[engine-audit][P2-cluster] Token-mass bounded surfaces

[100yenadmin]

Cluster theme

Two merged token-mass findings on the every-beat path: SYN-08 — unbounded campaign-history surfaces (every-beat full history re-parse, count-not-byte recap with 48,631B reproduced live, uncapped durable/tail blocks; merges F07-5+F07-11+F13-6+F14-16+F14-17). SYN-09 — echo-back return mass (~110K tok of corpus echo; log_event is the most-called tool and echoes the DM's own prose back; persist_beat's echo trim is test-asserted and must be a separate commit; merges F07-12+F13-7+F14-14).

This is a P2 cluster from the WorldOS full-engine adversarial audit (2026-06-11). Every finding below was skeptic-verified at engine HEAD a245a2c and has a full implementation-ready spec (root cause with file:line, evidence, fix spec, test strategy) in the per-unit deep sections (Part C) of the audit report — work the cluster as a wave or split per-finding as it gets scheduled.

Findings

SYN-08 [P2|high|M] Unbounded campaign-history surfaces on the every-beat path (F07-5 + F07-11 + F13-6 + F14-16 + F14-17)

gates: latency — the lean spine creeps invisibly as campaigns age (30+ sessions -> 30-60KB/beat projection) and the read side is strictly linear in campaign size on the every-beat path. why_broken: read_log_all opens + pydantic-validates EVERY line of EVERY session file to return the last 8, 2-4x/beat, no tail short-circuit (store.py:347-393; server.py:9025-9056; 25ms @ 2,518 rows today, linear); session_recap bounds COUNT (12) not SIZE — 12x4KB entries -> 48,631B reproduced live (recap.py:44-70); scene_context's durable block has no cap on npc_relationships (every met NPC forever) or open-quest objectives …

SYN-09 [P2|high|S] Echo-back return mass (F07-12 + F13-7 + F14-14)

gates: latency — ~110K tok of corpus echo; log_event is the MOST-CALLED tool (195x) and echoes the DM's own prose back; remember/forget return the entire memory list (~6KB at 60 facts); persist_beat echoes O(items x whole-memory) and bare-KeyErrors on a malformed item (aborting batched writes); update_character returns the full ~4KB sheet. why_broken: server.py:7212-7214 {"logged": entry.model_dump()}; remember/forget return full ch.memory (:6372); persist_beat remembered.append(full list) per item + mem["character_id"] bare KeyError where siblings raise ValueError; update_character:2653. Consumer grep: NO …

Cross-links

• Distinct from [qa][engine] #743 heartbeat is invisible to the player AND contaminates engine memory (recap/FTS/lean tail) #749/fix(qa+engine): make the beat heartbeat real — flip progress at ingest, decontaminate recap/FTS/lean-tail/fallback (#749) #763 (which govern what ENTERS the log) — this governs how much the per-beat spine CARRIES. Relates to Per-entity state files for scale (review finding M2) #17 (per-entity state files) at a different layer, and to the [ux][latency] Define a per-beat latency BUDGET for the GUI loop (not just telemetry) #753 latency budget.

Issue refs appearing in the findings' dup/related lines: #763, #17, #749

---

Findings: SYN-08, SYN-09 | effort/confidence: per-finding tags above
Source: docs/audits/ENGINE-AUDIT-2026-06-11.md (PR #768), unit(s) 07 + 13 + 14 — Part C per-finding deep sections hold the full specs.