fix(unity): honest WebGL saves, SSE transport hygiene, router cleanup, destroy honesty + benchmark Stop button

Audit wave 2026-07-11, findings 5/6/12/13 + owner request:
- WebGL IndexedDB flush failures logged; 'Saved N objects' honest on failure
- FetchSseOpenAiTransport: swallowed catches log with call id, concurrent
  ReadAsync fails loudly, stream state entries always removed on completion
- AiGameCommandRouter.Dispose clears the static CommandReceived event
- world_command destroy returns failure for missing targets
- Benchmark window: 'Stop (save partial)' button next to Run while active

Author: NeoXider

Assets/CoreAiUnity/CHANGELOG.md

@@ -4,6 +4,26 @@ Unity host: **CoreAI.Source** build, EditMode / PlayMode tests, Editor menus, do
 
 ## [Unreleased]
 
+### Fixed (2026-07-11 audit wave)
+
+- **WebGL persistence: IndexedDB flush failures are no longer silent.** `CoreAiWebGlPersistence` and
+  `WorldStateManager` log a warning when `CoreAi_PersistFsSync` throws, and the "Saved N objects" log is
+  honest about a failed flush (the save may not survive a reload).
+- **WebGL SSE transport hygiene** (`FetchSseOpenAiTransport`): all previously-empty catches log with the
+  call id (including a failed browser-fetch abort), a second concurrent `ReadAsync` fails loudly instead of
+  silently overwriting the pending slot, and terminal callbacks/open-failures always remove the stream's
+  entry from the static state table (no more permanent leaks from abandoned streams).
+- **`AiGameCommandRouter.Dispose()` clears the static `CommandReceived` event**, so commands after a scene
+  reload no longer reach dead subscribers from previous scenes (duplicate world mutations).
+- **`world_command destroy` reports failure for missing targets** (was: unconditional success, so the model
+  could never self-correct a typo'd object name).
+
+### Added
+
+- **Benchmark window: Stop button.** "Stop (save partial)" appears next to "Run benchmark" while a run is
+  active (same cooperative stop as the `CoreAI/Benchmarks/Stop Running Benchmark` menu item: finishes the
+  current scenario, saves a partial report); shows "Stopping…" once requested.
+
 ## 5.6.1 - Build-time policy registration + code-style pass (2026-07-11)
 
 - **`AgentBuilder.Build()` auto-registers with the global policy** when one exists (immediate routability);

Assets/CoreAiUnity/Runtime/Source/Features/Llm/Infrastructure/FetchSseOpenAiTransport.cs

@@ -82,7 +82,19 @@ public async Task<OpenAiHttpSseOpenResult> OpenSseResponseStreamAsync(OpenAiHttp
             // to be captured so the continuation reliably runs on the browser main thread.
             // ConfigureAwait(false) routes the continuation to ThreadPool, which doesn't
             // exist in WebGL, and the await never resumes.
-            StreamState.OpenInfo openInfo = await state.WaitForOpenAsync();
+            StreamState.OpenInfo openInfo;
+            try
+            {
+                openInfo = await state.WaitForOpenAsync();
+            }
+            catch
+            {
+                // WHY: WaitForOpenAsync can throw (typed jslib Timeout, cancellation). On that path the
+                // stream is never handed to the caller, so nothing else would ever dispose the state or
+                // remove its entry from the static States dictionary — clean up here before rethrowing.
+                state.Dispose();
+                throw;
+            }
 
             OpenAiHttpSseOpenResult result = new OpenAiHttpSseOpenResult
             {
@@ -256,9 +268,12 @@ public void AttachCancellation(CancellationToken cancellationToken)
                     {
                         CoreAi_FetchSseAbort(CallId);
                     }
-                    catch
+                    catch (Exception ex)
                     {
-                        // Browser abort must not throw back into the Unity cancellation path.
+                        // Browser abort must not throw back into the Unity cancellation path, but a
+                        // failed abort leaks the browser-side fetch — log it instead of swallowing.
+                        UnityEngine.Debug.LogWarning(
+                            $"[FetchSSE] CoreAi_FetchSseAbort failed on cancellation (callId={CallId}): {ex.Message}");
                     }
 
