.
• Backup restore plus sustained GUI use succeeds on disposable Oracle copies.
• Mesen traversal confirms representative edited rooms behave in-game.
• Canonical source ROMs remain unchanged during automated validation.

[scawful]

2026-07-21 implementation update

Two daily-driver slices are now published and under exact-head CI:

• Project/session/palette durability: draft fix(editor): make project and palette sessions durable #114 at 3ed5dc8914f59d09eb127d71fd9d381b54a5cb92. The latest review blockers are fixed: native and WASM raw Save As no longer clobber unrelated descriptors, project creation claims its descriptor before auxiliary directories, and lazy ROM reload/rollback rebinds PaletteManager. Focused integrated tests are green; exact-head CI is running.
• Sanctuary graphics palette parity: draft Fix dungeon graphics palette slot mapping #116 at 62f954b688a401b1d09d1b9d458e2955855e38c0. Root cause was reversed destination-block vs runtime $0F slot mapping during SNES 3bpp Left/Right expansion. Unit mapping tests are 7/7 and independent Mesen-backed room 0x012 wall/carpet checks are 2/2 locally; hosted CI is running.

The next active slice is issue #90's remaining spawn schema/persistence work. Regular entrance persistence is already merged; spawn fields remain fail-closed/read-only until their distinct shared-byte, 16-bit tilemap, and seven-ID model has exact ranges and save/reopen coverage.

[scawful]

Spawn persistence is now published as draft #117 at exact head 419929176ed60926aa599c9f0a3d54bd0baf7d26: dedicated 17-range/33-byte schema, manifest fencing, rollback, 25/25 focused tests, and an OOS 1.68 50-cycle save/reopen pass. Exact-head CI and strict review are running; mutable UI binding remains deliberately separate/read-only.

[scawful]

Exact-head gate update

• fix(editor): make project and palette sessions durable #114 (3ed5dc8914f59d09eb127d71fd9d381b54a5cb92) is fully green and review-clean: 19 pass, 3 intentional skips, 0 pending/failing. It remains draft/unmerged.
• Fix dungeon graphics palette slot mapping #116 moved to 4e2b074b4dc17bfa04ef2e0dcc5ea4db8020c4cb after its stable custom-object goldens were corrected for the intended right-palette expansion. Local palette/custom-object coverage is 19/19; fresh exact-head CI is running.
• feat(dungeon): add safe spawn point persistence #117 moved to d8ca356d4e081dd95765680b4e7b3d58773329c3 with the audit-requested documentation correction. Strict audit found no merge-blocking data-correctness defect; fresh exact-head CI is running.

The next proof lane (backup restoration on disposable copies) is now being audited in parallel.

[scawful]

Backup restoration slice published

Stacked draft #119 is open at exact head 10bdc606356f7380616d81b14b45aa879f154d03 on top of #114. It closes a real restore-path safety gap: restores now reject pending work and unrelated files, load through pointer-stable transactional session replacement, remain dirty until explicit Save ROM, and allow legitimate ROM size changes.

Disposable synthetic backup/edit/restore/save reversal and guard coverage is 5/5 locally; pre-push is green. No canonical Oracle ROM was touched. Strict review and exact-head CI are running.

[scawful]

Backup-restore hardening update:

• PR fix(editor): harden ROM backup restoration #119 exact head is now 668c08b402cbd05a95bbef70216fd1fca0dd28c9.
• Strict re-audit found no remaining merge blocker.
• Staged restores cannot be committed by autosave; only an explicit successful Save ROM / Save As clears the restore-pending state.
• Active/in-memory .labels and the original sidecar identity survive replacement.
• A managed corrupt-backup regression proves failure does not mutate the live ROM.
• Focused suite: 6/6 passed; backup tests repeated 50 times without flake.

PR #119 remains a stacked draft on #114. Its exact-head Claude/WASM jobs are still running, so it is not being called fully green yet.

