Account settings
account-settings · an adoption of State persistence scope, version 2
Use in your package
The first button opens the authoring tool with these answers and numbers already filled in. You still add the rules and tuning of your own game.
What is in the zip file
The zip file holds the adoption and its acceptance tests. In the authoring tool, choose Add contract and pick this zip file. If you edit your package outside the authoring tool, unpack the zip file in your package folder. The files of the zip file go into contracts/.
The contract that this adoption uses
This contract covers which state is kept after the end of a run or session, a quit, a crash, death, the deletion of saved data, and a move to another device. It also covers local saves, manual slots, cloud copies, server profiles, backups, conflicts, and version changes. This contract does not cover time that passes while the game is closed, replay guarantees, file formats, or the shape of saved numbers. The Suspension and catch-up contract covers time while the game is closed. The Replay scope contract covers replay guarantees.
Questions
The supplied answer is marked on each question. Pick other answers to see what changes. Nothing is saved here: the zip file and the authoring tool use the supplied answers.
By default, what happens when saved state cannot be read?
- Asked when
- the copy kinds list has at least one row.
- If not asked
- No saved copy can be opened later, so unreadable saved state never reaches a load attempt.
Why this is asked
Lost progress is the most visible failure of a save system. This answer is the default answer. A save kind can choose another answer in its own row.
By default, what happens when an older game build wrote the copy?
- Asked when
- the copy kinds list has at least one row.
- If not asked
- No loadable copy exists, so an older build has no saved state to open.
Why this is asked
An update can make a player's progress impossible to load, or change it permanently. Choose how the current build protects that progress.
By default, what happens when a newer game build wrote the copy?
- Asked when
- the copy kinds list has at least one row.
- If not asked
- No loadable copy exists, so a newer build has no saved state to open.
Why this is asked
Going back to an older build can erase newer content. Choose whether the player may take that risk.
Numbersno numbers
This contract has no numbers to set.
Rulesno rules
A rule is a check between the numbers. Validation reports a rule that fails.
This contract has no rules between its numbers.
Lists5 lists
Each list holds the rows this adoption supplies. A list can be empty.
State families
state-families
| Id | State declared in | Lifetime | Scope starts in | Scope ends in | Lifetime event declared in | Saved in | After normal quit | After crash | After death | After slot delete | After local profile delete | On another device |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
account-settings-service-state | settings.service-fields | account | — | account.delete-or-reset | — | account-settings-service | returns-last-commit | returns-last-commit | keeps-value | no-slot | no-profile | returns |
account-settings-device-cache | settings.cache-fields | device | — | device.erase-local-data | — | account-settings-cache | returns-last-commit | returns-last-commit | keeps-value | no-slot | clears-value | does-not-return |
Copy kinds
copy-kinds
| Id | Contains declared in | Write trigger | Write rule declared in | Residence | Layout | Storage rule declared in | Unreadable copy | Older build copy | Newer build copy | Mode gated | Mode rule declared in | Removed at | Removal rule declared in |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
account-settings-service | settings.service-contents | service-owned | settings.accepted-change | server-authoritative | one-current | settings.account-service | use-game-default | use-game-default | use-game-default | — | — | — | — |
account-settings-cache | settings.cache-contents | continuous | settings.cache-each-accepted-change | local-device | one-current | settings.local-profile-cache | start-fresh | use-game-default | use-game-default | — | — | — | — |
Backup copies
backup-copies
This adoption declares no backup copies.
Copy conflicts
copy-conflicts
This adoption declares no copy conflicts.
Earlier point returns
earlier-point-returns
This adoption declares no earlier point returns.
Test inputsscope and seeds
Some tests need a scope or seeds from the adoption before they can run.
This adoption supplies no test inputs. Every test uses its default inputs.
Acceptance tests59 tests apply
The contract comes with 85 tests. A test that runs once per row is counted once for each row. Tests that do not apply to these answers are still listed, with the reason.
run-scope-uses-cited-events
Row.id begins and ends its run only at the cited events
Does not apply to account-settings: no row in state-families matches lifetime run.
session-scope-uses-cited-events
Row.id keeps one session through returns to the same context
Does not apply to account-settings: no row in state-families matches lifetime session.
copy-carries-complete-identity · account-settings-service
account-settings-service copies carry their complete identity and their complete state-family set
Applies to the account-settings-service row.
A copy of save kind account-settings-service is one coherent accepted commit with save-kind, copy, slot when present, build, and commit identities and the complete family set at settings.service-contents. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
one accepted commit of the save kind named
account-settings-service- When
- the copy is recorded and later considered as a candidate
- Then
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
settings.service-contents - the commit record identifies one coherent accepted write rather than a collection of separately accepted fields
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
- Diagnostics
account-settings-commit-logaccount-settings-candidate-set
copy-carries-complete-identity · account-settings-cache
account-settings-cache copies carry their complete identity and their complete state-family set
Applies to the account-settings-cache row.
A copy of save kind account-settings-cache is one coherent accepted commit with save-kind, copy, slot when present, build, and commit identities and the complete family set at settings.cache-contents. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
one accepted commit of the save kind named
account-settings-cache- When
- the copy is recorded and later considered as a candidate
- Then
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
settings.cache-contents - the commit record identifies one coherent accepted write rather than a collection of separately accepted fields
- the copy record carries save-kind id, copy identity, any slot identity, build identity, commit identity, and the complete state-family set named at
- Diagnostics
account-settings-commit-logaccount-settings-candidate-set
conflict-has-two-unreplaced-accepted-copies
Row.id is a conflict only for two accepted unreplaced copies
Does not apply to account-settings: copy-conflicts has no rows.
state-family-follows-maximum-lifetime · account-settings-service-state
account-settings-service-state follows its declared maximum lifetime
Applies to the account-settings-service-state row.
account-settings-service-state has a maximum lifetime of one account. Each boundary before the end of that lifetime follows the row's result, and the trace distinguishes a restored value from an equal value derived later. The family definition is at settings.service-fields; the test names the address and restates nothing from it.
Test steps and diagnostics
- Given
account-settings-service-statechanges from an earlier value to a distinguishable value- When
- the value is read immediately before and after every declared persistence boundary that
account-settingscan construct
- the value is read immediately before and after every declared persistence boundary that
- Then
- the earlier value affects play for no longer than one account
- a boundary before the end of that lifetime clears it exactly when
account-settings-service-state's selected boundary result says so - the trace identifies restoration of the earlier value separately from a later derivation of an equal value
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
state-family-follows-maximum-lifetime · account-settings-device-cache
account-settings-device-cache follows its declared maximum lifetime
Applies to the account-settings-device-cache row.
account-settings-device-cache has a maximum lifetime of one device installation. Each boundary before the end of that lifetime follows the row's result, and the trace distinguishes a restored value from an equal value derived later. The family definition is at settings.cache-fields; the test names the address and restates nothing from it.
Test steps and diagnostics
- Given
account-settings-device-cachechanges from an earlier value to a distinguishable value- When
- the value is read immediately before and after every declared persistence boundary that
account-settingscan construct
- the value is read immediately before and after every declared persistence boundary that
- Then
- the earlier value affects play for no longer than one device installation
- a boundary before the end of that lifetime clears it exactly when
account-settings-device-cache's selected boundary result says so - the trace identifies restoration of the earlier value separately from a later derivation of an equal value
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
until-event-value-ends-at-cited-event
Row.id ends at its cited event
Does not apply to account-settings: no row in state-families matches lifetime until event.
not-kept-value-never-returns
Row.id never returns after its named interruption
Does not apply to account-settings: no row in state-families matches lifetime not kept.
slot-and-profile-end-at-cited-event
Row.id ends at its cited Row.lifetime boundary
Does not apply to account-settings: no row in state-families matches lifetime slot or profile.
commit-starts-only-at-selected-trigger · account-settings-service
account-settings-service starts a commit only at its selected trigger
Applies to the account-settings-service row.
A commit for account-settings-service begins only at the service authority's cited acceptance event under settings.accepted-change. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
events around the write rule at
settings.accepted-change- When
- the events occur before, at, and after the service authority's cited acceptance event
- Then
- one
account-settings-servicecommit starts at the service authority's cited acceptance event and no commit starts at the test events before or after it - the commit log records which cited event started it
- one
- Diagnostics
account-settings-commit-log
commit-starts-only-at-selected-trigger · account-settings-cache
account-settings-cache starts a commit only at its selected trigger
Applies to the account-settings-cache row.
A commit for account-settings-cache begins only at each cited accepted change under settings.cache-each-accepted-change. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
events around the write rule at
settings.cache-each-accepted-change- When
- the events occur before, at, and after each cited accepted change
- Then
- one
account-settings-cachecommit starts at each cited accepted change and no commit starts at an event the cited rule does not name as an accepted change - the commit log records which cited event started it
- one
- Diagnostics
account-settings-commit-log
commit-loadable-only-after-complete-success · account-settings-service
account-settings-service replaces its last commit only after complete success
Applies to the account-settings-service row.
account-settings-service becomes loadable only when settings.accepted-change reports success for the complete family set at settings.service-contents. A failed or partial write leaves the last successful commit in place. The test names both addresses and restates nothing from them.
Test steps and diagnostics
- Given
a last successful
account-settings-servicecommit and later complete-success, failed, and partial write attempts undersettings.accepted-change- When
- each attempt is followed by a return that requests
account-settings-service
- each attempt is followed by a return that requests
- Then
- only the attempt reported successful for the complete set at
settings.service-contentsbecomes loadable - a failed or partial attempt never replaces the last successful commit
- the commit and load records distinguish the retained last commit from the attempts that did not succeed
- only the attempt reported successful for the complete set at
- Diagnostics
account-settings-commit-logaccount-settings-load-resultaccount-settings-active-state-source
commit-loadable-only-after-complete-success · account-settings-cache
account-settings-cache replaces its last commit only after complete success
Applies to the account-settings-cache row.
account-settings-cache becomes loadable only when settings.cache-each-accepted-change reports success for the complete family set at settings.cache-contents. A failed or partial write leaves the last successful commit in place. The test names both addresses and restates nothing from them.
