feat: ordered startup + Services autoload extraction

[kuruk-mm]

Summary

Diagnoses + reshapes the boot path for the iOS WatchdogTermination Sentry issue GODOT-EXPLORER-3B (392 events / 97 users in prod, every release since 0.44; same crash as #1532 / tracked in #1980). Three changes land together:

1. BootInstrumentation autoload — boot clock + Sentry breadcrumb chain + last_boot_step tag on every event. On non-prod, renders an on-screen overlay with ephemeral step lines + a circular RAM-usage indicator pinned outside the safe area (triple-finger / F8 toggle). When a watchdog kill happens, the Sentry event now arrives tagged with the last step that fired.
2. Services autoload — single registry for every long-lived dependency. Owns 12 GDScript service objects (realm, scene_fetcher, modal_manager, music_player, …), the 5 previously-autoloaded scripts (ui_sounds, notifications_manager, connection_quality_monitor, impostor_capturer, avatar_lod_coordinator), and forwarding getters (typed where possible) for 19 Rust-inherited singletons on DclGlobal. Services.bootstrap() is awaited from main.gd under the visible splash; it yields process_frame between heavy blocks so iOS sees a responsive main loop. Rust singletons attach as children of /root/Services instead of /root.
3. Global shrunk — keeps signals, config constants, runtime state (camera mode, height tracking, session_id), CLI / orientation / Sentry-tag setup, and the async_route_to_target_scene branching that used to live in main.gd. Six autoload entries removed from project.godot (down from 8 to 3: BootInstrumentation, Services, Global).

Scope

• 135 files changed, +1946 / -1432.
• ~1000 callsites swept mechanically (UiSounds.* → Services.ui_sounds.*, Global.realm → Services.realm, Global.get_config() → Services.config, etc.).
• 1 Rust patch: lib/src/scene_runner/global_get_node_helper.rs — get_realm_node now resolves /root/Services/realm (was /root/realm). No other absolute path lookups exist in Rust per audit.
• class_name UISounds stripped from ui_sounds.gd; entry removed from .godot/global_script_class_cache.cfg.

Why this fixes the watchdog

The previous boot ran _async_clear_cache_if_needed() plus ~20 add_child.call_deferred Rust singleton attaches inside Global._ready, under the engine's opaque splash — iOS sees the main loop go silent and kills the process. Now those run inside Services.bootstrap() awaited from main.tscn's visible splash, with await get_tree().process_frame yields between heavy blocks. The instrumentation also tells us exactly which step is the last one before a kill, so if a watchdog still fires we can target the culprit.

Test plan

• cargo run -- run — desktop smoke; should reach lobby; step prints monotonic.
• cargo run -- run -- --emulate-ios and … --emulate-ios --landscape — visual smoke + BootInstrumentation overlay sanity (RAM indicator in the notch channel in both orientations).
• cargo run -- run --target ios — original repro from [Bug]: iOS sometimes loading too long (shaders?) #1532: open app, wait on splash, lock the phone 30s, unlock. App should survive.
• cargo run -- run --itest — alternate-mode boot (cli.test_runner) routes through Services.bootstrap() then async_route_to_target_scene().
• cargo run -- run --stest — same for scene tests.
• Post-merge ~3–7 days: query Sentry last_boot_step tag values on GODOT-EXPLORER-3B (filtered to environment:production). Either the event count drops sharply, or remaining events cluster on one step we can target next.

Validated

• gdformat godot/ — clean
• gdlint godot/ — no problems
• cargo run -- check-gdscript — 303 scripts, 0 errors
• Rust clippy on patched helper — clean

Risk

• Rust singletons now live at /root/Services/<Name>. Phase-1 audit confirmed only global_get_node_helper.rs uses /root/realm; no other absolute-path lookups exist. Patched in this PR.
• Initialization order is now deterministic instead of "all on the next frame". Anything implicitly depending on deferred attachment timing could regress — integration tests above are the gate.
• All ~1000 renames are mechanical (sed + check-gdscript clean after each batch). No silent class-name shadowing risk (UISounds was the only class_name on the demoted scripts; stripped).

Related: #1532 (user repro), #1980 (tracking), GODOT-EXPLORER-3B (Sentry).

[github-actions]

📦 Build Report

🤖 Android

Artifact	Status
APK	📱 Download APK
AAB	main/release builds only
Debug Symbols	main/release builds only

Build Status: ✅ Success

🍏 iOS

The signed APK is uploaded to R2 on every build (link above). Add the build label (alias: build-ios) to build & ship iOS to TestFlight and post a Slack "Android build ready" notification.

---

🔗 Workflow Run: View logs

🔄 Updated: 2026-06-24 22:06:34 UTC

[github-actions]

---

🍏 iOS Build Complete

✅ Status: Success

🔗 iOS Workflow: View build

📦 Artifacts: godot-mobile-deploy-pipeline

📍 Branch: PR-2159-feat/ordered-startup-instrumentation

🔄 Completed: 2026-06-01 19:11:39 UTC