feat(physics): C4 route 4b-2 — remote far snap through the canonical placement
Flips the SetPositionSimple classification (contact, PlayerDistance >= 96 m) for remotes onto 4b-1's drive controller and deletes both legacy far blocks, both duplicated 96f/4f constant pairs, and both `?? Vector3.Zero` fabrications. The 4 m constant now exists exactly once. Teleport and cell-less stay legacy for 4b-3. Retail: MoveOrTeleport @0x00516330's far branch runs StopInterpolating @0x005163CB before SetPositionSimple @0x005163D9 and returns 1 @0x005163E8 regardless — the SetPositionError is discarded — so HandleReceivedPosition arms ConstrainTo @0x00454272 post-move on commit AND on failure. The x87 parity decode at @0x00516393-@0x0051639E puts exactly 96.0 on the far branch. SetPositionSimple @0x005162B0 builds flags 0x1012 at @0x005162C4. Non-commit outcomes still advance the body, because retail's SetPositionInternal @0x00515BD0 commits the destination via store_position @0x00515CE2 when no cell resolves. The partition is by STAGE, not heuristic, enforced by an exhaustive switch: Refused/Contention/NotApplicable/RejectedPreparation store (the placement never executed); Committed/Deferred/RejectedByPlacement do not (the engine ran and refused, matching retail's non-storing returns @0x00515CB2 and @0x00515CD5). Without this a refused far snap froze the remote with an emptied queue. Also fixes a shipped defect this route made live: ParkDeferred's quiescence parks withdrew the entity (InWorld=false, clock suspended, residency removed) and were never restorable, while Forget(restoreCancelledPark: true) runs for every accepted Position on every entity. The restorable decision now lives inside ParkDeferred AFTER SnapToCell, reading body.CellPosition.ObjCellId — the value RestoreParkWithdrawal actually restores at — against every live quiescence rather than one minimum-OperationId token. The three pre-snap fields are hoisted into locals because SnapToCell ends with InWorld = true. ParkCollisionResidents passes restorableOnCancel: false explicitly; the plain unplaceable park is provably unchanged. RestoreParkWithdrawal re-tests the prefix at restore time so a retained route-2 park cannot re-admit into a prefix that began quiescing during the park. CanAttemptDestination is retained as an OPTIMISATION only, with the two Core predicates it cannot reproduce written down at the pre-flight, plus the two properties that depend on it staying there. Four fix rounds and eight Opus reviews. The slice was fully green at 10,990, 10,997 and 11,004 while containing real defects — a frozen remote pinned as correct by its own test, a fallback that over-wrote on the exact retail paths that decline to store, and a park guard incomplete on two independent axes. Register: AP-137 (leftover classifications take AP-87's catch-up; states the cell-less enqueue-vs-place delta deferred to 4b-3, that RejectedData is applied anyway, and the headless divergence), AP-138 (the refusable far placement), AP-136 narrowed to match the relocation. #309's acceptance steps rewritten — step 5 previously asserted a recovery the code does not perform — and gated on a new ACDREAM_PROBE_PARK=1 signal so the check cannot pass while broken. Suite 11,009 passed / 4 skipped / 0 failed against a measured 10,968 baseline. The 10,973 figure recorded earlier was wrong and is corrected here. Connected gate outstanding: the two-client far-snap walk and #309. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Erik
parent
1b631f127d
commit
7f1c1f5aa6
24 changed files with 5234 additions and 375 deletions
|
|
@ -64,10 +64,20 @@ internal enum RuntimeAcceptedPositionExecutionStatus : byte
|
|||
Contention,
|
||||
|
||||
/// <summary>
|
||||
/// The destination landblock's collision generation was not ready; the
|
||||
/// operation parked. The ack fires later, once
|
||||
/// The operation parked instead of committing. The ack fires later, once
|
||||
/// <see cref="RuntimeAcceptedPositionDriveController.Advance"/> observes
|
||||
/// the deferred commit.
|
||||
///
|
||||
/// Round 4 (2026-08-04, N3): the previous text named only one cause —
|
||||
/// "the destination landblock's collision generation was not ready" —
|
||||
/// which is <c>SubmitPreparedPlacementCore</c>'s plain
|
||||
/// <c>result.IsDeferred</c> park. Two other causes reach this same
|
||||
/// status and are asserted by this route's own tests: the PRE-engine
|
||||
/// collision-prefix quiescence park (the destination prefix is
|
||||
/// mid-retirement) and the POST-sweep one (a landblock the sweep merely
|
||||
/// TOUCHED is mid-retirement, which can rewrite an otherwise
|
||||
/// about-to-commit placement). All three are "parked, not committed";
|
||||
/// none of them means the placement failed.
|
||||
/// </summary>
|
||||
DeferredCell,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
using System.Numerics;
|
||||
using AcDream.Content;
|
||||
using AcDream.Core.Net.Messages;
|
||||
using AcDream.Core.Physics;
|
||||
|
|
@ -19,16 +20,41 @@ namespace AcDream.Runtime.Session;
|
|||
/// <see cref="RuntimeRemotePlacementDriveController"/> can
|
||||
/// ask, BEFORE attempting any canonical SetPosition, whether the accepted
|
||||
/// destination is one this host can actually place a remote into right now.
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Headless is not a live consumer, stated plainly (C4 route 4b-2, review
|
||||
/// fix).</b> The headless implementation above exists and is exact, but
|
||||
/// NOTHING in <c>AcDream.Headless</c> constructs a
|
||||
/// <see cref="RuntimeRemotePlacementDriveController"/>: the graphical
|
||||
/// composition root (<c>SessionPlayerComposition</c>) is the only
|
||||
/// construction site, and
|
||||
/// <c>RuntimeLiveEntitySessionController.OnPositionUpdated</c> returns early
|
||||
/// for every non-local GUID before any remote routing could occur. Route
|
||||
/// 4b-2's contract item 6 ("both hosts drive the identical Runtime entry
|
||||
/// point, or the divergence is stated plainly rather than satisfied
|
||||
/// vacuously") is therefore satisfied by THIS statement, not by a shared
|
||||
/// caller. The far snap is a graphical-host-only path until a headless
|
||||
/// remote-motion consumer exists.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
public interface IRuntimeRemotePlacementServiceWindow
|
||||
{
|
||||
/// <summary>
|
||||
/// True when <paramref name="landblockId"/>'s collision is currently
|
||||
/// published by this host, so a canonical SetPosition into it can be
|
||||
/// attempted without risking an un-wakeable <c>DeferredCell</c> park (see
|
||||
/// published by this host, so a canonical SetPosition into it is worth
|
||||
/// attempting rather than certain to park (see
|
||||
/// docs/research/2026-08-04-c4-route-4b-1-contract.md's "central
|
||||
/// decision"). <paramref name="landblockId"/> may be a full cell id — the
|
||||
/// implementation canonicalizes to the containing landblock.
|
||||
///
|
||||
/// <para>
|
||||
/// C4 route 4b-2 delta review: this answer is an OPTIMISATION only. It
|
||||
/// cannot be a correctness gate — see
|
||||
/// <see cref="RuntimeRemotePlacementDriveController"/>'s
|
||||
/// <c>CanAttemptDestination</c> for the two Core predicates that are
|
||||
/// strictly broader than any pre-flight, one of which reads a sweep
|
||||
/// footprint that does not exist until the sweep has run.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
bool IsWithinServiceWindow(uint landblockId);
|
||||
}
|
||||
|
|
@ -36,36 +62,208 @@ public interface IRuntimeRemotePlacementServiceWindow
|
|||
/// <summary>
|
||||
/// Typed yields for
|
||||
/// <see cref="RuntimeRemotePlacementDriveController.TryExecuteAcceptedRemotePosition"/>.
