# World milestone integration gate

Milestone 09 closes on native Rust behavior, not on catalog coverage alone. The
reproducible focused suite is `python3 tools/test_milestone_09.py`; its target
list contains the world-owned library tests, the complete fake-grid lifecycle,
and the translated compatibility targets for agent, inventory, assets,
appearance, avatars, objects, land, discovery, social, estate, experience, and
marketplace behavior. Live tests remain catalogued and reviewed but skip unless
their existing credentials and the explicit `RUN_LIVE_TESTS=1` opt-in are
supplied. The offline milestone runner always clears that opt-in.

## Cross-manager fake grid

The loopback scenario logs in through injected HTTP and UDP endpoints, waits
for seed capabilities and the event queue, then performs a simulator handoff.
While authenticated it constructs every client-owned world manager, verifies
agent/session identity, reconciles an inventory marker through the shared
store, checks AIS availability, creates an asset wrapper, observes appearance
and animesh state, requests an object, and inspects parcel, grid, friend, group,
and marketplace caches. A cancelled directory query proves that caller
cancellation wins before wire work. A marketplace capability error emitted
through a second `GridClient.Marketplace` lookup proves that the manager cache
and event registry are shared.

Manager events are asserted in deterministic order: event-queue readiness,
the marketplace error, then logout. Capability downloads are bounded by the
existing HTTP and download-manager policies. Diagnostic formatting is checked
against login and capability secrets.

## Cancellation and teardown

Logout cancels the event queue, disconnects every simulator, leaves no pending
logout task, and stops the download dispatcher. Client disposal then cancels
the root token and releases every cached manager, including assets,
appearance, avatars, animesh, land, discovery, social, estate, and marketplace
state. Inventory has an empty shared store before login so offline fixtures and
programs can stage deterministic data; a successful login atomically replaces
it with the authenticated hierarchy.

## Audit and program boundary

`python3 tools/check_milestone_09.py` rejects stubs in all milestone-owned
sources, missing native type/member mappings, unreviewed related parity cases,
missing fake-grid evidence, and drift in the nine catalogued Rust program
targets. The program ports remain a later milestone, but their required world
APIs and target inventory are now auditable. Live actions remain opt-in:
uploads, marketplace changes, estate/parcel mutations, currency spending, and
operations affecting other users are never part of this offline gate.