Bunny Mark original review — 2026-09-12

Assistant review of baseline 7601c55, retained before fixes. Scope: source, pure subsystem tests and offline eval; no engine process or visual inspection. User request: “Review the other evals as well, fix when needed.”

• B1 — blocker: the native per-node arm draws no bunnies. project/main.gd:223–238 instantiates bare Bunny objects; the authored base is Node2D (declarations/bunny.odin:27), with no drawing operation, texture, or Sprite2D child. The arm can PASS while rendering an empty play area. Correction must use the same textured geometry and scales as the other arms, and the runtime gate must inspect actual drawable instances.
• B2 — blocker: the comparison changes the workload. The staged arm uses a different PRNG (subsystem/bunny.odin:115–140 versus project/gd_bunnies.gd:42–55) and folds an ever-accelerating gravity parabola (subsystem/bunny.odin:216–233) instead of integrating gravity after elastic bounces. Folding gravity reverses acceleration on alternate intervals; it is not the same physical bounce claimed in README. GD also scales both velocity components (gd_bunnies.gd:75), while native scales only x (bunny.odin:143–144). The staged 14×14 quad differs from the sprite's natural dimensions. Use common seeded identities, geometry and explicit step rules; check all modes against the same replay state outside timing.
• B3 — should-fix: the producer and oracle bypass simulation state. field_write_layout regenerates parameters and positions instead of reading the SoA (subsystem/bunny.odin:314–323), and oracle_instance calls the same writers (333–347). Incorrect x/y updates do not affect the submitted layout or its oracle. Every frame also repeats hashing/trigonometry and trajectory calculation. Pack real retained simulation state and compare it with an independent reference integrator; include corruption rejection.
• B4 — should-fix: destruction reads freed memory. field_destroy frees its own Field (subsystem/bunny.odin:201–209), but its comment promises safe repeated destruction and the test invokes it twice (subsystem/bunny_test.odin:280–286). The second field.live read is a use after free. Clear the owning pointer and test repeated owner cleanup safely.
• B5 — should-fix: setup failure and ordinary exit leak staging. bunny_field_setup:144–145 returns after population allocation failure without retiring the newly created local staging owner. Earlier failures after the retained get_multimesh result can skip release (110–121). main.gd has no exit cleanup; only successful field eval explicitly calls shutdown (142), while deinit deliberately cannot free staging (bunny_field.odin:63–73). Cover acquisition rollback and every scene exit with symmetric cleanup.
• B6 — should-fix: resize rollback and state claims are false. bunny_field_set_count:255–279 reallocates server storage before retiring the old owner. Its “resize undone” error branch does not undo server allocation, and the new population starts at frame zero without resetting submitted-frame state. Retain new owners immediately, make failures explicit, and expose consistent post-resize count/frame/verification state.
• B7 — should-fix: errors and controls can leave a lying UI. main.gd:218,236–238,265,286,289 discard native error results. Switching to a newly set-up field resets its profile to canonical without applying current sliders (210–220). Returning sliders to canonical labels the old mixed history oracle-verifiable (303), although native verify returns -30. The interactive staged arm advances 1/60 per display frame while others use delta. Check calls, apply active settings on transitions, label actual verification applicability, and use a common simulation clock.
• B8 — should-fix: eval automatically overwrites failed historical evidence. test.sh:49–50 compares then always writes the tracked receipt. A mismatch merely prints DIFFER and exits zero (eval/main.odin:228–235); section matching searches the entire text (238–243). Invalid flags/numbers are silently ignored or clamped (38–49), production return values are dropped (99–110), and PASS precedes comparison. Preserve the receipt, reject bad arguments and failures, assert deterministic replay and workload-matched digest equality.
• B9 — should-fix: runtime campaign does not gate the claimed ownership or visible workload. test.sh:95 suppresses import failure and 119–120 checks only a workload sentinel, not engine diagnostics or zero-owner Host shutdown. No timeout, one-process guard or durable per-run provenance exists. The timed bracket excludes native no-op _process dispatch and engine rendering; README calls costs flat in count (CPU or GPU), while the recorded data grows ~10×. Retain runtime logs, reject errors/leaks, measure actual frame intervals separately from driver CPU, and bound claims to the measured workload.
• B10 — should-fix: unearned reload and verification claims. README's reload journey claims stored-property restoration although these authored structs declare no stored Godot properties and no reload workload runs. The field's oracle compares float equality, not the promised bitwise equality. State the actual non-reloading demo contract and execute any claimed byte-level checks.

Baseline evidence: pinned Odin test .../subsystem -o:speed completed 12 tests successfully. Read-only odin run .../eval -o:speed -- --count=10000 --frames=1200 printed EVAL_PASS and RECEIPT_MATCH (26.910 / 327.548 µs average producer time). These results did not establish comparative or visible correctness. An Address Sanitizer test build failed to link ___asan_version_mismatch_check_v8; no ASAN runtime result is claimed. Exact dev5 source archive spot-check confirmed the eight-float 2D layout and getter mapping at the cited mesh_storage.cpp lines. The buffer submission code extends past line 2161; the caller-consumption claim requires following buffer_update, not inferring lifetime from its name.