CHECKPOINT CLOCK REPAIR - PLAYTEST 11
====================================

Evidence
--------
Client attachment d1b13989-4882-4849-bd91-e0165baa8e4f, Playtest 10:
  lines 247-248: prepared launch and committed stage 1 accepted.
  lines 405-409: owned world ready, admission begun, first offer accepted.
  43 accepted offers; all admission-progress receiving byte counts are zero;
  no decoded state/Ready/release; line 475 names the 120-second admission timeout.
Host runtime.log from that same attempt:
  countdown and all required launch receipts succeeded;
  18,284,936 raw state bytes encoded to 1,555,134 bytes; repeated offers;
  prepared remains 1 of 2. The failure is after launch, before state admission.

Confirmed source cause
----------------------
The simulation worker captures now, then invokes PartyRuntime::pulse(now).
Pulse drains incoming messages, then invokes transfer(now).
The Offer handler called receiver.begin(...Clock::now()), setting started_ to
a LATER instant than pulse's now. CheckpointReceiver::expired(now) explicitly
rejects now < started_ as a backwards-clock safety condition. transfer(now)
therefore cancelled the newly started receiver IN THE SAME PULSE and sent Need.
The outgoing sequence was OfferAck followed by Need. Even when the host accepted
that receipt, Need replaced the delivery and the client no longer retained the
receiver for its arriving chunks. That explains the repeating zero-byte loop.

Fix
---
Pass pulse's monotonic now into message handling, receiver.begin, receiver.receive
and phase transitions. The existing expiry check uses that exact same instant.
No receiver timeout or backwards-clock guard is removed. No transfer is treated
as admitted without integrity verification and canonical state recapture.
Duplicate matching active offers acknowledge without resetting partial state;
conflicting retries still fail. Bounded event logs show receipt/first chunk/real
expiry, without logging addresses, credentials, saves or checkpoint contents.

Scope and preservation
----------------------
Only patches/checkpoint-clock-repair is authored. The overlay composes after
Playtest 10 and stages two first-party cpp files in external build directories:
party_runtime.cpp and experimental_runtime.cpp (compatibility identity only).
The fix's contract hash is included in the runtime compatibility identity, so
old peers cannot silently join a repaired runtime. All checked-out dependencies,
RecompiledFuncs and RecompiledPatches stay untouched. Countdown, host settings,
original lobby/spectator UI, swaps, invites, graphics and mods are retained.

Recovery snapshot:
D:/DiddykongWorkFolder/checkpoint-clock-repair-20261023/baseline

Verification
------------
The source audit re-composes both generated outputs, verifies final compiler
bindings, re-runs retained contract audits, checks unchanged pre-existing files
against the recovery snapshot, and requires the one-clock packet/expiry ordering.
Receiver size, digest, backwards-time and timeout safeguards are checked intact.
Windows and Linux compile/link; static binary and ZIP/AppImage inspection only.
No target/test/game/mod/AppImage execution. User gameplay/network acceptance
remains necessary. No push, public release or updater signing is performed.
