feat!: deliver runtime v2 and world-first Live simulation

[jBernavaPrah]

Purpose

Deliver world-first Live simulation together with the supervisor-backed runtime bootstrap and monotonic scheduling foundation.
This is one breaking implementation train, not two independently releasable changes.

• Add canonical world authoring, deterministic WorldBundle assets and provenance, shared geometry, and a complete robot simulation plan.
• Preserve each execution's monotonic timeline during attachment, pause, resume, and late join.
• Publish passive StepEvent progress through existing bounded delivery lanes with transition-correlated monotonic timestamps.
• Add transactional supervisor attachment and typed world/member lifecycle and retained evidence.
• Move Webots native generation into exact-train framework host, world-controller, and robot-controller packages.
• Support zero or multiple independently supervised robots, dynamic attachment, cooperative removal, and classified shared-world failure.
• Remove the superseded world-clock and readiness/permit paths while retaining generic runtime timeline-replacement capability.
• Publish alternate-registry packages in dependency order, verifying staged dependent archives before one atomic registry append.

Important boundaries

Live supports Webots R2025a and native REAL_TIME only.
Physics progress is not execution time and never gates service or brain scheduling.
There is no accelerated mode, profile selector, participant acknowledgement, public advance endpoint, or Lockstep implementation.
Native controller binaries are not supported on musl or Linux aarch64 in this release.
OBJ support is a conservative robot-mesh subset; authored world meshes remain self-contained GLB.

The exported contract is breaking relative to 0.67.1 and requires 0.68.0 or later.
The existing managed 0.67.2 release proposal is not the release vehicle for this implementation as currently generated.
Do not publish a bootstrap-only intermediate train.

Validation

• Workspace all-feature/all-target tests and compile-contract suite passed during implementation.
• Latest core library run: 604 tests passed, including real execution-router loss and attachment-observer regression coverage.
• Latest native package runs: 77 host library tests, 4 host binary tests, 11 robot-controller tests, and 3 world-controller tests passed; the explicitly ignored native renderer test was also run successfully on R2025a.
• Framework CI passed on ae7affeaaac984e9d6ba7c0dcd38f85e27a6a8c4, including the Linux native renderer, full workspace tests, and canonical consumer-profile matrix.
• Formatting, Clippy with warnings denied, strict rustdoc, repository policy checks, dependency checks, and compatibility reporting passed.
• Registry package ordering: 3 Python tests passed.
• Compatibility reporting identifies the breaking pre-1.0 train while preserving the frozen bootstrap boundary.

Local native evidence, not released-artifact acceptance

Using one coherent local owner checkout on macOS arm64 with R2025a and disposable robot-model copies with test brains:

• Headless zero-robot start, exact-ID world TUI reopen, compositional run, detach, discovery, and robot reattachment passed.
• Two independently supervised robots attached at different spawns, including attachment after world progress had begun.
• Native GUI acceptance verified both robot bodies, wheels, materials, and primitive/GLB fixtures at distinct spawns; the original no-op brain's staged hash matched its isolated build.
• Pause/resume retained monotonic execution timelines; a deliberately slow brain continued with monotonic missed ticks without gating native progress.
• A distinct 100 Hz service with a 200 ms invocation reported ordinary missed ticks of 19/20 while physics advanced, then continued its monotonic invocations while world progress remained paused.
• Suspending the test execution's drive service while paused let both motor leases expire; the first resumed transition retained Expired, no selected command, and applied Stop for both motors.
• Confirmed robot stop isolated that member while the world and other robot continued.
• Hard supervisor loss isolated the responsive robot and retained SupervisorLost with complete cleanup.
• Disabling a native accelerometer axis produced a non-finite IMU reading and the real controller-local Device fault path; that robot parked and was removed with ControllerFault and complete cleanup while the other robot and physics continued.
• A 959-post world with a 1 ms physics quantum and two robots reported about 0.43x observed pacing in native REAL_TIME, while a slow service kept its monotonic schedule.
• Briefly suspending one execution router in that world produced permitted sample eviction, then StepEvent returned WouldBlock at the existing 16 MiB byte bound; native progress continued until the typed controller fault, the router was resumed immediately, and member removal completed without ending the other robot or world.
• A disposable drive probe sent nonzero commands on delegated driver readiness with no Active revision; the first 25 native transitions applied typed Missing/Stop to both motors, then fresh revision-2 commands were selected at transition 26.
  All 102 actuation records from the bounded run were retained without drops.
• Hard synchronized robot-controller loss failed the world as ControllerLost, retained member ControllerFault, and reported unavailable isolation as incomplete cleanup instead of claiming recovery.
• Host, Webots, and world-controller loss produced typed terminal evidence and native-tree cleanup.
• Selecting the actual Webots Fast control failed a zero-robot world as UnsupportedNativeMode, named the observed Fast mode, retained terminal evidence, and removed native processes.
  Cleanup correctly recorded the missing controller stop acknowledgement after the fatal exit.
• Confirmed world stop retained complete world/member terminal evidence and removed native processes and live registration.
• Primitive and GLB visuals with implicit and explicit collision loaded natively; initial visual acceptance verified corrected lighting and camera orientation.

