@woosh/meep-engine 3.1.0 → 3.3.0

package/src/REVIEW_2026_08_06/adv-view.md

@@ -1,446 +1,446 @@
-# Adversarial verification — `view.md` (6 CRITICAL + 26 MAJOR) and `engine-misc.md` (13 MAJOR)
-
-Method: jest 29.7 with `--config jest.conf.json` from `H:/git/moh`, throwaway `__advcheck_*.spec.js` files
-(all deleted afterwards, `find app/src -name "__advcheck*"` shows only other agents' files remaining).
-jsdom is available (`jest-environment-jsdom` installed); view specs used `@jest-environment jsdom`.
-
-Two environment facts established up front, both of which matter for several verdicts:
-
-- **`assert.*` is LIVE under jest.** Stripping is done only by webpack's `UNASSERT_RULE`, which is pushed
-  only when `argv.mode === "production"` (`H:/git/moh/webpack.config.js:100-106`). `ENV_PRODUCTION` in
-  `jest.conf.json` is inert — `core/assert.js` never reads it. So where a finding's failure mode is masked
-  by an assert under test but exposed in prod, I transcribed the post-unassert code instead of running the
-  original (VIEW-27).
-- **`View` base-class facts** (`H:/git/moh/app/src/mir-engine/meep/src/view/View.js`): `View` **does** define
-  `addChild` (:365), `removeChild` (:433), `removeAllChildren` (:461), `bindSignal` (:610), `isLinked`
-  getter (:138) and `children` as a plain array class-field (:107). It does **not** define `update`.
-  `unlink()` calls `clearFlag(ViewFlags.Linked)` at :325 and only then `this.on.unlinked.send0()` at :347 —
-  confirmed by execution (`isLinked` observed as `false` inside an `on.unlinked` handler). Every finding that
-  depends on that ordering is therefore correctly grounded, not an assumption.
-  `Signal.send0` iterates `handlers.values()` of a `Map` (`core/events/signal/Signal.js:389`), so an entry
-  deleted mid-dispatch by an earlier handler is skipped, and each handler body is wrapped in `try/catch` +
-  `console.error` (:405-408) — the "swallowed by Signal" claims are accurate.
-
----
-
-## `view.md` — CRITICAL
-
-### VIEW-1
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed. Built a real `DomTooltipManager` over a stub tip manager, called
-  `mgr.manage(button, factory)` on a real `EmptyView`, instrumented `button.el.addEventListener` /
-  `removeEventListener`. Link → `added=2`. Unlink via `root.removeChild(button)` → `removed=0`.
-  Re-link → `added=4`. The `mouseenter`/`mouseleave` pair is never detached and a second observer with a
-  second pair is created on the next link, exactly as described.
-  Mechanism verified in source: `DomTooltipManager.manage` (`tooltip/DomTooltipManager.js:109-117`)
-  subscribes its `on.unlinked` handler *before* `observer.link()` subscribes `__handleViewUnlinked`
-  (`tooltip/DomTooltipObserver.js:152`), so manage's handler runs first, calls `remove()` → `observer.unlink()`
-  → guard `if (view.isLinked)` at :159 is false (flag already cleared) → teardown skipped, and
-  `view.on.unlinked.remove(this.__handleViewUnlinked, this)` at :164 deletes the not-yet-visited Map entry.
-
-### VIEW-2
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `require('./elements/image/SvgImageView.js')` →
-  `Cannot find module '../../../core/geom/AABB2.js'`. `ls core/geom/AABB2.js` → no such file;
-  the real path is `core/geom/2d/aabb/AABB2.js`. Part (b) also holds by reading:
-  `update()` (`SvgImageView.js:64-68`) references the free identifiers `resize` and `self`, both of which are
-  declared inside the constructor (`:25`, `:39`); `link()` (:70-73) calls `this.update()` unconditionally.
-
-### VIEW-3
-- **Verdict**: CONFIRMED (accepted from lead reviewer, not re-checked)
-
-### VIEW-4
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `MinimapTerrainView.prototype.__setTerrain.call(undefined, terrain, null)` →
-  `ReferenceError: updatePreview is not defined`. And `.call(undefined, null, terrain)` →
-  `TypeError: Cannot read properties of null (reading 'preview')`. Source confirms
-  `updatePreview` is a constructor-local function declaration (`minimap/dom/MinimapTerrainView.js:109`) and the
-  subscription at :126 is `this.terrain.onChanged.add(this.__setTerrain)` with no context argument.
-
-### VIEW-5
-- **Verdict**: CONFIRMED (accepted from lead reviewer; independently re-executed anyway)
-- **Evidence**: `g.remove(view)` threw `TypeError`; `g.connect(c1); g.connect(c2)` left
-  `c1.children.length === 2` (duplicate) and `c2.children.length === 1`.
-
-### VIEW-6
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `MinimapView.prototype.clear.call({__cameraViews:[camA,camB], __worldView})` against a
-  real `EmptyView` world view already holding both cameras: children went 2 → **4** → **6** across two
-  `clear()` calls. `minimap/Minimap.js:183-188` is `this.__worldView.addChild(v)` under a
-  "remove all existing markers" comment, called from `unlink()` at :236 *after* `super.unlink()` (so the
-  `child is already linked` assert does not fire and even the dev build is affected).
-
----
-
-## `view.md` — MAJOR
-
-### VIEW-7
-- **Verdict**: CONFIRMED
-- **Evidence**: `task/TaskProgressView.js:129` reads
-  `const estimate = Number.isNaN(computedEstimate) ? 0 : computedProgressValue;`. Executed the expression with
-  `computedProgressValue = 0.2`, `computedEstimate = 48` → `estimate === 0.2`, and `(0.2).toFixed(0) === "0"`,
-  matching the "0 seconds remaining for the whole load" symptom. The label formatter at :100 is `v.toFixed(0)`.
-
-### VIEW-8
-- **Verdict**: CONFIRMED
-- **Evidence**: `elements/ColorPickerView.js:291-293` is `if (_v !== null) { v.onChanged.remove(...) }`.
-  Executed a literal transcription over two stub colours: after `handler(b, a)` the **old** value `a` still has
-  1 listener and the **new** value `b` has 0. `handler(null, b)` threw `TypeError`.
-
-### VIEW-9
-- **Verdict**: CONFIRMED
-- **Evidence**: `writeLocks` is declared `{h,s,l,a}` at `:156-161`; the `colorV` handler tests and sets
-  `writeLocks.v` (`:215`, `:224`, `:229`); `modelValueChanged` guards on `h||s||l||a` (`:257`). Executed:
-  with `writeLocks.v = true`, the `modelValueChanged` guard evaluates to "run" — so the model→gauge writeback
-  is not suppressed while a V write is in flight, and `rgb2hsv(0,0,0)` snaps H and S to 0.
-
-### VIEW-10
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed a real `Vector1Control` linked under a real parent. `c.model.set(new Vector1(5))` →
-  number field shows 5. External `v1.set(42)` → model is 42, number field is still **5**.
-  `controller/controls/Vector1Control.js:67` is `v1.onChanged.add(writeBack)` where `writeBack` is the
-  controller→model direction; `syncForward` is only called once inside `subscribe`.
-
-### VIEW-11
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed a real `ListController` with a stub `GuiControl` factory. After `list.add(item)` the
-  container had 1 row; after `list.removeOneOf(item)` it still had **1** row in `children` and 1 node in the
-  DOM. `controller/controls/ListController.js:69` removes `guiControl`, which is a child of the
-  `vElementContainer` wrapper created at :48, not of `vContainer`.