                     SignalCancelled(cancellationToken);
@@ -286,8 +301,19 @@ public void SignalDone()
                 _stream.PumpPendingRead();
                 // Defensive: if SignalDone fires before SignalOpen (shouldn't happen, but
                 // caller surfaces a transport error instead of awaiting forever.
+                // TODO: In the jslib flow onOpen always precedes onDone; the only way to get here
+                // without an open result is when the onOpen dyncall itself threw and was swallowed
+                // by CoreAiSseFetch.jslib's callOpen catch. In that case the fetch may actually have
+                // succeeded (its chunks are already buffered in _queue), but the real HTTP status is
+                // lost, so this surfaces a fake "HTTP 0 / no headers" error. Recovering the real
+                // result would require the jslib to re-deliver the open info alongside done.
                 _openTcs.TrySetResult(new OpenInfo(0, "fetch completed without headers",
                     new Dictionary<string, IEnumerable<string>>()));
+
+                // onDone is terminal (the jslib finish() guard drops any later callback for this id),
+                // so drop the States entry now: a consumer that abandons the stream without disposing
+                // it would otherwise leak the entry in the static dictionary permanently.
+                States.TryRemove(CallId, out _);
             }
 
             public void SignalError(Exception ex)
@@ -321,6 +347,10 @@ public void SignalError(Exception ex)
                     _openTcs.TrySetResult(new OpenInfo(0, ex?.Message ?? "fetch error",
                         new Dictionary<string, IEnumerable<string>>()));
                 }
+
+                // onError is terminal (the jslib finish() guard drops any later callback for this id),
+                // so drop the States entry now — same abandoned-stream leak rationale as SignalDone.
+                States.TryRemove(CallId, out _);
             }
 
             public void SignalCancelled(CancellationToken cancellationToken)
@@ -344,9 +374,27 @@ public void Dispose()
                 // that is never removed (consumer drops the stream without reading to completion) is a
                 // permanent leak; removing on Dispose bounds the dictionary to live streams only.
                 States.TryRemove(CallId, out _);
-                try { _cancelRegistration.Dispose(); } catch { }
-                try { _signal.Set(); } catch { }
-                try { _signal.Dispose(); } catch { }
+                try
+                {
+                    _cancelRegistration.Dispose();
+                }
+                catch (Exception ex)
+                {
+                    UnityEngine.Debug.LogWarning(
+                        $"[FetchSSE] cancellation registration dispose failed (callId={CallId}): {ex.Message}");
+                }
+
+                try
+                {
+                    _signal.Set();
+                    _signal.Dispose();
+                }
+                catch (Exception ex)
+                {
+                    // Double-dispose race: the signal may already be disposed; still worth surfacing.
+                    UnityEngine.Debug.LogWarning(
+                        $"[FetchSSE] signal release failed on dispose (callId={CallId}): {ex.Message}");
+                }
             }
 
             public FetchSseStream Stream => _stream;
@@ -404,6 +452,14 @@ public override Task<int> ReadAsync(byte[] buffer, int offset, int count, Cancel
                 if (_error != null) return Task.FromException<int>(_error);
                 if (cancellationToken.IsCancellationRequested) return Task.FromCanceled<int>(cancellationToken);
 
+                // WHY: there is a single pending-read slot; a second concurrent ReadAsync would silently
+                // overwrite _pendingTcs and leave the first awaiter hanging until Dispose. Fail loudly.
+                if (_pendingTcs != null)
+                {
+                    return Task.FromException<int>(new InvalidOperationException(
+                        "FetchSseStream supports only one pending ReadAsync at a time; the previous read has not completed."));
+                }
+
                 int n = TryReadNonBlocking(buffer, offset, count);
                 if (n > 0) return Task.FromResult(n);
                 if (_isDone) return Task.FromResult(0);
@@ -507,11 +563,29 @@ protected override void Dispose(bool disposing)
                     // (with EOF) here, otherwise its TCS and per-read cancellation registration
                     // stay alive until the whole request token ends.
                     PumpPendingRead();
-                    try { CoreAi_FetchSseAbort(_owner.CallId); } catch { }
+                    try
+                    {
+                        CoreAi_FetchSseAbort(_owner.CallId);
+                    }
+                    catch (Exception ex)
+                    {
+                        // A failed abort leaks the browser-side fetch/ReadableStream for this call.
+                        UnityEngine.Debug.LogWarning(
+                            $"[FetchSSE] CoreAi_FetchSseAbort failed on stream dispose (callId={_owner.CallId}): {ex.Message}");
+                    }
+
                     // Owner disposal also removes the States entry and drops the request-token
                     // cancellation registration, which would otherwise pin this stream (queue,
                     // buffered chunks and all) to the caller's token lifetime on the success path.
-                    try { _owner.Dispose(); } catch { }
+                    try
+                    {
+                        _owner.Dispose();
+                    }
+                    catch (Exception ex)
+                    {
+                        UnityEngine.Debug.LogWarning(
+                            $"[FetchSSE] stream state dispose failed (callId={_owner.CallId}): {ex.Message}");
+                    }
                 }
 
                 base.Dispose(disposing);

