fix(streaming): derive the portal reveal window from the live streaming radii (#280)

The user watched far terrain visibly assemble after portal space exits.
The reveal gate was NOT missing a hold — Slice E's hold mechanism is
correct and already in place. The hold was measuring the wrong domain:
it opened at a hardcoded 3x3 landblock neighbourhood (~192 m) while the
visible world extends to the fog end (~2,189 m at the shipped High
preset, inside a 2,304 m Far window). An 11.4:1 ratio.

Retail's equivalent ratio is 1:1 BY CONSTRUCTION. `LScape` owns one
`mid_width x mid_width` array of `CLandBlock*` (`LScape::SetMidRadius`
@0x00504C00, `LScape::update_block` @0x005063A0), `mid_radius` is
assigned directly from the user's `Render.LandscapeDrawDistance`
preference (`SmartBox::SetRegion` @0x004531F0; values
`Render_LandscapeDrawDistance_Values` @0x007CA988 = {3,5,8,11,15,25},
default 8 — both byte-verified against the PDB-paired 2013 binary), and
that same square is simultaneously the prefetched set
(`LScape::PreFetchCells` @0x00505660), the drawn set (`block_draw_list`
over the same array), and the set the simulation blocks on
(`CellManager::blocking_for_cells`). There is no retail configuration in
which the client streams farther than it gates, because there is only
one number.

So the fix derives rather than duplicates. Four coupled parts, which is
why this is one commit and not four — D1 without D2 hangs the client and
D2 without D1 is dead code:

D1 `WorldRevealReadinessBarrier` takes a live `Func<StreamingRevealWindow>`
and stops being static: outdoor requires `FarRadius`, indoor still 0
(retail's `CEnvCell::PreFetchCells` @0x0052D1E0 arm). Read per
evaluation, never captured — the radii are runtime mutable through
Settings, and retail's answer to a mid-hold radius change is to reset,
re-radius, and re-arm the blocking prefetch at the NEW value
(`SmartBox::set_mid_radius` @0x00453180). `OutdoorNeighborhoodRadius`
is deleted; there is no constant left to drift.

D2 `StreamingController.IsRenderNeighborhoodResident` becomes tiered,
because acdream's loaded landscape is: inside `NearRadius`,
`IsNearTier && IsRenderReady`; out to `FarRadius`, `IsRenderReady` only.
Without this the fix cannot work at all — nothing outside the Near ring
is ever promoted, so any radius above `NearRadius` was unsatisfiable and
would have held the reveal forever. Proof obligation P1 (a Far-tier
landblock genuinely satisfies `IsRenderReady`) is now a test driven
through the real `PublicationKind.Far` pipeline against a real
`LandblockSpawnAdapter`, not an inference.

D7 `RuntimeWorldTransitState.AcknowledgeDestinationReadiness` re-derived
`indoor ? 0 : 1` and failed `invalid-readiness-shape` on any other
value, so changing the radius alone would have looked like "the fix
hangs the client". It is now a SHAPE invariant (`indoor => 0`,
`outdoor => >= 1`). Runtime does not own the graphical host's streaming
configuration and must not learn it; plumbing App radii into Runtime to
preserve the strict equality is exactly the assert-a-mechanism-that-does-
not-exist failure C5b was built to stop. Both non-graphical producers
keep emitting their centre-ring token and stay legal, annotated in place.

D6 `PhysicsEngine.IsNeighborhoodTerrainResident` rebuilt a full-map
`HashSet` on every call, every frame of every hold. At radius 1 that was
invisible; at radius 12 (625 ring members) it violates Slice I1's
0 B/resolve standard. Now an engine-owned scratch set, cleared in place;
measured at 0 bytes over 1,000 warmed radius-12 queries.

Also: the destination reservation opens at exactly the gate's radius and
reopens on the same generation when the radius changes mid-hold (retail
has one square for both, and no concept of prioritising an inner ring
differently). Composite warmup deliberately stays `NearRadius`-scoped —
the composite domain is entity-scoped and Far builds carry no entities,
so widening it would walk the outer window to warm nothing.
`ACDREAM_PROBE_REVEAL_RADIUS` is a measurement probe in a diagnostic
owner (CLAUDE.md rule 5) so the connected route can be run A/B on one
binary; it is NOT a user-facing prefetch knob, since a low setting would
reintroduce the decoupling this slice exists to close.

