Cloud campaign
cloud-campaign · an adoption of State persistence scope, version 1
Use in your game
Opens the authoring tool with these answers and settings already filled in. You still add your game's own rules and tuning.
What is in the ZIP
The ZIP holds the adoption and its acceptance tests. In the authoring tool, choose Add contract and pick this ZIP. If you keep your design as files, put them in contracts/.
The contract behind it
Covers what survives the end of a run or session, a quit, a crash, death, deleting saved data, and moving to another device. It also covers local saves, manual slots, cloud copies, server profiles, backups, conflicts, and version changes. Closed-game time, replay guarantees, file formats, and the shape of saved numbers stay elsewhere.
Questions
The supplied answer is marked on each question. Pick other answers to see what changes. Nothing is saved here: the ZIP and the authoring tool use the supplied answers.
What normally happens when saved state cannot be read?
- Asked when
- the copy kinds list has at least one row.
- If not asked
- No saved copy can be opened later, so unreadable saved state never reaches a load attempt.
Why this is asked
Lost progress is the most visible failure a save system has. Choose the result players should expect first.
What normally happens when an older game build wrote the copy?
- Asked when
- the copy kinds list has at least one row.
- If not asked
- No loadable copy exists, so an older build has no saved state to open.
Why this is asked
Updates can strand a player's progress or change it permanently. Choose how the current build protects that progress.
What normally happens when a newer game build wrote the copy?
- Asked when
- the copy kinds list has at least one row.
- If not asked
- No loadable copy exists, so a newer build has no saved state to open.
Why this is asked
Going back to an older build can erase newer content. Choose whether the player may take that risk.
Numbersno numbers
This contract has no numbers to set.
Rulesno rules
A rule is a check between the numbers. Validation reports a rule that fails.
This contract has no rules between its numbers.
Lists5 lists
Each list holds the rows this adoption supplies. A list can be empty.
State families
state-families
| Id | State declared in | Lifetime | Scope starts in | Scope ends in | Lifetime event declared in | Saved in | After normal quit | After crash | After death | After slot delete | After local profile delete | On another device |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
synced-campaign-progress | campaign.synced-progress-fields | slot | — | cloud.delete-synced-slot | — | synced-campaign-slots | returns-last-commit | returns-last-commit | keeps-value | clears-value | clears-value | returns |
synced-dungeon-attempt | dungeon.synced-attempt-fields | run | dungeon.enter | dungeon.victory-death-or-abandonment | — | synced-quicksave | returns-last-commit | returns-last-commit | clears-value | no-slot | clears-value | returns |
Copy kinds
copy-kinds
| Id | Contains declared in | Write trigger | Write rule declared in | Residence | Layout | Storage rule declared in | Unreadable copy | Older build copy | Newer build copy | Mode gated | Mode rule declared in | Removed at | Removal rule declared in |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
synced-campaign-slots | cloud.campaign-contents | checkpoint | cloud.campaign-commit | cloud-synced | manual-slots | cloud.three-slot-sync | use-game-default | use-game-default | use-game-default | — | — | — | — |
synced-quicksave | cloud.quicksave-contents | player-save | cloud.quicksave-commit | cloud-synced | one-current | cloud.quicksave-sync | warn-and-try | use-game-default | use-game-default | — | — | — | — |
Backup copies
backup-copies
| Id | Copy kind | Backup rule declared in | Restore rule declared in |
|---|---|---|---|
prior-synced-checkpoint | synced-campaign-slots | cloud.prior-checkpoint-policy | menus.restore-prior-cloud-checkpoint |
Copy conflicts
copy-conflicts
| Id | Scope | Copy kind | Response | Resolution declared in |
|---|---|---|---|---|
whole-save-sync | all-synced-kinds | — | player-chooses-copy | menus.choose-device-or-cloud-set |
Earlier point returns
earlier-point-returns
| Id | Copy kind | After load | Return rule declared in | Mode gated | Mode rule declared in |
|---|---|---|---|---|---|
synced-quicksave-retry | synced-quicksave | resume-stays | dungeon.quicksave-reuse | — | — |
Test inputsscope and seeds
Some tests need a scope or seeds from the adoption before they can run.
This adoption supplies none; every test uses its defaults.
Acceptance tests72 tests apply
The contract comes with 85 tests. A test that runs once per row is counted once for each row. Tests that do not apply to these answers are still listed, with the reason.
run-scope-uses-cited-events · synced-dungeon-attempt
synced-dungeon-attempt begins and ends its run only at the cited events
Applies to the synced-dungeon-attempt row.
The run for synced-dungeon-attempt begins at dungeon.enter and ends at dungeon.victory-death-or-abandonment. Each save, automatic write, timer tick, load, close, or relaunch the adoption can construct does not create either boundary; an unavailable event asserts nothing. The test names the addresses and restates nothing from them.
Test steps and diagnostics
- Given
a distinguishable
synced-dungeon-attemptvalue before, during, and after its run- When
- play crosses the attempt start at
dungeon.enter, the run ending atdungeon.victory-death-or-abandonment, and each save, automatic write, timer tick, load, process close, and relaunch to the same context that the adoption can construct
- play crosses the attempt start at
- Then
- the run identity begins only at
dungeon.enterand ends only atdungeon.victory-death-or-abandonment - each constructed save, automatic write, timer tick, load, close, and relaunch does not by itself begin or end the run; an event the adoption cannot construct asserts nothing
- the run identity begins only at
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-run-identity
session-scope-uses-cited-events
Row.id keeps one session through returns to the same context
Does not apply to cloud-campaign: no row in state-families matches lifetime session.
copy-carries-complete-identity · synced-campaign-slots
synced-campaign-slots copies carry complete identity and family membership
Applies to the synced-campaign-slots row.
A copy of kind synced-campaign-slots is one coherent accepted commit with save-kind, copy, slot when present, build, and commit identities and the complete family set at cloud.campaign-contents. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
one accepted commit of the copy kind named
synced-campaign-slots- When
- the copy is recorded and later considered as a candidate
- Then
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
cloud.campaign-contents - the commit record identifies one coherent accepted write rather than a collection of separately accepted fields
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
- Diagnostics
cloud-campaign-commit-logcloud-campaign-candidate-set
copy-carries-complete-identity · synced-quicksave
synced-quicksave copies carry complete identity and family membership
Applies to the synced-quicksave row.
A copy of kind synced-quicksave is one coherent accepted commit with save-kind, copy, slot when present, build, and commit identities and the complete family set at cloud.quicksave-contents. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
one accepted commit of the copy kind named
synced-quicksave- When
- the copy is recorded and later considered as a candidate
- Then
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
cloud.quicksave-contents - the commit record identifies one coherent accepted write rather than a collection of separately accepted fields
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
- Diagnostics
cloud-campaign-commit-logcloud-campaign-candidate-set
conflict-has-two-unreplaced-accepted-copies · whole-save-sync
whole-save-sync is a conflict only for two accepted unreplaced copies
Applies to the whole-save-sync row.
whole-save-sync is a conflict only for two accepted shared copies in one declared scope that disagree and have not replaced one another. menus.choose-device-or-cloud-set decides the cited facts; this test names the address and restates nothing from it.
Test steps and diagnostics
- Given
candidate pairs inside and outside the conflict scope governed by
menus.choose-device-or-cloud-set- When
- the game classifies each pair before reading gameplay state
- Then
- a conflict is recorded only when two accepted shared copies in one declared scope disagree and neither has replaced the other
- an unaccepted, agreeing, out-of-scope, or already replaced pair is not recorded as a conflict
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-conflict-report
state-family-follows-maximum-lifetime · synced-campaign-progress
synced-campaign-progress follows its declared maximum lifetime
Applies to the synced-campaign-progress row.
synced-campaign-progress has a maximum lifetime of one player-selected slot. Each shorter boundary follows the row's result, and the trace distinguishes a restored value from an equal value derived later. The family definition is at campaign.synced-progress-fields; the test names the address and restates nothing from it.
Test steps and diagnostics
- Given
synced-campaign-progresschanges from an earlier value to a distinguishable value- When
- the value is read immediately before and after every declared persistence boundary that
cloud-campaigncan construct
- the value is read immediately before and after every declared persistence boundary that
- Then
- the earlier value affects play for no longer than one player-selected slot
- a shorter boundary clears it exactly when
synced-campaign-progress's selected boundary result says so - the trace identifies restoration of the earlier value separately from a later derivation of an equal value
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
state-family-follows-maximum-lifetime · synced-dungeon-attempt
synced-dungeon-attempt follows its declared maximum lifetime
Applies to the synced-dungeon-attempt row.
synced-dungeon-attempt has a maximum lifetime of one run. Each shorter boundary follows the row's result, and the trace distinguishes a restored value from an equal value derived later. The family definition is at dungeon.synced-attempt-fields; the test names the address and restates nothing from it.
Test steps and diagnostics
- Given
synced-dungeon-attemptchanges from an earlier value to a distinguishable value- When
- the value is read immediately before and after every declared persistence boundary that
cloud-campaigncan construct
- the value is read immediately before and after every declared persistence boundary that
- Then
- the earlier value affects play for no longer than one run
- a shorter boundary clears it exactly when
synced-dungeon-attempt's selected boundary result says so - the trace identifies restoration of the earlier value separately from a later derivation of an equal value
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
until-event-value-ends-at-cited-event
Row.id ends at its cited event
Does not apply to cloud-campaign: no row in state-families matches lifetime until event.
not-kept-value-never-returns
Row.id never returns after its named interruption
Does not apply to cloud-campaign: no row in state-families matches lifetime not kept.
slot-and-profile-end-at-cited-event · synced-campaign-progress
synced-campaign-progress ends at its cited slot boundary
Applies to the synced-campaign-progress row.
The maximum lifetime of synced-campaign-progress ends at cloud.delete-synced-slot. An equal value derived later is new state. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a distinguishable
synced-campaign-progressvalue beforecloud.delete-synced-slot- When
- play crosses the cited lifetime ending
- Then
- the earlier value reaches the end of its maximum lifetime at
cloud.delete-synced-slotand cannot affect later play - the source record distinguishes an equal value derived later as new state
- the earlier value reaches the end of its maximum lifetime at
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
commit-starts-only-at-selected-trigger · synced-campaign-slots
synced-campaign-slots starts a commit only at its selected trigger
Applies to the synced-campaign-slots row.
A commit for synced-campaign-slots begins only at the cited checkpoint event under cloud.campaign-commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
events around the write rule at
cloud.campaign-commit- When
- the events occur before, at, and after the cited checkpoint event
- Then
- one
synced-campaign-slotscommit starts at the cited checkpoint event and no commit starts at a neighboring event - the commit log records which cited event started it
- one
- Diagnostics
cloud-campaign-commit-log
commit-starts-only-at-selected-trigger · synced-quicksave
synced-quicksave starts a commit only at its selected trigger
Applies to the synced-quicksave row.
