[08.6] Make vendor purchases fully atomic

crates/capture-diff/README.md

@@ -136,6 +136,23 @@ The one-packet fixture proves the reward wire shape; the bot workflow separately
 proves offline accrual, DB XP/rest consumption, relog persistence, fixture
 restoration, and the natural respawn timer.
 
+The issue-#108 vendor fixture isolates the exact post-COMMIT realm response:
+`SMSG_BUY_SUCCEEDED` followed by `SMSG_ITEM_PUSH_RESULT`. Paired C++ and Rust
+bot runs bought item `30183` from G'eras (entry `18525`, spawn `96654`) for
+extended cost `1642`, proved currency `42` changed `30→15`, verified the item
+after a fresh authentication, and restored the fixture. The strict two-packet
+flow is CLEAN with an empty divergence baseline. Both schema-v3 manifests bind
+the pinned bot executable and exact validated report, and import retains both
+reports under `capture-provenance/` for re-verification. Its narrow
+`SMSG_BUY_SUCCEEDED` comparator omits only G'eras' nonzero lower 40-bit
+map-runtime GUID counter while pinning Creature/realm 1/map 530/entry 18525/
+subtype 0/server 0, MUID 59, `NewQuantity = -1`, `QuantityBought = 1`, S2C
+direction, realm routing, and canonical decoding. `SMSG_ITEM_PUSH_RESULT`
+remains byte-exact. The complete raw action also exposed the independently
+missing Rust `SMSG_CRITERIA_UPDATE`; that achievement-subsystem gap is neither
+ignored nor accepted by this vendor fixture. See the flow's README for the
+precise scope and reproduction command.
+
 The issue-#106 loot gate has an equally narrow comparator for
 `SMSG_LOOT_REMOVED`: paired real captures assigned its one reviewed Doctor
 Maleficus identity (Creature, realm 1, map 530, entry 21779, subtype/server 0)

crates/capture-diff/flows/vendor-extended-cost-purchase/README.md

@@ -0,0 +1,54 @@
+# `vendor-extended-cost-purchase`
+
+This issue-#108 fixture is the exact server-response window after the durable
+commit of one real extended-cost item purchase. It contains, in order and on
+the realm socket:
+
+1. `SMSG_BUY_SUCCEEDED` (`0x26C6`)
+2. `SMSG_ITEM_PUSH_RESULT` (`0x2623`)
+
+It was imported strictly from paired C++ and Rust captures made at Rust
+`7bee9bfe71940048c721c14845dc0a0ad0811c5d`. The retained schema-v3 manifests
+pin the raw capture, executable, source, process/listener, configuration and
+cleanup identities; `capture-lineage.json` pins the derived two-packet
+artifacts. Each manifest also pins its exact bot executable and validated JSON
+report; import retains those reports as `capture-provenance/cpp.bot-report.json`
+and `capture-provenance/rust.bot-report.json`, so the persistence/restoration
+claims remain independently recheckable. The accepted-divergence baseline is
+empty.
+
+The bot used the unique G'eras fixture (Creature entry `18525`, SQL spawn
+`96654`, realm `1`, map `530`) and vendor row item `30183`, extended cost
+`1642`. On both servers it proved currency `42` changed from `30` to `15`, one
+item was present after logout and fresh authentication, the expected
+`VendorInventory`, `SetCurrency`, `BuySucceeded` and `ItemPushResult` packets
+arrived on their C++ sockets, and cleanup restored the original character
+state.
+
+## Narrow semantic normalization
+
+C++ and Rust allocate different nonzero lower 40-bit map-runtime counters for
+G'eras. The `SMSG_BUY_SUCCEEDED` comparator omits only that counter and only
+for the exact stable identity Creature/realm `1`/map `530`/entry `18525`/
+subtype `0`/server `0`. It still requires a nonzero counter, MUID `59`,
+`NewQuantity = -1`, `QuantityBought = 1`, canonical packet decoding,
+S2C direction and realm routing. Every field of `SMSG_ITEM_PUSH_RESULT`
+remains byte-exact.
+
+## Scope boundary
+
+The complete raw bot action ran from `CMSG_BUY_ITEM` through the fixed
+`CMSG_PING` fence. Its purchase-owned responses and final inventory state
+matched after the reviewed runtime-GUID normalization. C++ also emitted
+`SMSG_CRITERIA_UPDATE`; Rust does not yet implement the corresponding
+achievement subsystem. That pre-existing out-of-scope gap is deliberately
+not ignored or accepted in this fixture. Consequently this committed flow
+claims only the clean post-COMMIT realm-response window, while the bot proves
+the complete currency, inventory, persistence and restoration behavior.
+
+Recheck the committed evidence with:
+
+```bash
+cargo +1.88.0 run -q -p capture-diff -- \
+  diff vendor-extended-cost-purchase --strict
+```