-
-### VIEW-12
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `initializeFromElement` on an `<img class="icon" style="filter:grayscale(1)">`:
-  `el.style.length === 1` but `key.style.length === 0`. `common/HTMLElementCacheKey.js:201` declares an inner
-  `let i` shadowing the outer `let i = 0` at :189, so the `splice(i, this.style.length - i)` at :217 truncates
-  from index 0. The attribute loop at :224 uses `for (i = ...)` without `let`, confirming the intent.
-
-### VIEW-13
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed. `new TabbedView({tabs})` → `children.length === 0`, `el.children.length === 0`,
-  `hasChild(__panelContainer) === false`, `hasChild(__toggleContainer) === false`. With one tab definition and
-  the view linked under a document-attached parent, `t.el.outerHTML === "<div></div>"`. Renders nothing,
-  as claimed. Neither the constructor (`common/TabbedView.js:49-57`) nor `link()` (:60-67) attaches the
-  containers.
-
-### VIEW-14
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed the `enforceAspectRatio` arithmetic. Viewport 200×100 (vAR 0.5), region 100×100:
-  result 150×100, ratio **0.667** vs target 0.5. Control on the other branch (region 100×25) → exactly 0.5.
-  The width branch is not the mirror of the height branch, as claimed
-  (`minimap/gl/MinimapFogOfWar.js:31-35`).
-
-### VIEW-15
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed a real `ListView` with `filter: e => e.visible` over `[A(visible), C(hidden)]`;
-  `model.insert(1, B)` produced exactly
-  `TypeError: Cannot read properties of undefined (reading 'el')` inside `insertOne`, logged and swallowed by
-  `Signal`, leaving DOM order `[A, B]` with B appended rather than inserted. `common/ListView.js:192-194`
-  dereferences `getChildByElement(nextElement).el` and `getChildByElement` is `this.viewMapping.get(el)`
-  (:277-279) on a plain `Map` (:124), so it returns `undefined` for a filtered-out element.
-
-### VIEW-16
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed with a stub `ResizeObserver` that records `observe`/`unobserve`. `attach(a); start();`
-  → observed `[A]`. `attach(b)` → observed still `[A]`, while `o.element === b`.
-  `util/DomSizeObserver.js:147-153` assigns before unobserving and never calls `observe`.
-  Note: the impact requires re-attaching while running — the in-repo `DomTooltipObserver` path always attaches
-  before `start()` — but `attach()` is public and the described defect is literal.
-
-### VIEW-17
-- **Verdict**: CONFIRMED
-- **Evidence**: `elements/SimpleWindow.js:54-57` captures `anchor` on pointer-down (:66) and never advances it,
-  while the move handler does `view.size.add(position.clone().sub(anchor))`. Executed the arithmetic for a
-  10 px drag delivered as 5 moves → width grew by **30 px**, not 10. The sibling
-  `elements/BottomLeftResizeHandleView.js` does `lastPosition.copy(position)` each move, confirming intent.
-
-### VIEW-18
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed a real `ToastLogView` with two real `NotificationView`-compatible models.
-  After 1 notification `children.length === 2`; after 2, `children.length === 4` with positions
-  `[-48, -48, -0, -0]` — i.e. A at −48 instead of −24, exactly the 24 px gap described.
-  `elements/notify/ToastLogView.js:47` reassigns `this.children = []` and :72/:74 do both `addChild` and a
-  manual `push`.
-
-### VIEW-19
-- **Verdict**: CONFIRMED
-- **Evidence**: `grep` over `elements/radial/RadialProgressView.js` returns **no** occurrence of `bindSignal`,
-  `unlink` or `destroy`. The subscriptions at :59, :64-65, :73, :76 are raw `add` calls on caller-supplied
-  models with no counterpart anywhere in the class.
-
-### VIEW-20
-- **Verdict**: CONFIRMED
-- **Evidence**: `interaction/createInterfaceCommandButton.js:91-95` adds raw `on.added`/`on.removed`
-  subscriptions, and :98-99 add the same two handlers again via `button.bindSignal`. Verified the `if` is
-  always taken: `InteractionCommand`'s constructor unconditionally does `this.features = new List(features)`,
-  so `interaction.features` is never `undefined`. Nothing removes the raw pair.
-
-### VIEW-21
-- **Verdict**: CONFIRMED
-- **Evidence**: (a) `elements/MeshPreview.js:229-233` attaches a fresh `self.pContents.then(...)` inside
-  `link()`; `pContents` is created once in the constructor (:107) and settles once, so every subsequent link
-  runs `__addInteraction` again, which constructs a new `PointerDevice` and calls `start()` (:78-79).
-  `unlink()` (:257-272) releases only the renderer — no `pointer.stop()`, no handler removal.
-  (b) `this.camera = null` at :45 and is assigned only inside the async asset callback at :142, while
-  `__update_renderer_size` (:204-210) guards on `this.renderer !== null` and then writes `this.camera.aspect`.
-  `this.bindSignal(this.size.onChanged, this.__update_renderer_size, this)` (:206) makes that reachable
-  post-link, pre-load.
-
-### VIEW-22
-- **Verdict**: CONFIRMED
-- **Evidence**: `renderModel.js:85-92` stores `focus: focus, size: size` by reference and `findInCache`
-  compares `piece.size.equals(size)` (:24). `common/MeshView.js:61` passes `this.size` / `this.focus` directly.
-  Executed the aliasing: a cache entry holding the caller's live `Vector2` still matches after the caller
-  mutates it to a different size. No eviction — `cache.push` is the only mutation of `cache`.
-
-### VIEW-23
-- **Verdict**: CONFIRMED
-- **Evidence**: `common/MeshView.js` contains **zero** occurrences of `model.onChanged` (checked over the file
-  text). `update()` (:72-78) compares only `size` and `focus` against `renderedParams`, and `link()` binds only
-  `this.size.onChanged`.
-
-### VIEW-24
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed the exact arithmetic from
-  `elements/progress/RectangularPieProgressView.js:55-107` for `size 100×50, fraction 0.13` (branch 2, right
-  edge): `segment2_segment_compute_intersection_array_2d` returned **false**, `p` stayed empty, and the path
-  string was
-  `M 50 0 L 50 25 L undefined undefined L 100 50 L 0 50 L 0 0 Z`. Control at 64×64 with the same fraction
-  returned `true` with a valid point. Confirms the thresholds encode a 45° corner that only exists on squares.
-  (The report itself notes the single in-repo caller sizes it 64×64.)
-
-### VIEW-25
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `EmptyView.absolute({css:{width:'100px',backgroundColor:'red'}})` →
-  `el.style.cssText === "position: absolute; top: 0px; left: 0px;"`; `width` and `backgroundColor` are empty.
-  `elements/EmptyView.js:62-65` is the shorthand `css: { css, ...CSS_ABSOLUTE_POSITIONING }`.
-
-### VIEW-26
-- **Verdict**: CONFIRMED
-- **Evidence**: `elements/tiles2d/TileGrid.js:134-135` are raw `model.tiles.on.added.add(this.addTile, this)` /
-  `.on.removed.add(...)`. The file contains **no** `unlink()` override, and `grep` finds **no** occurrence of
-  `removeTarget` or `removeElement` anywhere in it, while `addTarget` (:307) and `addElement` (:381) are called
-  per slot / per tile. Confirmed the context does not self-clean: `common/dnd/DragAndDropContext.js` exposes
-  `removeTarget` (:57) and `removeElement` (:91) as explicit calls with no view-lifecycle hook.
