feat(runtime): commit dormant SetPosition activation

docs/research/2026-08-01-runtime-local-player-physics-publication.md

@@ -2,19 +2,20 @@
 
 ## Scope
 
-This is placement Slice 4B2 checkpoints 4-5. It adds the dormant,
+This is placement Slice 4B2 checkpoints 4-6. It adds the dormant,
 presentation-independent transaction which prepares and assigns ownership of
-one local-player `PhysicsBody` and `PlayerMovementController`, then retains an
-exact post-ownership activation lease which can evaluate retail SetPosition
-without publishing it. No App or
-Headless production route invokes this transaction, so graphical and no-window
-game behavior is unchanged and AP-1/AD-1 remain open.
+one local-player `PhysicsBody` and `PlayerMovementController`, retains an exact
+post-ownership evaluation lease, and commits the canonical Runtime SetPosition
+activation in retail order. No App or Headless production route invokes this
+transaction yet, so graphical and no-window game behavior is unchanged and
+AP-1/AD-1 remain open until their hosts cut over.
 
-The checkpoints deliberately stop before canonical SetPosition activation.
-They do not consume the prepared placement operation, enter the body into the
-physics engine, publish FullCell/world/host/shadow/workset state, or project a
-presentation entity. Those effects belong to the next transaction and must all
-use the same Runtime-owned dormant body.
+Checkpoint 6 consumes the prepared placement operation only after the exact
+body/controller/identity/collision envelope is current. It publishes FullCell,
+world residence, host, shadow, workset, object-clock, and ordered Place state
+from that same Runtime-owned dormant body. There is no second body, mirrored
+gameplay owner, rollback mutation, or presentation callback inside the
+canonical tail.
 
 ## Ownership contract
 
@@ -46,8 +47,9 @@ the same server GUID as the exact entity incarnation.
 Unpublished candidates and ownership-committed dormant controllers reject live
 movement operations: update, public SetPosition, blip, outbound-position
 capture, movement/position send tracking, and shared-engine position commit.
-Only the subsequent activation transaction may promote `RuntimeOwnedDormant`
-to `RuntimePublished`; this checkpoint never invokes that transition. Once a
+Only the checkpoint-6 activation transaction may promote `RuntimeOwnedDormant`
+to `RuntimePublished`; preparation and evaluation never invoke that transition.
+Once a
 Runtime-owned dormant or published controller is replaced, reset, or disposed,
 its terminal retirement state rejects the same operations plus
 body/configuration mutation and manager acquisition. Publicly constructed
@@ -106,8 +108,9 @@ transaction is pure: it returns committed, deferred-cell, or rejected
 placement data without writing the canonical body, FullCell, clock, spatial
 worksets, shadows, collision-report owners, host, operation stage, or Place
 projection. A missing cell therefore leaves the exact body dormant and the
-authored operation retryable. A valid result likewise remains only an
-immutable evaluation receipt; this checkpoint has no activation/commit API.
+authored operation retryable. During evaluation, a valid result likewise
+remains only an immutable receipt; checkpoint 6's separate commit API consumes
+that receipt only after revalidating the complete activation envelope.
 
 Each evaluation carries an append-only, stable-order union of every cell read
 by the complete Core transaction: the AdjustPosition seed and adjusted cell,
@@ -154,6 +157,71 @@ discard is required before a new candidate can be prepared. Reset and disposal
 retire the lease, body, and dormant controller and include the pending
 activation in the ownership convergence ledger.
 
+## Canonical activation and retail ordering
+
+The implementation follows the named-retail chain rather than treating
+SetPosition as a single opaque callback:
+
+- `CPhysicsObj::SetPosition` at `0x005160C0` owns the outer placement call.
+- The internal wrapper at `0x00515BD0` evaluates residence and collision.
+- `CPhysicsObj::SetPositionInternal(CTransition*)` at `0x00515330` commits the
+  accepted frame/contact prefix and later shadow/cell state.
+- `CPhysicsObj::enter_world` at `0x00516170` is the final live edge.
+- `CPhysicsObj::leave_world` at `0x005155A0` is the canonical retirement edge.
+
+Runtime splits that chain into a prepared, callback-free transaction and an
+ordered notification suffix:
+
+1. Install the accepted frame and contact prefix on the still-dormant body and
+   perform the first acceleration calculation.
+2. Open one narrow dormant ground phase and invoke `HitGround` or
+   `LeaveGround`. Movement reapplication may call retail `set_velocity`, but
+   the phase closes with `Active=false`; the body is still out of world, has no
+   host/spatial membership, and its object clock is inactive.
+3. Synchronize accepted State and Vector authorities, run the post-ground
+   acceleration/sliding phase, and dispatch the already-installed collision
+   batch.
+4. Revalidate the complete ownership/collision envelope. Accepted State and
+   Vector updates are synchronized; Position, ObjDesc, Create, Setup,
+   incarnation, identity, collision-generation, body, controller, host, or
+   session displacement aborts the old transaction.
+5. Apply velocity-current physical response and stationary bits, prepare the
+   final shadow mutation and Place receipt, then perform the callback-free
+   FullCell/body/host/controller/spatial/object-clock tail.
+6. Dispatch exact shadow notifications and the ordered Place projection only
+   after the complete live graph is visible.
+
+Collision and shadow mutations use explicit prepare/apply/dispatch receipts.
+Receipt dispatch is exact-once and owner-local, so reverse-order receipts for
+different owners remain valid while a superseding mutation of the same owner
+stops the stale suffix. Collision owner states carry the exact SetPosition
+batch ID. Reentrant Position or newer-batch replacement suppresses remaining
+reciprocal/environment callbacks, and abort cleanup force-ends/removes only the
+still-exact old batch, including reverse rows and the environment latch. The
+combined Runtime physics ownership ledger includes pending collision and
+shadow SetPosition receipts; teardown cannot report convergence while either
+receipt remains.
+
+Candidate construction applies the accepted `PhysicsDesc` values in retail
+`CPhysicsObj::set_description` order before sealing ownership: final state,
+friction, clamped elasticity, `set_velocity` (including the 50-unit clamp),
+and angular velocity. Network acceleration remains parse-only because retail
+recalculates it from the final physics state. This initial vector bootstrap is
+required even when the SetPosition receipt's source Vector authority is still
+current; the later refresh intentionally skips in that case. Collision
+callbacks may advance State/Vector authority without invalidating the
+immutable geometry/identity envelope, and a changed Vector authority refreshes
+the dormant body through the same `set_velocity` path before physical response.
+
+A deferred-cell commit atomically suspends an authored shadow registration and
+consumes its notification receipt. Explicit publication discard cancels the
+exact SetPosition lease and body/controller ownership, while the suspended
+registration remains owned by the live entity/shadow registry and is reusable
+by a later activation. A deterministic discard -> generation-ready -> new
+activation gate proves the same registration restores without stale rows or a
+pending receipt. Entity/lifetime teardown remains the terminal owner of that
+suspended registration.
+
 ## Gates
 
