Build the native Lua bridge and migrate the first Actions window slice

Closure: user confirmed production deployment and accepted closure. Historical validation notes and unchecked platform/live-interaction checklist below are retained; no independently rerun checks are claimed. Outcome: the built-in Actions window is the first real XML/Lua-authored UI feature, using the same explicit native capabilities intended for player packages. Replace, do not retain a parallel C# presentation implementation when the feature migrates. Worktree /home/mathias/Projects/worktrees/engines-client-lua-actions; branch feature/client-lua-actions; base develop at 0c14da4f3. Original checkout and other experiment worktrees remain untouched. Do not commit without permission. Agreed decisions: standard native Lua5.4 with our own small Native-AOT-safe bridge; retain XML as optional structure/templates; Lua owns presentation/composition/UI state, C# owns authoritative game knowledge, information content and validated commands. Preserve current gameplay and wire behavior. Generous runaway safeguards, not a limits-tuning project: bounded Lua heap, high host-object ceilings (~10k widgets), bounded queued work and native execution interruption. Independent Lua states per package; coroutines share a package budget. No reflection-based arbitrary CLR exposure or IO/OS/debug/native loading access. Critical boundary invariant: all fallible Lua API work and Lua errors/OOM/yield must stay inside native protected execution. Managed callbacks may implement typed host capabilities but must never call Lua APIs or let managed exceptions escape; native code pushes any results/raises errors only after the managed callback has returned. Runtime and widget lifecycle are single-UI-thread-owned with deterministic teardown and no process-global mutable VM state. Review/reproduce this invariant under allocation failure, bad arguments, callback failure and runaway loops before claiming the bridge safe. Reuse: existing retained GuiView/XML/layout/input/rendering, window lifecycle, icon-grid resizing, item presentation/info services, SpecialActionController availability and native execution. Existing Actions behavior includes special+perk actions, cooldown/unsupported state, icon/tooltips, resizing/empty padding, inspection and hotbar integration. Native shim must be generic, not know about Actions. Presentation should be package-owned; any temporary native window-factory/lifecycle integration must be explicitly identified. Acceptance: native source build/package with pinned Lua source+licenses; explicit managed bindings work with trimming/NativeAOT; Lua owns Actions content creation/reconciliation/events using XML; ordinary/perk commands remain validated natively; existing inspection/hotbar/cooldown/window behavior is preserved; widget/VM resources and callbacks are released on failure/disposal; meaningful red/green regression and native failure-containment tests pass; Linux executable AOT proof passes and untested Windows/macOS release requirements remain explicit. No broad addon manager, marketplace, live reload framework, other-window migration or benchmark subsystem in this slice. Evidence carried forward: PRK.Client/TestSupport/LuaAotProbe in chore/client-lua-aot-validation demonstrated both runtime paths under Linux NativeAOT, native Lua5.4 ~1.7–2.6x faster for Lua-heavy kernels. Do not import that experimental managed-interpreter dependency into production. Native error/OOM boundary and actual platform packaging remain to be implemented here. Current phase: user accepted measured bridge costs, prioritizing safety and avoiding managed allocation. Bridge checkpoint committed first as requested:8b35889a7 (feature: Add protected native Lua UI bridge and validation). Actions migration and Lua list mode are now committed as9539b880c (feature: Move Actions presentation to XML and Lua), pushed to origin/feature/client-lua-actions, and open for team feedback in draft/WIP PR https://git.project-rk.com/prk/engines/pulls/2797 against develop. User explicitly requested opening the WIP PR, authorizing the needed commit/push. Keep in_progress while feedback/platform/live-interaction checks remain. Old ActionsPresenter and old Actions/ActionSlot layouts removed; CharacterInterface uses ScriptedActionsWindow. Generic owned LuaWidgetHost, bounded LuaUiPackage asset loader, native ActionPresentationSource and shipped Core/Actions