fix(physics): C4 route 7 — child cell propagation moves from a render tick into Runtime

Retail re-cells children when their parent crosses a cell, recursively, to
unbounded depth. acdream did it from a RENDER tick, so headless parented
children were cell-less forever and the canonical cell had two writers. This
slice makes Runtime the sole authority and demotes App's tick to
presentation-only. Contract:
docs/research/2026-08-04-c4-route-7-contract.md; the research that unblocked
it is docs/research/2026-08-04-retail-parent-cell-propagation.md (ca96ea5e).

Retail: SetPositionInternal @0x00515330 branches on `this->cell == curr_cell`
@0x0051536d; the changed branch reaches change_cell @0x00513390, whose
delegates leave_cell @0x00510f50 and enter_cell @0x00510ed0 self-recurse over
children and write the FULL identity (add_object @0x00510ee2, objcell_id
@0x00510f1e, part-array cell id @0x00510f2b, cell pointer @0x00510f35).
change_cell itself has no child loop.

THE TRAP, recorded because it nearly shipped: the depth-1 loop
@0x0051539c-0x005153d8 is the SAME-CELL fast path (objcell_id and part-array
id only, deliberately not the cell pointer), NOT the propagation. An
implementer who finds it first concludes "depth-1, id-only" and strands every
equipped item at a landblock boundary — the #184 class. The clincher against
that reading: update_object @0x00515d10 early-returns on `parent != 0`
@0x00515d40, so a child never runs its own physics tick and parent
propagation is the ONLY mechanism maintaining its cell.

Route 7 performs NO placement (DoPickupEvent @0x00452240 = unset_parent +
leave_world; DoParentEvent @0x00452290 = set_parent + SetPlacementFrame), so
it arms ConstrainTo nowhere — the leash rule INVERTS relative to routes
2/4/5, and both reviewers confirmed nothing arms.

Propagation is an ITERATIVE WORKLIST, not recursion. The first implementation
recursed with a depth-64 cap; both reviews independently found the cap left a
truncated tail at a stale NON-ZERO cell — permanently unrecoverable, logged
only under a probe flag, and on the withdraw path exactly the #184 shape
AP-142 clause (a) exists to reject. Shipping a fresh #184 instance inside the
slice that fixes stranded children was not acceptable, so the cap was removed
rather than tuned. The worklist retires the cap, the constant, its register
clause, and the failure mode together. Termination: every record on the stack
is already at the target pair, so nothing can be pushed twice and a hostile
A->B->A cycle collapses without a visited set.

The child write deliberately bypasses the public RuntimeEntityDirectory
.SetFullCell and calls the record method directly. This is LOAD-BEARING:
the public method re-enters PropagateFullCellToChildren, which opens with
_propagationWorklist.Clear() — routing children through it mid-drain would
wipe the shared stack and silently drop every unprocessed sibling. Any future
side effect added to the public SetFullCell must be mirrored by hand at that
call site.

Deliberate divergence, recorded not disguised: retail's removal path leaves
children with a null cell pointer but a STALE nonzero objcell_id @0x005133c1.
acdream does not reproduce it, because FullCellId != 0 is the liveness
predicate at 45+ sites — faithful porting would mark dead children live.
AP-142 records this; clause (d) records that acdream cannot gate propagation
on HasPartArray the way enter_cell gates on part_array @0x00510ed8, because
the flag's only writers are graphical and headless never sets it — the reason
is Slice J LAYERING, not a semantic difference (retail's part_array is itself
a mesh-construction product, single assignment site makeAnimObject
@0x0050e930 -> CPartArray::CreateSetup @0x0050e93e).

D7 adopts retail's unset_parent-before-leave_world order @0x0045227f ->
@0x00452286, applied to BOTH pickup paths including the dormant executor
replay. Its inertness was verified by reverting it and finding all 12
propagation tests still green — reported honestly rather than papered over
with a manufactured test, and independently confirmed by both reviewers.