|
||||
///
|
||||
/// <para>
|
||||
/// <b>The partition this enum exists to express (C4 route 4b-2, delta review
|
||||
/// MAJOR A).</b> Retail's <c>CPhysicsObj::SetPositionInternal</c> @0x00515BD0
|
||||
/// has exactly two shapes, and the earlier three-value enum could not tell
|
||||
/// them apart:
|
||||
/// </para>
|
||||
/// <list type="bullet">
|
||||
/// <item><description><b>Stores.</b> <c>AdjustPosition</c> yielded no
|
||||
/// transition @0x00515C1D, so the resolve never ran:
|
||||
/// <c>prepare_to_leave_visibility</c> @0x00515CDA,
|
||||
/// <c>store_position(this, arg2)</c> @0x00515CE2,
|
||||
/// <c>CObjectMaint::GotoLostCell</c> @0x00515CF2, transient-state clear
|
||||
/// @0x00515CF7, <c>return 0</c> @0x00515D07. The object MOVES to the accepted
|
||||
/// destination.</description></item>
|
||||
/// <item><description><b>Does not store.</b> The resolve DID run and refused:
|
||||
/// <c>CheckPositionInternal == 0</c> @0x00515C85 →
|
||||
/// <c>handle_all_collisions</c> @0x00515CC2 →
|
||||
/// <c>return ((eax_14 - eax_14) & 2) + 2</c> @0x00515CD5 (2 or 4), and
|
||||
/// <c>sphere_path.curr_cell == 0</c> @0x00515C8F → <c>return 3</c>
|
||||
/// @0x00515CB2. Both leave the object where it was.</description></item>
|
||||
/// </list>
|
||||
/// <para>
|
||||
/// <see cref="RuntimeRemotePlacementExecutionStatusExtensions.StoresAcceptedDestination"/>
|
||||
/// is the single predicate that reads this partition; every value below
|
||||
/// states which side it falls on and WHY, so a new value cannot be added
|
||||
/// without deciding.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
internal enum RuntimeRemotePlacementExecutionStatus : byte
|
||||
{
|
||||
/// <summary>Out of this route's scope: not a disposition this
|
||||
/// controller owns (<see cref="RuntimeRemotePlacementDriveController.OwnsPlacement"/>),
|
||||
/// no canonical body, or no incarnation key.</summary>
|
||||
/// <summary>
|
||||
/// Out of this route's scope: not a disposition this controller owns
|
||||
/// (<see cref="RuntimeRemotePlacementDriveController.OwnsPlacement"/>),
|
||||
/// no canonical body, or no incarnation key. <b>Stores</b> — nothing ran.
|
||||
///
|
||||
/// <para>
|
||||
/// The three sub-cases are not symmetric, and round 3 (correction m4)
|
||||
/// states each. <i>Not owned</i> stores the accepted destination like any
|
||||
/// other never-ran outcome. <i>No canonical body</i> stores nothing:
|
||||
/// there is nowhere to write, which
|
||||
/// <see cref="RuntimeRemotePlacementDriveController.StoreAcceptedDestinationPose"/>
|
||||
/// tests directly rather than inferring from this value. <i>No
|
||||
/// incarnation key, with a body</i> DOES write, and that is correct on
|
||||
/// retail's partition — nothing ran, so the pose must advance — but it is
|
||||
/// unreachable in production regardless: the far arm requires an
|
||||
/// already-classified route, and
|
||||
/// <c>RuntimeAcceptedPositionRouteRequests.TryBuild</c> refuses to build
|
||||
/// one for a record whose <c>Key</c> is null, so no caller can hold a
|
||||
/// route for a keyless record.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
NotApplicable,
|
||||
|
||||
/// <summary>
|
||||
/// The central decision (see the class doc on
|
||||
/// <see cref="RuntimeRemotePlacementDriveController"/>): the accepted
|
||||
/// destination is not one this host can currently collision-publish, or
|
||||
/// the canonical SetPosition attempted anyway and Core still deferred it.
|
||||
/// No operation is retained either way — the entity keeps its last
|
||||
/// committed pose and waits for the next accepted Position, which for a
|
||||
/// remote is a 5-10 Hz stream away.
|
||||
/// <see cref="RuntimeRemotePlacementDriveController"/>): the pre-flight
|
||||
/// declined to attempt this destination at all, so no operation was ever
|
||||
/// begun and the canonical resolve never ran.
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Stores.</b> This is exactly retail's no-transition branch — "no cell
|
||||
/// for it here", never "do not move". See
|
||||
/// <see cref="RuntimeRemotePlacementDriveController.ApplyAcceptedRemoteFarSnap"/>.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
Refused,
|
||||
|
||||
/// <summary>The entity already holds an active operation — a concurrent
|
||||
/// placement authority (portal/teleport/another host route) or this
|
||||
/// controller's own still-outstanding preparation retry.</summary>
|
||||
/// <summary>
|
||||
/// <see cref="RuntimeSetPositionState.TryBeginExclusiveAuthoredPlacement"/>
|
||||
/// refused, or this controller retained a preparation retry.
|
||||
///
|
||||
/// <para>
|
||||
/// Round 3 (correction m2) — the producers this route can actually reach,
|
||||
/// not the two the earlier text named. The Begin refuses when the entity
|
||||
/// already holds an active operation (a concurrent placement authority —
|
||||
/// portal, teleport, another host route), when it holds a RETAINED
|
||||
/// COMPLETION that has not been acknowledged yet
|
||||
/// (<c>HasRetainedCompletion</c> — ordinary right after a
|
||||
/// <see cref="Committed"/> far snap whose projection sink declined), or
|
||||
/// when the record is no longer the current incarnation
|
||||
/// (<c>!IsCurrent</c>). Its remaining refusals cannot fire from here:
|
||||
/// the expected position-authority version is read off the same record
|
||||
/// one statement earlier, and the accepted destination was already
|
||||
/// required non-null by the pre-flight. This controller adds the fourth
|
||||
/// producer: a retryable preparation status
|
||||
/// (<c>RetrySetupUnavailable</c>/<c>RetryWorldFrameUnavailable</c>).
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Stores</b> in every one of those shapes: all four are decided
|
||||
/// before <c>_physics.Engine.SetPosition</c> is called for THIS packet,
|
||||
/// and retail never waits for an asset before committing the pose.
|
||||
/// (<see cref="RuntimeRemotePlacementDriveController.StoreAcceptedDestinationPose"/>
|
||||
/// re-validates currency itself, so the <c>!IsCurrent</c> producer cannot
|
||||
/// write through a superseded record.)
|
||||
/// </para>
|
||||
/// </summary>
|
||||
Contention,
|
||||
|
||||
/// <summary>The canonical SetPosition committed synchronously.</summary>
|
||||
/// <summary>
|
||||
/// Preparation refused TERMINALLY, before anything was submitted:
|
||||
/// <c>RuntimeSetPositionMoverPreparationStatus.RejectedAuthority</c> (the
|
||||
/// operation/authority pair went stale between Begin and prepare) or
|
||||
/// <c>InvalidData</c> (the accepted frame fails
|
||||
/// <c>PositionFrameValidation</c>, or the prepared mover could not be
|
||||
/// built).
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Stores.</b> The engine was never called — this is the same
|
||||
/// "placement never executed" state as <see cref="Refused"/>, reached one
|
||||
/// stage later. Kept distinct from <see cref="RejectedByPlacement"/>
|
||||
/// because that one is the opposite side of the partition.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
RejectedPreparation,
|
||||
|
||||
/// <summary>The canonical SetPosition committed synchronously.
|
||||
/// <b>Does not store</b>: the committed pose IS the settled pose, and it
|
||||
/// is already on the canonical body.</summary>
|
||||
Committed,
|
||||
|
||||
/// <summary>Rejected/cancelled by Core (invalid prepared data, authority
|
||||
/// displaced mid-submit).</summary>
|
||||
Rejected,
|
||||
/// <summary>
|
||||
/// Core parked the placement (<c>RuntimeSetPositionStatus.DeferredCell</c>)
|
||||
/// and this controller cancelled-and-restored it immediately rather than
|
||||
/// retaining a watch — no park survives this controller.