A commit for synced-quicksave begins only at the cited player save action under cloud.quicksave-commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
events around the write rule at
cloud.quicksave-commit- When
- the events occur before, at, and after the cited player save action
- Then
- one
synced-quicksavecommit starts at the cited player save action and no commit starts at a neighboring event - the commit log records which cited event started it
- one
- Diagnostics
cloud-campaign-commit-log
commit-loadable-only-after-complete-success · synced-campaign-slots
synced-campaign-slots replaces its last commit only after complete success
Applies to the synced-campaign-slots row.
synced-campaign-slots becomes loadable only when cloud.campaign-commit reports success for the complete family set at cloud.campaign-contents. A failed or partial write leaves the last successful commit in place. The test names both addresses and restates nothing from them.
Test steps and diagnostics
- Given
a last successful
synced-campaign-slotscommit and later complete-success, failed, and partial write attempts undercloud.campaign-commit- When
- each attempt is followed by a return that requests
synced-campaign-slots
- each attempt is followed by a return that requests
- Then
- only the attempt reported successful for the complete set at
cloud.campaign-contentsbecomes loadable - a failed or partial attempt never replaces the last successful commit
- the commit and load records distinguish the retained last commit from the rejected attempts
- only the attempt reported successful for the complete set at
- Diagnostics
cloud-campaign-commit-logcloud-campaign-load-resultcloud-campaign-active-state-source
commit-loadable-only-after-complete-success · synced-quicksave
synced-quicksave replaces its last commit only after complete success
Applies to the synced-quicksave row.
synced-quicksave becomes loadable only when cloud.quicksave-commit reports success for the complete family set at cloud.quicksave-contents. A failed or partial write leaves the last successful commit in place. The test names both addresses and restates nothing from them.
Test steps and diagnostics
- Given
a last successful
synced-quicksavecommit and later complete-success, failed, and partial write attempts undercloud.quicksave-commit- When
- each attempt is followed by a return that requests
synced-quicksave
- each attempt is followed by a return that requests
- Then
- only the attempt reported successful for the complete set at
cloud.quicksave-contentsbecomes loadable - a failed or partial attempt never replaces the last successful commit
- the commit and load records distinguish the retained last commit from the rejected attempts
- only the attempt reported successful for the complete set at
- Diagnostics
cloud-campaign-commit-logcloud-campaign-load-resultcloud-campaign-active-state-source
normal-quit-final-commit-follows-write-rule · synced-campaign-slots
synced-campaign-slots makes a final quit commit only when its rule calls for one
Applies to the synced-campaign-slots row.
On ordinary quit, synced-campaign-slots makes a final commit only when cloud.campaign-commit calls for one. Otherwise the prior successful commit remains last. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
each ordinary-quit case the adoption can construct for changed
synced-campaign-slotsstate undercloud.campaign-commit- When
- each ordinary quit completes
- Then
- where
cloud.campaign-commitcalls for a final commit, exactly one starts - where the rule does not call for one, no final commit starts and the previous last successful commit remains; an unavailable branch asserts nothing
- where
- Diagnostics
cloud-campaign-commit-log
normal-quit-final-commit-follows-write-rule · synced-quicksave
synced-quicksave makes a final quit commit only when its rule calls for one
Applies to the synced-quicksave row.
On ordinary quit, synced-quicksave makes a final commit only when cloud.quicksave-commit calls for one. Otherwise the prior successful commit remains last. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
each ordinary-quit case the adoption can construct for changed
synced-quicksavestate undercloud.quicksave-commit- When
- each ordinary quit completes
- Then
- where
cloud.quicksave-commitcalls for a final commit, exactly one starts - where the rule does not call for one, no final commit starts and the previous last successful commit remains; an unavailable branch asserts nothing
- where
- Diagnostics
cloud-campaign-commit-log
normal-quit-returns-last-commit · synced-campaign-progress
synced-campaign-progress returns its last commit after a normal quit
Applies to the synced-campaign-progress row.
After a normal quit, synced-campaign-progress returns from the latest successful commit of the copy kind named by saved-in; its uncommitted change does not return. If the row has no saved-in, the restoration clause asserts nothing.
Test steps and diagnostics
- Given
a committed
synced-campaign-progressvalue followed by a distinguishable uncommitted change- When
- the game quits normally and returns through the same context
- Then
- where this family names a copy kind at saved-in, the latest successful commit of that kind restores
synced-campaign-progressand the uncommitted change does not return - where this family has no saved-in, the restoration clause asserts nothing
- where this family names a copy kind at saved-in, the latest successful commit of that kind restores
- Diagnostics
cloud-campaign-commit-logcloud-campaign-load-resultcloud-campaign-active-state-source
normal-quit-returns-last-commit · synced-dungeon-attempt
synced-dungeon-attempt returns its last commit after a normal quit
Applies to the synced-dungeon-attempt row.
After a normal quit, synced-dungeon-attempt returns from the latest successful commit of the copy kind named by saved-in; its uncommitted change does not return. If the row has no saved-in, the restoration clause asserts nothing.
Test steps and diagnostics
- Given
a committed
synced-dungeon-attemptvalue followed by a distinguishable uncommitted change- When
- the game quits normally and returns through the same context
- Then
- where this family names a copy kind at saved-in, the latest successful commit of that kind restores
synced-dungeon-attemptand the uncommitted change does not return - where this family has no saved-in, the restoration clause asserts nothing
- where this family names a copy kind at saved-in, the latest successful commit of that kind restores
- Diagnostics
cloud-campaign-commit-logcloud-campaign-load-resultcloud-campaign-active-state-source
normal-quit-does-not-return
Row.id does not return after a normal quit
Does not apply to cloud-campaign: no row in state-families matches after-normal-quit does not return.
crash-returns-last-commit · synced-campaign-progress
synced-campaign-progress returns its last completed commit after a crash
Applies to the synced-campaign-progress row.
After a crash, no unfinished commit succeeds. synced-campaign-progress returns from the last successful commit of the copy kind named by saved-in, without later changes. If the row has no saved-in, the restoration clause asserts nothing.
Test steps and diagnostics
- Given
a committed
synced-campaign-progressvalue, then a distinguishable change and an unfinished commit- When
- the game crashes and returns through the same context
- Then
- the unfinished commit does not succeed
- where this family names a copy kind at saved-in, the last commit completed before the crash restores
synced-campaign-progressand the later change does not return - where this family has no saved-in, the restoration clause asserts nothing
- Diagnostics
cloud-campaign-commit-logcloud-campaign-load-resultcloud-campaign-active-state-source
crash-returns-last-commit · synced-dungeon-attempt
synced-dungeon-attempt returns its last completed commit after a crash
Applies to the synced-dungeon-attempt row.
After a crash, no unfinished commit succeeds. synced-dungeon-attempt returns from the last successful commit of the copy kind named by saved-in, without later changes. If the row has no saved-in, the restoration clause asserts nothing.
Test steps and diagnostics
- Given
a committed
synced-dungeon-attemptvalue, then a distinguishable change and an unfinished commit- When
- the game crashes and returns through the same context
- Then
- the unfinished commit does not succeed
- where this family names a copy kind at saved-in, the last commit completed before the crash restores
synced-dungeon-attemptand the later change does not return - where this family has no saved-in, the restoration clause asserts nothing
- Diagnostics
cloud-campaign-commit-logcloud-campaign-load-resultcloud-campaign-active-state-source
crash-does-not-return
Row.id does not return after a crash
Does not apply to cloud-campaign: no row in state-families matches after-crash does not return.
timer-and-checkpoint-have-crash-loss-window · synced-campaign-slots
synced-campaign-slots exposes its possible crash loss window
Applies to the synced-campaign-slots row.
synced-campaign-slots has an explicit possible crash loss window under cloud.campaign-commit. The interrupted commit fails, and the report identifies the last successful commit and lost interval. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a successful
synced-campaign-slotscommit, later changes inside the possible loss window atcloud.campaign-commit, and a commit interrupted by a crash- When
- the game returns after the crash
- Then
- the interrupted commit does not succeed
- the settlement report identifies the last successful commit and the changes in the cited possible loss window that did not return
- Diagnostics
cloud-campaign-commit-logcloud-campaign-settlement-report
layout-selects-requested-copy · synced-campaign-slots
synced-campaign-slots selects its requested copy before activation
Applies to the synced-campaign-slots row.
Before activation, synced-campaign-slots selects the player's named slot with its stable slot identity under cloud.three-slot-sync. Where an earlier commit is retained, it is not another layout; otherwise that clause asserts nothing. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the player requests
synced-campaign-slotsthrough the selection route atcloud.three-slot-syncand, where the adoption retains one, an earlier commit is also available- When
- selection completes before any state activation
- Then
synced-campaign-slotsselects the player's named slot with its stable slot identity- where an earlier commit is retained, it is not treated as another layout choice and remains available only through its matching backup and damage routes; where none is retained, this clause asserts nothing
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-active-state-source
layout-selects-requested-copy · synced-quicksave
synced-quicksave selects its requested copy before activation
Applies to the synced-quicksave row.
Before activation, synced-quicksave selects its current copy and presents no player-selected slot under cloud.quicksave-sync. Where an earlier commit is retained, it is not another layout; otherwise that clause asserts nothing. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the player requests
synced-quicksavethrough the selection route atcloud.quicksave-syncand, where the adoption retains one, an earlier commit is also available- When
- selection completes before any state activation
- Then
synced-quicksaveselects its current copy and presents no player-selected slot- where an earlier commit is retained, it is not treated as another layout choice and remains available only through its matching backup and damage routes; where none is retained, this clause asserts nothing
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-active-state-source
residence-controls-authoritative-candidates · synced-campaign-slots
synced-campaign-slots obtains candidates from its declared residence
Applies to the synced-campaign-slots row.
synced-campaign-slots obtains every accepted device and cloud candidate before conflict handling under cloud.three-slot-sync. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the candidate sources the adoption can construct for
synced-campaign-slotsas governed atcloud.three-slot-sync- When
- the game builds the candidate set before conflict handling
- Then
synced-campaign-slotsobtains every accepted device and cloud candidate before conflict handling
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-authority-trace
residence-controls-authoritative-candidates · synced-quicksave
synced-quicksave obtains candidates from its declared residence
Applies to the synced-quicksave row.
synced-quicksave obtains every accepted device and cloud candidate before conflict handling under cloud.quicksave-sync. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the candidate sources the adoption can construct for
synced-quicksaveas governed atcloud.quicksave-sync- When
- the game builds the candidate set before conflict handling
- Then
synced-quicksaveobtains every accepted device and cloud candidate before conflict handling
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-authority-trace
candidate-identity-precedes-settlement · synced-campaign-slots
synced-campaign-slots reads candidate identity before settlement
Applies to the synced-campaign-slots row.
synced-campaign-slots reads candidate identity first. An unreadable identity cannot enter conflict handling; no survivor goes directly to the effective damage response; a readable header with an unreadable body reaches damage only after conflict and build comparison.