Register: AD-2 amended with the derived window, the two-tier split, and
the four new retail anchors. AP-149 FILED for the residual this does not
close — the outer ring accepts terrain-only publication where retail
requires LandBlockInfo and every building EnvCell, so a distant building
can still pop in at Far-ring distances. Do not let a later closeout
claim parity.

Docs: `ACDREAM_STREAM_RADIUS`'s CLAUDE.md description was wrong on every
clause (the default is unset, not 2; it forces `NearRadius`; it is
silently discarded by any Settings save) — corrected, since that is the
file every session reads. `reference_two_tier_streaming.md` corrected in
four ways, including "Far tier = terrain only": Far also publishes
terrain COLLISION, which is precisely what makes this fix viable.
#280's issue text had the right conclusion from a wrong premise (it
names a view-distance setting acdream does not have) — corrected, and
the missing Viewing Distance option filed separately as #326, with #327
(DDD progress readout) and #328 (hardcoded 5000 f far plane vs retail's
byte-verified 4000) filed alongside.

Expect LONGER holds and the "In Portal Space - Please Wait..." cue on
recalls MORE often. That is convergence toward retail, not away from it:
retail emits the byte-identical string for the whole duration of a
blocked prefetch and polls at 5 s intervals. The failure condition is
non-convergence, not duration.

Gates: Release build 0 errors. Complete suite 11,178 passed / 4 skipped
/ 0 failed, against a re-measured 11,142 / 4 / 0 baseline at 9ee9c1a1 —
+36, reconciled exactly as 36 new tests (App +23, Runtime +10, Core +3),
zero deleted, zero newly skipped. Nine discriminating tests
sabotage-verified in both directions. The connected/visual gate is
batched into C5's matrix; its recipe, its three positive artifacts, and
its required recall leg are written into the campaign plan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/AcDream.App/Composition/SessionPlayerComposition.cs

@@ -370,6 +370,15 @@ internal sealed class SessionPlayerCompositionPhase
             foundation.TextureCache.SetDestinationRevealUploadPriority);
         var worldReveal = new WorldRevealCoordinator(
             live.WorldTransit,
+            // #280: read the radii LIVE from the streaming controller rather
+            // than capturing them here. They are runtime mutable through
+            // Settings (StreamingController.ReconfigureRadii), and retail
+            // re-arms the blocking prefetch at the new radius on a mid-hold
+            // change (SmartBox::set_mid_radius @0x00453180).
+            () => StreamingDiagnostics.ApplyRevealRadiusOverride(
+                new StreamingRevealWindow(
+                    streaming.NearRadius,
+                    streaming.FarRadius)),
             streaming.IsRenderNeighborhoodResident,
             d.PhysicsEngine.IsSpawnCellReady,
             d.PhysicsEngine.IsNeighborhoodTerrainResident,

src/AcDream.App/Streaming/StreamingController.cs

@@ -217,17 +217,38 @@ public sealed class StreamingController
     internal bool IsCollapsedToDungeon => _collapsed;
 