ClassifyLeaveWorld and its request/cause types are DELETED: retail has no
classification here, and method-per-cause IS the retail dispatch shape.
Wiring it would have forced a vacuous teleport-sequence predicate with the
#307 shape.

Two review rounds plus a coordinator-required third pass; 5 MAJORs. One was a
handoff failure worth recording: enter_cell's part_array guard was correctly
identified as load-bearing by the research, dropped by the contract when it
enumerated the writes, and inherited as an omission by the code — a right
finding that evaporated across two handoffs with nobody re-reading the source.
Another was a test that survived deleting the entire behaviour it claimed to
pin, because its assertion read a field written unconditionally one line
earlier.

NoProjection is structurally unreachable from TickChild (TryResolveExactAttachment
performs a strictly stronger form of the same guard one call earlier). Kept as
a fail-safe, unit-tested directly, and documented in two places rather than
wrapped in a fabricated end-to-end test.

Headless regression test — the direct gate for this defect, which FAILED
before this work because no code path existed:
RuntimeLiveEntitySessionControllerTests
.DirectSink_D5_StandaloneParentEventCommitsChildToParentsExactCell.

Probe: ACDREAM_PROBE_CHILD_CELL=1 emits [child-cell] lines at all four write
sites (attach / headless-attach / propagate / withdraw / delete). TEMPORARY.

Complete Release suite MEASURED at 11,079 passed / 4 skipped / 0 failed
(baseline 11,063 at cff52c44, +16). An allocation flake appeared once under
load and was proven NOT this slice by reachability — RuntimeCollisionReportingState
contains zero SetFullCell and zero ParentAttachments references.

STILL OWED: the two-client connected gate (equip/unequip, carry across
landblock boundaries, pickup, loot, reconnect) with ACDREAM_PROBE_CHILD_CELL=1,
and a session counts only if [child-cell] cause=propagate lines appear.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Runtime/Entities/ParentAttachmentState.cs

@@ -516,6 +516,31 @@ public sealed class ParentAttachmentState
     public bool HasCommittedParent(uint childGuid) =>
         _lastAcceptedByChild.ContainsKey(childGuid);
 
+    /// <summary>
+    /// Route 7 D1/D5: the exact (guid, incarnation) a child's committed
+    /// relation currently names, read straight from the committed table
+    /// rather than the staged/recovery timing window - the source the
+    /// attach-time re-cell and the headless drive both resolve the parent
+    /// through, per the contract's "currency, never by guid alone" pin.
+    /// </summary>
+    public bool TryGetCommittedParent(
+        uint childGuid,
+        out uint parentGuid,
+        out ushort parentInstanceSequence)
+    {
+        if (_lastAcceptedByChild.TryGetValue(
+                childGuid,
+                out ParentAttachmentRelation relation))
+        {
+            parentGuid = relation.ParentGuid;
+            parentInstanceSequence = relation.ParentInstanceSequence;
+            return true;
+        }
+        parentGuid = 0u;
+        parentInstanceSequence = 0;
+        return false;
+    }
+
     public bool IsPending(
         ParentAttachmentRelation relation,
         ParentProjectionCandidateKind kind) =>
@@ -614,6 +639,39 @@ public sealed class ParentAttachmentState
         return result.ToArray();
     }
 
