docs(runtime): close J3.3 and hand off J3.4

Record exact projection-store ownership, automated and connected evidence, rollback chain, and the executor-ready canonical object-table plan. Reconcile milestones, roadmap, architecture, divergence pointers, AGENTS/CLAUDE, and durable handoff state.

Co-authored-by: Codex <codex@openai.com>

docs/architecture/code-structure.md

@@ -47,8 +47,9 @@ At the campaign baseline, `GameWindow` was the single object that:
 - Composes the shipped `LiveSessionController`/host/router boundary; it no
   longer owns a parallel session, command bus, subscription lifetime, connect,
   character-entry, reconnect, or graceful-close body.
-- Owns the adapters that hydrate canonical `LiveEntityRuntime` records into
-  animation, collision, rendering, and DAT-backed appearance resources.
+- Owns the adapters that hydrate canonical Runtime entity records into
+  exact-key App projection sidecars and their animation, collision, rendering,
+  and DAT-backed appearance resources.
 - Composes the shipped `WorldSelectionQuery` and
   `SelectionInteractionController`; it no longer owns world-picking,
   selection intent, Use/PickUp, or auto-walk deferral algorithms.
@@ -298,7 +299,8 @@ What `GameWindow` loses:
 - Live connect/enter/logout and event-subscription bodies → completed inside
   `LiveSessionController` / `LiveSessionEventRouter`.
 - Live-object hydration adapters and final animated-part presentation → focused
-  world/render owners over canonical `LiveEntityRuntime` records.
+  world/render owners over exact-key App projection sidecars backed by
+  canonical Runtime records.
 - `WorldPicker`, target queries, and selection-driven Use/PickUp/auto-walk →
   `WorldSelectionQuery` + `SelectionInteractionController`. Core
   `SelectionState` remains the injected session owner.
@@ -310,27 +312,33 @@ What `GameWindow` loses:
 
 The eventual `GameEntity` aggregation (target state described in
 `acdream-architecture.md` §"GameEntity: The Unified Entity") happens
-**after** `LiveEntityRuntime` is the single owner of entity state.
-Until then, the parallel-dicts problem is bounded inside one class
-instead of spread across `GameWindow`.
+**after** `RuntimeEntityDirectory` is the single owner of canonical entity
+state. That boundary is now shipped. App's former parallel presentation
+dictionaries are bounded by one exact-key projection store rather than spread
+across `GameWindow`.
 
-`LiveEntityRuntime` is now that single boundary. It composes
-`InboundPhysicsStateController` for the nine-channel retail timestamp gates and
-latest accepted immutable CreateObject snapshot, owns the canonical local ID
-and optional runtime components, and separates logical registration from
-spatial projection. It also retains raw PhysicsState separately from the final
-state produced by retail's ordered side effects;
-`LiveEntityPresentationController` projects those transitions into draw,
-collision, effect, child-NoDraw, and target visibility without becoming a
-second lifetime or GUID owner. `ParentAttachmentState` is runtime-owned and keys unresolved
-relations by child and parent generation. `Rendering/Vfx/EntityEffectController`
-owns the focused mixed F754/F755 pending FIFO, effect profiles, typed-table
-resolution, and a readiness set; canonical ServerGuid-to-local-ID translation
-always stays in `LiveEntityRuntime`. `EntityScriptActivator` uses the same
-canonical `WorldEntity.Id` as rendering and physics; the disjoint static ID
-allocators fail fast instead of wrapping into another landblock's namespace.
-All other non-Parent packet
-families still need the future general queue tracked by divergence AD-32.
+`RuntimeEntityDirectory` owns the only active server-GUID/incarnation map,
+Runtime local-ID allocation/reverse lookup, accepted immutable CreateObject
+snapshot and nine-channel timestamp gates, parent relations, operation
+versions, and exact teardown tombstones. `RuntimeEntityRecord` is
+presentation-free. `LiveEntityRuntime` is the App projection/lifecycle host:
+it creates a `LiveEntityRecord` sidecar only after Runtime local-ID claim and
+stores it in `LiveEntityProjectionStore` by exact `RuntimeEntityKey`.
+Hydration, animation, effects, lights, equipped children, render identity,
+movement observations, liveness, teardown, and spatial worksets borrow that
+same exact identity. `LiveEntityPresentationController` projects Runtime state
+transitions into draw, collision, effects, child-NoDraw, and target visibility
+without becoming a second canonical owner.
+
+`Rendering/Vfx/EntityEffectController` owns the focused mixed F754/F755 pending
+FIFO, effect profiles, typed-table resolution, and readiness markers. A GUID
+is retained there only as pending wire-delivery metadata; current-incarnation
+resolution always asks `RuntimeEntityDirectory` and then the exact projection
+store. `EntityScriptActivator` uses the same Runtime-issued `WorldEntity.Id` as
+rendering and physics; disjoint static ID allocators fail fast instead of
+wrapping into another landblock's namespace. All other non-Parent pre-create
+packet families still need the future general queue tracked by divergence
+AD-32.
 
