feat(runtime): seal dormant SetPosition evaluations

docs/research/2026-08-01-runtime-local-player-physics-publication.md

@@ -2,14 +2,16 @@
 
 ## Scope
 
-This is placement Slice 4B2 checkpoint 4. It adds the dormant,
+This is placement Slice 4B2 checkpoints 4-5. It adds the dormant,
 presentation-independent transaction which prepares and assigns ownership of
-one local-player `PhysicsBody` and `PlayerMovementController`. No App or
+one local-player `PhysicsBody` and `PlayerMovementController`, then retains an
+exact post-ownership activation lease which can evaluate retail SetPosition
+without publishing it. No App or
 Headless production route invokes this transaction, so graphical and no-window
 game behavior is unchanged and AP-1/AD-1 remain open.
 
-The checkpoint deliberately stops before canonical SetPosition activation.
-It does not consume the prepared placement operation, enter the body into the
+The checkpoints deliberately stop before canonical SetPosition activation.
+They do not consume the prepared placement operation, enter the body into the
 physics engine, publish FullCell/world/host/shadow/workset state, or project a
 presentation entity. Those effects belong to the next transaction and must all
 use the same Runtime-owned dormant body.
@@ -88,6 +90,70 @@ Repeated stores of the same body/controller do not advance their epochs; real
 bind, replacement, and unbind edges do. This makes ABA-shaped reference changes
 observable even if a later value happens to equal an earlier reference.
 
+## Dormant SetPosition evaluation lease
+
+Ownership commit now returns one private activation token captured only after
+the canonical body and controller stores. It binds the exact entity key,
+authored placement token and sealed command, local identity GUID/revision,
+session lifetime, and the post-store physics-body, object-clock, and controller
+ownership epochs. The owner retains the same record, body, controller, and
+command behind that token; no caller can substitute an equivalent-looking
+body or rebuild the mover.
+
+`EvaluateActivation` revalidates that complete lease and calls Core
+`PhysicsEngine.SetPosition` synchronously with an immutable request. Core's
+transaction is pure: it returns committed, deferred-cell, or rejected
+placement data without writing the canonical body, FullCell, clock, spatial
+worksets, shadows, collision-report owners, host, operation stage, or Place
+projection. A missing cell therefore leaves the exact body dormant and the
+authored operation retryable. A valid result likewise remains only an
+immutable evaluation receipt; this checkpoint has no activation/commit API.
+
+Each evaluation carries an append-only, stable-order union of every cell read
+by the complete Core transaction: the AdjustPosition seed and adjusted cell,
+visible-child probes (including rejected lateral siblings), rejected
+portal/building containment probes, transition/compass retries, and every
+normal or scatter attempt. Rejected probes enter only the authority union and
+never the final successful shadow/CrossCell footprint. Scatter keeps that union
+in retained scratch and materializes its
+immutable receipt exactly once after the final attempt, avoiding quadratic
+copy/allocation growth at the 64-attempt retail ceiling. The final
+`CrossCellIds` remains the successful placement's authored
+shadow footprint; failed scatter probes cannot leak into that commit payload.
+Runtime seals every distinct queried landblock against the exact collision
+generation, the global collision-world authority, and the dynamic-shadow
+mutation revision. An active replacement admission rejects evaluation even
+before it commits, while begin/cancel, a re-entrant generation commit, or any
+owner insert/remove/move/state/suspend/reflood mutation invalidates an older
+receipt.
+
+Entry restrictions also consult the live `ClientObjectTable` for the resolved
+house object, owner and complete restriction record, plus the mover's monarch.
+The receipt therefore seals the exact object-table reference, the engine's
+monotonic binding epoch, and the table's synchronous mutation revision. Object
+creation/removal, owner-property, guest-list, or mover-monarch updates invalidate
+the receipt; a null/fresh replacement and an equal-revision A-B-A binding cycle
+cannot resurrect it. Retained `ClientObject` owner, monarch, and restriction
+setters synchronously advance every exact owning table even when callers mutate
+the object directly rather than re-submit it through `AddOrUpdate`. Replacement,
+removal, and clear detach that observer exactly, and every
+`HouseRestrictionRecord` freezes a defensive snapshot of its input guest map so
+no caller-owned dictionary or mutable downcast can alter entry authority behind
+the revision.
+
+`IsEvaluationCurrent` accepts only the newest receipt for the exact activation
+lease and rejects it after a position/vector/state/object-description/Create
+authority change, identity revision, body/controller replacement, session or
+incarnation change, or any sealed collision/shadow authority change.
+Re-evaluation supersedes the older receipt without mutating world state.
+Re-entrant reset or delete-plus-GUID-reuse during Core evaluation immediately
+retires the invalid lease instead of leaving an orphaned dormant graph. An
+existing activation lease also blocks candidate preparation even if an
+external owner has already cleared the body/controller references; explicit
+discard is required before a new candidate can be prepared. Reset and disposal
+retire the lease, body, and dormant controller and include the pending
+activation in the ownership convergence ledger.
+
 ## Gates
 