[scawful]

Daily-driver proof update (canonical source ROM untouched):

• Built the current integration target and ran DungeonPotRepackOosIntegrationTest.AllDailyDriverDomainsSurviveFiftyReopenCycles against the canonical OOS fixture plus its real hack manifest: 1/1 passed, including 50 save/close/reopen cycles across object, sprite, pot, chest, entrance, header/message, and rollback behavior.
• Manifest object-stream inventory is clean: 296 pointers, 0 issues, 32,768 allocator-owned free bytes.
• A disposable CLI probe exposed a narrower non-GUI gap: dungeon-place-object dry-run does not preflight stream capacity and write mode does not consume the manifest COW allocator. On full D6 room 0xA8, write failed closed (Size: 266, Available: 263), with unchanged scratch hash and no backup. Tracked under fix(cli): preflight growing dungeon object writes with manifest allocator #121; the GUI/editor manifest-backed path remains covered and passing.
• Issue fix(cli): report the dedicated dungeon spawn schema #118 is implemented in stacked draft PR fix(cli): report dedicated dungeon spawn schema #120 at 1ca74ac1b221147f7058555c17975c98e24e6a24.

[scawful]

Merge update:

• PR Fix dungeon graphics palette slot mapping #116 merged at exact head 4e2b074b4dc17bfa04ef2e0dcc5ea4db8020c4cb as ae766ddfa498a15c2a0d5f072702c05b83810ba2 after 19 pass / 3 intentional skips / 0 pending or failing checks.
• PR feat(dungeon): add safe spawn point persistence #117 merged at exact head d8ca356d4e081dd95765680b4e7b3d58773329c3 as 589d2c69a1974e169f2914fc4f5214a179367fd2 with the same terminal-green matrix; issue test(dungeon): fence and soak Oracle entrance saves #90 auto-closed.
• Draft PR fix(cli): report dedicated dungeon spawn schema #120 was retargeted to master and reopened solely to trigger the full default-branch pull-request matrix.
• Draft fix(editor): make project and palette sessions durable #114 remains intentionally unmerged; stacked backup-restore PR fix(editor): harden ROM backup restoration #119 remains draft and green on its available exact-head checks.

[scawful]

Object-write follow-up implemented:

• Draft PR fix(cli): preflight manifest-backed dungeon object writes #122 closes fix(cli): preflight growing dungeon object writes with manifest allocator #121 at exact head 06db8d86ea5743551e54dd57e3997c312bbc3d1d.
• dungeon-place-object now accepts an explicit manifest capability, loads the existing object COW layout, and runs the exact save path on an isolated ROM snapshot so dry-run and write have the same capacity/allocation result.
• Unsafe manifestless growth remains fail-closed.
• Focused unit suite: 13/13 passed. Real Oracle D6 room 0xA8 disposable-copy dry-run/write/reopen/untouched-stream integration: 1/1 passed. Pre-push and independent strict review passed.
• PR fix(cli): preflight manifest-backed dungeon object writes #122 is draft with its exact-head full CI now queued; this is a focused D6 proof, not yet the full D6-room-set + Mesen traversal exit criterion.

[scawful]

Wave complete:

• PR fix(cli): report dedicated dungeon spawn schema #120 merged as 9a940d73d59d45b944c65121a957ae1ac7e88787; fix(cli): report the dedicated dungeon spawn schema #118 closed.
• PR fix(cli): preflight manifest-backed dungeon object writes #122 merged from post-sync exact head d2c82b500ad7df1936fb01fd70487faa37eda8b3 as 4303bac915bb3868e1fd21b168efa7a6c2a3969d; fix(cli): preflight growing dungeon object writes with manifest allocator #121 closed.
• PR fix(cli): preflight manifest-backed dungeon object writes #122 exact matrix: 19 pass / 3 intentional skips / 0 pending or failing. Strict audit’s protected-range bypass reproducer is fixed: current stream, allocator, object pointer, door pointer, and ASM-owned bank tests all reject before mutation with unchanged bytes/hash and zero backups. Real-manifest A8 relocation/readback still passes.
• Canonical OOS remains at SHA-256 bd1e34ccf96eacb85f6d0fc5bd0f9c6941dda4d5948f574992407477d0cbd1e4.

Draft #114 and stacked #119 remain intentionally unmerged. The remaining beta-exit work is sustained GUI use, the broader D6 room-set + Mesen traversal, expanded-message ASM handoff, and the documented semantic/UX follow-ups.

[scawful]

Save-contract follow-up is now in draft PR #124 (exact head 6f100d2a5adec5cb8af915b186d17195f20e3a7d): strict required-backup semantics plus whole-ROM rollback around the four dungeon edit commands. Local exact-head build passed; focused ROM/dungeon command coverage is 43/43; pre-push is green. CI is running. This addresses #123 without changing the intentionally held #114/#119 stack. Remaining scope outside #124: other legacy backup=true CLI mutators still need their own transaction audit.