     /// <summary>
-    /// True once every in-bounds landblock in the requested Chebyshev ring has
-    /// crossed the render-thread publication barrier. Worker completion and
+    /// True once every in-bounds landblock in the requested Chebyshev window
+    /// has crossed the render-thread publication barrier. Worker completion and
     /// world-state registration are not sufficient: all static GfxObj and
     /// EnvCell shell meshes must have completed their render-thread upload.
     /// Portal-space exit uses this alongside physics residency so the world
     /// cannot be revealed while its render slots are still absent.
+    ///
+    /// <para>
+    /// #280: the window is TIERED, because acdream's loaded landscape is.
+    /// Members inside <paramref name="nearRadius"/> must be Near-tier — the
+    /// full publication retail's <c>LScape::PreFetchCells</c> @0x00505660
+    /// demands (terrain record, LandBlockInfo, building EnvCells). Members out
+    /// to <paramref name="farRadius"/> need only their Far-tier terrain
+    /// publication to be drawable, which is what the user actually sees out
+    /// there. Requiring Near tier across the whole window would be
+    /// unsatisfiable: nothing outside the Near ring is ever promoted, so the
+    /// reveal would hold forever.
+    /// </para>
     /// </summary>
-    public bool IsRenderNeighborhoodResident(uint cellOrLandblockId, int radius)
+    public bool IsRenderNeighborhoodResident(
+        uint cellOrLandblockId,
+        int nearRadius,
+        int farRadius)
     {
-        if (radius < 0)
-            throw new ArgumentOutOfRangeException(nameof(radius));
+        if (nearRadius < 0)
+            throw new ArgumentOutOfRangeException(nameof(nearRadius));
+        if (farRadius < nearRadius)
+        {
+            throw new ArgumentOutOfRangeException(
+                nameof(farRadius),
+                "Far radius must be greater than or equal to near radius.");
+        }
 
         // LandDefs::InboundValidCellId validates both map axes and the low-word
         // class (outdoor cell, EnvCell, or canonical landblock sentinel).
@@ -235,18 +256,26 @@ public sealed class StreamingController
             return false;
         int cx = (int)((cellOrLandblockId >> 24) & 0xFFu);
         int cy = (int)((cellOrLandblockId >> 16) & 0xFFu);
-        for (int dx = -radius; dx <= radius; dx++)
-        for (int dy = -radius; dy <= radius; dy++)
+        for (int dx = -farRadius; dx <= farRadius; dx++)
+        for (int dy = -farRadius; dy <= farRadius; dy++)
         {
             int nx = cx + dx;
             int ny = cy + dy;
             // Match PhysicsEngine.IsNeighborhoodTerrainResident: the outer
-            // 0xFF coordinate has no loadable neighbour beyond it.
+            // 0xFF coordinate has no loadable neighbour beyond it. Retail skips
+            // the same way (LScape::PreFetchCells' >= 0x7F8 bounds test).
             if (nx < 0 || nx > 254 || ny < 0 || ny > 254)
                 continue;
 
             uint canonical = ((uint)nx << 24) | ((uint)ny << 16) | 0xFFFFu;
-            if (!_state.IsNearTier(canonical) || !_state.IsRenderReady(canonical))
+            // GpuWorldState.IsRenderReady already implies IsLoaded; a Far-tier
+            // publication registers with the spawn adapter and an empty mesh
+            // set, so this is a real drawability test out there, not a stamp.
+            if (!_state.IsRenderReady(canonical))
+                return false;
+            bool isInnerRing = Math.Abs(dx) <= nearRadius
+                && Math.Abs(dy) <= nearRadius;
+            if (isInnerRing && !_state.IsNearTier(canonical))
                 return false;
         }
 
@@ -691,6 +720,7 @@ public sealed class StreamingController
                 _destinationReservation is not null
                 && !IsRenderNeighborhoodResident(
                     DestinationLandblockId,
+                    Math.Min(NearRadius, DestinationRadius),
                     DestinationRadius);
             if (!ConvergePendingPublications(
                     preferDestination: destinationPublicationIncomplete))

