fix: ignore pre-history prediction acknowledgements

Game/scripts/local_prediction_history.gd

@@ -73,6 +73,7 @@ const RING_SIZE := 128
 var _ring_seq: PackedInt32Array = PackedInt32Array()
 var _ring_entry: Array = []
 var _has_recorded := false
+var _first_recorded_seq := -1
 
 var newest_recorded_seq := -1
 var last_acknowledged_seq := 0
@@ -94,6 +95,7 @@ func begin_epoch() -> void:
 		_ring_seq[i] = -1
 		_ring_entry[i] = null
 	_has_recorded = false
+	_first_recorded_seq = -1
 	newest_recorded_seq = -1
 	last_acknowledged_seq = 0
 	resync_required = false
@@ -106,6 +108,8 @@ func begin_epoch() -> void:
 func record(seq: int, action: ShipAction, state: NetBodyState, contact_window: bool = false) -> bool:
 	var overflowed_now := false
 	if not _has_recorded or seq > newest_recorded_seq:
+		if not _has_recorded:
+			_first_recorded_seq = seq
 		if seq - last_acknowledged_seq > RING_SIZE:
 			# Only the LEADING edge of an episode counts: resync_required is
 			# still true for every subsequent tick of the same stall, and
@@ -140,6 +144,8 @@ func record(seq: int, action: ShipAction, state: NetBodyState, contact_window: b
 func record_unsimulated(seq: int, action: ShipAction) -> bool:
 	var overflowed_now := false
 	if not _has_recorded or seq > newest_recorded_seq:
+		if not _has_recorded:
+			_first_recorded_seq = seq
 		if seq - last_acknowledged_seq > RING_SIZE:
 			overflowed_now = not resync_required
 			resync_required = true
@@ -289,6 +295,11 @@ func compare_authoritative(seq: int, authoritative: NetBodyState) -> Dictionary:
 
 
 func _missing_status(seq: int) -> String:
+	# The server starts its acknowledgement clock at sequence 0, while the
+	# first local post-step prediction is normally sequence 1. This is a normal
+	# startup boundary, not a lost ring entry and must not trigger a hard snap.
+	if not _has_recorded or seq < _first_recorded_seq:
+		return "warmup_not_recorded"
 	if _has_recorded and seq <= newest_recorded_seq - RING_SIZE:
 		return "missing_evicted"
 	return "missing_not_recorded"

Game/scripts/net_ship_predictor.gd

@@ -44,6 +44,11 @@ static func decide(comparison: Dictionary, local_frozen: bool, reset_changed: bo
 	# normally against real data.
 	if comparison.get("status", "") == "unsimulated_gap":
 		return {"mode": "skip", "reason": "unsimulated_gap"}
+	if comparison.get("status", "") == "warmup_not_recorded":
+		# Sequence acknowledgements that predate the first local post-step state
+		# are expected during startup. The initial snapshot already placed the
+		# body, so there is no correction to apply and no resync to arm.
+		return {"mode": "skip", "reason": "warmup_not_recorded"}
 	if comparison.get("status", "missing_not_recorded") != "matched":
 		return {"mode": "hard", "reason": comparison.get("status", "missing")}
 	if authoritative == null or authoritative.frozen != local_frozen:

Game/tests/cases/test_net_ship_predictor.gd

@@ -99,6 +99,14 @@ func test_genuine_missing_history_is_still_a_hard_snap() -> void:
 		assert_eq(decision["mode"], "hard", "%s must still hard-correct" % status)
 
 
+func test_warmup_ack_before_first_prediction_is_skipped() -> void:
+	var history := LocalPredictionHistory.new()
+	var authority := _authoritative()
+	var comparison := history.compare_authoritative(0, authority)
+	assert_eq(comparison["status"], "warmup_not_recorded", "pre-history acknowledgement is startup, not loss")
+	assert_eq(NetShipPredictor.decide(comparison, false, false)["mode"], "skip", "startup acknowledgement must not hard-snap")
+
+
 func test_a_reset_still_wins_over_an_unsimulated_gap() -> void:
 	# Ordering guard: reset_gen is an epoch boundary and outranks everything,
 	# including the new skip path — otherwise a gap landing on the reset

