State persistence scope

run-scope-uses-cited-events

Applies when row lifetime is Run.

The run for Row.id begins at Row.scope starts in and ends at Row.scope ends in. Each save, automatic write, timer tick, load, close, or relaunch the adoption can construct does not create either boundary; an unavailable event asserts nothing. The test names the addresses and restates nothing from them.

Given

a distinguishable Row.id value before, during, and after its run

When

• play crosses the attempt start at Row.scope starts in, the run ending at Row.scope ends in, and each save, automatic write, timer tick, load, process close, and relaunch to the same context that the adoption can construct

Then

• the run identity begins only at Row.scope starts in and ends only at Row.scope ends in
• each constructed save, automatic write, timer tick, load, close, and relaunch does not by itself begin or end the run; an event the adoption cannot construct asserts nothing

Diagnostics

• Instance-state-boundary-trace
• Instance-run-identity

session-scope-uses-cited-events

Applies when row lifetime is Session.

The session for Row.id begins at Row.scope starts in, survives each constructible save, automatic write, timer tick, load, pause, background interval, closure, relaunch to the same context, and another family's run boundary, and ends at Row.scope ends in. An unavailable event or run boundary asserts nothing. Its value still needs the declared commit and boundary result to return. The test names the addresses and restates nothing from them.

Given

a distinguishable Row.id value in the session that starts at Row.scope starts in

When

• play pauses, enters the background, crosses each constructed save, automatic write, timer tick, and load, closes, relaunches to the same context, and finally crosses Row.scope ends in
• where the adoption declares a run family, play also crosses that family's run boundary

Then

• pause, background, closure, and relaunch to the same context retain one session identity
• each constructed save, automatic write, timer tick, load, close, and relaunch does not by itself begin or end the session; an event the adoption cannot construct asserts nothing
• crossing a run boundary declared by another family does not by itself end this session; where the adoption declares no run family, this clause asserts nothing
• the session ends only at Row.scope ends in; whether its earlier value returns still follows its commit and boundary results

Diagnostics

• Instance-state-boundary-trace
• Instance-session-identity

copy-carries-complete-identity

Applies for every adoption

A copy of kind Row.id is one coherent accepted commit with save-kind, copy, slot when present, build, and commit identities and the complete family set at Row.contains declared in. The test names the address and restates nothing from it.

Given

one accepted commit of the copy kind named Row.id

When

• the copy is recorded and later considered as a candidate

Then

• the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at Row.contains declared in
• the commit record identifies one coherent accepted write rather than a collection of separately accepted fields

Diagnostics

• Instance-commit-log
• Instance-candidate-set

conflict-has-two-unreplaced-accepted-copies

Applies for every adoption

Row.id is a conflict only for two accepted shared copies in one declared scope that disagree and have not replaced one another. Row.resolution declared in decides the cited facts; this test names the address and restates nothing from it.

Given

candidate pairs inside and outside the conflict scope governed by Row.resolution declared in

When

• the game classifies each pair before reading gameplay state

Then

• a conflict is recorded only when two accepted shared copies in one declared scope disagree and neither has replaced the other
• an unaccepted, agreeing, out-of-scope, or already replaced pair is not recorded as a conflict

Diagnostics

• Instance-candidate-set
• Instance-conflict-report

state-family-follows-maximum-lifetime

Applies when row lifetime is Run or Session or Slot or Profile or Device or Account or Until event or Not kept.

Row.id has a maximum lifetime of Bind maximum scope. Each shorter boundary follows the row's result, and the trace distinguishes a restored value from an equal value derived later. The family definition is at Row.state declared in; the test names the address and restates nothing from it.

Given

Row.id changes from an earlier value to a distinguishable value

When

• the value is read immediately before and after every declared persistence boundary that Instance can construct

Then

• the earlier value affects play for no longer than Bind maximum scope
• a shorter boundary clears it exactly when Row.id's selected boundary result says so
• the trace identifies restoration of the earlier value separately from a later derivation of an equal value

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

until-event-value-ends-at-cited-event

Applies when row lifetime is Until event.

Row.id follows its quit, crash, death, slot-deletion, local-profile-deletion, and device-change results at each boundary the adoption can construct and ends at Row.lifetime event declared in. This test asserts nothing about run or session crossing because an event-bounded value declares no run or session scope. It names the address and restates nothing from it.

Given

a distinguishable Row.id value before the event at Row.lifetime event declared in

When

• play crosses each of quit, crash, death, slot deletion, local-profile deletion, and device change that the adoption can construct, then the cited event; run and session crossing are out of reach because an event-bounded value declares no run or session scope

Then

• each constructed boundary follows Row.id's own row result; a boundary the adoption cannot construct asserts nothing
• the earlier value ends at Row.lifetime event declared in and does not affect later play

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

not-kept-value-never-returns

Applies when row lifetime is Not kept.

The earlier Row.id value never returns after Row.scope ends in. An equal value derived later is recorded as new state. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before Row.scope ends in

When

• play crosses Row.scope ends in and later reaches a point where an equal value can be derived

Then

• the earlier value never returns after the boundary
• the source record distinguishes a later derived equal value as new state

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

slot-and-profile-end-at-cited-event

Applies when row lifetime is Slot or Profile.

The maximum lifetime of Row.id ends at Row.scope ends in. An equal value derived later is new state. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before Row.scope ends in

When

• play crosses the cited lifetime ending

Then

• the earlier value reaches the end of its maximum lifetime at Row.scope ends in and cannot affect later play
• the source record distinguishes an equal value derived later as new state

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

commit-starts-only-at-selected-trigger

Applies when row write trigger is Player save or Checkpoint or Continuous or Timer or Service owned.

A commit for Row.id begins only at Bind trigger under Row.write rule declared in. The test names the address and restates nothing from it.

