feat(runtime): first-entry conductor sequences local-player world entry

Cutover slice C3a: the resumable transaction that dissolves the C3
flip's circularity finding. RuntimeLocalPlayerFirstEntryState drives the
local player's complete entry in retail's own order — authored-mover
preparation (the makeObject/set_description shape analog, via a pure
no-submit extraction TryPrepareAuthoredMover), the publication chain's
off-canonical Prepare + atomic body Commit against the residence's exact
placement token, the Evaluate/CommitActivation enter-world analog, the
Place-receipt acknowledgement as that act's virtualized completion, and
only then the executor's FIFO drain (retail: enter_world at 93824
strictly precedes ProcessObjectNetBlobs at 93831). Five stages, eight
typed statuses, exactly-once per stage under retry, no second token
copies, and an acknowledge-stage discriminator that separates
not-yet-FIFO-head (retryable) from authority-moved (typed abandonment) —
a mid-flight delete can no longer strand a retry-forever entry.

The residence retirement notification becomes an ordered multicast
(snapshot-iterated per the event-stream precedent), the lifetime
constructs the conductor with a late-bind Publication seam (transactional
unbound failure — no mutation before the throw), deletion/reset converge
the conductor automatically through the same choke points as the
executor, and its active count is in the ownership snapshot and
IsConverged. Dormant: no production Advance caller; GameRuntime binding
is C3c's first act.

Reviewed: retail-conformance PASS (the stage order verified
step-for-step against retail's entry sequence; the live-controller-on-
abandonment invariant proven structurally enforced and retail-correct —
retail has no entry-flow rollback) + architecture/adversarial PASS after
one fix round (acknowledge-stage authority discrimination; the wiring
fold; two prescribed pre-C3c hardenings). Runtime 948/948; complete
Release solution green across all nine projects.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.Runtime.Tests/Entities/RuntimeInitialCreateResidenceStateTests.cs

@@ -2623,6 +2623,53 @@ public sealed class RuntimeInitialCreateResidenceStateTests
         lifetime.Entities.SetPhysicsBody(canonical, body);
     }
 
+    [Fact]
+    public void RetirementNotificationBoundReentrantlyDuringDispatchDoesNotCorruptTheCurrentIteration()
+    {
+        // H1: RuntimeEntityObjectLifetime's own constructor already binds
+        // TWO retirement notifications (the executor's DiscardProgress and
+        // the local-player first-entry conductor's Forget). Before this
+        // fix, NotifyRetirement iterated the live _retirementNotifications
+        // list directly; a THIRD subscriber binding from inside one of
+        // those two (or this test's own) callbacks would throw
+        // "Collection was modified" on the very next notify() call in the
+        // SAME foreach. Snapshotting via ToArray() before iterating must
+        // let a reentrant bind land safely mid-dispatch, with the newly
+        // added subscriber observed on the NEXT retirement, not the current
+        // one (it is not required to see notifications that were already
+        // "in flight" when it bound).
+        using var lifetime = new RuntimeEntityObjectLifetime();
+        Bind(lifetime, 20UL);
+        var lateBoundKeys = new List<RuntimeEntityKey>();
+        bool reentrantBindAttempted = false;
+        lifetime.InitialCreateResidences.BindRetirementNotification(key =>
+        {
+            if (reentrantBindAttempted)
+                return;
+            reentrantBindAttempted = true;
+            lifetime.InitialCreateResidences.BindRetirementNotification(
+                lateBoundKeys.Add);
+        });
+
+        RuntimeEntityRecord first = lifetime.RegisterEntityWithInitialResidence(
+            Spawn(0x70003F80u, 1), isLocalPlayer: false).Canonical!;
+        RuntimeEntityKey firstKey = first.Key!.Value;
+        Exception? thrown = Record.Exception(() =>
+            lifetime.InitialCreateResidences.Forget(first, out _, out _));
+
+        Assert.Null(thrown);
+        Assert.True(reentrantBindAttempted);
+        Assert.DoesNotContain(firstKey, lateBoundKeys);
+
+        RuntimeEntityRecord second = lifetime.RegisterEntityWithInitialResidence(
+            Spawn(0x70003F81u, 1), isLocalPlayer: false).Canonical!;
+        RuntimeEntityKey secondKey = second.Key!.Value;
+        Assert.True(lifetime.InitialCreateResidences.Forget(
+            second, out _, out _));
+
+        Assert.Contains(secondKey, lateBoundKeys);
+    }
+
     private static void Bind(
         RuntimeEntityObjectLifetime lifetime,
         ulong generation)