feat(physics): C4 route 4a — remote steady-state Position through the seam

Routes the classifier's two NO-PLACEMENT remote branches — Interpolate
(contact, PlayerDistance < 96 m) and NoPositionOperation (no contact) — through
a Runtime-owned seam, and fixes the two divergences they carried. Teleport,
far-snap and cell-less stay on the legacy App path; 4b owns them.

Route 4 was split into 4a/4b after scoping put the whole route at 1,500-2,500
lines against a ~400 budget. 4a's branches perform no SetPosition, so this slice
carries no deferred-cell park, no service-window guard and no allocation
exposure — which is what made the split worth doing.

Divergences fixed, both previously unfiled:

* D1 — the NPC airborne branch hard-snapped Body.Position/Orientation and
  branched on the client-tracked rmState.Airborne, never consulting the wire
  IsGrounded bit. Retail's MoveOrTeleport @0x00516330 returns 0 at 0x0051636D
  and writes nothing. Player remotes were already correct; NPCs were not.
* D2 — ConstrainTo was armed before the operation, unconditionally, so it fired
  on the airborne no-op retail skips and anchored to the PRE-move position.
  Retail arms it at 0x00454272, only when MoveOrTeleport returns nonzero,
  anchored to &arg2->m_position read live, i.e. post-move.

AP-87 and TS-44 were carried deliberately, not delegated away. AP-87's three
conditions — including firstUp, which one round silently dropped — are preserved
as an explicit acdream policy layer applied AFTER the classifier commits to
Interpolate; the two previously separate player/NPC copies are now one. TS-44
stays an NPC-only caller gate; extending sticky suppression to player remotes has
no retail basis and no live evidence, so it was declined rather than absorbed.

Landing is explicitly carved out of 4a's ownership on both arms. A landing packet
classifies Interpolate, so an ordering slip would ENQUEUE a body that must PLANT
and a creature knocked off a ledge would glide down over a packet interval. The
carve-out is a named entry point returning AirborneSnap/SteadyStateInterpolate/
Legacy precisely so the PRECEDENCE is observable and testable rather than implied
by statement order — that is how the slip happened once and was caught.

The player/NPC asymmetry on landing is real and NOT resolved here: retail draws
no such distinction, but converging them is a behaviour decision needing its own
evidence. Filed into the 4b plan.

Register: AP-135 filed for the two bookkeeping writes the airborne branch
deliberately retains (rmState.CellId, LastServerPos/Time) — not retail's model,
but load-bearing for our catch-up sweep and staleness timer, and verified not to
be a canonical cell commit for ordinary remotes. AP-87 and TS-44 rewritten to
describe the code.

Honest remainder: App still owns branch selection, the airborne return, the cell
write, the entity write and the shadow publish, and headless satisfies "both
hosts drive the identical entry point" only vacuously since it returns early for
remotes. That is written into the 4b bullet rather than left implicit.

Cost: 364 non-comment production lines, 91% of the ~400 budget — the split did
isolate the cheap half, but not by much. Do not carry "well under" into 4b's
scoping.

Gates: complete Release solution 10,938 passed / 4 skipped / 0 failed (pre-4a
baseline 10,909). Four review rounds; the first three each introduced a new
behavioural defect while fixing another, and each left a comment asserting
behaviour that no longer matched — the final round's precedence matrix was
traced cell-by-cell against HEAD with only the D1-intended difference. App tests
call production entry points against a real WorldEntity and real classifier
output, closing route 2's #292 gap rather than repeating it.

Connected acceptance NOT run — needs a live second character.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Runtime/Entities/RuntimeEntityObjectLifetime.cs