[scawful]

Transactional dungeon-save wave update

• PR fix(cli): make dungeon writes transactional #124 merged exact head 251208e7131e14da6b2e228256b62149005c9429 as 73ddd31a940ef4c1a0cd89c32e9753bd68968598; issue fix(cli): roll back ROM edits when disk commit or required backup fails #123 closed.
• Exact fix(cli): make dungeon writes transactional #124 matrix: 19 pass / 3 intentional skips / 0 pending or failing. Local focused ROM/dungeon coverage was 44/44. The four sprite/object/collision edit commands now roll caller state back unless serialization, a strict destination backup, and atomic target replacement all succeed.
• The next bounded slice is draft PR fix(cli): make dungeon room-property writes transactional #130 at dfcc345c23364ce8c6953c11124d38f9880ad3d4 for fix(cli): make dungeon room-property writes transactional #126. It adds the same transaction contract to room-property writes, loads the real header before mutation, preserves previously dropped raw header bits, and fails object-stream-only layout/floor fields closed instead of reporting a false save. Focused coverage is 15/15 and exact-head CI is running.
• Follow-up gaps are explicitly tracked: legacy best-effort Save As destination backups (fix(rom): make legacy Save As backup protect the destination #125), all-or-nothing track-collision writes (fix(cli): make track-collision writes all-or-nothing #127), collision/water-fill JSON disk persistence (fix(cli): persist collision JSON imports transactionally #128), and safe layout/floor object-stream-header persistence for both CLI and GUI (fix(cli): persist dungeon layout and floor properties in object-stream headers safely #129).
• Intentionally held draft fix(editor): make project and palette sessions durable #114 and stacked fix(editor): harden ROM backup restoration #119 were not retargeted or merged in this wave.

[scawful]

Dungeon daily-driver stabilization wave update (2026-07-22):

• fix(cli): make dungeon room-property writes transactional #130 merged at dfcc345c23364ce8c6953c11124d38f9880ad3d4 (merge 8dbca6c6c182a2a8644fe204e00a4eae80b9cd1d): room-property CLI writes now use loaded headers and strict transactions. Exact-head matrix: 19 passed, 3 intentional skips.
• fix(rom): back up the legacy Save As destination #131 merged at 117480c362883ab78746e2e4db2db1127ba53eb2 (merge 13d42b2b585c3a84a7ebb8cddae2f34bc8ee16d0): legacy Save As now backs up the actual destination. Exact-head matrix: 19 passed, 3 intentional skips.
• fix(cli): make track collision writes all-or-nothing #132 exact head 546f5bc17b86c23500d75b8841603243d35bdd83: transactional track-collision writes; local combined verification passed, hosted exact-head gate still running.
• fix(dungeon): persist layout and floor stream headers #133 exact head 63e33300beb473419e7ae1f9f1f5cd6a3815d910: layout/floor stream-header persistence with alias-aware COW; focused 26/26 and broader 215/215 locally, hosted exact-head gate still running.
• fix(cli): persist collision JSON imports transactionally #135 exact head 87d28d583c016e87d7ede3259ae6b0c952a938d4: transactional collision JSON imports, required backup/rollback, sandbox dirty-state preservation, and report-path safety. Focused 91/91 post-sync; hosted exact-head gate running. Fixes fix(cli): persist collision JSON imports transactionally #128 when merged.
• fix(cli): make collision export paths ROM-alias-safe #134 tracks the remaining pre-existing collision-export --out ROM-alias hazard separately.

No canonical Oracle ROM was modified. #114 and #119 remain intentionally held drafts; this wave does not retarget or merge them.

[scawful]

Train update after #132 landed: PR #132 merged as 9c27218d4764b54428402d997c6cf0b8fe329ce7 after the exact-head matrix finished 19 passed / 3 intentional skips; #127 closed. That master change overlapped the two later branches, so I synced them rather than merging stale compositions. #133 is now exact head 4f7e2972e19b1ca4550de6f5bd01a50f43249c12 with 225/225 combined layout/floor + track/ROM regressions passing locally. #135 is now exact head 0f45ae96fc925f97ff00833d4ab991d25e0813d9 with 114/114 collision JSON + track/ROM/room-property regressions passing locally. Both remain draft while fresh exact-head hosted matrices run.