Test steps and diagnostics
- Given
a last successful
account-settings-cachecommit and later complete-success, failed, and partial write attempts undersettings.cache-each-accepted-change- When
- each attempt is followed by a return that requests
account-settings-cache
- each attempt is followed by a return that requests
- Then
- only the attempt reported successful for the complete set at
settings.cache-contentsbecomes loadable - a failed or partial attempt never replaces the last successful commit
- the commit and load records distinguish the retained last commit from the attempts that did not succeed
- only the attempt reported successful for the complete set at
- Diagnostics
account-settings-commit-logaccount-settings-load-resultaccount-settings-active-state-source
normal-quit-final-commit-follows-write-rule · account-settings-service
account-settings-service makes a final quit commit only when its rule requires one
Applies to the account-settings-service row.
On a normal quit, account-settings-service makes a final commit only when settings.accepted-change requires one. Otherwise the earlier successful commit remains the last commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
each normal-quit case the adoption can construct for changed
account-settings-servicestate undersettings.accepted-change- When
- each normal quit completes
- Then
- where
settings.accepted-changerequires a final commit, exactly one starts - where the rule does not require one, no final commit starts and the previous last successful commit remains; for a case that the adoption cannot construct, this test checks nothing
- where
- Diagnostics
account-settings-commit-log
normal-quit-final-commit-follows-write-rule · account-settings-cache
account-settings-cache makes a final quit commit only when its rule requires one
Applies to the account-settings-cache row.
On a normal quit, account-settings-cache makes a final commit only when settings.cache-each-accepted-change requires one. Otherwise the earlier successful commit remains the last commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
each normal-quit case the adoption can construct for changed
account-settings-cachestate undersettings.cache-each-accepted-change- When
- each normal quit completes
- Then
- where
settings.cache-each-accepted-changerequires a final commit, exactly one starts - where the rule does not require one, no final commit starts and the previous last successful commit remains; for a case that the adoption cannot construct, this test checks nothing
- where
- Diagnostics
account-settings-commit-log
normal-quit-returns-last-commit · account-settings-service-state
account-settings-service-state returns its last commit after a normal quit
Applies to the account-settings-service-state row.
After a normal quit, account-settings-service-state returns from the latest successful commit of the save kind named by saved-in; its uncommitted change does not return. If the row has no saved-in, this test checks nothing about restoration.
Test steps and diagnostics
- Given
a committed
account-settings-service-statevalue followed by a distinguishable uncommitted change- When
- the game quits normally and returns through the same context
- Then
- where this family names a save kind at saved-in, the latest successful commit of that kind restores
account-settings-service-stateand the uncommitted change does not return - where this family has no saved-in, this test checks nothing about restoration
- where this family names a save kind at saved-in, the latest successful commit of that kind restores
- Diagnostics
account-settings-commit-logaccount-settings-load-resultaccount-settings-active-state-source
normal-quit-returns-last-commit · account-settings-device-cache
account-settings-device-cache returns its last commit after a normal quit
Applies to the account-settings-device-cache row.
After a normal quit, account-settings-device-cache returns from the latest successful commit of the save kind named by saved-in; its uncommitted change does not return. If the row has no saved-in, this test checks nothing about restoration.
Test steps and diagnostics
- Given
a committed
account-settings-device-cachevalue followed by a distinguishable uncommitted change- When
- the game quits normally and returns through the same context
- Then
- where this family names a save kind at saved-in, the latest successful commit of that kind restores
account-settings-device-cacheand the uncommitted change does not return - where this family has no saved-in, this test checks nothing about restoration
- where this family names a save kind at saved-in, the latest successful commit of that kind restores
- Diagnostics
account-settings-commit-logaccount-settings-load-resultaccount-settings-active-state-source
normal-quit-does-not-return
Row.id does not return after a normal quit
Does not apply to account-settings: no row in state-families matches after-normal-quit does not return.
crash-returns-last-commit · account-settings-service-state
account-settings-service-state returns its last completed commit after a crash
Applies to the account-settings-service-state row.
After a crash, no unfinished commit succeeds. account-settings-service-state returns from the last successful commit of the save kind named by saved-in, without later changes. If the row has no saved-in, this test checks nothing about restoration.
Test steps and diagnostics
- Given
a committed
account-settings-service-statevalue, then a distinguishable change and an unfinished commit- When
- the game crashes and returns through the same context
- Then
- the unfinished commit does not succeed
- where this family names a save kind at saved-in, the last commit completed before the crash restores
account-settings-service-stateand the later change does not return - where this family has no saved-in, this test checks nothing about restoration
- Diagnostics
account-settings-commit-logaccount-settings-load-resultaccount-settings-active-state-source
crash-returns-last-commit · account-settings-device-cache
account-settings-device-cache returns its last completed commit after a crash
Applies to the account-settings-device-cache row.
After a crash, no unfinished commit succeeds. account-settings-device-cache returns from the last successful commit of the save kind named by saved-in, without later changes. If the row has no saved-in, this test checks nothing about restoration.
Test steps and diagnostics
- Given
a committed
account-settings-device-cachevalue, then a distinguishable change and an unfinished commit- When
- the game crashes and returns through the same context
- Then
- the unfinished commit does not succeed
- where this family names a save kind at saved-in, the last commit completed before the crash restores
account-settings-device-cacheand the later change does not return - where this family has no saved-in, this test checks nothing about restoration
- Diagnostics
account-settings-commit-logaccount-settings-load-resultaccount-settings-active-state-source
crash-does-not-return
Row.id does not return after a crash
Does not apply to account-settings: no row in state-families matches after-crash does not return.
timer-and-checkpoint-have-crash-loss-window
Row.id reports its possible crash loss window
Does not apply to account-settings: no row in copy-kinds matches write-trigger timer or checkpoint.
layout-selects-requested-copy · account-settings-service
account-settings-service selects its requested copy before activation
Applies to the account-settings-service row.
Before activation, account-settings-service selects its current copy and presents no player-selected slot under settings.account-service. Where an earlier commit is retained, it is not another layout. Where none is retained, this test checks nothing about earlier commits. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the player requests
account-settings-servicethrough the selection route atsettings.account-serviceand, where the adoption retains one, an earlier commit is also available- When
- selection completes before any state activation
- Then
account-settings-serviceselects its current copy and presents no player-selected slot- where an earlier commit is retained, it is not treated as another layout choice and remains available only through its matching backup and damage routes; where none is retained, this test checks nothing about earlier commits
- Diagnostics
account-settings-candidate-setaccount-settings-active-state-source
layout-selects-requested-copy · account-settings-cache
account-settings-cache selects its requested copy before activation
Applies to the account-settings-cache row.
Before activation, account-settings-cache selects its current copy and presents no player-selected slot under settings.local-profile-cache. Where an earlier commit is retained, it is not another layout. Where none is retained, this test checks nothing about earlier commits. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the player requests
account-settings-cachethrough the selection route atsettings.local-profile-cacheand, where the adoption retains one, an earlier commit is also available- When
- selection completes before any state activation
- Then
account-settings-cacheselects its current copy and presents no player-selected slot- where an earlier commit is retained, it is not treated as another layout choice and remains available only through its matching backup and damage routes; where none is retained, this test checks nothing about earlier commits
- Diagnostics
account-settings-candidate-setaccount-settings-active-state-source
residence-controls-authoritative-candidates · account-settings-service
account-settings-service obtains candidates from its declared residence
Applies to the account-settings-service row.
account-settings-service obtains the service's accepted copy and never treats an unaccepted local cache as equal authority under settings.account-service. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the candidate sources the adoption can construct for
account-settings-serviceas governed atsettings.account-service- When
- the game builds the candidate set before conflict handling
- Then
account-settings-serviceobtains the service's accepted copy and never treats an unaccepted local cache as equal authority
- Diagnostics
account-settings-candidate-setaccount-settings-authority-trace
residence-controls-authoritative-candidates · account-settings-cache
account-settings-cache obtains candidates from its declared residence
Applies to the account-settings-cache row.
account-settings-cache is available only on that device unless a transfer cited outside this adoption supplies it under settings.local-profile-cache. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the candidate sources the adoption can construct for
account-settings-cacheas governed atsettings.local-profile-cache- When
- the game builds the candidate set before conflict handling
- Then
account-settings-cacheis available only on that device unless a transfer cited outside this adoption supplies it
- Diagnostics
account-settings-candidate-setaccount-settings-authority-trace
candidate-identity-precedes-settlement · account-settings-service
account-settings-service reads candidate identity before settlement
Applies to the account-settings-service row.
account-settings-service reads candidate identity first. A candidate with an unreadable identity cannot enter conflict handling. When no candidate remains, the effective damage response runs immediately. A readable header with an unreadable body reaches the damage response only after conflict and build comparison.
Test steps and diagnostics
- Given
account-settings-servicecandidates with readable identity, unreadable identity, and a readable header with an unreadable gameplay body- When
- the game reads candidate identity before conflict, build, or damage settlement
- Then
- save-kind, slot when present, build, and commit identity are read before gameplay state
- an unreadable identity is not a conflict candidate; if no candidate remains, the effective damage response runs immediately without conflict or build comparison
- a readable header with an unreadable body remains a candidate through conflict and build comparison before reaching damage settlement
- Diagnostics
account-settings-candidate-setaccount-settings-settlement-traceaccount-settings-damage-report
candidate-identity-precedes-settlement · account-settings-cache
account-settings-cache reads candidate identity before settlement
Applies to the account-settings-cache row.
account-settings-cache reads candidate identity first. A candidate with an unreadable identity cannot enter conflict handling. When no candidate remains, the effective damage response runs immediately. A readable header with an unreadable body reaches the damage response only after conflict and build comparison.
