feat(physics): C4 route 2 — ForcePosition through the canonical placement

A local-player ForcePosition had TWO independent writers for one accepted
packet: LocalForcePositionTransaction snapped the physics body
(PlayerMovementController.BlipPosition, a raw SnapToCell with no collision
resolve), while LiveEntityNetworkUpdateController's generic tail separately
wrote position/cell/rotation to the render WorldEntity from the raw wire and
rebucketed it. Two stores, one packet — the divergence class 670f307c fixed on
the remote path. The outbound AutonomousPosition ack also fired BEFORE any
canonical commit existed: we told ACE "got it, I'm here" before deciding where
"here" was, and the trailing isCurrent() could only suppress the continuation,
never recall the packet.

RuntimeAcceptedPositionDriveController is now the one Runtime-owned seam. Both
hosts call the identical TryExecuteAcceptedLocalPosition; App and headless
project the committed result through the existing placement projection sink
(LiveEntityRuntime.TryApplyRuntimePlacementPlace already performed the same
four writes, from committed state rather than a wire guess).

Retail: SmartBox::HandleReceivedPosition @0x00453FD0's FORCE_POSITION branch is
get_heading -> Frame::set_heading -> SmartBox::BlipPlayer @0x00453940 -> stamp
POSITION_TS -> SendPositionEvent @0x00454091 -> return @0x0045409D. BlipPlayer
is CPhysicsObj::SetPositionSimple @0x005162B0 with flags 0x1012
(Teleport|Slide|SendPositionEvent) — a real collision-resolving SetPosition,
not a snap. The pinned classifier already encoded this exactly.

Named behaviour changes:

* The ack is now an OUTPUT of the committed route, fired strictly after the
  canonical commit and exactly once per accepted force packet.
* The ForcePosition route no longer re-arms the constraint leash. The force
  branch returns at 0x0045409D, ahead of all three ConstrainTo sites
  (0x00454272, 0x0045418A, 0x004541EC); the old re-arm cited retail's "Player,
  normal" branch, which BlipPlayer is not on. The teleport, CommitPreparedPosition
  and first-entry callers legitimately still constrain and are untouched.
* A force correction that terminates WITHOUT committing still sends its
  position event and is not retried — retail's BlipPlayer discards
  SetPositionSimple's SetPositionError return and acks unconditionally.

A single _pending funnel owns the in-flight placement, deciding on the token's
PositionAuthorityVersion against the record's: equal -> clear; advanced with the
newest accepted event still a force -> re-issue, re-classified; advanced to an
ordinary Apply -> clear, since newer server truth owns that pose. This closes a
double-apply/double-ack and a silently-dropped correction that two earlier
iterations of this slice each introduced.

AD-62 records the residual: a ForcePosition our async collision publication
cannot carry to a committed placement is not re-applied. Retail has no park —
its world is fully resident and its placement synchronous — so the state is
unreachable there. AP-131 is NOT retired; its legacy Position caller is route 4.

Deleted: LocalForcePositionTransaction, PlayerMovementController.BlipPosition,
HeadlessSessionWorldProjection.BlipLocalPlayer.

Gates: complete Release solution 10,858 passed / 4 skipped / 0 failed (baseline
10,844/4/0). Two independent Opus reviews (retail-conformance and
architecture/adversarial) PASS on the final diff after three FAIL rounds; every
intermediate state was fully green, so the suite caught none of the four real
defects. Connected acceptance is NOT run: nothing a user can do makes ACE emit
a ForcePosition without retail's @pklite, which acdream does not implement — see
docs/research/2026-08-03-c4-route-2-visual-gate.md.

Known gap, recorded not claimed: the plan's acceptance item 2 is unmet. The App
double-write check is a source pin, and "the committed projection moves the
render entity" is uncovered at any layer (#292). Filed alongside: #286-#291,
#293-#296.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.App/Physics/LiveEntityNetworkUpdateController.cs

@@ -15,6 +15,7 @@ using AcDream.Core.Items;
 using AcDream.Core.Physics;
 using AcDream.Runtime.Entities;
 using AcDream.Runtime.Gameplay;
+using AcDream.Runtime.Session;
 using AcDream.Core.Selection;
 using AcDream.Core.World;
 using DatReaderWriter;
@@ -63,6 +64,7 @@ internal sealed class LiveEntityNetworkUpdateController
     private readonly IMovementTruthDiagnosticSink _movementTruthDiagnostics;
     private readonly InventoryWorldDropProjectionController?
         _worldDropProjection;
+    private readonly RuntimeAcceptedPositionDriveController _acceptedPositionDrive;
 