XML+Lua now drive the real feature. Native window chrome/icon-grid sizing are explicitly reused shared backends; content reconciliation, slot creation, click binding, visual/cooldown state and tooltip fallback formatting are Lua-owned. Verified milestone: existing special/perk tests plus new scripted behavior cases:32 passed/1 install-dependent skip; observed initial red due Lua prototype global clearing then fixed with module-local prototype. New cases exercise real input/one-bound-action-per-click, reject snapshot-driven execution, release stale handlers/tree on script faults, and verify zero managed allocations for1000 unchanged snapshot updates. Native bridge Release7/7 and sanitized7/7 still pass. Published headless ScriptedActionsSmoke now passes actual XML/layout/input, special+perk dispatch, info/hotbar identity, cooldown, padding, unchanged-update allocation invariant and teardown under NativeAOT without new suppressions. AOT smoke initially referenced the full client and hit its pre-existing Silk.NET IL2072/IL3000/IL3002 warnings. Instead of suppressing them, separated existing DTO records into UI/ActionSnapshots.cs, UI/InventoryItemPresentation.cs and SessionState/PerkActionGrant.cs and source-linked exact production component files into ScriptedActionsSmoke, with normal GraphicsEngine/ClientScripting/Common.Enums references. This is a headless component proof, not a full-client publish claim. Full client retains existing production Silk policy. Current checkpoint: Linux Actions implementation and relevant validation are complete. User has now run the new Actions window and reports no real visible difference from the old window, accepting visual parity as a successful first-slice outcome. Final integration review, native Windows/macOS execution and detailed real-client interaction acceptance remain outstanding; visual confirmation alone does not establish resize/inspection/hotbar/zoning coverage. Keep task in_progress for those checks, not for bridge micro-optimization. Bridge checkpoint8b35889a7 and Actions/list implementation9539b880c are committed and pushed. Worktree is clean; PR2797 is explicitly draft/not mergeable until marked ready. Do not accidentally include the other worktrees or private tracker metadata in commits. New component paths: UI/Scripting/LuaUiPackage.cs (bounded package files/XML preflight), LuaWidgetHost.cs (owned widgets/handlers,10k widget ceiling,64MiB retained text,128-level XML and dynamic-tree depth guard, cycle/stale-handle checks, deterministic cleanup), ActionPresentationSource.cs (native data/facts/resources/commands); UI/Windows/ScriptedActionsWindow.cs (native lifecycle/data adapter, no C# slot-building); UI/Packages/Core/ui.lua; UI/Packages/Actions/{package.xml,window.xml,slot.xml,action_button.lua,main.lua}. DTOs split into UI/ActionSnapshots.cs, UI/InventoryItemPresentation.cs, SessionState/PerkActionGrant.cs without changing their public contracts. Existing WindowFactory/WindowManager/IconGridWindowSizing remain shared native backends deliberately. Generic programmatic widget construction/style APIs, external art packs, discovery/reload and other-window migrations are not implemented; docs flag these limits. Safety/gameplay: actual enabled/visible view activation captures its native binding. Exactly one matching command can consume that activation; initialization/snapshot-driven/saved-handler calls cannot authorize commands or rebind mid-handler to execute another action. Existing SpecialActionController remains authoritative. Native metadata backs inspection/hotbar identity and unavailable reason; rendered tooltip strings no longer determine facts. Unchanged source snapshots and unchanged resize capacities are gated without entering Lua. Script exceptions/budget/host faults clear handlers/icons/tree and render a diagnostic, never revive old C# presentation. Borrowed icon resources remain owned by shared presentation caches. Verified final commands/results: - ./run-client-tests.sh --filter 'FullyQualifiedName~ScriptedActionsTests|FullyQualifiedName~SpecialActionTests|FullyQualifiedName~PerkActionTests|FullyQualifiedName~UiWindow|FullyQualifiedName~Shortcut|FullyQualifiedName~ItemTooltip' -p:TreatWarningsAsErrors=true -p:WarningsNotAsErrors=NU1903 =>87 passed/1 RequiresInstall skip. ScriptedActionsTests cover actual input provenance/one command, zero allocations for1000 unchanged updates, removed-handler