src/AcDream.App/Streaming/StreamingDiagnostics.cs

@@ -0,0 +1,56 @@
+using System;
+
+namespace AcDream.App.Streaming;
+
+/// <summary>
+/// Diagnostic owner for the streaming/reveal probe family (CLAUDE.md Code
+/// Structure Rules §5 — one static class per subsystem, typed properties read
+/// from the environment once at startup, never per-call-site
+/// <c>GetEnvironmentVariable</c> reads).
+/// </summary>
+internal static class StreamingDiagnostics
+{
+    /// <summary>
+    /// #280 A/B measurement probe. When set, the outdoor reveal gate uses this
+    /// landblock radius instead of the derived streaming window, so the same
+    /// binary can run the connected route once with the pre-fix behaviour
+    /// (<c>ACDREAM_PROBE_REVEAL_RADIUS=1</c>, the old
+    /// <c>OutdoorNeighborhoodRadius</c>) and once without. It is NOT a user
+    /// setting: it is not surfaced in Settings, not persisted, and not part of
+    /// <c>RuntimeOptions</c>. A shipped prefetch knob would re-expose exactly
+    /// the reveal-window/visible-window decoupling #280 exists to close.
+    /// Unset or unparseable leaves the derivation in charge.
+    /// </summary>
+    public static int? RevealRadiusOverride { get; } =
+        ParseRadius(
+            Environment.GetEnvironmentVariable("ACDREAM_PROBE_REVEAL_RADIUS"));
+
+    /// <summary>
+    /// Applies <see cref="RevealRadiusOverride"/> to a live streaming window.
+    /// </summary>
+    public static StreamingRevealWindow ApplyRevealRadiusOverride(
+        StreamingRevealWindow window) =>
+        ApplyRevealRadiusOverride(window, RevealRadiusOverride);
+
+    /// <summary>
+    /// Pure override application, separated so the clamp is testable without
+    /// mutating process-wide diagnostic state. The near radius is clamped to
+    /// the (possibly overridden) far radius: the gate's inner arm demands
+    /// Near-tier publication, so it can never exceed the outer arm.
+    /// </summary>
+    public static StreamingRevealWindow ApplyRevealRadiusOverride(
+        StreamingRevealWindow window,
+        int? overrideRadius)
+    {
+        if (overrideRadius is not { } radius)
+            return window;
+
+        int far = Math.Max(0, radius);
+        return new StreamingRevealWindow(
+            Math.Clamp(window.NearRadius, 0, far),
+            far);
+    }
+
+    private static int? ParseRadius(string? raw) =>
+        int.TryParse(raw, out int value) && value >= 0 ? value : null;
+}

src/AcDream.App/Streaming/WorldRevealCoordinator.cs

@@ -43,7 +43,15 @@ internal sealed class WorldRevealCoordinator
         in WorldGenerationQuiescenceEdge quiescenceEdge)
     {
         public RuntimeWorldHostProjectionToken Token { get; } = token;
-        public int RequiredRenderRadius { get; } = requiredRenderRadius;
+
+        /// <summary>
+        /// The radius this projection's streaming reservation is currently
+        /// open at. Mutable because the quality preset can be changed
+        /// mid-hold; retail re-arms the blocking prefetch at the new radius
+        /// (<c>SmartBox::set_mid_radius</c> @0x00453180) rather than finishing
+        /// the old hold at the old one.
+        /// </summary>
+        public int RequiredRenderRadius { get; set; } = requiredRenderRadius;
         public WorldGenerationQuiescenceEdge QuiescenceEdge { get; } =
             quiescenceEdge;
         public bool QuiescenceCommitted { get; set; }
@@ -65,7 +73,8 @@ internal sealed class WorldRevealCoordinator
 
     public WorldRevealCoordinator(
         RuntimeWorldTransitState transit,
-        Func<uint, int, bool> isRenderNeighborhoodReady,
+        Func<StreamingRevealWindow> revealWindow,
+        Func<uint, int, int, bool> isRenderNeighborhoodReady,
         Func<uint, bool> isSpawnCellReady,
         Func<uint, int, bool> isTerrainNeighborhoodReady,
         Func<bool> areCompositeTexturesReady,
@@ -78,6 +87,7 @@ internal sealed class WorldRevealCoordinator
     {
         _transit = transit ?? throw new ArgumentNullException(nameof(transit));
         _readiness = new WorldRevealReadinessBarrier(
+            revealWindow,
             isRenderNeighborhoodReady,
             isSpawnCellReady,
             isTerrainNeighborhoodReady,
@@ -164,8 +174,7 @@ internal sealed class WorldRevealCoordinator
 