 The per-frame object scheduler is extracted, but final animated-part
 presentation is not. `LiveEntityAnimationScheduler` snapshots canonical spatial
@@ -348,8 +356,8 @@ is deliberately separate: `RetailStaticAnimatingObjectScheduler` owns the
 Static owners with Setup DefaultAnimation. Both schedulers are wired by
 `GameWindow`, but neither owns GUID identity or logical resources.
 The typed animation view fills its reusable snapshot and render-ID set from
-`LiveEntityRuntime`'s concrete spatial dictionary, avoiding interface-enumerator
-boxing on both update and render hot paths.
+the exact-key projection workset, avoiding interface-enumerator boxing on both
+update and render hot paths.
 `RemoteInboundMotionDispatcher` similarly keeps UpdateMotion protocol behavior
 outside `GameWindow`: GameWindow resolves the canonical record/body and the
 optional PartArray sink, while one dispatcher owns retail's interrupt, style,
@@ -408,7 +416,8 @@ not `GameWindow`: it retains at most one pending request per materialized
 incarnation, scopes it by the live generation and accepted PositionSequence,
 and asks `RemoteTeleportPlacement` to collision-seat the current body when the
 destination projection is available. `GameWindow` supplies lifecycle and
-shadow-sync callbacks only; canonical identity remains in `LiveEntityRuntime`.
+shadow-sync callbacks only; canonical identity remains in
+`RuntimeEntityDirectory`, and App placement retains the exact projection key.
 Failed hydration restores the captured source and delegates an
 incarnation-scoped shadow restore to `LiveEntityPresentationController` while
 that source is unloaded, so Hidden/UnHide and teleport never become competing
@@ -459,16 +468,16 @@ useful ordering seam, but its ownership status is **partial**.
 | Area | Status | Current truth |
 |---|---|---|
 | Startup options | **Complete** | `RuntimeOptions` owns startup configuration (`eda936dc`). Remaining direct environment reads are legacy runtime diagnostics, not startup configuration. |
-| Network session | **Complete** | `LiveSessionController` remains the sole resolve/create/Connect/selection/EnterWorld/Tick/stop/reconnect/disposal and current-session owner. `LiveSessionHost` owns App reset/selection/entry ordering plus create→attach route factories; `LiveSessionLifecycleHost` guards exact borrowed-session attachment. `LiveSessionEventRouter` and `LiveSessionCommandRouter` own exact inbound/outbound lifetimes, with retryable per-edge teardown before reset or replacement. `GameWindow` retains the controller, focused host, and typed domain binding factories—no mirrored session or reset plan. |
+| Network session | **Complete Runtime ownership** | `RuntimeLiveSessionController` owns the sole `WorldSession` generation and resolve/create/Connect/selection/EnterWorld/Tick/stop/reconnect/disposal transaction. Runtime route owners preserve exact inbound/outbound ordering and retryable teardown. App supplies immutable options, graphical/domain callbacks, and one borrowed inertable UI command projection—no mirrored session or reset plan (`75930787`). |
 | World environment | **Complete ownership** | `WorldEnvironmentController` solely owns WorldTime, the loaded DAT sky, current day group, Weather, server synchronization, AdminEnvirons bridging, and debug time/weather cycles. `GameWindow` keeps ABI-compatible readonly aliases to the same clock/weather instances and composes one render source plus the two live-session callbacks. TS-54/TS-55 register the remaining centered UI sound and full fog/ambient/radar behavior gaps. |
-| Live identity/lifetime | **Complete App integration** | `LiveEntityRuntime` owns incarnation identity, accepted snapshots/timestamps, runtime components, and logical/spatial lifetime. `LiveEntityHydrationController`, `LiveEntityRuntimeTeardownController`, and `LiveEntityNetworkUpdateController` own DAT-backed hydration, retryable cleanup, and accepted Position/Vector/State/Movement presentation without a second GUID owner (`aa90c646`). |