cleanup, fault diagnostics, widget/text/nesting runaway refusal and release/recovery. - GraphicsEngine suite =>703 passed/1 skip. - ./run-client-lua-tests.sh =>7/7 native Release,7/7 ASan+UBSan, bridge NativeAOT smoke and actual Actions NativeAOT smoke pass. No new warning suppressions. - Full client suite with complete install mounted as /game and PRK_GUIROOT=/game/cd_image/gui/Default =>3972 passed/161 skipped/1 failed. Failure is exactly pre-existing ALostConnectionDuringAnAreaChangeEndsTheSessionAtOnce already reproduced on unchanged base during research; not disabled or changed. - Actual whole client Release linux-x64 AOT publish with warnings-as-errors, production dev flags disabled, native Lua package, and freshly built native audio package succeeded. Existing production Silk NoWarn policy unchanged. Verified native lib, every Lua/XML package file and canonical Lua notice in output. Missing-Lua-package msbuild target negative control fails with expected required-package error. - Shell syntax, Lua syntax, workflow YAML parsing and git diff whitespace checks pass. Automated validation was headless. User subsequently reported the live new Actions window is visually indistinguishable from the old one; platform and individual interaction checks were not specified. Packaging: NativeLua/Package.props shares RID/library/path resolution; ClientScripting copies native lib plus canonical source notice (avoids duplicate notice publish paths), client refuses publishing without target Lua library/notice. prepare-client-lua.sh builds in compiler container and copies package to default RID path; Linux dev/test/publish scripts call it. Windows launcher and CI/release matrix build/test native package; CI/release add bridge and actual UI AOT smoke. Windows/macOS recipes edited but not executed. Client solution adds scripting project with only existing Any CPU configs retained (dotnet-sln's unrelated platform churn removed). UI/Packages/README.md, NativeLua/README.md and UI_XML.md document ownership/API/migration limits. Full-client publish reproduction: dotnet publish PRK.Client/PRK.Client/PRK.Client.csproj -c Release -r linux-x64 -p:EnableDevClient=false -p:TreatWarningsAsErrors=true -p:WarningsNotAsErrors=NU1903 -p:PrkLuaNativeDirectory=/src/.dev-data/native-lua/container/linux-x64/package -p:PrkAudioNativeDirectory=/src/.dev-data/native-audio/gcc-linux-x64/package -o /src/.dev-data/native-lua/client-aot (inside compiler container mounted at/src). Audio prerequisite required fresh build because old artifact patch/license layout differed. Clang18 C++ modules hit an unrelated upstream OpenAL issue; faithful source build succeeded using existing prk-client-sdk:10.0-native GCC/Unix Makefiles toolchain, no audio source changes and no fake/relabelled package. Its package is in .dev-data/native-audio/gcc-linux-x64/package. No extra audio-only tooling retained in Lua Dockerfile. Durable evidence: .dev-data/native-lua/actions-validation/ contains final targeted, graphics, native/AOT, full-suite, whole-client-publish and missing-package-control logs. AOT component output .dev-data/native-lua/container/actions-aot-linux-x64; full client .dev-data/native-lua/client-aot. Initial real Actions tests were observed red due a Lua prototype global being cleared, then fixed with module-local prototype capture; no regression test disabled. Implemented paths: - PRK.Client/NativeLua/{prk_lua.h,prk_lua.c,CMakeLists.txt,tests.c,Dockerfile.tests,README.md}: SHA256-pinned Lua5.4.8, hidden raw Lua symbols, explicit ABI/scalar host calls and flat snapshot trees, per-state tracked allocator, native-only protected execution and hard instruction bailout. Native package contains libprk_ui_lua + Lua MIT notice; source license in PRK.Client/Licenses/LICENSE.Lua.txt. - PRK.Client/PRK.ClientScripting/: dependency-free net10 IsAotCompatible library using LibraryImport/UnmanagedCallersOnly, ILuaHost, reusable LuaArguments, failure values, single-thread ownership, managed exception barrier, deferred callback release, package/generation-scoped LuaCallback tokens, deterministic host disposal and SafeHandle native cleanup. Raw Lua state pointers never reach C#. Context GCHandle is weak; no permanent native->managed owner root. - PRK.Client/TestSupport/NativeLuaSmoke/: actual AOT consumer exercising managed/native failures, not the prior KeraLua benchmark. No production interpreter NuGet dependency added. - run-client-lua-tests.sh: compiler-container native Release + ASan/UBSan + full-trimmed AOT smoke; root native README documents ABI/lifecycle/current limits. Important design invariant now implemented: native heap allocations are tracked in an arena. An instruction-hook bailout returns directly to the native bridge entry, permanently faults the VM, and the arena is discarded without lua_close. Package teardown does NOT execute script __gc/__close handlers. No managed callback is active at bailout. This avoids catchable-pcall budget escapes and hostile finalizers during disposal. The merge-readiness correction now refuses script-defined __gc registration even during execution because Lua disables instruction hooks in automatic GC finalizers; normal __close remains budgeted. External resources must be host-owned and deterministically disposed. Arbitrary native Lua modules / native userdata needing finalizers are unsupported; any future extension must re-prove this arena-abandonment invariant. No IO/OS/debug/package/dynamic loading exposed. Host functions must be bounded/nonblocking; hooks are not preemptive limits for C#/single native library operations. Generous foundation limits: Lua heap64MiB incl tracking headers;10m instructions per entry;100k live+pending callbacks;100k transfer nodes;16MiB transfer text/source;16 host args;64KiB reply. LuaWidgetHost now enforces widget count, retained text and tree-depth budgets. Exhaustive renderer/GPU/font-cache and multi-addon aggregate budgets are not implemented. A widget count alone is insufficient: repeated copies of one large Lua string into many C# widgets could otherwise evade Lua's heap limit. Keep widget/resource limits generous, do not turn them into a tuning project. Verified command: ./run-client-lua-tests.sh (from this worktree). Result:7/7 native Release groups,7/7 ASan+UBSan groups, published Linux NativeAOT smoke all pass with dynamic code=False and no AOT/trim warning suppression. Smoke covers structured UTF8 snapshots, scoped callbacks, replacement/refusal cleanup, source diagnostics, wrong-thread/reentry/dispose refusal, contained OOM AFTER a managed callback's finally completed, native budget termination through pcall/coroutines/__close, fault cleanup, other-package usability, and collection of30 disposed owners. Clang static analysis emitted no findings; nm confirms only prk_lua_* entrypoints exported. Logs and mutation-control results in .dev-data/native-lua/validation/. First Docker sanitizer link failed due missing Clang runtime; Dockerfile now installs libclang-rt-dev and the full runner passes. Regression/control evidence: repeated callback rebinding was observed failing with raw registry IDs (old callback became callable after Lua recycled the ID), then passed with package/generation tokens; cross-package callback invocation is rejected. Isolated mutation copies removing allocator budget fail lua_memory; disabling count hooks times out lua_budgets at5s. No guard/test disabled in actual implementation. The foundation-stage checks did not claim a whole-client run. Subsequent full-suite/publish outcomes are recorded above, including the unrelated baseline failure. User visual parity is now confirmed; Windows/macOS/arm64 execution and detailed live interactions remain unverified. Boundary-performance checkpoint (user explicitly requested real measurements): - Added isolated PRK.Client/TestSupport/LuaBoundaryBench/{LuaBoundaryBench.csproj,Program.cs,Workload.cs,Engines.cs,measure.py,README.md}. Actual protected bridge is tested, not the prior LuaCSharp experiment. KeraLua1.4.11 exists only in this benchmark project. No production bridge source or safeguard changed. - Clean full-trimmed warnings-as-errors Release Native AOT publish, dynamic code disabled. i7-12700KF/Linux x64 pinned CPU0;5 fresh processes per case/engine, one full warmup and3 timed samples each; rotate order, validate totals/call counts/UTF8/final real GuiView.Text/snapshot fields outside timing. Seven cases, real bridge+KeraLua+direct C# and two native-copy controls=525 recorded samples. All checks passed. Native allocation totals unmeasured; managed allocation figures are separate from live native heap snapshots. - Current medians: Lua->C# integer884.399ns vsKera36.979ns; borrowed UTF8 echo921.485ns vs157.521ns; actual handle+GuiView.Text933.091ns vs109.244ns. C#->Lua cached empty224.852ns vs22.486ns; integer231.664ns vs29.451ns. Fresh100-record