         _hostProjections.Add(new HostProjection(
             token,
-            WorldRevealReadinessBarrier.RequiredRenderRadius(
-                destinationCell),
+            _readiness.RequiredRenderRadius(destinationCell),
             quiescenceEdge));
         RetryPendingHostWork();
     }
@@ -184,6 +193,7 @@ internal sealed class WorldRevealCoordinator
     {
         RetryPendingHostWork();
         WorldRevealReadinessSnapshot snapshot = _readiness.Evaluate(destinationCell);
+        ReconcileDestinationReservationRadius(snapshot);
         RuntimePortalSnapshot portal = _transit.Snapshot;
         if (portal.Generation != 0)
         {
@@ -499,6 +509,39 @@ internal sealed class WorldRevealCoordinator
                 .DestinationReservationReleased);
     }
 
+    /// <summary>
+    /// Keeps the open destination reservation on the same square the gate is
+    /// measuring after a mid-hold quality change. Retail's
+    /// <c>SmartBox::set_mid_radius</c> @0x00453180 resets the cell manager,
+    /// re-radiuses the landscape, and re-arms the blocking prefetch at the NEW
+    /// value; acdream's equivalent is to close and reopen the reservation on
+    /// the same reveal generation. <c>EndDestinationReservation</c> already
+    /// refuses a generation mismatch, so the reopen is generation-safe.
+    /// </summary>
+    private void ReconcileDestinationReservationRadius(
+        in WorldRevealReadinessSnapshot snapshot)
+    {
+        if (_streaming is null || !snapshot.HasDestination)
+            return;
+
+        HostProjection? host = FindCurrentHostProjection();
+        if (host is null
+            || !host.StreamingRegistered
+            || host.StreamingReleased
+            || host.Token.DestinationCell != snapshot.DestinationCell
+            || host.RequiredRenderRadius == snapshot.RequiredRenderRadius)
+        {
+            return;
+        }
+
+        _streaming.EndDestinationReservation(host.Token.Generation);
+        _streaming.BeginDestinationReservation(
+            host.Token.Generation,
+            host.Token.DestinationCell,
+            snapshot.RequiredRenderRadius);
+        host.RequiredRenderRadius = snapshot.RequiredRenderRadius;
+    }
+
     private void WithdrawHostForReplacement()
     {
         HostProjection? host = FindCurrentHostProjection();

src/AcDream.App/Streaming/WorldRevealReadinessBarrier.cs

@@ -1,5 +1,23 @@
 namespace AcDream.App.Streaming;
 
+/// <summary>
+/// The live landblock window the reveal gate measures. Retail has exactly one
+/// landscape square — <c>LScape::mid_radius</c>, assigned directly from the
+/// user's <c>Render.LandscapeDrawDistance</c> preference
+/// (<c>SmartBox::SetRegion</c> @0x004531F0;
+/// <c>Render_LandscapeDrawDistance_Values</c> @0x007CA988 = {3,5,8,11,15,25},
+/// default 8) — and that same square is simultaneously the loaded set, the
+/// drawn set, and the set <c>LScape::PreFetchCells</c> @0x00505660 blocks on.
+/// acdream splits the loaded landscape into a Near tier (full publication) and
+/// a Far tier (terrain render + terrain collision), so the reveal window is a
+/// pair rather than a single number; <see cref="FarRadius"/> is the structural
+/// analogue of retail's <c>mid_radius</c> because it bounds everything the
+/// user can see (fog end is <c>FarRadius * 192 m * 0.95</c>).
+/// </summary>
+internal readonly record struct StreamingRevealWindow(
+    int NearRadius,
+    int FarRadius);
+
 /// <summary>
 /// One evaluation of the destination domains guarded by
 /// <see cref="WorldRevealReadinessBarrier"/>. Keeping the individual facts in
@@ -11,6 +29,7 @@ internal readonly record struct WorldRevealReadinessSnapshot(
     bool IsIndoor,
     bool IsUnhydratable,
     int RequiredRenderRadius,
+    int RequiredNearRadius,
     bool IsRenderNeighborhoodReady,
     bool AreCompositeTexturesReady,
     bool IsCollisionReady)
@@ -32,12 +51,21 @@ internal readonly record struct WorldRevealReadinessSnapshot(
 /// (<c>SmartBox::UseTime</c>, 0x00455410). acdream loads those domains
 /// asynchronously, so login and portal arrival must share this explicit
 /// equivalent of retail's single blocking-cell edge.
+///
+/// <para>
+/// #280: the outdoor gate is DERIVED from the live streaming window, never
+/// hardcoded. Retail cannot stream farther than it gates because it has only
+/// one number (<c>LScape::SetMidRadius</c> @0x00504C00 sets
+/// <c>mid_width = radius * 2 + 1</c> and <c>LScape::update_block</c>
+/// @0x005063A0 allocates exactly that array). A fixed reveal radius under a
+/// configurable streaming window reintroduces the decoupling the moment the
+/// preset changes, which is the whole defect.
+/// </para>
 /// </summary>
 internal sealed class WorldRevealReadinessBarrier
 {
-    internal const int OutdoorNeighborhoodRadius = 1;
-
-    private readonly Func<uint, int, bool> _isRenderNeighborhoodReady;
+    private readonly Func<StreamingRevealWindow> _revealWindow;
+    private readonly Func<uint, int, int, bool> _isRenderNeighborhoodReady;
     private readonly Func<uint, bool> _isSpawnCellReady;
     private readonly Func<uint, int, bool> _isTerrainNeighborhoodReady;
     private readonly Func<bool> _areCompositeTexturesReady;
@@ -46,7 +74,8 @@ internal sealed class WorldRevealReadinessBarrier
     private readonly Func<uint, bool> _isSpawnClaimUnhydratable;
 
