[FractalEngineer]

Depends on #745. This branch is stacked on the corrected projective replay.

Production startup inspection currently depends on the heavyweight debug server and TCP.

Current behavior

Debug-free builds have no compact machine-readable confirmation that the requested save load settled and the current XR session submitted a real frame.

Desired behavior

A production build can atomically publish one receipt per XR session after the requested load succeeds and that session submits a frame. Failed loads cannot appear successful, and a later XR session resets readiness.

Changes

• Publishes through a same-directory temporary followed by atomic replacement; an existing destination is refused at process start.
• Adds XR session-generation fields so readiness is bound to a submission from the current session.
• Waits for the requested PSX_LOAD_SLOT outcome and a later current-session submission; failed loads publish ready:false.
• Starts a fresh load lifecycle for every game/XR session and rebinds the current execution request, so a previous success cannot authorize a reboot.
• Reports write/close failures without exposing partial JSON.
• Keeps the opt-in production performance counters separate from the readiness receipt.

Validation

The complete production runtime builds with debug tools off. Atomic replacement and focused OpenXR/PGXP/render tests pass. The readiness state-machine test covers success, XR re-init, reboot with stale success, pending/failed reboot loads, recovery, and refused requests. A headless malformed-load control writes ready:false.

[mstan]

Useful opt-in production diagnostics, but this stack is blocked by #744 and #745. Independently, the claimed atomic/fresh readiness receipt is not implemented: openxr_ready_report_tick fopen(path, wb) truncates an existing destination and exposes partial JSON while writing. It also latches done for the process rather than the session. Please use a same-directory temporary file plus atomic publication, refuse/reliably invalidate a stale requested destination, check write/close failures, and reset the readiness request on session reboot. Bind readiness to a real submission from the current session after the requested current-build load completes; a stale or failed load must not appear successful. The older slot-2 fixture being rejected is acceptable under owner policy and is not itself a blocker. The lightweight perf counters can remain separate from this receipt fix. Tracking: beads-ek8k.

[mstan]

Re-reviewed 5c68581. Same-directory atomic publication, existing-destination refusal, and explicit invalid/refused-load reporting address substantial feedback. One session-lifetime issue remains: when session_generation changes, the reporter resets only published_for_session and submission counters. Its static load_resolved, load_status and generation floor, plus g_openxr_ready_load_error, survive the next session_reboot, which stages PSX_LOAD_SLOT again. After a successful first-session load, a second-session pending/failed load can therefore be ignored and the previous last_ok can authorize ready:true once a new XR submission arrives. Reset/rebind the load lifecycle to the current execution/XR session and qualify success->reboot->pending/failure/success sequences. Please exercise the actual readiness decision state machine, not just the atomic-file helper. This is current-session correctness; rejection of an older savestate remains acceptable. Keeping this head held; #744/#745's revised fixes are being reconsidered separately. Tracking: beads-ek8k.

[mstan]

Re-reviewed ebca6c5. The execution-bound request sequence / generation floor and session rebind address the stale-success issue I reported. The tests now exercise successful load -> reboot -> pending/failure -> recovery, plus refusal and XR session re-init, through the actual readiness decision helper. Those tests and the atomic file fixture pass both standalone and in the combined current-master build. The remaining ordinary title smoke batch is underway. No HMD rendering qualification is claimed here; this PR is an opt-in production receipt, with truthful current-session load status required within that path. Tracking: beads-kgof.

[mstan]

The author execution generation/request sequence/status floor and session rebind address stale readiness success. Actual readiness-helper tests cover success->reboot->pending/failure->recovery, refusal and XR session reinit; atomic file publication passes. The production receipt is elective; truthful current-session status within it is unconditional. This is not headset rendering qualification.

One bounded muted OpenGL boot/progression/visual smoke passed for Tomba, Tomba 2, Ape Escape and Mega Man X6. Tomba 2 reached its title screen after the opening FMV at native aspect; its unsupported widescreen package remains disabled. Supported debug quit returned exit 0 for all four; this is not extended gameplay, normal-teardown or native-card-write qualification.

Combined integration 9ee1a8c63996cc91e4068aa27f100d407ab1ac0e includes #710/#723/#736/#737/#746; #736 remains held for residency policy. Six focused native checks and the GL fixture passed. This evidence qualifies the reviewed heads as a compatible subset, not an exact final-master-tree claim. Tracking: beads-kgof.

[mstan]

The author execution generation/request sequence/status floor and session rebind address stale readiness success. Actual readiness-helper tests cover success->reboot->pending/failure->recovery, refusal and XR session reinit; atomic file publication passes. The production receipt is elective; truthful current-session status within it is unconditional. This is not headset rendering qualification.

One bounded muted OpenGL boot/progression/visual smoke passed for Tomba, Tomba 2, Ape Escape and Mega Man X6. Tomba 2 reached its title screen after the opening FMV at native aspect; its unsupported widescreen package remains disabled. Supported debug quit returned exit 0 for all four; this is not extended gameplay, normal-teardown or native-card-write qualification.

Combined integration 9ee1a8c63996cc91e4068aa27f100d407ab1ac0e includes #710/#723/#736/#737/#746; #736 remains held for residency policy. Six focused native checks and the GL fixture passed. This evidence qualifies the reviewed heads as a compatible subset, not an exact final-master-tree claim. Tracking: beads-kgof.