Test steps and diagnostics
- Given
account-settings-cachecandidates with readable identity, unreadable identity, and a readable header with an unreadable gameplay body- When
- the game reads candidate identity before conflict, build, or damage settlement
- Then
- save-kind, slot when present, build, and commit identity are read before gameplay state
- an unreadable identity is not a conflict candidate; if no candidate remains, the effective damage response runs immediately without conflict or build comparison
- a readable header with an unreadable body remains a candidate through conflict and build comparison before reaching damage settlement
- Diagnostics
account-settings-candidate-setaccount-settings-settlement-traceaccount-settings-damage-report
missing-conflict-row-runs-no-conflict-response · account-settings-service
account-settings-service has no conflict response without a matching row
Applies to the account-settings-service row.
If account-settings-service has no matching conflict row, this contract performs no conflict response for it. If it has one, this test checks nothing.
Test steps and diagnostics
- Given
a candidate set for
account-settings-service- When
- the game looks for a matching copy-conflicts row before build comparison
- Then
- where no matching conflict row exists, no candidate is selected, refused, or replaced by a conflict response from this contract
- where a matching row exists, this test checks nothing
- Diagnostics
account-settings-candidate-setaccount-settings-settlement-trace
missing-conflict-row-runs-no-conflict-response · account-settings-cache
account-settings-cache has no conflict response without a matching row
Applies to the account-settings-cache row.
If account-settings-cache has no matching conflict row, this contract performs no conflict response for it. If it has one, this test checks nothing.
Test steps and diagnostics
- Given
a candidate set for
account-settings-cache- When
- the game looks for a matching copy-conflicts row before build comparison
- Then
- where no matching conflict row exists, no candidate is selected, refused, or replaced by a conflict response from this contract
- where a matching row exists, this test checks nothing
- Diagnostics
account-settings-candidate-setaccount-settings-settlement-trace
one-kind-conflict-settles-only-named-kind
Row.id settles only Row.copy kind
Does not apply to account-settings: copy-conflicts has no rows.
all-synced-conflict-settles-whole-set
Row.id settles every synced save kind together
Does not apply to account-settings: copy-conflicts has no rows.
conflict-select-by-rule
Row.id applies select-by-rule
Does not apply to account-settings: copy-conflicts has no rows.
conflict-player-chooses-copy
Row.id applies player-chooses-copy
Does not apply to account-settings: copy-conflicts has no rows.
conflict-refuse-until-resolved
Row.id applies refuse-until-resolved
Does not apply to account-settings: copy-conflicts has no rows.
older-build-override-refuse-load
Row.id applies its older-build refuse-load override
Does not apply to account-settings: no row in copy-kinds matches older-build-copy refuse load.
older-build-default-refuse-load
Row.id applies the default answer refuse-load for an older build
Does not apply to account-settings: older build default is convert and load, not refuse load.
older-build-override-convert-and-load
Row.id applies its older-build convert-and-load override
Does not apply to account-settings: no row in copy-kinds matches older-build-copy convert and load.
older-build-default-convert-and-load · account-settings-service
account-settings-service applies the default answer convert-and-load for an older build
Applies to the account-settings-service row.
account-settings-service uses the default answer for an older build and converts the copy to one coherent current-build copy before successful activation; a failed conversion refuses the load and leaves the source copy unchanged unless its cited rule records another result for the source copy. The observable consequence is stated here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of save kind
account-settings-servicewritten by an older build, with no unresolved conflict- When
- one conversion succeeds and a second constructed conversion fails
- Then
- the successful conversion produces one coherent current-build copy before all of its carried families activate together
- the failed conversion refuses activation and leaves the source copy unchanged unless its cited rule records another result for the source copy
- the conversion record distinguishes success, refusal, and what happened to the source copy
- Diagnostics
account-settings-writer-and-reader-buildsaccount-settings-conversion-resultaccount-settings-load-resultaccount-settings-active-state-source
older-build-default-convert-and-load · account-settings-cache
account-settings-cache applies the default answer convert-and-load for an older build
Applies to the account-settings-cache row.
account-settings-cache uses the default answer for an older build and converts the copy to one coherent current-build copy before successful activation; a failed conversion refuses the load and leaves the source copy unchanged unless its cited rule records another result for the source copy. The observable consequence is stated here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of save kind
account-settings-cachewritten by an older build, with no unresolved conflict- When
- one conversion succeeds and a second constructed conversion fails
- Then
- the successful conversion produces one coherent current-build copy before all of its carried families activate together
- the failed conversion refuses activation and leaves the source copy unchanged unless its cited rule records another result for the source copy
- the conversion record distinguishes success, refusal, and what happened to the source copy
- Diagnostics
account-settings-writer-and-reader-buildsaccount-settings-conversion-resultaccount-settings-load-resultaccount-settings-active-state-source
older-build-override-warn-and-load
Row.id applies its older-build warn-and-load override
Does not apply to account-settings: no row in copy-kinds matches older-build-copy warn and load.
older-build-default-warn-and-load
Row.id applies the default answer warn-and-load for an older build
Does not apply to account-settings: older build default is convert and load, not warn and load.
newer-build-override-refuse-load
Row.id applies its newer-build refuse-load override
Does not apply to account-settings: no row in copy-kinds matches newer-build-copy refuse load.
newer-build-default-refuse-load · account-settings-service
account-settings-service applies the default answer refuse-load for a newer build
Applies to the account-settings-service row.
account-settings-service uses the default answer for a newer build and refuses the load before any mismatched-build state activates. The observable consequence is stated here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of save kind
account-settings-servicewritten by a newer build, with no unresolved conflict- When
- the player requests the copy
- Then
- loading stops before any state from the mismatched-build copy activates
- the refusal record distinguishes refusal from an absent or unreadable copy
- Diagnostics
account-settings-writer-and-reader-buildsaccount-settings-load-resultaccount-settings-active-state-source
newer-build-default-refuse-load · account-settings-cache
account-settings-cache applies the default answer refuse-load for a newer build
Applies to the account-settings-cache row.
account-settings-cache uses the default answer for a newer build and refuses the load before any mismatched-build state activates. The observable consequence is stated here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected readable copy of save kind
account-settings-cachewritten by a newer build, with no unresolved conflict- When
- the player requests the copy
- Then
- loading stops before any state from the mismatched-build copy activates
- the refusal record distinguishes refusal from an absent or unreadable copy
- Diagnostics
account-settings-writer-and-reader-buildsaccount-settings-load-resultaccount-settings-active-state-source
newer-build-override-warn-and-load
Row.id applies its newer-build warn-and-load override
Does not apply to account-settings: no row in copy-kinds matches newer-build-copy warn and load.
newer-build-default-warn-and-load
Row.id applies the default answer warn-and-load for a newer build
Does not apply to account-settings: newer build default is refuse load, not warn and load.
unreadable-copy-override-refuse-load
Row.id applies its unreadable-copy refuse-load override
Does not apply to account-settings: no row in copy-kinds matches unreadable-copy refuse load.
unreadable-copy-default-refuse-load
Row.id applies the default answer refuse-load for an unreadable copy
Does not apply to account-settings: unreadable copy default is repair readable state, not refuse load.
unreadable-copy-override-start-fresh · account-settings-cache
account-settings-cache applies its unreadable-copy start-fresh override
Applies to the account-settings-cache row.
account-settings-cache overrides the default answer for an unreadable copy and activates the adoption's starting state without silently deleting or overwriting the unreadable copy. The observable consequence is stated here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected copy of save kind
account-settings-cachewhose gameplay body is unreadable after conflict and build settlement- When
- the player requests the unreadable copy
- Then
- the starting state named by the adoption becomes active instead of state from the unreadable copy
- the unreadable copy is not silently deleted or overwritten
- the source and removal records distinguish a new start from a deletion
- Diagnostics
account-settings-damage-reportaccount-settings-load-resultaccount-settings-active-state-sourceaccount-settings-removal-log
unreadable-copy-default-start-fresh
Row.id applies the default answer start-fresh for an unreadable copy
Does not apply to account-settings: unreadable copy default is repair readable state, not start fresh.
unreadable-copy-override-restore-earlier-copy
Row.id applies its unreadable-copy restore-earlier-copy override
Does not apply to account-settings: no row in copy-kinds matches unreadable-copy restore earlier copy.
unreadable-copy-default-restore-earlier-copy
Row.id applies the default answer restore-earlier-copy for an unreadable copy
Does not apply to account-settings: unreadable copy default is repair readable state, not restore earlier copy.
unreadable-copy-override-repair-readable-state
Row.id applies its unreadable-copy repair-readable-state override
Does not apply to account-settings: no row in copy-kinds matches unreadable-copy repair readable state.
unreadable-copy-default-repair-readable-state · account-settings-service
account-settings-service applies the default answer repair-readable-state for an unreadable copy
Applies to the account-settings-service row.
account-settings-service uses the default answer for an unreadable copy and activates one coherent repaired result with every unreadable part reset under the cited rule; a failed repair refuses the load. The observable consequence is stated here; the test restates nothing from the adoption's cited rule.
Test steps and diagnostics
- Given
a selected copy of save kind
account-settings-servicewhose gameplay body is unreadable after conflict and build settlement- When
- one repair produces a coherent result and a second constructed repair cannot do so
- Then
- the successful repair activates one coherent result containing every readable part and the starting value for every unreadable part under the cited repair rule
- the failed repair refuses the load and activates no state
- the repair record distinguishes retained readable parts, reset parts, and failure
- Diagnostics
account-settings-damage-reportaccount-settings-load-resultaccount-settings-active-state-sourceaccount-settings-removal-log
unreadable-copy-override-warn-and-try
Row.id applies its unreadable-copy warn-and-try override
Does not apply to account-settings: no row in copy-kinds matches unreadable-copy warn and try.
unreadable-copy-default-warn-and-try
Row.id applies the default answer warn-and-try for an unreadable copy
Does not apply to account-settings: unreadable copy default is repair readable state, not warn and try.
backup-retains-orders-and-restores-earlier-copies
Row.id retains and restores earlier copies
Does not apply to account-settings: backup-copies has no rows.
readable-compatible-copy-activates-together · account-settings-service
account-settings-service loads a readable compatible conflict-free copy
Applies to the account-settings-service row.