     public WorldRevealReadinessBarrier(
-        Func<uint, int, bool> isRenderNeighborhoodReady,
+        Func<StreamingRevealWindow> revealWindow,
+        Func<uint, int, int, bool> isRenderNeighborhoodReady,
         Func<uint, bool> isSpawnCellReady,
         Func<uint, int, bool> isTerrainNeighborhoodReady,
         Func<bool> areCompositeTexturesReady,
@@ -54,6 +83,8 @@ internal sealed class WorldRevealReadinessBarrier
         Action invalidateCompositeTextures,
         Func<uint, bool> isSpawnClaimUnhydratable)
     {
+        _revealWindow = revealWindow
+            ?? throw new ArgumentNullException(nameof(revealWindow));
         _isRenderNeighborhoodReady = isRenderNeighborhoodReady
             ?? throw new ArgumentNullException(nameof(isRenderNeighborhoodReady));
         _isSpawnCellReady = isSpawnCellReady
@@ -86,9 +117,20 @@ internal sealed class WorldRevealReadinessBarrier
         if (destinationCell == 0 || _isSpawnClaimUnhydratable(destinationCell))
             return;
 
-        int radius = RequiredRenderRadius(destinationCell);
-        if (_isRenderNeighborhoodReady(destinationCell, radius))
-            _prepareCompositeTextures(destinationCell, radius);
+        StreamingRevealWindow required = RequiredWindow(destinationCell);
+        if (_isRenderNeighborhoodReady(
+                destinationCell,
+                required.NearRadius,
+                required.FarRadius))
+        {
+            // D3: the composite domain is entity-scoped
+            // (WbDrawDispatcher.IsCompositeWarmupCandidate filters entities by
+            // Chebyshev landblock radius) and Far-tier builds carry no
+            // entities at all (LandblockBuildFactory), so the honest composite
+            // domain is the NEAR radius. Widening it over Far rings would walk
+            // the whole outer window to warm nothing.
+            _prepareCompositeTextures(destinationCell, required.NearRadius);
+        }
     }
 
     /// <summary>
@@ -110,38 +152,76 @@ internal sealed class WorldRevealReadinessBarrier
             return default;
 
         bool isIndoor = IsIndoor(destinationCell);
-        int radius = RequiredRenderRadius(destinationCell);
+        StreamingRevealWindow required = RequiredWindow(destinationCell);
         if (_isSpawnClaimUnhydratable(destinationCell))
         {
             return new WorldRevealReadinessSnapshot(
                 destinationCell,
                 isIndoor,
                 IsUnhydratable: true,
-                radius,
+                required.FarRadius,
+                required.NearRadius,
                 IsRenderNeighborhoodReady: false,
                 AreCompositeTexturesReady: false,
                 IsCollisionReady: false);
         }
 