Host-discovered startup, paused import, sensor anchoring, orderly removal, park acknowledgement, authority loss, and terminal classification defects have regression tests and native reruns.

Review and publication boundary

The local implementation, native visual, command-admission, transport-saturation, pacing, and cooperative recovery evidence are ready for review.
Real multi-artifact compatibility cases and the full published-artifact workflow remain required after the coordinated owner train is available.
An earlier, longer router suspension ended as RemovalFailed; the bounded 1 ms-world retry above separately proved WouldBlock, cooperative parking, complete member cleanup, and continued peer progress.
Artifact inspection found shared Cargo target reuse between disposable test projects, so these runs are not claimed as unmodified-brain acceptance.
Their project compilation caches were isolated before repeating that case.
The repeated compositional run now verifies the original no-op brain: its staged SHA-256 matches the fresh isolated build, neither slow-probe marker is present, q leaves the execution and world live, native REAL_TIME advancement succeeds, and confirmed world stop plus deferred robot cleanup complete successfully.
This is still a local-owner overlay, not published-artifact acceptance.

Review and merge this owner only under the normal human review and CI gates, then publish the complete breaking train.
The dependent CLI must refresh real dependency pins and lockfiles to that published owner and repeat the released workflow before consumer merge/publication and migration-repository retirement.

[jBernavaPrah]

Follow-up corrections on this PR: transaction-owned host SIGTERM now uses orderly world cleanup and retains WorldStopped/Complete in native rollback proof; native parsing now depends directly on webots-proto-ast, removing unused JavaScript/template/resolver dependencies and their fast-float advisory chain; tracked-source policy, Rust 1.98 chunk-iteration lints, and profile-specific rustdoc have been corrected. Native package tests pass locally (76 + 4 + 11 + 3), all 17 policy rules pass, and strict rustdoc passes across the five explicit host/authoring profile combinations. Linux CI is rerunning. The existing Zenoh lz4_flex advisory is not claimed as resolved. Remaining native and published-artifact acceptance gates in the PR body still apply.

[jBernavaPrah]

Linux CI follow-up: workspace policy and Clippy now pass. The renderer diagnostic identified missing libEGL.so.1 on the runner, rather than a version mismatch. The native renderer job now installs the runtime library set from the R2025a upstream installation script: https://github.com/cyberbotics/webots/blob/R2025a/scripts/install/linux_runtime_dependencies.sh. CI is rerunning with those prerequisites; no renderer pass is claimed yet.

[jBernavaPrah]

The cancelled long-running test jobs were still compiling participant-metadata fixture binaries, not stuck in runtime simulation. The all-feature job had already passed 604 core tests and the preceding integration suites before those cold fixture builds. I cancelled the already-failed run to inspect this, so the full suites remain unverified remotely, not failed assertions or successful runs. The new rerun includes the exact Mesa environment-notice handling; all asset warnings and errors remain fatal in the renderer proof. Latest local host library checks pass 77 tests plus the explicit native renderer probe, with Clippy warnings denied.

[jBernavaPrah]

Review corrections are now at 398a0a78.

• Every non-bootstrap world-session request now carries the verified WorldInstanceId; a reused endpoint refuses stale control and attachment requests before dispatch.
• Idle state and diagnostics subscriptions observe peer EOF, so disconnects release their server slots without requiring a world update.
• Progress checkpoint persistence and state publication stay inside the state serialization boundary.
• Motor and attachment cleanup attempt every independent action and aggregate failures.
• The Webots host is binary-only again. A narrow exact-train phoxal-simulator-webots-shared library owns only the typed controller plan and private wire protocol; the policy and release train recognize it as a library.
• Webots lowering derives canonical completeness, substitutions, and asset closure from FullSimulationPlan.

Local checks passed: targeted world transport regressions, shared-plan tests, host binary suite, cleanup regression, clippy, formatting, and workspace policy. The full PR CI is running.

[jBernavaPrah]

Follow-up correction is pushed in b1016d0.

This completes the structural recommendations in the simulator owner:

• controller and host now use one Live bootstrap path that resolves exactly one execution, opens the bus, validates the frozen bootstrap and time domain, and cleans up on failure;
• the framework owns the built-in drive source, command expiry, and locomotion-topology validation;
• native bindings are mutually exclusive Motor, Encoder, or Sampled variants, so invalid optional sampling or actuation combinations are unrepresentable;
• one resolved rigid assembly now drives native rendering, collision, and mass lowering.

Validated locally with all framework features (606 core tests), focused Webots shared/host/controller suites, clippy with warnings denied, formatting, and workspace policy. Native Webots renderer remains covered by CI.