@@ -164,6 +164,16 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
     /// <summary>C4 route 2: see <see cref="RegisterAcceptedPositionDriveOwnership"/>.</summary>
     private readonly List<Func<int>> _acceptedPositionDriveOwnership = [];
     /// <summary>
+    /// C4 route 4a: captured by <see cref="BindEventContext"/> alongside the
+    /// other generation-consuming children so
+    /// <see cref="ClassifyRemoteAcceptedPosition"/> can build a real
+    /// <c>RuntimeAuthoritativePositionAuthority</c> from the SAME generation
+    /// source every other accepted-position authority in this lifetime uses.
+    /// Never exposed: a host must not be able to read a generation token out
+    /// of this lifetime and assemble its own authority beside it.
+    /// </summary>
+    private Func<RuntimeGenerationToken>? _generation;
+    /// <summary>
     /// #297 (review round 2, preferred fix): keeps every canonical
     /// snapshot's <c>ObjectDescriptionFlags</c> live against
     /// <c>ClientObjectTable.PublicWeenieBitfield</c> — see
@@ -530,12 +540,62 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         Func<ulong> frameNumber)
     {
         EnsureNotDisposed();
+        _generation = generation;
         Events.BindContext(generation, frameNumber);
         Placements.BindGeneration(generation);
         InitialCreateResidences.BindGeneration(generation);
         InitialCreateExecution.BindGeneration(generation);
     }
 
+    /// <summary>
+    /// C4 route 4a: classifies one REMOTE incarnation's accepted Position
+    /// through <see cref="RuntimeAuthoritativePositionRouteClassifier"/>, so
+    /// the graphical host and any future no-window remote-motion host make
+    /// the SAME airborne-no-op / near-interpolate decision from the same
+    /// generation, the same authority shape, and the same request builder the
+    /// deferred initial-create continuation uses.
+    ///
+    /// <para>
+    /// Returns <see langword="null"/> when no classification can honestly be
+    /// made: the lifetime has no bound generation yet, the canonical record
+    /// has not claimed a local id, or there is no live local-player position
+    /// to derive retail's <c>player_distance</c> from. In every one of those
+    /// cases the caller's pre-existing legacy path runs completely unchanged
+    /// — a null here is "route 4a has no opinion", never "rejected".
+    /// </para>
+    /// </summary>
+    internal RuntimeAuthoritativePositionRoute? ClassifyRemoteAcceptedPosition(
+        RuntimeEntityRecord canonical,
+        in WorldSession.EntityPositionUpdate update,
+        PositionTimestampDisposition disposition,
+        in AcceptedPhysicsTimestamps timestamps,
+        float? playerDistance)
+    {
+        ArgumentNullException.ThrowIfNull(canonical);
+        if (_generation is not { } generation)
+            return null;
+        if (!RuntimeAcceptedPositionRouteRequests.TryBuild(
+                generation(),
+                canonical,
+                update,
+                RuntimePositionEntityKind.Remote,
+                RuntimeAcceptedPositionSource.PositionEvent,
+                disposition,
+                timestamps.PreviousTeleport,
+                timestamps.Teleport,
+                playerDistance,
+                // Retail's UsePositionFromServer is consumed by the local
+                // player branch only; the Remote branch never reads it.
+                usePositionFromServer: false,
+                out RuntimeAcceptedPositionRouteRequest request))
+        {
+            return null;
+        }
+
+        return RuntimeAuthoritativePositionRouteClassifier
+            .ClassifyAcceptedPosition(request);
+    }
+
     /// <summary>
     /// C3c: registers one host callback fired for every FRESH initial-create
     /// residence begin (never for a same-generation FIFO append). Multicast,
@@ -2020,6 +2080,7 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         finally
         {
             _disposed = true;
+            _generation = null;
             _pvpBitfieldSync.Dispose();
             Events.Dispose();
             Physics.Dispose();