     private PlayerMovementController? _playerController => _playerControllerSource.Controller;
     private EntityPhysicsHost? _playerHost => _playerHostSource.Host;
@@ -103,6 +105,7 @@ internal sealed class LiveEntityNetworkUpdateController
         ILiveWorldSessionSource session,
         Action<uint, AcceptedPhysicsTimestamps> publishTimestamps,
         IMovementTruthDiagnosticSink movementTruthDiagnostics,
+        RuntimeAcceptedPositionDriveController acceptedPositionDrive,
         InventoryWorldDropProjectionController? worldDropProjection = null)
     {
         _liveEntities = liveEntities ?? throw new ArgumentNullException(nameof(liveEntities));
@@ -138,6 +141,8 @@ internal sealed class LiveEntityNetworkUpdateController
             publishTimestamps);
         _movementTruthDiagnostics = movementTruthDiagnostics
             ?? throw new ArgumentNullException(nameof(movementTruthDiagnostics));
+        _acceptedPositionDrive = acceptedPositionDrive
+            ?? throw new ArgumentNullException(nameof(acceptedPositionDrive));
         _worldDropProjection = worldDropProjection;
     }
 
@@ -1113,20 +1118,61 @@ internal sealed class LiveEntityNetworkUpdateController
         bool forceLocal = timestampDisposition is AcDream.Core.Physics.PositionTimestampDisposition.ForcePosition
             && update.Guid == _playerServerGuid
             && _playerController is not null;
-        if (!LocalForcePositionTransaction.Apply(
-                forceLocal,
-                () => IsCurrentPositionOwner(),
-                () => _playerController!.BlipPosition(
-                    worldPos,
-                    p.LandblockId,
-                    new System.Numerics.Vector3(
-                        p.PositionX,
-                        p.PositionY,
-                        p.PositionZ)),
-                () => _localPlayerOutbound.SendImmediatePosition(
-                    _session.CurrentSession,
-                    _playerController)))
-            return;
+        if (forceLocal)
+        {
+            if (!IsCurrentPositionOwner())
+                return;
+
+            // C4 route 2 (2026-08-03): the Runtime-owned accepted-Position
+            // execution seam replaces the deleted LocalForcePositionTransaction.
+            // Ownership validation is the operation's own currency check,
+            // the body commit is Runtime's canonical SetPosition transaction
+            // (retail CPhysicsObj::SetPositionSimple @0x005162B0, called from
+            // SmartBox::BlipPlayer @0x00453940), and the outbound ack is an
+            // OUTPUT of that committed route, fired strictly after it.
+            RuntimeAcceptedPositionExecutionStatus forceStatus =
+                _acceptedPositionDrive.TryExecuteAcceptedLocalPosition(
+                    acceptedPositionCanonical,
+                    update,
+                    timestampDisposition,
+                    timestamps,
+                    timestamps.PreviousTeleport);
+            if (forceStatus is RuntimeAcceptedPositionExecutionStatus.Committed
+                or RuntimeAcceptedPositionExecutionStatus.DeferredCell)
+            {
+                // App projects the committed (or parked-toward) result
+                // through the existing Runtime placement sink
+                // (RuntimePlacementPresentationSink), which observes the
+                // SAME Runtime SetPosition FIFO every other placement uses —
+                // it must not ALSO independently mutate the render-facing
+                // WorldEntity here (the retired duplicate-write authority:
+                // the generic tail below). The two local-player side effects
+                // this neighbourhood still owns independently of WorldEntity
+                // position (owned-VFX pose-dirty tracking and the
+                // pre-player-mode streaming landblock tracker) are
+                // preserved — DeferredCell included, since following the
+                // destination is what lets its streaming/collision window
+                // eventually publish the generation the park is waiting on.
+                _entityEffects?.MarkLiveOwnerPoseDirty(update.Guid);
+                _authorityGate.ObserveAcceptedLocalPosition(
+                    update.Position.LandblockId);
+                return;
+            }
+            if (forceStatus is not RuntimeAcceptedPositionExecutionStatus.NotApplicable)
+            {
+                // R9 review fix (2026-08-03): Rejected/Contention — no
+                // correction was applied or parked for this exact packet.
+                // Do NOT move the streaming observer or mark the render pose
+                // dirty for a landblock this route explicitly declined to
+                // place into, and do not fall through to the generic tail
+                // below either (that would resurrect the retired duplicate-
+                // write authority this whole route exists to remove).
+                return;
+            }
+            // NotApplicable — e.g. an initial-Create residence still owns
+            // this record (route 1's job). Fall through to the pre-existing
+            // path unchanged, exactly as every other disposition does.
+        }
 
         // A leave-world transition deliberately retains WorldEntity as the
         // logical/render-resource owner while IsSpatiallyProjected is false.