Test steps and diagnostics
- Given
synced-campaign-slotscandidates with readable identity, unreadable identity, and a readable header with an unreadable gameplay body- When
- the game reads candidate identity before conflict, build, or damage settlement
- Then
- save-kind, slot when present, build, and commit identity are read before gameplay state
- an unreadable identity is not a conflict candidate; if no candidate survives, the effective damage response runs immediately without conflict or build comparison
- a readable header with an unreadable body remains a candidate through conflict and build comparison before reaching damage settlement
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-settlement-tracecloud-campaign-damage-report
candidate-identity-precedes-settlement · synced-quicksave
synced-quicksave reads candidate identity before settlement
Applies to the synced-quicksave row.
synced-quicksave reads candidate identity first. An unreadable identity cannot enter conflict handling; no survivor goes directly to the effective damage response; a readable header with an unreadable body reaches damage only after conflict and build comparison.
Test steps and diagnostics
- Given
synced-quicksavecandidates with readable identity, unreadable identity, and a readable header with an unreadable gameplay body- When
- the game reads candidate identity before conflict, build, or damage settlement
- Then
- save-kind, slot when present, build, and commit identity are read before gameplay state
- an unreadable identity is not a conflict candidate; if no candidate survives, the effective damage response runs immediately without conflict or build comparison
- a readable header with an unreadable body remains a candidate through conflict and build comparison before reaching damage settlement
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-settlement-tracecloud-campaign-damage-report
missing-conflict-row-runs-no-conflict-response · synced-campaign-slots
synced-campaign-slots has no conflict response without a matching row
Applies to the synced-campaign-slots row.
If synced-campaign-slots has no matching conflict row, this contract performs no conflict response for it. If it has one, this test asserts nothing.
Test steps and diagnostics
- Given
a candidate set for
synced-campaign-slots- When
- the game looks for a matching copy-conflicts row before build comparison
- Then
- where no matching conflict row exists, no candidate is selected, refused, or replaced by a conflict response from this contract
- where a matching row exists, this test asserts nothing
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-settlement-trace
missing-conflict-row-runs-no-conflict-response · synced-quicksave
synced-quicksave has no conflict response without a matching row
Applies to the synced-quicksave row.
If synced-quicksave has no matching conflict row, this contract performs no conflict response for it. If it has one, this test asserts nothing.
Test steps and diagnostics
- Given
a candidate set for
synced-quicksave- When
- the game looks for a matching copy-conflicts row before build comparison
- Then
- where no matching conflict row exists, no candidate is selected, refused, or replaced by a conflict response from this contract
- where a matching row exists, this test asserts nothing
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-settlement-trace
one-kind-conflict-settles-only-named-kind
Row.id settles only Row.copy kind
Does not apply to cloud-campaign: no row in copy-conflicts matches scope this copy kind.
all-synced-conflict-settles-whole-set · whole-save-sync
whole-save-sync settles every synced kind together
Applies to the whole-save-sync row.
whole-save-sync settles every synced copy kind in its declared scope together, before gameplay state is read, and never merges fields. menus.choose-device-or-cloud-set governs the conflict; the test names the address and restates nothing from it.
Test steps and diagnostics
- Given
accepted disagreeing candidates across the synced copy kinds in
whole-save-sync's scope- When
- the response at
menus.choose-device-or-cloud-setruns before gameplay state is read
- the response at
- Then
- every synced kind in the declared scope enters one settlement
- the response chooses or refuses complete copies and never merges fields
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-conflict-report
conflict-select-by-rule
Row.id applies select-by-rule
Does not apply to cloud-campaign: no row in copy-conflicts matches response select by rule.
conflict-player-chooses-copy · whole-save-sync
whole-save-sync applies player-chooses-copy
Applies to the whole-save-sync row.
For whole-save-sync, player-chooses-copy runs before gameplay state is read. No candidate state activates before the player chooses one complete copy; the chosen copy proceeds, and fields are never merged. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
two accepted complete shared copies that conflict under
menus.choose-device-or-cloud-set- When
- the player first waits without choosing and then chooses one candidate
- Then
- no candidate state activates before the player chooses one complete copy
- the chosen complete copy proceeds and fields from candidates are never merged
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-conflict-reportcloud-campaign-active-state-source
conflict-refuse-until-resolved
Row.id applies refuse-until-resolved
Does not apply to cloud-campaign: no row in copy-conflicts matches response refuse until resolved.
older-build-override-refuse-load
Row.id applies its older-build refuse-load override
Does not apply to cloud-campaign: no row in copy-kinds matches older-build-copy refuse load.
older-build-default-refuse-load
Row.id applies the older-build refuse-load default
Does not apply to cloud-campaign: older build default is convert and load, not refuse load.
older-build-override-convert-and-load
Row.id applies its older-build convert-and-load override
Does not apply to cloud-campaign: no row in copy-kinds matches older-build-copy convert and load.
older-build-default-convert-and-load · synced-campaign-slots
synced-campaign-slots applies the older-build convert-and-load default
Applies to the synced-campaign-slots row.
synced-campaign-slots uses the older-build default and converts to one coherent current-build copy before successful activation; a failed conversion refuses and preserves the source unless its cited rule records otherwise. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of kind
synced-campaign-slotswritten by an older build, with no unresolved conflict- When
- one conversion succeeds and a second constructed conversion fails
- Then
- the successful conversion produces one coherent current-build copy before all of its carried families activate together
- the failed conversion refuses activation and leaves the source copy unchanged unless its cited rule records another disposition
- the conversion record distinguishes success, refusal, and source-copy disposition
- Diagnostics
cloud-campaign-writer-and-reader-buildscloud-campaign-conversion-resultcloud-campaign-load-resultcloud-campaign-active-state-source
older-build-default-convert-and-load · synced-quicksave
synced-quicksave applies the older-build convert-and-load default
Applies to the synced-quicksave row.
synced-quicksave uses the older-build default and converts to one coherent current-build copy before successful activation; a failed conversion refuses and preserves the source unless its cited rule records otherwise. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of kind
synced-quicksavewritten by an older build, with no unresolved conflict- When
- one conversion succeeds and a second constructed conversion fails
- Then
- the successful conversion produces one coherent current-build copy before all of its carried families activate together
- the failed conversion refuses activation and leaves the source copy unchanged unless its cited rule records another disposition
- the conversion record distinguishes success, refusal, and source-copy disposition
- Diagnostics
cloud-campaign-writer-and-reader-buildscloud-campaign-conversion-resultcloud-campaign-load-resultcloud-campaign-active-state-source
older-build-override-warn-and-load
Row.id applies its older-build warn-and-load override
Does not apply to cloud-campaign: no row in copy-kinds matches older-build-copy warn and load.
older-build-default-warn-and-load
Row.id applies the older-build warn-and-load default
Does not apply to cloud-campaign: older build default is convert and load, not warn and load.
newer-build-override-refuse-load
Row.id applies its newer-build refuse-load override
Does not apply to cloud-campaign: no row in copy-kinds matches newer-build-copy refuse load.
newer-build-default-refuse-load · synced-campaign-slots
synced-campaign-slots applies the newer-build refuse-load default
Applies to the synced-campaign-slots row.
synced-campaign-slots uses the newer-build default and refuses before any mismatched-build state activates. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of kind
synced-campaign-slotswritten by a newer build, with no unresolved conflict- When
- the player requests the copy
- Then
- loading stops before any state from the mismatched-build copy activates
- the refusal record distinguishes refusal from an absent or unreadable copy
- Diagnostics
cloud-campaign-writer-and-reader-buildscloud-campaign-load-resultcloud-campaign-active-state-source
newer-build-default-refuse-load · synced-quicksave
synced-quicksave applies the newer-build refuse-load default
Applies to the synced-quicksave row.
synced-quicksave uses the newer-build default and refuses before any mismatched-build state activates. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of kind
synced-quicksavewritten by a newer build, with no unresolved conflict- When
- the player requests the copy
- Then
- loading stops before any state from the mismatched-build copy activates
- the refusal record distinguishes refusal from an absent or unreadable copy
- Diagnostics
cloud-campaign-writer-and-reader-buildscloud-campaign-load-resultcloud-campaign-active-state-source
newer-build-override-warn-and-load
Row.id applies its newer-build warn-and-load override
Does not apply to cloud-campaign: no row in copy-kinds matches newer-build-copy warn and load.
newer-build-default-warn-and-load
Row.id applies the newer-build warn-and-load default
Does not apply to cloud-campaign: newer build default is refuse load, not warn and load.
unreadable-copy-override-refuse-load
Row.id applies its unreadable-copy refuse-load override
Does not apply to cloud-campaign: no row in copy-kinds matches unreadable-copy refuse load.
unreadable-copy-default-refuse-load
Row.id applies the unreadable-copy refuse-load default
Does not apply to cloud-campaign: unreadable copy default is restore earlier copy, not refuse load.
unreadable-copy-override-start-fresh
Row.id applies its unreadable-copy start-fresh override
Does not apply to cloud-campaign: no row in copy-kinds matches unreadable-copy start fresh.
unreadable-copy-default-start-fresh
Row.id applies the unreadable-copy start-fresh default
Does not apply to cloud-campaign: unreadable copy default is restore earlier copy, not start fresh.
unreadable-copy-override-restore-earlier-copy
Row.id applies its unreadable-copy restore-earlier-copy override
Does not apply to cloud-campaign: no row in copy-kinds matches unreadable-copy restore earlier copy.
unreadable-copy-default-restore-earlier-copy · synced-campaign-slots
synced-campaign-slots applies the unreadable-copy restore-earlier-copy default
Applies to the synced-campaign-slots row.
synced-campaign-slots uses the unreadable-copy default and uses the matching backup row to activate the newest usable earlier copy and report the lost interval. Where none can be produced, the result follows the cited recovery rule and activates no state from the unreadable copy. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected copy of kind
synced-campaign-slotswhose gameplay body is unreadable after conflict and build settlement- When
- the supported recovery route selects the newest usable earlier copy under the matching backup row
- Then
- the selected earlier copy becomes active as one complete copy
- the damage report identifies the selected earlier commit and the lost interval
- where no usable earlier copy can be produced, the result follows the cited recovery rule and activates no state from the unreadable copy
- Diagnostics
cloud-campaign-damage-reportcloud-campaign-load-resultcloud-campaign-active-state-sourcecloud-campaign-removal-log
unreadable-copy-override-repair-readable-state
Row.id applies its unreadable-copy repair-readable-state override
Does not apply to cloud-campaign: no row in copy-kinds matches unreadable-copy repair readable state.
unreadable-copy-default-repair-readable-state
Row.id applies the unreadable-copy repair-readable-state default
Does not apply to cloud-campaign: unreadable copy default is restore earlier copy, not repair readable state.
unreadable-copy-override-warn-and-try · synced-quicksave
synced-quicksave applies its unreadable-copy warn-and-try override
Applies to the synced-quicksave row.
synced-quicksave overrides the unreadable-copy default and waits for an explicit choice; cancellation activates nothing, and acceptance is recorded separately from success. The observable consequence is fixed here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected copy of kind
synced-quicksavewhose gameplay body is unreadable after conflict and build settlement- When
- the player first cancels the warning, then accepts a successful attempt, and finally accepts a constructed failed attempt
- Then
- no copy state activates before the explicit choice and cancellation activates nothing
- the successful accepted attempt activates one coherent copy and the failed accepted attempt activates none
- warning acceptance is recorded separately from load success
- Diagnostics
cloud-campaign-damage-reportcloud-campaign-load-resultcloud-campaign-active-state-sourcecloud-campaign-removal-log
unreadable-copy-default-warn-and-try
Row.id applies the unreadable-copy warn-and-try default
Does not apply to cloud-campaign: unreadable copy default is restore earlier copy, not warn and try.
backup-retains-orders-and-restores-earlier-copies · prior-synced-checkpoint
prior-synced-checkpoint retains and restores earlier copies
Applies to the prior-synced-checkpoint row.
prior-synced-checkpoint retains and orders earlier copies under cloud.prior-checkpoint-policy. Its direct player route at menus.restore-prior-cloud-checkpoint opens the newest usable one and reports the lost interval, independently of damage settlement. The test names both addresses and restates nothing from them.