Given

events around the write rule at Row.write rule declared in

When

• the events occur before, at, and after Bind trigger

Then

• one Row.id commit starts at Bind trigger and Bind negative
• the commit log records which cited event started it

Diagnostics

• Instance-commit-log

commit-loadable-only-after-complete-success

Applies for every adoption

Row.id becomes loadable only when Row.write rule declared in reports success for the complete family set at Row.contains declared in. A failed or partial write leaves the last successful commit in place. The test names both addresses and restates nothing from them.

Given

a last successful Row.id commit and later complete-success, failed, and partial write attempts under Row.write rule declared in

When

• each attempt is followed by a return that requests Row.id

Then

• only the attempt reported successful for the complete set at Row.contains declared in becomes loadable
• a failed or partial attempt never replaces the last successful commit
• the commit and load records distinguish the retained last commit from the rejected attempts

Diagnostics

• Instance-commit-log
• Instance-load-result
• Instance-active-state-source

normal-quit-final-commit-follows-write-rule

Applies for every adoption

On ordinary quit, Row.id makes a final commit only when Row.write rule declared in calls for one. Otherwise the prior successful commit remains last. The test names the address and restates nothing from it.

Given

each ordinary-quit case the adoption can construct for changed Row.id state under Row.write rule declared in

When

• each ordinary quit completes

Then

• where Row.write rule declared in calls for a final commit, exactly one starts
• where the rule does not call for one, no final commit starts and the previous last successful commit remains; an unavailable branch asserts nothing

Diagnostics

• Instance-commit-log

normal-quit-returns-last-commit

Applies when row after normal quit is Returns last commit.

After a normal quit, Row.id returns from the latest successful commit of the copy kind named by saved-in; its uncommitted change does not return. If the row has no saved-in, the restoration clause asserts nothing.

Given

a committed Row.id value followed by a distinguishable uncommitted change

When

• the game quits normally and returns through the same context

Then

• where this family names a copy kind at saved-in, the latest successful commit of that kind restores Row.id and the uncommitted change does not return
• where this family has no saved-in, the restoration clause asserts nothing

Diagnostics

• Instance-commit-log
• Instance-load-result
• Instance-active-state-source

normal-quit-does-not-return

Applies when row after normal quit is Does not return.

After a normal quit, the earlier Row.id value does not return. Its post-quit value follows Row.state declared in, and the record distinguishes that result from restoration. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before a normal quit

When

• the game quits normally and returns through its normal flow

Then

• the earlier value does not become active
• Row.id starts from the post-quit value governed at Row.state declared in
• the source record distinguishes that value from restoration of the earlier value

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

crash-returns-last-commit

Applies when row after crash is Returns last commit.

After a crash, no unfinished commit succeeds. Row.id returns from the last successful commit of the copy kind named by saved-in, without later changes. If the row has no saved-in, the restoration clause asserts nothing.

Given

a committed Row.id value, then a distinguishable change and an unfinished commit

When

• the game crashes and returns through the same context

Then

• the unfinished commit does not succeed
• where this family names a copy kind at saved-in, the last commit completed before the crash restores Row.id and the later change does not return
• where this family has no saved-in, the restoration clause asserts nothing

Diagnostics

• Instance-commit-log
• Instance-load-result
• Instance-active-state-source

crash-does-not-return

Applies when row after crash is Does not return.

After a crash, the earlier Row.id value does not return. Any unfinished commit fails; if none can exist, that clause asserts nothing. Its post-crash value follows Row.state declared in. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value and, where the adoption can construct one, an unfinished commit before a crash

When

• the game crashes and returns through its normal flow

Then

• the earlier value does not become active; where an unfinished commit exists, it does not succeed, and where none can exist that clause asserts nothing
• Row.id starts from the post-crash value governed at Row.state declared in
• the source record distinguishes that value from restoration

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

timer-and-checkpoint-have-crash-loss-window

Applies when row write trigger is Timer or Checkpoint.

Row.id has an explicit possible crash loss window under Row.write rule declared in. The interrupted commit fails, and the report identifies the last successful commit and lost interval. The test names the address and restates nothing from it.

Given

a successful Row.id commit, later changes inside the possible loss window at Row.write rule declared in, and a commit interrupted by a crash

When

• the game returns after the crash

Then

• the interrupted commit does not succeed
• the settlement report identifies the last successful commit and the changes in the cited possible loss window that did not return

Diagnostics

• Instance-commit-log
• Instance-settlement-report

layout-selects-requested-copy

Applies when row layout is One current or Manual slots.

Before activation, Row.id Bind selection under Row.storage rule declared in. Where an earlier commit is retained, it is not another layout; otherwise that clause asserts nothing. The test names the address and restates nothing from it.

Given

the player requests Row.id through the selection route at Row.storage rule declared in and, where the adoption retains one, an earlier commit is also available

When

• selection completes before any state activation

Then

• Row.id Bind selection
• where an earlier commit is retained, it is not treated as another layout choice and remains available only through its matching backup and damage routes; where none is retained, this clause asserts nothing

Diagnostics

• Instance-candidate-set
• Instance-active-state-source

residence-controls-authoritative-candidates

Applies when row residence is Local device or Cloud synced or Server authoritative.

Row.id Bind candidates under Row.storage rule declared in. The test names the address and restates nothing from it.

Given

the candidate sources the adoption can construct for Row.id as governed at Row.storage rule declared in

When

• the game builds the candidate set before conflict handling

Then

• Row.id Bind candidates

Diagnostics

• Instance-candidate-set
• Instance-authority-trace

candidate-identity-precedes-settlement

Applies for every adoption

Row.id reads candidate identity first. An unreadable identity cannot enter conflict handling; no survivor goes directly to the effective damage response; a readable header with an unreadable body reaches damage only after conflict and build comparison.