-  `removeTile` (:411-419) passes the result of `findTileView` straight into `removeChild` and
-  `__hookTileRemoved`, so `undefined` propagates when the tile is unknown.
-
-### VIEW-27
-- **Verdict**: CONFIRMED
-- **Evidence**: `common/LocalizedLabelView.js:122-154`. The `try` covers only :136; :143
-  (`localization.locale.getValue()`) and the `$el.text(value)` fallback at :146 are outside it.
-  Because asserts at :130-131 are stripped in production, I executed a post-unassert transcription:
-  result `TypeError: Cannot read properties of null (reading 'locale')`, **no** text written to the element,
-  `needsUpdate` left `true`. Reachability verified: `localization=null` is the constructor default of
-  `TaskProgressView` (`task/TaskProgressView.js:20`) and is forwarded to the `LocalizedLabelView` at :29-33;
-  `needsUpdate` is initialised `true` at LocalizedLabelView:57 so the `on.linked` handler at :59-68 calls
-  `update()` on the first link.
-
-### VIEW-28
-- **Verdict**: CONFIRMED
-- **Evidence**: `minimap/gl/MarkerGL.js:57-87`. `updateIcon` releases `this.patch` **before** awaiting
-  `atlasManager.acquire`, the continuation does `this.patch = patch;` and only then
-  `if (!this.active) return;` — the freshly acquired reference is never released on that path.
-  `this.patch = Reference.NULL` initially (:32) and `shutdown()` (:109-118) sets `active = false` and releases
-  whatever `this.patch` currently is, which on the racing path is still `Reference.NULL`. The overlapping-call
-  double-release / overwrite variant follows from the same ordering.
-
-### VIEW-29
-- **Verdict**: CONFIRMED
-- **Evidence**: `common/dnd/DropTarget.js:43` subscribes `attachDropValidityIndicators`' `handleDragEnter` to
-  `dropTarget.on.enter`; that handler (:72-92) creates a fresh `SignalBinding` and pushes into `current`
-  unconditionally, while `removeDraggable` (:49-66) removes exactly one record per call. The DOM
-  `handleDragEnter` (:212-221) pushes into `isInState_ENTER` unconditionally and `handleDragLeave` (:227-236)
-  does `isInState_ENTER.splice(indexOf(e), 1)` with no `-1` check (`splice(-1,1)` removes the last element).
-  The double-fire premise is real: `common/dnd/Draggable.js:103-106` explicitly routes `dragEnter` to
-  `self.parent.__eventHandlers.handleDragEnter(event)` in addition to bubbling.
-
-### VIEW-30
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `TooltipManager.prototype.buildTipView` against a stub GML with a throwing factory:
-  the call log was `push,set:false` — `popState()` never ran, leaving `depth === 1` and
-  `getTooltipsEnabled() === false` permanently. `tooltip/TooltipManager.js:132-138` has no `try/finally`,
-  whereas `tooltip/gml/GMLEngine.js` uses `try { … } finally { this.popState(); }` in both compile paths.
-
-### VIEW-31
-- **Verdict**: CONFIRMED
-- **Evidence**: `elements/radial/RadialMenu.js:194-223`: `init()` body contains `this.elements = []` and
-  `this.vElementContainer.addChild(element)` and **no** `removeAllChildren`/`removeChild` (verified by slicing
-  the method body out of the source and matching). `elements/RadialMenuElement.js:70` is
-  `this.addChild(description.iconView)`, and `View.addChild` re-parents (`View.js:373-380`:
-  `child.parent = this; this.el.appendChild(child.el)`), so a shared definition's icon is moved between menus.
-
-### VIEW-32
-- **Verdict**: CONFIRMED-BUT-DOWNGRADED
-- **Corrected severity**: MINOR
-- **Evidence**: The mechanism is real and executed:
-  `"button-" + "cancel all now".replace(' ', '-')` → `"button-cancel-all now"`, and
-  `classList.add("button-cancel-all now")` throws `InvalidCharacterError` in jsdom.
-- **Reason** (ground 5, severity inflation): the trigger needs an option `name` containing **two or more**
-  spaces. Every in-repo construction site passes single-token names — `engine/ui/GUIEngine.js:264-274`
-  (`"yes"`, `"no"`) and `:352-357` (`"ok"`). Names with one space work fine. This is a latent public-API
-  hazard, not a MAJOR-blast-radius defect.
-
----
-
-## `engine-misc.md` — MAJOR
-
-### EMISC-1
-- **Verdict**: CONFIRMED
-- **Evidence**: `save/storage/IndexedDBStorage.js:98-128`. `store()` attaches `success`/`error` to the
-  **request** (`idbRequest.addEventListener('success', …)` at :110) and never holds or listens on the
-  transaction, so a post-request `abort`/`error` at commit time notifies nobody. `remove` (:45-76) has the same
-  shape. The file header's `TODO add QuotaExceededError handling` corroborates rather than excuses it.
-
-### EMISC-2
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed.
-  `new Engine(new InMemoryEnginePlatform(), {enableAudio:false, enableGraphics:false})` → `e.sound === undefined`;
-  `e.start()` threw synchronously with `TypeError: Cannot read properties of undefined (reading 'start')`.
-  `Engine.js:584` evaluates `this.sound.start()` while building the `Promise.all` array, whereas the
-  constructor (:290-302) and `#initialize_audio()` (:421-424) both guard.
-
-### EMISC-3
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed. Same engine with `enableGraphics:false` → `e.graphics === undefined`; `e.render()`
-  threw `TypeError: Cannot read properties of undefined (reading 'autoDraw')`.
-  `Engine.js:544` reads `graphics.autoDraw` before the `if (graphics && …)` guard at :549.
-
-### EMISC-4
-- **Verdict**: CONFIRMED (accepted from lead reviewer; independently re-executed)
-- **Evidence**: `await engine.stop()` on a freshly constructed engine threw `Error: Not currently running`
-  from `Ticker.pause()` (`simulation/Ticker.js:261-263`), before any of the four shutdown steps.
-  Also verified the supporting claims: `Ticker.#isUpdateLoopActive()` requires both handles
-  (`Ticker.js:114-116`), `Ticker.start()` discards its first `requestAnimationFrame` handle (:250), and
-  `Engine.js:616-630` stores no handle for `#animation_frame` so it is never cancellable.
-
-### EMISC-5
-- **Verdict**: CONFIRMED
-- **Evidence**: `Engine.js:607-609` — the second argument to `.then` is
-  `function (e) { logger.error(...) }`, which returns `undefined`. Executed the same shape:
-  the resulting promise settles **fulfilled with `undefined`**, and the success branch (ticker start at :599,
-  options load at :603) is skipped.
-
-### EMISC-6
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed against the real `Clock`. `start(); spin 20ms; pause()` → elapsed 0.0194.
-  `spin 50ms; pause()` again (already paused) → elapsed 0.0693 — 50 ms injected while stopped.
-  `Clock.js:87-91` calls the module-level `updateElapsedTime(this)` (:8-13), bypassing the `__isRunning` guard
-  in `Clock.updateElapsedTime()` (:108-113).
-  Second instance also executed: a fresh `Clock` (elapsed 0, `__lastMeasurement` 0) after a single `pause()`
-  reports elapsed **0.9917 s** against `current_time_in_seconds() === 0.9917` — i.e. seconds since page load.
-  `Ticker`'s constructor does exactly this (`simulation/Ticker.js:71-73`), and `Ticker.start()`'s
-  `getDelta()`/`clock.start()` do not clear it (both leave `elapsedTime` untouched while `__isRunning` is false).