Test steps and diagnostics
- Given
several earlier commits for the copy kind named by
synced-campaign-slots, including usable and unusable candidates- When
- the game applies
cloud.prior-checkpoint-policyand the player directly usesmenus.restore-prior-cloud-checkpoint
- the game applies
- Then
- earlier commits are retained and ordered only as
cloud.prior-checkpoint-policyand the storage rule of the copy kind named at copy-kind provide - the newest usable earlier copy becomes active as one complete copy and the lost interval is reported
- the direct route at
menus.restore-prior-cloud-checkpointremains available independently of any damage response
- earlier commits are retained and ordered only as
- Diagnostics
cloud-campaign-backup-inventorycloud-campaign-load-resultcloud-campaign-damage-report
readable-compatible-copy-activates-together · synced-campaign-slots
synced-campaign-slots loads a readable compatible conflict-free copy
Applies to the synced-campaign-slots row.
A readable, same-build, conflict-free copy of kind synced-campaign-slots loads successfully and activates every family at cloud.campaign-contents together from one commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a selected readable copy of kind
synced-campaign-slotsfrom the running build with no conflict, carrying distinguishable values for every family atcloud.campaign-contents- When
- the game loads the copy
- Then
- the load is accepted rather than refused
- every carried state family activates together from one commit
- no partial copy is visible at any point
- Diagnostics
cloud-campaign-load-resultcloud-campaign-active-state-sourcecloud-campaign-activation-trace
readable-compatible-copy-activates-together · synced-quicksave
synced-quicksave loads a readable compatible conflict-free copy
Applies to the synced-quicksave row.
A readable, same-build, conflict-free copy of kind synced-quicksave loads successfully and activates every family at cloud.quicksave-contents together from one commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a selected readable copy of kind
synced-quicksavefrom the running build with no conflict, carrying distinguishable values for every family atcloud.quicksave-contents- When
- the game loads the copy
- Then
- the load is accepted rather than refused
- every carried state family activates together from one commit
- no partial copy is visible at any point
- Diagnostics
cloud-campaign-load-resultcloud-campaign-active-state-sourcecloud-campaign-activation-trace
load-preserves-families-from-other-kinds · synced-campaign-slots
loading synced-campaign-slots preserves state from other copy kinds
Applies to the synced-campaign-slots row.
Loading synced-campaign-slots activates its carried families together and preserves the active value of every family saved in another kind. If no other kind exists, that clause asserts nothing.
Test steps and diagnostics
- Given
active distinguishable state from
synced-campaign-slotsand, where the adoption declares one, another copy kind- When
- a readable compatible conflict-free copy of kind
synced-campaign-slotsloads successfully
- a readable compatible conflict-free copy of kind
- Then
- families carried by
synced-campaign-slotsactivate together from its selected commit - families saved in another copy kind keep that kind's already active value
- where no other copy kind exists, the second clause asserts nothing
- families carried by
- Diagnostics
cloud-campaign-activation-tracecloud-campaign-active-state-source
load-preserves-families-from-other-kinds · synced-quicksave
loading synced-quicksave preserves state from other copy kinds
Applies to the synced-quicksave row.
Loading synced-quicksave activates its carried families together and preserves the active value of every family saved in another kind. If no other kind exists, that clause asserts nothing.
Test steps and diagnostics
- Given
active distinguishable state from
synced-quicksaveand, where the adoption declares one, another copy kind- When
- a readable compatible conflict-free copy of kind
synced-quicksaveloads successfully
- a readable compatible conflict-free copy of kind
- Then
- families carried by
synced-quicksaveactivate together from its selected commit - families saved in another copy kind keep that kind's already active value
- where no other copy kind exists, the second clause asserts nothing
- families carried by
- Diagnostics
cloud-campaign-activation-tracecloud-campaign-active-state-source
family-without-saved-in-is-never-restored · synced-campaign-progress
synced-campaign-progress is never restored when it names no save kind
Applies to the synced-campaign-progress row.
For synced-campaign-progress, when it has no saved-in, no return path restores its earlier value. For synced-campaign-progress, when it names saved-in, only an accepted load of that copy kind restores its earlier value; no other return path does.
Test steps and diagnostics
- Given
a distinguishable earlier
synced-campaign-progressvalue and every return path the adoption can construct- When
- the return paths complete
- Then
- where
synced-campaign-progresshas no saved-in, none of the return paths restores its earlier value - where
synced-campaign-progressnames saved-in, its earlier value is restored only by an accepted load of that copy kind and by no other return path
- where
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
family-without-saved-in-is-never-restored · synced-dungeon-attempt
synced-dungeon-attempt is never restored when it names no save kind
Applies to the synced-dungeon-attempt row.
For synced-dungeon-attempt, when it has no saved-in, no return path restores its earlier value. For synced-dungeon-attempt, when it names saved-in, only an accepted load of that copy kind restores its earlier value; no other return path does.
Test steps and diagnostics
- Given
a distinguishable earlier
synced-dungeon-attemptvalue and every return path the adoption can construct- When
- the return paths complete
- Then
- where
synced-dungeon-attempthas no saved-in, none of the return paths restores its earlier value - where
synced-dungeon-attemptnames saved-in, its earlier value is restored only by an accepted load of that copy kind and by no other return path
- where
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
earlier-point-follows-after-load · synced-quicksave-retry
synced-quicksave-retry follows its after-load result
Applies to the synced-quicksave-retry row.
After successful activation, synced-quicksave-retry returns play to dungeon.quicksave-reuse and keeps the run identity when the point is inside a run. Then both successful returns go to the same earlier point, which remains available after the first return. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
an accepted copy of the copy kind
synced-quicksaveand an earlier point atdungeon.quicksave-reuse- When
- activation succeeds and the player attempts the return twice
- Then
- continuous play returns to the cited earlier point only after successful activation
- each return the row's after-load result permits retains the same run identity when the point is inside a run
- both successful returns go to the same earlier point, which remains available after the first return
- Diagnostics
cloud-campaign-load-resultcloud-campaign-return-pointcloud-campaign-run-identitycloud-campaign-save-availability-after-load
missing-earlier-point-row-returns-nowhere · synced-campaign-slots
synced-campaign-slots returns nowhere without an earlier-point row
Applies to the synced-campaign-slots row.
A successful synced-campaign-slots load returns continuous play nowhere under this contract when no earlier-point row names it. When one does, this test asserts nothing.
Test steps and diagnostics
- Given
a successful
synced-campaign-slotsload- When
- the game checks for an earlier-point-returns row after activation
- Then
- where no row names
synced-campaign-slots, this contract returns continuous play to no earlier point - where a row names
synced-campaign-slots, this test asserts nothing
- where no row names
- Diagnostics
cloud-campaign-load-resultcloud-campaign-return-point
missing-earlier-point-row-returns-nowhere · synced-quicksave
synced-quicksave returns nowhere without an earlier-point row
Applies to the synced-quicksave row.
A successful synced-quicksave load returns continuous play nowhere under this contract when no earlier-point row names it. When one does, this test asserts nothing.
Test steps and diagnostics
- Given
a successful
synced-quicksaveload- When
- the game checks for an earlier-point-returns row after activation
- Then
- where no row names
synced-quicksave, this contract returns continuous play to no earlier point - where a row names
synced-quicksave, this test asserts nothing
- where no row names
- Diagnostics
cloud-campaign-load-resultcloud-campaign-return-point
earlier-point-mode-gate-controls-existence
Row.id exists only in its named modes
Does not apply to cloud-campaign: no row in earlier-point-returns matches mode-gated only in named modes.
death-follows-family-result · synced-campaign-progress
synced-campaign-progress follows its death result
Applies to the synced-campaign-progress row.
On death, synced-campaign-progress follows its selected result: the earlier value remains available to later play.
Test steps and diagnostics
- Given
a distinguishable
synced-campaign-progressvalue immediately before death- When
- death settles before any death-triggered copy removal the adoption declares
- Then
- the earlier value remains available to later play
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
death-follows-family-result · synced-dungeon-attempt
synced-dungeon-attempt follows its death result
Applies to the synced-dungeon-attempt row.
On death, synced-dungeon-attempt follows its selected result: the earlier value is removed before later play and an equal later value is recorded only as new state.
Test steps and diagnostics
- Given
a distinguishable
synced-dungeon-attemptvalue immediately before death- When
- death settles before any death-triggered copy removal the adoption declares
- Then
- the earlier value is removed before later play and an equal later value is recorded only as new state
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
death-at-run-end-clears-run-family · synced-dungeon-attempt
synced-dungeon-attempt clears when death is its run end
Applies to the synced-dungeon-attempt row.
If death is the run end at dungeon.victory-death-or-abandonment, synced-dungeon-attempt clears even without a save action. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a distinguishable
synced-dungeon-attemptvalue before a death, where the run ending atdungeon.victory-death-or-abandonmentis death- When
- death occurs without another save action
- Then
- if the cited end at
dungeon.victory-death-or-abandonmentis death, the earlier run-lifetime value clears before later play even without a save action; if the cited end is not death, this test asserts nothing
- if the cited end at
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-run-identity
death-at-until-event-clears-family
Row.id clears when death is its cited event
Does not apply to cloud-campaign: no row in state-families matches lifetime until event.
slot-deletion-follows-family-result · synced-campaign-progress
synced-campaign-progress follows its slot-deletion result
Applies to the synced-campaign-progress row.
On slot deletion, synced-campaign-progress follows its selected result: the earlier value tied to that slot clears before later play.
Test steps and diagnostics
- Given
a distinguishable family value before deletion of its related player-selected slot
- When
- the related slot is deleted
- Then
- the earlier value tied to that slot clears before later play
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-settlement-report
slot-deletion-follows-family-result · synced-dungeon-attempt
synced-dungeon-attempt follows its slot-deletion result
Applies to the synced-dungeon-attempt row.