src/AcDream.Runtime/Entities/RuntimeInitialCreateContinuationExecutor.cs

@@ -1904,46 +1904,26 @@ internal sealed class RuntimeInitialCreateContinuationExecutor
         }
         else
         {
-            var authority = new RuntimeAuthoritativePositionAuthority(
-                CurrentGeneration(),
-                key,
-                canonical.PositionAuthorityVersion,
-                update.PositionSequence,
-                action.PreviousTeleportSequence,
-                action.AcceptedTimestamps.Teleport,
-                action.PositionDisposition);
-
-            // Round 3 A3: contact comes SOLELY from the retained wire
-            // packet's own IsGrounded bit (PositionPack bit 0x4,
-            // server-asserted contact at admission time) - never a live
-            // body query, never an Inputs fallback.
-            bool hasContact = update.IsGrounded;
-            // Round 3 B5: HasAnimations is the SAME data-driven proxy for
-            // every position source, SameIncarnationCreate included - no
-            // PositionSource short-circuit. Round 4 R4-13: fall back to the
-            // nested PhysicsSpawnData's own MotionTableId when the
-            // top-level snapshot field is null (WeenieDescription/ObjDesc
-            // merges only ever populate one of the two, depending on
-            // which stage last touched appearance vs description).
-            bool hasAnimations = (canonical.Snapshot.MotionTableId
-                    ?? canonical.Snapshot.Physics?.MotionTableId) is { } motionTableId
-                && motionTableId != 0u;
-
-            var request = new RuntimeAcceptedPositionRouteRequest(
-                authority,
-                entityKind,
-                action.PositionSource,
-                update.Position,
-                update.PlacementId,
-                update.Velocity,
-                canonical.FullCellId,
-                hasContact,
-                inputs.PlayerDistance,
-                inputs.UsePositionFromServer,
-                hasAnimations,
-                new RuntimePositionPlacementFacts(
-                    canonical.FinalPhysicsState,
-                    canonical.Snapshot.SetupTableId is not null));
+            // Round 3 A3 / B5 and Round 4 R4-13 (contact from the retained
+            // wire packet's own IsGrounded bit only; the data-driven
+            // HasAnimations proxy with its PhysicsSpawnData fallback) now
+            // live in the ONE shared request builder, which C4 route 4a's
+            // remote classification also uses - see
+            // RuntimeAcceptedPositionRouteRequests for why a second
+            // hand-written copy of this construction is not allowed.
+            RuntimeAcceptedPositionRouteRequest request =
+                RuntimeAcceptedPositionRouteRequests.Build(
+                    CurrentGeneration(),
+                    canonical,
+                    key,
+                    update,
+                    entityKind,
+                    action.PositionSource,
+                    action.PositionDisposition,
+                    action.PreviousTeleportSequence,
+                    action.AcceptedTimestamps.Teleport,
+                    inputs.PlayerDistance,
+                    inputs.UsePositionFromServer);
 
             route = RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition(request);
 