A readable, same-build, conflict-free copy of save kind account-settings-service loads successfully and activates every family at settings.service-contents together from one commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a selected readable copy of save kind
account-settings-servicefrom the running build with no conflict, carrying distinguishable values for every family atsettings.service-contents- When
- the game loads the copy
- Then
- the load is accepted rather than refused
- every carried state family activates together from one commit
- no partial copy is visible at any point
- Diagnostics
account-settings-load-resultaccount-settings-active-state-sourceaccount-settings-activation-trace
readable-compatible-copy-activates-together · account-settings-cache
account-settings-cache loads a readable compatible conflict-free copy
Applies to the account-settings-cache row.
A readable, same-build, conflict-free copy of save kind account-settings-cache loads successfully and activates every family at settings.cache-contents together from one commit. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a selected readable copy of save kind
account-settings-cachefrom the running build with no conflict, carrying distinguishable values for every family atsettings.cache-contents- When
- the game loads the copy
- Then
- the load is accepted rather than refused
- every carried state family activates together from one commit
- no partial copy is visible at any point
- Diagnostics
account-settings-load-resultaccount-settings-active-state-sourceaccount-settings-activation-trace
load-preserves-families-from-other-kinds · account-settings-service
loading account-settings-service preserves state from other save kinds
Applies to the account-settings-service row.
Loading account-settings-service activates its carried families together and preserves the active value of every family saved in another save kind. If no other save kind exists, this test checks nothing about other save kinds.
Test steps and diagnostics
- Given
active distinguishable state from
account-settings-serviceand, where the adoption declares one, another save kind- When
- a readable compatible conflict-free copy of save kind
account-settings-serviceloads successfully
- a readable compatible conflict-free copy of save kind
- Then
- families carried by
account-settings-serviceactivate together from its selected commit - families saved in another save kind keep that kind's already active value
- where no other save kind exists, this test checks nothing about other save kinds
- families carried by
- Diagnostics
account-settings-activation-traceaccount-settings-active-state-source
load-preserves-families-from-other-kinds · account-settings-cache
loading account-settings-cache preserves state from other save kinds
Applies to the account-settings-cache row.
Loading account-settings-cache activates its carried families together and preserves the active value of every family saved in another save kind. If no other save kind exists, this test checks nothing about other save kinds.
Test steps and diagnostics
- Given
active distinguishable state from
account-settings-cacheand, where the adoption declares one, another save kind- When
- a readable compatible conflict-free copy of save kind
account-settings-cacheloads successfully
- a readable compatible conflict-free copy of save kind
- Then
- families carried by
account-settings-cacheactivate together from its selected commit - families saved in another save kind keep that kind's already active value
- where no other save kind exists, this test checks nothing about other save kinds
- families carried by
- Diagnostics
account-settings-activation-traceaccount-settings-active-state-source
family-without-saved-in-is-never-restored · account-settings-service-state
account-settings-service-state is never restored when it names no save kind
Applies to the account-settings-service-state row.
For account-settings-service-state, when it has no saved-in, no return path restores its earlier value. For account-settings-service-state, when it names saved-in, only an accepted load of that save kind restores its earlier value; no other return path does.
Test steps and diagnostics
- Given
a distinguishable earlier
account-settings-service-statevalue and every return path the adoption can construct- When
- the return paths complete
- Then
- where
account-settings-service-statehas no saved-in, none of the return paths restores its earlier value - where
account-settings-service-statenames saved-in, its earlier value is restored only by an accepted load of that save kind and by no other return path
- where
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
family-without-saved-in-is-never-restored · account-settings-device-cache
account-settings-device-cache is never restored when it names no save kind
Applies to the account-settings-device-cache row.
For account-settings-device-cache, when it has no saved-in, no return path restores its earlier value. For account-settings-device-cache, when it names saved-in, only an accepted load of that save kind restores its earlier value; no other return path does.
Test steps and diagnostics
- Given
a distinguishable earlier
account-settings-device-cachevalue and every return path the adoption can construct- When
- the return paths complete
- Then
- where
account-settings-device-cachehas no saved-in, none of the return paths restores its earlier value - where
account-settings-device-cachenames saved-in, its earlier value is restored only by an accepted load of that save kind and by no other return path
- where
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
earlier-point-follows-after-load
Row.id follows its after-load result
Does not apply to account-settings: earlier-point-returns has no rows.
missing-earlier-point-row-returns-nowhere · account-settings-service
account-settings-service returns to no earlier point without an earlier-point row
Applies to the account-settings-service row.
A successful account-settings-service load returns continuous play to no earlier point under this contract when no earlier-point row names it. When a row names it, this test checks nothing.
Test steps and diagnostics
- Given
a successful
account-settings-serviceload- When
- the game checks for an earlier-point-returns row after activation
- Then
- where no row names
account-settings-service, this contract returns continuous play to no earlier point - where a row names
account-settings-service, this test checks nothing
- where no row names
- Diagnostics
account-settings-load-resultaccount-settings-return-point
missing-earlier-point-row-returns-nowhere · account-settings-cache
account-settings-cache returns to no earlier point without an earlier-point row
Applies to the account-settings-cache row.
A successful account-settings-cache load returns continuous play to no earlier point under this contract when no earlier-point row names it. When a row names it, this test checks nothing.
Test steps and diagnostics
- Given
a successful
account-settings-cacheload- When
- the game checks for an earlier-point-returns row after activation
- Then
- where no row names
account-settings-cache, this contract returns continuous play to no earlier point - where a row names
account-settings-cache, this test checks nothing
- where no row names
- Diagnostics
account-settings-load-resultaccount-settings-return-point
earlier-point-mode-gate-controls-existence
Row.id exists only in its named modes
Does not apply to account-settings: earlier-point-returns has no rows.
death-follows-family-result · account-settings-service-state
account-settings-service-state follows its death result
Applies to the account-settings-service-state row.
On death, account-settings-service-state follows its selected result: the earlier value remains available to later play.
Test steps and diagnostics
- Given
a distinguishable
account-settings-service-statevalue immediately before death- When
- death settles before any death-triggered copy removal the adoption declares
- Then
- the earlier value remains available to later play
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
death-follows-family-result · account-settings-device-cache
account-settings-device-cache follows its death result
Applies to the account-settings-device-cache row.
On death, account-settings-device-cache follows its selected result: the earlier value remains available to later play.
Test steps and diagnostics
- Given
a distinguishable
account-settings-device-cachevalue immediately before death- When
- death settles before any death-triggered copy removal the adoption declares
- Then
- the earlier value remains available to later play
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
death-at-run-end-clears-run-family
Row.id clears when death is its run end
Does not apply to account-settings: no row in state-families matches lifetime run.
death-at-until-event-clears-family
Row.id clears when death is its cited event
Does not apply to account-settings: no row in state-families matches lifetime until event.
slot-deletion-follows-family-result · account-settings-service-state
account-settings-service-state follows its slot-deletion result
Applies to the account-settings-service-state row.
On slot deletion, account-settings-service-state follows its selected result: the settlement records that this family has no related player-selected slot.
Test steps and diagnostics
- Given
a distinguishable family value when it has no related player-selected slot
- When
- a slot-deletion boundary is considered
- Then
- the settlement records that this family has no related player-selected slot
- Diagnostics
account-settings-state-boundary-traceaccount-settings-settlement-report
slot-deletion-follows-family-result · account-settings-device-cache
account-settings-device-cache follows its slot-deletion result
Applies to the account-settings-device-cache row.
On slot deletion, account-settings-device-cache follows its selected result: the settlement records that this family has no related player-selected slot.
Test steps and diagnostics
- Given
a distinguishable family value when it has no related player-selected slot
- When
- a slot-deletion boundary is considered
- Then
- the settlement records that this family has no related player-selected slot
- Diagnostics
account-settings-state-boundary-traceaccount-settings-settlement-report
local-profile-deletion-follows-family-result · account-settings-service-state
account-settings-service-state follows its local-profile-deletion result
Applies to the account-settings-service-state row.
On local-profile deletion, account-settings-service-state follows its selected result: the settlement records that this family has no related local player profile. Where a related profile exists, child slots are included only as the adoption's cited rule provides. Where no related profile exists, this test checks nothing about child slots. The test restates nothing from the cited rule.
Test steps and diagnostics
- Given
a distinguishable family value when it has no related local player profile
- When
- a local-profile-deletion boundary is considered
- Then
- the settlement records that this family has no related local player profile
- Diagnostics
account-settings-state-boundary-traceaccount-settings-settlement-reportaccount-settings-removal-log
local-profile-deletion-follows-family-result · account-settings-device-cache
account-settings-device-cache follows its local-profile-deletion result
Applies to the account-settings-device-cache row.
On local-profile deletion, account-settings-device-cache follows its selected result: the earlier value tied to that local profile clears before later play. Where a related profile exists, child slots are included only as the adoption's cited rule provides. Where no related profile exists, this test checks nothing about child slots. The test restates nothing from the cited rule.
Test steps and diagnostics
- Given
a distinguishable family value before deletion of its related local profile
- When
- the related local profile is deleted with every child slot named by the adoption's cited rule
- Then
- the earlier value tied to that local profile clears before later play
- Diagnostics
account-settings-state-boundary-traceaccount-settings-settlement-reportaccount-settings-removal-log
device-lifetime-ends-at-device-data-deletion · account-settings-device-cache
account-settings-device-cache ends when device data is deleted
Applies to the account-settings-device-cache row.
Device-data deletion ends account-settings-device-cache through device.erase-local-data. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a distinguishable
account-settings-device-cachevalue before device-data deletion- When
- the event at
device.erase-local-datadeletes device data
- the event at
- Then
- the earlier device-lifetime value ends and cannot affect later play
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
account-lifetime-ends-at-account-deletion · account-settings-service-state
account-settings-service-state ends when its account is deleted or reset
Applies to the account-settings-service-state row.