crates/capture-diff/flows/vendor-extended-cost-purchase/capture-lineage.json

@@ -0,0 +1,136 @@
+{
+  "version": 3,
+  "flow": "vendor-extended-cost-purchase",
+  "completed": true,
+  "sources": {
+    "cpp": {
+      "manifest_path": "capture-provenance/cpp.capture-manifest.json",
+      "manifest_sha256": "3275309e4a542772b982dc30b26db4d6fa7d1206ade8375c34299c0dacb7edb1",
+      "raw_artifact_sha256": "f037313fabf483655897aa2744ce80c0022236ef0632e08861f6d788f9afc6de",
+      "raw_artifact_size": 133941,
+      "raw_packet_count": null,
+      "harness_repo_head": "7bee9bfe71940048c721c14845dc0a0ad0811c5d",
+      "source_repo_head": "5100ce3d8fc6150feedf902e62512760ec03ea92",
+      "harness_worktree_clean": true,
+      "harness_worktree_state_sha256": "ce537655f53231c5303e35c1178d2996786316f51edf6d96a40282ccadc93c29",
+      "source_worktree_dirty": true,
+      "source_worktree_state_sha256": "3eeb18895c18215d381c7dc13cab516bb06e0441be2901e92c05d1845107afb1",
+      "worktree_state_algorithm": "git-head-path-mode-content-sha256-v1",
+      "expected_exec_path": "/home/server/trinity-legacy-install/bin/worldserver",
+      "expected_exec_sha256": "189ac0ef6a5fef0fe3033a9844e2251523a442b746734cbcfd667277bdf99603",
+      "source_exec_path": "/home/server/trinity-legacy-install/bin/worldserver",
+      "source_exec_sha256": "189ac0ef6a5fef0fe3033a9844e2251523a442b746734cbcfd667277bdf99603",
+      "live_exec_path": "/home/server/trinity-legacy-install/bin/worldserver",
+      "live_exec_sha256": "189ac0ef6a5fef0fe3033a9844e2251523a442b746734cbcfd667277bdf99603",
+      "executable_pin_enforced": true,
+      "pm2_entry_pid": 1641361,
+      "pm2_entry_starttime": 83203231,
+      "pm2_exec_path": "/home/server/trinity-legacy-install/bin/worldserver-wrapper.sh",
+      "pm2_exec_sha256": "41c0e84f282bf5711a2d4b433a054426d28de9875cfce1b3f7fcfe6c576df213",
+      "pm2_profile_redacted_sha256": "5de156ef078858c9d979e6bcc274d5d06e4d44588c273357fbf3f34dc235aca0",
+      "listener_runtime_pid": 1641363,
+      "listener_runtime_starttime": 83203231,
+      "listener_relationship_verified": true,
+      "restart_count": 0,
+      "effective_config_path": "/home/server/trinity-legacy-install/bin/worldserver.conf",
+      "effective_config_redacted_sha256": "d1194cfd24f63527cd930493f8ffd7610dfd8b2586e17a5b9a03cd3c97295437",
+      "effective_config_algorithm": "capture-relevant-redacted-v1",
+      "runtime_cleanup_verified": true,
+      "normal_runtime_restored": true,
+      "fixture_guard": null,
+      "bot_report": {
+        "contract": "wow-test-bot-vendor-extended-cost-purchase-report-v1",
+        "exec_path": "/home/server/rustycore-issue-108/tools/wow-test-bot/target/release/wow-test-bot",
+        "exec_sha256": "fad985573f17d24dd7d538ab499d3ef56189a63b233b1431028d8354704ee27b",
+        "report_path": "/tmp/rustycore-issue108-capture-7bee9bfe/cpp.bot-report.json",
+        "report_sha256": "caa1bbc6d304bac0157e4f939e099e01f6f30a3d2d492cf589f5d83515cfe056",
+        "account": "TESTBOT2@bot.local",
+        "account_id": 9,
+        "character_guid": 15,
+        "report_validated": true
+      },
+      "retained_bot_report_path": "capture-provenance/cpp.bot-report.json"
+    },
+    "rust": {
+      "manifest_path": "capture-provenance/rust.capture-manifest.json",
+      "manifest_sha256": "8ab981d481eaf401e52240601b61a2bdaeb43d394bfffc3a0b1aff8a3d8efa60",
+      "raw_artifact_sha256": "11563c26932f862d6bf1315f785f7c71002522a26f9489d9e65b72080c46d61c",
+      "raw_artifact_size": null,