-
-### EMISC-7
-- **Verdict**: CONFIRMED
-- **Evidence**: `achievements/AchievementManager.js:232-238` — `async initialize(engine)` assigns four fields
-  and never calls `super.initialize(engine)`; `EnginePlugin.initialize` is what calls
-  `BaseProcess.initialize()` → `__state.set(Initialized)`. `:421-430` — `async startup()` never calls
-  `super.startup()`. `save/GameStateLoader.js:15-17` — same omission for `startup()`.
-  Consequences verified in `plugin/PluginReferenceContext.js`: `navigate_to_running` (:72-89) short-circuits
-  only on `Running`, so a plugin stuck at `New` re-runs `initialize()` **and** `startup()` on every request;
-  `navigate_to_finalized` (:44-67) returns immediately for `New`, so `shutdown()` never runs.
-  `plugin/EnginePluginManager.js:75-101` re-requests the transition whenever
-  `dependency_state !== ProcessState.Running`, which for these plugins is always.
-  `loadDefinitions` (:239-255) pushes into `this.entries` with no reset, so a second `startup()` duplicates
-  every achievement.
-
-### EMISC-8
-- **Verdict**: CONFIRMED
-- **Evidence**: `achievements/AchievementManager.js:427` is `this.initializeGateway();` with no `await`,
-  followed immediately by `this.isStarted.set(true)` at :429. `initializeGateway` sets
-  `isGatewayInitialized` only after awaiting the gateway read. `unlock()` (:149-160) gates **both**
-  `deactivateEntry` and `present` on `this.isGatewayInitialized.getValue()`, so an unlock that lands in the gap
-  is written to storage and blackboard but never presented and never deactivated. `isActive` is
-  `ReactiveAnd(isStarted, isBlackboardAttached)` (:106-119), which fires `activate()` synchronously on the
-  `isStarted` write.
-
-### EMISC-9
-- **Verdict**: CONFIRMED
-- **Evidence**: `EngineHarness.js:126` is `new Promise(async function (resolve, reject) { … })` with no
-  `try/catch` and no use of `reject` anywhere in the body. Executed the same shape: after a throw past the
-  first `await`, the outer promise state remained **pending** and jest reported the escape as an unhandled
-  rejection — precisely the "hangs with no error surfaced" symptom. `this.p` memoises the pending promise
-  (:167-169), so retries hang too.
-
-### EMISC-10
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed a real `GameStateLoader` with a `gameSaves.update()` that rejects. Neither `resolve`
-  nor `reject` was called (`outcome: pending` after a full microtask+timer flush), and the rejection surfaced
-  as an unhandled rejection. `save/GameStateLoader.js:128-135` has no second `then` argument and no `.catch`,
-  unlike `load()` (:110) and `exists()` (:164).
-
-### EMISC-11
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed a real `GameStateLoader` over a real `InMemoryStorage` with empty
-  `gameSaves.data`: `load('auto-save', …)` **resolved with `undefined`**.
-  `save/GameStateLoader.js:101-103` falls through to `legacyLoad` → `Storage.loadBinary` (`save/Storage.js:25-28`)
-  → `InMemoryStorage.load` (`save/storage/InMemoryStorage.js:15`) which resolves `this.#data.get(key)`.
-  `IndexedDBStorage.load` (:88-90) resolves `event.target.result` with the same sentinel.
-
-### EMISC-12
-- **Verdict**: CONFIRMED
-- **Evidence**: Executed `WebEnginePlatform.prototype.pickDefaultLocale.call({}, ['ru','de'])` with
-  `navigator.languages === ['ja-JP']` → returned **`'en-gb'`**, which is not among the options.
-  `platform/WebEnginePlatform.js:81-85` hard-codes it. Secondary claim also executed: with `[]`,
-  `array_pick_best_element` returns `undefined` (verified in
-  `core/collection/array/array_pick_best_element.js:21-23`) and `best.score` threw
-  `TypeError: Cannot read properties of undefined (reading 'score')`.
-  `platform/EnginePlatform.js:18-22` documents `@param {string[]} options @returns {string}`, i.e. one of the
-  options.
-
-### EMISC-13
-- **Verdict**: CONFIRMED
-- **Evidence**: `save/GameStateLoader.js:1` imports
-  `"../../../../view/game/save/GameSaveStateMetadata.js"`, which resolves to
-  `app/src/mir-engine/view/game/save/GameSaveStateMetadata.js` — verified to exist and to be **outside** the
-  `meep/` package root. The symbol is referenced only in a JSDoc `@type` at :82, so the runtime import is
-  gratuitous. `scene/SerializedScene.js:1` imports
-  `"../../../../model/game/scenes/MirScene.js"` → `app/src/mir-engine/model/game/scenes/MirScene.js`
-  (verified to exist), and :57 is `export class SerializedScene extends MirScene`, i.e. a hard inheritance
-  dependency from the engine onto game code. Both escape the published package boundary.
-
----
-
-## Tally
-
-45 findings checked (6 CRITICAL + 26 MAJOR from `view.md`, 13 MAJOR from `engine-misc.md`).
-
-- **CONFIRMED: 44**
-- **CONFIRMED-BUT-DOWNGRADED: 1** (VIEW-32, MAJOR → MINOR)
-- **REFUTED: 0**
-
-## Notes on what I looked for and did not find
-
-I specifically attempted the following refutations and none succeeded:
-
-- **Misread base-class members.** Checked `View.js` and `DOM.js` in full. `addChild`/`removeChild`/`isLinked`/
-  `bindSignal` all exist as the reviewer assumed; `View` genuinely has no `update` (VIEW-39's premise, MINOR);
-  `View.children` is a plain array so the `this.children = []` reassignments in `ToastLogView`/`Group` really do
-  produce the described double-registration. No mixin, getter or inherited member rescues any of the
-  "non-functional" claims.
-- **The `unlink()` ordering assumption.** Executed rather than assumed: `isLinked` is `false` inside
-  `on.unlinked`. VIEW-1's teardown-skip is therefore correctly grounded, not inverted.
-- **`assert.*` masking.** The one finding where this mattered (VIEW-27) is *worse* in production, not better,
-  because the guard that would surface the null localisation is unasserted away. No finding depends on an
-  assert being live.
-- **Unconstructable-class overreach.** `TabbedView`, `ToastLogView`, `ListController`, `Vector1Control`,
-  `MinimapTerrainView`, `RadialMenu` and `EmptyView` all construct fine in jsdom; the claimed defects are
-  behavioural, and each was reproduced against a real instance rather than inferred.
-- **Deliberate-convention defences.** No comment or JSDoc anywhere in the implicated code documents any of the
-  reported behaviours as intended. In two cases the codebase's own sibling code proves the opposite intent:
-  `GMLEngine.compile`'s `try/finally` vs `TooltipManager.buildTipView` (VIEW-30), and
-  `BottomLeftResizeHandleView`'s `lastPosition.copy(position)` vs `SimpleWindow` (VIEW-17).
-
-## Reliability of each report
-
-**`view.md`**: broadly reliable. All 6 CRITICALs and all 26 MAJORs reproduce; 22 of the 32 were reproduced by
-executing real code rather than reading. The only overstatement is VIEW-32's severity. The reviewer's own
-"Notes on evidence used" preamble (unlink ordering, Signal Map semantics, segment-intersection miss behaviour)
-checked out on every point.