Given

Row.id candidates with readable identity, unreadable identity, and a readable header with an unreadable gameplay body

When

• the game reads candidate identity before conflict, build, or damage settlement

Then

• save-kind, slot when present, build, and commit identity are read before gameplay state
• an unreadable identity is not a conflict candidate; if no candidate survives, the effective damage response runs immediately without conflict or build comparison
• a readable header with an unreadable body remains a candidate through conflict and build comparison before reaching damage settlement

Diagnostics

• Instance-candidate-set
• Instance-settlement-trace
• Instance-damage-report

missing-conflict-row-runs-no-conflict-response

Applies for every adoption

If Row.id has no matching conflict row, this contract performs no conflict response for it. If it has one, this test asserts nothing.

Given

a candidate set for Row.id

When

• the game looks for a matching copy-conflicts row before build comparison

Then

• where no matching conflict row exists, no candidate is selected, refused, or replaced by a conflict response from this contract
• where a matching row exists, this test asserts nothing

Diagnostics

• Instance-candidate-set
• Instance-settlement-trace

one-kind-conflict-settles-only-named-kind

Applies when row scope is This copy kind.

Row.id settles only Row.copy kind before gameplay state is read. It never merges fields, and state from other copy kinds remains active. Row.resolution declared in governs the conflict; the test names the address and restates nothing from it.

Given

a conflict under Row.id plus non-conflicting active state from another copy kind

When

• the response at Row.resolution declared in runs before gameplay state is read

Then

• only Row.copy kind candidates enter this conflict settlement
• the response chooses or refuses complete copies and never merges fields
• the other copy kind keeps its active value

Diagnostics

• Instance-candidate-set
• Instance-conflict-report
• Instance-active-state-source

all-synced-conflict-settles-whole-set

Applies when row scope is All synced kinds.

Row.id settles every synced copy kind in its declared scope together, before gameplay state is read, and never merges fields. Row.resolution declared in governs the conflict; the test names the address and restates nothing from it.

Given

accepted disagreeing candidates across the synced copy kinds in Row.id's scope

When

• the response at Row.resolution declared in runs before gameplay state is read

Then

• every synced kind in the declared scope enters one settlement
• the response chooses or refuses complete copies and never merges fields

Diagnostics

• Instance-candidate-set
• Instance-conflict-report

conflict-select-by-rule

Applies when row response is Select by rule.

For Row.id, select-by-rule runs before gameplay state is read. The rule at Row.resolution declared in selects one complete copy before activation; only that copy proceeds, and fields are never merged. The test names the address and restates nothing from it.

Given

two accepted complete shared copies that conflict under Row.resolution declared in

When

• the cited selection rule resolves the conflict

Then

• the rule at Row.resolution declared in selects one complete copy before activation
• only the selected copy's complete state can proceed; fields from candidates are never merged

Diagnostics

• Instance-candidate-set
• Instance-conflict-report
• Instance-active-state-source

conflict-player-chooses-copy

Applies when row response is Player chooses copy.

For Row.id, player-chooses-copy runs before gameplay state is read. No candidate state activates before the player chooses one complete copy; the chosen copy proceeds, and fields are never merged. The test names the address and restates nothing from it.

Given

two accepted complete shared copies that conflict under Row.resolution declared in

When

• the player first waits without choosing and then chooses one candidate

Then

• no candidate state activates before the player chooses one complete copy
• the chosen complete copy proceeds and fields from candidates are never merged

Diagnostics

• Instance-candidate-set
• Instance-conflict-report
• Instance-active-state-source

conflict-refuse-until-resolved

Applies when row response is Refuse until resolved.

For Row.id, refuse-until-resolved runs before gameplay state is read. No candidate activates while the conflict remains. After the cited clearing event at Row.resolution declared in, a load of the resulting accepted copy is no longer refused by this conflict. Fields are never merged. The test names the address and restates nothing from it.

Given

two accepted complete shared copies that conflict under Row.resolution declared in

When

• a load is attempted before and after the cited conflict-clearing event

Then

• no candidate activates while the conflict remains
• after the cited clearing event at Row.resolution declared in, a load of the resulting accepted copy is no longer refused by this conflict
• fields are never merged

Diagnostics

• Instance-candidate-set
• Instance-conflict-report
• Instance-active-state-source

older-build-override-refuse-load

Applies when row older build copy is Refuse load.

Row.id overrides the older-build default and refuses before any mismatched-build state activates. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by an older build, with no unresolved conflict

When

• the player requests the copy

Then

• loading stops before any state from the mismatched-build copy activates
• the refusal record distinguishes refusal by build mismatch from an absent or unreadable copy

Diagnostics

• Instance-writer-and-reader-builds
• Instance-load-result
• Instance-active-state-source

older-build-default-refuse-load

Applies when Older build default is Refuse load and row older build copy is Use game default.

Row.id uses the older-build default and refuses before any mismatched-build state activates. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by an older build, with no unresolved conflict

When

• the player requests the copy

Then

• loading stops before any state from the mismatched-build copy activates
• the refusal record distinguishes refusal by build mismatch from an absent or unreadable copy

Diagnostics

• Instance-writer-and-reader-builds
• Instance-load-result
• Instance-active-state-source

older-build-override-convert-and-load

Applies when row older build copy is Convert and load.

Row.id overrides the older-build default and converts to one coherent current-build copy before successful activation; a failed conversion refuses and preserves the source unless its cited rule records otherwise. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by an older build, with no unresolved conflict

When

• one conversion succeeds and a second constructed conversion fails

Then

• the successful conversion produces one coherent current-build copy before all of its carried families activate together
• the failed conversion refuses activation and leaves the source copy unchanged unless its cited rule records another disposition
• the conversion record distinguishes success, refusal, and source-copy disposition

Diagnostics

• Instance-writer-and-reader-builds
• Instance-conversion-result
• Instance-load-result
• Instance-active-state-source

older-build-default-convert-and-load

Applies when Older build default is Convert and load and row older build copy is Use game default.

