Complete milestone 09 world integration gate (#75)

docs/world-milestone-gate.md

@@ -0,0 +1,48 @@
+# World milestone integration gate
+
+Milestone 09 closes on native Rust behavior, not on catalog coverage alone. The
+reproducible focused suite is `python3 tools/test_milestone_09.py`; its target
+list contains the world-owned library tests, the complete fake-grid lifecycle,
+and the translated compatibility targets for agent, inventory, assets,
+appearance, avatars, objects, land, discovery, social, estate, experience, and
+marketplace behavior. Live tests remain catalogued and reviewed but skip unless
+their existing credentials and the explicit `RUN_LIVE_TESTS=1` opt-in are
+supplied. The offline milestone runner always clears that opt-in.
+
+## Cross-manager fake grid
+
+The loopback scenario logs in through injected HTTP and UDP endpoints, waits
+for seed capabilities and the event queue, then performs a simulator handoff.
+While authenticated it constructs every client-owned world manager, verifies
+agent/session identity, reconciles an inventory marker through the shared
+store, checks AIS availability, creates an asset wrapper, observes appearance
+and animesh state, requests an object, and inspects parcel, grid, friend, group,
+and marketplace caches. A cancelled directory query proves that caller
+cancellation wins before wire work. A marketplace capability error emitted
+through a second `GridClient.Marketplace` lookup proves that the manager cache
+and event registry are shared.
+
+Manager events are asserted in deterministic order: event-queue readiness,
+the marketplace error, then logout. Capability downloads are bounded by the
+existing HTTP and download-manager policies. Diagnostic formatting is checked
+against login and capability secrets.
+
+## Cancellation and teardown
+
+Logout cancels the event queue, disconnects every simulator, leaves no pending
+logout task, and stops the download dispatcher. Client disposal then cancels
+the root token and releases every cached manager, including assets,
+appearance, avatars, animesh, land, discovery, social, estate, and marketplace
+state. Inventory has an empty shared store before login so offline fixtures and
+programs can stage deterministic data; a successful login atomically replaces
+it with the authenticated hierarchy.
+
+## Audit and program boundary
+
+`python3 tools/check_milestone_09.py` rejects stubs in all milestone-owned
+sources, missing native type/member mappings, unreviewed related parity cases,
+missing fake-grid evidence, and drift in the nine catalogued Rust program
+targets. The program ports remain a later milestone, but their required world
+APIs and target inventory are now auditable. Live actions remain opt-in:
+uploads, marketplace changes, estate/parcel mutations, currency spending, and
+operations affecting other users are never part of this offline gate.