fix(physics): restore presentation when a park is cancelled (#312)

Regression from 7f1c1f5a (C4 route 4b-2). A remote player who recalled in,
arrived, and stood still was permanently absent from the world render AND the
radar while remaining fully simulated — 71 healthy physics ticks with contact
and walkable, interpolation enqueues, equipment attached, chat visible.

Route 4b-2 is the first commit that lets an ordinary remote UpdatePosition open
a canonical SetPosition. A park publishes a synchronous Withdraw that tears down
presentation registrations; only TryPublishPlace restores them.
RestoreParkWithdrawal — added in the same slice — restores InWorld, the object
clock, and canonical residency, i.e. the Runtime half only. Eight Opus reviews
verified those three fields and the tests asserted exactly them, so the suite
stayed green while the entity was invisible.

Why it is intermittent: the presentation half IS restored incidentally by the
per-packet prologue rebucket for a MOVING remote. It only sticks when the
entity parks on its FINAL accepted Position and then goes idle, because ACE
stops broadcasting for a stationary entity, so no later packet arrives to
re-publish it and nothing else re-drives.

The fix publishes a RuntimePlacementProjectionKind.WithdrawalRestored receipt on
the one ordered placement stream, acknowledge-only in Runtime (the parked
operation is already retired by CancelCoreDeferred), which the App sink maps to
the exact inverse of its own TryPublishWithdrawal: the projection half (bucket,
IsSpatiallyProjected, IsSpatiallyVisible, spatial indexes, RefreshPresentation)
plus the publish half (_worldState, _worldEvents, _effectPoses,
_localPlayerShadow, visibility sinks). Applied with commitPose: false, because
the withdrawal never moved the sidecar; a test feeds a deliberately wrong
position to pin that.

Two alternatives were refuted on measurement, not preference. Routing the
restore's SetFullCell through CommitCanonicalCell cannot fire on the shipped
remote path at all — the prologue rebucket has already recommitted a non-zero
FullCellId before the merge cancels the park, so no cell edge remains — and it
never touches the publish half regardless. Extending RestoreParkWithdrawal
directly reduces to the same receipt, since Runtime must not reach behind the
host sink.

Gated on the entity ending the rollback canonically whole (FullCellId != 0 &&
InWorld) rather than on residencyRestored, which is false on the shipped remote
path and would have made the fix a no-op. AP-136's quiescing-prefix refusal arm
is preserved: no receipt, entity stays withdrawn.

Corrects my own framing of the defect: _worldState/_worldEvents/_effectPoses are
lost but are NOT what kills render and radar (_worldState is the plugin
IGameState; _effectPoses is the pose registry, not entity.MeshRefs). The
load-bearing casualties are the visibility sinks and the
IsSpatiallyProjected/IsSpatiallyVisible + bucket removal that gates the radar.

Register: AD-63 filed (selection deliberately not restored — user intent),
AP-136 amended (its "restored visible" claim covered only the canonical half;
the gap was a defect, not a divergence). ShadowObjectRegistry.Suspend stays
out of scope per AP-136.

Seven-revert discrimination table including one that proves the test is not
merely re-checking the bucket. Suite 11,023 passed / 4 skipped / 0 failed.

Live gate is user-run and folds into #309: two clients, ACDREAM_PROBE_PARK=1,
recall a remote in and let it stand still; acceptance is
[park-restore] ... presentation=True for that guid plus a visible model and a
radar blip.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/World/RuntimePlacementPresentationSinkTests.cs

@@ -121,6 +121,168 @@ public sealed class RuntimePlacementPresentationSinkTests
         Assert.Equal(Guid, Assert.Single(fixture.ClearedSelection));
     }
 
