fix(runtime): name why a placement is parked and fail closed when it cannot resolve

Fixes #284 (plan S1).

A first-entry placement that could not be prepared returned
RetrySetupUnavailable and was re-Advanced every pump forever. Nothing counted
it, nothing named its cause, and nothing distinguished "waiting for something
that will arrive" from "waiting for something that never can". That is why
#281's 43 test failures presented as four unrelated symptoms across App and
Runtime instead of one cause, and why a stuck entity in the live client simply
never appears with no log line to follow.

Worse, the two causes were conflated: 670f307c's missing-world-frame park
reported itself as RetrySetupUnavailable, sending anyone diagnosing it to the
prepared-asset pipeline rather than to the absent local-player Create that
actually publishes the frame.

- RetryWorldFrameUnavailable splits the two causes. Call sites now ask
  IsRetryable() instead of comparing against one reason, so a future retry
  reason cannot be silently reclassified as a hard rejection - the exact way
  this class of bug hides.
- The operation retains its RuntimeSetPositionParkReason, and
  RuntimeSetPositionOwnershipSnapshot reports parked work by cause
  (ParkedAwaitingSetupCollisionCount / ParkedAwaitingWorldFrameCount /
  ParkedPlacementCount), so parked placements appear wherever ledgers are
  already asserted.
- ObserveLocalPlayerCreate records the accepted local-player Create even when
  it carries no landblock - precisely the case where no frame is ever
  published - and ThrowIfWorldFrameUnreachable makes that contradiction
  terminal. Waiting is legitimate only while that Create is outstanding; after
  it, no later pump can supply the frame. Same shape as 01f4791e, which made a
  violated receipt-ledger invariant terminal rather than resumable.

This is observability plus fail-fast. There is no timeout, no retry cap, and
no grace period anywhere in it; retryable work still retries exactly as before
and no placement behaviour changed.

The parked counts are deliberately NOT folded into IsConverged: #277 documents
a far Create legitimately parking for a whole session, so a parked entry at
teardown is not automatically a defect. Wiring them into the connected gates
is carried with #277's service-window conversion, where "legitimately parked"
becomes definable.

Runtime 1,012/1,012. Complete Release solution: 10,834 passed / 4 skipped /
0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/ISSUES.md

@@ -65,7 +65,7 @@ reconciling #281's 43 test failures.
   gate may or may not exclude Create during that window, and #280 says other
   work does continue arriving through it. Two owners of one fact; the campaign
   answer is that Runtime owns the frame and App projects it. Route-3 adjacent.
-- **#284 — OPEN — a placement that cannot resolve parks forever with no
+- **#284 — DONE (2026-08-03) — a placement that cannot resolve parks forever with no
   diagnostic.** A first-entry placement whose world frame is absent returns
   `RetrySetupUnavailable` (`RuntimeSetPositionState.PrepareMover:1535-1543`)
   and is re-Advanced every pump indefinitely. Nothing counts it, names its
@@ -77,6 +77,23 @@ reconciling #281's 43 test failures.
   exception pattern established in `01f4791e`. Doing this FIRST makes #282,
   #283, and every C4 route cheaper to diagnose and lets the connected gates
   fail on nonzero parked entries.
+  **Landed 2026-08-03 (S1).** `RetryWorldFrameUnavailable` splits the
+  world-frame park from the Setup park, so a missing frame stops reporting
+  itself as an asset problem; call sites now test `IsRetryable()` instead of
+  one reason, so a future reason cannot be silently demoted to a rejection.
+  The operation retains its `RuntimeSetPositionParkReason`, and
+  `RuntimeSetPositionOwnershipSnapshot` reports
+  `ParkedAwaitingSetupCollisionCount` / `ParkedAwaitingWorldFrameCount` /
+  `ParkedPlacementCount`. `ObserveLocalPlayerCreate` records the accepted
+  local-player Create even when it carries no landblock, and
+  `ThrowIfWorldFrameUnreachable` makes that contradiction terminal instead of
+  an infinite silent retry.
+  **Deliberately NOT folded into `IsConverged`:** #277 documents a far Create
+  legitimately parking for the whole session, so a parked entry at teardown is
+  not automatically a defect. The counts are exposed for gate assertions at
+  stable checkpoints; wiring them into the connected gates' `report.json` is
+  carried with #277's service-window conversion, where "legitimately parked"
+  becomes precisely definable.
 
 ## C3c placement cutover — 2026-08-02