Row.id uses the older-build default and converts to one coherent current-build copy before successful activation; a failed conversion refuses and preserves the source unless its cited rule records otherwise. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by an older build, with no unresolved conflict

When

• one conversion succeeds and a second constructed conversion fails

Then

• the successful conversion produces one coherent current-build copy before all of its carried families activate together
• the failed conversion refuses activation and leaves the source copy unchanged unless its cited rule records another disposition
• the conversion record distinguishes success, refusal, and source-copy disposition

Diagnostics

• Instance-writer-and-reader-builds
• Instance-conversion-result
• Instance-load-result
• Instance-active-state-source

older-build-override-warn-and-load

Applies when row older build copy is Warn and load.

Row.id overrides the older-build default and warns before the attempt; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by an older build, with no unresolved conflict

When

• the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt

Then

• cancelling activates no state
• the warning precedes both accepted attempts; the successful attempt activates every carried family together and the failed attempt activates none
• warning acceptance is recorded separately from load success

Diagnostics

• Instance-writer-and-reader-builds
• Instance-warning-choice
• Instance-load-result
• Instance-active-state-source

older-build-default-warn-and-load

Applies when Older build default is Warn and load and row older build copy is Use game default.

Row.id uses the older-build default and warns before the attempt; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by an older build, with no unresolved conflict

When

• the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt

Then

• cancelling activates no state
• the warning precedes both accepted attempts; the successful attempt activates every carried family together and the failed attempt activates none
• warning acceptance is recorded separately from load success

Diagnostics

• Instance-writer-and-reader-builds
• Instance-warning-choice
• Instance-load-result
• Instance-active-state-source

newer-build-override-refuse-load

Applies when row newer build copy is Refuse load.

Row.id overrides the newer-build default and refuses before any mismatched-build state activates. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by a newer build, with no unresolved conflict

When

• the player requests the copy

Then

• loading stops before any state from the mismatched-build copy activates
• the refusal record distinguishes refusal from an absent or unreadable copy

Diagnostics

• Instance-writer-and-reader-builds
• Instance-load-result
• Instance-active-state-source

newer-build-default-refuse-load

Applies when Newer build default is Refuse load and row newer build copy is Use game default.

Row.id uses the newer-build default and refuses before any mismatched-build state activates. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by a newer build, with no unresolved conflict

When

• the player requests the copy

Then

• loading stops before any state from the mismatched-build copy activates
• the refusal record distinguishes refusal from an absent or unreadable copy

Diagnostics

• Instance-writer-and-reader-builds
• Instance-load-result
• Instance-active-state-source

newer-build-override-warn-and-load

Applies when row newer build copy is Warn and load.

Row.id overrides the newer-build default and warns before the attempt; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by a newer build, with no unresolved conflict

When

• the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt

Then

• cancelling activates no state
• the warning precedes both accepted attempts; the successful attempt activates every carried family together and the failed attempt activates none
• warning acceptance is recorded separately from load success, and the failed attempt is distinguished from an absent or unreadable copy

Diagnostics

• Instance-writer-and-reader-builds
• Instance-warning-choice
• Instance-load-result
• Instance-active-state-source

newer-build-default-warn-and-load

Applies when Newer build default is Warn and load and row newer build copy is Use game default.

Row.id uses the newer-build default and warns before the attempt; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected readable copy of kind Row.id written by a newer build, with no unresolved conflict

When

• the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt

Then

• cancelling activates no state
• the warning precedes both accepted attempts; the successful attempt activates every carried family together and the failed attempt activates none
• warning acceptance is recorded separately from load success, and the failed attempt is distinguished from an absent or unreadable copy

Diagnostics

• Instance-writer-and-reader-builds
• Instance-warning-choice
• Instance-load-result
• Instance-active-state-source

unreadable-copy-override-refuse-load

Applies when row unreadable copy is Refuse load.

Row.id overrides the unreadable-copy default and refuses the load without activating, replacing, or repairing unreadable state. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the player requests the unreadable copy

Then

• no state from the unreadable copy becomes active
• the unreadable copy is neither replaced nor repaired by this response
• the load result distinguishes refusal from an absent copy

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-default-refuse-load

Applies when Unreadable copy default is Refuse load and row unreadable copy is Use game default.

Row.id uses the unreadable-copy default and refuses the load without activating, replacing, or repairing unreadable state. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the player requests the unreadable copy

Then

• no state from the unreadable copy becomes active
• the unreadable copy is neither replaced nor repaired by this response
• the load result distinguishes refusal from an absent copy

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-override-start-fresh

Applies when row unreadable copy is Start fresh.

Row.id overrides the unreadable-copy default and activates the adoption's fresh state without silently deleting or overwriting the unreadable copy. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the player requests the unreadable copy

Then

• the fresh state fixed by the adoption becomes active instead of state from the unreadable copy
• the unreadable copy is not silently deleted or overwritten
• the source and removal records distinguish a fresh start from deletion

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-default-start-fresh

Applies when Unreadable copy default is Start fresh and row unreadable copy is Use game default.

Row.id uses the unreadable-copy default and activates the adoption's fresh state without silently deleting or overwriting the unreadable copy. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the player requests the unreadable copy

Then

• the fresh state fixed by the adoption becomes active instead of state from the unreadable copy
• the unreadable copy is not silently deleted or overwritten
• the source and removal records distinguish a fresh start from deletion

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-override-restore-earlier-copy

Applies when row unreadable copy is Restore earlier copy.