multiplayer-todo.md

@@ -1227,7 +1227,7 @@ the local/CI/community transport, not a silent production fallback.
 | # | Task | Acceptance |
 |---|---|---|
 | 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness; the API can now use the durable participant-scoped proposal provider for both recovery and accept/decline mutations | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents`, `TestStateChangingAPIActionsPublishTargetedEvents`, `TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped` and store proposal SQL tests reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain |
-| 8.40 `[D:8.3,8.14]` | **IN PROGRESS.** Pure Go revisioned replica reducer rejects gaps for REST resync, makes duplicate/out-of-order events idempotent, and resumes from the authoritative snapshot revision; authenticated queue-ticket recovery now has an owner-checked REST read; Godot client projection persists non-secret ticket/proposal state, forces authoritative recovery after restart, and can replay a lost queue-create response with the original ticket/idempotency key; the Go API now exposes an authenticated `/v1/events` WebSocket with bounded per-player queues, strict upgrade/vocabulary validation and REST-resync-safe slow-client failure; Godot `ControlPlaneClient` can connect to the stream using Godot 4.7's handshake-header API, consume validated events, automatically reconnect with bounded backoff, and trigger REST recovery on projection gaps and stream return; `OutboxDispatcher` now provides ordered at-least-once delivery after durable commit; assignment recovery events carry the durable assignment revision without leaking it into REST JSON | `server/domain/sync.go`, `server/api/events.go`, `server/api/service.go`, `server/store/outbox.go`, `service_test.go`, `outbox_test.go`, `matchmaking_state.gd` and `control_plane_client.gd` cover gap, snapshot, replay, same-revision conflict, owner-only ticket recovery, expired-ticket terminal handling, malformed restart snapshots, API-level duplicate-create replay/conflict, authenticated handshake/key rejection, targeted event delivery, exactly-once slow-subscriber closure, invalid-event rejection, delivery-before-ack failure ordering and assignment event/response revision separation; Godot 4.7.1 headless project parse and 142-test unit harness pass with compatibility rendering; wiring the dispatcher to a production WebSocket/Redis worker and live multi-process control-plane/game verification remain |
+| 8.40 `[D:8.3,8.14]` | **IN PROGRESS.** Pure Go revisioned replica reducer rejects gaps for REST resync, makes duplicate/out-of-order events idempotent, and resumes from the authoritative snapshot revision; authenticated queue-ticket recovery now has an owner-checked REST read; Godot client projection persists non-secret ticket/proposal state, forces authoritative recovery after restart, and can replay a lost queue-create response with the original ticket/idempotency key; the Go API now exposes an authenticated `/v1/events` WebSocket with bounded per-player queues, strict upgrade/vocabulary validation and REST-resync-safe slow-client failure; Godot `ControlPlaneClient` can connect to the stream using Godot 4.7's handshake-header API, consume validated events, automatically reconnect with bounded backoff, and trigger REST recovery on projection gaps and stream return; `OutboxDispatcher` now provides ordered at-least-once delivery after durable commit; assignment recovery events carry the durable assignment revision without leaking it into REST JSON; prediction startup now distinguishes the sequence-0 warm-up acknowledgement from genuine missing/evicted history, preventing a false hard-snap during a live match | `server/domain/sync.go`, `server/api/events.go`, `server/api/service.go`, `server/store/outbox.go`, `service_test.go`, `outbox_test.go`, `matchmaking_state.gd`, `control_plane_client.gd`, `local_prediction_history.gd`, `net_ship_predictor.gd` and tests cover gap, snapshot, replay, same-revision conflict, owner-only ticket recovery, expired-ticket terminal handling, malformed restart snapshots, API-level duplicate-create replay/conflict, authenticated handshake/key rejection, targeted event delivery, exactly-once slow-subscriber closure, invalid-event rejection, delivery-before-ack failure ordering, assignment event/response revision separation and prediction warm-up/hard-resync separation; Godot 4.7.1 headless project parse and 143-test unit harness pass with compatibility rendering, and a two-process ENet authoritative match smoke passes spawn, movement, prediction, 0% snapshot loss and 0 hard snaps; wiring the dispatcher to a production WebSocket/Redis worker and live multi-process control-plane/game verification remain |
 | 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view including the hosted endpoint; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, validate and retain the endpoint, preserve explicit transport/slot/join authorisation and do not connect before assignment-ready; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point; `SaveAssignments` publishes a complete signed roster atomically instead of allowing partial player visibility; `SaveVerifiedAssignmentRoster` rechecks signed claims before deriving player rows | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `test_assignment_state.gd`, `server/contracts/v1/openapi.json`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport/endpoint boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling, atomic batch validation and signed-claim binding; direct client connect caller, SDR relay-ticket installation, `hello` join-authorisation wiring, fencing integration and live Godot/PostgreSQL verification remain |
 | 8.42 `[D:8.22,8.23,8.24,8.40]` | **IN PROGRESS.** `RankedProfileState` and `ControlPlaneClient.fetch_ranked_profile()` expose the backend-authoritative rating/RD/volatility/games/tier/provisional/season view; matchmaking UI displays provisional/tier status without client-side rating math | `test_control_plane_client.gd` validates profile shape, numeric safety and provisional display; ranked profile fetch/display, committed revision after reconnect, abandon status and season countdown remain dependent on live auth/backend events and Godot runtime verification |
 | 8.43 `[D:8.39,8.40,8.41]` | **IN PROGRESS.** Matchmaking client now distinguishes expired queue recovery, session expiry, missing records and retryable control-plane outages; a 401 clears the in-memory token, emits `session_expired` and disables retry until a new session is configured; terminal messages remain visible and active searches are not falsely failed on transient errors | `MatchmakingState` and `ControlPlaneClient` tests cover explicit expiry and the existing terminal/retry-safe state paths; decline, version mismatch, regional outage retry UI, failed reconnect, duplicate-action recovery and live Godot verification remain |