feat(physics): C4 route 4b-1 — remote placement infrastructure (dormant)

Builds the machinery route 4b-2 and 4b-3 will flip on, and changes no remote
behaviour: it has no production caller, so RemotePlacementDrivePendingCount is
provably 0 and IsConverged is unchanged.

Five pieces: a per-entity remote placement owner (RuntimeRemotePlacementDriveController),
a Position-time service-window guard with a Runtime interface plus BOTH host
implementations, N3's headless RetryPending pump, parked-count observability in
the ownership ledger, and the service-window optimisation that avoids parks we
can cheaply predict.

Landed alone because it is where the park-withdraws-the-entity failure was
decided; that decision is fixed at the source in the preceding commit and must
not share a review signal with a behaviour flip.

Two parts of route 2's controller are deliberately NOT ported, both verified
against retail rather than assumed. There is no ack: SendPositionEvent is called
only inside HandleReceivedPosition's local-player FORCE_POSITION gate
@0x0045400C-@0x00454091, and the remote arm @0x0045414D has no equivalent. There
is no re-issue funnel: retail never re-attempts a position it could not apply —
stale timestamps merely bump error_count @0x004542AC — and re-issuing packet N
after N+1 has merged would apply a pose the newer packet already superseded,
which is correct for a one-shot ForcePosition and wrong for a 5-10 Hz stream.

The service-window guard is an OPTIMISATION, not the correctness mechanism. The
original contract had it the other way round, justified by a claim that retail
cannot represent "arrived but not placeable" — false, and corrected in the
review findings: retail's GotoLostCell/reenter_visibility path represents it
exactly. A pre-flight guard also cannot be complete, because Core defers on the
entity's CURRENT cell, on the swept QueriedCellIds footprint spanning
neighbouring landblocks, and on residency evaluated after AdjustToOutside —
conditions only Core can see.

Review found and this commit fixes: DetachRoute cleared two maps of LIVE Core
operations without cancelling them (route 2's AbandonPending is the correct
mirror, not the first-entry controller) and its test asserted that blindness as
convergence; the headless predicate answered "can ever publish" rather than "is
published", and after the first fix still matched only 1 of the 9 landblocks
this host publishes; OwnsPlacement admitted remote top-level Creates until
gated on the Teleport flag as well as the disposition; Advance re-submitted
without re-checking the window; and four comments cited a report that did not
exist.

Contract item 6 is met by the structural proof, not the earlier test:
HasOldPrefixPlacementDebt refuses collision-prefix mutation permission before
ParkCollisionResidents is ever entered, so its overlap throw is unreachable.
That same mechanism is the unbounded stall filed as #310, which 4b-1 does not
bound — it only avoids widening it.

#311 files the remaining per-tick allocation in RetryPendingProjections; the
early-out for the empty-FIFO case landed via a new HasPendingReceipts accessor
so hosts still never touch .Placements. directly.

Gates: complete Release solution 10,973 passed / 4 skipped / 0 failed (baseline
10,938). Four review rounds; every fix discrimination-verified by revert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Runtime/Physics/RuntimePhysicsState.cs

@@ -454,6 +454,21 @@ public sealed class RuntimePhysicsState : IDisposable
         _collisionGenerationCommittedObservers = new();
     private bool _disposed;
 
+    /// <summary>
+    /// C2-1 review fix (delta round): lets a ledger-provider callback
+    /// registered against <see cref="RuntimeEntityObjectLifetime"/> (e.g.
+    /// <c>RuntimeRemotePlacementDriveController.CountLiveAwaitingAcknowledgement</c>)
+    /// check disposal state BEFORE calling into <see cref="SetPosition"/>,
+    /// whose own <c>IsPlacementCurrent</c> throws <c>ObjectDisposedException</c>
+    /// once disposed. <c>Dispose()</c> below disposes <see cref="SetPosition"/>
+    /// strictly before setting this flag, so <c>IsDisposed == true</c> here
+    /// guarantees <see cref="SetPosition"/> is already disposed too — a
+    /// post-<c>Dispose()</c> <c>CaptureOwnership()</c> read is the designed
+    /// contract (<c>GameWindowLifetime.DisposeGameRuntime</c>), so every
+    /// ledger provider must survive it without throwing.
+    /// </summary>
+    internal bool IsDisposed => _disposed;
+
     public event Action<RuntimePhysicsCellCommit>? CellCommitted;
     public event Action<RuntimeCollisionGenerationCommitted>?
         CollisionGenerationCommitted

src/AcDream.Runtime/Physics/RuntimePlacementProjectionSubscription.cs

@@ -86,6 +86,20 @@ public sealed class RuntimePlacementProjectionSubscription
     public bool HasAppliedReceiptAwaitingAcknowledgement =>
         _appliedAwaitingAcknowledgement.IsValid;
 
+    /// <summary>
+    /// C2-2 review fix (delta round, B5(b)): true when Runtime's placement
+    /// FIFO has at least one outstanding receipt, so a host can early-out
+    /// before calling <see cref="RetryPending"/> without reaching the
+    /// Runtime placement channel directly — the architectural boundary
+    /// <c>RuntimePhysicsOwnershipTests.ProductionHostsUseSharedPlacementSubscriptionWithoutDirectChannel</c>
+    /// enforces (hosts consume placement state ONLY through this
+    /// subscription). Only closes the EMPTY-FIFO case: when the count is
+    /// nonzero, <c>RetryPending</c> still reaches
+    /// <c>RuntimeSetPositionState.RetryPendingProjections</c>'s per-call
+    /// array snapshot — see docs/ISSUES.md for that residual.
+    /// </summary>
+    public bool HasPendingReceipts => _channel.PendingCount != 0;
+
     /// <summary>
     /// Republishes Runtime's complete still-pending FIFO. Later receipts are
     /// ignored until the exact oldest receipt projects and acknowledges.