-
-**`engine-misc.md`**: broadly reliable. All 13 MAJORs reproduce; 8 of them by direct execution against real
-`Engine`, `Clock`, `GameStateLoader` and `WebEnginePlatform` instances. No severity inflation identified —
-EMISC-13 is a packaging rather than runtime defect but genuinely breaks external consumers of a published
-package, so MAJOR is defensible.
+# Adversarial verification — `view.md` (6 CRITICAL + 26 MAJOR) and `engine-misc.md` (13 MAJOR)
+
+Method: jest 29.7 with `--config jest.conf.json` from `H:/git/moh`, throwaway `__advcheck_*.spec.js` files
+(all deleted afterwards, `find app/src -name "__advcheck*"` shows only other agents' files remaining).
+jsdom is available (`jest-environment-jsdom` installed); view specs used `@jest-environment jsdom`.
+
+Two environment facts established up front, both of which matter for several verdicts:
+
+- **`assert.*` is LIVE under jest.** Stripping is done only by webpack's `UNASSERT_RULE`, which is pushed
+  only when `argv.mode === "production"` (`H:/git/moh/webpack.config.js:100-106`). `ENV_PRODUCTION` in
+  `jest.conf.json` is inert — `core/assert.js` never reads it. So where a finding's failure mode is masked
+  by an assert under test but exposed in prod, I transcribed the post-unassert code instead of running the
+  original (VIEW-27).
+- **`View` base-class facts** (`H:/git/moh/app/src/mir-engine/meep/src/view/View.js`): `View` **does** define
+  `addChild` (:365), `removeChild` (:433), `removeAllChildren` (:461), `bindSignal` (:610), `isLinked`
+  getter (:138) and `children` as a plain array class-field (:107). It does **not** define `update`.
+  `unlink()` calls `clearFlag(ViewFlags.Linked)` at :325 and only then `this.on.unlinked.send0()` at :347 —
+  confirmed by execution (`isLinked` observed as `false` inside an `on.unlinked` handler). Every finding that
+  depends on that ordering is therefore correctly grounded, not an assumption.
+  `Signal.send0` iterates `handlers.values()` of a `Map` (`core/events/signal/Signal.js:389`), so an entry
+  deleted mid-dispatch by an earlier handler is skipped, and each handler body is wrapped in `try/catch` +
+  `console.error` (:405-408) — the "swallowed by Signal" claims are accurate.
+
+---
+
+## `view.md` — CRITICAL
+
+### VIEW-1
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed. Built a real `DomTooltipManager` over a stub tip manager, called
+  `mgr.manage(button, factory)` on a real `EmptyView`, instrumented `button.el.addEventListener` /
+  `removeEventListener`. Link → `added=2`. Unlink via `root.removeChild(button)` → `removed=0`.
+  Re-link → `added=4`. The `mouseenter`/`mouseleave` pair is never detached and a second observer with a
+  second pair is created on the next link, exactly as described.
+  Mechanism verified in source: `DomTooltipManager.manage` (`tooltip/DomTooltipManager.js:109-117`)
+  subscribes its `on.unlinked` handler *before* `observer.link()` subscribes `__handleViewUnlinked`
+  (`tooltip/DomTooltipObserver.js:152`), so manage's handler runs first, calls `remove()` → `observer.unlink()`
+  → guard `if (view.isLinked)` at :159 is false (flag already cleared) → teardown skipped, and
+  `view.on.unlinked.remove(this.__handleViewUnlinked, this)` at :164 deletes the not-yet-visited Map entry.
+
+### VIEW-2
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `require('./elements/image/SvgImageView.js')` →
+  `Cannot find module '../../../core/geom/AABB2.js'`. `ls core/geom/AABB2.js` → no such file;
+  the real path is `core/geom/2d/aabb/AABB2.js`. Part (b) also holds by reading:
+  `update()` (`SvgImageView.js:64-68`) references the free identifiers `resize` and `self`, both of which are
+  declared inside the constructor (`:25`, `:39`); `link()` (:70-73) calls `this.update()` unconditionally.
+
+### VIEW-3
+- **Verdict**: CONFIRMED (accepted from lead reviewer, not re-checked)
+
+### VIEW-4
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `MinimapTerrainView.prototype.__setTerrain.call(undefined, terrain, null)` →
+  `ReferenceError: updatePreview is not defined`. And `.call(undefined, null, terrain)` →
+  `TypeError: Cannot read properties of null (reading 'preview')`. Source confirms
+  `updatePreview` is a constructor-local function declaration (`minimap/dom/MinimapTerrainView.js:109`) and the
+  subscription at :126 is `this.terrain.onChanged.add(this.__setTerrain)` with no context argument.
+
+### VIEW-5
+- **Verdict**: CONFIRMED (accepted from lead reviewer; independently re-executed anyway)
+- **Evidence**: `g.remove(view)` threw `TypeError`; `g.connect(c1); g.connect(c2)` left
+  `c1.children.length === 2` (duplicate) and `c2.children.length === 1`.
+
+### VIEW-6
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `MinimapView.prototype.clear.call({__cameraViews:[camA,camB], __worldView})` against a
+  real `EmptyView` world view already holding both cameras: children went 2 → **4** → **6** across two
+  `clear()` calls. `minimap/Minimap.js:183-188` is `this.__worldView.addChild(v)` under a
+  "remove all existing markers" comment, called from `unlink()` at :236 *after* `super.unlink()` (so the
+  `child is already linked` assert does not fire and even the dev build is affected).
+
+---
+
+## `view.md` — MAJOR
+
+### VIEW-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `task/TaskProgressView.js:129` reads
+  `const estimate = Number.isNaN(computedEstimate) ? 0 : computedProgressValue;`. Executed the expression with
+  `computedProgressValue = 0.2`, `computedEstimate = 48` → `estimate === 0.2`, and `(0.2).toFixed(0) === "0"`,
+  matching the "0 seconds remaining for the whole load" symptom. The label formatter at :100 is `v.toFixed(0)`.
+
+### VIEW-8
+- **Verdict**: CONFIRMED
+- **Evidence**: `elements/ColorPickerView.js:291-293` is `if (_v !== null) { v.onChanged.remove(...) }`.
+  Executed a literal transcription over two stub colours: after `handler(b, a)` the **old** value `a` still has
+  1 listener and the **new** value `b` has 0. `handler(null, b)` threw `TypeError`.
+
+### VIEW-9
+- **Verdict**: CONFIRMED
+- **Evidence**: `writeLocks` is declared `{h,s,l,a}` at `:156-161`; the `colorV` handler tests and sets
+  `writeLocks.v` (`:215`, `:224`, `:229`); `modelValueChanged` guards on `h||s||l||a` (`:257`). Executed:
+  with `writeLocks.v = true`, the `modelValueChanged` guard evaluates to "run" — so the model→gauge writeback
+  is not suppressed while a V write is in flight, and `rgb2hsv(0,0,0)` snaps H and S to 0.
+
+### VIEW-10
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed a real `Vector1Control` linked under a real parent. `c.model.set(new Vector1(5))` →
+  number field shows 5. External `v1.set(42)` → model is 42, number field is still **5**.
+  `controller/controls/Vector1Control.js:67` is `v1.onChanged.add(writeBack)` where `writeBack` is the
+  controller→model direction; `syncForward` is only called once inside `subscribe`.
+
+### VIEW-11
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed a real `ListController` with a stub `GuiControl` factory. After `list.add(item)` the
+  container had 1 row; after `list.removeOneOf(item)` it still had **1** row in `children` and 1 node in the
+  DOM. `controller/controls/ListController.js:69` removes `guiControl`, which is a child of the
+  `vElementContainer` wrapper created at :48, not of `vContainer`.