+| Live identity/lifetime | **J3.3 complete** | `RuntimeEntityDirectory` owns the sole GUID/incarnation/local-ID identity, accepted snapshots/timestamps, parent state, operation versions, and tombstones. `LiveEntityProjectionStore` owns App graphical sidecars by exact `RuntimeEntityKey`; hydration, presentation components, `GpuWorldState` residence/visibility, and retryable teardown preserve that key without another GUID authority (`f46ddb5c`, `420e5eea`, `e937cc36`). |
 | Inbound/object-frame order | **Complete App orchestration** | `UpdateFrameOrchestrator` owns the complete typed host phase graph; `RetailInboundEventDispatcher`, `RetailLiveFrameCoordinator`, `LiveObjectFrameController`, `LiveSpatialPresentationReconciler`, streaming/input/teleport/player-mode/camera owners preserve the accepted order. `GameWindow.OnUpdate` is one profiler-scoped handoff (`e91f3102`). |
 | World reveal | **Complete** | `WorldRevealCoordinator` owns login/portal readiness, generation quiescence, and the exact streaming destination reservation. Login auto-entry and portal completion close only their active generation; stale completion cannot clear its replacement. Delayed portals retain the authored tunnel and centered retail wait notice rather than force-revealing incomplete content. Quiesced destination projections may become spatially resident for renderer preparation while all availability-gated gameplay consumers stay closed. |
 | Retained gameplay UI | **Mostly complete feature ownership** | `RetailUiRuntime` and focused panel/controllers own layout and behavior. `GameWindow.OnLoad` still performs substantial service composition, which is allowed until the final composition cleanup. |
 | Selection/interaction | **Complete** | `WorldSelectionQuery` owns read-only picking/classification/range queries; `SelectionInteractionController` owns selection intent, Use/PickUp transport, exact-incarnation queues, and auto-walk deferral; `ItemInteractionController` owns ItemHolder policy plus the shared retail inventory-request transaction. `GameWindow` retains construction and narrow lifecycle forwarding only. |
 | Landblock presentation | **Complete** | `LandblockBuildFactory` owns the captured-origin DAT transaction; concrete render/physics/DAT-static publishers and `LandblockPresentationPipeline` own typed-meter publication and exact retryable retirement. `StreamingController` owns stable destination/control/unload/Near/Far queues and destination reservation. CPU mesh-cache restaging requires an exact live owner. `StreamingOriginRecenterCoordinator` serializes old-window retirement with teleport/session origin lifetimes. `GameWindow` retains construction and one pipeline field only (`c79d0a49`, closeout `4a205a3e`; Slice E closeout `91e82c3c`). |
 | Render-frame orchestration | **Complete** | `RenderFrameOrchestrator` owns the GPU-flight, resource, world/PView/shared-alpha, private-presentation, diagnostics, screenshot, and recovery graph. `GameWindow.OnRender` takes one logical window-size snapshot and performs one immutable handoff (`9d7df1bf`). |
-| Unified `GameEntity` | **Deferred target** | `LiveEntityRuntime` already supplies the critical canonical owner. Full type aggregation is a separate high-risk migration and is not required to make `GameWindow` thin. |
+| Unified `GameEntity` | **Slice J active** | Canonical identity is now in Runtime and exact graphical sidecars are in App. J3.4 next moves `ClientObjectTable`; later J4–J7 move coherent gameplay lifetime groups before one Runtime composition root. |
 
 ### 4.3 Revised extraction sequence