Row.id overrides the unreadable-copy default and uses the matching backup row to activate the newest usable earlier copy and report the lost interval. Where none can be produced, the result follows the cited recovery rule and activates no state from the unreadable copy. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the supported recovery route selects the newest usable earlier copy under the matching backup row

Then

• the selected earlier copy becomes active as one complete copy
• the damage report identifies the selected earlier commit and the lost interval
• where no usable earlier copy can be produced, the result follows the cited recovery rule and activates no state from the unreadable copy

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-default-restore-earlier-copy

Applies when Unreadable copy default is Restore earlier copy and row unreadable copy is Use game default.

Row.id uses the unreadable-copy default and uses the matching backup row to activate the newest usable earlier copy and report the lost interval. Where none can be produced, the result follows the cited recovery rule and activates no state from the unreadable copy. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the supported recovery route selects the newest usable earlier copy under the matching backup row

Then

• the selected earlier copy becomes active as one complete copy
• the damage report identifies the selected earlier commit and the lost interval
• where no usable earlier copy can be produced, the result follows the cited recovery rule and activates no state from the unreadable copy

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-override-repair-readable-state

Applies when row unreadable copy is Repair readable state.

Row.id overrides the unreadable-copy default and activates one coherent repaired result with every unreadable part reset under the cited rule; failure refuses. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• one repair produces a coherent result and a second constructed repair cannot do so

Then

• the successful repair activates one coherent result containing every readable part and the fresh value for every unreadable part under the cited repair rule
• the failed repair refuses and activates no state
• the repair record distinguishes retained readable parts, reset parts, and failure

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-default-repair-readable-state

Applies when Unreadable copy default is Repair readable state and row unreadable copy is Use game default.

Row.id uses the unreadable-copy default and activates one coherent repaired result with every unreadable part reset under the cited rule; failure refuses. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• one repair produces a coherent result and a second constructed repair cannot do so

Then

• the successful repair activates one coherent result containing every readable part and the fresh value for every unreadable part under the cited repair rule
• the failed repair refuses and activates no state
• the repair record distinguishes retained readable parts, reset parts, and failure

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-override-warn-and-try

Applies when row unreadable copy is Warn and try.

Row.id overrides the unreadable-copy default and waits for an explicit choice; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt

Then

• no copy state activates before the explicit choice and cancellation activates nothing
• the successful accepted attempt activates one coherent copy and the failed accepted attempt activates none
• warning acceptance is recorded separately from load success

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

unreadable-copy-default-warn-and-try

Applies when Unreadable copy default is Warn and try and row unreadable copy is Use game default.

Row.id uses the unreadable-copy default and waits for an explicit choice; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.

Given

a selected copy of kind Row.id whose gameplay body is unreadable after conflict and build settlement

When

• the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt

Then

• no copy state activates before the explicit choice and cancellation activates nothing
• the successful accepted attempt activates one coherent copy and the failed accepted attempt activates none
• warning acceptance is recorded separately from load success

Diagnostics

• Instance-damage-report
• Instance-load-result
• Instance-active-state-source
• Instance-removal-log

backup-retains-orders-and-restores-earlier-copies

Applies for every adoption

Row.id retains and orders earlier copies under Row.backup rule declared in. Its direct player route at Row.restore rule declared in opens the newest usable one and reports the lost interval, independently of damage settlement. The test names both addresses and restates nothing from them.

Given

several earlier commits for the copy kind named by Row.copy kind, including usable and unusable candidates

When

• the game applies Row.backup rule declared in and the player directly uses Row.restore rule declared in

Then

• earlier commits are retained and ordered only as Row.backup rule declared in and the storage rule of the copy kind named at copy-kind provide
• the newest usable earlier copy becomes active as one complete copy and the lost interval is reported
• the direct route at Row.restore rule declared in remains available independently of any damage response

Diagnostics

• Instance-backup-inventory
• Instance-load-result
• Instance-damage-report

readable-compatible-copy-activates-together

Applies for every adoption

A readable, same-build, conflict-free copy of kind Row.id loads successfully and activates every family at Row.contains declared in together from one commit. The test names the address and restates nothing from it.

Given

a selected readable copy of kind Row.id from the running build with no conflict, carrying distinguishable values for every family at Row.contains declared in

When

• the game loads the copy

Then

• the load is accepted rather than refused
• every carried state family activates together from one commit
• no partial copy is visible at any point

Diagnostics

• Instance-load-result
• Instance-active-state-source
• Instance-activation-trace

load-preserves-families-from-other-kinds

Applies for every adoption

Loading Row.id activates its carried families together and preserves the active value of every family saved in another kind. If no other kind exists, that clause asserts nothing.

Given

active distinguishable state from Row.id and, where the adoption declares one, another copy kind

When

• a readable compatible conflict-free copy of kind Row.id loads successfully

Then

• families carried by Row.id activate together from its selected commit
• families saved in another copy kind keep that kind's already active value
• where no other copy kind exists, the second clause asserts nothing

Diagnostics

• Instance-activation-trace
• Instance-active-state-source

family-without-saved-in-is-never-restored

Applies for every adoption

For Row.id, when it has no saved-in, no return path restores its earlier value. For Row.id, when it names saved-in, only an accepted load of that copy kind restores its earlier value; no other return path does.

Given

a distinguishable earlier Row.id value and every return path the adoption can construct

When

• the return paths complete

Then

• where Row.id has no saved-in, none of the return paths restores its earlier value
• where Row.id names saved-in, its earlier value is restored only by an accepted load of that copy kind and by no other return path

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

earlier-point-follows-after-load

Applies when row after load is Resume stays or Resume is used once or Player mode decides.

After successful activation, Row.id returns play to Row.return rule declared in and keeps the run identity when the point is inside a run. Then Bind reuse. The test names the address and restates nothing from it.