+
+### VIEW-12
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `initializeFromElement` on an `<img class="icon" style="filter:grayscale(1)">`:
+  `el.style.length === 1` but `key.style.length === 0`. `common/HTMLElementCacheKey.js:201` declares an inner
+  `let i` shadowing the outer `let i = 0` at :189, so the `splice(i, this.style.length - i)` at :217 truncates
+  from index 0. The attribute loop at :224 uses `for (i = ...)` without `let`, confirming the intent.
+
+### VIEW-13
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed. `new TabbedView({tabs})` → `children.length === 0`, `el.children.length === 0`,
+  `hasChild(__panelContainer) === false`, `hasChild(__toggleContainer) === false`. With one tab definition and
+  the view linked under a document-attached parent, `t.el.outerHTML === "<div></div>"`. Renders nothing,
+  as claimed. Neither the constructor (`common/TabbedView.js:49-57`) nor `link()` (:60-67) attaches the
+  containers.
+
+### VIEW-14
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed the `enforceAspectRatio` arithmetic. Viewport 200×100 (vAR 0.5), region 100×100:
+  result 150×100, ratio **0.667** vs target 0.5. Control on the other branch (region 100×25) → exactly 0.5.
+  The width branch is not the mirror of the height branch, as claimed
+  (`minimap/gl/MinimapFogOfWar.js:31-35`).
+
+### VIEW-15
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed a real `ListView` with `filter: e => e.visible` over `[A(visible), C(hidden)]`;
+  `model.insert(1, B)` produced exactly
+  `TypeError: Cannot read properties of undefined (reading 'el')` inside `insertOne`, logged and swallowed by
+  `Signal`, leaving DOM order `[A, B]` with B appended rather than inserted. `common/ListView.js:192-194`
+  dereferences `getChildByElement(nextElement).el` and `getChildByElement` is `this.viewMapping.get(el)`
+  (:277-279) on a plain `Map` (:124), so it returns `undefined` for a filtered-out element.
+
+### VIEW-16
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed with a stub `ResizeObserver` that records `observe`/`unobserve`. `attach(a); start();`
+  → observed `[A]`. `attach(b)` → observed still `[A]`, while `o.element === b`.
+  `util/DomSizeObserver.js:147-153` assigns before unobserving and never calls `observe`.
+  Note: the impact requires re-attaching while running — the in-repo `DomTooltipObserver` path always attaches
+  before `start()` — but `attach()` is public and the described defect is literal.
+
+### VIEW-17
+- **Verdict**: CONFIRMED
+- **Evidence**: `elements/SimpleWindow.js:54-57` captures `anchor` on pointer-down (:66) and never advances it,
+  while the move handler does `view.size.add(position.clone().sub(anchor))`. Executed the arithmetic for a
+  10 px drag delivered as 5 moves → width grew by **30 px**, not 10. The sibling
+  `elements/BottomLeftResizeHandleView.js` does `lastPosition.copy(position)` each move, confirming intent.
+
+### VIEW-18
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed a real `ToastLogView` with two real `NotificationView`-compatible models.
+  After 1 notification `children.length === 2`; after 2, `children.length === 4` with positions
+  `[-48, -48, -0, -0]` — i.e. A at −48 instead of −24, exactly the 24 px gap described.
+  `elements/notify/ToastLogView.js:47` reassigns `this.children = []` and :72/:74 do both `addChild` and a
+  manual `push`.
+
+### VIEW-19
+- **Verdict**: CONFIRMED
+- **Evidence**: `grep` over `elements/radial/RadialProgressView.js` returns **no** occurrence of `bindSignal`,
+  `unlink` or `destroy`. The subscriptions at :59, :64-65, :73, :76 are raw `add` calls on caller-supplied
+  models with no counterpart anywhere in the class.
+
+### VIEW-20
+- **Verdict**: CONFIRMED
+- **Evidence**: `interaction/createInterfaceCommandButton.js:91-95` adds raw `on.added`/`on.removed`
+  subscriptions, and :98-99 add the same two handlers again via `button.bindSignal`. Verified the `if` is
+  always taken: `InteractionCommand`'s constructor unconditionally does `this.features = new List(features)`,
+  so `interaction.features` is never `undefined`. Nothing removes the raw pair.
+
+### VIEW-21
+- **Verdict**: CONFIRMED
+- **Evidence**: (a) `elements/MeshPreview.js:229-233` attaches a fresh `self.pContents.then(...)` inside
+  `link()`; `pContents` is created once in the constructor (:107) and settles once, so every subsequent link
+  runs `__addInteraction` again, which constructs a new `PointerDevice` and calls `start()` (:78-79).
+  `unlink()` (:257-272) releases only the renderer — no `pointer.stop()`, no handler removal.
+  (b) `this.camera = null` at :45 and is assigned only inside the async asset callback at :142, while
+  `__update_renderer_size` (:204-210) guards on `this.renderer !== null` and then writes `this.camera.aspect`.
+  `this.bindSignal(this.size.onChanged, this.__update_renderer_size, this)` (:206) makes that reachable
+  post-link, pre-load.
+
+### VIEW-22
+- **Verdict**: CONFIRMED
+- **Evidence**: `renderModel.js:85-92` stores `focus: focus, size: size` by reference and `findInCache`
+  compares `piece.size.equals(size)` (:24). `common/MeshView.js:61` passes `this.size` / `this.focus` directly.
+  Executed the aliasing: a cache entry holding the caller's live `Vector2` still matches after the caller
+  mutates it to a different size. No eviction — `cache.push` is the only mutation of `cache`.
+
+### VIEW-23
+- **Verdict**: CONFIRMED
+- **Evidence**: `common/MeshView.js` contains **zero** occurrences of `model.onChanged` (checked over the file
+  text). `update()` (:72-78) compares only `size` and `focus` against `renderedParams`, and `link()` binds only
+  `this.size.onChanged`.
+
+### VIEW-24
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed the exact arithmetic from
+  `elements/progress/RectangularPieProgressView.js:55-107` for `size 100×50, fraction 0.13` (branch 2, right
+  edge): `segment2_segment_compute_intersection_array_2d` returned **false**, `p` stayed empty, and the path
+  string was
+  `M 50 0 L 50 25 L undefined undefined L 100 50 L 0 50 L 0 0 Z`. Control at 64×64 with the same fraction
+  returned `true` with a valid point. Confirms the thresholds encode a 45° corner that only exists on squares.
+  (The report itself notes the single in-repo caller sizes it 64×64.)
+
+### VIEW-25
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `EmptyView.absolute({css:{width:'100px',backgroundColor:'red'}})` →
+  `el.style.cssText === "position: absolute; top: 0px; left: 0px;"`; `width` and `backgroundColor` are empty.
+  `elements/EmptyView.js:62-65` is the shorthand `css: { css, ...CSS_ABSOLUTE_POSITIONING }`.
+
+### VIEW-26
+- **Verdict**: CONFIRMED
+- **Evidence**: `elements/tiles2d/TileGrid.js:134-135` are raw `model.tiles.on.added.add(this.addTile, this)` /
+  `.on.removed.add(...)`. The file contains **no** `unlink()` override, and `grep` finds **no** occurrence of
+  `removeTarget` or `removeElement` anywhere in it, while `addTarget` (:307) and `addElement` (:381) are called
+  per slot / per tile. Confirmed the context does not self-clean: `common/dnd/DragAndDropContext.js` exposes
+  `removeTarget` (:57) and `removeElement` (:91) as explicit calls with no view-lifecycle hook.