+      "raw_packet_count": 196,
+      "harness_repo_head": "7bee9bfe71940048c721c14845dc0a0ad0811c5d",
+      "source_repo_head": "7bee9bfe71940048c721c14845dc0a0ad0811c5d",
+      "harness_worktree_clean": true,
+      "harness_worktree_state_sha256": "ce537655f53231c5303e35c1178d2996786316f51edf6d96a40282ccadc93c29",
+      "source_worktree_dirty": false,
+      "source_worktree_state_sha256": "ce537655f53231c5303e35c1178d2996786316f51edf6d96a40282ccadc93c29",
+      "worktree_state_algorithm": "git-head-path-mode-content-sha256-v1",
+      "expected_exec_path": "/home/server/rustycore-issue-108/target/release/world-server",
+      "expected_exec_sha256": "18292b8fe1ec4cf646c90125814cb395446e944c6d2a2d1ebc4412737d412b00",
+      "source_exec_path": "/home/server/rustycore-issue-108/target/release/world-server",
+      "source_exec_sha256": "18292b8fe1ec4cf646c90125814cb395446e944c6d2a2d1ebc4412737d412b00",
+      "live_exec_path": "/home/server/rustycore-issue-108/target/release/world-server",
+      "live_exec_sha256": "18292b8fe1ec4cf646c90125814cb395446e944c6d2a2d1ebc4412737d412b00",
+      "executable_pin_enforced": true,
+      "pm2_entry_pid": 1644097,
+      "pm2_entry_starttime": 83211941,
+      "pm2_exec_path": "/home/server/rustycore-issue-108/target/release/world-server",
+      "pm2_exec_sha256": "18292b8fe1ec4cf646c90125814cb395446e944c6d2a2d1ebc4412737d412b00",
+      "pm2_profile_redacted_sha256": "ad8a27657fdd7584b28ff3fc5150a1ce98f0b575511d87889dbb4830d2e791ab",
+      "listener_runtime_pid": 1644097,
+      "listener_runtime_starttime": 83211941,
+      "listener_relationship_verified": true,
+      "restart_count": 0,
+      "effective_config_path": "/home/server/trinity-legacy-install/etc/worldserver.conf",
+      "effective_config_redacted_sha256": "5e3f4e1ff0b296932b6d620f5a71ce03d13137f494e4812db8b9623dde0f5606",
+      "effective_config_algorithm": "capture-relevant-redacted-v1",
+      "runtime_cleanup_verified": true,
+      "normal_runtime_restored": true,
+      "fixture_guard": null,
+      "bot_report": {
+        "contract": "wow-test-bot-vendor-extended-cost-purchase-report-v1",
+        "exec_path": "/home/server/rustycore-issue-108/tools/wow-test-bot/target/release/wow-test-bot",
+        "exec_sha256": "fad985573f17d24dd7d538ab499d3ef56189a63b233b1431028d8354704ee27b",
+        "report_path": "/tmp/rustycore-issue108-capture-7bee9bfe/rust.bot-report.json",
+        "report_sha256": "8dd538caf0879add1cee437e8434ea7716a9f5dc95ff804e75f3be79841b15cf",
+        "account": "TESTBOT2@bot.local",
+        "account_id": 9,
+        "character_guid": 15,
+        "report_validated": true
+      },
+      "retained_bot_report_path": "capture-provenance/rust.bot-report.json"
+    }
+  },
+  "selection": {
+    "directions": [
+      "s2c"
+    ],
+    "from_opcode": {
+      "direction": "s2c",
+      "opcode": 9926
+    },
+    "until_opcode": {
+      "direction": "s2c",
+      "opcode": 9763
+    },
+    "ignored_opcodes": [],
+    "strict": true
+  },
+  "outputs": {
+    "cpp_pkt": {
+      "path": "cpp.pkt",
+      "size": 240,
+      "sha256": "ef95922e260a96d8ef9140d0378095476f7b35db5475e6e6459ae1ec2dcb51a5"
+    },
+    "rust": {
+      "path": "rust",
+      "file_count": 4,
+      "packet_count": 2,
+      "tree_sha256": "52575840c5e9db44452e5e0194ec8944c5f227136fb12b7e7885ef417d4c249e"
+    },
+    "expected_divergences": {
+      "path": "expected-divergences.json",
+      "size": 2,
+      "sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
+    }
+  }
+}