snapshot incl encoding/table creation/Lua consumption40.062us vs40.232us; managed bytes0 vs5600 per snapshot. Scalar/callback paths0 managed bytes; UTF8 echo0 vs172; decoded widget text60 vs116. - Causal control1 in ignored .dev-data/native-lua/boundary-control: same executable/compiler/source except disable full64KiB reply-array initialization, initializing only first byte. Integer host call drops884ns->65ns; UTF8 echo921ns->92ns; widget933ns->138ns. NOT safe to copy into production: a host claiming unwritten string bytes could expose native stack contents. Need a sound initialized/reused per-owner reply storage or tracked writer contract, then fault/ownership tests. - Causal control2 .dev-data/native-lua/boundary-hook-control: same native source except count-hook mask0. No-host Lua integer loop falls7.737ns/iteration->3.587ns (Kera3.771ns). Guard cost applies even without boundary traffic. Do NOT disable the hook as a production fix; any cheaper interruption mechanism must preserve uncatchable budget/OOM/finalizer containment. - C#->Lua ~0.23us call cost remains mostly unchanged by reply-clear control; fresh worker-thread creation/registry/protected setup are source-backed candidates, NOT causally isolated measurements yet. No worker pooling/reset optimization applied. - Reproduction: build ./run-client-lua-tests.sh first, publish benchmark with explicit PrkLuaNativeDirectory pointing at .dev-data/native-lua/container/linux-x64/package, then python3 .../LuaBoundaryBench/measure.py <published executable> <output> --cpu 0 --processes 5. Detailed exact commands, tables, safety differences and control descriptions are in benchmark README. Logs/binary+library hashes/platform/results in .dev-data/native-lua/boundary-results/profiled/summary.json and adjacent logs; initial/pinned campaigns retained. Normal native7/7, sanitized7/7 and actual AOT smoke rerun after profiling: all pass. Production still has full reply clearing and LUA_MASKCOUNT. - Interpretation: current bridge is correctness-first and is NOT yet an optimized boundary implementation. Kera control lacks equivalent quotas/ownership/error containment; direct controls are lower bounds. Earlier Kera/LuaCSharp/native-heavy results must not be reused as performance evidence for this guarded implementation. No whole-client/frame-time or other-platform claim. Requested extension completed: Actions list mode is a Lua/XML customization proof. Standard title-icon toggle, free list sizing, persistent mode/sort, real row/header/icon/text input, name/cooldown sorting, native identity/activation, and return-to-grid work. Added presentation.lua, action_row.lua and row.xml; bounded ui.publish state plus deferred native notifications adapts existing view/table persistence without native C# list rows. Fixed columns and non-locale-aware name comparison are documented gaps. Baseline image primitive limitation exposed: plain BitmapView does not render assigned Bitmap; reused frame-free non-interactive ItemSlotView for row icons. No renderer workaround or native list presenter added. Verified list-specific milestone: new list behavior/persistence tests observed red with missing Lua entrypoints then green; targeted broad finalrun96 passed/1 install-dependent skip. 42 passed/1skip in narrower list/scripted/action/persistence run before final broad rerun. Native7/7 +ASan/UBSan7/7 and published actual component AOT smoke (now includes list/sort/grid return) pass. Headless synthetic list render and icon pixels verified; PNG inspected at .dev-data/test-results/client/Deploy_ 20261021T065540_150/In/lua-actions-list.png. Generic state feedback-loop containment regression passes; game activation is cleared before native state observers run. Full client Linux publish was verified for the initial slice; latest list has component AOT coverage, not a newly claimed full-client publish. WIP publication milestone: fetched origin/develop atcdb60df9c, read-only merge-tree against HEAD succeeded without conflicts. This is not a test run of the merged result; branch tests run on the feature tree. Two commits8b35889a7 and9539b880c pushed; draftPR2797 explicitly lists pending Windows/macOS/live checks, baseline network failure, safety boundaries and performance costs. No private tracking metadata in PR/repository/commit content. Source/assets, shell syntax, workflow YAML parse and whitespace checks pass. User asked feedback, not merge; do not mark