On slot deletion, synced-dungeon-attempt follows its selected result: the settlement records that this family has no related player-selected slot.
Test steps and diagnostics
- Given
a distinguishable family value when it has no related player-selected slot
- When
- a slot-deletion boundary is considered
- Then
- the settlement records that this family has no related player-selected slot
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-settlement-report
local-profile-deletion-follows-family-result · synced-campaign-progress
synced-campaign-progress follows its local-profile-deletion result
Applies to the synced-campaign-progress row.
On local-profile deletion, synced-campaign-progress follows its selected result: the earlier value tied to that local profile clears before later play. Where a related profile exists, child slots are included only as the adoption's cited rule provides; otherwise that clause asserts nothing. The test restates nothing from the cited rule.
Test steps and diagnostics
- Given
a distinguishable family value before deletion of its related local profile
- When
- the related local profile is deleted with every child slot named by the adoption's cited rule
- Then
- the earlier value tied to that local profile clears before later play
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-settlement-reportcloud-campaign-removal-log
local-profile-deletion-follows-family-result · synced-dungeon-attempt
synced-dungeon-attempt follows its local-profile-deletion result
Applies to the synced-dungeon-attempt row.
On local-profile deletion, synced-dungeon-attempt follows its selected result: the earlier value tied to that local profile clears before later play. Where a related profile exists, child slots are included only as the adoption's cited rule provides; otherwise that clause asserts nothing. The test restates nothing from the cited rule.
Test steps and diagnostics
- Given
a distinguishable family value before deletion of its related local profile
- When
- the related local profile is deleted with every child slot named by the adoption's cited rule
- Then
- the earlier value tied to that local profile clears before later play
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-settlement-reportcloud-campaign-removal-log
device-lifetime-ends-at-device-data-deletion
Row.id ends when device data is deleted
Does not apply to cloud-campaign: no row in state-families matches lifetime device.
account-lifetime-ends-at-account-deletion
Row.id ends when its account is deleted or reset
Does not apply to cloud-campaign: no row in state-families matches lifetime account.
another-device-returns-family · synced-campaign-progress
synced-campaign-progress returns on another eligible device
Applies to the synced-campaign-progress row.
On another eligible device, synced-campaign-progress is obtained from its synced or authoritative copy before activation. Conflict handling still runs and applies the response of the conflict row that matches that copy kind; where no row matches, that clause asserts nothing. The device change does not delete any source-device copy; if none exists, that clause asserts nothing.
Test steps and diagnostics
- Given
a distinguishable
synced-campaign-progressvalue on one device before the same eligible player continues on another- When
- the new device settles available state
- Then
- the family is obtained from its synced or authoritative copy before activation and conflict handling still runs, applying the response of the conflict row that matches that copy kind; where no conflict row matches it, that clause asserts nothing
- any source-device copy is not deleted by the device change; where none exists, this clause asserts nothing
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-conflict-reportcloud-campaign-active-state-sourcecloud-campaign-removal-log
another-device-returns-family · synced-dungeon-attempt
synced-dungeon-attempt returns on another eligible device
Applies to the synced-dungeon-attempt row.
On another eligible device, synced-dungeon-attempt is obtained from its synced or authoritative copy before activation. Conflict handling still runs and applies the response of the conflict row that matches that copy kind; where no row matches, that clause asserts nothing. The device change does not delete any source-device copy; if none exists, that clause asserts nothing.
Test steps and diagnostics
- Given
a distinguishable
synced-dungeon-attemptvalue on one device before the same eligible player continues on another- When
- the new device settles available state
- Then
- the family is obtained from its synced or authoritative copy before activation and conflict handling still runs, applying the response of the conflict row that matches that copy kind; where no conflict row matches it, that clause asserts nothing
- any source-device copy is not deleted by the device change; where none exists, this clause asserts nothing
- Diagnostics
cloud-campaign-candidate-setcloud-campaign-conflict-reportcloud-campaign-active-state-sourcecloud-campaign-removal-log
another-device-does-not-return-family
Row.id does not return on another device
Does not apply to cloud-campaign: no row in state-families matches on-another-device does not return.
removed-copy-disappears-at-selected-event
Row.id disappears at its removal event
Does not apply to cloud-campaign: no row in copy-kinds matches removed-at normal quit or crash or death or slot delete or local profile delete or device data delete or account delete.
copy-kind-mode-gate-controls-existence
Row.id exists only in its named modes
Does not apply to cloud-campaign: no row in copy-kinds matches mode-gated only in named modes.
cleared-or-ended-value-never-affects-later-play
ended and cleared values stay absent
Applies to cloud-campaign.
After a lifetime ends or a boundary result clears a value, that earlier value never affects later play. An equal value derived later is new state. If no such case can be constructed, the test asserts nothing.
Test steps and diagnostics
- Given
every event the
cloud-campaignadoption can construct where a lifetime ends or a boundary result clears an earlier value- When
- later play reaches points where an equal value can be derived
- Then
- the earlier value never affects later play after the end or clearing event
- any equal value derived later is recorded as new state rather than restoration
- where the adoption can construct no such event, this test asserts nothing
- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-active-state-source
settlement-report-is-complete
every settlement report records its complete result
Applies to cloud-campaign.
Every settlement report carries the mechanism's full identity, boundary, commit, selection, response, result, and loss fields. Conflict and damage reports add their required facts and never claim an unattempted success. A clause for a case the adoption cannot construct asserts nothing.
Test steps and diagnostics
- Given
each persistence settlement the
cloud-campaignadoption can construct- When
- the settlement completes or refuses
- Then
- the report identifies state-family id, copy-kind id or its absence, event, scope before and after, last successful commit when read, selected copy and build when loaded, override or default used, state result, and any lost interval
- a conflict report also identifies both candidate commits and the selected response
- a damage report identifies refusal, fresh state, earlier-copy recovery, repaired parts, or warning choice and never claims an unattempted load succeeded
- where a conflict, damage case, load, or answered question does not arise, its corresponding clause asserts nothing
- Diagnostics
cloud-campaign-settlement-reportcloud-campaign-conflict-reportcloud-campaign-damage-report
state-family-citation-states-its-duty · synced-campaign-progress
declaration check: synced-campaign-progress's state citation states its duty
Applies to the synced-campaign-progress row.
This declaration check reads the adoption and cited prose, not the running game. campaign.synced-progress-fields must name every field in synced-campaign-progress and every point where it can affect later play. For a family that answers does-not-return after a quit, a crash, or on another device, it must also name the value the family starts from; otherwise that clause asserts nothing. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atcampaign.synced-progress-fields, not the running game- When
- a reviewer checks the citation's meaning
- Then
campaign.synced-progress-fieldsnames every field in this state family and every point where it can affect later play- where the row answers does-not-return after a quit, a crash, or on another device,
campaign.synced-progress-fieldsalso names the value the family starts from; where it never gives that answer for those cases, this clause asserts nothing - another meaning is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
state-family-citation-states-its-duty · synced-dungeon-attempt
declaration check: synced-dungeon-attempt's state citation states its duty
Applies to the synced-dungeon-attempt row.
This declaration check reads the adoption and cited prose, not the running game. dungeon.synced-attempt-fields must name every field in synced-dungeon-attempt and every point where it can affect later play. For a family that answers does-not-return after a quit, a crash, or on another device, it must also name the value the family starts from; otherwise that clause asserts nothing. Another meaning is a defect this test fails by construction. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atdungeon.synced-attempt-fields, not the running game- When
- a reviewer checks the citation's meaning
- Then
dungeon.synced-attempt-fieldsnames every field in this state family and every point where it can affect later play- where the row answers does-not-return after a quit, a crash, or on another device,
dungeon.synced-attempt-fieldsalso names the value the family starts from; where it never gives that answer for those cases, this clause asserts nothing - another meaning is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
saved-in-joins-a-copy-kind · synced-campaign-progress
declaration check: synced-campaign-progress names an existing copy kind when saved
Applies to the synced-campaign-progress row.
This declaration check reads the adoption, not the running game. When synced-campaign-progress has saved-in, it must name exactly one copy kind in this adoption; any other name is a defect this test fails by construction. With no saved-in, this check asserts nothing. It says nothing about a family held in two places at once; one family names one restoring save kind.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer reads
synced-campaign-progress's saved-in field
- a reviewer reads
- Then
- where saved-in is present, it names exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction
- where saved-in is absent, this join check asserts nothing
- Diagnostics
cloud-campaign-declaration-record
saved-in-joins-a-copy-kind · synced-dungeon-attempt
declaration check: synced-dungeon-attempt names an existing copy kind when saved
Applies to the synced-dungeon-attempt row.
This declaration check reads the adoption, not the running game. When synced-dungeon-attempt has saved-in, it must name exactly one copy kind in this adoption; any other name is a defect this test fails by construction. With no saved-in, this check asserts nothing. It says nothing about a family held in two places at once; one family names one restoring save kind.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer reads
synced-dungeon-attempt's saved-in field
- a reviewer reads
- Then
- where saved-in is present, it names exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction
- where saved-in is absent, this join check asserts nothing
- Diagnostics
cloud-campaign-declaration-record
backup-copy-kind-joins · prior-synced-checkpoint
declaration check: prior-synced-checkpoint names an existing copy kind
Applies to the prior-synced-checkpoint row.
This declaration check reads the adoption, not the running game. synced-campaign-slots must name exactly one copy kind in this adoption. Any other name is a defect this test fails by construction.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer compares
synced-campaign-slotswith copy-kinds ids
- a reviewer compares
- Then
synced-campaign-slotsnames exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
conflict-copy-kind-joins
declaration check: Row.id names an existing shared copy kind
Does not apply to cloud-campaign: no row in copy-conflicts matches scope this copy kind.
earlier-point-copy-kind-joins · synced-quicksave-retry
declaration check: synced-quicksave-retry names an existing copy kind
Applies to the synced-quicksave-retry row.
This declaration check reads the adoption, not the running game. synced-quicksave must name exactly one copy kind in this adoption. Any other name is a defect this test fails by construction.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer compares
synced-quicksavewith copy-kinds ids
- a reviewer compares
- Then
synced-quicksavenames exactly one copy-kinds row in this adoption; another name is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
account-family-names-account-ending
declaration check: Row.id names account deletion or reset as its end
Does not apply to cloud-campaign: no row in state-families matches lifetime account.
restore-earlier-override-has-backup
declaration check: Row.id's restore-earlier-copy override has a backup row
Does not apply to cloud-campaign: no row in copy-kinds matches unreadable-copy restore earlier copy.
restore-earlier-default-has-backup · synced-campaign-slots
declaration check: synced-campaign-slots's restore-earlier-copy default has a backup row
Applies to the synced-campaign-slots row.