+    /// <summary>
+    /// The invisible-recalled-remote regression, at the layer that produced
+    /// it. A restorable park publishes a <c>Withdraw</c> whose PRESENTATION
+    /// half only this sink performs; <c>RestoreParkWithdrawal</c> restores
+    /// canonical state and cannot reach any of it, and the per-packet
+    /// <c>RebucketLiveEntity</c> that used to mask the hole never runs for a
+    /// remote which parks on its final Position and then stops moving (ACE
+    /// stops broadcasting for a stationary entity). The entity stayed
+    /// simulated, collidable, and audible while absent from BOTH the world
+    /// render and the radar for the rest of the session.
+    ///
+    /// <para>This test asserts on the presentation side specifically -
+    /// bucket residency, projection visibility, plugin world state, the
+    /// world-event replay set, the effect-pose registry, the local-player
+    /// shadow, and the visibility sinks. Re-checking <c>InWorld</c>, the
+    /// object clock, and residency (which the shipped Runtime tests already
+    /// cover) reproduces exactly the blind spot that shipped the bug.</para>
+    /// </summary>
+    [Fact]
+    public void WithdrawalRestored_ReinstatesEveryPresentationRegistrationTheWithdrawalRemoved()
+    {
+        Fixture fixture = Fixture.Create();
+        LiveEntityRecord record = fixture.Materialize(Spawn(Guid, 1, SourceCell));
+        WorldEntity entity = Assert.IsType<WorldEntity>(record.WorldEntity);
+
+        AcDream.Plugin.Abstractions.WorldEntitySnapshot expectedSnapshot =
+            Assert.Single(fixture.WorldState.Entities);
+        LocalPlayerShadowState.Snapshot? expectedShadow =
+            fixture.LocalShadow.Current;
+        Assert.NotNull(expectedShadow);
+        Assert.Equal(
+            expectedSnapshot,
+            Assert.Single(CurrentEventMembership(fixture.WorldEvents)));
+        Assert.Equal(1, fixture.EffectPoses.Count);
+        Vector3 posedPosition = entity.Position;
+        Quaternion posedRotation = entity.Rotation;
+
+        RuntimePlacementProjectionSnapshot withdraw = Placement(
+            fixture,
+            record,
+            RuntimePlacementProjectionKind.Withdraw,
+            posedPosition,
+            posedRotation);
+        Assert.True(fixture.Sink.TryApply(in withdraw));
+        Assert.Empty(fixture.WorldState.Entities);
+        Assert.Empty(CurrentEventMembership(fixture.WorldEvents));
+        Assert.Equal(0, fixture.EffectPoses.Count);
+
+        RuntimeOwnershipSnapshot beforeRestore =
+            RuntimeOwnershipSnapshot.Capture(fixture.Runtime, record);
+        RuntimePlacementProjectionSnapshot restored = Placement(
+            fixture,
+            record,
+            RuntimePlacementProjectionKind.WithdrawalRestored,
+            // Deliberately NOT the entity's pose: the receipt is the exact
+            // inverse of a withdrawal, which never moved the sidecar, so the
+            // restoration must not move it either.
+            new Vector3(-777f, -777f, -777f),
+            Quaternion.CreateFromAxisAngle(Vector3.UnitY, 1.25f));
+
+        Assert.True(fixture.Sink.TryApply(in restored));
+
+        // Graphical projection - what the world render and the radar read.
+        Assert.True(
+            record.IsSpatiallyProjected,
+            "restored park left the entity unprojected");
+        Assert.True(
+            record.IsSpatiallyVisible,
+            "restored park left the entity invisible");
+        Assert.Contains(record, fixture.Runtime.VisibleRecords);
+        Assert.True(
+            fixture.Spatial.IsLiveEntityProjectionResident(
+                record.ProjectionKey!.Value),
+            "restored park left the entity out of its draw bucket");
+        Assert.Equal(SourceCell, entity.ParentCellId);
+
+        // Sink-owned registrations - restored EXACTLY, not defaulted.
+        Assert.Equal(
+            expectedSnapshot,
+            Assert.Single(fixture.WorldState.Entities));
+        Assert.Equal(
+            expectedSnapshot,
+            Assert.Single(CurrentEventMembership(fixture.WorldEvents)));
+        Assert.Equal(1, fixture.EffectPoses.Count);
+        Assert.True(fixture.EffectPoses.TryGetRootPose(
+            entity.Id,
+            out Matrix4x4 restoredPose));
+        Assert.Equal(
+            Matrix4x4.CreateFromQuaternion(posedRotation)
+                * Matrix4x4.CreateTranslation(posedPosition),
+            restoredPose);
+        Assert.Equal(expectedShadow, fixture.LocalShadow.Current);
+        Assert.Equal(
+            [(record, false), (record, true)],
+            fixture.Visibility);
+
+        // The sidecar pose is untouched by the restoration.
+        Assert.Equal(posedPosition, entity.Position);
+        Assert.Equal(posedRotation, entity.Rotation);
+
+        // No canonical Runtime ownership moved.
+        Assert.Equal(
+            beforeRestore,
+            RuntimeOwnershipSnapshot.Capture(fixture.Runtime, record));
+
+        // Idempotent: re-applying the same immutable receipt (the documented
+        // IRuntimePlacementProjectionSink contract) changes nothing.
+        Assert.True(fixture.Sink.TryApply(in restored));
+        Assert.Equal(
+            expectedSnapshot,
+            Assert.Single(fixture.WorldState.Entities));
+        Assert.Equal(1, fixture.EffectPoses.Count);
+        Assert.True(record.IsSpatiallyVisible);
+    }
+
+    /// <summary>
+    /// A WithdrawalRestored receipt must NEVER be refused. Its caller
+    /// (<c>RuntimePlacementProjectionSubscription</c>) treats a false return
+    /// as "leave at the FIFO head", which would wedge the ordered stream for
+    /// every entity - strictly worse than the invisibility the receipt
+    /// repairs. Every way the restore can decline is an entity that is gone,
+    /// displaced, or unmaterialized, i.e. one with no prior projection left.
+    /// </summary>
+    [Fact]
+    public void WithdrawalRestored_IsAcknowledgedEvenWhenTheProjectionIsGone()
+    {
+        Fixture fixture = Fixture.Create();
+        LiveEntityRecord record = fixture.Materialize(Spawn(Guid, 1, SourceCell));
+        RuntimePlacementProjectionSnapshot restored = Placement(
+            fixture,
+            record,
+            RuntimePlacementProjectionKind.WithdrawalRestored,
+            Vector3.Zero,
+            Quaternion.Identity) with
+        {
+            Token = Placement(
+                fixture,
+                record,
+                RuntimePlacementProjectionKind.WithdrawalRestored,
+                Vector3.Zero,
+                Quaternion.Identity).Token with
+            {
+                SessionLifetimeVersion =
+                    fixture.Runtime.SessionLifetimeVersion + 99UL,
+            },
+        };
+
+        Assert.True(fixture.Sink.TryApply(in restored));
+        Assert.Empty(fixture.Visibility);
+    }
+
+    private static List<AcDream.Plugin.Abstractions.WorldEntitySnapshot>
+        CurrentEventMembership(WorldEvents events)
+    {
+        var replayed = new List<AcDream.Plugin.Abstractions.WorldEntitySnapshot>();
+        void Handler(AcDream.Plugin.Abstractions.WorldEntitySnapshot snapshot) =>
+            replayed.Add(snapshot);
+        events.EntitySpawned += Handler;
+        events.EntitySpawned -= Handler;
+        return replayed;
+    }
+
     [Fact]
     public void Discard_IsAckOnlyNoOpEvenWhenTokenIsStaleOrSidecarIsGone()
     {