Given

an accepted copy of the copy kind Row.copy kind and an earlier point at Row.return rule declared in

When

• activation succeeds and the player attempts the return twice

Then

• continuous play returns to the cited earlier point only after successful activation
• each return the row's after-load result permits retains the same run identity when the point is inside a run
• Bind reuse

Diagnostics

• Instance-load-result
• Instance-return-point
• Instance-run-identity
• Instance-save-availability-after-load

missing-earlier-point-row-returns-nowhere

Applies for every adoption

A successful Row.id load returns continuous play nowhere under this contract when no earlier-point row names it. When one does, this test asserts nothing.

Given

a successful Row.id load

When

• the game checks for an earlier-point-returns row after activation

Then

• where no row names Row.id, this contract returns continuous play to no earlier point
• where a row names Row.id, this test asserts nothing

Diagnostics

• Instance-load-result
• Instance-return-point

earlier-point-mode-gate-controls-existence

Applies when row mode gated is Only in named modes.

Row.id exists only while Row.mode rule declared in permits it. The test asserts nothing about changing the mode mid-profile. It names the address and restates nothing from it.

Given

modes allowed and excluded by Row.mode rule declared in

When

• the player looks for Row.id in each mode before loading

Then

• Row.id exists in every allowed mode and is absent in every excluded mode
• a mode change during an existing profile is outside this declaration and this test asserts nothing about that transition

Diagnostics

• Instance-mode-trace
• Instance-return-point

death-follows-family-result

Applies when row after death is Keeps value or Clears value.

On death, Row.id follows its selected result: Bind result.

Given

a distinguishable Row.id value immediately before death

When

• death settles before any death-triggered copy removal the adoption declares

Then

• Bind result

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

death-at-run-end-clears-run-family

Applies when row lifetime is Run.

If death is the run end at Row.scope ends in, Row.id clears even without a save action. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before a death, where the run ending at Row.scope ends in is death

When

• death occurs without another save action

Then

• if the cited end at Row.scope ends in is death, the earlier run-lifetime value clears before later play even without a save action; if the cited end is not death, this test asserts nothing

Diagnostics

• Instance-state-boundary-trace
• Instance-run-identity

death-at-until-event-clears-family

Applies when row lifetime is Until event.

If death is the event at Row.lifetime event declared in, Row.id clears before later play. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before death

When

• death occurs, where death is the event cited at Row.lifetime event declared in

Then

• if the cited event at Row.lifetime event declared in is death, the earlier value clears before later play; if the cited event is not death, this test asserts nothing

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

slot-deletion-follows-family-result

Applies when row after slot delete is Keeps value or Clears value or No slot.

On slot deletion, Row.id follows its selected result: Bind result.

Given

Bind case

When

• Bind action

Then

• Bind result

Diagnostics

• Instance-state-boundary-trace
• Instance-settlement-report

local-profile-deletion-follows-family-result

Applies when row after local profile delete is Keeps value or Clears value or No profile.

On local-profile deletion, Row.id follows its selected result: Bind result. Where a related profile exists, child slots are included only as the adoption's cited rule provides; otherwise that clause asserts nothing. The test restates nothing from the cited rule.

Given

Bind case

When

• Bind action

Then

• Bind result

Diagnostics

• Instance-state-boundary-trace
• Instance-settlement-report
• Instance-removal-log

device-lifetime-ends-at-device-data-deletion

Applies when row lifetime is Device.

Device-data deletion ends Row.id through Row.scope ends in. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before device-data deletion

When

• the event at Row.scope ends in deletes device data

Then

• the earlier device-lifetime value ends and cannot affect later play

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

account-lifetime-ends-at-account-deletion

Applies when row lifetime is Account.

Account deletion or reset ends Row.id through Row.scope ends in. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value before account deletion or reset

When

• the event at Row.scope ends in deletes or resets the account

Then

• the earlier account-lifetime value ends and cannot affect later play

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

another-device-returns-family

Applies when row on another device is Returns.

On another eligible device, Row.id is obtained from its synced or authoritative copy before activation. Conflict handling still runs and applies the response of the conflict row that matches that copy kind; where no row matches, that clause asserts nothing. The device change does not delete any source-device copy; if none exists, that clause asserts nothing.

Given

a distinguishable Row.id value on one device before the same eligible player continues on another

When

• the new device settles available state

Then

• the family is obtained from its synced or authoritative copy before activation and conflict handling still runs, applying the response of the conflict row that matches that copy kind; where no conflict row matches it, that clause asserts nothing
• any source-device copy is not deleted by the device change; where none exists, this clause asserts nothing

Diagnostics

• Instance-candidate-set
• Instance-conflict-report
• Instance-active-state-source
• Instance-removal-log

another-device-does-not-return-family

Applies when row on another device is Does not return.

On another eligible device, the earlier Row.id value does not return. Its new-device value follows Row.state declared in. The device change does not delete any source-device copy; if none exists, that clause asserts nothing. The test names the address and restates nothing from it.

Given

a distinguishable Row.id value on one device before the same eligible player continues on another

When

• the new device settles available state

Then

• the earlier value does not activate and the family starts from the new-device value governed at Row.state declared in
• any source-device copy is not deleted by the device change; where none exists, this clause asserts nothing

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source
• Instance-removal-log

removed-copy-disappears-at-selected-event

Applies when row removed at is Normal quit or Crash or Death or Slot delete or Local profile delete or Device data delete or Account delete.

At Bind event, Row.id disappears from later load choices Bind order under Row.removal rule declared in. The record distinguishes removal from refusal or failure. The test names the address and restates nothing from it.

Given

a visible Row.id load choice before Bind event

When

• Bind event occurs under Row.removal rule declared in

Then

• the affected copy disappears from later load choices Bind order
• the removal log records the event and distinguishes removal from a refused or failed load

Diagnostics

• Instance-removal-log
• Instance-load-result

copy-kind-mode-gate-controls-existence

Applies when row mode gated is Only in named modes.

Row.id exists only while Row.mode rule declared in permits it. The test asserts nothing about changing the mode mid-profile. It names the address and restates nothing from it.