Account deletion or reset ends account-settings-service-state through account.delete-or-reset. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a distinguishable
account-settings-service-statevalue before account deletion or reset- When
- the event at
account.delete-or-resetdeletes or resets the account
- the event at
- Then
- the earlier account-lifetime value ends and cannot affect later play
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
another-device-returns-family · account-settings-service-state
account-settings-service-state returns on another eligible device
Applies to the account-settings-service-state row.
On another eligible device, account-settings-service-state is obtained from its synced or authoritative copy before activation. Conflict handling still runs and applies the response of the conflict row that matches that save kind; where no row matches, this test checks nothing about a conflict response. The device change does not delete any source-device copy; if none exists, this test checks nothing about a source-device copy.
Test steps and diagnostics
- Given
a distinguishable
account-settings-service-statevalue on one device before the same eligible player continues on another- When
- the new device settles available state
- Then
- the family is obtained from its synced or authoritative copy before activation and conflict handling still runs, applying the response of the conflict row that matches that save kind; where no conflict row matches it, this test checks nothing about a conflict response
- any source-device copy is not deleted by the device change; where none exists, this test checks nothing about a source-device copy
- Diagnostics
account-settings-candidate-setaccount-settings-conflict-reportaccount-settings-active-state-sourceaccount-settings-removal-log
another-device-does-not-return-family · account-settings-device-cache
account-settings-device-cache does not return on another device
Applies to the account-settings-device-cache row.
On another eligible device, the earlier account-settings-device-cache value does not return. Its new-device value follows settings.cache-fields. The device change does not delete any source-device copy; if none exists, this test checks nothing about a source-device copy. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
a distinguishable
account-settings-device-cachevalue on one device before the same eligible player continues on another- When
- the new device settles available state
- Then
- the earlier value does not activate and the family starts from the new-device value governed at
settings.cache-fields - any source-device copy is not deleted by the device change; where none exists, this test checks nothing about a source-device copy
- the earlier value does not activate and the family starts from the new-device value governed at
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-sourceaccount-settings-removal-log
removed-copy-disappears-at-selected-event
Row.id disappears at its removal event
Does not apply to account-settings: no row in copy-kinds matches removed-at normal quit or crash or death or slot delete or local profile delete or device data delete or account delete.
copy-kind-mode-gate-controls-existence
Row.id exists only in its named modes
Does not apply to account-settings: no row in copy-kinds matches mode-gated only in named modes.
cleared-or-ended-value-never-affects-later-play
ended and cleared values stay absent
Applies to account-settings.
After a lifetime ends or a boundary result clears a value, that earlier value never affects later play. An equal value derived later is new state. If no such case can be constructed, this test checks nothing.
Test steps and diagnostics
- Given
every event the
account-settingsadoption can construct where a lifetime ends or a boundary result clears an earlier value- When
- later play reaches points where an equal value can be derived
- Then
- the earlier value never affects later play after the end or clearing event
- any equal value derived later is recorded as new state rather than restoration
- where the adoption can construct no such event, this test checks nothing
- Diagnostics
account-settings-state-boundary-traceaccount-settings-active-state-source
settlement-report-is-complete
every settlement report records its complete result
Applies to account-settings.
Every settlement report carries the mechanism's full identity, boundary, commit, selection, response, result, and loss fields. Conflict and damage reports add their required facts and never claim an unattempted success. For a case that the adoption cannot construct, this test checks nothing.
Test steps and diagnostics
- Given
each persistence settlement the
account-settingsadoption can construct- When
- the settlement completes or refuses
- Then
- the report identifies state-family id, save-kind id or its absence, event, scope before and after, last successful commit when read, selected copy and build when loaded, override or default answer used, state result, and any lost interval
- a conflict report also identifies both candidate commits and the selected response
- a damage report identifies refusal, starting state, earlier-copy recovery, repaired parts, or warning choice and never claims an unattempted load succeeded
- where a conflict, damage case, load, or answered question does not arise, this test checks nothing about it
- Diagnostics
account-settings-settlement-reportaccount-settings-conflict-reportaccount-settings-damage-report
state-family-citation-states-its-duty · account-settings-service-state
declaration check: account-settings-service-state's state citation states its duty
Applies to the account-settings-service-state row.
This declaration check reads the adoption and cited prose, not the running game. settings.service-fields must name every field in account-settings-service-state and every point where it can affect later play. For a family that answers does-not-return after a quit, a crash, or on another device, it must also name the value the family starts from; otherwise this test checks nothing about a starting value. When the cited prose has another meaning, the adoption is invalid, and this test fails. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
account-settingsadoption and the prose atsettings.service-fields, not the running game- When
- a reviewer checks the citation's meaning
- Then
settings.service-fieldsnames every field in this state family and every point where it can affect later play- where the row answers does-not-return after a quit, a crash, or on another device,
settings.service-fieldsalso names the value the family starts from; where it never gives that answer for those cases, this test checks nothing about a starting value - when the cited prose has another meaning, the adoption is invalid, and this test fails
- Diagnostics
account-settings-declaration-record
state-family-citation-states-its-duty · account-settings-device-cache
declaration check: account-settings-device-cache's state citation states its duty
Applies to the account-settings-device-cache row.
This declaration check reads the adoption and cited prose, not the running game. settings.cache-fields must name every field in account-settings-device-cache and every point where it can affect later play. For a family that answers does-not-return after a quit, a crash, or on another device, it must also name the value the family starts from; otherwise this test checks nothing about a starting value. When the cited prose has another meaning, the adoption is invalid, and this test fails. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
account-settingsadoption and the prose atsettings.cache-fields, not the running game- When
- a reviewer checks the citation's meaning
- Then
settings.cache-fieldsnames every field in this state family and every point where it can affect later play- where the row answers does-not-return after a quit, a crash, or on another device,
settings.cache-fieldsalso names the value the family starts from; where it never gives that answer for those cases, this test checks nothing about a starting value - when the cited prose has another meaning, the adoption is invalid, and this test fails
- Diagnostics
account-settings-declaration-record
saved-in-joins-a-copy-kind · account-settings-service-state
declaration check: account-settings-service-state names an existing save kind when saved
Applies to the account-settings-service-state row.
This declaration check reads the adoption, not the running game. When account-settings-service-state has saved-in, it must name exactly one save kind in this adoption. When it names anything else, the adoption is invalid, and this test fails. With no saved-in, this test checks nothing. It says nothing about a family held in two places at once; one family names one restoring save kind.
Test steps and diagnostics
- Given
the
account-settingsadoption document, not the running game- When
- a reviewer reads
account-settings-service-state's saved-in field
- a reviewer reads
- Then
- where saved-in is present, it names exactly one copy-kinds row in this adoption; when it names anything else, the adoption is invalid, and this test fails
- where saved-in is absent, this test checks nothing
- Diagnostics
account-settings-declaration-record
saved-in-joins-a-copy-kind · account-settings-device-cache
declaration check: account-settings-device-cache names an existing save kind when saved
Applies to the account-settings-device-cache row.
This declaration check reads the adoption, not the running game. When account-settings-device-cache has saved-in, it must name exactly one save kind in this adoption. When it names anything else, the adoption is invalid, and this test fails. With no saved-in, this test checks nothing. It says nothing about a family held in two places at once; one family names one restoring save kind.
Test steps and diagnostics
- Given
the
account-settingsadoption document, not the running game- When
- a reviewer reads
account-settings-device-cache's saved-in field
- a reviewer reads
- Then
- where saved-in is present, it names exactly one copy-kinds row in this adoption; when it names anything else, the adoption is invalid, and this test fails
- where saved-in is absent, this test checks nothing
- Diagnostics
account-settings-declaration-record
backup-copy-kind-joins
declaration check: Row.id names an existing save kind
Does not apply to account-settings: backup-copies has no rows.
conflict-copy-kind-joins
declaration check: Row.id names an existing shared save kind
Does not apply to account-settings: copy-conflicts has no rows.
earlier-point-copy-kind-joins
declaration check: Row.id names an existing save kind
Does not apply to account-settings: earlier-point-returns has no rows.
account-family-names-account-ending · account-settings-service-state
declaration check: account-settings-service-state names account deletion or reset as its end
Applies to the account-settings-service-state row.
This declaration check reads the adoption and cited prose, not the running game. account.delete-or-reset must name account deletion or reset. When it has another meaning, the adoption is invalid, and this test fails. The test names the address and restates nothing from it.
Test steps and diagnostics
- Given
the
account-settingsadoption and the prose ataccount.delete-or-reset, not the running game- When
- a reviewer checks the meaning of the cited ending
- Then
account.delete-or-resetnames account deletion or reset; when it has another meaning, the adoption is invalid, and this test fails
- Diagnostics
account-settings-declaration-record
restore-earlier-override-has-backup
declaration check: Row.id's restore-earlier-copy override has a backup row
Does not apply to account-settings: no row in copy-kinds matches unreadable-copy restore earlier copy.
restore-earlier-default-has-backup
declaration check: the default answer restore-earlier-copy for Row.id has a backup row
Does not apply to account-settings: unreadable copy default is repair readable state, not restore earlier copy.
returning-family-uses-shared-authority · account-settings-service-state
declaration check: account-settings-service-state returns from a cloud-synced or server-authoritative save kind
Applies to the account-settings-service-state row.
This declaration check reads the adoption, not the running game. A returning account-settings-service-state family must name exactly one cloud-synced or server-authoritative save kind that restores it. When it does not, the adoption is invalid, and this test fails.
Test steps and diagnostics
- Given
the
account-settingsadoption document, not the running game- When
- a reviewer follows
account-settings-service-state's saved-in name to a copy-kinds row
- a reviewer follows
- Then
- saved-in is present and names exactly one cloud-synced or server-authoritative save kind; when it does not, the adoption is invalid, and this test fails
- Diagnostics
account-settings-declaration-record
one-conflict-row-per-scope
declaration check: each conflict scope has at most one row
Applies to account-settings.
This declaration check reads the adoption, not the running game. Each represented conflict scope has at most one row. When a scope has more than one row, the adoption is invalid, and this test fails. With no conflict rows, this test checks nothing.