+    /// <summary>
+    /// Route 7 D5/A6 (architecture review): a lighter-weight sibling of
+    /// <see cref="ChildrenWaitingForParent"/> for a caller that only needs
+    /// to discover a child whose relation is still UNRESOLVED (waiting on
+    /// this exact parent guid to become addressable) — the headless
+    /// <c>RuntimeLiveEntitySessionController</c> retry, whose own
+    /// <c>Resolve</c>/<c>TryGetStagedProjection</c>/<c>CommitProjection</c>
+    /// sequence handles a relation already sitting in
+    /// <c>_stagedByChild</c>/<c>_recoveryByChild</c> when it re-resolves a
+    /// specific child directly, so this query does not need to sweep those
+    /// two dictionaries or allocate the <c>HashSet</c>
+    /// <see cref="ChildrenWaitingForParent"/> uses to de-duplicate across
+    /// all three. Allocates a fresh <see cref="List{T}"/> only when it has
+    /// something to return (round-3 review, B4): a shared reused buffer was
+    /// tried and reverted — it broke reentrancy safety a fresh-array return
+    /// already had, since a nested call into the same query while an outer
+    /// caller was still iterating its result would clear/refill the SAME
+    /// list out from under it.
+    /// </summary>
+    public IReadOnlyList<uint> ChildrenUnresolvedForParent(uint parentGuid)
+    {
+        List<uint>? result = null;
+        foreach ((uint childGuid, Queue<ParentAttachmentRelation> queue) in _unresolvedByChild)
+        {
+            if (queue.Any(relation => relation.ParentGuid == parentGuid))
+            {
+                result ??= new List<uint>();
+                result.Add(childGuid);
+            }
+        }
+        return (IReadOnlyList<uint>?)result ?? Array.Empty<uint>();
+    }
+
     /// <summary>
     /// Returns only the exact direct children currently committed to one
     /// parent incarnation. Lost-cell destruction follows retail's live

src/AcDream.Runtime/Entities/RuntimeEntityDirectory.cs

@@ -234,8 +234,16 @@ public sealed class RuntimeEntityDirectory
         bool refreshPosition = false)
     {
         EnsureKnown(record);
+        uint previousCell = record.FullCellId;
         record.Snapshot = accepted;
         record.RefreshDerivedState(refreshPosition);
+        if (record.FullCellId != previousCell)
+        {
+            PropagateFullCellToChildren(
+                record,
+                record.FullCellId,
+                record.CanonicalLandblockId);
+        }
     }
 
