fix(runtime): transient collision-seal failure no longer terminal for login (#357)

Login could hang forever at reveal ready=True with the world never
revealed: UI and sky drawn, geometry absent, client healthy. The player's
first-entry conductor was being terminally dropped by a TRANSIENT
condition.

Mechanism, pinned by probes: the C3c-F2 rearm guard validates the exact
destination cell's prefix admissibility before moving the dormant lease
out of AwaitingCell, but the placement transaction's ring search touches
NEIGHBOUR landblocks and TrySealCollisionEvaluationAuthority covers every
touched prefix. A hard login recenter admits nine landblocks at once, so
a rearm taken while a neighbour's admission was still registered passed
the guard and failed the seal. The operation was left in
AwaitingPreparation, IsDormantLocalActivationAwaitingCell went false, and
EvaluateActivation had no way to say 'retry' - it fell through to
RejectedAuthority, which RuntimeFirstEntryDriveController treats as
terminal. The local player left the pump (pending=0), the movement
controller never published, auto-entry never fired, the reveal never
completed. Timing-flipped: the same binary worked when the rearm landed
outside a neighbour's admission window, then lost that race consistently.

Fix is classification, not state: EvaluateActivation reports DeferredCell
when the abort happens while the dormant lease is still current
(IsDormantLocalActivationLeaseCurrent), so the conductor keeps retrying.
The operation deliberately stays in AwaitingPreparation - the retry
re-runs the full evaluation against fresh state, which is the recovery
contract the publication-state tests already pin (the SAME token
evaluates Evaluated once the authority settles). Genuine discards still
report RejectedAuthority. A first attempt that re-parked the lease to
AwaitingCell was rejected by the test matrix: recovery would then need
the rearm gate, which is stricter than the seal, and the
reentrant-restriction-mutation recoveries hung in DeferredCell.

Seven publication-state tests move their transient-abort assertion from
RejectedAuthority to DeferredCell; the two genuinely-terminal tests
(lease retired) are unchanged. The [wake]/[rearm]/[pump] probes that
pinned the mechanism stay behind ACDREAM_PROBE_PARK=1 with the rest of
the C4 family.

Exonerated by experiment before the fix: ACE (wire capture shows
PlayerCreate sent; retail logs in fine) and the portal-cue commit
2914e43a (full revert stalled identically).

Verified: 2/2 live logins reach auto-entered player mode and reveal
event=complete, with the probe showing seal-refused -> retry -> recovery
in flight; full Release suite 11,740 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/ISSUES.md

@@ -39,7 +39,47 @@ published-controller behaviour is unchanged.
 
 ## #357 — Login stalls: reveal reaches ready=True but the player is never placed; UI + sky render, world never opens
 
-**Status:** OPEN — filed 2026-08-08 during the Campaign A listening session,
+**Status:** CLOSED 2026-08-08 — root-caused and fixed same session (see the
+commit referencing this issue). **Root cause:** a transient collision-
+authority seal failure was classified as TERMINAL for the login conductor.
+The C3c-F2 rearm guard validates the EXACT destination cell's prefix before
+leaving `AwaitingCell`, but the placement transaction's ring search touches
+NEIGHBOUR landblocks, and `TrySealCollisionEvaluationAuthority` covers every
+touched prefix — so a rearm taken while a neighbour's collision admission
+was still registered (a hard login recenter admits nine at once) passed the
+guard and then failed the seal. The operation was left in
+`AwaitingPreparation`, which made `IsDormantLocalActivationAwaitingCell`
+false, which forced `EvaluateActivation` to report `RejectedAuthority` —
+terminal for `RuntimeFirstEntryDriveController`, which dropped the local
+player from its pump (`pending=0`), so the movement controller never
+published, auto-entry never fired, and the reveal never completed.
+Probe signature: `[rearm] verdict=OK` once, then silence.
+
+**Fix (classification, not state):** `EvaluateActivation` now reports
+`DeferredCell` when the evaluation aborts while the dormant lease is still
+current (`IsDormantLocalActivationLeaseCurrent`), keeping the conductor
+retrying; the operation deliberately stays in `AwaitingPreparation` so the
+retry re-runs the full evaluation against fresh state — the recovery path
+the publication-state tests already pin (the same token evaluates
+`Evaluated` once the authority settles). Genuine discards (lease retired /
+not current) still report `RejectedAuthority`. A first attempt that
+re-parked the operation back to `AwaitingCell` was REJECTED by the test
+matrix: recovery would then require the rearm gate, which is stricter than
+the seal, and the reentrant-restriction-mutation tests hung in
+`DeferredCell`.
+
+Seven publication-state tests updated from `RejectedAuthority` to
+`DeferredCell` at their transient-abort assertions (their substance —
+abort now, retained pending activation, same-token recovery — was already
+the retryable contract; only the status name told the conductor to give
+up). The `[wake]`/`[rearm]`/`[pump]` probes that pinned the mechanism are
+kept behind `ACDREAM_PROBE_PARK=1` with the rest of the C4 family.
+
+The portal-cue commit (`2914e43a`) was suspected and EXONERATED by
+experiment: a build with it fully reverted stalled with the identical
+probe signature. Wire capture had already exonerated ACE.
+
+**Original filing (evidence chain preserved below):** — filed 2026-08-08 during the Campaign A listening session,
 which it blocks. **This is a placement/streaming bug, not an audio bug** —
 read `docs/research/2026-08-05-c4-closeout-handoff.md` and
 `claude-memory/project_physics_collision_digest.md` before touching it.