+  `removeTile` (:411-419) passes the result of `findTileView` straight into `removeChild` and
+  `__hookTileRemoved`, so `undefined` propagates when the tile is unknown.
+
+### VIEW-27
+- **Verdict**: CONFIRMED
+- **Evidence**: `common/LocalizedLabelView.js:122-154`. The `try` covers only :136; :143
+  (`localization.locale.getValue()`) and the `$el.text(value)` fallback at :146 are outside it.
+  Because asserts at :130-131 are stripped in production, I executed a post-unassert transcription:
+  result `TypeError: Cannot read properties of null (reading 'locale')`, **no** text written to the element,
+  `needsUpdate` left `true`. Reachability verified: `localization=null` is the constructor default of
+  `TaskProgressView` (`task/TaskProgressView.js:20`) and is forwarded to the `LocalizedLabelView` at :29-33;
+  `needsUpdate` is initialised `true` at LocalizedLabelView:57 so the `on.linked` handler at :59-68 calls
+  `update()` on the first link.
+
+### VIEW-28
+- **Verdict**: CONFIRMED
+- **Evidence**: `minimap/gl/MarkerGL.js:57-87`. `updateIcon` releases `this.patch` **before** awaiting
+  `atlasManager.acquire`, the continuation does `this.patch = patch;` and only then
+  `if (!this.active) return;` — the freshly acquired reference is never released on that path.
+  `this.patch = Reference.NULL` initially (:32) and `shutdown()` (:109-118) sets `active = false` and releases
+  whatever `this.patch` currently is, which on the racing path is still `Reference.NULL`. The overlapping-call
+  double-release / overwrite variant follows from the same ordering.
+
+### VIEW-29
+- **Verdict**: CONFIRMED
+- **Evidence**: `common/dnd/DropTarget.js:43` subscribes `attachDropValidityIndicators`' `handleDragEnter` to
+  `dropTarget.on.enter`; that handler (:72-92) creates a fresh `SignalBinding` and pushes into `current`
+  unconditionally, while `removeDraggable` (:49-66) removes exactly one record per call. The DOM
+  `handleDragEnter` (:212-221) pushes into `isInState_ENTER` unconditionally and `handleDragLeave` (:227-236)
+  does `isInState_ENTER.splice(indexOf(e), 1)` with no `-1` check (`splice(-1,1)` removes the last element).
+  The double-fire premise is real: `common/dnd/Draggable.js:103-106` explicitly routes `dragEnter` to
+  `self.parent.__eventHandlers.handleDragEnter(event)` in addition to bubbling.
+
+### VIEW-30
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `TooltipManager.prototype.buildTipView` against a stub GML with a throwing factory:
+  the call log was `push,set:false` — `popState()` never ran, leaving `depth === 1` and
+  `getTooltipsEnabled() === false` permanently. `tooltip/TooltipManager.js:132-138` has no `try/finally`,
+  whereas `tooltip/gml/GMLEngine.js` uses `try { … } finally { this.popState(); }` in both compile paths.
+
+### VIEW-31
+- **Verdict**: CONFIRMED
+- **Evidence**: `elements/radial/RadialMenu.js:194-223`: `init()` body contains `this.elements = []` and
+  `this.vElementContainer.addChild(element)` and **no** `removeAllChildren`/`removeChild` (verified by slicing
+  the method body out of the source and matching). `elements/RadialMenuElement.js:70` is
+  `this.addChild(description.iconView)`, and `View.addChild` re-parents (`View.js:373-380`:
+  `child.parent = this; this.el.appendChild(child.el)`), so a shared definition's icon is moved between menus.
+
+### VIEW-32
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MINOR
+- **Evidence**: The mechanism is real and executed:
+  `"button-" + "cancel all now".replace(' ', '-')` → `"button-cancel-all now"`, and
+  `classList.add("button-cancel-all now")` throws `InvalidCharacterError` in jsdom.
+- **Reason** (ground 5, severity inflation): the trigger needs an option `name` containing **two or more**
+  spaces. Every in-repo construction site passes single-token names — `engine/ui/GUIEngine.js:264-274`
+  (`"yes"`, `"no"`) and `:352-357` (`"ok"`). Names with one space work fine. This is a latent public-API
+  hazard, not a MAJOR-blast-radius defect.
+
+---
+
+## `engine-misc.md` — MAJOR
+
+### EMISC-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `save/storage/IndexedDBStorage.js:98-128`. `store()` attaches `success`/`error` to the
+  **request** (`idbRequest.addEventListener('success', …)` at :110) and never holds or listens on the
+  transaction, so a post-request `abort`/`error` at commit time notifies nobody. `remove` (:45-76) has the same
+  shape. The file header's `TODO add QuotaExceededError handling` corroborates rather than excuses it.
+
+### EMISC-2
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed.
+  `new Engine(new InMemoryEnginePlatform(), {enableAudio:false, enableGraphics:false})` → `e.sound === undefined`;
+  `e.start()` threw synchronously with `TypeError: Cannot read properties of undefined (reading 'start')`.
+  `Engine.js:584` evaluates `this.sound.start()` while building the `Promise.all` array, whereas the
+  constructor (:290-302) and `#initialize_audio()` (:421-424) both guard.
+
+### EMISC-3
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed. Same engine with `enableGraphics:false` → `e.graphics === undefined`; `e.render()`
+  threw `TypeError: Cannot read properties of undefined (reading 'autoDraw')`.
+  `Engine.js:544` reads `graphics.autoDraw` before the `if (graphics && …)` guard at :549.
+
+### EMISC-4
+- **Verdict**: CONFIRMED (accepted from lead reviewer; independently re-executed)
+- **Evidence**: `await engine.stop()` on a freshly constructed engine threw `Error: Not currently running`
+  from `Ticker.pause()` (`simulation/Ticker.js:261-263`), before any of the four shutdown steps.
+  Also verified the supporting claims: `Ticker.#isUpdateLoopActive()` requires both handles
+  (`Ticker.js:114-116`), `Ticker.start()` discards its first `requestAnimationFrame` handle (:250), and
+  `Engine.js:616-630` stores no handle for `#animation_frame` so it is never cancellable.
+
+### EMISC-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `Engine.js:607-609` — the second argument to `.then` is
+  `function (e) { logger.error(...) }`, which returns `undefined`. Executed the same shape:
+  the resulting promise settles **fulfilled with `undefined`**, and the success branch (ticker start at :599,
+  options load at :603) is skipped.
+
+### EMISC-6
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed against the real `Clock`. `start(); spin 20ms; pause()` → elapsed 0.0194.
+  `spin 50ms; pause()` again (already paused) → elapsed 0.0693 — 50 ms injected while stopped.
+  `Clock.js:87-91` calls the module-level `updateElapsedTime(this)` (:8-13), bypassing the `__isRunning` guard
+  in `Clock.updateElapsedTime()` (:108-113).
+  Second instance also executed: a fresh `Clock` (elapsed 0, `__lastMeasurement` 0) after a single `pause()`
+  reports elapsed **0.9917 s** against `current_time_in_seconds() === 0.9917` — i.e. seconds since page load.
+  `Ticker`'s constructor does exactly this (`simulation/Ticker.js:71-73`), and `Ticker.start()`'s
+  `getDelta()`/`clock.start()` do not clear it (both leave `elapsedTime` untouched while `__isRunning` is false).