Given

modes allowed and excluded by Row.mode rule declared in

When

• the player looks for Row.id in each mode

Then

• Row.id exists in every allowed mode and is absent in every excluded mode
• a mode change during an existing profile is outside this declaration and this test asserts nothing about that transition

Diagnostics

• Instance-mode-trace
• Instance-candidate-set

cleared-or-ended-value-never-affects-later-play

Applies for every adoption

After a lifetime ends or a boundary result clears a value, that earlier value never affects later play. An equal value derived later is new state. If no such case can be constructed, the test asserts nothing.

Given

every event the Instance adoption can construct where a lifetime ends or a boundary result clears an earlier value

When

• later play reaches points where an equal value can be derived

Then

• the earlier value never affects later play after the end or clearing event
• any equal value derived later is recorded as new state rather than restoration
• where the adoption can construct no such event, this test asserts nothing

Diagnostics

• Instance-state-boundary-trace
• Instance-active-state-source

settlement-report-is-complete

Applies for every adoption

Every settlement report carries the mechanism's full identity, boundary, commit, selection, response, result, and loss fields. Conflict and damage reports add their required facts and never claim an unattempted success. A clause for a case the adoption cannot construct asserts nothing.

Given

each persistence settlement the Instance adoption can construct

When

• the settlement completes or refuses

Then

• the report identifies state-family id, copy-kind id or its absence, event, scope before and after, last successful commit when read, selected copy and build when loaded, override or default used, state result, and any lost interval
• a conflict report also identifies both candidate commits and the selected response
• a damage report identifies refusal, fresh state, earlier-copy recovery, repaired parts, or warning choice and never claims an unattempted load succeeded
• where a conflict, damage case, load, or answered question does not arise, its corresponding clause asserts nothing

Diagnostics

• Instance-settlement-report
• Instance-conflict-report
• Instance-damage-report

state-family-citation-states-its-duty

Applies for every adoption

This declaration check reads the adoption and cited prose, not the running game. Row.state declared in must name every field in Row.id and every point where it can affect later play. For a family that answers does-not-return after a quit, a crash, or on another device, it must also name the value the family starts from; otherwise that clause asserts nothing. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.state declared in, not the running game

When

• a reviewer checks the citation's meaning

Then

• Row.state declared in names every field in this state family and every point where it can affect later play
• where the row answers does-not-return after a quit, a crash, or on another device, Row.state declared in also names the value the family starts from; where it never gives that answer for those cases, this clause asserts nothing
• another meaning is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

saved-in-joins-a-copy-kind

Applies for every adoption

This declaration check reads the adoption, not the running game. When Row.id has saved-in, it must name exactly one copy kind in this adoption; any other name is a defect this test fails by construction. With no saved-in, this check asserts nothing. It says nothing about a family held in two places at once; one family names one restoring save kind.

Given

the Instance adoption document, not the running game

When

• a reviewer reads Row.id's saved-in field

Then

• where saved-in is present, it names exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction
• where saved-in is absent, this join check asserts nothing

Diagnostics

• Instance-declaration-record

backup-copy-kind-joins

Applies for every adoption

This declaration check reads the adoption, not the running game. Row.copy kind must name exactly one copy kind in this adoption. Any other name is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer compares Row.copy kind with copy-kinds ids

Then

• Row.copy kind names exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

conflict-copy-kind-joins

Applies when row scope is This copy kind.

This declaration check reads the adoption, not the running game. Row.copy kind must name exactly one shared copy kind in this adoption. Any other shape is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer compares Row.copy kind with copy-kinds ids and residences

Then

• Row.copy kind names exactly one cloud-synced or server-authoritative copy-kinds row in this adoption; another shape is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

earlier-point-copy-kind-joins

Applies for every adoption

This declaration check reads the adoption, not the running game. Row.copy kind must name exactly one copy kind in this adoption. Any other name is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer compares Row.copy kind with copy-kinds ids

Then

• Row.copy kind names exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

account-family-names-account-ending

Applies when row lifetime is Account.

This declaration check reads the adoption and cited prose, not the running game. Row.scope ends in must name account deletion or reset. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.scope ends in, not the running game

When

• a reviewer checks the meaning of the cited ending

Then

• Row.scope ends in names account deletion or reset; another meaning is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

restore-earlier-override-has-backup

Applies when row unreadable copy is Restore earlier copy.

This declaration check reads the adoption, not the running game. The Row.id override that restores an earlier copy requires a matching backup row. Absence is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer compares Row.id with backup-copies copy-kind fields

Then

• at least one backup-copies row names Row.id; absence is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

restore-earlier-default-has-backup

Applies when Unreadable copy default is Restore earlier copy and row unreadable copy is Use game default.

This declaration check reads the adoption, not the running game. The Row.id default that restores an earlier copy requires a matching backup row. Absence is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer compares Row.id with backup-copies copy-kind fields

Then

• at least one backup-copies row names Row.id; absence is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

returning-family-uses-shared-authority

Applies when row on another device is Returns.

This declaration check reads the adoption, not the running game. A returning Row.id family must name exactly one cloud-synced or server-authoritative restoring kind. Any other shape is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer follows Row.id's saved-in name to a copy-kinds row

Then

• saved-in is present and names exactly one cloud-synced or server-authoritative copy kind; another shape is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

one-conflict-row-per-scope

Applies for every adoption

This declaration check reads the adoption, not the running game. Each represented conflict scope has at most one row. A duplicate is a defect this test fails by construction. With no conflict rows, the check asserts nothing.

Given

the Instance adoption document, not the running game

When

• a reviewer groups copy-conflicts rows by a this-copy-kind name or the all-synced-kinds scope

Then

• no declared scope has more than one conflict row; a duplicate scope is a defect this test fails by construction; with no conflict rows, this check asserts nothing

Diagnostics

• Instance-declaration-record

one-earlier-point-row-per-copy-kind

Applies for every adoption

This declaration check reads the adoption, not the running game. Each copy kind has at most one earlier-point row. A duplicate is a defect this test fails by construction. With no such rows, the check asserts nothing.