Test steps and diagnostics
- Given
the
account-settingsadoption document, not the running game- When
- a reviewer groups copy-conflicts rows by a this-copy-kind name or the all-synced-kinds scope
- Then
- no declared scope has more than one conflict row; when a scope has more than one row, the adoption is invalid, and this test fails; with no conflict rows, this test checks nothing
- Diagnostics
account-settings-declaration-record
one-earlier-point-row-per-copy-kind
declaration check: each save kind has at most one earlier-point row
Applies to account-settings.
This declaration check reads the adoption, not the running game. Each save kind has at most one earlier-point row. When more than one row names a save kind, the adoption is invalid, and this test fails. With no such rows, this test checks nothing.
Test steps and diagnostics
- Given
the
account-settingsadoption document, not the running game- When
- a reviewer groups earlier-point-returns rows by copy-kind
- Then
- no save kind is named by more than one earlier-point-returns row; when more than one row names a save kind, the adoption is invalid, and this test fails; with no such rows, this test checks nothing
- Diagnostics
account-settings-declaration-record
copy-citations-state-their-duties · account-settings-service
declaration check: account-settings-service's required citations state their duties
Applies to the account-settings-service row.
This declaration check reads the adoption and cited prose, not the running game. settings.service-contents must state the state-family set. settings.accepted-change must state when a write succeeds and what the loss window is. settings.account-service must state the residence, the authority, the identities, and the player selection that apply. When a duty is missing, the adoption is invalid, and this test fails. The test names the addresses and restates nothing from them.
Test steps and diagnostics
- Given
the
account-settingsadoption and the prose atsettings.service-contents,settings.accepted-change, andsettings.account-service, not the running game- When
- a reviewer checks each citation's meaning
- Then
settings.service-contentsnames the complete family set written and restored togethersettings.accepted-changenames the trigger, success condition, final-write behavior, and quit or crash loss windowsettings.account-servicenames residence, applicable sync or service acceptance and authority, layout, identities, and player selection- when a citation does not state its duty, the adoption is invalid, and this test fails
- Diagnostics
account-settings-declaration-record
copy-citations-state-their-duties · account-settings-cache
declaration check: account-settings-cache's required citations state their duties
Applies to the account-settings-cache row.
This declaration check reads the adoption and cited prose, not the running game. settings.cache-contents must state the state-family set. settings.cache-each-accepted-change must state when a write succeeds and what the loss window is. settings.local-profile-cache must state the residence, the authority, the identities, and the player selection that apply. When a duty is missing, the adoption is invalid, and this test fails. The test names the addresses and restates nothing from them.
Test steps and diagnostics
- Given
the
account-settingsadoption and the prose atsettings.cache-contents,settings.cache-each-accepted-change, andsettings.local-profile-cache, not the running game- When
- a reviewer checks each citation's meaning
- Then
settings.cache-contentsnames the complete family set written and restored togethersettings.cache-each-accepted-changenames the trigger, success condition, final-write behavior, and quit or crash loss windowsettings.local-profile-cachenames residence, applicable sync or service acceptance and authority, layout, identities, and player selection- when a citation does not state its duty, the adoption is invalid, and this test fails
- Diagnostics
account-settings-declaration-record
backup-citations-state-their-duties
declaration check: Row.id's backup citations state their duties
Does not apply to account-settings: backup-copies has no rows.
conflict-citation-states-its-duties
declaration check: Row.id's resolution citation states its duties
Does not apply to account-settings: copy-conflicts has no rows.
earlier-return-citation-states-its-duties
declaration check: Row.id's return citation states its duties
Does not apply to account-settings: earlier-point-returns has no rows.
copy-removal-citation-states-its-duty
declaration check: Row.id's removal citation states its duty
Does not apply to account-settings: no row in copy-kinds matches removed-at normal quit or crash or death or slot delete or local profile delete or device data delete or account delete.
copy-mode-citation-states-its-duty
declaration check: Row.id's mode citation states its duty
Does not apply to account-settings: no row in copy-kinds matches mode-gated only in named modes.
player-mode-return-is-mode-gated
declaration check: Row.id's player-mode return is mode-gated
Does not apply to account-settings: earlier-point-returns has no rows.
earlier-point-mode-citation-states-its-duty
declaration check: Row.id's mode citation states its duty
Does not apply to account-settings: earlier-point-returns has no rows.
persistence-holds
the persistence mechanism holds for the whole run
Applies to account-settings.
Across each of quit, crash, death, slot deletion, profile deletion, and device change that the adoption can construct, plus each constructible damage and build-mismatch case, each family's value on both sides of every constructed boundary matches its row and the numbered settlement order holds. Every load the adoption can construct refuses partial state and activates all carried families together only when accepted. For a case that the adoption cannot construct, this test checks nothing. The pack's default audit seeds apply unless the adoption supplies its own.
Test steps and diagnostics
- Holds
every state family's distinguishable value on both sides of every constructed boundary matched its row; every commit, candidate, conflict, build comparison, damage response, activation, earlier return, deletion, device return, and settlement report that the adoption constructed followed the mechanism's numbered order; every constructed load that was partial or refused activated no state; every accepted load activated all carried families together; where the adoption can construct no load, conflict, damage, build mismatch, or earlier return, this test checks nothing about that case
- Seeds
["audit-a","audit-b"]- Scope
each of quit, crash, death, slot deletion, profile deletion, and device change that the adoption can construct, plus each constructible damage and build-mismatch case- Diagnostics
account-settings-state-boundary-traceaccount-settings-commit-logaccount-settings-candidate-setaccount-settings-settlement-traceaccount-settings-load-resultaccount-settings-active-state-sourceaccount-settings-settlement-reportaccount-settings-first-ordering-violation
JSONthe adoption as one file
Answers you try on this page do not change this file. To change an adoption, open it in the authoring tool.
{
"contract": "state-persistence-scope",
"version": 2,
"summary": "This contract covers which state is kept after the end of a run or session, a quit, a crash, death, the deletion of saved data, and a move to another device. It also covers local saves, manual slots, cloud copies, server profiles, backups, conflicts, and version changes. This contract does not cover time that passes while the game is closed, replay guarantees, file formats, or the shape of saved numbers. The Suspension and catch-up contract covers time while the game is closed. The Replay scope contract covers replay guarantees.",
"questions": {
"unreadable-copy-default": {
"asks": "By default, what happens when saved state cannot be read?",
"rationale": "Lost progress is the most visible failure of a save system. This answer is the default answer. A save kind can choose another answer in its own row.",
"when": {
"row-count": {
"copy-kinds": "non-empty"
}
},
"otherwise": "No saved copy can be opened later, so unreadable saved state never reaches a load attempt.",
"options": {
"refuse-load": {
"meaning": "The unreadable copy stays closed. A city slot remains listed, but none of its progress becomes active.",
"semantics": "Loading stops before any state from that copy becomes active. The copy is neither replaced nor repaired by this response."
},
"start-fresh": {
"meaning": "Play starts from the normal starting state. A damaged puzzle slot opens with its first board instead of the old board.",
"semantics": "The starting state becomes active instead of state from the unreadable copy. The response does not by itself delete or overwrite that copy."
},
"restore-earlier-copy": {
"meaning": "An earlier copy can replace the unreadable copy through a route that the game supports. Restoring a file by hand is one such route. A factory game continues after the player chooses the backup that was made before the damaged autosave.",
"semantics": "A declared manual, in-game, or automatic recovery route can activate an earlier copy. The newest usable earlier copy under the matching backup rule becomes active."
},
"repair-readable-state": {
"meaning": "Readable progress returns and damaged parts reset. A dungeon keeps cleared floors but rebuilds one broken room record.",
"semantics": "Readable state becomes active as one repaired result. Every unreadable part takes the starting value named by the cited repair rule."
},
"warn-and-try": {
"meaning": "The player can cancel or try the unreadable copy. A colony save opens only after its damage warning is accepted.",
"semantics": "No state from the copy becomes active before the explicit choice. Accepting the warning permits an attempt but does not promise success."
}
}
},
"older-build-default": {
"asks": "By default, what happens when an older game build wrote the copy?",
"rationale": "An update can make a player's progress impossible to load, or change it permanently. Choose how the current build protects that progress.",
"when": {
"row-count": {
"copy-kinds": "non-empty"
}
},
"otherwise": "No loadable copy exists, so an older build has no saved state to open.",
"options": {
"refuse-load": {
"meaning": "The older copy stays closed. A world from last year's rules cannot open in the current build.",
"semantics": "Loading stops before state written by the older build becomes active."
},
"convert-and-load": {
"meaning": "The game updates the old state and opens it. A factory save gains the current recipe records before play resumes.",
"semantics": "A declared conversion produces current-build state before activation."
},
"warn-and-load": {
"meaning": "The old copy is tried only after a warning. A racing career from an earlier patch opens after the player accepts the risk.",
"semantics": "The player accepts a compatibility warning before old-build state becomes active. Acceptance permits an attempt but does not promise success."
}
}
},
"newer-build-default": {
"asks": "By default, what happens when a newer game build wrote the copy?",
"rationale": "Going back to an older build can erase newer content. Choose whether the player may take that risk.",
"when": {
"row-count": {
"copy-kinds": "non-empty"
}
},
"otherwise": "No loadable copy exists, so a newer build has no saved state to open.",
"options": {
"refuse-load": {
"meaning": "The newer copy stays closed. A world from a later patch remains unavailable in this build.",
"semantics": "Loading stops before state written by the newer build becomes active."
},
"warn-and-load": {
"meaning": "The newer copy is tried only after a warning. A sandbox world opens after the player accepts that newer content may be lost.",
"semantics": "The player accepts a compatibility warning before newer-build state becomes active. Acceptance permits an attempt but does not promise success."