 - Candidate privacy and live-operation rejection.
@@ -104,23 +170,53 @@ observable even if a later value happens to equal an earlier reference.
   placement cancellation.
 - Delete plus same-GUID reincarnation.
 - Candidate replacement, reset, disposal, and ownership convergence.
+- Pure committed/deferred/rejected SetPosition evaluation with bit-exact
+  body-state snapshots and no canonical, collision-report, projection,
+  clock, FullCell, host, shadow, workset, or operation-stage mutation.
+- Complete stable-order queried-cell capture across AdjustPosition,
+  visible-child lookup, normal/scatter retries, map-edge/deferred, rejected,
+  committed, and defensive NoCell outcomes. Scatter deliberately retains
+  retail's RNG consumption; only its authority footprint and commit payload
+  are deterministic for a fixed draw sequence.
+- Newest-receipt selection, active-admission rejection, collision-generation
+  replacement, re-entrant begin/cancel and commit invalidation, plus dynamic
+  shadow insert/move/state/suspend/remove invalidation.
+- Exact object-table reference/revision/binding authority, including
+  post-evaluation and re-entrant house-object, owner, guest-list, and mover-
+  monarch mutations plus null/fresh/equal-revision ABA replacement. Direct
+  retained-object setters, replacement/removal/clear observer lifetime, shared
+  multi-table ownership, and frozen guest-map input are covered explicitly.
+- Re-entrant reset and delete/GUID-reuse convergence plus activation-lease
+  overwrite prevention after an external body/controller clear.
+- Post-ownership position, vector, object-description, Create, identity,
+  body, and controller authority replacement.
 - Terminal stale-controller rejection after replacement, reset, and disposal.
 - Body/controller epochs advance only on actual ownership changes.
 
-Focused publication, controller, movement, and SetPosition tests pass 167/167.
-The complete Runtime project passes 627/627 under invariant culture. The App
-Runtime-ownership guard passes 4/4, the complete Release solution builds with
-zero errors, and the complete Release solution test gate passes 10,374 tests
-with 4 intentional skips. Under the machine's Swedish current culture, the
-three previously known formatting assertions still fail (`0,5` versus `0.5`
-and localized sky text); they are unrelated to this checkpoint.
+The checkpoint-5 focused publication suite passes 70/70 and the focused Core
+SetPosition suite passes 59/59. The complete Runtime project passes 666/666;
+the complete Core project passes 4,230 tests / 1 skip; and the App Runtime
+physics/movement ownership guard passes 6/6. The complete Release solution
+builds with zero errors (three pre-existing App-test nullability warnings are
+outside this checkpoint), and its invariant-culture test gate passes 10,419
+tests / 4 intentional skips. The installed prepared-package gate
+uses the exact local `acdream.pak`. Under the machine's Swedish current culture,
+the same three previously known formatting assertions remain unrelated (`0,5`
+versus `0.5` and localized sky text), so the canonical gate runs under
+invariant culture.
 
 ## Next checkpoint
 
-Add the canonical Runtime SetPosition activation transaction. It must evaluate
-and commit the already-owned dormant body, consume the exact prepared placement,
-and atomically establish physics-engine/workset/shadow/FullCell/world/host
-ownership before presentation receives an acknowledgement, then invoke the sole
-`ActivateRuntimePublication` transition. The activation must
-roll back or leave the operation retryable on every pre-commit failure and must
-not construct a second body or controller.
+Add the canonical Runtime SetPosition activation transaction. Before its
+callback-free tail, it must prepare a presentation-independent Runtime
+`PhysicsHost`/`PositionManager`/`MoveToManager` graph, the existing authoritative
+authored shadow payload (without rebuilding AP-22 shapes), and an exact staged
+collision-report batch. Then it may commit the already-owned dormant body,
+contact/water/walkable/response state, object clock, FullCell, exact shadow,
+spatial/ordinary workset, host, and SetPosition operation versions; seal the
+ordered Place receipt; and invoke the sole `ActivateRuntimePublication`
+transition as the final tickable edge. Collision reports and the Place observer
+publish only afterward and must tolerate delete/reset re-entry without replaying
+physics. Every pre-commit failure leaves the dormant lease and authored
+operation retryable or rejects them; no rollback mutation and no second body or
+controller are allowed.