feat(runtime): C3c - production placement cutover: both hosts on the residence conductors (routes 1+8)

Campaign P remaining-physics-divergence, placement cutover slice C3c
(docs/plans/2026-08-02-placement-cutover.md). Both production hosts now
register every initial Create through the residence + continuation-
executor + first-entry-conductor machinery (C0-C3b):

- Graphical (route 1): RegisterEntityWithInitialResidence at Create; the
  shared RuntimeFirstEntryDriveController pumps both conductors from the
  placement-receipt flow; MaterializeProjection and RebucketLiveEntity
  are presentation-only while a residence is ACTIVE (ExecutorCompleted is
  the presentation-binding receipt); post-residence entities take the
  full legacy path including the prepare_to_enter_world clock edges.
  PlayerModeController attaches presentation to the Runtime-published
  controller; its legacy resolve/step-heights/host-construction path is
  deleted; presentation-only rollback (retail has no entry-flow rollback).
- Headless (route 8): OnSpawned registers with residence when a drive
  exists; content-less sessions keep the pre-flip direct registration;
  SynchronizeLocalPlayer/CreateController/ApplySetupStepHeights deleted;
  prepared-collision read failure is a typed AwaitingCollisionSource
  retry; far remotes outside the service window complete celless.
- RuntimeLocalPlayerMovementState.Controller setter sealed internal; all
  controller mutation flows through the publication lifecycle.

Fix slices landed within this cutover, each dual-gated:
- F1: live movement-stat/server-physics application routed through the
  Runtime ownership seam (post-logout ingest crash on the retired
  controller eliminated; RuntimeMovementSkillProjection deleted).
- F2: login activation wedge - collision-admission prefix gate factored
  out of the seal (reentrant-commit RejectedAuthority), rearm generation
  identity corrected, PlayerModeAutoEntry requires the Runtime-published
  controller (world reveal can no longer seal unmaterialized).
- F3: landblock-prefix 0-sentinel replaced by explicit absent-id guards;
  map-corner landblocks (grid row/col 0) fully legal through admission,
  park/rearm/retire, quiescence, and outdoor shadow seeds.
- F5: local-player first-entry ground contact seeded by the shared
  SpawnPlacementSettler (moved App->Core) at FinalizeActivation - the
  retail first-gravity-frame touch (enter_world 0x00516170 carries no
  seed); the legacy unconditional force-seed is overwritten by a real
  floor-found contact; airborne spawns stay airborne; outbound contact
  bit verified end-to-end. Fixes the standing-cast 'You can't do that
  while in the air!' rejections.
- R1 (dual-review round): login constraint leash armed at the committed
  placement (HandleReceivedPosition 0x00453FD0 analog); register rows
  AD-61 (settle-timing compression now covering the local player) and
  AD-42 (repointed off the deleted resolve split) in this commit;
  residence-conversion owner API; wire-landblock guards; drive-pending
  ledger in IsConverged; route attach/detach latch; executor-drain drift
  model documented + source-pinned.

Gates: Runtime 1,003, App 4,039/3 skips, Headless 79, complete solution
10,816/0 failed/4 skips (Release, -m:1); connected lifecycle/reconnect
gate PASS (logs/connected-world-gate-20260802-175401; graceful exits,
world-visible, zero airborne rejections). The nine-stop soak remains red
for the pre-existing 6b28ff99 whole-world collision-clone throughput
regression (attributed with evidence; scheduled as its own slice before
C5). Dual Opus reviews (retail-conformance + adversarial): delta PASS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-08-02 18:10:33 +02:00
parent 78f1eb1896
commit 529e0e9d88
68 changed files with 5977 additions and 831 deletions

