Empirical lab backlog — untested load-bearing engine assumptions (post fluid-lab sweep)

[solarcloud7]

A repo-wide sweep (2026-07-06, after the fluid-lab killed the ghost-buffer legend) classified every load-bearing engine-behavior claim by evidence status. This issue is the durable backlog; work items check off as labs re-certify them. Method + triggers: CLAUDE.md § Empirical lab discipline; fact ledger: docs/factorio-2.0-api-notes.md.

Tier A — rungs required BEFORE Phase-2 wiring is approved

• Hold-completeness lab (sweep Migrate to Clusterio 2.0.0-alpha.25 + destination-planet imports #1, the top risk): what does platform.paused actually stop? The D1/hold proof measured only items+fluids over 600 ticks. Untested on a held platform: spoilage progression, asteroid collision/damage, mid-descent cargo pods. Also fold in the descending-pod hub-overflow branch (sweep chore(dev): make build/hot-reload commands safe + accurate; drop stale DEVELOPMENT_SETUP #19). A long-held destination that can spoil or take damage silently violates the fidelity claim.
• No-tick-in-synchronous-pass rung (sweep refactor: table-drive trivial field restores in restore_entity_state #10 / Pitfall fix: make fidelity sentinel robust — meter-drift only (drop unsound src-vs-dst total) #28 mechanism): the strict gate's correctness rests on "a synchronous active-toggle pass produces no craft swing" — cheap single-session rung.
• set_surface_hidden semantics (sweep ci: bump GitHub Actions to Node 24 runtime #5): what does hidden actually gate mid-session (remote view, teleport-in, map)? Needs a connected player — semi-manual lab on host-1.

Tier B — 2.0.76→2.0.77 re-pin sweep (mostly retag-via-existing-coverage)

The version-compat layer + a body of [empirical, 2.0.76] facts run un-re-certified on 2.0.77 — and the API provably drifted across exactly this gap twice (destroy(ticks), set_inventory_size_override arg order). Most are already exercised by CI suites on 2.0.77; the task is verifying which suite covers each fact and updating tags:

• chore: enforce documented Lua invariants + fix 4 platform.destroy leaks #8 held-item clamp/force-bonus (covered by force-bonus-sync on CI → retag)
• refactor: type the gantt timeline rows (web), drop getProp in PhaseTimeline #13 get_item_count belt semantics (engine-invariants on CI → retag)
• chore(dev): address code-review nits from #16 #17 platform.destroy no-op (5-min RCON re-probe + retag)
• refactor: relocate transaction payload types to shared/dto + type the web payload reads #11 pause-on-import placement/fuel, chore: docs reconciliation + test-harness fixes (cleanup, belt fixture, engine invariant) #20 passenger detection inputs (re-probe or map to covering suite)
• version-compat.lua:16 header re-anchor to 2.0.77
• feat: Prometheus transfer metrics on the live /metrics endpoint #9 set_inventory_size_override (tag-only; no production dependency)

Tier C — tag-only (no rung until a design needs them)

• refactor: Tier-1/1.5 structural cleanup (behavior-preserving) #2 fluidbox stale-read: retag [empirical]→[hypothesis] — R9 explicitly failed to confirm staleness; the workaround it justifies is harmless and stays
• feat: real waterfall Transfer-Flow trace with cross-machine gap accounting #15/fix: content-hash web static assets (stale-chunk bug) + host-Node-free build #16/test: failed-entity-loss attribution + patch-and-reset exit-code fix #23/fix: make fidelity sentinel robust — meter-drift only (drop unsound src-vs-dst total) #28 pitfall MECHANISM sentences: add evidence-status lines separating rule (SYS/empirical) from mechanism (hypothesis), as chore(dev): address code-review nits from #16 #17 got
• fix: two unbound-method crashes from #2 (instance start + transfer) #6 evacuation connected-player path: [to-verify] — test opportunistically when a player is connected
• chore(lint): guard webpack output stays content-hashed (lint:web-cache) #18 thermal-energy merge behavior: already hedged ("may"); tag
• ci: reliable instance start (start-all) + single-source Factorio 2.0.76 #4 stage-write vs autosave durability: NOTE — likely self-resolving by save atomicity (storage + world state live in the same save file, so a crash reverts both consistently); the real exposure is controller-vs-dest divergence, already a crash-matrix row. Confirm with one sentence in the Phase-2 plan, no lab needed.

Already sound (no action)

Fusion output write-reject (ISO77), seg-id nil (ISO77), platform identity (API+ISO+lint), frozen read-only (ISO77), belt insert_at residual (ISO77, accepted loss), get_capacity targeting (ISO77).