+
+### EMISC-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `achievements/AchievementManager.js:232-238` — `async initialize(engine)` assigns four fields
+  and never calls `super.initialize(engine)`; `EnginePlugin.initialize` is what calls
+  `BaseProcess.initialize()` → `__state.set(Initialized)`. `:421-430` — `async startup()` never calls
+  `super.startup()`. `save/GameStateLoader.js:15-17` — same omission for `startup()`.
+  Consequences verified in `plugin/PluginReferenceContext.js`: `navigate_to_running` (:72-89) short-circuits
+  only on `Running`, so a plugin stuck at `New` re-runs `initialize()` **and** `startup()` on every request;
+  `navigate_to_finalized` (:44-67) returns immediately for `New`, so `shutdown()` never runs.
+  `plugin/EnginePluginManager.js:75-101` re-requests the transition whenever
+  `dependency_state !== ProcessState.Running`, which for these plugins is always.
+  `loadDefinitions` (:239-255) pushes into `this.entries` with no reset, so a second `startup()` duplicates
+  every achievement.
+
+### EMISC-8
+- **Verdict**: CONFIRMED
+- **Evidence**: `achievements/AchievementManager.js:427` is `this.initializeGateway();` with no `await`,
+  followed immediately by `this.isStarted.set(true)` at :429. `initializeGateway` sets
+  `isGatewayInitialized` only after awaiting the gateway read. `unlock()` (:149-160) gates **both**
+  `deactivateEntry` and `present` on `this.isGatewayInitialized.getValue()`, so an unlock that lands in the gap
+  is written to storage and blackboard but never presented and never deactivated. `isActive` is
+  `ReactiveAnd(isStarted, isBlackboardAttached)` (:106-119), which fires `activate()` synchronously on the
+  `isStarted` write.
+
+### EMISC-9
+- **Verdict**: CONFIRMED
+- **Evidence**: `EngineHarness.js:126` is `new Promise(async function (resolve, reject) { … })` with no
+  `try/catch` and no use of `reject` anywhere in the body. Executed the same shape: after a throw past the
+  first `await`, the outer promise state remained **pending** and jest reported the escape as an unhandled
+  rejection — precisely the "hangs with no error surfaced" symptom. `this.p` memoises the pending promise
+  (:167-169), so retries hang too.
+
+### EMISC-10
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed a real `GameStateLoader` with a `gameSaves.update()` that rejects. Neither `resolve`
+  nor `reject` was called (`outcome: pending` after a full microtask+timer flush), and the rejection surfaced
+  as an unhandled rejection. `save/GameStateLoader.js:128-135` has no second `then` argument and no `.catch`,
+  unlike `load()` (:110) and `exists()` (:164).
+
+### EMISC-11
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed a real `GameStateLoader` over a real `InMemoryStorage` with empty
+  `gameSaves.data`: `load('auto-save', …)` **resolved with `undefined`**.
+  `save/GameStateLoader.js:101-103` falls through to `legacyLoad` → `Storage.loadBinary` (`save/Storage.js:25-28`)
+  → `InMemoryStorage.load` (`save/storage/InMemoryStorage.js:15`) which resolves `this.#data.get(key)`.
+  `IndexedDBStorage.load` (:88-90) resolves `event.target.result` with the same sentinel.
+
+### EMISC-12
+- **Verdict**: CONFIRMED
+- **Evidence**: Executed `WebEnginePlatform.prototype.pickDefaultLocale.call({}, ['ru','de'])` with
+  `navigator.languages === ['ja-JP']` → returned **`'en-gb'`**, which is not among the options.
+  `platform/WebEnginePlatform.js:81-85` hard-codes it. Secondary claim also executed: with `[]`,
+  `array_pick_best_element` returns `undefined` (verified in
+  `core/collection/array/array_pick_best_element.js:21-23`) and `best.score` threw
+  `TypeError: Cannot read properties of undefined (reading 'score')`.
+  `platform/EnginePlatform.js:18-22` documents `@param {string[]} options @returns {string}`, i.e. one of the
+  options.
+
+### EMISC-13
+- **Verdict**: CONFIRMED
+- **Evidence**: `save/GameStateLoader.js:1` imports
+  `"../../../../view/game/save/GameSaveStateMetadata.js"`, which resolves to
+  `app/src/mir-engine/view/game/save/GameSaveStateMetadata.js` — verified to exist and to be **outside** the
+  `meep/` package root. The symbol is referenced only in a JSDoc `@type` at :82, so the runtime import is
+  gratuitous. `scene/SerializedScene.js:1` imports
+  `"../../../../model/game/scenes/MirScene.js"` → `app/src/mir-engine/model/game/scenes/MirScene.js`
+  (verified to exist), and :57 is `export class SerializedScene extends MirScene`, i.e. a hard inheritance
+  dependency from the engine onto game code. Both escape the published package boundary.
+
+---
+
+## Tally
+
+45 findings checked (6 CRITICAL + 26 MAJOR from `view.md`, 13 MAJOR from `engine-misc.md`).
+
+- **CONFIRMED: 44**
+- **CONFIRMED-BUT-DOWNGRADED: 1** (VIEW-32, MAJOR → MINOR)
+- **REFUTED: 0**
+
+## Notes on what I looked for and did not find
+
+I specifically attempted the following refutations and none succeeded:
+
+- **Misread base-class members.** Checked `View.js` and `DOM.js` in full. `addChild`/`removeChild`/`isLinked`/
+  `bindSignal` all exist as the reviewer assumed; `View` genuinely has no `update` (VIEW-39's premise, MINOR);
+  `View.children` is a plain array so the `this.children = []` reassignments in `ToastLogView`/`Group` really do
+  produce the described double-registration. No mixin, getter or inherited member rescues any of the
+  "non-functional" claims.
+- **The `unlink()` ordering assumption.** Executed rather than assumed: `isLinked` is `false` inside
+  `on.unlinked`. VIEW-1's teardown-skip is therefore correctly grounded, not inverted.
+- **`assert.*` masking.** The one finding where this mattered (VIEW-27) is *worse* in production, not better,
+  because the guard that would surface the null localisation is unasserted away. No finding depends on an
+  assert being live.
+- **Unconstructable-class overreach.** `TabbedView`, `ToastLogView`, `ListController`, `Vector1Control`,
+  `MinimapTerrainView`, `RadialMenu` and `EmptyView` all construct fine in jsdom; the claimed defects are
+  behavioural, and each was reproduced against a real instance rather than inferred.
+- **Deliberate-convention defences.** No comment or JSDoc anywhere in the implicated code documents any of the
+  reported behaviours as intended. In two cases the codebase's own sibling code proves the opposite intent:
+  `GMLEngine.compile`'s `try/finally` vs `TooltipManager.buildTipView` (VIEW-30), and
+  `BottomLeftResizeHandleView`'s `lastPosition.copy(position)` vs `SimpleWindow` (VIEW-17).
+
+## Reliability of each report
+
+**`view.md`**: broadly reliable. All 6 CRITICALs and all 26 MAJORs reproduce; 22 of the 32 were reproduced by
+executing real code rather than reading. The only overstatement is VIEW-32's severity. The reviewer's own
+"Notes on evidence used" preamble (unlink ordering, Signal Map semantics, segment-intersection miss behaviour)
+checked out on every point.
+
+**`engine-misc.md`**: broadly reliable. All 13 MAJORs reproduce; 8 of them by direct execution against real
+`Engine`, `Clock`, `GameStateLoader` and `WebEnginePlatform` instances. No severity inflation identified —
+EMISC-13 is a packaging rather than runtime defect but genuinely breaks external consumers of a published
+package, so MAJOR is defensible.