     public void AdvanceCreateAuthority(RuntimeEntityRecord record)
@@ -344,6 +352,157 @@ public sealed class RuntimeEntityDirectory
     {
         EnsureKnown(record);
         record.SetFullCell(fullCellId, canonicalLandblockId);
+        PropagateFullCellToChildren(record, fullCellId, canonicalLandblockId);
+    }
+
+    /// <summary>
+    /// Reused across every <see cref="PropagateFullCellToChildren"/> call.
+    /// Always empty on entry and on exit (the loop drains it unconditionally
+    /// before returning) — see that method's remarks for why sharing it is
+    /// safe rather than a repeat of the round-3 A6/B4 scratch-buffer
+    /// reentrancy lesson: this stack never escapes the method, and nothing
+    /// on the write path can trigger a nested call while it holds state.
+    /// </summary>
+    private readonly Stack<RuntimeEntityRecord> _propagationWorklist = new();
+
+    /// <summary>
+    /// C4 route 7 D2 — the sole propagation hook. Retail's parent-cell-
+    /// crossing propagation (<c>CPhysicsObj::SetPositionInternal</c>
+    /// @0x00515330's changed-cell branch @0x00515372 -&gt; <c>change_cell</c>
+    /// @0x00513390 -&gt; the self-recursive <c>enter_cell</c>/<c>leave_cell</c>
+    /// @0x00510ed0/@0x00510f50) has exactly one acdream analogue: every
+    /// canonical cell write already funnels through this method or
+    /// <see cref="RefreshSnapshot"/>'s derived-state write (see
+    /// docs/research/2026-08-04-retail-parent-cell-propagation.md and the
+    /// route-7 contract's D2).
+    ///
+    /// <para>
+    /// ITERATIVE, not recursive (round-3 remediation — both the retail and
+    /// architecture reviews independently converged on the same finding,
+    /// N4/B3: a depth-capped RECURSIVE version left a subtree beyond the cap
+    /// at a STALE NONZERO cell permanently — on the withdraw path that is
+    /// the #184 shape verbatim, the exact defect AP-142 clause (a) exists to
+    /// reject, shipped fresh inside the slice whose headline is fixing it.
+    /// A reused <see cref="_propagationWorklist"/> stack removes the depth
+    /// concept entirely rather than mitigating it: there is no C# call-stack
+    /// growth to bound, so the only limit is the number of committed
+    /// relations actually in the system (which cannot exceed the live
+    /// entity count) — matching retail's own genuinely unbounded recursion
+    /// exactly, with no acdream-only cap and no register row for one. This
+    /// also retires B5 in the sense that there is no longer a RECURSIVE call
+    /// to reason about — but the bypass itself is NOT retired: the loop
+    /// below still calls a child's own <c>SetFullCell</c> directly rather
+    /// than the public <see cref="SetFullCell"/>, and that bypass is
+    /// DELIBERATE and LOAD-BEARING, not incidental. The public
+    /// <see cref="SetFullCell"/> calls this method, and this method opens
+    /// with <c>_propagationWorklist.Clear()</c> — routing a child through
+    /// the public method would re-enter this method mid-drain, clear the
+    /// shared worklist out from under the OUTER loop, and silently drop
+    /// every sibling still waiting on the stack, with no error and no
+    /// exception. Any side effect added to the public
+    /// <see cref="SetFullCell"/> in the future MUST be mirrored by hand at
+    /// this call site, because this call site cannot route through it.
+    /// </para>
+    ///
+    /// <para>
+    /// Skipping a child whose <see cref="RuntimeEntityRecord.FullCellId"/>
+    /// (and <see cref="RuntimeEntityRecord.CanonicalLandblockId"/>, A7)
+    /// already equals the target is BOTH the cycle guard (an A→B→A wire-
+    /// induced relation cycle writes A, pushes B, writes B, pops B, finds A
+    /// already at the target value, and does not re-push it — no visited
+    /// set needed) and the retail-behavioral subsumption of retail's
+    /// separate same-cell depth-1 id refresh (@0x0051539c-@0x005153d8)
+    /// under this project's single-field cell model (AP-142). Zero
+    /// allocation after warmup:
+    /// <see cref="ParentAttachmentState.ChildrenAttachedToParent"/> returns
+    /// the stored list or <see cref="Array.Empty{T}"/>, and the worklist
+    /// stack is a reused field, never a fresh collection per call. Field
+    /// writes only — no clock, workset, shadow, or placement work — so this
+    /// is safe to run re-entrantly inside whatever transaction is mid-commit
+    /// on the parent's own cell; the worklist field itself is safe to share
+    /// across calls because the loop below unconditionally drains it to
+    /// empty before this method returns, and nothing on the write path
