# V2 Code Virtualization

V2 code virtualization protects a narrow set of critical gameplay logic in
shipping client builds by moving selected native routines into custom bytecode
artifacts that are loaded by the protected runtime. The scope is intentionally
small: drive and meter economy, super/fatal-blow activation gates, finisher
resolution, and match-state finisher routing.

## Protected Segments

The protected segment list lives in
`V2/ue/Build/DRM/v2-code-virtualization.json`. Each segment names the owning
module, source file, protected symbols, bytecode output, symbol map, runtime
allowlist, deterministic simulation parity fixture, and rollback parity fixture.

The plan uses `V2CodeVM-BC-v1` as the custom bytecode evidence format. It does
not add a VM implementation in this repository; the manifest and planner define
the release contract that a protected build tool must satisfy.

## Boundaries

This layer is for critical gameplay logic only. It is shipping-client-only and
must stay out of editor, debug, and dedicated-server builds. Protected client
paths still require server-authoritative revalidation.

The virtualization plan must preserve deterministic simulation parity and
rollback parity. Every protected segment needs a fixture proving that protected
and unprotected builds produce the same gameplay result for the same input.

This layer has no anti-debugging, process scanning, driver inspection, or hidden
runtime enforcement. Those are separate tasks with their own review gates.

## CI Gates

`V2/ue/Tools/plan-v2-code-virtualization.py` emits the deterministic code
virtualization plan. `V2/ue/Tools/check-v2-code-virtualization.py` validates the
manifest, source-symbol coverage, planner output, runtime unpacker dependency,
Horde wiring, CI workflow wiring, and this runbook.

Required release gates:

- `drm-code-virtualization-plan-generated`
- `drm-code-virtualization-segment-coverage`
- `drm-code-virtualization-bytecode-output`
- `drm-code-virtualization-determinism-fixtures`
- `drm-code-virtualization-runtime-allowlist`

The gates ensure every protected segment has custom bytecode output, source
symbol maps, deterministic simulation parity, rollback parity, and runtime
allowlists before a protected client build can ship.