# Landmark intake, teleport, and roaming

Landmark authority is private. Public chat and non-allow-listed IM can neither
accept offers nor see create/teleport/schedule tools. An authorized agent can
create and catalog a landmark for its current position in the standard
Landmarks inventory folder. The policy layer seals the authenticated avatar
into every mutation; tool schemas contain only a landmark name, catalog
selector, or bounded interval, never an avatar, region, coordinate, inventory
folder, or L$ field.

The live adapter subscribes through the original LibreMetaverse compatibility
events but lives entirely in `metacrate-grid-agent`. Authorized landmark and
folder offers are accepted into `MetaCrate Received Landmarks`, which is a
quarantine and recovery folder. Direct items are cataloged only after the
server returns authoritative item metadata. Folder descendants are fetched
with bounded breadth/depth and asset-fetch counts; a cycle, link, duplicate
asset, bad type, empty folder, stale response, or limit breach leaves the
quarantined inventory untouched and out of the catalog. Task offers and all
unauthorized or arbitrary inventory offers are declined.

The persisted catalog contains sender UUID, inventory UUID, asset UUID,
permission fingerprint, display name, receipt time, validation state, and last
outcome. Names are untrusted. Persistence is bounded, versioned, atomically
replaced, and mode `0600` on Unix. Teleport selection prefers stable IDs and
requires clarification for duplicate names. Immediately before the native
landmark teleport, the item is fetched again and its type, asset UUID, and
permissions must match. One semaphore, a timeout, cooldown, and lifecycle
cancellation prevent overlapping or stale teleports.

Roaming schedules retain the authorizing avatar UUID and safe minimum/maximum
intervals. Randomness is injectable. A due run chooses without immediate
repetition when possible and schedules its next deadline from the current time,
so downtime never creates catch-up bursts. Conversation, operator, degraded,
build, and viewport-capture pause reasons all suppress selection. Disabling a
schedule is persistent and cancellation stops in-flight native teleport work.

Focused verification:

```console
cargo test --locked -p metacrate-grid-agent --lib landmark_tests
cargo check --locked -p metacrate-grid-agent --all-targets --features live-grid
```