}
}
}
},
"declares": {
"values": {},
"rows": {
"state-families": {
"description": "List each state family. A state family is a group of state that can change later play. For each state family, give how long it lasts and what happens to it at a quit, a crash, death, a deletion, and a move to another device.",
"when-empty": "No changing game state is covered, so this adoption makes no persistence promise.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "A short name for the state family in your game's words, such as campaign-progress, run-inventory, unlocks, or settings."
},
"state-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say which fields belong to this family and at which points the family can affect later play. For a family that does not return after a quit, after a crash, or on another device, the rules also name the value that the family starts from."
},
"lifetime": {
"type": "string",
"required": true,
"options": [
"run",
"session",
"slot",
"profile",
"device",
"account",
"until-event",
"not-kept"
],
"description": "How long this state lasts. Run: the state belongs to one attempt; a roguelike's carried items are lost when that attempt ends. Session: the state belongs to one continuous visit; a co-op lobby choice is lost when the party leaves that lobby. Slot: the state belongs to one player-selected save; campaign progress is lost when that slot is deleted. Profile: the state belongs to one local player profile; unlocks are lost when that profile is deleted. Device: the state belongs to one installation; local settings are lost when that device data is erased. Account: the state belongs to one account; online settings are lost when that account is deleted or reset. Until event: the state lasts to one named game event; dropped currency is lost at the next death. Not kept: the state is lost at its first named interruption; an enemy's alert meter does not return after quitting."
},
"scope-starts-in": {
"type": "citation",
"when": {
"row": {
"lifetime": [
"run",
"session"
]
}
},
"description": "Where your game's rules say when this attempt or continuous visit starts. The player can observe the start. A run may start when the character enters the dungeon; a session may start when the party joins a lobby."
},
"scope-ends-in": {
"type": "citation",
"when": {
"row": {
"lifetime": [
"run",
"session",
"slot",
"profile",
"device",
"account",
"not-kept"
]
}
},
"description": "Where your game's rules say when this lifetime ends. The player can observe the ending. It may be an attempt result, leaving a lobby, deleting a player-selected slot, deleting a local profile, erasing device data, deleting an account, or the first interruption that discards the value."
},
"lifetime-event-declared-in": {
"type": "citation",
"when": {
"row": {
"lifetime": [
"until-event"
]
}
},
"description": "Where your game's rules say which named game event destroys the value that the family had before the event. A recovery point may last until the next death after it appears."
},
"saved-in": {
"type": "string",
"pattern": "kebab-case",
"description": "The save kind that restores this family. When the field is absent, no copy restores the family."
},
"after-normal-quit": {
"type": "string",
"required": true,
"options": [
"returns-last-commit",
"does-not-return"
],
"description": "Whether this state returns after a normal quit. The answer returns-last-commit means that the state returns as it was at the last successful save. A campaign returns its last checkpoint; an unsaved match score does not."
},
"after-crash": {
"type": "string",
"required": true,
"options": [
"returns-last-commit",
"does-not-return"
],
"description": "Whether this state returns after a crash. The answer returns-last-commit means that the state returns as it was at the last successful save before the crash. A world that is saved on a timer may lose the changes made since its last save, and still return that save."
},
"after-death": {
"type": "string",
"required": true,
"options": [
"keeps-value",
"clears-value"
],
"description": "Whether death keeps this value. Roguelike unlocks may remain while the dead run's inventory clears."
},
"after-slot-delete": {
"type": "string",
"required": true,
"options": [
"keeps-value",
"clears-value",
"no-slot"
],
"description": "Whether this value is kept when the related player-selected slot is deleted. The storage rule of a save kind with several player-selected slots names that slot. For a save kind with one current copy, answer no-slot."
},
"after-local-profile-delete": {
"type": "string",
"required": true,
"options": [
"keeps-value",
"clears-value",
"no-profile"
],
"description": "Whether this value is kept when the related local player profile is deleted. The storage rule of the save kind that restores this family names that profile. For a family with no such profile, answer no-profile."
},
"on-another-device": {
"type": "string",
"required": true,
"options": [
"returns",
"does-not-return"
],
"description": "Whether the value returns when the same eligible player continues on another device. A server profile may return; local settings may not."
}
}
},
"copy-kinds": {
"description": "List each save kind. A save kind is one kind of saved copy that is written and loaded independently, such as campaign slots, profile data, cloud settings, or a server profile.",
"when-empty": "No saved copy can be opened later. Loading cannot restore state, compare builds, recover damage, or resolve a conflict.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "A short name for this save kind in your game's words, such as campaign-slots, unlock-profile, or account-settings."
},
"contains-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say which state families this save kind writes and restores together. The rules list the state-family ids."
},
"write-trigger": {
"type": "string",
"required": true,
"options": [
"player-save",
"checkpoint",
"continuous",
"timer",
"service-owned"
],
"description": "What starts a save: a save action, a named checkpoint, each accepted change, a timer, or the service's own rule."
},
"write-rule-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say exactly when a save begins, what makes it successful, and which later changes a quit or a crash can lose."
},
"residence": {
"type": "string",
"required": true,
"options": [
"local-device",
"cloud-synced",
"server-authoritative"
],
"description": "Where the copy that decides the restored state is kept: on this device, in copies that are synced between devices, or on a game service. Synced copies can disagree. A profile that the service controls uses the state that the service accepted."
},
"layout": {
"type": "string",
"required": true,
"options": [
"one-current",
"manual-slots"
],
"description": "How the save is presented: one current copy or several player-selected slots. A slot is one named load choice in the storage rule; retained earlier copies belong in the backup list."
},
"storage-rule-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say where the copy is kept, which sync or service has authority over it, and how the player selects it. For a save kind with several player-selected slots, the rules also name the identity of each slot, and that identity does not change. For a save kind with one current copy, the rules name no player-selected slot."
},
"unreadable-copy": {
"type": "string",
"required": true,
"options": [
"use-game-default",
"refuse-load",
"start-fresh",
"restore-earlier-copy",
"repair-readable-state",
"warn-and-try"
],
"description": "What happens when a copy of this save kind cannot be read. Use the default answer, or choose another answer for this row."
},
"older-build-copy": {
"type": "string",
"required": true,
"options": [
"use-game-default",
"refuse-load",
"convert-and-load",
"warn-and-load"
],
"description": "What happens when an older game build wrote a copy of this save kind. Use the default answer, or choose another answer for this row."
},
"newer-build-copy": {
"type": "string",
"required": true,
"options": [
"use-game-default",
"refuse-load",
"warn-and-load"
],
"description": "What happens when a newer game build wrote a copy of this save kind. Use the default answer, or choose another answer for this row."
},
"mode-gated": {
"type": "string",
"options": [
"only-in-named-modes"
],
"description": "This save kind exists only in named player modes. A restore point may exist in a practice mode and a standard mode but not in a challenge mode."
},
"mode-rule-declared-in": {
"type": "citation",
"when": {
"row": {
"mode-gated": [
"only-in-named-modes"
]
}
},
"description": "Where your game's rules say in which player modes this save kind exists. The rules name every such mode and confirm that the save kind is absent in every other mode."
},
"removed-at": {
"type": "string",
"options": [
"normal-quit",
"crash",
"death",
"slot-delete",
"local-profile-delete",
"device-data-delete",
"account-delete"
],
"description": "The event that removes this copy from later load choices. A permadeath save may be removed when the character dies. For a save kind with several player-selected slots, this event removes the copy of the deleted slot, not the whole save kind."
},
"removal-rule-declared-in": {
"type": "citation",
"when": {
"row": {
"removed-at": [
"normal-quit",
"crash",
"death",
"slot-delete",
"local-profile-delete",
"device-data-delete",
"account-delete"
]
}
},
"description": "Where your game's rules say exactly which event removes the copy and what the player sees afterward."
}
}
},
"backup-copies": {
"description": "List save kinds that retain an earlier copy for supported recovery.",
"when-empty": "No save kind promises an earlier usable copy, so damage cannot be answered by restoring one.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "A short name for this earlier copy in your game's words, such as previous-campaign-checkpoint."
},
"copy-kind": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"description": "The save kind protected by this earlier copy."
},
"backup-rule-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say when an earlier copy is kept, how many earlier copies remain, and which later progress a recovery loses."
},
"restore-rule-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say which supported route opens an earlier copy. The rules say whether recovery is automatic, happens in the game, or is a file step outside the game."
}
}
},
"copy-conflicts": {
"description": "List shared save kinds that can present two complete but disagreeing copies. One adoption has at most one row per conflict scope: one for each named save kind and one for all synced kinds.",
"when-empty": "No shared save kind can present two disagreeing copies, so no conflict response runs.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "A short name for the conflict in your game's words, such as campaign-slot-sync."
},
"scope": {
"type": "string",
"required": true,
"options": [
"this-copy-kind",
"all-synced-kinds"
],
"description": "Whether the response settles one save kind or every synced save kind together. One cloud dialog may settle campaign slots and quicksaves as a set."
},
"copy-kind": {
"type": "string",
"when": {
"row": {
"scope": [
"this-copy-kind"
]
}
},
"pattern": "kebab-case",
"description": "The one cloud-synced or service save kind whose copies can disagree."
},
"response": {
"type": "string",
"required": true,
"options": [
"select-by-rule",
"player-chooses-copy",
"refuse-until-resolved"
],
"description": "What happens before any disagreeing state becomes active. A fixed rule may always prefer the copy the game service holds; the player may choose between dated copies; or neither copy may open until sync is repaired."
},
"resolution-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say how this conflict is handled. The rules say how disagreement is detected. They say how the identities of the copies are compared. They say which copies are selected or kept. They name the event that clears the conflict."
}
}
},
"earlier-point-returns": {
"description": "List save kinds that can return to an earlier point of the same continuous play, whether or not the game names a run. One adoption has at most one row per save kind.",
"when-empty": "No save kind can return to an earlier point of the same continuous play, so the player cannot load a save to try again.",
"record": {
"id": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"unique": true,
"description": "A short name for the earlier return point in your game's words, such as dungeon-retry or quicksave."
},
"copy-kind": {
"type": "string",
"required": true,
"pattern": "kebab-case",
"description": "The save kind that can return play to the earlier point."