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Does not store.</b> <c>ParkDeferred</c> has ALREADY performed
|
||||
/// retail's <c>store_position</c>: it snaps the body to the parked result
|
||||
/// before withdrawing (and <c>RestoreParkWithdrawal</c> deliberately
|
||||
/// leaves that pose alone). For the pre-sweep quiescence park that result
|
||||
/// is the accepted destination; for the post-sweep one it is the
|
||||
/// COLLISION-SETTLED <c>spherePath.CurPos</c>, and writing the raw
|
||||
/// destination over it would undo the settle (delta review N2). The two
|
||||
/// <c>DeferredCell</c> returns that park nothing
|
||||
/// (<c>InheritedLostDeadline</c>, <c>WakeableLostCell</c>) are
|
||||
/// unreachable here: <c>TryBeginExclusiveAuthoredPlacement</c> refuses
|
||||
/// whenever an operation already exists for the key, so neither flag can
|
||||
/// be inherited, and this controller's own retained entries are
|
||||
/// preparation retries that have not parked.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
Deferred,
|
||||
|
||||
/// <summary>
|
||||
/// The canonical placement EXECUTED and did not commit:
|
||||
/// <c>RuntimeSetPositionStatus.Rejected</c> (the engine's own sweep
|
||||
/// refused the destination — <c>PhysicsEngine.SetPosition</c> returned a
|
||||
/// non-Ok error, acdream's port of @0x00515CD5/@0x00515CB2) or
|
||||
/// <c>Cancelled</c> (authority was displaced after the engine ran, which
|
||||
/// includes the case where <c>CommitCanonical</c> had already SETTLED the
|
||||
/// body).
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Does not store.</b> Retail's matching returns (2/3/4) leave the
|
||||
/// object where it was, and the <c>Cancelled</c>-after-commit shape has a
|
||||
/// freshly settled pose (contact plane, step-down) that a raw destination
|
||||
/// write would destroy.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// Round 3 (correction B2): "EXECUTED" is a reachability property of the
|
||||
/// producers this route can reach, not a structural guarantee Core
|
||||
/// enforces. <c>RuntimeSetPositionStatus.Rejected</c> has two other,
|
||||
/// PRE-engine producers in <c>SubmitPreparedPlacementCore</c>, both
|
||||
/// unreachable through this controller; the <c>default:</c> arm of
|
||||
/// <see cref="RuntimeRemotePlacementDriveController.SubmitAndResolve"/>
|
||||
/// enumerates exactly what each depends on, and why the failure direction
|
||||
/// if one is ever broken is the safe one.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
RejectedByPlacement,
|
||||
}
|
||||
|
||||
internal static class RuntimeRemotePlacementExecutionStatusExtensions
|
||||
{
|
||||
/// <summary>
|
||||
/// True when retail's <c>store_position</c> @0x00515CE2 is what this
|
||||
/// outcome corresponds to: the canonical placement never reached the
|
||||
/// engine, so nothing has committed a pose to the body and the remote
|
||||
/// would otherwise be frozen at a superseded one. See the enum's own doc
|
||||
/// for the retail partition and for why each value falls where it does.
|
||||
///
|
||||
/// <para>
|
||||
/// Written as an exhaustive switch rather than a set test so adding a
|
||||
/// value is a compile-time decision, not a silent default.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
internal static bool StoresAcceptedDestination(
|
||||
this RuntimeRemotePlacementExecutionStatus status) =>
|
||||
status switch
|
||||
{
|
||||
RuntimeRemotePlacementExecutionStatus.NotApplicable => true,
|
||||
RuntimeRemotePlacementExecutionStatus.Refused => true,
|
||||
RuntimeRemotePlacementExecutionStatus.Contention => true,
|
||||
RuntimeRemotePlacementExecutionStatus.RejectedPreparation => true,
|
||||
RuntimeRemotePlacementExecutionStatus.Committed => false,
|
||||
RuntimeRemotePlacementExecutionStatus.Deferred => false,
|
||||
RuntimeRemotePlacementExecutionStatus.RejectedByPlacement => false,
|
||||
_ => throw new ArgumentOutOfRangeException(nameof(status)),
|
||||
};
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
|
|
@ -85,7 +283,21 @@ internal enum RuntimeRemotePlacementExecutionStatus : byte
|
|||
/// <c>SendPositionEvent</c> — <c>HandleReceivedPosition</c> @0x00453FD0 calls
|
||||
/// it only on the local-player FORCE_POSITION branch. There is nothing here
|
||||
/// resembling route 2's <c>PositionEventOwed</c>/<c>SendPositionEvent</c>
|
||||
/// pair.</description></item>
|
||||
/// pair. <b>The separate question 4b-1's review left open is now settled</b>
|
||||
/// (C4 route 4b-2 review fix): the <c>SetPositionStruct</c> flag
|
||||
/// <c>SEND_POSITION_EVENT_SPF = 0x1000</c> — which
|
||||
/// <c>CPhysicsObj::SetPositionSimple</c> @0x005162B0 sets as part of
|
||||
/// <c>0x1012</c> @0x005162C4 and which therefore reaches
|
||||
/// <c>TryPrepareAndSubmitAuthoredPlacement</c> here — is <b>never read</b>.
|
||||
/// The commit path <c>CPhysicsObj::SetPositionInternal</c>
|
||||
/// @0x00515330-@0x00515593 takes only <c>this</c> and the <c>CTransition</c>
|
||||
/// and never sees the struct; the flag-reading overload @0x00515BD0 tests
|
||||
/// only bit 5 (<c>DONOTCREATECELLS_SPF = 0x20</c>) @0x00515BF8/@0x00515C6C;
|
||||
/// and no site anywhere in the decomp tests bit 12 of a
|
||||
/// <c>SetPositionStruct</c>. It is a carried, inert flag, entirely distinct
|
||||
/// from <c>CommandInterpreter::SendPositionEvent</c> @0x006B4770 (dispatched
|
||||
/// from @0x00454091, the local-player branch 4b-1 already
|
||||
/// cleared).</description></item>
|
||||
/// <item><description><b>No re-issue funnel.</b> Route 2 re-issues a dead
|
||||
/// operation because a ForcePosition is a one-shot correction ACE never
|
||||
/// repeats. A remote Position is a REPEATED stream — re-issuing packet N
|
||||
|
|
@ -104,42 +316,66 @@ internal enum RuntimeRemotePlacementExecutionStatus : byte
|
|||
/// </list>
|
||||
///
|
||||
/// <para>
|
||||
/// <b>The central decision — refuse, do not park.</b>
|
||||
/// <b>The central decision — avoid the PARK where it is cheap to, never the
|
||||
/// tracking.</b>
|
||||
/// <see cref="RuntimeSetPositionState"/>'s <c>DeferredCell</c> park
|
||||
/// withdraws the entity from the world (<c>ParkDeferred</c> sets
|
||||
/// <c>body.InWorld = false</c>, suspends the object clock, and publishes a
|
||||
/// <c>Withdraw</c>) — and <c>RuntimeEntityObjectLifetime.TryApplyPosition</c>
|
||||
/// calls <c>RuntimeSetPositionState.Forget</c> on EVERY subsequent accepted
|
||||
/// Position for that same entity, regardless of disposition. <c>Forget</c>'s
|
||||
/// <c>CancelCoreDeferred</c> removes the operation and rewrites the
|
||||
/// <c>Withdraw</c> into a <c>Discard</c> WITHOUT restoring <c>InWorld</c>,
|
||||
/// resuming the clock, or re-entering residency. Because ACE broadcasts a
|
||||
/// remote's Position every 100-150 ms — almost always faster than the
|
||||
/// collision-generation wake this park would need to resolve on its own —
|
||||
/// any DeferredCell park opened here would be cancelled by the entity's own
|
||||
/// next packet long before it could wake, leaving the entity invisible AND
|
||||
/// intangible for the rest of the session. <see cref="_serviceWindow"/>
|
||||
/// exists to prevent this controller from ever attempting a SetPosition
|
||||
/// whose destination cannot be placed right now: <see cref="TryExecuteAcceptedRemotePosition"/>
|
||||
/// Position for that same entity, regardless of disposition. Because ACE
|
||||
/// broadcasts a remote's Position every 100-150 ms — almost always faster
|
||||
/// than the collision-generation wake this park would need to resolve on its
|
||||
/// own — any DeferredCell park opened here would be cancelled by the
|
||||
/// entity's own next packet long before it could wake.