View file

@ -34,23 +34,39 @@ internal sealed class HeadlessRuntimePlacementProjectionSink
if (projection.Kind is RuntimePlacementProjectionKind.ExecutorCompleted)
{
// F1: acknowledge-and-ignore, same as Discard - ExecutorCompleted
// is not a placement to project (no world/presentation mutation
// by definition; the executor's own drain already committed
// every Place/Withdraw this receipt follows). It must NOT fall
// through to the record-lookup gate below: that gate can validly
// reject an unrelated entity/session mismatch, and this sink's
// caller (RuntimePlacementProjectionSubscription) treats a false
// return as "leave at the FIFO head" - a rejected ExecutorCompleted
// would permanently wedge the entire ordered placement stream
// behind it. Currently provably inert: PublishExecutorCompletion
// has zero production callers (Execute/RegisterEntityWithInitialResidence
// are both unreached in production) - see
// HeadlessSessionHostTests.ExecutorCompletedReceiptIsAcknowledgeOnlyRegardlessOfRecordValidity.
// is not a placement to project (a headless host has no
// presentation to bind off the completed initial drain; the
// executor's own drain already committed every canonical fact).
// It must NOT fall through to the record-lookup gate below: that
// gate can validly reject an unrelated entity/session mismatch,
// and this sink's caller (RuntimePlacementProjectionSubscription)
// treats a false return as "leave at the FIFO head" - a rejected
// ExecutorCompleted would permanently wedge the entire ordered
// placement stream behind it.
return true;
}
RuntimePlacementProjectionToken token = projection.Token;
RuntimeEntityDirectory directory = _runtime.EntityObjects.Entities;
if (projection.Kind is RuntimePlacementProjectionKind.Place
or RuntimePlacementProjectionKind.Withdraw
&& token.IsValid
&& directory.TryGetByLocalId(
token.Entity.LocalEntityId,
out RuntimeEntityRecord residenceCandidate)
&& directory.IsCurrent(residenceCandidate)
&& residenceCandidate.Key == token.Entity
&& _runtime.EntityObjects.TryGetInitialCreateResidence(
residenceCandidate,
out _))
{
// C3c: a Place/Withdraw for an entity still holding its
// initial-create residence belongs to the first-entry conductor
// machinery, which acknowledges its own receipts at the exact
// FIFO head. Leave it there for the drive pump; validating or
// acknowledging it here would starve the conductor forever.
return false;
}
if (!token.IsValid
|| token.SessionLifetimeVersion
!= directory.SessionLifetimeVersion

View file

@ -15,6 +15,7 @@ internal sealed class HeadlessSessionEventRoute : ILiveSessionEventRouting
private readonly ILiveSessionEventRouting _events;
private readonly GameRuntime _runtime;
private readonly IRuntimePlacementProjectionSink _placements;
private readonly RuntimeFirstEntryDriveController? _firstEntry;
private RuntimePlacementProjectionSubscription? _subscription;
private bool _attachStarted;
private bool _eventsDisposed;
@ -23,12 +24,14 @@ internal sealed class HeadlessSessionEventRoute : ILiveSessionEventRouting
internal HeadlessSessionEventRoute(
ILiveSessionEventRouting events,
GameRuntime runtime,
IRuntimePlacementProjectionSink placements)
IRuntimePlacementProjectionSink placements,
RuntimeFirstEntryDriveController? firstEntry = null)
{
_events = events ?? throw new ArgumentNullException(nameof(events));
_runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
_placements = placements
?? throw new ArgumentNullException(nameof(placements));
_firstEntry = firstEntry;
}
public void Attach()
@ -41,6 +44,10 @@ internal sealed class HeadlessSessionEventRoute : ILiveSessionEventRouting
// succeeds and throws, LiveSessionHost's retryable rollback still
// invokes Dispose on the underlying route.
_attachStarted = true;
// C3c-R1 review F6: assert (not assume) that the prior route
// detached — session reset precedes a new route — before this route
// takes ownership of the shared drive controller's tracked entries.
_firstEntry?.AttachRoute(this);
_events.Attach();
_subscription = new RuntimePlacementProjectionSubscription(
_runtime,
@ -56,6 +63,12 @@ internal sealed class HeadlessSessionEventRoute : ILiveSessionEventRouting
// network route. A still-pending FIFO head remains Runtime-owned for
// the replacement route to drain.
Interlocked.Exchange(ref _subscription, null)?.Dispose();
// C3c: the drive controller's tracked entries die with this exact
// route; Runtime's retirement/session-clear fan-out owns
// conductor/residence convergence independently. C3c-R1 review F6:
// route-scoped — a route that never attached cannot clear a live
// route's entries.
_firstEntry?.DetachRoute(this);
if (!_eventsDisposed)
{
_events.Dispose();