Assets/CoreAiUnity/Runtime/Source/Features/Messaging/Infrastructure/AiGameCommandRouter.cs

@@ -75,6 +75,14 @@ public void Dispose()
         {
             _disposed = true;
             _subscription?.Dispose();
+
+            // WHY: CommandReceived is process-global (static) while its subscribers are typically
+            // scene-scoped (e.g. AiDashboardPresenter). A subscriber that misses its own unsubscribe
+            // would survive a scene reload and receive commands routed by the next scene's router —
+            // duplicate world mutations against destroyed objects. The router is registered once per
+            // CoreAILifetimeScope, so clearing on scope teardown is safe: live subscribers in the new
+            // scene re-attach via their own OnEnable/Initialize.
+            CommandReceived = null;
         }
     }
 }

Assets/CoreAiUnity/Runtime/Source/Features/World/Infrastructure/CoreAiWorldCommandExecutor.cs

@@ -749,11 +749,16 @@ private bool TryParentSpawned(GameObject child, string parentName, bool worldPos
 
         private bool TryDestroy(CoreAiWorldCommandEnvelope env)
         {
-            if (ResolveObject(env.targetName, out GameObject go))
+            if (!ResolveObject(env.targetName, out GameObject go))
             {
-                UnityEngine.Object.Destroy(go);
+                // WHY: Returning true here reported "ok" for a typo'd/missing target, so the model
+                // could never self-correct — every other verb fails on an unresolved target.
+                _logger.LogWarning(GameLogFeature.MessagePipe,
+                    $"[World] destroy: object not found (name='{env.targetName}')");
+                return false;
             }
 
+            UnityEngine.Object.Destroy(go);
             return true;
         }
 

Assets/CoreAiUnity/Runtime/Source/Features/World/WorldStateManager.cs

@@ -26,12 +26,26 @@ public sealed class WorldStateManager : IWorldStateManager, IDisposable
         private static extern void CoreAi_PersistFsSync();
 #endif
 
-        /// <summary>On WebGL pushes the in-memory IDBFS tree into IndexedDB after a save so it survives a reload/tab close.</summary>
-        private static void PersistFsForWebGl()
+        /// <summary>
+        /// On WebGL pushes the in-memory IDBFS tree into IndexedDB after a save so it survives a
+        /// reload/tab close. Returns false when the flush threw (the save reached IDBFS memory only),
+        /// so the caller can report the save honestly instead of claiming durable success.
+        /// </summary>
+        private bool PersistFsForWebGl()
         {
 #if UNITY_WEBGL && !UNITY_EDITOR
-            try { CoreAi_PersistFsSync(); } catch { /* best-effort flush */ }
+            try
+            {
+                CoreAi_PersistFsSync();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(GameLogFeature.Core,
+                    $"[WorldState] IndexedDB flush failed after save: {ex.Message}");
+                return false;
+            }
 #endif
+            return true;
         }
 
         private static readonly Color NoColor = new(-1f, -1f, -1f, -1f);
@@ -262,10 +276,19 @@ public void Save()
                     File.Move(tmpPath, _saveFilePath);
                 }
 
-                PersistFsForWebGl();
-
-                _logger.LogInfo(GameLogFeature.Core,
-                    $"[WorldState] Saved {objects.Count} objects.");
+                if (PersistFsForWebGl())
+                {
+                    _logger.LogInfo(GameLogFeature.Core,
+                        $"[WorldState] Saved {objects.Count} objects.");
+                }
+                else
+                {
+                    // WHY: On WebGL the file only reached the in-memory IDBFS tree; the IndexedDB
+                    // flush threw, so a reload/tab close can still lose this save. Don't claim
+                    // durable success — the flush failure was already logged by PersistFsForWebGl.
+                    _logger.LogWarning(GameLogFeature.Core,
+                        $"[WorldState] Saved {objects.Count} objects to in-memory FS, but the IndexedDB flush failed; the save may not survive a reload.");
+                }
             }
             catch (Exception ex)
             {