 - Candidate privacy and live-operation rejection.
@@ -161,15 +229,22 @@ activation in the ownership convergence ledger.
   acquisition/binding, and remote-placement ownership.
 - Exact local-player identity, identity-switch, and disposed-identity rejection.
 - Exact same-body ownership in entity record and dormant movement controller.
-- Dormant rejection after ownership commit plus the isolated controller-level
-  `dormant -> activated -> live` lifecycle contract for the next checkpoint.
+- Initial PhysicsDesc velocity, angular velocity, friction, and elasticity
+  bootstrap, including activation with the retail 50-unit velocity clamp.
+- Dormant rejection after ownership commit plus the controller-level
+  `dormant -> activated -> live` lifecycle contract exercised by checkpoint 6.
 - No mutation of SetPosition, FullCell, spatial roots, host projections,
-  shadows, worksets, world residence, or presentation during this checkpoint.
+  shadows, worksets, world residence, or presentation during preparation or
+  evaluation; the separately gated activation commit owns those mutations.
 - Replacement by position, vector, final physics state, object description,
   CreateObject, remote/projectile/body/clock/controller ownership, and explicit
   placement cancellation.
 - Delete plus same-GUID reincarnation.
 - Candidate replacement, reset, disposal, and ownership convergence.
+- Publication/activation sequence exhaustion is preflighted before candidate
+  allocation or replacement, leaving no private or canonical owner behind.
+- Shadow-registry reset invalidates even a prepared, unapplied shapeless
+  transaction which owns no logical rows or pending dispatch receipt.
 - Pure committed/deferred/rejected SetPosition evaluation with bit-exact
   body-state snapshots and no canonical, collision-report, projection,
   clock, FullCell, host, shadow, workset, or operation-stage mutation.
@@ -193,30 +268,20 @@ activation in the ownership convergence ledger.
 - Terminal stale-controller rejection after replacement, reset, and disposal.
 - Body/controller epochs advance only on actual ownership changes.
 
-The checkpoint-5 focused publication suite passes 70/70 and the focused Core
-SetPosition suite passes 59/59. The complete Runtime project passes 666/666;
-the complete Core project passes 4,230 tests / 1 skip; and the App Runtime
-physics/movement ownership guard passes 6/6. The complete Release solution
-builds with zero errors (three pre-existing App-test nullability warnings are
-outside this checkpoint), and its invariant-culture test gate passes 10,419
-tests / 4 intentional skips. The installed prepared-package gate
-uses the exact local `acdream.pak`. Under the machine's Swedish current culture,
-the same three previously known formatting assertions remain unrelated (`0,5`
-versus `0.5` and localized sky text), so the canonical gate runs under
-invariant culture.
+The checkpoint-6 focused publication/collision suite passes 129/129, the
+focused Core shadow transaction suite passes 16/16, and the complete Runtime
+project passes 695/695 under invariant globalization. The Runtime Release build
+passes with zero warnings and zero errors. Broader Core/App/solution and
+connected gates remain for the parent integration checkpoint. Under the
+machine's Swedish current culture, the three previously known formatting
+assertions remain unrelated (`0,5` versus `0.5` and localized sky text), so the
+canonical Runtime gate runs under invariant globalization.
 
 ## Next checkpoint
 
-Add the canonical Runtime SetPosition activation transaction. Before its
-callback-free tail, it must prepare a presentation-independent Runtime
-`PhysicsHost`/`PositionManager`/`MoveToManager` graph, the existing authoritative
-authored shadow payload (without rebuilding AP-22 shapes), and an exact staged
-collision-report batch. Then it may commit the already-owned dormant body,
-contact/water/walkable/response state, object clock, FullCell, exact shadow,
-spatial/ordinary workset, host, and SetPosition operation versions; seal the
-ordered Place receipt; and invoke the sole `ActivateRuntimePublication`
-transition as the final tickable edge. Collision reports and the Place observer
-publish only afterward and must tolerate delete/reset re-entry without replaying
-physics. Every pre-commit failure leaves the dormant lease and authored
-operation retryable or rejects them; no rollback mutation and no second body or
-controller are allowed.
+Cut the graphical and no-window local-player hosts over to this Runtime-owned
+activation transaction, then delete their duplicate SetPosition
+activation/publication paths. The cutover must preserve the same exact body,
+controller, shadow payload, deferred-cell lease, collision receipt ordering,
+and graceful teardown proven here; no host may reconstruct or replay the
+canonical transaction.