},
"after-load": {
"type": "string",
"required": true,
"options": [
"resume-stays",
"resume-is-used-once",
"player-mode-decides"
],
"description": "Whether the same earlier point remains available after a successful load. A practice mode may keep a boss checkpoint while an iron mode allows one return."
},
"return-rule-declared-in": {
"type": "citation",
"required": true,
"description": "Where your game's rules say what the earlier point is, when activation is successful, and whether another load remains possible."
},
"mode-gated": {
"type": "string",
"options": [
"only-in-named-modes"
],
"description": "This earlier return point exists only in named player modes. A quicksave may be available in a practice mode but absent in a challenge mode."
},
"mode-rule-declared-in": {
"type": "citation",
"when": {
"row": {
"mode-gated": [
"only-in-named-modes"
]
}
},
"description": "Where your game's rules say in which player modes this earlier return point exists. The rules name every such mode and confirm that the point is absent in every other mode."
}
}
}
}
},
"rules": {},
"origin": "https://opengdd.org/contracts/state-persistence-scope-2",
"mechanism": [
"This text decides the order of the steps for state-family identity, scope starts and endings, commits, loads, damage, build mismatch, copy conflicts, deletion, and device change. The questions and rows supply choices and cited game rules. They do not change the order.",
"A **run** begins at the player-observable attempt start named by `scope-starts-in` and ends at the result or exit named by `scope-ends-in`. Victory, death, and abandonment are common endings, but only the cited game rules decide. A save or load does not start or end a run. A **session** begins when play enters the world, match, lobby, or profile context named by `scope-starts-in` and ends at the exit, switch, or reset named by `scope-ends-in`. It continues through a pause, background interval, closure, or relaunch that returns to that same context; a missing commit may still prevent its earlier value from returning.",
"A **save kind** is one row of `copy-kinds`. A **commit** is one coherent accepted write of a save kind. A **copy** is a load candidate with its save-kind id, copy identity, any slot identity, build identity, commit identity, and complete state-family set. A **conflict** exists when the cited rule finds two accepted shared copies in one declared conflict scope that disagree and neither has already replaced the other. An **earlier copy** is a retained older commit named by a backup row.",
"### Change and commit",
"1. When state changes, keep each `state-families` row as one family under its cited game rule. The row's lifetime is the longest time for which a value of the family is kept. An `until-event` value ends at its cited game event. A boundary result may clear a value before its lifetime ends only when the row says so.",
"2. Evaluate run and session starts and endings from their separate cited player-observable events. A save action, automatic write, timer tick, process launch, process close, or load does not create a new run or session by itself.",
"3. Start a commit of a save kind only at its selected write trigger. A player save follows the cited save action. A checkpoint follows its named game event. Continuous writing follows each accepted change named by its rule. A timer follows the cited interval. A service-owned copy follows its authority's cited acceptance event.",
"4. A commit becomes loadable only when `write-rule-declared-in` reports success for the complete `contains-declared-in` set. A failed or partial write never replaces the last successful commit. Earlier copies are retained and ordered only by their backup and storage rules.",
"### Quit, crash, and return",
"5. On a normal quit, perform a final commit only when the cited write rule of the save kind requires one. For each state row, `returns-last-commit` restores its latest successful commit on return; `does-not-return` starts from the cited post-quit value. Uncommitted changes do not return. A copy removed at normal quit is no longer a later load choice.",
"6. On a crash, no unfinished commit succeeds. For each state row, `returns-last-commit` restores the last commit that succeeded before the crash; `does-not-return` starts from the cited post-crash value. With a timer or a checkpoint, a crash can therefore lose the changes made since the last successful commit. These changes are the possible loss window, and the cited write rule states it. A copy removed at crash is no longer a later load choice.",
"7. Select the requested slot or profile before activating state. A `one-current` save kind selects its current copy. `manual-slots` selects the player's named slot. A retained earlier copy is not another layout; the damage response and matching backup rule may select it later, and a backup row's cited restore route is also available to the player directly, independent of any damage response.",
"8. A local-device copy is available only on that device unless another cited transfer exists outside this adoption. A cloud-synced save kind obtains every accepted device and cloud candidate before conflict handling. A server-authoritative save kind obtains the service's accepted copy and does not treat an unaccepted local cache as equal authority. Read each candidate's save-kind, slot, build, and commit identity now. A candidate whose identity cannot be read is not a conflict candidate. If no candidate remains, run the damage response of the requested save kind immediately, without conflict or build comparison. A readable header with an unreadable gameplay body remains a candidate for steps 9 and 10, then reaches the damage response in step 11.",
"### Conflict, compatibility, and damage",
"9. If readable shared candidates conflict, apply the matching row's response before reading their gameplay state. A one-kind row settles only that save kind; a whole-set row settles every synced save kind together. `select-by-rule` chooses one complete copy. `player-chooses-copy` waits for one complete-copy choice. `refuse-until-resolved` activates neither. No response merges fields.",
"10. Compare the selected copy's writing build with the running build. Apply the save-kind override when present; otherwise apply the matching default answer for an older or a newer build. Refusal activates no state. Conversion produces one current-build copy before activation. A warning precedes the attempt and does not promise that it succeeds. If conversion fails, refuse the load and leave the source copy unchanged unless its cited rule says otherwise.",
"11. Read the selected copy as one coherent unit. If it is unreadable, apply the save-kind override or `unreadable-copy-default`. Refusal activates nothing. `start-fresh` activates the cited starting state without silently deleting the unreadable copy. Earlier-copy recovery follows the matching backup row, selects the newest usable earlier copy, and reports the lost interval. Repair activates one coherent repaired result and resets every unreadable part under the cited rule; failure to produce a coherent result refuses the load. Warning waits for the player's choice before any attempted activation.",
"12. Activate all state families in the accepted copy together. State families saved in another save kind keep the already active value from that kind; a state family without `saved-in` is never restored by this load.",
"13. If the accepted copy has an `earlier-point-returns` row, return continuous play to its cited earlier point. If that point is inside a run, continue the same run identity. Apply `after-load` only after successful activation: keeping the resume leaves it available, using it once makes it unavailable, and a player-mode answer follows the mode that was set before the load.",
"### Death, deletion, and another device",
"14. On death, apply every state's `after-death` result. `clears-value` removes the earlier value before later play. `keeps-value` retains it. If death is also the cited run end, every run-lifetime value clears even if no save action occurs. If it is the cited event for an `until-event` value, that value clears as well. Longer-lived unlocks, settings, and profile state follow their own rows. A copy with `removed-at: death` disappears from the load choices after these state results are settled.",
"15. On slot deletion, clear each `clears-value` row tied to that slot and keep each `keeps-value` row. `no-slot` records that the state has no related player-selected slot. Deleting a local profile applies `after-local-profile-delete` the same way and includes any slots whose cited rule makes them children of that profile. Device-data deletion ends device-lifetime state under its cited rule. Account deletion or reset ends account-lifetime state through `scope-ends-in`. At each event, remove every copy whose `removed-at` value names it.",
"16. On another eligible device, `returns` obtains the family from its cloud-synced or server-authoritative copy before activation and still runs conflict handling. `does-not-return` starts from the cited new-device value. A device change does not by itself delete the source device's copy.",
"17. After every event, no earlier value affects later play once its lifetime has ended or its selected boundary result cleared it. A later game rule may derive a new value, but that is new state rather than restoration of the cleared value. A mode-gated copy or earlier return point exists only while the cited player mode permits it.",
"Every settlement report identifies the state-family id, save-kind id or its absence, event, scope before and after, last successful commit when read, selected copy and build when loaded, override or default answer used, state result, and any lost interval. Conflict reports also identify both candidate commits and the selected response. Damage reports identify refusal, starting state, earlier-copy recovery, repaired parts, or warning choice without claiming an unattempted load succeeded."
],
"pack": "sha256:4ec64b865a0ade721bc27b72550f9d1d57e3e93d9a060e72b6eba5890aea75fd",
"answers": {
"unreadable-copy-default": "repair-readable-state",
"older-build-default": "convert-and-load",
"newer-build-default": "refuse-load"
},
"values": {},
"rows": {
"state-families": [
{
"id": "account-settings-service-state",
"state-declared-in": "settings.service-fields",
"lifetime": "account",
"scope-ends-in": "account.delete-or-reset",
"saved-in": "account-settings-service",
"after-normal-quit": "returns-last-commit",
"after-crash": "returns-last-commit",
"after-death": "keeps-value",
"after-slot-delete": "no-slot",
"after-local-profile-delete": "no-profile",
"on-another-device": "returns"
},
{
"id": "account-settings-device-cache",
"state-declared-in": "settings.cache-fields",
"lifetime": "device",
"scope-ends-in": "device.erase-local-data",
"saved-in": "account-settings-cache",
"after-normal-quit": "returns-last-commit",
"after-crash": "returns-last-commit",
"after-death": "keeps-value",
"after-slot-delete": "no-slot",
"after-local-profile-delete": "clears-value",
"on-another-device": "does-not-return"
}
],
"copy-kinds": [
{
"id": "account-settings-service",
"contains-declared-in": "settings.service-contents",
"write-trigger": "service-owned",
"write-rule-declared-in": "settings.accepted-change",
"residence": "server-authoritative",
"layout": "one-current",
"storage-rule-declared-in": "settings.account-service",
"unreadable-copy": "use-game-default",
"older-build-copy": "use-game-default",
"newer-build-copy": "use-game-default"
},
{
"id": "account-settings-cache",
"contains-declared-in": "settings.cache-contents",
"write-trigger": "continuous",
"write-rule-declared-in": "settings.cache-each-accepted-change",
"residence": "local-device",
"layout": "one-current",
"storage-rule-declared-in": "settings.local-profile-cache",
"unreadable-copy": "start-fresh",
"older-build-copy": "use-game-default",
"newer-build-copy": "use-game-default"
}
],
"backup-copies": [],
"copy-conflicts": [],
"earlier-point-returns": []
}
}