src/AcDream.Runtime/Physics/RuntimeAcceptedPositionRouteRequests.cs

@@ -0,0 +1,127 @@
+using System;
+using AcDream.Core.Net;
+using AcDream.Core.Physics;
+using AcDream.Runtime.Entities;
+
+namespace AcDream.Runtime.Physics;
+
+/// <summary>
+/// The ONE construction of a <see cref="RuntimeAcceptedPositionRouteRequest"/>
+/// from a canonical record plus an accepted wire packet. Every caller that
+/// classifies an accepted Position goes through here — the deferred
+/// initial-create continuation (<c>RuntimeInitialCreateContinuationExecutor</c>)
+/// and C4 route 4a's remote steady state
+/// (<see cref="RuntimeRemoteSteadyStatePosition"/>).
+///
+/// <para>
+/// This exists because the two independent hand-written copies had already
+/// diverged: #307 (the always-zero <c>PreviousTeleport</c>) and the fabricated
+/// <c>Vector3.Zero</c> player position both entered through a second copy of
+/// this construction rather than through the original. Adding a caller means
+/// adding an overload here, never a third copy.
+/// </para>
+/// </summary>
+internal static class RuntimeAcceptedPositionRouteRequests
+{
+    /// <summary>
+    /// Builds the request for a caller that has already resolved the exact
+    /// incarnation key and a real <c>player_distance</c>.
+    /// </summary>
+    internal static RuntimeAcceptedPositionRouteRequest Build(
+        RuntimeGenerationToken generation,
+        RuntimeEntityRecord canonical,
+        RuntimeEntityKey key,
+        in WorldSession.EntityPositionUpdate update,
+        RuntimePositionEntityKind entityKind,
+        RuntimeAcceptedPositionSource source,
+        PositionTimestampDisposition disposition,
+        ushort previousTeleportSequence,
+        ushort acceptedTeleportSequence,
+        float playerDistance,
+        bool usePositionFromServer)
+    {
+        ArgumentNullException.ThrowIfNull(canonical);
+        var authority = new RuntimeAuthoritativePositionAuthority(
+            generation,
+            key,
+            canonical.PositionAuthorityVersion,
+            update.PositionSequence,
+            previousTeleportSequence,
+            acceptedTeleportSequence,
+            disposition);
+
+        // Contact comes SOLELY from the retained wire packet's own IsGrounded
+        // bit (PositionPack bit 0x4, server-asserted contact at admission
+        // time) - never a live body query. HasAnimations is the same
+        // data-driven proxy for every position source: WeenieDescription and
+        // ObjDesc merges only ever populate one of the two MotionTableId
+        // fields, depending on which stage last touched appearance vs
+        // description.
+        bool hasAnimations = (canonical.Snapshot.MotionTableId
+                ?? canonical.Snapshot.Physics?.MotionTableId) is { } motionTableId
+            && motionTableId != 0u;
+
+        return new RuntimeAcceptedPositionRouteRequest(
+            authority,
+            entityKind,
+            source,
+            update.Position,
+            update.PlacementId,
+            update.Velocity,
+            canonical.FullCellId,
+            update.IsGrounded,
+            playerDistance,
+            usePositionFromServer,
+            hasAnimations,
+            new RuntimePositionPlacementFacts(
+                canonical.FinalPhysicsState,
+                canonical.Snapshot.SetupTableId is not null));
+    }
+
+    /// <summary>
+    /// Builds the request for a caller whose incarnation key or local-player
+    /// position may not exist yet. Returns <see langword="false"/> in both
+    /// cases rather than inventing a substitute: a null local-player position
+    /// MUST yield "no request", never a fabricated <c>Vector3.Zero</c> that
+    /// would report every remote as implausibly far — <c>GameRuntime</c>'s
+    /// <c>BindLiveInputs</c> call states exactly that rule for exactly this
+    /// field, and <c>RuntimeInitialCreateContinuationExecutor.ResolveInputs</c>
+    /// honours it. A nonfinite distance is NOT filtered here: the classifier
+    /// owns that policy explicitly (<c>RejectedData</c>), and one
+    /// classification means one owner.
+    /// </summary>
+    internal static bool TryBuild(
+        RuntimeGenerationToken generation,
+        RuntimeEntityRecord canonical,
+        in WorldSession.EntityPositionUpdate update,
+        RuntimePositionEntityKind entityKind,
+        RuntimeAcceptedPositionSource source,
+        PositionTimestampDisposition disposition,
+        ushort previousTeleportSequence,
+        ushort acceptedTeleportSequence,
+        float? playerDistance,
+        bool usePositionFromServer,
+        out RuntimeAcceptedPositionRouteRequest request)
+    {
+        ArgumentNullException.ThrowIfNull(canonical);
+        if (canonical.Key is not { } key || playerDistance is not { } distance)
+        {
+            request = default;
+            return false;
+        }
+
+        request = Build(
+            generation,
+            canonical,
+            key,
+            update,
+            entityKind,
+            source,
+            disposition,
+            previousTeleportSequence,
+            acceptedTeleportSequence,
+            distance,
+            usePositionFromServer);
+        return true;
+    }
+}

