feat(runtime): C3c - production placement cutover: both hosts on the residence conductors (routes 1+8)

Campaign P remaining-physics-divergence, placement cutover slice C3c
(docs/plans/2026-08-02-placement-cutover.md). Both production hosts now
register every initial Create through the residence + continuation-
executor + first-entry-conductor machinery (C0-C3b):

- Graphical (route 1): RegisterEntityWithInitialResidence at Create; the
  shared RuntimeFirstEntryDriveController pumps both conductors from the
  placement-receipt flow; MaterializeProjection and RebucketLiveEntity
  are presentation-only while a residence is ACTIVE (ExecutorCompleted is
  the presentation-binding receipt); post-residence entities take the
  full legacy path including the prepare_to_enter_world clock edges.
  PlayerModeController attaches presentation to the Runtime-published
  controller; its legacy resolve/step-heights/host-construction path is
  deleted; presentation-only rollback (retail has no entry-flow rollback).
- Headless (route 8): OnSpawned registers with residence when a drive
  exists; content-less sessions keep the pre-flip direct registration;
  SynchronizeLocalPlayer/CreateController/ApplySetupStepHeights deleted;
  prepared-collision read failure is a typed AwaitingCollisionSource
  retry; far remotes outside the service window complete celless.
- RuntimeLocalPlayerMovementState.Controller setter sealed internal; all
  controller mutation flows through the publication lifecycle.

Fix slices landed within this cutover, each dual-gated:
- F1: live movement-stat/server-physics application routed through the
  Runtime ownership seam (post-logout ingest crash on the retired
  controller eliminated; RuntimeMovementSkillProjection deleted).
- F2: login activation wedge - collision-admission prefix gate factored
  out of the seal (reentrant-commit RejectedAuthority), rearm generation
  identity corrected, PlayerModeAutoEntry requires the Runtime-published
  controller (world reveal can no longer seal unmaterialized).
- F3: landblock-prefix 0-sentinel replaced by explicit absent-id guards;
  map-corner landblocks (grid row/col 0) fully legal through admission,
  park/rearm/retire, quiescence, and outdoor shadow seeds.
- F5: local-player first-entry ground contact seeded by the shared
  SpawnPlacementSettler (moved App->Core) at FinalizeActivation - the
  retail first-gravity-frame touch (enter_world 0x00516170 carries no
  seed); the legacy unconditional force-seed is overwritten by a real
  floor-found contact; airborne spawns stay airborne; outbound contact
  bit verified end-to-end. Fixes the standing-cast 'You can't do that
  while in the air!' rejections.
- R1 (dual-review round): login constraint leash armed at the committed
  placement (HandleReceivedPosition 0x00453FD0 analog); register rows
  AD-61 (settle-timing compression now covering the local player) and
  AD-42 (repointed off the deleted resolve split) in this commit;
  residence-conversion owner API; wire-landblock guards; drive-pending
  ledger in IsConverged; route attach/detach latch; executor-drain drift
  model documented + source-pinned.

Gates: Runtime 1,003, App 4,039/3 skips, Headless 79, complete solution
10,816/0 failed/4 skips (Release, -m:1); connected lifecycle/reconnect
gate PASS (logs/connected-world-gate-20260802-175401; graceful exits,
world-visible, zero airborne rejections). The nine-stop soak remains red
for the pre-existing 6b28ff99 whole-world collision-clone throughput
regression (attributed with evidence; scheduled as its own slice before
C5). Dual Opus reviews (retail-conformance + adversarial): delta PASS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Headless/Hosting/HeadlessSessionHost.cs

@@ -120,6 +120,12 @@ internal sealed class HeadlessSessionHost : IDisposable
     private readonly RuntimeLocalPlayerFrameController _localPlayerFrame;
     private readonly HeadlessProcessContentOwner.HeadlessProcessContentLease?
         _contentLease;
+    /// <summary>C3c: one per-host first-entry drive controller (lazy — its
+    /// residence-begin subscription binds once against the persistent
+    /// Runtime lifetime) plus the active world projection it pumps
+    /// through.</summary>
+    private RuntimeFirstEntryDriveController? _firstEntryDrive;
+    private HeadlessSessionWorldProjection? _worldProjection;
     private int _disposeStage;
     private long _reconnectDeadline;
     private bool _reconnectPending;
@@ -295,6 +301,10 @@ internal sealed class HeadlessSessionHost : IDisposable
         _localPlayerFrame.AdvanceBeforeNetwork(
             checked((float)deltaSeconds));
         Runtime.Session.Tick();
+        // C3c: pump pending first-entry sequences after the network drain —
+        // collision-generation progress and freshly accepted Creates both
+        // surface here, mirroring the graphical per-frame retry phase.
+        _worldProjection?.PumpFirstEntry();
         _localPlayerFrame.RunPostNetworkCommandPhase();
         Runtime.ActionOwner.CombatAttack.Tick();
         _policy.Tick(Runtime, Commands);
@@ -525,10 +535,34 @@ internal sealed class HeadlessSessionHost : IDisposable
     private ILiveSessionEventRouting CreateEventRoute(
         AcDream.Core.Net.WorldSession session)
     {
-        IRuntimeDirectWorldProjection? worldProjection =
-            _contentLease is { } content
-                ? new HeadlessSessionWorldProjection(Runtime, content)
-                : null;
+        IRuntimeDirectWorldProjection? worldProjection = null;
+        if (_contentLease is { } content)
+        {
+            // C3c: one drive controller per host — the residence-begin
+            // notification binds once against the persistent Runtime
+            // lifetime; reconnects reuse it (its tracked entries are cleared
+            // with each retiring route).
+            _firstEntryDrive ??= new RuntimeFirstEntryDriveController(
+                Runtime.EntityObjects,
+                Runtime.Clock,
+                content.PreparedCollision,
+                () => PlayerMovementConstructionOptions.From(
+                    Runtime.CharacterOwner.MovementSkills.Snapshot),
+                // A headless host registers no shadow payloads — the local
+                // player is provably shapeless in the shadow registry, with
+                // the same default approach cylinder the deleted
+                // hand-resolve used.
+                static _ => new RuntimeLocalPlayerPhysicsActivationPreparation(
+                    Radius: 0.48f,
+                    Height: 1.835f,
+                    RuntimeLocalPlayerShadowDisposition.ProvenShapeless));
+            var projection = new HeadlessSessionWorldProjection(
+                Runtime,
+                content,
+                _firstEntryDrive);
+            _worldProjection = projection;
+            worldProjection = projection;
+        }
         var entities = new RuntimeLiveEntitySessionController(
             Runtime,
             session,
@@ -583,7 +617,8 @@ internal sealed class HeadlessSessionHost : IDisposable
         return new HeadlessSessionEventRoute(
             route,
             Runtime,
-            new HeadlessRuntimePlacementProjectionSink(Runtime));
+            new HeadlessRuntimePlacementProjectionSink(Runtime),
+            _firstEntryDrive);
     }
 
     private static LiveSessionCharacterSelector MapCharacterSelector(