+    /// (a field assignment and an optional diagnostic log line) can call
+    /// back into a nested <see cref="SetFullCell"/>. NOT gated on retail's
+    /// <c>part_array != 0</c> guard (@0x00510ed8) — see AP-142 clause (d)
+    /// for why that guard has no reproducible analogue at acdream's
+    /// canonical layer.
+    ///
+    /// <para>
+    /// P8 (contract proof obligation, corrected at the architecture review
+    /// round — A3): this step deliberately publishes NO per-child
+    /// <c>RuntimeEntityChange.Rebucketed</c> delta, matching
+    /// <c>RuntimePhysicsState.CommitCanonicalCell</c>'s precedent. The
+    /// correct basis for that decision is BOTH observer interfaces, not
+    /// just <c>IRuntimeEntityObjectObserver</c>'s direct implementations:
+    /// <c>GameRuntimeEventHub</c> itself implements
+    /// <c>IRuntimeEntityObjectObserver</c> and fans every entity delta out
+    /// to <c>IRuntimeEventObserver</c>, and <c>RuntimeTraceRecorder.OnEntity</c>
+    /// (<c>GameRuntimeEvents.cs</c>) is a non-stub shipped consumer that
+    /// records <c>(delta.Change, delta.Entity.CellId)</c> for every entity
+    /// delta — it is diagnostic tracing, not gameplay logic, and the
+    /// entries it would lose are graphical-only equipped-child
+    /// <c>Rebucketed</c> deltas that TickChild's demoted rebucket used to
+    /// produce, so silence here is acceptable, but "no consumer at all" is
+    /// false and must not be restated that way.
+    /// </para>
+    ///
+    /// <para>
+    /// P4 (contract proof obligation — the child broadphase story, stated):
+    /// this step writes canonical cell FIELDS only. At attach, the
+    /// preceding cell-less edge already force-ends collision reporting
+    /// (<c>Physics.CollisionReports.LeaveWorld</c>) and no child broadphase
+    /// registration exists to rebuild — retail's own
+    /// <c>recalc_cross_cells</c> @0x00515A30 runs at attach only, never
+    /// per-crossing (the §0 trap this hook deliberately does not port). At
+    /// every crossing thereafter, a committed child never becomes a spatial
+    /// root (<c>LiveEntityRuntime.HasSpatialRuntimeProjection</c> keys off
+    /// <c>ProjectionKind is World</c>, and an attached child is always
+    /// <c>ProjectionKind.Attached</c> — <c>AcknowledgeSpatialProjection</c>
+    /// is never called on this path, headless or graphical), so it never
+    /// joins any physics workset or shadow/cross-cell list this step would
+    /// need to maintain. Confirmed, not assumed: zero shadow work is
+    /// performed anywhere in this method.
+    /// </para>
+    /// </summary>
+    private void PropagateFullCellToChildren(
+        RuntimeEntityRecord root,
+        uint fullCellId,
+        uint canonicalLandblockId)
+    {
+        _propagationWorklist.Clear();
+        _propagationWorklist.Push(root);
+        while (_propagationWorklist.Count > 0)
+        {
+            RuntimeEntityRecord current = _propagationWorklist.Pop();
+            IReadOnlyList<uint> children = ParentAttachments.ChildrenAttachedToParent(
+                current.ServerGuid,
+                current.Incarnation);
+            for (int i = 0; i < children.Count; i++)
+            {
+                // A7 (architecture review, LOW): key the idempotence/cycle
+                // skip on the PAIR, not FullCellId alone. Every production
+                // writer derives canonicalLandblockId from fullCellId, so
+                // the two are coupled today, but the coupling is not
+                // enforced anywhere (LiveEntityRuntime.CanonicalLandblockId's
+                // setter can write a same-cell, different-landblock pair) —
+                // testing the pair is the version that is correct
+                // independent of that coupling.
+                if (!TryGetActive(children[i], out RuntimeEntityRecord child)
+                    || (child.FullCellId == fullCellId
+                        && child.CanonicalLandblockId == canonicalLandblockId))
+                {
+                    continue;
+                }
+                if (PhysicsDiagnostics.ProbeChildCellEnabled)
+                {
+                    Console.WriteLine(FormattableString.Invariant(
+                        $"[child-cell] parent=0x{current.ServerGuid:X8} child=0x{child.ServerGuid:X8} old=0x{child.FullCellId:X8} new=0x{fullCellId:X8} cause={(fullCellId == 0u ? "withdraw" : "propagate")}"));
+                }
+                child.SetFullCell(fullCellId, canonicalLandblockId);
+                _propagationWorklist.Push(child);
+            }
+        }
     }
 