src/AcDream.Runtime/Physics/RuntimeRemoteSteadyStatePosition.cs

@@ -0,0 +1,198 @@
+using System;
+using System.Numerics;
+using AcDream.Core.Physics;
+using AcDream.Core.Physics.Motion;
+
+namespace AcDream.Runtime.Physics;
+
+/// <summary>
+/// C4 route 4a (2026-08-03): the Runtime-owned decision for the two
+/// <see cref="RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition"/>
+/// remote branches that perform NO SetPosition — retail
+/// <c>CPhysicsObj::MoveOrTeleport</c> (0x00516330)'s airborne no-op
+/// (<c>arg4==0</c> -&gt; return 0 @0x0051636D, nothing written at all) and its
+/// near <c>InterpolateTo</c> queue (<c>player_distance &lt; 96 m</c>
+/// @0x005163AF). Both classify identically for player-remote and NPC-remote
+/// incarnations — retail's disassembly makes no <c>this==player</c>
+/// distinction on this path (see <c>ConstraintDistance</c>) — so one Runtime
+/// owner decides and applies both, replacing the two independent per-kind
+/// copies that used to live in <c>LiveEntityNetworkUpdateController</c>. The
+/// far (&gt;=96 m) and teleport/cell-less branches remain the legacy App path
+/// until C4 route 4b.
+///
+/// <para>
+/// <b>Exactly two dispositions are owned here.</b> Everything else —
+/// <c>SetPositionSimple</c>, <c>SetPosition</c>, <c>RejectedAuthority</c>,
+/// <c>RejectedData</c>, and "not classified at all" (<see langword="null"/>) —
+/// falls through to the untouched legacy App routing. "Not Interpolate" must
+/// never be read as "far".
+/// </para>
+/// </summary>
+internal static class RuntimeRemoteSteadyStatePosition
+{
+    /// <summary>
+    /// AP-87 (register row, carried forward — not retired): retail's
+    /// InterpolateTo has no concept of "the body isn't already tracking the
+    /// target". acdream's catch-up + per-tick sweep needs one — an unplaced
+    /// body (a first-UP / spawn-seed origin, or any large correction)
+    /// enqueued instead of snapped would let InterpolationManager's 100 m
+    /// far-blip fire and the per-tick sweep run from a cell that does not
+    /// contain the body, producing the reverted #184 invisible-but-solid
+    /// monster.
+    /// </summary>
+    private const float BodySnapThreshold = 4f;
+
+    internal enum Action : byte
+    {
+        /// <summary>AP-87 backstop: the body wasn't already tracking the
+        /// target closely enough, has no consumer to walk the queue, or has
+        /// never received a server sample.</summary>
+        Snapped,
+
+        /// <summary>The ordinary near catch-up: queued for the per-tick
+        /// InterpolationManager/ConstraintManager chain to walk toward.</summary>
+        Enqueued,
+    }
+
+    /// <summary>
+    /// True when route 4a owns this classification outright, so the legacy App
+    /// path must not run for it AT ALL — not partially, not "just the render
+    /// write". This is the staged cutover's ONLY discriminator: the
+    /// classification itself, never a heuristic or a flag.
+    /// </summary>
+    internal static bool OwnsSteadyState(RuntimeAuthoritativePositionRoute? route) =>
+        IsAirborneNoOperation(route) || IsNearInterpolate(route);
+
+    /// <summary>
+    /// Retail's <c>arg4 == 0</c> return-0 branch: the accepted wire packet
+    /// reports no ground contact, so <c>MoveOrTeleport</c> writes nothing and
+    /// its caller <c>SmartBox::HandleReceivedPosition</c> (0x00453FD0) skips
+    /// <c>ConstrainTo</c> (@0x00454272, inside
+    /// <c>if (MoveOrTeleport(...) != 0)</c>) as well.
+    /// </summary>
+    internal static bool IsAirborneNoOperation(
+        RuntimeAuthoritativePositionRoute? route) =>
+        route is
+        {
+            Disposition: RuntimeAuthoritativePositionDisposition.NoPositionOperation,
+        };
+
+    /// <summary>Retail's <c>player_distance &lt; 96f</c> InterpolateTo
+    /// branch.</summary>
+    internal static bool IsNearInterpolate(
+        RuntimeAuthoritativePositionRoute? route) =>
+        route is
+        {
+            Disposition: RuntimeAuthoritativePositionDisposition.Interpolate,
+        };
+
+    /// <summary>
+    /// Applies the retail near-InterpolateTo branch for one remote whose
+    /// accepted Position has already classified to
+    /// <see cref="RuntimeAuthoritativePositionDisposition.Interpolate"/>.
+    /// Callers must NOT invoke this for
+    /// <see cref="RuntimeAuthoritativePositionDisposition.NoPositionOperation"/>
+    /// — that branch writes nothing at all (retail returns 0) and has no