This declaration check reads the adoption, not the running game. The synced-campaign-slots default that restores an earlier copy requires a matching backup row. Absence is a defect this test fails by construction.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer compares
synced-campaign-slotswith backup-copies copy-kind fields
- a reviewer compares
- Then
- at least one backup-copies row names
synced-campaign-slots; absence is a defect this test fails by construction
- at least one backup-copies row names
- Diagnostics
cloud-campaign-declaration-record
returning-family-uses-shared-authority · synced-campaign-progress
declaration check: synced-campaign-progress returns from a shared authority
Applies to the synced-campaign-progress row.
This declaration check reads the adoption, not the running game. A returning synced-campaign-progress family must name exactly one cloud-synced or server-authoritative restoring kind. Any other shape is a defect this test fails by construction.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer follows
synced-campaign-progress's saved-in name to a copy-kinds row
- a reviewer follows
- Then
- saved-in is present and names exactly one cloud-synced or server-authoritative copy kind; another shape is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
returning-family-uses-shared-authority · synced-dungeon-attempt
declaration check: synced-dungeon-attempt returns from a shared authority
Applies to the synced-dungeon-attempt row.
This declaration check reads the adoption, not the running game. A returning synced-dungeon-attempt family must name exactly one cloud-synced or server-authoritative restoring kind. Any other shape is a defect this test fails by construction.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer follows
synced-dungeon-attempt's saved-in name to a copy-kinds row
- a reviewer follows
- Then
- saved-in is present and names exactly one cloud-synced or server-authoritative copy kind; another shape is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
one-conflict-row-per-scope
declaration check: each conflict scope has at most one row
Applies to cloud-campaign.
This declaration check reads the adoption, not the running game. Each represented conflict scope has at most one row. A duplicate is a defect this test fails by construction. With no conflict rows, the check asserts nothing.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer groups copy-conflicts rows by a this-copy-kind name or the all-synced-kinds scope
- Then
- no declared scope has more than one conflict row; a duplicate scope is a defect this test fails by construction; with no conflict rows, this check asserts nothing
- Diagnostics
cloud-campaign-declaration-record
one-earlier-point-row-per-copy-kind
declaration check: each copy kind has at most one earlier-point row
Applies to cloud-campaign.
This declaration check reads the adoption, not the running game. Each copy kind has at most one earlier-point row. A duplicate is a defect this test fails by construction. With no such rows, the check asserts nothing.
Test steps and diagnostics
- Given
the
cloud-campaignadoption document, not the running game- When
- a reviewer groups earlier-point-returns rows by copy-kind
- Then
- no copy kind is named by more than one earlier-point-returns row; a duplicate is a defect this test fails by construction; with no such rows, this check asserts nothing
- Diagnostics
cloud-campaign-declaration-record
copy-citations-state-their-duties · synced-campaign-slots
declaration check: synced-campaign-slots's required citations state their duties
Applies to the synced-campaign-slots row.
This declaration check reads the adoption and cited prose, not the running game. cloud.campaign-contents, cloud.campaign-commit, and cloud.three-slot-sync must state their family-set, write-success and loss-window, and applicable residence, authority, identity, and selection duties. A missing duty is a defect this test fails by construction. The test names the addresses and restates nothing from them.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atcloud.campaign-contents,cloud.campaign-commit, andcloud.three-slot-sync, not the running game- When
- a reviewer checks each citation's meaning
- Then
cloud.campaign-contentsnames the complete family set written and restored togethercloud.campaign-commitnames the trigger, success condition, final-write behavior, and quit or crash loss windowcloud.three-slot-syncnames residence, applicable sync or service acceptance and authority, layout, identities, and player selection- a citation missing its duty is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
copy-citations-state-their-duties · synced-quicksave
declaration check: synced-quicksave's required citations state their duties
Applies to the synced-quicksave row.
This declaration check reads the adoption and cited prose, not the running game. cloud.quicksave-contents, cloud.quicksave-commit, and cloud.quicksave-sync must state their family-set, write-success and loss-window, and applicable residence, authority, identity, and selection duties. A missing duty is a defect this test fails by construction. The test names the addresses and restates nothing from them.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atcloud.quicksave-contents,cloud.quicksave-commit, andcloud.quicksave-sync, not the running game- When
- a reviewer checks each citation's meaning
- Then
cloud.quicksave-contentsnames the complete family set written and restored togethercloud.quicksave-commitnames the trigger, success condition, final-write behavior, and quit or crash loss windowcloud.quicksave-syncnames residence, applicable sync or service acceptance and authority, layout, identities, and player selection- a citation missing its duty is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
backup-citations-state-their-duties · prior-synced-checkpoint
declaration check: prior-synced-checkpoint's backup citations state their duties
Applies to the prior-synced-checkpoint row.
This declaration check reads the adoption and cited prose, not the running game. cloud.prior-checkpoint-policy must state retention, ordering, usable selection, and loss duties; menus.restore-prior-cloud-checkpoint must state the direct restore route. A missing duty is a defect this test fails by construction. The test names both addresses and restates nothing from them.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atcloud.prior-checkpoint-policyandmenus.restore-prior-cloud-checkpoint, not the running game- When
- a reviewer checks each citation's meaning
- Then
cloud.prior-checkpoint-policynames retention, ordering, usable selection, and the possible lost intervalmenus.restore-prior-cloud-checkpointnames the supported direct restore route- a citation missing its duty is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
conflict-citation-states-its-duties · whole-save-sync
declaration check: whole-save-sync's resolution citation states its duties
Applies to the whole-save-sync row.
This declaration check reads the adoption and cited prose, not the running game. menus.choose-device-or-cloud-set must state disagreement, identity, complete-copy handling, and clearing duties. A missing duty is a defect this test fails by construction. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atmenus.choose-device-or-cloud-set, not the running game- When
- a reviewer checks the citation's meaning
- Then
menus.choose-device-or-cloud-setnames disagreement detection, identity comparison, complete-copy selection or preservation, and the conflict-clearing event- a citation missing a duty is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
earlier-return-citation-states-its-duties · synced-quicksave-retry
declaration check: synced-quicksave-retry's return citation states its duties
Applies to the synced-quicksave-retry row.
This declaration check reads the adoption and cited prose, not the running game. dungeon.quicksave-reuse must state the point, activation, run-identity, and reuse duties. A missing duty is a defect this test fails by construction. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
cloud-campaignadoption and the prose atdungeon.quicksave-reuse, not the running game- When
- a reviewer checks the citation's meaning
- Then
dungeon.quicksave-reusenames the earlier point, successful activation, run identity when applicable, and whether another load remains possible- a citation missing a duty is a defect this test fails by construction
- Diagnostics
cloud-campaign-declaration-record
copy-removal-citation-states-its-duty
declaration check: Row.id's removal citation states its duty
Does not apply to cloud-campaign: no row in copy-kinds matches removed-at normal quit or crash or death or slot delete or local profile delete or device data delete or account delete.
copy-mode-citation-states-its-duty
declaration check: Row.id's mode citation states its duty
Does not apply to cloud-campaign: no row in copy-kinds matches mode-gated only in named modes.
player-mode-return-is-mode-gated
declaration check: Row.id's player-mode return is mode-gated
Does not apply to cloud-campaign: no row in earlier-point-returns matches after-load player mode decides.
earlier-point-mode-citation-states-its-duty
declaration check: Row.id's mode citation states its duty
Does not apply to cloud-campaign: no row in earlier-point-returns matches mode-gated only in named modes.
persistence-holds
the persistence mechanism holds for the whole run
Applies to cloud-campaign.
Across each of quit, crash, death, slot deletion, profile deletion, and device change that the adoption can construct, plus each constructible damage and build-mismatch case, each family's value on both sides of every constructed boundary matches its row and the numbered settlement order holds. Every load the adoption can construct refuses partial state and activates all carried families together only when accepted. A case the adoption cannot construct asserts nothing. The pack's default audit seeds apply unless the adoption supplies its own.
Test steps and diagnostics
- Holds
every state family's distinguishable value on both sides of every constructed boundary matched its row; every commit, candidate, conflict, build comparison, damage response, activation, earlier return, deletion, device return, and settlement report that the adoption constructed followed the mechanism's numbered order; every constructed load that was partial or refused activated no state; every accepted load activated all carried families together; where the adoption can construct no load, conflict, damage, build mismatch, or earlier return, that clause asserts nothing
- Seeds
["audit-a","audit-b"]- Scope
each of quit, crash, death, slot deletion, profile deletion, and device change that the adoption can construct, plus each constructible damage and build-mismatch case- Diagnostics
cloud-campaign-state-boundary-tracecloud-campaign-commit-logcloud-campaign-candidate-setcloud-campaign-settlement-tracecloud-campaign-load-resultcloud-campaign-active-state-sourcecloud-campaign-settlement-reportcloud-campaign-first-ordering-violation
JSONthe adoption as one file
The adoption file as supplied. Answers you try on this page are not written into it; to change an adoption, open it in the authoring tool.
{
"contract": "state-persistence-scope",
"version": 1,
"summary": "Covers what survives the end of a run or session, a quit, a crash, death, deleting saved data, and moving to another device. It also covers local saves, manual slots, cloud copies, server profiles, backups, conflicts, and version changes. Closed-game time, replay guarantees, file formats, and the shape of saved numbers stay elsewhere.",
"questions": {
"unreadable-copy-default": {
"asks": "What normally happens when saved state cannot be read?",
"rationale": "Lost progress is the most visible failure a save system has. Choose the result players should expect first.",
"when": {
"row-count": {
"copy-kinds": "non-empty"
}
},
"otherwise": "No saved copy can be opened later, so unreadable saved state never reaches a load attempt.",
"options": {
"refuse-load": {
"meaning": "The unreadable copy stays closed. A city slot remains listed, but none of its progress becomes active.",
"semantics": "Loading stops before any state from that copy becomes active. The copy is neither replaced nor repaired by this response."
},
"start-fresh": {
"meaning": "Play starts from normal fresh state. A damaged puzzle slot opens with its first board instead of the old board.",
"semantics": "Fresh state becomes active instead of state from the unreadable copy. The response does not by itself delete or overwrite that copy."
},
"restore-earlier-copy": {
"meaning": "An earlier copy can replace it through the supported route, including a manual file restore. A factory returns after choosing the backup before its damaged autosave.",
"semantics": "A declared manual, in-game, or automatic recovery route can activate an earlier copy. The newest usable earlier copy under the matching backup rule becomes active."
},
"repair-readable-state": {
"meaning": "Readable progress returns and damaged parts reset. A dungeon keeps cleared floors but rebuilds one broken room record.",
"semantics": "Readable state becomes active as one repaired result. Every unreadable part takes the fresh value named by the cited repair rule."
},
"warn-and-try": {
"meaning": "The player can cancel or try the unreadable copy. A colony save opens only after its damage warning is accepted.",
"semantics": "No state from the copy becomes active before the explicit choice. Accepting the warning permits an attempt but does not promise success."