     public void SetFinalPhysicsState(

src/AcDream.Runtime/Entities/RuntimeEntityObjectLifetime.cs

@@ -997,6 +997,15 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         if (result.Disposition
             is CreateObjectTimestampDisposition.NewGeneration)
         {
+            // D3 (route 7): the replacement-generation path has the same
+            // stranding shape as delete - EndGeneration tears down the
+            // OLD generation's committed-children edge with no cell work.
+            if (prior is not null)
+            {
+                WithdrawCommittedChildrenToCellless(
+                    prior.ServerGuid,
+                    prior.Incarnation);
+            }
             Entities.ParentAttachments.EndGeneration(
                 incoming.Guid,
                 result.Snapshot.InstanceSequence);
@@ -1292,6 +1301,10 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         RuntimePlacementCancellationReceipt initialCancellation =
             ForgetInitialCreateResidence(canonical);
         Entities.AdvancePositionAuthority(canonical);
+        // D7 (route 7): retail order is unset_parent @0x0045227F THEN
+        // leave_world @0x00452286 (SmartBox::DoPickupEvent). This was
+        // inverted; EndChildProjection now runs first.
+        Entities.ParentAttachments.EndChildProjection(update.Guid);
         Physics.CollisionReports.LeaveWorld(canonical);
         RuntimePlacementCancellationReceipt ordinaryCancellation =
             Physics.SetPosition.Forget(canonical);
@@ -1299,7 +1312,6 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
             PreferCancellation(initialCancellation, ordinaryCancellation);
         Entities.SuspendObjectClock(canonical);
         Entities.SetFullCell(canonical, 0u, 0u);
-        Entities.ParentAttachments.EndChildProjection(update.Guid);
         ulong positionVersion = canonical.PositionAuthorityVersion;
         ulong spatialVersion = canonical.SpatialAuthorityVersion;
         return AcknowledgeProjectionAndPublish(
@@ -1440,6 +1452,54 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
             cancellation);
     }
 
+    /// <summary>
+    /// D3 (route 7): retail DeleteObject/set_parent's replacement-
+    /// generation shape both null a subtree's children while they are
+    /// still attached - acdream's relation teardown
+    /// (<see cref="ParentAttachmentState.DeleteGeneration"/>/
+    /// <see cref="ParentAttachmentState.EndGeneration"/>) removes the
+    /// committed-children edge outright with no cell work of its own, so
+    /// callers run this first, through the SAME D2 write path
+    /// (<see cref="RuntimeEntityDirectory.SetFullCell"/>, recursive by
+    /// construction) - acdream's single-field cell model propagates zero
+    /// rather than reproducing retail's stale-`objcell_id`-under-a-null-
+    /// pointer residue (AP-142).
+    /// </summary>
+    private void WithdrawCommittedChildrenToCellless(
+        uint parentGuid,
+        ushort parentInstanceSequence)
+    {
+        IReadOnlyList<uint> children = Entities.ParentAttachments.ChildrenAttachedToParent(
+            parentGuid,
+            parentInstanceSequence);
+        for (int i = 0; i < children.Count; i++)
+        {
+            if (!Entities.TryGetActive(children[i], out RuntimeEntityRecord child))
+                continue;
+            if (PhysicsDiagnostics.ProbeChildCellEnabled)
+            {
+                Console.WriteLine(FormattableString.Invariant(
+                    $"[child-cell] parent=0x{parentGuid:X8} child=0x{child.ServerGuid:X8} old=0x{child.FullCellId:X8} new=0x00000000 cause=delete"));
+            }
+            Entities.SetFullCell(child, 0u, 0u);
+        }
+    }
+
+    /// <summary>
+    /// Route 7 D1 (architecture review A4): the published
+    /// <see cref="RuntimeEntityChange.Withdrawn"/> delta's payload contract
+    /// changed under this slice. Before D1 existed, a <c>Withdrawn</c> from
+    /// this method always carried <c>FullCellId == 0</c>. It now carries
+    /// the PARENT's exact cell whenever the parent is celled at attach —
+    /// i.e. in the ordinary equip case — because D1's re-cell runs before
+    /// this method's <see cref="AcknowledgeProjectionAndPublish"/> call, in
+    /// the SAME synchronous transaction (so no caller ever observes the
+    /// child cell-less in between). This is deliberate: the kind still
+    /// correctly says "this projection was withdrawn and must be
+    /// re-realized," and the payload's cell is the child's ACTUAL resulting
+    /// cell, not a stale zero. Pinned by
+    /// <c>Attach_ParentCelled_ChildEndsAtParentCellAndStaysSuspended</c>.
+    /// </summary>
     public bool CommitAcceptedParentCellless(
         RuntimeEntityRecord canonical,
         ulong positionAuthorityVersion,
@@ -1462,6 +1522,31 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         Physics.CollisionReports.LeaveWorld(canonical);
         Entities.SuspendObjectClock(canonical);
         Entities.SetFullCell(canonical, 0u, 0u);
+        // D1 (route 7): retail set_parent's second half, run on the SAME
+        // synchronous transaction so no caller observes the child
+        // cell-less between the leave-world edge and the re-cell.
+        // @0x00515AC6 parent = ...; @0x00515AD1 if (parent->cell != 0)
+        // @0x00515AD6 change_cell(this, parent->cell). The committed
+        // relation (not the guid alone) resolves the parent so a stale or
+        // superseded incarnation can never re-cell the child.
+        if (Entities.ParentAttachments.TryGetCommittedParent(
+                canonical.ServerGuid,
+                out uint parentGuid,
+                out ushort parentInstanceSequence)
+            && Entities.TryGetActive(parentGuid, out RuntimeEntityRecord parent)
+            && parent.Incarnation == parentInstanceSequence
+            && parent.FullCellId != 0u)
+        {
+            if (PhysicsDiagnostics.ProbeChildCellEnabled)
+            {
+                Console.WriteLine(FormattableString.Invariant(
+                    $"[child-cell] parent=0x{parentGuid:X8} child=0x{canonical.ServerGuid:X8} old=0x00000000 new=0x{parent.FullCellId:X8} cause=attach"));
+            }
+            Entities.SetFullCell(
+                canonical,
+                parent.FullCellId,
+                parent.CanonicalLandblockId);
+        }
         ulong spatialVersion = canonical.SpatialAuthorityVersion;
         return AcknowledgeProjectionAndPublish(
             canonical,
@@ -1993,6 +2078,13 @@ public sealed class RuntimeEntityObjectLifetime : IDisposable
         }
 