|
||||
/// <b>Correcting this paragraph's earlier claim</b> (4b-1's review ordered it
|
||||
/// and it shipped uncorrected): that cancellation no longer strands the
|
||||
/// entity "invisible AND intangible for the rest of the session".
|
||||
/// <see cref="CancelToken"/> passes <c>restoreCancelledPark: true</c>, and
|
||||
/// <c>RuntimeSetPositionState.RestoreParkWithdrawal</c> rolls
|
||||
/// <c>InWorld</c>, the object clock, and canonical residency back — the
|
||||
/// AP-136 behaviour <c>634bc551</c> landed. The park is still worth avoiding
|
||||
/// (a restored park re-shows the entity where retail keeps it hidden until
|
||||
/// cell load, which is precisely what AP-136 records), so
|
||||
/// <see cref="_serviceWindow"/> stays — but it is an OPTIMISATION, not a
|
||||
/// correctness mechanism, and it is never the reason a remote stops
|
||||
/// tracking the server (see
|
||||
/// <see cref="ApplyAcceptedRemoteFarSnap"/>'s <c>store_position</c>
|
||||
/// fallback). <see cref="TryExecuteAcceptedRemotePosition"/>
|
||||
/// checks it BEFORE calling
|
||||
/// <see cref="RuntimeSetPositionState.TryBeginExclusiveAuthoredPlacement"/>,
|
||||
/// and if Core still returns <c>DeferredCell</c> despite the guard passing,
|
||||
/// the operation is cancelled immediately rather than retained, so the
|
||||
/// ledger still converges even though the guard's invariant did not hold for
|
||||
/// that one packet. <b>Why the guard can still miss (the co-extensivity
|
||||
/// finding and its residual):</b> a tier/residency-backed service window
|
||||
/// (the graphical host's <c>GpuWorldState.IsNearTier</c>, headless's
|
||||
/// that one packet.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Why a pre-flight structurally cannot be the correctness mechanism (C4
|
||||
/// route 4b-2, delta review MAJOR B/C).</b> A tier/residency-backed service
|
||||
/// window (the graphical host's <c>GpuWorldState.IsNearTier</c>, headless's
|
||||
/// collision-published check) is co-extensive with collision PUBLICATION in
|
||||
/// both directions — verified by reading both tier-writer call sites
|
||||
/// (promotion cannot read Near before collision commits) and the retirement
|
||||
/// call site (the tier flips to Far as the FIRST, synchronous step of
|
||||
/// retirement, strictly before collision-side withdrawal). It is NOT
|
||||
/// co-extensive with a live in-place collision-prefix MUTATION that leaves
|
||||
/// the tier/residency reading unchanged while the prefix quiesces —
|
||||
/// <see cref="RuntimeSetPositionState"/>'s private <c>TryGetBlockingQuiescence</c>
|
||||
/// is Core's own check for exactly that case, and it is what a placement can
|
||||
/// still hit even after this guard passes. That one narrow window is the
|
||||
/// residual this guard cannot close from outside Core.
|
||||
/// co-extensive with a live in-place collision-prefix MUTATION, which is why
|
||||
/// <see cref="CanAttemptDestination"/> also reads Core's own
|
||||
/// <see cref="RuntimeSetPositionState.IsCollisionPrefixQuiescing"/>. But even
|
||||
/// that pair only tests ONE prefix — the DESTINATION's — while Core's park
|
||||
/// predicates are broader: <c>ResultTouchesPrefix</c> scans every
|
||||
/// <c>QueriedCellIds</c> entry, a sweep footprint that provably spans
|
||||
/// NEIGHBOUR landblocks (<c>CellTransit.AddOutsideCell</c> re-derives the
|
||||
/// block id from the global lcoord and has no same-block filter). The sweep
|
||||
/// footprint does not exist until the sweep has run, so no pre-flight can
|
||||
/// close that half. <b>The correctness mechanism is therefore at the source:</b>
|
||||
/// <c>SubmitPreparedPlacementCore</c>'s two quiescence parks are RESTORABLE,
|
||||
/// and <c>ParkDeferred</c> decides whether the rollback is safe by testing
|
||||
/// the cell it will actually restore into — after the snap, against EVERY
|
||||
/// live quiescence — so the rollback re-admits nothing into ANY quiescing
|
||||
/// prefix, which is the only thing AP-136's blanket non-restorable scoping
|
||||
/// was protecting. This guard merely shrinks the reachable set. Recorded as
|
||||
/// AP-138(2).
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
|
|
@ -198,6 +434,13 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
/// is mid-iteration can never corrupt its scratch buffer.
|
||||
/// </summary>
|
||||
private readonly List<RuntimeEntityKey> _awaitingAcknowledgementScratch = [];
|
||||
/// <summary>
|
||||
/// R9 review fix: <see cref="CountLivePending"/>'s own removal buffer,
|
||||
/// kept separate from <see cref="_driveScratch"/> (owned by
|
||||
/// <see cref="Advance"/>) for the same reason
|
||||
/// <see cref="_awaitingAcknowledgementScratch"/> is.
|
||||
/// </summary>
|
||||
private readonly List<RuntimeEntityKey> _pendingScratch = [];
|
||||
private bool _driving;
|
||||
private object? _routeOwner;
|
||||
|
||||
|
|
@ -215,7 +458,7 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
_serviceWindow = serviceWindow
|
||||
?? throw new ArgumentNullException(nameof(serviceWindow));
|
||||
_entityObjects.RegisterRemotePlacementDriveOwnership(
|
||||
() => _pending.Count);
|
||||
CountLivePending);
|
||||
// B4 review fix: a second, independent registration — multiple
|
||||
// registrations sum (RegisterRemotePlacementDriveOwnership's own doc
|
||||
// comment) — so the awaiting-acknowledgement dimension is visible in
|
||||
|
|
@ -230,6 +473,9 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
/// that dimension is reported to the lifetime's ownership ledger via the
|
||||
/// constructor's second <c>RegisterRemotePlacementDriveOwnership</c> call
|
||||
/// (B4 review fix) and has no separate test-visible counter of its own.
|
||||
/// Raw, unhealed: this is the map's literal size. The ownership ledger
|
||||
/// reads <see cref="CountLivePending"/> instead, which prunes entries Core
|
||||
/// has already retired (R9 review fix).