Assets/CoreAiUnity/Runtime/Source/Infrastructure/CoreAiWebGlPersistence.cs

@@ -22,7 +22,17 @@ public static class CoreAiWebGlPersistence
         public static void Sync()
         {
 #if UNITY_WEBGL && !UNITY_EDITOR
-            try { CoreAi_PersistFsSync(); } catch { /* best-effort flush */ }
+            try
+            {
+                CoreAi_PersistFsSync();
+            }
+            catch (System.Exception ex)
+            {
+                // WHY: A failed flush means the preceding write may not survive a reload/tab close —
+                // that must be visible in the console instead of silently losing the data.
+                UnityEngine.Debug.LogWarning(
+                    $"[CoreAiWebGlPersistence] IndexedDB flush failed; last write may not survive a reload: {ex.Message}");
+            }
 #endif
         }
     }

Assets/CoreAiUnity/Tests/EditMode/CoreAiWorldCommandExecutorDestroyEditModeTests.cs

@@ -0,0 +1,34 @@
+using CoreAI.Infrastructure.Logging;
+using CoreAI.Infrastructure.World;
+using CoreAI.Messaging;
+using NUnit.Framework;
+using UnityEngine;
+
+namespace CoreAI.Tests.EditMode
+{
+    /// <summary>
+    /// Regression coverage for audit finding 13: <c>destroy</c> must fail (not silently report
+    /// success) when the target object does not exist, so the model sees the failure on a typo'd
+    /// name and can self-correct — matching every other verb's unresolved-target contract.
+    /// </summary>
+    public sealed class CoreAiWorldCommandExecutorDestroyEditModeTests
+    {
+        [Test]
+        public void TryExecute_Destroy_MissingTarget_ReturnsFalse()
+        {
+            CoreAiWorldCommandExecutor executor = new(GameLoggerUnscopedFallback.Instance);
+
+            string json = JsonUtility.ToJson(CoreAiWorldCommandEnvelope.Destroy(
+                "NoSuchObject_CoreAiAudit2026DestroyTest"));
+            bool executed = executor.TryExecute(new ApplyAiGameCommand
+            {
+                CommandTypeId = AiGameCommandTypeIds.WorldCommand,
+                JsonPayload = json,
+                SourceTaskHint = "editmode_destroy_missing"
+            });
+
+            Assert.IsFalse(executed,
+                "destroy must fail when the target object cannot be resolved in the scene.");
+        }
+    }
+}

Assets/CoreAiUnity/Tests/EditMode/CoreAiWorldCommandExecutorDestroyEditModeTests.cs.meta

@@ -41,6 +41,7 @@ public sealed class GameCreationBenchmarkWindowUitk : EditorWindow
         private ToolbarToggle _compareTab;
         private ToolbarToggle _modelsTab;
         private Label _statusLabel;
+        private Button _stopButton;
         private VisualElement _progressFill;
         private Label _progressText;
         private VisualElement _progressLines;
@@ -491,10 +492,21 @@ private VisualElement BuildConnectionSection()
         private VisualElement BuildRunButtonSection()
         {
             VisualElement section = Section(null);
+            VisualElement row = Row();
             Button run = new(RunBenchmark) { text = "Run benchmark" };
             run.style.height = 34;
             run.style.unityFontStyleAndWeight = FontStyle.Bold;
-            section.Add(run);
+            run.style.flexGrow = 1;
+            row.Add(run);
+            _stopButton = new Button(GameCreationBenchmarkLauncher.StopRunningBenchmark)
+            {
+                text = "Stop (save partial)"
+            };
+            _stopButton.style.height = 34;
+            _stopButton.style.marginLeft = 6;
+            _stopButton.style.display = DisplayStyle.None;
+            row.Add(_stopButton);
+            section.Add(row);
             return section;
         }
 
@@ -664,6 +676,13 @@ private void UpdateLiveStatus()
             }
 
             bool active = BenchmarkProgress.IsRunning;
+            if (_stopButton != null)
+            {
+                _stopButton.style.display = active ? DisplayStyle.Flex : DisplayStyle.None;
+                _stopButton.SetEnabled(active && !BenchmarkProgress.StopRequested);
+                _stopButton.text = BenchmarkProgress.StopRequested ? "Stopping…" : "Stop (save partial)";
+            }
+
             // A solo scenario (Total <= 1, e.g. running G6's free build alone) has a count-based Fraction
             // that sits at 0% for its whole multi-minute run and only jumps to 100% at the very end - not
             // useful to a human watching. Fall back to the scenario's own elapsed/remaining wall-clock