erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

fix(headless): #365 — collision-admission-open window drove the first-entry conductor into a permanent seal refusal

Browse source 
Root cause (measured live via ACDREAM_PROBE_PARK=1): HeadlessSessionWorldProjection
drove the first-entry conductor unconditionally, including while
HeadlessCollisionNeighborhood's own 3x3 publication plan held a genuinely open
RuntimeCollisionAdmission for the local player's landblock. Every
TrySealCollisionEvaluationAuthority attempt during that window failed
(IsCollisionEvaluationPrefixAdmissible false) and retried forever without
recovering — measured verdict: "seal-refused" repeating with no preceding
[rearm] verdict= line (the operation never even reached the AwaitingCell park).
This is the diagnosis doc's "structural half" mechanism; no evidence of the
"circular HasOldPrefixPlacementDebt" hypothesis was observed, so that shape
was not needed.

Step 1 (enabler): HeadlessStaticStateAudit.ValidateProcessIsolation now takes
sessionCount and only refuses process-global physics probes for
sessionCount > 1 — its own multi-root-attribution rationale never applied to
a single session, and it was blocking the exact probe built to diagnose this
class of stall.

Step 3a (root cause): new IHeadlessCollisionNeighborhood.IsQuiescent gates
ProjectSpawn/ProjectPosition/PumpFirstEntry's conductor-drive calls — the
conductor is never driven while the neighborhood's own publication owns
collision authority for that tick.

Step 4 (defense-in-depth): HeadlessLocalPlayerFrameHost.CanAdvancePlayer now
requires Controller.CanExecuteLiveMovement instead of just a non-null
controller — the headless-only gap that turned the (now-fixed) hydration
stall into a hard crash reaching SuspendObjectUpdate on a dormant controller.
RuntimeLocalPlayerFrameController's three shared entry points gained the same
guard, contract-preserving for the graphical host.

Verified end-to-end against live ACE (jump-probe policy, three runs):
hydration succeeds cleanly (136 entities load vs. 0 before), no seal-refused
spam, no crash from the original bug, graceful logout every time. Full
airborne-transition confirmation is blocked by a separate, newly-discovered,
pre-existing defect filed as #368 (the headless scheduler's
Task.Delay(...).ConfigureAwait(false) tick loop can resume on a different
ThreadPool thread mid collision-generation, tripping
EnsureCollisionMutationThread) — explicitly out of scope here, not mentioned
anywhere in the #365 diagnosis, and unsafe to fix without graphical-host
verification this session was constrained not to perform.

New tests: the real-admission hydration test (fails on the pre-Step-3a tree,
verified by temporarily reverting the three gates and confirming failure,
then restoring), the PumpFirstEntry quiescence-gate test, the
CanAdvancePlayer publication-lifecycle test, the dormant-controller
sabotage tests for RuntimeLocalPlayerFrameController, and the audit
single/multi-session tests. RuntimeLocalPlayerPhysicsPublicationStateTests
is untouched.

Full Release suite: 12,343 passed / 4 skipped / 0 failed (baseline ~12,330/4
plus 11 new tests).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-08-10 11:34:36 +02:00
parent 6150327ea3
commit 41b408f3e6
10 changed files with 937 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

31
src/AcDream.Runtime/Gameplay/RuntimeLocalPlayerFrameController.cs
View file

@ -72,8 +72,18 @@ public sealed class RuntimeLocalPlayerFrameController
{
_advancedFrame = null;
PlayerMovementController? controller = _host.Controller;
if (!_host.CanAdvancePlayer || controller is null)
// #365 Step 4 hardening: a host whose CanAdvancePlayer check is
// looser than "published" (the exact defect this issue fixed for
// the headless host) still cannot reach a dormant controller here —
// contract-preserving for hosts (the graphical one) that already
// gate correctly, since a published controller's
// CanExecuteLiveMovement is always true.
if (!_host.CanAdvancePlayer
|| controller is null
|| !controller.CanExecuteLiveMovement)
{
return;
}
if (!float.IsFinite(deltaSeconds) || deltaSeconds <= 0f)
{
@ -132,8 +142,18 @@ public sealed class RuntimeLocalPlayerFrameController
public void RunPostNetworkCommandPhase()
{
PlayerMovementController? controller = _host.Controller;
if (!_host.CanAdvancePlayer || controller is null)
// #365 Step 4 hardening: a host whose CanAdvancePlayer check is
// looser than "published" (the exact defect this issue fixed for
// the headless host) still cannot reach a dormant controller here —
// contract-preserving for hosts (the graphical one) that already
// gate correctly, since a published controller's
// CanExecuteLiveMovement is always true.
if (!_host.CanAdvancePlayer
|| controller is null
|| !controller.CanExecuteLiveMovement)
{
return;
}
bool hidden = _host.IsHidden;
if (_advancedFrame is { } advanced
@ -163,8 +183,13 @@ public sealed class RuntimeLocalPlayerFrameController
{
frame = default;
PlayerMovementController? controller = _host.Controller;
if (!_host.CanAdvancePlayer || controller is null)
// #365 Step 4 hardening: see AdvanceBeforeNetwork's matching comment.
if (!_host.CanAdvancePlayer
|| controller is null
|| !controller.CanExecuteLiveMovement)
{
return false;
}
bool hidden = _host.IsHidden;
if (_advancedFrame is { } advanced