View file

@ -120,6 +120,12 @@ internal sealed class HeadlessSessionHost : IDisposable
private readonly RuntimeLocalPlayerFrameController _localPlayerFrame;
private readonly HeadlessProcessContentOwner.HeadlessProcessContentLease?
_contentLease;
/// <summary>C3c: one per-host first-entry drive controller (lazy — its
/// residence-begin subscription binds once against the persistent
/// Runtime lifetime) plus the active world projection it pumps
/// through.</summary>
private RuntimeFirstEntryDriveController? _firstEntryDrive;
private HeadlessSessionWorldProjection? _worldProjection;
private int _disposeStage;
private long _reconnectDeadline;
private bool _reconnectPending;
@ -295,6 +301,10 @@ internal sealed class HeadlessSessionHost : IDisposable
_localPlayerFrame.AdvanceBeforeNetwork(
checked((float)deltaSeconds));
Runtime.Session.Tick();
// C3c: pump pending first-entry sequences after the network drain —
// collision-generation progress and freshly accepted Creates both
// surface here, mirroring the graphical per-frame retry phase.
_worldProjection?.PumpFirstEntry();
_localPlayerFrame.RunPostNetworkCommandPhase();
Runtime.ActionOwner.CombatAttack.Tick();
_policy.Tick(Runtime, Commands);
@ -525,10 +535,34 @@ internal sealed class HeadlessSessionHost : IDisposable
private ILiveSessionEventRouting CreateEventRoute(
AcDream.Core.Net.WorldSession session)
{
IRuntimeDirectWorldProjection? worldProjection =
_contentLease is { } content
? new HeadlessSessionWorldProjection(Runtime, content)
: null;
IRuntimeDirectWorldProjection? worldProjection = null;
if (_contentLease is { } content)
{
// C3c: one drive controller per host — the residence-begin
// notification binds once against the persistent Runtime
// lifetime; reconnects reuse it (its tracked entries are cleared
// with each retiring route).
_firstEntryDrive ??= new RuntimeFirstEntryDriveController(
Runtime.EntityObjects,
Runtime.Clock,
content.PreparedCollision,
() => PlayerMovementConstructionOptions.From(
Runtime.CharacterOwner.MovementSkills.Snapshot),
// A headless host registers no shadow payloads — the local
// player is provably shapeless in the shadow registry, with
// the same default approach cylinder the deleted
// hand-resolve used.
static _ => new RuntimeLocalPlayerPhysicsActivationPreparation(
Radius: 0.48f,
Height: 1.835f,
RuntimeLocalPlayerShadowDisposition.ProvenShapeless));
var projection = new HeadlessSessionWorldProjection(
Runtime,
content,
_firstEntryDrive);
_worldProjection = projection;
worldProjection = projection;
}
var entities = new RuntimeLiveEntitySessionController(
Runtime,
session,
@ -583,7 +617,8 @@ internal sealed class HeadlessSessionHost : IDisposable
return new HeadlessSessionEventRoute(
route,
Runtime,
new HeadlessRuntimePlacementProjectionSink(Runtime));
new HeadlessRuntimePlacementProjectionSink(Runtime),
_firstEntryDrive);
}
private static LiveSessionCharacterSelector MapCharacterSelector(