ready/merge without further instruction. Original extension design context: Reuse the existing title-icon List Mode menu, native shared sizing and UiListViewPersistence. Lua owns row composition, mode state, sorting, cooldown labels and bindings; C# only adapts Lua-published state to existing window/persistence interfaces. Keep the same native action facts/command validation and bridge safeguards. Add generic bounded package-state publication with notifications deferred until native Lua execution returns, not a C# Actions list presenter. Plan list columns for icon/name/readiness, clickable sort headers, preserved inspect/hotbar/activation behavior and restore to grid. Fixed columns are acceptable for this proof; do not claim drag-resizable columns if unsupported. Existing uncommitted Actions changes are related and intentionally retained; no commit requested in this extension. Cleanup requested after WIP feedback: committed and pushed as fd1e15323 (refactor: Organize AOT tests and trim Lua UI documentation) under user's explicit "push it" request. Worktree clean; draftPR2797 updated with renamed test entrypoints and benchmark link removed, preserving the user's shortened PR description and draft status. - Slimmed UI/Packages/README.md from1285 to457 words (105->55 lines), NativeLua/README.md from1520 to382 words (105->37 lines). Kept build/API/ownership/abort rules and current limits; removed validation diary, repeated caveats and benchmark narrative. Writing skill applied; repository docs remain Markdown as required for READMEs. - Removed tracked TestSupport/LuaBoundaryBench and its KeraLua dependency from current tree. Full source, adjusted local project references, existing binaries and results preserved in ignored .dev-data/research/lua-boundary-bench and .dev-data/native-lua/. This removes it from net PR diff once cleanup is committed; old published commits still contain history, no force-push/rewrite performed. - Renamed/moved real AOT acceptance executables out of TestSupport: PRK.Client/PRK.ClientScripting.AotTests/PRK.ClientScripting.AotTests.csproj and PRK.Client/PRK.Client.UI.AotTests/PRK.Client.UI.AotTests.csproj. Updated namespaces, diagnostic source names, friend assembly, relative production source links, runner and Linux/Windows/macOS CI/release executable paths. No changed runtime behavior and no safety tests removed. Existing unrelated shared TestSupport fixtures left alone. - ./run-client-lua-tests.sh passed after rename:7/7 native Release,7/7 ASan+UBSan, both published Native AOT test executables with dynamic code disabled. YAML/shell syntax, project references and git whitespace checks pass. No remaining tracked references to old test project names or LuaBoundaryBench/KeraLua in client/added workflows; unrelated existing uses of the word remain untouched. - Cleanup commit fd1e15323 is on origin/feature/client-lua-actions and PR2797 remains draft. PR entrypoints now reference PRK.ClientScripting.AotTests and PRK.Client.UI.AotTests; deleted benchmark link and old naming removed. README/test relocation validation log remains /tmp/prk-lua-cleanup-aot.log. No additional tests rerun for the commit-only push; previously verified native Release/sanitizer and both renamed AOT executables passed. Original checkout remains untouched. Merge-readiness correction IMPLEMENTED, VERIFIED AND PUSHED with explicit user permission as6045f8f02 (fix: Contain Lua finalizers and widget lifecycle failures), updating existing draftPR2797. No merge requested or performed. Remote feature branch was rebased to014484034, six commits above origin/develop c8ecd6e33. Isolated worktree /home/mathias/Projects/worktrees/engines-client-lua-readiness on fix/client-lua-merge-readiness tracks actual origin/feature/client-lua-actions. Readiness worktree clean at6045f8f02; committed on fix/client-lua-merge-readiness and fast-forward-pushed HEAD to origin/feature/client-lua-actions after confirming remote remained014484034. Original checkout and obsolete old Lua worktree untouched; do not push the old worktree history. Validation preceded this commit-only push; no remote CI success claimed. Resolved three reviewed findings. Native initialize wraps the ORIGINAL base setmetatable in a private C closure and rejects any non-nil raw __gc field before registration; delegates normal checks, returns, nil removal and protected-metatable behavior to Lua. Original setter is inaccessible without