fix(physics): bind a parented child to the parent's live incarnation (#319)

A player-parented child never received a canonical cell. Its FullCellId stayed
0 for its whole attached lifetime, so it could not follow the player across a
boundary. Scope was wider than the local player: every REMOTE player's
equipment too.

ROOT CAUSE. EquippedChildRenderController hardcoded ParentInstanceSequence: 0
for a parented CreateObject. Correct for creatures and statics, which really
are sequence 0; wrong for players, whose ObjectInstance is Character.TotalLogins
(ACE Player_Networking.cs:37). The relation filed under (playerGuid, 0) while
the record carried TotalLogins, so both route-7 write sites — D1's attach
re-cell and D2's propagation lookup — keyed on an incarnation that never
matched. TryCommitParent did not validate the sequence, so the attach
succeeded and printed normally. Silent.

A ROUTE 7 REGRESSION (cd3129e9) that un-masked a latent bug: the TickChild call
route 7 deleted was keyed on the child guid alone and was structurally immune
to a wrong parent key.

THE FIX IS TO STOP TREATING PLAYERS DIFFERENTLY, not to special-case them.
Retail's attach path is guid-only end to end — PhysicsDesc::get_parent_id
@0x00558a18 -> CObjectMaint::GetObjectA @0x00558a2d -> set_parent @0x00558a3e,
with SetChildren @0x00509370 hash-walking by guid — and neither set_parent
overload (@0x00515A90, @0x00515B50) nor enter_cell @0x00510ED0 contains any
player test or instance-sequence read. Our player/non-player split was purely
an artifact of keying relations by (guid, incarnation) against a wire message
that carries no parent incarnation. Late-binding to whoever currently holds the
guid is retail's own semantics. Fixed at BOTH producers: OnSpawn and
OnCreateParentAccepted, the second carrying the byte-identical defect and not
named in the contract's scope line.

THE INVARIANT IS EQUALITY, NOT FRESHNESS. The contract rejected both framings I
offered: every one of the 45 FullCellId liveness predicates excludes a
committed child on a NON-cell clause first, so the child inherits only the
parent record's existing staleness, which is already present today with no
symptom. The key fix alone restores child-equals-parent for every parent class.

TWO SITES GATED, inert only because the cell was zero and would have woken
wrongly: the hydration candidate loop (a nonzero-cell child would take the
legacy RebucketLiveEntity -> CommitRebucket, a second canonical writer — route
7's exact defect class) and RestoreShadow (would install a broadphase row for
the weapon, the #184 shape, contradicting route 7's P4). Retail anchor:
update_object's parent != 0 early-out @0x00515D40 — children are never
independently re-placed.

THREE MAJORS WERE FIXED BY DELETION. The first pass added a deferral queue for
an unaddressable parent, carrying a missing child-freshness gate (A2), a
sentinel-0 collision with the generation filters (A3), and unbounded
accumulation (A5). Both reviewers then proved the deferred branch unreachable
for BOTH producers — RegisterEntityCore defers the entire CreateObject one
layer above, reading the same ?? chain, and CreateParentUpdate is produced only
inside AcceptCreateCore, after that gate passes. The machinery was deleted
rather than repaired, and the diff SHRANK to 76 added / 13 removed from 91/24
while gaining the A1 fix. Retail confirmed the deletion does not diverge:
acdream's real port of retail's per-guid replay (QueueBlobForObject) is a
different, untouched layer, and the deleted queue was a third redundant one
downstream of it.

THE GUARD MUST NOT TEAR WHAT IT PROTECTS. The first pass threw
InvalidOperationException AFTER the canonical half had committed, so the one
time it fired it left the child parented with no committed relation and a
staged one blocking Resolve — a torn transaction, the exact outcome the
contract pinned against. Now a pure CanCommitIncarnation precondition checked
BEFORE the commit at both sites, with a logged refusal instead of a throw.
Route 3's N3 principle (do not make a transient fatal on a host that must
survive 30 sessions x 2 hours) reinforces it, but the tearing argument stands
alone.

TEST QUALITY, the recurring lesson in its most refined form. The A1 test
initially passed sabotage FOR THE WRONG REASON: a mismatched ChildPositionSequence
meant TryCommitParent's own gate refused in either ordering, so the three
assertions carrying A1's meaning passed both ways and only an incidental
staging assertion failed. It failed on stranding, not tearing. Corrected, the
sabotage now names line 925 — Assert.Null(snapshot.ParentGuid), with the
parent's guid in it — proving the canonical mutation happened before the catch.
"Fails under sabotage" is necessary, not sufficient; WHICH assertion fails is
the real question.

The dual parent-class matrix (player 0x5… incarnation > 1 vs creature 0x8…
incarnation 0, identical outcomes, sabotage-verified in both directions) is the
structural fix for how this survived a full dual review and two connected
sessions: every prior test and both captured gate logs used sequence-0 parents.

Register: AP-142 clause (f); AP-132 amended to distinguish the two producers;
new row AP-146 for the local player's coarse canonical cell (retail writes it
per tick at SetPositionInternal @0x00515330 — which, per the retail review, ALSO
walks this->children writing each child's objcell_id @0x005153AE-@0x005153D8,
so retail's per-tick child propagation lives in the same function). That
divergence had no row at all, a standing rule-1 violation now corrected.
Follow-up #320 filed for making the player's cell track ordinary movement —
deliberately excluded here: it touches the landblock-preserve contract, the
Rebucketed cadence, route-2/4b-3 classification inputs AP-136/AP-138 spent four
review rounds pinning, and the portal-space frozen-source-cell race.

Two dual review rounds; 6 architecture MAJORs and 2 retail MAJORs closed.
Diagnostic refusals are latched per child guid and the latch clears on
Clear()/RemoveChild, so a recycled guid's next incarnation still logs rather
than being silently suppressed.

Complete Release suite MEASURED at 11,112 passed / 4 skipped / 0 failed
(baseline 11,090 at 52175aa1, +22). Neither known flake fired.

STILL OWED: the connected gate, with the CORRECTED positive criterion — assert
the equipped child's FullCellId EQUALS the parent's after a crossing (a zero is
a failure, not a silence), run with BOTH a player and a creature parent, plus
the new step carrying an armed creature across a landblock unload/reload.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Runtime/Entities/ParentAttachmentState.cs

@@ -34,6 +34,19 @@ public sealed class ParentAttachmentState
     private readonly Dictionary<uint, Queue<DeferredAcceptedParentRelation>>
         _deferredAcceptedRelationsByParent = [];
     private ulong _nextDeferredCreateAdmissionId;
+    /// <summary>
+    /// #319 D3/B6 (retail + architecture review round 2, 2026-08-05):
+    /// per-child log-once latch for <see cref="CanCommitIncarnation"/>'s
+    /// refusal. The refusal should be structurally unreachable in
+    /// production; if the invariant it depends on ever breaks for a
+    /// repeating producer, an unconditional log would spam once per
+    /// packet on a host that must survive long endurance sessions (Slice
+    /// K4). One line per distinct child is enough to make the break
+    /// discoverable without a flood. Does not affect
+    /// <see cref="CanCommitIncarnation"/>'s correctness-table purity - it
+    /// touches only this bookkeeping set, never the relation tables.
+    /// </summary>
+    private readonly HashSet<uint> _loggedIncarnationRefusals = [];
 
     /// <summary>
     /// Round 5 R5-2: cancellation-aware detach/restore window state, shared
@@ -568,7 +581,59 @@ public sealed class ParentAttachmentState
         }
     }
 
-    public bool CommitProjection(ParentAttachmentRelation relation)
+    /// <summary>
+    /// #319 A1 (architecture review, 2026-08-05): pure, side-effect-free
+    /// precondition for the commit-time incarnation tripwire. Callable
+    /// BEFORE any canonical or relation-table mutation so a mismatch can be
+    /// refused without ever tearing a transaction — the original shape threw
+    /// from inside <see cref="CommitProjection"/>, which callers reached
+    /// AFTER already committing the canonical half
+    /// (<c>RuntimeEntityObjectLifetime.TryCommitParent</c>), leaving a child
+    /// the canonical layer believed was parented with no committed relation
+    /// and a staged relation blocking <see cref="Resolve"/> forever — the
+    /// exact torn-transaction outcome F1 pinned against. Logs and returns
+    /// <see langword="false"/> on a mismatch; never throws (Route 3's N3
+    /// principle: a possibly-transient condition must not become fatal on a
+    /// host that must survive long endurance sessions). Returns
+    /// <see langword="true"/> (no refusal) when
+    /// <paramref name="resolveParentInstance"/> is null or the parent is not
+    /// currently addressable — the tripwire only fires when the parent IS
+    /// live and DISAGREES with the relation's named incarnation.
+    /// </summary>
+    public bool CanCommitIncarnation(
+        ParentAttachmentRelation relation,
+        Func<uint, ushort?>? resolveParentInstance)
+    {
+        if (resolveParentInstance is null
+            || resolveParentInstance(relation.ParentGuid) is not { } liveParentInstance
+            || liveParentInstance == relation.ParentInstanceSequence)
+        {
+            return true;
+        }
+
+        if (_loggedIncarnationRefusals.Add(relation.ChildGuid))
+        {
+            Console.Error.WriteLine(
+                $"[parent-attach] refused: child=0x{relation.ChildGuid:X8} names " +
+                $"parent 0x{relation.ParentGuid:X8} incarnation " +
+                $"{relation.ParentInstanceSequence}, but the parent's live " +
+                $"incarnation is {liveParentInstance} (#319 tripwire). " +
+                "Logged once for this child; further refusals for the same " +
+                "child are suppressed.");
+        }
+        return false;
+    }
+
+    /// <summary>
+    /// Stages -&gt; committed transition for an accepted parent relation.
+    /// Calls <see cref="CanCommitIncarnation"/> as its own first check
+    /// (before any mutation here) so this method is non-tearing on its own
+    /// terms for ANY caller, in addition to the two production call sites
+    /// that also pre-check before their canonical commit.
+    /// </summary>
+    public bool CommitProjection(
+        ParentAttachmentRelation relation,
+        Func<uint, ushort?>? resolveParentInstance = null)
     {
         if (!_stagedByChild.TryGetValue(
                 relation.ChildGuid,
@@ -578,6 +643,9 @@ public sealed class ParentAttachmentState
             return false;
         }
 
+        if (!CanCommitIncarnation(relation, resolveParentInstance))
+            return false;
+
         RemoveCommittedChild(relation.ChildGuid);
         _lastAcceptedByChild[relation.ChildGuid] = relation;
         var parent = new ParentIncarnation(
@@ -794,6 +862,10 @@ public sealed class ParentAttachmentState
         _recoveryByChild.Remove(childGuid);
         RemoveCommittedChild(childGuid);
         _unresolvedByChild.Remove(childGuid);
+        // #319 D3/B6: a recycled guid's next incarnation deserves its own
+        // refusal log rather than silent suppression from a prior, now-dead
+        // incarnation's latch entry.
+        _loggedIncarnationRefusals.Remove(childGuid);
     }
 
     public void Clear()
@@ -812,6 +884,7 @@ public sealed class ParentAttachmentState
         foreach (List<uint> children in _committedChildrenByParent.Values)
             children.Clear();
         _committedChildrenByParent.Clear();
+        _loggedIncarnationRefusals.Clear();
     }
 
     private void RemoveDeferredChildCreates(uint childGuid)

src/AcDream.Runtime/Entities/RuntimeEntityObjectLifetime.cs

@@ -1528,7 +1528,15 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         // @0x00515AC6 parent = ...; @0x00515AD1 if (parent->cell != 0)
         // @0x00515AD6 change_cell(this, parent->cell). The committed
         // relation (not the guid alone) resolves the parent so a stale or
-        // superseded incarnation can never re-cell the child.
+        // superseded incarnation can never re-cell the child. (Retail
+        // review R4, 2026-08-05: this protection is ACTIVE for the
+        // ParentEvent producer, whose incarnation the wire names and
+        // AP-132 gates on staleness. For the CreateObject producer, #319's
+        // fix makes the committed relation's incarnation always equal the
+        // parent's live value at commit time by construction - the
+        // commit-time tripwire in ParentAttachmentState.CanCommitIncarnation
+        // enforces it - so this sentence is vacuous-by-design there, not a
+        // live protection against a reachable staleness.)
         if (Entities.ParentAttachments.TryGetCommittedParent(
                 canonical.ServerGuid,
                 out uint parentGuid,

src/AcDream.Runtime/Session/RuntimeLiveEntitySessionController.cs

@@ -405,9 +405,20 @@ public sealed class RuntimeLiveEntitySessionController
             return false;
         }
 
+        // #319 A1 (architecture review, 2026-08-05): same ordering fix as
+        // the graphical host's PrepareAndTryRealize - the incarnation
+        // tripwire must run before TryCommitParent's canonical mutation,
+        // never after, so a mismatch refuses cleanly instead of tearing the
+        // transaction.
+        if (!relations.CanCommitIncarnation(staged, _resolveParentInstance))
+        {
+            relations.RejectProjection(staged);
+            return false;
+        }
+
         ulong positionAuthorityVersion = canonical.PositionAuthorityVersion;
         if (!Entities.TryCommitParent(staged, acknowledgeProjection: null, out _)
-            || !relations.CommitProjection(staged))
+            || !relations.CommitProjection(staged, _resolveParentInstance))
         {
             return false;
         }