|
||||
/// </summary>
|
||||
internal int PendingCount => _pending.Count;
|
||||
|
||||
|
|
@ -398,10 +644,14 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
CreateObject.ServerPosition? destination =
|
||||
record.Snapshot.Physics?.Position ?? record.Snapshot.Position;
|
||||
if (destination is not { } accepted
|
||||
|| !_serviceWindow.IsWithinServiceWindow(accepted.LandblockId))
|
||||
|| !CanAttemptDestination(setPosition, accepted.LandblockId))
|
||||
{
|
||||
// The central decision: refuse rather than open a park this
|
||||
// host's own service window could never wake.
|
||||
// The central decision: skip a placement this host already knows
|
||||
// will only park and be cancelled again. An OPTIMISATION — see
|
||||
// CanAttemptDestination for the two Core predicates it cannot
|
||||
// reproduce and where correctness actually lives — and the body
|
||||
// still advances, because Refused is on the storing side of
|
||||
// retail's partition.
|
||||
return RuntimeRemotePlacementExecutionStatus.Refused;
|
||||
}
|
||||
|
||||
|
|
@ -416,6 +666,218 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
return SubmitAndResolve(record, token, route);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// C4 route 4b-2: retail's far branch, end to end, for one remote whose
|
||||
/// accepted Position already classified to
|
||||
/// <see cref="RuntimeRemoteFarSnapPosition.OwnsFarSnap"/>. This is the
|
||||
/// route's FIRST production caller of
|
||||
/// <see cref="TryExecuteAcceptedRemotePosition"/>.
|
||||
///
|
||||
/// <code>
|
||||
/// 005163c1 position_manager = this_1->position_manager;
|
||||
/// 005163c9 if (position_manager != 0)
|
||||
/// 005163cb PositionManager::StopInterpolating(position_manager);
|
||||
/// 005163d9 CPhysicsObj::SetPositionSimple(this_1, arg2, 1);
|
||||
/// 005163e8 return 1;
|
||||
/// </code>
|
||||
///
|
||||
/// <para>
|
||||
/// The ORDER is load-bearing and is why this lives here rather than being
|
||||
/// assembled by a caller: <c>StopInterpolating</c> runs strictly BEFORE
|
||||
/// the placement (@0x005163CB before @0x005163D9). acdream's
|
||||
/// <c>InterpolationManager</c> queue is the analogue — a stale near
|
||||
/// waypoint surviving a far snap would immediately drag the freshly
|
||||
/// placed body back toward it on the next per-tick catch-up. The
|
||||
/// classifier's own <c>StopInterpolating</c> flag
|
||||
/// (<c>RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition</c>'s
|
||||
/// remote tail, <c>StopInterpolating: !nearby</c>) is what gates it, so
|
||||
/// the retail condition is read from the route rather than restated.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// The destination is NOT a parameter: it is read from the canonical
|
||||
/// merged snapshot by <see cref="TryExecuteAcceptedRemotePosition"/> and
|
||||
/// resolved through Runtime's own accepted world frame
|
||||
/// (<c>resolveWorldOffsetFromRuntimeFrame: true</c>). A caller's
|
||||
/// separately-derived world position is not a second input — #283 proved
|
||||
/// by measurement that App's streaming origin and Runtime's world frame
|
||||
/// cannot disagree, and <c>LiveWorldOriginState.EnsureAgreesWithRuntimeFrame</c>
|
||||
/// is terminal if they ever do.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// <c>ConstrainTo</c> is deliberately NOT armed here.
|
||||
/// <c>SmartBox::HandleReceivedPosition</c> owns retail's single arming
|
||||
/// site (@0x00454272) for all three nonzero-returning branches; acdream's
|
||||
/// analogue is
|
||||
/// <see cref="RuntimeRemoteSteadyStatePosition.TryArmConstraintAfterOperation"/>,
|
||||
/// called once by the caller after the routing block. Arming inside this
|
||||
/// method would be the second site the route 4b scoping forbids.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// <b>The <c>store_position</c> fallback (C4 route 4b-2 review fix — the
|
||||
/// one root defect).</b> Every outcome for which the canonical placement
|
||||
/// never reached the engine
|
||||
/// (<see cref="RuntimeRemotePlacementExecutionStatusExtensions.StoresAcceptedDestination"/>)
|
||||
/// still advances the body to the accepted destination pose, through
|
||||
/// <see cref="StoreAcceptedDestinationPose"/>. Without it a refused,
|
||||
/// contended, or preparation-rejected far snap left the body at its stale
|
||||
/// pose with the interpolation queue ALREADY cleared by the
|
||||
/// <c>StopInterpolating</c> above — a frozen remote that the next 5-10 Hz
|
||||
/// packet simply reproduces, because nothing about the refusal reason
|
||||
/// changes at packet cadence.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// This is retail, not a symptom patch.
|
||||
/// <c>CPhysicsObj::SetPositionInternal</c> @0x00515BD0 takes the
|
||||
/// no-transition branch @0x00515C1D whenever <c>AdjustPosition</c>
|
||||
/// resolves no cell, and that branch commits the destination pose —
|
||||
/// <c>prepare_to_leave_visibility</c> @0x00515CDA,
|
||||
/// <c>store_position(this, arg2)</c> @0x00515CE2,
|
||||
/// <c>CObjectMaint::GotoLostCell</c> @0x00515CF2 — and returns 0
|
||||
/// (success) @0x00515D07. "This host cannot resolve a cell for the
|
||||
/// destination right now" is exactly that state; retail moves the object
|
||||
/// and hides it pending cell load, and never leaves it standing at a
|
||||
/// superseded pose. The deleted legacy far block also always tracked.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>The other half of retail's partition is honoured too (delta review
|
||||
/// MAJOR A — correcting this comment's earlier claim that no non-commit
|
||||
/// outcome could represent it).</b> Retail's failure returns that do NOT
|
||||
/// store — <c>curr_cell == 0</c> @0x00515C8F/@0x00515CB2 and the blocked
|
||||
/// <c>CheckPositionInternal</c> @0x00515C85/@0x00515CD5 — are reached
|
||||
/// AFTER the resolve ran, and acdream CAN represent that:
|
||||
/// <see cref="RuntimeRemotePlacementExecutionStatus.RejectedByPlacement"/>
|
||||
/// is returned when <c>PhysicsEngine.SetPosition</c> itself refused, or
|
||||
/// when authority was displaced after it ran (including after
|
||||
/// <c>CommitCanonical</c> had already settled the body). Those do not
|
||||
/// store, so a destination the engine's own sweep refuses no longer
|
||||
/// teleports the canonical body into it, and a just-settled pose is never
|
||||
/// overwritten. The residual is recorded as AP-138.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
internal RuntimeRemotePlacementExecutionStatus ApplyAcceptedRemoteFarSnap(
|
||||
RuntimeEntityRecord record,
|
||||
RemoteMotion remote,
|
||||
in RuntimeAuthoritativePositionRoute route)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(record);
|
||||
ArgumentNullException.ThrowIfNull(remote);
|
||||
if (!RuntimeRemoteFarSnapPosition.OwnsFarSnap(route))
|
||||
{
|
||||
throw new ArgumentException(
|
||||
"Only a remote far-snap classification (SetPositionSimple, "
|
||||
+ "RemoteAuthoritative, Teleport-flagged) may be applied "
|
||||
+ "through the far-snap arm; the caller must select the arm "
|
||||
+ "with RuntimeRemoteFarSnapPosition.ResolveArm.",
|
||||
nameof(route));
|
||||
}
|
||||
|
||||
if (route.StopInterpolating)
|
||||
remote.Interp.Clear();
|
||||
RuntimeRemotePlacementExecutionStatus status =
|
||||
TryExecuteAcceptedRemotePosition(record, route);
|
||||
if (status.StoresAcceptedDestination())
|
||||
StoreAcceptedDestinationPose(record);
|
||||
return status;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Retail <c>CPhysicsObj::store_position</c> @0x00515CE2, reached from
|
||||
/// <c>SetPositionInternal</c>'s no-resolvable-cell branch @0x00515C1D.
|
||||
/// Commits the SAME accepted destination
|
||||
/// <see cref="TryExecuteAcceptedRemotePosition"/> reads — the canonical
|
||||
/// merged snapshot, resolved through Runtime's own accepted world frame,
|
||||
/// which is the exact pair
|
||||
/// <c>RuntimeSetPositionMoverPreparer.TryBuild</c> composes for a
|
||||
/// committed placement (<c>cellLocal + ShadowWorldOffset</c> in X/Y, the
|
||||
/// authored Z, the authored quaternion). A caller's separately-derived
|
||||
/// wire pose is deliberately not an input here either, for the same
|
||||
/// reason the committed path does not take one.