View file

@ -16,6 +16,15 @@ internal interface IHeadlessCollisionNeighborhood
void CenterOn(uint fullCellId);
bool IsReady(uint fullCellId);
/// <summary>
/// C3c-R1 review F7: true when <paramref name="fullCellId"/>'s landblock
/// is one this neighborhood can ever collision-publish — inside the 3x3
/// window around the requested center (or no center has been requested
/// yet). A remote Create outside the window must not open a deferred
/// placement: its collision-generation wake could never fire.
/// </summary>
bool IsWithinServiceWindow(uint fullCellId);
}
internal readonly record struct HeadlessCollisionGenerationAdvance(
@ -233,6 +242,20 @@ internal sealed class HeadlessCollisionNeighborhood
AdvanceWork();
}
public bool IsWithinServiceWindow(uint fullCellId)
{
if (_requestedCenterLandblock == 0u)
return true;
uint target = CanonicalLandblock(fullCellId);
int dx = Math.Abs(
(int)((target >> 24) & 0xFFu)
- (int)((_requestedCenterLandblock >> 24) & 0xFFu));
int dy = Math.Abs(
(int)((target >> 16) & 0xFFu)
- (int)((_requestedCenterLandblock >> 16) & 0xFFu));
return dx <= 1 && dy <= 1;
}
public bool IsReady(uint fullCellId)
{
uint center = CanonicalLandblock(fullCellId);
@ -480,36 +503,72 @@ internal sealed class HeadlessSessionWorldProjection
private readonly GameRuntime _runtime;
private readonly IHeadlessCollisionNeighborhood _collision;
private readonly IPreparedCollisionSource? _preparedCollision;
private readonly RuntimeFirstEntryDriveController? _firstEntry;
private uint _requestedLocalPlayerCell;
internal HeadlessSessionWorldProjection(
GameRuntime runtime,
HeadlessProcessContentOwner.HeadlessProcessContentLease content)
HeadlessProcessContentOwner.HeadlessProcessContentLease content,
RuntimeFirstEntryDriveController? firstEntry = null)
: this(
runtime,
new HeadlessCollisionNeighborhood(runtime, content),
content.PreparedCollision)
firstEntry)
{
}
internal HeadlessSessionWorldProjection(
GameRuntime runtime,
IHeadlessCollisionNeighborhood collision,
IPreparedCollisionSource? preparedCollision = null)
RuntimeFirstEntryDriveController? firstEntry = null)
{
_runtime = runtime
?? throw new ArgumentNullException(nameof(runtime));
_collision = collision
?? throw new ArgumentNullException(nameof(collision));
_preparedCollision = preparedCollision;
_firstEntry = firstEntry;
}
public void ProjectSpawn(
RuntimeEntityRecord record,
bool isLocalPlayer)
{
if (isLocalPlayer)
SynchronizeLocalPlayer(record);
// C3c route-8 flip: the first-entry conductors own mover
// preparation, body/controller construction, and placement for every
// Create. The host's spawn projection centers the collision
// neighborhood on the local player's wire cell (the activation
// defers until its collision generation commits) and pumps the
// drive; remote leases ride the same pump.
if (isLocalPlayer
&& record.ServerGuid == _runtime.PlayerIdentity.ServerGuid
// C3c-R1 review F4: LandblockId is the RAW wire value; 0 is the
// absent-id sentinel and the F3 admission guards
// (RuntimePhysicsState.BeginCollisionAdmission) now throw on it,
// which would make one absent-position Create session-fatal.
// Skip the centering; the conductor pumps regardless.
&& record.Snapshot.Position is { LandblockId: not 0u } position)
{
_requestedLocalPlayerCell = position.LandblockId;
_collision.CenterOn(position.LandblockId);
}
else if (!isLocalPlayer
&& record.Snapshot.Position is
{ LandblockId: not 0u } remotePosition
&& !_collision.IsWithinServiceWindow(remotePosition.LandblockId))
{
// C3c-R1 review F7: a remote/projectile Create outside the
// neighborhood's service window would submit a placement whose
// DeferredCell park can never wake (the far landblock is never
// collision-published here), pinning its residence and this
// pump's entry forever. Convert to the celless completion route
// BEFORE the pump: the conductor completes with FullCell 0 and
// the accepted wire frame stays on the canonical snapshot — the
// exact pre-flip accepted-frame behavior for far remotes. A
// later fresh Position event owns any subsequent placement.
_ = _runtime.EntityObjects
.TryConvertInitialResidenceToCellessRoute(record);
}
_firstEntry?.DriveAll();
}
public void ProjectPosition(
@ -522,7 +581,17 @@ internal sealed class HeadlessSessionWorldProjection
if (_runtime.MovementOwner.Controller is null)
{
SynchronizeLocalPlayer(record);