debug/upvalue access, which is not exposed. Normal prototypes and budgeted __close continue to work. Mutating a metatable to add __gc after initial assignment does not mark the object for finalization; subsequent attachment is refused. Verified against fetched pinned Lua lgc.c (GCTM disables allowhook; luaC_checkfinalizer marks only on registration). No vendor source patch, arbitrary native modules/userdata or managed stack unwind introduced. Arena-only disposal and other safety limits unchanged. ui.add now detaches the child with the existing RemoveChild operation AFTER all ownership/root/cycle/depth checks, then AddChild attaches it. Existing node/callback/binding/resource budget ownership is retained. Invalid manifest InvalidDataException now goes through ScriptedActionsWindow.Fail and deterministic disposal/diagnostic rather than escaping interface initialization. README native/package restrictions updated to explicitly refuse __gc registration. Observed red before fixes: native lua_finalizers timed out under CTest external5s watchdog on automatic allocation-triggered hostile GC; reparenting regression terminally faulted the package; three invalid manifest cases threw from constructor. Added native checks for direct finalizer registration, non-function __gc, reused/mutated metatables and ordinary/protected/nil-removal semantics. Updated earlier teardown fixtures to use a harmless unregistered late-added __gc field, rather than requiring forbidden registration. UI regression moves an XML subtree repeatedly, checks cycle/root refusals, identity, real-click action callback and explicit subtree destruction. Actual source-linked UI AOT test also moves a freshly loaded fragment and contains three bad manifest forms. Bridge AOT exercises finalizer refusal after a completed managed callback, host disposal and zero remaining native memory. Verified on rebased head plus fixes: ./run-client-lua-tests.sh =>8/8 Release,8/8 ASan/UBSan, generator self-tests, both Linux x64 NativeAOT executables pass (incl finalizer refusal, package diagnostics, input/identities/list/grid/sort, zero-allocation unchanged updates). Broad targeted UI100 passed/1 install-dependent skip. FULL client suite3990 passed/180 skipped/0 failed,8s; no game installation/native audio assets mounted, so skipped acceptance remains explicit. Old ClientSessionBoundaryTests failure did not recur in this current-head run; do not carry old baseline classification forward as a current failure. Clang --analyze with warnings-as-errors exits0/no findings; git diff --check clean. No Windows/macOS execution, detailed live-GUI or new whole-client AOT publish claimed. Evidence under .dev-data/lua-readiness/: native-red.log (timeout), ui-red.log (4 failures), native-aot-green.log, ui-green.log, full-client.log, native-analysis.log. Both AOT artifacts under .dev-data/native-lua/container/. Material findings corrected; platform/live checks remain separate release gates. No automatic merge or ready-state change. Next execution plan: 0. Lua list mode implemented, tested, documented and included in draftPR2797; do not re-implement it. 1. Review the current Actions integration patch against bridge checkpoint8b35889a7; resolve material correctness/security/lifecycle issues. The native arena-abandonment and no-managed-unwind invariants must remain intact. Do not apply unsafe performance-control changes. 2. Run native Windows/macOS CI/release smoke executions and verify real-client Actions interactions/appearance, especially resize, Shift-inspect, hotbar dragging, tooltip suppression and zoning/session lifecycle. Linux proof does not certify these platforms or live behavior. 3. Actions implementation is now committed/pushed under the user's WIP PR request. Process feedback on draftPR2797; do not mark ready or merge without instruction. Do not mark shipped/platform-ready until remaining substantive checks are resolved. Keep scope on the first slice; no addon framework expansion or micro-call tuning unless requested. Bridge foundation and validation committed as 8b35889a7 in feature/client-lua-actions. Actions/list implementation is a separate commit9539b880c, both commits included in draftPR2797. Original checkout and previous validation/flat-UI worktrees remain untouched. This task stays in_progress until real Actions integration and its acceptance validation finish; update the current-phase handoff at each meaningful continuation.