         Entities.AdvanceLifetimeMutation(delete.Guid);
+        // D3 (route 7): retail's DeleteObject nulls a subtree's children
+        // while they are still attached (leave_world @0x00508472 runs
+        // BEFORE unparent_children @0x005084B9) - DeleteGeneration below
+        // performs no cell work of its own, so run the children's
+        // leave-world edge first or a deleted parent's children are
+        // stranded at a stale nonzero cell (the #184 shape).
+        WithdrawCommittedChildrenToCellless(delete.Guid, delete.InstanceSequence);
         Entities.ParentAttachments.DeleteGeneration(
             delete.Guid,
             delete.InstanceSequence);

src/AcDream.Runtime/Entities/RuntimeInitialCreateContinuationExecutor.cs

@@ -2181,12 +2181,18 @@ internal sealed class RuntimeInitialCreateContinuationExecutor
         // must not tear down the residence mid-drain: only ordinary
         // SetPosition.Forget runs here, never ForgetInitialCreateResidence.
         _entities.AdvancePositionAuthority(canonical);
+        // D7 (route 7, architecture review A5): retail order is
+        // unset_parent @0x0045227F THEN leave_world @0x00452286
+        // (SmartBox::DoPickupEvent) - the same reorder
+        // RuntimeEntityObjectLifetime.TryApplyPickup applies to the live
+        // pickup path, applied here to the DORMANT replay of the same wire
+        // event so both pickup paths are one shape.
+        _entities.ParentAttachments.EndChildProjection(canonical.ServerGuid);
         _physics.CollisionReports.LeaveWorld(canonical);
         RuntimePlacementCancellationReceipt cancellation =
             _physics.SetPosition.Forget(canonical);
         _entities.SuspendObjectClock(canonical);
         _entities.SetFullCell(canonical, 0u, 0u);
-        _entities.ParentAttachments.EndChildProjection(canonical.ServerGuid);
         // Round 3 B2: mutate -> rebaseline -> publish. Round 4 R4-4:
         // AdvancePositionAuthority + SetFullCell(0,0) move
         // PositionAuthorityVersion and FullCellId, the only two of the