Given

the Instance adoption document, not the running game

When

• a reviewer groups earlier-point-returns rows by copy-kind

Then

• no copy kind is named by more than one earlier-point-returns row; a duplicate is a defect this test fails by construction; with no such rows, this check asserts nothing

Diagnostics

• Instance-declaration-record

copy-citations-state-their-duties

Applies for every adoption

This declaration check reads the adoption and cited prose, not the running game. Row.contains declared in, Row.write rule declared in, and Row.storage rule declared in must state their family-set, write-success and loss-window, and applicable residence, authority, identity, and selection duties. A missing duty is a defect this test fails by construction. The test names the addresses and restates nothing from them.

Given

the Instance adoption and the prose at Row.contains declared in, Row.write rule declared in, and Row.storage rule declared in, not the running game

When

• a reviewer checks each citation's meaning

Then

• Row.contains declared in names the complete family set written and restored together
• Row.write rule declared in names the trigger, success condition, final-write behavior, and quit or crash loss window
• Row.storage rule declared in names residence, applicable sync or service acceptance and authority, layout, identities, and player selection
• a citation missing its duty is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

backup-citations-state-their-duties

Applies for every adoption

This declaration check reads the adoption and cited prose, not the running game. Row.backup rule declared in must state retention, ordering, usable selection, and loss duties; Row.restore rule declared in must state the direct restore route. A missing duty is a defect this test fails by construction. The test names both addresses and restates nothing from them.

Given

the Instance adoption and the prose at Row.backup rule declared in and Row.restore rule declared in, not the running game

When

• a reviewer checks each citation's meaning

Then

• Row.backup rule declared in names retention, ordering, usable selection, and the possible lost interval
• Row.restore rule declared in names the supported direct restore route
• a citation missing its duty is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

conflict-citation-states-its-duties

Applies for every adoption

This declaration check reads the adoption and cited prose, not the running game. Row.resolution declared in must state disagreement, identity, complete-copy handling, and clearing duties. A missing duty is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.resolution declared in, not the running game

When

• a reviewer checks the citation's meaning

Then

• Row.resolution declared in names disagreement detection, identity comparison, complete-copy selection or preservation, and the conflict-clearing event
• a citation missing a duty is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

earlier-return-citation-states-its-duties

Applies for every adoption

This declaration check reads the adoption and cited prose, not the running game. Row.return rule declared in must state the point, activation, run-identity, and reuse duties. A missing duty is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.return rule declared in, not the running game

When

• a reviewer checks the citation's meaning

Then

• Row.return rule declared in names the earlier point, successful activation, run identity when applicable, and whether another load remains possible
• a citation missing a duty is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

copy-removal-citation-states-its-duty

Applies when row removed at is Normal quit or Crash or Death or Slot delete or Local profile delete or Device data delete or Account delete.

This declaration check reads the adoption and cited prose, not the running game. Row.removal rule declared in must state the exact removal event and visible result. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.removal rule declared in, not the running game

When

• a reviewer checks the citation's meaning

Then

• Row.removal rule declared in names the exact removal event and what the player sees afterward
• another meaning is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

copy-mode-citation-states-its-duty

Applies when row mode gated is Only in named modes.

This declaration check reads the adoption and cited prose, not the running game. Row.mode rule declared in must name all allowed modes and confirm absence elsewhere. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.mode rule declared in, not the running game

When

• a reviewer checks the citation's meaning

Then

• Row.mode rule declared in names every mode where the copy kind exists and confirms absence elsewhere
• another meaning is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

player-mode-return-is-mode-gated

Applies when row after load is Player mode decides.

This declaration check reads the adoption, not the running game. Row.id must be mode-gated: only-in-named-modes and cite its mode rule. A player-mode-decides row with no mode gate is a defect this test fails by construction.

Given

the Instance adoption document, not the running game

When

• a reviewer checks the player-mode return's mode gate and mode-rule citation

Then

• Row.id is mode-gated: only-in-named-modes and cites its mode rule; a player-mode-decides row with no mode gate is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

earlier-point-mode-citation-states-its-duty

Applies when row mode gated is Only in named modes.

This declaration check reads the adoption and cited prose, not the running game. Row.mode rule declared in must name all allowed modes and confirm absence elsewhere. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.

Given

the Instance adoption and the prose at Row.mode rule declared in, not the running game

When

• a reviewer checks the citation's meaning

Then

• Row.mode rule declared in names every mode where the earlier point exists and confirms absence elsewhere
• another meaning is a defect this test fails by construction

Diagnostics

• Instance-declaration-record

persistence-holds

Applies for every adoption

Across Inputs scope, each family's value on both sides of every constructed boundary matches its row and the numbered settlement order holds. Every load the adoption can construct refuses partial state and activates all carried families together only when accepted. A case the adoption cannot construct asserts nothing. The pack's default audit seeds apply unless the adoption supplies its own.

Holds

every state family's distinguishable value on both sides of every constructed boundary matched its row; every commit, candidate, conflict, build comparison, damage response, activation, earlier return, deletion, device return, and settlement report that the adoption constructed followed the mechanism's numbered order; every constructed load that was partial or refused activated no state; every accepted load activated all carried families together; where the adoption can construct no load, conflict, damage, build mismatch, or earlier return, that clause asserts nothing

Seeds

Inputs seeds

Scope

Inputs scope

Diagnostics

• Instance-state-boundary-trace
• Instance-commit-log
• Instance-candidate-set
• Instance-settlement-trace
• Instance-load-result
• Instance-active-state-source
• Instance-settlement-report
• Instance-first-ordering-violation