[Mathih13]

A Gateway handler reached a reducer through three forwarding layers: the family trait, the WorldStore adapter block, and an inherent wrapper in stdb/reducers.rs. 75 wrappers took an account id they never read, 76 copied a zero-guid guard, and five handlers told a Refusal from a lost connection by matching the text "reducer transport disconnected". That text appears only when the pipe was already down. A connection lost during the call, a 10 s timeout or a send failure counted as a silent Refusal, and the World Session went on.

This is phase 4 of #635.

Shape

• Each family's Coordinator impl in gateway/src/stdb/store/<family>.rs calls its reducer directly. stdb/reducers.rs went from about 4,950 lines to 113 and keeps only the calls no Store owns. stdb/world_store.rs is gone; RealmDb lives in stdb/realm_db.rs.
• Actor(NonZeroU64) replaces (account_id, actor_guid) on every Store method that acts for a Character. The handler resolves it once, and the zero-guid guard exists only in Actor::new. Calls that mean the session owner on purpose use owner_actor().
• classify(&error) returns Refusal { reason } or TransportLoss. Every handler uses it, and Fakes return typed ReducerCallError::refused or transport_lost.

Behaviour change (approved: fail closed)

• Only a Module Refusal (ReducerCallError::Rejected) is a Refusal. A timeout, a lost or failed send, or a failed cache read is a Transport Loss and ends the World Session, and the client relogs from durable state. Before, vendor, quest, guild, chat, channel, cast, melee, mail, bank, trainer, meeting stone and others swallowed these as a silent Refusal.
• Every client answer to a Refusal is unchanged. A user error that the Gateway finds itself, such as an unknown Account name in a GM command, still reaches the GM as a system line.
• Taxi: a Module Refusal on status, open or activate now answers and keeps the session, where before it ended it.
• Bank slot purchase: the old code parsed the reducer's display text, which never matched, so every refusal showed "not a banker". It now decodes the real reason.

Tests

• Each family has a test where a Transport Loss ends the session and a Refusal answers the client. Families that decode in the adapter test the pure decoder with typed errors.
• Proof: no "transport disconnected" outside stdb/connection.rs, no _account_id in gateway/src/stdb, no actor_guid == 0.

Glossary: adds Transport Loss; Actor now names the type.

Main's #643 Gateway changes (bind home, talent wipe, at-war, item split and destroy) are merged and expressed in this shape.

Local gates: fmt, clippy with -D warnings, the five crate test commands and the wasm check pass.

🤖 Generated with Claude Code (Claude Opus 5.5 lead, with Opus 5.5 and Sonnet 5.5 subagents)

[Mathih13]

Code review: Standards and Spec

Reviewed main...ab718dcb (37 commits, 152 files) on two separate axes. The spec is #635, phase 4. Line numbers are for files at the head commit.

Most claims in the description are true: reducers.rs is 113 lines, world_store.rs is gone, and classify (stdb/connection.rs:578) downcasts to ReducerCallError. No "transport disconnected" text, _account_id or actor_guid == 0 is left. No wire, schema or Module files changed. The bank slot-purchase fix is correct.

Standards

Breaches of documented standards

1. Medium. The Actor glossary entry has drifted. CONTEXT.md:219 ends "into a SessionActor" and CORE_TERMS.md:47 ends "into the SessionActor a reducer receives". AGENTS.md and CORE_TERMS.md require the two to match.
2. Medium. New prose uses "database" to mean a shard, which is an Avoid word under Shard. See store/loot_roll.rs:14, the pending_local_rolls doc, the unsharded-database comments in store/channel.rs, chat.rs and guild.rs, and the heartbeat doc in reducers.rs.
3. Low. New names use Avoid words: "reject" (under Refusal) in the a_rejected_* tests in connection.rs, in the decoder tests and in fn rejected (loot_window.rs:487), and "fatal" (under Transport Loss).
4. Low. About 139 added comment lines have em dashes, which the unslop skill bans. Most of them moved over from reducers.rs. History narration remains in the pending_local_rolls doc: "this table is now part of the coordinator subscription list".

Smells (judgement calls)

5. Medium, Duplicated Code. The pattern "classify, then parse_tag(reason), then Err(error)" repeats in store/item.rs:88, loot_roll.rs:205, social.rs:256, auction.rs:1072 and party.rs:548. party.rs:548 also duplicates reducer_refusal_reason (connection.rs:586). One generic helper next to classify would replace all of them.
6. Medium, Middle Man. In realm_db.rs, about 14 trait methods only forward to the inherent method of the same name. Move the bodies into the impl.
7. Medium, Primitive Obsession. InWorld.self_guid stays a u64, so handlers call Actor::new about 20 times (guild.rs:1659/1677/1717/1788, party.rs:1076/1363/1403/1509, mail.rs:704, taxi.rs:115, ...). Each of those callers decides what guid 0 means. If InWorld stored an Actor, the conversion would happen once.
8. Medium, Data Clumps. The three finish_*character_shard_transfer bodies in realm_db.rs pass the same source and destination tuple.
9. Low. store/character.rs:431,434 still decides on reason.contains("NAME_IN_USE") and "SERVER_LIMIT" instead of parsing a tag.

Spec

Wrong implementation

1. High. A rejected taxi ack now keeps the session after the flight has committed. In store/taxi.rs, gw_ack_taxi_reply runs after gw_activate_taxi commits. If the Module refuses the ack, classify returns Refusal, and or_refused (world/handlers/taxi.rs:46) answers ACTIVATE_UNSPECIFIED_SERVER_ERROR and keeps the session. The flight stays committed but is never armed. The comment there still says a failed ack "remains session-fatal". Either map an ack failure to Transport Loss, or apply or_refused only to the activate call.

2. Medium. "Fail closed" covers more than transport. classify treats every untyped error as a Transport Loss, so local Gateway failures now end the World Session even when nothing durable is in doubt. Examples:

   • next_escrow_id bails with "not claimed" or "exhausted" (world/mail.rs:908,913) before any durable write.
   • mail_escrows_of (store/mail.rs:436) drops an escrow row whose header fails to decode, so held_fence times out.
   • auction.rs:230 returns "not in world".

   Confirm that the approval covers these cases, or make them typed Gateway Refusals.

Missing or partial

3. Medium. Spec: "Delete the inherent reducer wrappers that only forward." In store/transfer.rs:107-131, trait methods still forward to inherent wrappers at :327-390, and only a test in account_sessions.rs:600-623 uses them. realm_db.rs:45-52 (establish_session) also forwards to reducers.rs:97.
4. Medium. Spec: "one test per family shows a transport loss and a Refusal produce different outcomes." The transfer family has no such test.
5. Low. guild.rs:1699 (run_best_effort, sign-on at world entry) logs and continues and does not call classify.

Not in the spec

6. Low. realm_core.rs:163 (unknown_account) builds a ReducerCallError::Rejected for a check the Gateway makes itself, so the reducer error type now also carries Gateway Refusals.
7. Low. The cache reads moved from stdb/reads/* into the Store files. The move is harmless, but it makes the diff larger.

---

Summary: Standards has 9 findings. The worst is the Actor entry that differs between CONTEXT.md and CORE_TERMS.md, plus the Avoid-word use. Spec has 7 findings. The worst is the rejected taxi ack, which keeps the session with a committed but unarmed flight.

---

Generated by Claude Code