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Currency is re-validated first (delta review MAJOR D).</b>
|
||||
/// <see cref="CancelToken"/> publishes its cancellation receipt
|
||||
/// SYNCHRONOUSLY, and the production placement-projection sink can delete
|
||||
/// or replace this incarnation from inside that publish — so by the time
|
||||
/// control returns to <see cref="ApplyAcceptedRemoteFarSnap"/> the record
|
||||
/// may no longer be the canonical one for its GUID. Writing a pose
|
||||
/// through a superseded incarnation is the exact class the R5 fix
|
||||
/// introduced the rule for, and
|
||||
/// <c>RuntimeSetPositionState.RestoreParkWithdrawal</c> already guards the
|
||||
/// same way. The App-side re-validation happens only after this seam
|
||||
/// returns, which is too late.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// <b>The write target is the CANONICAL body (delta review N5).</b>
|
||||
/// Retail's <c>store_position(this, arg2)</c> writes the CPhysicsObj's own
|
||||
/// position, and acdream's canonical CPhysicsObj is
|
||||
/// <see cref="RuntimeEntityRecord.PhysicsBody"/>.
|
||||
/// <c>RemoteMotion.Body</c> IS that instance in production, by two
|
||||
/// independent routes: <c>RuntimePhysicsState.GetOrCreateRemoteMotion</c>
|
||||
/// passes <c>record.PhysicsBody</c> into the constructor, and when the
|
||||
/// record has no body yet <c>SetRemoteMotion</c> ADOPTS the component's
|
||||
/// private one as canonical (<c>InitializeNewPhysicsBody</c> +
|
||||
/// <c>SetPhysicsBody</c>). So the divergent pair is not constructible
|
||||
/// through the production seam and this change moves no production
|
||||
/// behaviour — it removes the ability to write a pose into a body the
|
||||
/// canonical record does not own, which is what
|
||||
/// <see cref="RuntimeRemotePlacementExecutionStatus.NotApplicable"/>'s
|
||||
/// no-body producer would otherwise permit for a caller-supplied
|
||||
/// component. Reading the record directly makes "there is no canonical
|
||||
/// body" and "there is nothing to store into" the same test.
|
||||
/// </para>
|
||||
///
|
||||
/// <para>
|
||||
/// Returns false only when there is nothing to write, or nowhere to write
|
||||
/// it: no canonical body, no accepted destination on the snapshot, a
|
||||
/// superseded incarnation, or no Runtime world frame yet. The last case
|
||||
/// reuses Core's own #284 policy —
|
||||
/// <see cref="RuntimePhysicsState.ThrowIfWorldFrameUnreachable"/> makes a
|
||||
/// frame that can never arrive terminal rather than silent — so the only
|
||||
/// surviving false there is the genuine pre-local-player-Create window,
|
||||
/// which the far arm cannot reach anyway: the classifier needs a live
|
||||
/// <c>player_distance</c> to emit <c>SetPositionSimple</c> at all, and
|
||||
/// that requires the local movement controller to exist.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
private bool StoreAcceptedDestinationPose(RuntimeEntityRecord record)
|
||||
{
|
||||
if (!_entityObjects.Entities.IsCurrent(record)
|
||||
|| record.PhysicsBody is not { } body)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
CreateObject.ServerPosition? destination =
|
||||
record.Snapshot.Physics?.Position ?? record.Snapshot.Position;
|
||||
if (destination is not { } accepted)
|
||||
return false;
|
||||
|
||||
if (!_entityObjects.Physics.TryGetWorldFrameOffset(
|
||||
accepted.LandblockId,
|
||||
out float worldOffsetX,
|
||||
out float worldOffsetY))
|
||||
{
|
||||
_entityObjects.Physics.ThrowIfWorldFrameUnreachable(
|
||||
accepted.LandblockId);
|
||||
return false;
|
||||
}
|
||||
|
||||
body.Position = new Vector3(
|
||||
accepted.PositionX + worldOffsetX,
|
||||
accepted.PositionY + worldOffsetY,
|
||||
accepted.PositionZ);
|
||||
body.Orientation = new Quaternion(
|
||||
accepted.RotationX,
|
||||
accepted.RotationY,
|
||||
accepted.RotationZ,
|
||||
accepted.RotationW);
|
||||
return true;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Host cadence pump: retries a preparation-only retry status
|
||||
/// (<c>RetrySetupUnavailable</c>/<c>RetryWorldFrameUnavailable</c>) by
|
||||
|
|
@ -457,24 +919,35 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
// B3 review fix: a retry can sit retained across many host
|
||||
// cadence pumps (bounded only by how long the asset stayed
|
||||
// unavailable) while its destination's collision publication
|
||||
// retires out from under it. Re-check the SAME service-window
|
||||
// guard the entry point uses BEFORE resubmitting — dropping
|
||||
// (and cancelling the already-begun token) rather than
|
||||
// resubmitting matches the entry point's own Refused
|
||||
// semantics: no operation survives, the entity keeps its last
|
||||
// committed pose, and the next packet supplies current truth
|
||||
// on its own. Without this re-check a destination that fell
|
||||
// out of the window would just keep coming back Contention
|
||||
// forever (the asset source has not changed), never
|
||||
// retires out from under it. Re-check the SAME pre-flight the
|
||||
// entry point uses BEFORE resubmitting — dropping (and
|
||||
// cancelling the already-begun token) rather than resubmitting
|
||||
// matches the entry point's own Refused semantics: no
|
||||
// operation survives and the next packet supplies current
|
||||
// truth on its own. Without this re-check a destination that
|
||||
// fell out of the window would just keep coming back
|
||||
// Contention forever (the asset source has not changed), never
|
||||
// converging even though the window already knows better.
|
||||
//
|
||||
// Delta review N1: this path is the entry point's Refused
|
||||
// semantics, so it must ALSO be the entry point's
|
||||
// store_position — correcting this comment's earlier claim
|
||||
// that "the entity keeps its last committed pose". A retained
|
||||
// retry whose destination leaves the window is exactly the
|
||||
// freeze the fallback exists to prevent, one cadence pump
|
||||
// later; the pre-flight is an optimisation here for the same
|
||||
// reason it is one at the entry point, and it may never be the
|
||||
// reason a remote stops tracking.
|
||||
CreateObject.ServerPosition? destination =
|
||||
pending.Record.Snapshot.Physics?.Position
|
||||
?? pending.Record.Snapshot.Position;
|
||||
if (destination is not { } accepted
|
||||
|| !_serviceWindow.IsWithinServiceWindow(
|
||||
|| !CanAttemptDestination(
|
||||
setPosition,
|
||||
accepted.LandblockId))
|
||||
{
|
||||
CancelToken(setPosition, pending.Token);
|
||||
StoreAcceptedDestinationPose(pending.Record);
|
||||
continue;
|
||||
}
|
||||
|
||||
|
|
@ -517,8 +990,12 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
return RuntimeRemotePlacementExecutionStatus.Contention;
|
||||
}
|
||||
|
||||
// Preparation refused TERMINALLY (RejectedAuthority/InvalidData).