+    /// operation for this method to perform.
+    ///
+    /// <para>
+    /// The acdream-only TS-44 sticky suppression is deliberately NOT here: it
+    /// is an NPC-only caller gate and stays one, so this seam is exactly the
+    /// kind-agnostic retail decision plus AP-87.
+    /// </para>
+    ///
+    /// <para>
+    /// The returned <see cref="Action"/> is this seam's observable outcome and
+    /// is what the focused tests assert AP-87's snap against its enqueue with.
+    /// Production has no use for it and deliberately discards it at both call
+    /// sites — do not delete it as dead, because collapsing it to
+    /// <see langword="void"/> would make the two AP-87 outcomes
+    /// indistinguishable from outside.
+    /// </para>
+    /// </summary>
+    internal static Action ApplyInterpolate(
+        RemoteMotion remote,
+        Vector3 worldPosition,
+        Quaternion orientation,
+        bool isMovingTo,
+        bool willBeDrTicked)
+    {
+        ArgumentNullException.ThrowIfNull(remote);
+
+        // AP-87, all three conditions, verbatim from the NPC copy this
+        // replaces. `firstUp` is a belt hint, not the load-bearing guard: it
+        // is unreliable because a UM that enters a locomotion cycle can stamp
+        // LastServerPosTime before the first UP. It is retained rather than
+        // silently dropped, and is exact for BOTH kinds — the player-remote
+        // caller stamps LastServerPosTime before it routes (its diagnostic
+        // roll-forward block), so `firstUp` is structurally false there and
+        // this evaluates to exactly the player copy's own two conditions.
+        bool firstUp = remote.LastServerPosTime <= 0.0;
+        float bodyToTarget = Vector3.Distance(remote.Body.Position, worldPosition);
+        if (firstUp || !willBeDrTicked || bodyToTarget > BodySnapThreshold)
+        {
+            remote.Interp.Clear();
+            remote.Body.Position = worldPosition;
+            remote.Body.Orientation = orientation;
+            return Action.Snapped;
+        }
+
+        Quaternion? immediate = remote.Interp.Enqueue(
+            worldPosition,
+            orientation,
+            isMovingTo,
+            remote.Body.Position,
+            remote.Body.Orientation);
+        if (immediate is { } close)
+            remote.Body.Orientation = close;
+        return Action.Enqueued;
+    }
+
+    /// <summary>
+    /// D2: retail arms <c>CPhysicsObj::ConstrainTo</c> strictly AFTER
+    /// <c>MoveOrTeleport</c> returns nonzero, anchored to the object's own
+    /// CURRENT (i.e. post-move) position — <c>SmartBox::HandleReceivedPosition</c>
+    /// 0x00453FD0 reads <c>&amp;arg2-&gt;m_position</c> at 0x00454272, inside
+    /// the <c>if (MoveOrTeleport(...) != 0)</c> at 0x00454254. It therefore
+    /// does NOT run on the airborne no-op.
+    ///
+    /// <para>
+    /// Route-gated so it can only fire for a classification route 4a owns:
+    /// every other classification still arms the leash through the legacy
+    /// pre-operation call site, unchanged, until 4b moves them too.
+    /// </para>
+    /// </summary>
+    internal static bool TryArmConstraintAfterOperation(
+        RuntimeAuthoritativePositionRoute? route,
+        RemoteMotion remote)
+    {
+        ArgumentNullException.ThrowIfNull(remote);
+        if (route is not { } selected
+            || !OwnsSteadyState(selected)
+            || !selected.ConstrainAfterRouting
+            || remote.Host is not { } host)
+        {
+            return false;
+        }
+
+        ArmConstraintAfterOperation(host);
+        return true;
+    }
+
+    /// <summary>
+    /// The leash arming itself: <c>ConstraintPosOffset</c> is captured as
+    /// distance(anchor, host.Position) at call time, and the anchor here IS
+    /// host.Position read live, so a fresh accepted Position always restarts
+    /// the leash at zero displacement — retail's per-packet re-anchor.
+    /// docs/research/2026-07-30-constraint-leash-constants.md §2/§3.2.
+    /// </summary>
+    internal static void ArmConstraintAfterOperation(EntityPhysicsHost host)
+    {
+        ArgumentNullException.ThrowIfNull(host);
+        Position anchor = host.Position;
+        host.PositionManager.ConstrainTo(
+            anchor,
+            ConstraintDistance.GetStartConstraintDistance(anchor.ObjCellId),
+            ConstraintDistance.GetMaxConstraintDistance(anchor.ObjCellId));
+    }
+}