Shared Photon co-op transport layer for Outward BepInEx mods: channels over one relay, a hello/peer ledger, per-channel counters/heartbeat, PUN diagnostics, and a replicated-record store for consumer state mirroring.
Fix stale dependency pins across the fleet; DonorKit 0.1.7
CompanionKit/NetKit: park+release the anchor's Photon view-ID
AF1-3 review: keep void Flourish, add TryFlourish; sync the version quartets
AF1-8: bound the NetCounters tables
AF1-6: a PeerOwned store must clear on a room change
AF1-4: a disabled master names the guest reports it swallows
Unreleased
NetCounters is bounded (AF1-8, the UnknownViewTable pattern): the per-verb table caps at 64
verbs and each verb's drop-reason set at 32, with refused events counted and named in Summary.
Verbs and drop reasons are compile-time constants in every consumer, so a growing table means
something is inventing them from the wire — and a diagnostic must never become the leak. A full
table stops growing rather than evicting, and a capped reason tag still counts its drop.
ReplicatedStore refuses PeerOwned + ClearOnRoomChange = false at construction (AF1-6), the
same ArgumentException shape as the existing ResolveUidOwner refusal. A PeerOwned row key is
derived from the sender's ACTOR NUMBER, and actor numbers are room-scoped — carrying rows across a
room change leaves ghosts keyed to actors that mean someone else (or nobody) in the new room, and
the presence reap compares actor numbers with no room identity so it cannot see them either.
Latent today (both shipped consumers set it true); documented in docs/wiki/kits/netkit.md.
Fire-and-forget PROXY leg: a master with the feature disabled now DROPS a guest's report as
disabled-on-master instead of skipping it silently (AF1-4, ruling change). The old Skip
blackholed every guest's transient — no apply, no relay, no drop count, no log — so nobody in the
room ever saw that moment and no dump could name why. The CAST leg keeps its silent skip: a
machine that renders nothing locally is not losing anyone else's moment.
0.2.4 — 2026-08-19
Merge branch 'fix/sa-0815-mpnet' into feature/pet-self-feed
SA 2026-08-15 lane F3: MP/net teardown, mirror-race + hello-warn fixes
A10 verb re-homing: photondump body -> NetKit.ViewRegistryDump; waiver docs; V28-V31
Forge shell fixes: SSH commands via bash -c (fish login shell); set/cfgdump on every channel mod
Forge shell: catalog dump + response protocol + set/cfgdump in ForgeKit; forge CLI/REPL + completion packs; wiki-enriched name db
W4: fixes for everything D1 found, plus the join-race P1
MP fix waves W1/W2/W3, and what Block A found when we ran them
Log levels: a per-mod [Diag] LogLevel, gating at the source
NetKit + CompanionKit: GetComponent ?? AddComponent, without the eager trap (UNT0007)
Cloudward + NetKit: say it when a decision was downgraded
Cloudward + NetKit: five ways a quiet failure became a loud one
Unreleased
New (built, NOT live-verified): ChannelOptions.QuietVerbs — verbs a channel declares quiet
skip the per-send/per-recv LogInfo line AND the 32-entry TraceRing write, while their
COUNTERS still count (sends/recvs/drops stay in netdump). Built for streaming verbs
(CompanionKit's ~5 Hz ck.proxy.pos would wrap the whole trace ring in ~6 s and destroy the
cross-verb forensic window, and would drown a VerboseNet log). Pure membership decision is
NetKit.Core.QuietVerbSet (ordinal, null/empty-tolerant, unit-tested).
New: NetKit.Views — a shared clone/view-hygiene API, positioned as NetKit owning the Photon
half of "clean up a live clone" so consumers stop hand-rolling their own tripwires against it.
Neutralize performs the always-legal PhotonView field writes (removedFromLocalViewList,
viewID=0, sync mode Off, send group 254) BEFORE any destroy is attempted, so even a refused
destroy can no longer let a stray view evict the real replica underneath it. VerifyClean /
CountNetwork / DisarmSurvivors round out an honest report of what actually survived a strip,
rather than assuming a logged destroy call succeeded.
New: core/NetKit.Core/ViewHygiene.cs — the pure compute half (ViewFacts/SurvivorFacts/
Describe/IsClean), including the one shared RefusalNote const for "Unity silently refuses
this class of destroy call here" so the explanation can't drift between call sites that quote it.
New: NetKit.ViewLease — the view LIFECYCLE complement to Views (phase 2 of the hygiene
migration; built, NOT live-verified): Mint/Bind allocate or adopt a viewID onto an inactive
clone's own PhotonView (single-view semantics; no-view is a returned fact, never a throw —
the consumer owns the warn-vs-refuse policy), Release/DeferRelease/SweepPending park a
minted id next to its body and hand it back only once the body is destroyed (PUN warns on a
live-view release), and MuteView + MutedGroup (253) stop a registered view from streaming
WITHOUT deregistering it — deliberately the opposite doctrine of Views.Neutralize (254), the
header explains why both groups coexist. One instance per consumer: the ledger, the log tag and
the once-per-session latches are consumer-scoped, and every emitted line is byte-stable with
the pre-migration SpawnKit implementation; consumer-dialect notices surface through callbacks.
New: core/NetKit.Core/ViewLease.cs — the pure half of the lease (LeasePolicy with the 300s
age-out rule and the aged-out re-check verdict, ViewLedger/LeaseEntry the pending-release
ledger, MuteResult), unit-tested for the first time incl. the byte-stable forensics dump
format (ViewLeaseTests).
0.2.2 — 2026-08-02
Cloudward + NetKit: say it when a decision was downgraded
Cloudward + NetKit: five ways a quiet failure became a loud one
Docs sweep: archive, condense, and validate the whole documentation tree