|
||||
// Nothing was submitted, so the engine never ran — this is the
|
||||
// STORING side of retail's partition, one stage later than the
|
||||
// pre-flight Refused. Delta review MAJOR A.
|
||||
CancelToken(setPosition, token);
|
||||
return RuntimeRemotePlacementExecutionStatus.Rejected;
|
||||
return RuntimeRemotePlacementExecutionStatus.RejectedPreparation;
|
||||
}
|
||||
|
||||
switch (outcome.Status)
|
||||
|
|
@ -541,25 +1018,141 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
return RuntimeRemotePlacementExecutionStatus.Committed;
|
||||
|
||||
case RuntimeSetPositionStatus.DeferredCell:
|
||||
// Central decision: this branch means the service-window
|
||||
// guard passed but Core still deferred the destination — the
|
||||
// narrow residual the class doc's central-decision paragraph
|
||||
// explains (a live in-place collision-prefix quiescence the
|
||||
// tier/residency guard cannot see from outside Core, per
|
||||
// RuntimeSetPositionState's private TryGetBlockingQuiescence).
|
||||
// Cancel immediately rather than retain a watch: no
|
||||
// re-issue, no park survives this controller.
|
||||
// Central decision: the pre-flight passed but Core still
|
||||
// parked the destination — the residual the class doc's
|
||||
// central-decision paragraph explains, now that the pre-flight
|
||||
// is explicitly only an optimisation (it tests the DESTINATION
|
||||
// prefix; Core's own post-sweep predicate also matches the
|
||||
// whole swept footprint, which spans neighbouring landblocks
|
||||
// and does not exist until the sweep has run). Cancel
|
||||
// immediately rather than
|
||||
// retain a watch: no re-issue, no park survives this
|
||||
// controller, and CancelToken's restoreCancelledPark rolls the
|
||||
// withdrawal back at the destination cell.
|
||||
//
|
||||
// ParkDeferred has already performed retail's store_position —
|
||||
// it snaps the body to the parked result before withdrawing,
|
||||
// and RestoreParkWithdrawal deliberately leaves that pose
|
||||
// alone — so the fallback must NOT fire here. For the
|
||||
// post-sweep park that result is the collision-SETTLED
|
||||
// position and a raw destination write would undo the settle
|
||||
// (delta review N2).
|
||||
CancelToken(setPosition, token);
|
||||
return RuntimeRemotePlacementExecutionStatus.Refused;
|
||||
return RuntimeRemotePlacementExecutionStatus.Deferred;
|
||||
|
||||
default:
|
||||
// Rejected/Cancelled — authority moved out from under this
|
||||
// operation, so the body never moved.
|
||||
// Rejected/Cancelled. Correcting this comment's earlier claim
|
||||
// that "the body never moved" (delta review MAJOR A — it was
|
||||
// the claim that made the fallback fire here): the statuses
|
||||
// that reach this arm are returned AFTER
|
||||
// _physics.Engine.SetPosition ran. Rejected is the engine's
|
||||
// own sweep refusing the destination (retail @0x00515CD5 /
|
||||
// @0x00515CB2, neither of which stores), and Cancelled
|
||||
// includes the shape where CommitCanonical already SETTLED
|
||||
// the body and only the projection ownership was displaced.
|
||||
// Neither may be overwritten with the raw accepted
|
||||
// destination.
|
||||
//
|
||||
// Round 3 (correction B2) — that is a REACHABILITY claim, not
|
||||
// a structural one, so state what it rests on. Core's
|
||||
// SubmitPreparedPlacementCore has three Rejected producers
|
||||
// and only the post-engine one (`!result.IsSuccessful` after
|
||||
// the SetPosition call) can reach here. Its two PRE-engine
|
||||
// producers are unreachable through this controller because
|
||||
// each is shadowed by a check PrepareMover already made, with
|
||||
// nothing reentrant in between:
|
||||
// * the entry validation's identity/authority terms (token
|
||||
// ownership, stage, preparation authority) re-test what
|
||||
// PrepareMover's own guard clause tested one call
|
||||
// earlier, and IsPreparationAuthorityCurrent catches
|
||||
// all seven of its version dimensions there first — as
|
||||
// RejectedAuthority, i.e. RejectedPreparation, which
|
||||
// DOES store. The one stage divergence PrepareMover
|
||||
// admits and SubmitPreparedPlacementCore refuses is
|
||||
// AwaitingCell, which additionally requires
|
||||
// DormantLocalActivation — forbidden for a record that
|
||||
// has a body, and this route requires one. Its remaining
|
||||
// terms (finite GameTime, matching Kind/Portal, the exact
|
||||
// PreparedCommand, the velocity-version echo) are
|
||||
// satisfied by construction: TryPrepareAndSubmitAuthored-
|
||||
// Placement submits the very command PrepareMover just
|
||||
// stored, built from the same operation, with nothing in
|
||||
// between.
|
||||
// * the NULL-BODY term is the one entry-validation test
|
||||
// PrepareMover does NOT shadow (round 4, D3 — its guard
|
||||
// clause has no body test at all). This route's own
|
||||
// entry check does: TryExecuteAcceptedRemotePosition's
|
||||
// `record.PhysicsBody is null → NotApplicable` above.
|
||||
// The only two writers that CLEAR it are entity teardown
|
||||
// (RuntimeEntityObjectLifetime's canonical leave-world
|
||||
// tail) and local-player activation retirement, and each
|
||||
// retires the operation as part of the same transaction —
|
||||
// so a body lost in between surfaces as Cancelled, not
|
||||
// as a pre-engine Rejected.
|
||||
// * !IsStructurallyValid(canonicalRequest) re-tests the
|
||||
// command PrepareMover just validated. The `with` between
|
||||
// them only replaces fields IsStructurallyValid reads
|
||||
// when WakeableLostCell is set, which requires an
|
||||
// inherited park — and TryBeginExclusiveAuthoredPlacement
|
||||
// refuses whenever an operation already exists for the
|
||||
// key, so nothing can be inherited here.
|
||||
// If a future change breaks one of those, the failure lands
|
||||
// on the SAFE side: a pre-engine Rejected filed here does not
|
||||
// store, so the body holds a stale pose for ONE packet (no
|
||||
// operation is retained — CancelToken runs below — so the
|
||||
// next 5-10 Hz packet starts clean). The opposite mistake,
|
||||
// storing after the engine refused, teleports the canonical
|
||||
// body into a destination the sweep just declined. That
|
||||
// asymmetry is why this stays a documented invariant rather
|
||||
// than a stage flag threaded out of Core: the flag would
|
||||
// change the shared placement contract three shipped routes
|
||||
// depend on, to make the already-safe direction slightly
|
||||
// safer.
|
||||
CancelToken(setPosition, token);
|
||||
return RuntimeRemotePlacementExecutionStatus.Rejected;
|
||||
return RuntimeRemotePlacementExecutionStatus.RejectedByPlacement;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// R9 review fix — the same self-healing read
|
||||
/// <see cref="CountLiveAwaitingAcknowledgement"/> already performed, for
|
||||
/// <see cref="_pending"/>. Both maps are keyed by
|
||||
/// <see cref="RuntimeEntityKey"/> (guid + incarnation), so a reused GUID
|
||||
/// produces a NEW key and cannot displace a dead incarnation's entry by
|
||||
/// itself. <see cref="Advance"/> drops such entries, but it early-returns
|
||||
/// whenever nothing is pending and is a host cadence call the ledger has
|
||||
/// no right to assume ran; without this the count converged only at
|
||||
/// <see cref="DetachRoute"/>, i.e. never in-session — contract item 7's
|
||||
/// GUID-reuse/incarnation dimension.