// C3c: the initial-resolve hand-copy is gone — a Position
// arriving before the conductor's publication commit only pumps
// the drive (the conductor re-reads the accepted snapshot
// itself). C3c-R1 review F4: guard the raw wire LandblockId —
// 0 is the absent-id sentinel the F3 admission guards throw on.
if (record.Snapshot.Position is { LandblockId: not 0u } position)
{
_requestedLocalPlayerCell = position.LandblockId;
_collision.CenterOn(position.LandblockId);
}
_firstEntry?.DriveAll();
return;
}
@ -530,6 +599,19 @@ internal sealed class HeadlessSessionWorldProjection
BlipLocalPlayer(record);
}
/// <summary>
/// C3c: the host tick's first-entry pump — advances the collision
/// neighborhood toward the requested local-player cell (its publication
/// work progresses on <c>IsReady</c> polls) and drives every pending
/// conductor sequence.
/// </summary>
internal void PumpFirstEntry()
{
if (_requestedLocalPlayerCell != 0u)
_ = _collision.IsReady(_requestedLocalPlayerCell);
_firstEntry?.DriveAll();
}
public void BeginTeleport()
{
if (_runtime.MovementOwner.Controller is { } controller)
@ -545,7 +627,7 @@ internal sealed class HeadlessSessionWorldProjection
destination.EntityGuid,
out RuntimeEntityRecord record))
{
SynchronizeLocalPlayer(record);
ResynchronizeLocalPlayerForPortalArrival(record);
}
if (_runtime.MovementOwner.Controller is { } controller)
controller.State = PlayerState.InWorld;
@ -563,19 +645,27 @@ internal sealed class HeadlessSessionWorldProjection
IsCollisionReady: ready);
}
private void SynchronizeLocalPlayer(RuntimeEntityRecord record)
/// <summary>
/// TODO-C4 (route 3): portal-arrival re-synchronization only. The
/// route-1/8 initial-entry hand-copy (controller construction + first
/// resolve/placement) was deleted at C3c — the first-entry conductor's
/// publication chain owns it — but the portal route is unflipped, so its
/// arrival re-resolve keeps today's exact behavior against the
/// already-published controller until C4 routes it through
/// RuntimePortalPlacementAuthority.
/// </summary>
private void ResynchronizeLocalPlayerForPortalArrival(
RuntimeEntityRecord record)
{
if (record.ServerGuid
!= _runtime.PlayerIdentity.ServerGuid
|| record.Snapshot.Position is not { } position)
|| record.Snapshot.Position is not { } position
|| _runtime.MovementOwner.Controller is not { } controller)
{
return;
}
_collision.CenterOn(position.LandblockId);
PlayerMovementController controller =
_runtime.MovementOwner.Controller
?? CreateController(record);
Vector3 wirePosition = new(
position.PositionX,
position.PositionY,
@ -636,57 +726,4 @@ internal sealed class HeadlessSessionWorldProjection
wirePosition);
}
private PlayerMovementController CreateController(
RuntimeEntityRecord record)
{
var controller = new PlayerMovementController(
_runtime.EntityObjects.Physics.Engine,
record.ObjectClock,
PlayerMovementConstructionOptions.From(
_runtime.CharacterOwner.MovementSkills.Snapshot));
controller.ApplyPhysicsState(record.FinalPhysicsState);
controller.LocalEntityId = record.LocalEntityId ?? 0u;
ApplySetupStepHeights(record, controller);
RuntimeMovementSkillProjection.ApplyTo(
_runtime.CharacterOwner.MovementSkills,
controller);
_runtime.MovementOwner.Controller = controller;
return controller;
}
private void ApplySetupStepHeights(
RuntimeEntityRecord record,
PlayerMovementController controller)
{
if (record.Snapshot.SetupTableId is not { } setupId
|| (setupId & 0xFF000000u) != 0x02000000u
|| _preparedCollision is null)
{
return;
}
PreparedCollisionReadResult<FlatSetupCollision> read =
_preparedCollision.ReadSetupCollision(setupId);
if (read.Status != PreparedAssetReadStatus.Loaded
|| read.Data is not { } setup)
{
throw new InvalidDataException(
$"Player Setup collision 0x{setupId:X8} is {read.Status}.");
}
_runtime.EntityObjects.Physics.DataCache.CacheSetup(
setupId,
setup);
controller.StepUpHeight = setup.StepUpHeight > 0f
? setup.StepUpHeight
: 0.4f;
controller.StepDownHeight = setup.StepDownHeight > 0f
? setup.StepDownHeight
: 0.4f;
// TS-46 (2026-07-30): the prepared package already carries the
// Setup's verbatim sphere list — no raw-DAT read needed here (unlike
// the graphical PlayerModeController.ApplyStepHeights, which reads
// DatReaderWriter.DBObjs.Setup directly). Empty falls back to
// ResolveWithTransition's legacy scalar reconstruction.
controller.SphereList = setup.Spheres;
}
}