-        bool renderReady = _isRenderNeighborhoodReady(destinationCell, radius);
+        bool renderReady = _isRenderNeighborhoodReady(
+            destinationCell,
+            required.NearRadius,
+            required.FarRadius);
         bool compositesReady = renderReady && _areCompositeTexturesReady();
         bool collisionReady = renderReady && compositesReady
             && (isIndoor
                 ? _isSpawnCellReady(destinationCell)
-                : _isTerrainNeighborhoodReady(destinationCell, radius));
+                : _isTerrainNeighborhoodReady(
+                    destinationCell,
+                    required.FarRadius));
 
         return new WorldRevealReadinessSnapshot(
             destinationCell,
             isIndoor,
             IsUnhydratable: false,
-            radius,
+            required.FarRadius,
+            required.NearRadius,
             renderReady,
             compositesReady,
             collisionReady);
     }
 
-    internal static int RequiredRenderRadius(uint destinationCell) =>
-        IsIndoor(destinationCell) ? 0 : OutdoorNeighborhoodRadius;
+    /// <summary>
+    /// The window this destination must satisfy, read LIVE from the streaming
+    /// configuration on every call. Retail's answer to a mid-hold radius
+    /// change is <c>SmartBox::set_mid_radius</c> @0x00453180: reset the cell
+    /// manager, re-radius the landscape, and re-arm the blocking prefetch at
+    /// the NEW value — never finish the old hold at the old radius.
+    ///
+    /// <para>
+    /// Indoor destinations take retail's EnvCell arm
+    /// (<c>CEnvCell::PreFetchCells</c> @0x0052D1E0), which walks the cell's own
+    /// visible-cell graph rather than the landscape square, so the outdoor
+    /// ring is not required and the radius is zero.
+    /// </para>
+    /// </summary>
+    internal StreamingRevealWindow RequiredWindow(uint destinationCell)
+    {
+        if (IsIndoor(destinationCell))
+            return new StreamingRevealWindow(0, 0);
+
+        StreamingRevealWindow window = _revealWindow();
+        int far = Math.Max(0, window.FarRadius);
+        int near = Math.Clamp(window.NearRadius, 0, far);
+        return new StreamingRevealWindow(near, far);
+    }
+
+    /// <summary>
+    /// The outdoor gate's outer radius — retail's <c>mid_radius</c>. Callers
+    /// that reserve destination streaming capacity must use exactly this value
+    /// so the prefetch square and the blocked square stay identical, as they
+    /// are in retail by construction.
+    /// </summary>
+    internal int RequiredRenderRadius(uint destinationCell) =>
+        RequiredWindow(destinationCell).FarRadius;
 
     private static bool IsIndoor(uint cellId) => (cellId & 0xFFFFu) >= 0x0100u;
 }

src/AcDream.Core/Physics/PhysicsEngine.cs

@@ -45,6 +45,12 @@ public sealed class PhysicsEngine
         _collisionWorld.Current.LandblockFreeSlots;
     private readonly TransitionScratchArena? _transitionScratch;
 
+    // #280 (D6): reusable landblock-prefix scratch for
+    // IsNeighborhoodTerrainResident. Physics is single-threaded per engine and
+    // this method is a leaf, so one instance-owned set is safe and keeps the
+    // per-frame reveal gate allocation-free.
+    private readonly HashSet<uint> _terrainResidencyScratch = new();
+
     public PhysicsEngine()
         : this(reuseTransitionScratch: true)
     {
@@ -128,7 +134,17 @@ public sealed class PhysicsEngine
     /// </summary>
     public bool IsNeighborhoodTerrainResident(uint cellOrLandblockId, int radius)
     {
-        var resident = new HashSet<uint>();
+        // #280 (D6): this runs every frame for the whole duration of a reveal
+        // hold, and the hold's radius is now the streaming Far radius (12 at
+        // the shipped High preset = 625 ring members) instead of 1. Building a
+        // fresh HashSet per call would allocate on every frame of every hold,
+        // against Slice I1's 0 B standard. The scratch set is owned by this
+        // engine, cleared and refilled in place, so a warmed call allocates
+        // nothing; the prefix-masked membership semantics are unchanged
+        // (callers register landblocks under canonical, cell-resolved, or bare
+        // ids and this gate has always compared on the high 16 bits).
+        HashSet<uint> resident = _terrainResidencyScratch;
+        resident.Clear();
         foreach ((uint key, _) in _landblocks)
             resident.Add(key & 0xFFFF0000u);
 