}
}
},
"older-build-default": {
"asks": "What normally happens when an older game build wrote the copy?",
"rationale": "Updates can strand a player's progress or change it permanently. Choose how the current build protects that progress.",
"when": {
"row-count": {
"copy-kinds": "non-empty"
}
},
"otherwise": "No loadable copy exists, so an older build has no saved state to open.",
"options": {
"refuse-load": {
"meaning": "The older copy stays closed. A world from last year's rules cannot open in the current build.",
"semantics": "Loading stops before state written by the older build becomes active."
},
"convert-and-load": {
"meaning": "The game updates the old state and opens it. A factory save gains the current recipe records before play resumes.",
"semantics": "A declared conversion produces current-build state before activation."
},
"warn-and-load": {
"meaning": "The old copy is tried only after a warning. A racing career from an earlier patch opens after the player accepts the risk.",
"semantics": "The player accepts a compatibility warning before old-build state becomes active. Acceptance permits an attempt but does not promise success."
}
}
},
"newer-build-default": {
"asks": "What normally happens when a newer game build wrote the copy?",
"rationale": "Going back to an older build can erase newer content. Choose whether the player may take that risk.",
"when": {
"row-count": {
"copy-kinds": "non-empty"
}
},
"otherwise": "No loadable copy exists, so a newer build has no saved state to open.",
"options": {
"refuse-load": {
"meaning": "The newer copy stays closed. A world from a later patch remains unavailable in this build.",
"semantics": "Loading stops before state written by the newer build becomes active."
},
"warn-and-load": {
"meaning": "The newer copy is tried only after a warning. A sandbox world opens after the player accepts that newer content may be lost.",
"semantics": "The player accepts a compatibility warning before newer-build state becomes active. Acceptance permits an attempt but does not promise success."
}
}
}
},
"declares": {
"values": {},
"rows": {
"state-families": {
"description": "List each family of state that can change later play and give its observed persistence boundaries.",
"when-empty": "No changing game state is covered, so this adoption makes no persistence promise.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "Name the state family in game words, such as campaign-progress, run-inventory, unlocks, or settings."
},
"state-declared-in": {
"type": "citation",
"required": true,
"description": "The fixed game prose naming every field in this family and the points where it can affect later play. For a family that does not return after a quit, a crash, or on another device, it also names the value the family starts from."
},
"lifetime": {
"type": "string",
"required": true,
"options": [
"run",
"session",
"slot",
"profile",
"device",
"account",
"until-event",
"not-kept"
],
"description": "Run: the state belongs to one attempt; a roguelike's carried items go when that attempt ends. Session: the state belongs to one continuous visit; a co-op lobby choice goes when the party leaves that lobby. Slot: the state belongs to one player-selected save; campaign progress goes when that slot is deleted. Profile: the state belongs to one local player profile; unlocks go when that profile is deleted. Device: the state belongs to one installation; local settings go when that device data is erased. Account: the state belongs to one account; online settings go when that account is deleted or reset. Until event: the state lasts to one named game event; dropped currency goes at the next death. Not kept: the state does not cross its first named interruption; an enemy's alert meter does not return after quitting."
},
"scope-starts-in": {
"type": "citation",
"when": {
"row": {
"lifetime": [
"run",
"session"
]
}
},
"description": "The player-observable start of this attempt or continuous visit. A run may start when the character enters the dungeon; a session may start when the party joins a lobby."
},
"scope-ends-in": {
"type": "citation",
"when": {
"row": {
"lifetime": [
"run",
"session",
"slot",
"profile",
"device",
"account",
"not-kept"
]
}
},
"description": "The player-observable ending of this lifetime. It may be an attempt result, leaving a lobby, deleting a player-selected slot, deleting a local profile, erasing device data, deleting an account, or the first interruption that discards the value."
},
"lifetime-event-declared-in": {
"type": "citation",
"when": {
"row": {
"lifetime": [
"until-event"
]
}
},
"description": "The named game event that destroys the earlier value. A recovery point may last until the next death after it appears."
},
"saved-in": {
"type": "string",
"pattern": "kebab-case",
"description": "The save kind that restores this family. Absence means no copy restores it."
},
"after-normal-quit": {
"type": "string",
"required": true,
"options": [
"returns-last-commit",
"does-not-return"
],
"description": "Whether the last saved point returns after an ordinary quit. A campaign returns its last checkpoint; an unsaved match score does not."
},
"after-crash": {
"type": "string",
"required": true,
"options": [
"returns-last-commit",
"does-not-return"
],
"description": "Whether the last saved point returns after a crash. A timer-written world may lose changes since its last write while still returning that write."
},
"after-death": {
"type": "string",
"required": true,
"options": [
"keeps-value",
"clears-value"
],
"description": "Whether death keeps this value. Roguelike unlocks may remain while the dead run's inventory clears."
},
"after-slot-delete": {
"type": "string",
"required": true,
"options": [
"keeps-value",
"clears-value",
"no-slot"
],
"description": "Whether deleting the related player-selected save keeps this value. That slot is named by the storage rule for several player-selected saves; a save presented as one current copy answers that no related slot exists."
},
"after-local-profile-delete": {
"type": "string",
"required": true,
"options": [
"keeps-value",
"clears-value",
"no-profile"
],
"description": "Whether deleting the related local player profile keeps this value. That profile is named by the restoring copy's storage rule; a family with no such profile answers that no related profile exists."
},
"on-another-device": {
"type": "string",
"required": true,
"options": [
"returns",
"does-not-return"
],
"description": "Whether the value returns when the same eligible player continues on another device. A server profile may return; local settings may not."
}
}
},
"copy-kinds": {
"description": "List each independently written and loaded save kind, such as campaign slots, profile data, cloud settings, or a server profile.",
"when-empty": "No saved copy can be opened later. Loading cannot restore state, compare builds, recover damage, or resolve a conflict.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "Name this save kind in game words, such as campaign-slots, unlock-profile, or account-settings."
},
"contains-declared-in": {
"type": "citation",
"required": true,
"description": "The fixed list of state-family ids written and restored together by this save kind."
},
"write-trigger": {
"type": "string",
"required": true,
"options": [
"player-save",
"checkpoint",
"continuous",
"timer",
"service-owned"
],
"description": "What starts a save: a save action, a named checkpoint, each accepted change, a timer, or the service's own rule."
},
"write-rule-declared-in": {
"type": "citation",
"required": true,
"description": "The rule naming exactly when a save begins, what makes it successful, and which later changes a quit or crash can lose."
},
"residence": {
"type": "string",
"required": true,
"options": [
"local-device",
"cloud-synced",
"server-authoritative"
],
"description": "Where the copy that can restore play is authoritative: this device, synced device copies, or a game service. Copies shared through sync can conflict; a profile controlled by the service reads its accepted state."
},
"layout": {
"type": "string",
"required": true,
"options": [
"one-current",
"manual-slots"
],
"description": "How the save is presented: one current copy or several player-selected slots. A slot is one named load choice in the storage rule; retained earlier copies belong in the backup list."
},
"storage-rule-declared-in": {
"type": "citation",
"required": true,
"description": "The rule naming copy residence, sync or service authority, and the player-visible selection route. For several player-selected saves it also names each stable slot identity; one current copy names no player-selected slot."
},
"unreadable-copy": {
"type": "string",
"required": true,
"options": [
"use-game-default",
"refuse-load",
"start-fresh",
"restore-earlier-copy",
"repair-readable-state",
"warn-and-try"
],
"description": "Use the game's ordinary answer for a save that cannot be read, or choose a different result for this save kind."
},
"older-build-copy": {
"type": "string",
"required": true,
"options": [
"use-game-default",
"refuse-load",
"convert-and-load",
"warn-and-load"
],
"description": "Use the game's ordinary answer for a save written by an older build, or choose a different result for this save kind."
},
"newer-build-copy": {
"type": "string",
"required": true,
"options": [
"use-game-default",
"refuse-load",
"warn-and-load"
],
"description": "Use the game's ordinary answer for a save written by a newer build, or choose a different result for this save kind."
},
"mode-gated": {
"type": "string",
"options": [
"only-in-named-modes"
],
"description": "This save kind exists only in named player modes. A restore point may exist in a practice mode and a standard mode but not in a challenge mode."
},
"mode-rule-declared-in": {
"type": "citation",
"when": {
"row": {
"mode-gated": [
"only-in-named-modes"
]
}
},
"description": "The rule naming every player mode where this save kind exists and confirming that it is absent elsewhere."
},
"removed-at": {
"type": "string",
"options": [
"normal-quit",
"crash",
"death",
"slot-delete",
"local-profile-delete",
"device-data-delete",
"account-delete"
],
"description": "The event that removes this copy from later load choices. A permadeath save may vanish when the character dies. For several player-selected saves this names removal of the deleted slot's copy, not of the whole save kind."
},
"removal-rule-declared-in": {
"type": "citation",
"when": {
"row": {
"removed-at": [
"normal-quit",
"crash",
"death",
"slot-delete",
"local-profile-delete",
"device-data-delete",
"account-delete"
]
}
},
"description": "The rule naming the exact event that removes the copy and what the player sees afterward."
}
}
},
"backup-copies": {
"description": "List save kinds that retain an earlier copy for supported recovery.",
"when-empty": "No save kind promises an earlier usable copy, so damage cannot be answered by restoring one.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "Name the earlier-copy family, such as previous-campaign-checkpoint."
},
"copy-kind": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"description": "The save kind protected by this earlier copy."
},
"backup-rule-declared-in": {
"type": "citation",
"required": true,
"description": "The rule naming when an earlier copy is retained, how many remain, and what later progress recovery loses."
},
"restore-rule-declared-in": {
"type": "citation",
"required": true,
"description": "The supported route for opening an earlier copy. It names whether recovery is automatic, in the game, or an external file step."
}
}
},
"copy-conflicts": {
"description": "List shared save kinds that can present two complete but disagreeing copies. One adoption has at most one row per conflict scope: one for each named save kind and one for all synced kinds.",
"when-empty": "No shared save kind can present competing copies, so no conflict response runs.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "Name the conflict in game words, such as campaign-slot-sync."
},
"scope": {
"type": "string",
"required": true,
"options": [
"this-copy-kind",
"all-synced-kinds"
],
"description": "Whether the response settles one save kind or every synced save kind together. One cloud dialog may settle campaign slots and quicksaves as a set."
},
"copy-kind": {
"type": "string",
"when": {
"row": {
"scope": [
"this-copy-kind"
]
}
},
"pattern": "kebab-case",
"description": "The one cloud-synced or service save kind whose copies can disagree."
},
"response": {
"type": "string",
"required": true,
"options": [
"select-by-rule",
"player-chooses-copy",
"refuse-until-resolved"
],
"description": "What happens before any disagreeing state becomes active. A fixed rule may always prefer the copy the game service holds; the player may choose between dated copies; or neither copy may open until sync is repaired."
},
"resolution-declared-in": {
"type": "citation",
"required": true,
"description": "The rule detecting disagreement, comparing copy identity, selecting or preserving copies, and naming the event that clears the conflict."