|
||||
///
|
||||
/// <para>
|
||||
/// Removal is gated on <c>!IsPlacementCurrent</c>, so this can only ever
|
||||
/// drop entries Core has ALREADY retired. It never cancels anything and
|
||||
/// therefore cannot hide the live-operation leak
|
||||
/// <see cref="DetachRoute"/>'s own review fix exists to prevent. The
|
||||
/// disposal guard matches its sibling's, for the same
|
||||
/// post-<c>Dispose()</c> <c>CaptureOwnership()</c> contract.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
private int CountLivePending()
|
||||
{
|
||||
if (_pending.Count == 0)
|
||||
return 0;
|
||||
if (_entityObjects.Physics.IsDisposed)
|
||||
return _pending.Count;
|
||||
|
||||
RuntimeSetPositionState setPosition = _entityObjects.Physics.SetPosition;
|
||||
_pendingScratch.Clear();
|
||||
foreach ((RuntimeEntityKey key, Pending entry) in _pending)
|
||||
{
|
||||
if (!setPosition.IsPlacementCurrent(entry.Token))
|
||||
_pendingScratch.Add(key);
|
||||
}
|
||||
foreach (RuntimeEntityKey key in _pendingScratch)
|
||||
_pending.Remove(key);
|
||||
return _pending.Count;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Self-healing read: prunes every <see cref="_awaitingAcknowledgement"/>
|
||||
/// entry whose token Core no longer considers current (the ack already
|
||||
|
|
@ -616,6 +1209,96 @@ internal sealed class RuntimeRemotePlacementDriveController
|
|||
return _awaitingAcknowledgement.Count;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// An OPTIMISATION, never the correctness mechanism: can this host place a
|
||||
/// remote into <paramref name="landblockId"/> RIGHT NOW without paying for
|
||||
/// a park that will only be cancelled again?
|
||||
///
|
||||
/// <para>
|
||||
/// <b>Deliberately NOT complete, and it cannot be (C4 route 4b-2, delta
|
||||
/// review MAJOR B/C — correcting this comment's earlier "the complete
|
||||
/// pre-flight" framing).</b> This tests ONE prefix, the destination's.
|
||||
/// Core's own park predicates are broader in two independent ways that no
|
||||
/// pre-flight can reproduce:
|
||||
/// </para>
|
||||
/// <list type="number">
|
||||
/// <item><description><c>PlacementTouchesPrefix</c> also matches the
|
||||
/// request's <c>CurrentCellId</c>. <b>Round 3 — the earlier text called
|
||||
/// that "the SOURCE landblock the remote is snapping OUT of" and "the
|
||||
/// likelier shape"; that is not what production supplies.</b>
|
||||
/// <c>CurrentCellId</c> is read from <c>record.FullCellId</c>, and both
|
||||
/// accepted-Position callers commit the accepted WIRE cell to that field
|
||||
/// before this seam is reached — the graphical remote path through
|
||||
/// <c>LiveEntityRuntime.RebucketLiveEntity</c> →
|
||||
/// <c>RuntimeEntityObjectLifetime.CommitRebucket</c> in its shared
|
||||
/// prologue, route 2 through the merge itself. So on the FIRST submit
|
||||
/// this arm names the DESTINATION, and it is the destination prefix — the
|
||||
/// one this pre-flight DOES see — that it matches. Measured, not argued.
|
||||
/// Scoped deliberately (round 4, D5): that is a property of the first
|
||||
/// submit only. A RETAINED operation re-submits from a cadence pump with
|
||||
/// no fresh merge, so see the <see cref="Advance"/> paragraph below for
|
||||
/// what the arm can name by then — the arm is live, not dead
|
||||
/// code.</description></item>
|
||||
/// <item><description><c>ResultTouchesPrefix</c> scans every
|
||||
/// <c>QueriedCellIds</c> entry, and that sweep footprint provably spans
|
||||
/// NEIGHBOUR landblocks (<c>CellTransit.AddOutsideCell</c> re-derives the
|
||||
/// block id from the global lcoord and states outright that there is no
|
||||
/// same-block filter). The footprint does not EXIST until the sweep has
|
||||
/// run.</description></item>
|
||||
/// </list>
|
||||
/// <para>
|
||||
/// <see cref="Advance"/> re-reads this predicate and is subject to the
|
||||
/// same two gaps, plus a third: a non-Position rebucket
|
||||
/// (<c>RemoteTeleportController</c>, the projection materializer, the
|
||||
/// equipped-child renderer) can move <c>record.FullCellId</c> to a THIRD
|
||||
/// landblock between the retained submit and the retry. All three are
|
||||
/// harmless for the same reason (delta review N3). That reason is the
|
||||
/// paragraph below — NOT, as the round-2 text claimed, that re-reading
|
||||
/// <c>record.CurrentCellId</c> here would "re-derive a private Core
|
||||
/// predicate outside Core": this method already calls Core's own
|
||||
/// <c>internal</c> <see cref="RuntimeSetPositionState.IsCollisionPrefixQuiescing"/>,
|
||||
/// so that objection was simply false (round-3 correction A5).
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Correctness lives at the source instead.</b>
|
||||
/// <c>SubmitPreparedPlacementCore</c>'s two quiescence parks are opted
|
||||
/// into <c>ParkDeferred</c>'s rollback, and <c>ParkDeferred</c> then
|
||||
/// restores only when the cell it will actually restore into —
|
||||
/// <c>body.CellPosition.ObjCellId</c>, read AFTER the snap and tested
|
||||
/// against EVERY live quiescence — is not itself quiescing.
|
||||
/// <b>Corrected round 4 (D5):</b> the earlier text said "every shape this
|
||||
/// predicate cannot see is a merely-swept NEIGHBOUR", which contradicts
|
||||
/// the third-landblock rebucket shape named ten lines above. The right
|
||||
/// statement is weaker and does not need the enumeration: whatever the
|
||||
/// blocking prefix turns out to be, the rollback is decided against the
|
||||
/// RESTORE cell rather than against that prefix, so it re-admits nothing
|
||||
/// into any quiescing prefix and AP-136's reason for the blanket
|
||||
/// non-restorable scoping (a spatial root re-entering the prefix that is
|
||||
/// trying to quiesce) cannot apply. This predicate therefore only
|
||||
/// shrinks the reachable set, and the <c>DeferredCell</c> case in
|
||||
/// <see cref="SubmitAndResolve"/> handles whatever still reaches Core.
|
||||
/// Recorded as AP-138(2).
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Two other properties DEPEND on this pre-flight staying here
|
||||
/// (round-3 correction A5). Do not delete it as redundant.</b> First,
|
||||
/// N3's "a retained retry can no longer strand" argument: a retry whose
|
||||
/// destination has begun quiescing since the submit is refused HERE and
|
||||
/// takes the <see cref="Advance"/> window-drop <c>store_position</c>,
|
||||
/// rather than reaching Core and opening a park into a prefix whose own
|
||||
/// restore is (correctly) declined. Second, the destination-quiescing
|
||||
/// shape is the one case where <c>ParkDeferred</c> would refuse to
|
||||
/// restore, so refusing ahead of it is what keeps that shape off the
|
||||
/// remote path entirely; without this call it becomes reachable and the
|
||||
/// remote is left withdrawn until a later packet commits.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
private bool CanAttemptDestination(
|
||||
RuntimeSetPositionState setPosition,
|
||||
uint landblockId) =>
|
||||
_serviceWindow.IsWithinServiceWindow(landblockId)
|
||||
&& !setPosition.IsCollisionPrefixQuiescing(landblockId);
|
||||
|
||||
private static void CancelToken(
|
||||
RuntimeSetPositionState setPosition,
|
||||
in RuntimeEntityPlacementToken token)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue