fix(physics): bind a parented child to the parent's live incarnation (#319)

A player-parented child never received a canonical cell. Its FullCellId stayed
0 for its whole attached lifetime, so it could not follow the player across a
boundary. Scope was wider than the local player: every REMOTE player's
equipment too.

ROOT CAUSE. EquippedChildRenderController hardcoded ParentInstanceSequence: 0
for a parented CreateObject. Correct for creatures and statics, which really
are sequence 0; wrong for players, whose ObjectInstance is Character.TotalLogins
(ACE Player_Networking.cs:37). The relation filed under (playerGuid, 0) while
the record carried TotalLogins, so both route-7 write sites — D1's attach
re-cell and D2's propagation lookup — keyed on an incarnation that never
matched. TryCommitParent did not validate the sequence, so the attach
succeeded and printed normally. Silent.

A ROUTE 7 REGRESSION (cd3129e9) that un-masked a latent bug: the TickChild call
route 7 deleted was keyed on the child guid alone and was structurally immune
to a wrong parent key.

THE FIX IS TO STOP TREATING PLAYERS DIFFERENTLY, not to special-case them.
Retail's attach path is guid-only end to end — PhysicsDesc::get_parent_id
@0x00558a18 -> CObjectMaint::GetObjectA @0x00558a2d -> set_parent @0x00558a3e,
with SetChildren @0x00509370 hash-walking by guid — and neither set_parent
overload (@0x00515A90, @0x00515B50) nor enter_cell @0x00510ED0 contains any
player test or instance-sequence read. Our player/non-player split was purely
an artifact of keying relations by (guid, incarnation) against a wire message
that carries no parent incarnation. Late-binding to whoever currently holds the
guid is retail's own semantics. Fixed at BOTH producers: OnSpawn and
OnCreateParentAccepted, the second carrying the byte-identical defect and not
named in the contract's scope line.

THE INVARIANT IS EQUALITY, NOT FRESHNESS. The contract rejected both framings I
offered: every one of the 45 FullCellId liveness predicates excludes a
committed child on a NON-cell clause first, so the child inherits only the
parent record's existing staleness, which is already present today with no
symptom. The key fix alone restores child-equals-parent for every parent class.

TWO SITES GATED, inert only because the cell was zero and would have woken
wrongly: the hydration candidate loop (a nonzero-cell child would take the
legacy RebucketLiveEntity -> CommitRebucket, a second canonical writer — route
7's exact defect class) and RestoreShadow (would install a broadphase row for
the weapon, the #184 shape, contradicting route 7's P4). Retail anchor:
update_object's parent != 0 early-out @0x00515D40 — children are never
independently re-placed.

THREE MAJORS WERE FIXED BY DELETION. The first pass added a deferral queue for
an unaddressable parent, carrying a missing child-freshness gate (A2), a
sentinel-0 collision with the generation filters (A3), and unbounded
accumulation (A5). Both reviewers then proved the deferred branch unreachable
for BOTH producers — RegisterEntityCore defers the entire CreateObject one
layer above, reading the same ?? chain, and CreateParentUpdate is produced only
inside AcceptCreateCore, after that gate passes. The machinery was deleted
rather than repaired, and the diff SHRANK to 76 added / 13 removed from 91/24
while gaining the A1 fix. Retail confirmed the deletion does not diverge:
acdream's real port of retail's per-guid replay (QueueBlobForObject) is a
different, untouched layer, and the deleted queue was a third redundant one
downstream of it.

THE GUARD MUST NOT TEAR WHAT IT PROTECTS. The first pass threw
InvalidOperationException AFTER the canonical half had committed, so the one
time it fired it left the child parented with no committed relation and a
staged one blocking Resolve — a torn transaction, the exact outcome the
contract pinned against. Now a pure CanCommitIncarnation precondition checked
BEFORE the commit at both sites, with a logged refusal instead of a throw.
Route 3's N3 principle (do not make a transient fatal on a host that must
survive 30 sessions x 2 hours) reinforces it, but the tearing argument stands
alone.

TEST QUALITY, the recurring lesson in its most refined form. The A1 test
initially passed sabotage FOR THE WRONG REASON: a mismatched ChildPositionSequence
meant TryCommitParent's own gate refused in either ordering, so the three
assertions carrying A1's meaning passed both ways and only an incidental
staging assertion failed. It failed on stranding, not tearing. Corrected, the
sabotage now names line 925 — Assert.Null(snapshot.ParentGuid), with the
parent's guid in it — proving the canonical mutation happened before the catch.
"Fails under sabotage" is necessary, not sufficient; WHICH assertion fails is
the real question.

The dual parent-class matrix (player 0x5… incarnation > 1 vs creature 0x8…
incarnation 0, identical outcomes, sabotage-verified in both directions) is the
structural fix for how this survived a full dual review and two connected
sessions: every prior test and both captured gate logs used sequence-0 parents.

Register: AP-142 clause (f); AP-132 amended to distinguish the two producers;
new row AP-146 for the local player's coarse canonical cell (retail writes it
per tick at SetPositionInternal @0x00515330 — which, per the retail review, ALSO
walks this->children writing each child's objcell_id @0x005153AE-@0x005153D8,
so retail's per-tick child propagation lives in the same function). That
divergence had no row at all, a standing rule-1 violation now corrected.
Follow-up #320 filed for making the player's cell track ordinary movement —
deliberately excluded here: it touches the landblock-preserve contract, the
Rebucketed cadence, route-2/4b-3 classification inputs AP-136/AP-138 spent four
review rounds pinning, and the portal-space frozen-source-cell race.

Two dual review rounds; 6 architecture MAJORs and 2 retail MAJORs closed.
Diagnostic refusals are latched per child guid and the latch clears on
Clear()/RemoveChild, so a recycled guid's next incarnation still logs rather
than being silently suppressed.

Complete Release suite MEASURED at 11,112 passed / 4 skipped / 0 failed
(baseline 11,090 at 52175aa1, +22). Neither known flake fired.

STILL OWED: the connected gate, with the CORRECTED positive criterion — assert
the equipped child's FullCellId EQUALS the parent's after a crossing (a zero is
a failure, not a silence), run with BOTH a player and a creature parent, plus
the new step carrying an armed creature across a landblock unload/reload.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/World/LiveEntityHydrationControllerTests.cs

@@ -127,6 +127,77 @@ public sealed class LiveEntityHydrationControllerTests
         Assert.Equal(1, fixture.Ready.PublishCount);
     }
 
+    /// <summary>
+    /// #319 F2 (contract §3.1). Dual-parent-class matrix: a player-range
+    /// parent with a nonzero incarnation and a creature/static-range parent
+    /// at sequence 0. #319 existed precisely because every pre-existing
+    /// test in this file used only sequence-0 (non-player) parents - a
+    /// matrix in which the two classes could diverge silently is the
+    /// defect's habitat.
+    /// </summary>
+    [Theory]
+    [InlineData(0x50000123u, (ushort)7)]
+    [InlineData(0x70000099u, (ushort)0)]
+    public void CommittedChild_IsExcludedFromLandblockLoadCandidates(
+        uint parentGuid,
+        ushort parentInstanceSequence)
+    {
+        using var fixture = new Fixture(originKnown: true);
+        fixture.Controller.OnCreate(Spawn(Generation: 1, PositionSequence: 1));
+        LiveEntityRecord record = fixture.Record;
+        WorldEntity entity = record.WorldEntity!;
+
+        // Simulate the post-#319-fix state: a committed parent relation
+        // exists for this child (D1/D2, exercised elsewhere, would give it
+        // a nonzero canonical cell equal to the parent's). Pre-fix the
+        // relation DID commit for a player-class parent too - HasCommittedParent
+        // is child-keyed and CommitProjection succeeded under (playerGuid, 0)
+        // (retail review R3).
+        //
+        // The two InlineData rows differ in what was reachable PRE-fix
+        // (retail review round 2, D2 - qualified per parent class):
+        // - PLAYER row (0x50000123u): the relation committed under the
+        //   WRONG key (playerGuid, 0), so D1's `parent.Incarnation ==
+        //   parentInstanceSequence` gate never matched and the child's
+        //   FullCellId stayed 0 forever pre-fix - this candidate gate
+        //   this test exercises never saw a live population for this row
+        //   before the fix.
+        // - CREATURE row (0x70000099u): the hardcoded 0 genuinely MATCHES
+        //   a creature-class parent's real incarnation, so D1 already
+        //   passed pre-fix and this child ALREADY carried a nonzero
+        //   FullCellId at HEAD - this row's scenario was already LIVE
+        //   pre-fix, and the child was already a hydration candidate
+        //   taking the legacy RebucketLiveEntity path this gate now
+        //   excludes (contract §3.1's correction). Both rows exercise the
+        //   SAME gate; only their pre-fix reachability differs.
+        var relation = new ParentAttachmentRelation(
+            parentGuid,
+            Guid,
+            ParentLocation: 0,
+            PlacementId: 0,
+            parentInstanceSequence,
+            ChildPositionSequence: 1);
+        fixture.Runtime.ParentAttachments.AcceptCreateObjectRelation(relation);
+        Assert.True(fixture.Runtime.ParentAttachments.CommitProjection(relation));
+
+        // Decoy: the legacy RebucketLiveEntity branch below would overwrite
+        // this back to the canonical cell (0x01010001u, matching `Cell`) if
+        // this candidate were not excluded - see
+        // LiveEntityRuntime.RebucketLiveEntity's unconditional
+        // `entity.ParentCellId = spatialCellOrLandblockId` write.
+        entity.ParentCellId = 0x02020002u;
+
+        fixture.Controller.OnLandblockLoaded(Cell);
+
+        // #319 F2: a committed child is never independently re-placed by
+        // landblock load (retail's update_object `parent != 0` early-out,
+        // @0x00515D40) - the decoy must survive untouched. Sabotage:
+        // deleting the `HasCommittedParent` gate in
+        // LiveEntityHydrationController.OnLandblockLoaded makes this fail
+        // for BOTH rows (the decoy gets corrected back to 0x01010001u).
+        Assert.Equal(0x02020002u, entity.ParentCellId);
+    }
+
     [Fact]
     public void AppearanceAfterDeferredProjection_FirstMaterializesAndPublishesReady()
     {