One helper sets stepper.blocked from _moving_bodies() after add_body,
pre-init remove_body, initialize and stepper recreation, so the latch never
disagrees with motion ownership. Tests: latch follows add/remove; the
after-close assertion checks the actual refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LBMStepper.step raises before any launch or buffer swap when the owner has
set 'blocked'; Simulation sets it when a translating circle is declared, at
initialize and after stepper recreation. Tests: direct-stepper guard (zero
launches, no swap, unchanged step count), spin/multi-step/checkpoint run
variants, run(0) keeps the pending target, static runs proceed, mixed
moving/static packing parity with the moving id absent, failure refusal of
checkpoint calls, no retry and no re-entry after close.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed MovingCircle.advance now calls the owner hook, so the Simulation
is marked failed (Jet lifecycle) and refuses run/step/sync until close().
Adds host tests for set_body routing on real objects, initialize band and
mode rejections before mutation, exclusion from static link packing, and
the Simulation failure lifecycle. Contract status line updated for S1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MovingCircle keeps the applied offset and an optional pending target apart,
validates targets against the applied offset (box, Euclidean 0.5-cell step,
speed, no sliding hold) and commits only after upload, step and sync succeed;
any failure after the upload attempt is fail-closed. Simulation.add_body
(translation=...) declares one; moving circles are excluded from the packed
static links, unsupported modes and swept-band placement are rejected at
initialize, and every positive-step run raises before any device write until
the moving kernels exist. Host tests include a refill-donor enumeration.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