}
}
},
"earlier-point-returns": {
"description": "List save kinds that can return to an earlier point of the same continuous play, whether or not the game names a run. One adoption has at most one row per save kind.",
"when-empty": "No save kind can return to an earlier point of the same continuous play, so reload-to-retry is unavailable.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "Name the earlier return point in game words, such as dungeon-retry or quicksave."
},
"copy-kind": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"description": "The save kind that can return play to the earlier point."
},
"after-load": {
"type": "string",
"required": true,
"options": [
"resume-stays",
"resume-is-used-once",
"player-mode-decides"
],
"description": "Whether the same earlier point remains available after a successful load. A practice mode may keep a boss checkpoint while an iron mode allows one return."
},
"return-rule-declared-in": {
"type": "citation",
"required": true,
"description": "The rule naming the earlier point, successful activation, and whether another load remains possible."
},
"mode-gated": {
"type": "string",
"options": [
"only-in-named-modes"
],
"description": "This earlier return point exists only in named player modes. A quicksave may be available in a practice mode but absent in a challenge mode."
},
"mode-rule-declared-in": {
"type": "citation",
"when": {
"row": {
"mode-gated": [
"only-in-named-modes"
]
}
},
"description": "The rule naming every player mode where this earlier return point exists and confirming that it is absent elsewhere."
}
}
}
}
},
"rules": {},
"origin": "https://opengdd.org/contracts/state-persistence-scope-1",
"mechanism": [
"This is the one normative settlement authority for state-family identity, scope starts and endings, commits, loads, damage, build mismatch, copy conflicts, deletion, and device change. Questions and rows supply defaults, overrides, and cited game rules; they do not define another sequence.",
"A **run** begins at the player-observable attempt start named by `scope-starts-in` and ends at the result or exit named by `scope-ends-in`. Victory, death, and abandonment are common endings, but only the cited game rules decide. A save or load does not start or end a run. A **session** begins when play enters the world, match, lobby, or profile context named by `scope-starts-in` and ends at the exit, switch, or reset named by `scope-ends-in`. It survives a pause, background interval, closure, or relaunch that returns to that same context; a missing commit may still prevent its earlier value from returning.",
"A **commit** is one coherent accepted write of a copy kind. A **copy** is a load candidate with its save-kind id, copy identity, any slot identity, build identity, commit identity, and complete state-family set. A **conflict** exists when the cited rule finds two accepted shared copies in one declared conflict scope that disagree and neither has already replaced the other. An **earlier copy** is a retained older commit named by a backup row.",
"### Change and commit",
"1. When state changes, keep each `state-families` row as one family under its cited game rule. The row's lifetime is the maximum scope of that earlier value. An `until-event` value ends at its cited game event; a shorter boundary result may clear any value sooner only when the row says so. 2. Evaluate run and session starts and endings from their separate cited player-observable events. A save action, automatic write, timer tick, process launch, process close, or load does not create a new run or session by itself. 3. Start a copy-kind commit only at its selected write trigger. A player save follows the cited save action. A checkpoint follows its named game event. Continuous writing follows each accepted change named by its rule. A timer follows the cited interval. A service-owned copy follows its authority's cited acceptance event. 4. A commit becomes loadable only when `write-rule-declared-in` reports success for the complete `contains-declared-in` set. A failed or partial write never replaces the last successful commit. Earlier copies are retained and ordered only by their backup and storage rules.",
"### Quit, crash, and return",
"5. On an ordinary quit, perform a final commit only when the copy kind's cited write rule calls for one. For each state row, `returns-last-commit` restores its latest successful commit on return; `does-not-return` starts from the cited post-quit value. Uncommitted changes do not return. A copy removed at normal quit is no longer a later load choice. 6. On a crash, no unfinished commit succeeds. For each state row, `returns-last-commit` restores the last commit that succeeded before the crash; `does-not-return` starts from the cited post-crash value. A timer or checkpoint therefore has an explicit possible loss window. A copy removed at crash is no longer a later load choice. 7. Select the requested slot or profile before activating state. A `one-current` kind selects its current copy. `manual-slots` selects the player's named slot. A retained earlier copy is not another layout; the damage response and matching backup rule may select it later, and a backup row's cited restore route is also available to the player directly, independent of any damage response. 8. A local-device copy is available only on that device unless another cited transfer exists outside this adoption. A cloud-synced kind obtains every accepted device and cloud candidate before conflict handling. A server-authoritative kind obtains the service's accepted copy and does not treat an unaccepted local cache as equal authority. Read each candidate's save-kind, slot, build, and commit identity now. A candidate whose identity cannot be read is not a conflict candidate. If no candidate survives, run the requested kind's damage response immediately, without conflict or build comparison. A readable header with an unreadable gameplay body remains a candidate for steps 9 and 10, then reaches the damage response in step 11.",
"### Conflict, compatibility, and damage",
"9. If readable shared candidates conflict, apply the matching row's response before reading their gameplay state. A one-kind row settles only that save kind; a whole-set row settles every synced kind together. `select-by-rule` chooses one complete copy. `player-chooses-copy` waits for one complete-copy choice. `refuse-until-resolved` activates neither. No response merges fields. 10. Compare the selected copy's writing build with the running build. Apply the copy-kind override when present; otherwise apply the matching older or newer default. Refusal activates no state. Conversion produces one current-build copy before activation. A warning precedes the attempt and does not promise that it succeeds. If conversion fails, refuse the load and leave the source copy unchanged unless its cited rule says otherwise. 11. Read the selected copy as one coherent unit. If it is unreadable, apply the copy-kind override or `unreadable-copy-default`. Refusal activates nothing. Fresh start activates the cited fresh state without silently deleting the unreadable copy. Earlier-copy recovery follows the matching backup row, selects the newest usable earlier copy, and reports the lost interval. Repair activates one coherent repaired result and resets every unreadable part under the cited rule; failure to produce a coherent result refuses the load. Warning waits for the player's choice before any attempted activation. 12. Activate all state families in the accepted copy together. State families saved in another copy kind keep the already active value from that kind; a state family without `saved-in` is never restored by this load. 13. If the accepted copy has a `earlier-point-returns` row, return continuous play to its cited earlier point. If that point is inside a run, continue the same run identity. Apply `after-load` only after successful activation: keeping the resume leaves it available, using it once makes it unavailable, and a player-mode answer follows the mode fixed before the load.",
"### Death, deletion, and another device",
"14. On death, apply every state's `after-death` result. `clears-value` removes the earlier value before later play. `keeps-value` retains it. If death is also the cited run end, every run-lifetime value clears even if no save action occurs. If it is the cited event for an `until-event` value, that value clears as well. Longer-lived unlocks, settings, and profile state follow their own rows. A copy with `removed-at: death` disappears from the load choices after these state results are settled. 15. On slot deletion, clear each `clears-value` row tied to that slot and keep each `keeps-value` row. `no-slot` records that the state has no related player-selected slot. Deleting a local profile applies `after-local-profile-delete` the same way and includes any slots whose cited rule makes them children of that profile. Device-data deletion ends device-lifetime state under its cited rule. Account deletion or reset ends account-lifetime state through `scope-ends-in`. At each event, remove every copy whose `removed-at` value names it. 16. On another eligible device, `returns` obtains the family from its cloud-synced or server-authoritative copy before activation and still runs conflict handling. `does-not-return` starts from the cited new-device value. A device change does not by itself delete the source device's copy. 17. After every event, no earlier value affects later play once its lifetime has ended or its selected boundary result cleared it. A later game rule may derive a new value, but that is new state rather than restoration of the cleared value. A mode-gated copy or earlier return point exists only while the cited player mode permits it.",
"Every settlement report identifies the state-family id, copy-kind id or its absence, event, scope before and after, last successful commit when read, selected copy and build when loaded, override or default used, state result, and any lost interval. Conflict reports also identify both candidate commits and the selected response. Damage reports identify refusal, fresh state, earlier-copy recovery, repaired parts, or warning choice without claiming an unattempted load succeeded."
],
"answers": {
"unreadable-copy-default": "restore-earlier-copy",
"older-build-default": "convert-and-load",
"newer-build-default": "refuse-load"
},
"values": {},
"rows": {
"state-families": [
{
"id": "synced-campaign-progress",
"state-declared-in": "campaign.synced-progress-fields",
"lifetime": "slot",
"scope-ends-in": "cloud.delete-synced-slot",
"saved-in": "synced-campaign-slots",
"after-normal-quit": "returns-last-commit",
"after-crash": "returns-last-commit",
"after-death": "keeps-value",
"after-slot-delete": "clears-value",
"after-local-profile-delete": "clears-value",
"on-another-device": "returns"
},
{
"id": "synced-dungeon-attempt",
"state-declared-in": "dungeon.synced-attempt-fields",
"lifetime": "run",
"scope-starts-in": "dungeon.enter",
"scope-ends-in": "dungeon.victory-death-or-abandonment",
"saved-in": "synced-quicksave",
"after-normal-quit": "returns-last-commit",
"after-crash": "returns-last-commit",
"after-death": "clears-value",
"after-slot-delete": "no-slot",
"after-local-profile-delete": "clears-value",
"on-another-device": "returns"
}
],
"copy-kinds": [
{
"id": "synced-campaign-slots",
"contains-declared-in": "cloud.campaign-contents",
"write-trigger": "checkpoint",
"write-rule-declared-in": "cloud.campaign-commit",
"residence": "cloud-synced",
"layout": "manual-slots",
"storage-rule-declared-in": "cloud.three-slot-sync",
"unreadable-copy": "use-game-default",
"older-build-copy": "use-game-default",
"newer-build-copy": "use-game-default"
},
{
"id": "synced-quicksave",
"contains-declared-in": "cloud.quicksave-contents",
"write-trigger": "player-save",
"write-rule-declared-in": "cloud.quicksave-commit",
"residence": "cloud-synced",
"layout": "one-current",
"storage-rule-declared-in": "cloud.quicksave-sync",
"unreadable-copy": "warn-and-try",
"older-build-copy": "use-game-default",
"newer-build-copy": "use-game-default"
}
],
"backup-copies": [
{
"id": "prior-synced-checkpoint",
"copy-kind": "synced-campaign-slots",
"backup-rule-declared-in": "cloud.prior-checkpoint-policy",
"restore-rule-declared-in": "menus.restore-prior-cloud-checkpoint"
}
],
"copy-conflicts": [
{
"id": "whole-save-sync",
"scope": "all-synced-kinds",
"response": "player-chooses-copy",
"resolution-declared-in": "menus.choose-device-or-cloud-set"
}
],
"earlier-point-returns": [
{
"id": "synced-quicksave-retry",
"copy-kind": "synced-quicksave",
"after-load": "resume-stays",
"return-rule-declared-in": "dungeon.quicksave-reuse"
}
]
},
"pack": "sha256:86060e861a3d6b10e0019612467e03749328dba98ab1a148bbc54c09e2492cf7"
}