src/AcDream.Headless/Hosting/HeadlessSessionWorldProjection.cs

@@ -970,6 +970,12 @@ internal sealed class HeadlessSessionWorldProjection
             // concept, derive the real predicate here instead of leaving
             // this hardcoded.
             IsUnhydratable: false,
+            // #280: this "centre ring" token is NOT the graphical host's
+            // derived reveal radius and must not be made to track it. This
+            // host has no streaming window, no render publication and no
+            // composites, so there is nothing wider for a radius to mean
+            // here. Runtime validates only the SHAPE (indoor => 0,
+            // outdoor => >= 1), which this satisfies by construction.
             RequiredRenderRadius: indoor ? 0 : 1,
             IsRenderNeighborhoodReady: true,
             AreCompositeTexturesReady: true,

src/AcDream.Runtime/Session/RuntimeLiveEntitySessionController.cs

@@ -773,6 +773,12 @@ public sealed class RuntimeLiveEntitySessionController
                 destination.CellId,
                 indoor,
                 IsUnhydratable: false,
+                // #280: this "centre ring" token is NOT the graphical host's
+                // derived reveal radius and must not be made to track it. This
+                // host has no streaming window, no render publication and no
+                // composites, so there is nothing wider for a radius to mean
+                // here. Runtime validates only the SHAPE (indoor => 0,
+                // outdoor => >= 1), which this satisfies by construction.
                 RequiredRenderRadius: indoor ? 0 : 1,
                 IsRenderNeighborhoodReady: true,
                 AreCompositeTexturesReady: true,

src/AcDream.Runtime/World/RuntimeWorldTransitState.cs

@@ -569,18 +569,30 @@ public sealed class RuntimeWorldTransitState
         if (_snapshot.Readiness.IsReady)
             return false;
 
+        // #280: this is a SHAPE invariant, not a value invariant. Runtime owns
+        // the canonical reveal lifetime; it does not own — and must never
+        // learn — the graphical host's streaming configuration. The outdoor
+        // radius is now derived from that host's live Near/Far window
+        // (WorldRevealReadinessBarrier.RequiredWindow), so re-encoding a
+        // literal here would assert a mechanism that no longer exists and fail
+        // every graphical acknowledgement. What remains genuinely invariant,
+        // and is still worth failing on, is the shape: an indoor destination
+        // takes retail's EnvCell arm and requires no landscape ring at all,
+        // while an outdoor destination must require at least its own
+        // landblock's ring. The no-window host has no streaming window, so its
+        // "centre ring" token (indoor ? 0 : 1) stays legal by construction.
         bool isIndoor = IsIndoor(acknowledgement.DestinationCell);
-        int requiredRenderRadius = isIndoor ? 0 : 1;
-        if (acknowledgement.IsIndoor != isIndoor
-            || acknowledgement.RequiredRenderRadius
-                != requiredRenderRadius)
+        bool radiusShapeValid = isIndoor
+            ? acknowledgement.RequiredRenderRadius == 0
+            : acknowledgement.RequiredRenderRadius >= 1;
+        if (acknowledgement.IsIndoor != isIndoor || !radiusShapeValid)
         {
             FailInvariant(
                 "invalid-readiness-shape",
                 $"indoor={acknowledgement.IsIndoor} "
                 + $"expectedIndoor={isIndoor} "
                 + $"radius={acknowledgement.RequiredRenderRadius} "
-                + $"expectedRadius={requiredRenderRadius}");
+                + $"expectedRadius={(isIndoor ? "0" : ">=1")}");
             return false;
         }