docs(physics): record cutover slice C3c completion + closeout

C3c COMPLETE at 529e0e9d in the placement-cutover plan (five fix slices,
R1 dual-review round, final gates). New closeout research note. ISSUES
#276 (settle-CellId discard), #277 (route-1 far-Create radius bound),
#278 (user-session triage bundle). Register AD-60/AD-61 numeric order.

The next slice before C5 is the 6b28ff99 O(changed) collision clone
(soak convergence); C4 resumes after.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/research/2026-08-02-c3c-cutover-closeout.md

@@ -0,0 +1,104 @@
+# C3c production placement cutover — closeout (2026-08-02)
+
+Behavior commit: `529e0e9d` (68 files, +5,979/−833, register rows AD-61 +
+AD-42 refresh in-commit). Plan:
+[`2026-08-02-placement-cutover.md`](../plans/2026-08-02-placement-cutover.md).
+Session evidence trail: the campaign scratchpad's `implementer-progress.md`
+sections `Continuation 1-4`, `C3c-F1`..`C3c-F5`, `C3c-R1` (not committed;
+summarized here).
+
+## What shipped
+
+Both production hosts (graphical + headless) register every initial
+wire Create through the C0-C3b residence/executor/conductor machinery.
+One shared `RuntimeFirstEntryDriveController` pumps the local-player and
+remote conductors from the placement-receipt flow (per-frame graphical,
+per-tick headless). `MaterializeProjection`/`RebucketLiveEntity` are
+presentation-only strictly while the initial-create residence is ACTIVE
+(exact-token check; `ExecutorCompleted` is the presentation-binding
+receipt); post-residence entities take the full legacy path including
+retail's `prepare_to_enter_world` (0x00511FA0) clock rebase.
+`RuntimeLocalPlayerMovementState.Controller`'s setter is sealed; every
+controller mutation flows through the publication lifecycle. Content-less
+headless sessions (validated-legal config) keep the pre-flip direct
+registration until C4/C5 revisit.
+
+## The five fix slices (each connected-gated inside the cutover)
+
+- **F1** — live movement-stat + server-physics application moved behind
+  Runtime ownership (`RuntimeMovementStatsApplication`,
+  `ApplyServerPhysicsState`); the post-logout ingest crash on the
+  retired controller is eliminated; `RuntimeMovementSkillProjection`
+  deleted.
+- **F2** — the login activation wedge (world never revealed): the
+  collision-admission prefix gate factored out of the seal (reentrant
+  commit could yield terminal `RejectedAuthority`), the rearm's
+  generation identity corrected (parked G vs post-retirement G+1), and
+  `PlayerModeAutoEntry` now requires the Runtime-published controller
+  (`IsPlayerControllerReady` was a constant `true` — one early attempt
+  permanently sealed the reveal).
+- **F3** — landblock-prefix `0`-sentinel replaced by explicit absent-id
+  representation; map-corner landblocks (grid row/col 0, e.g.
+  `0x0000FFFF`) are legal through admission, park/rearm/retire,
+  quiescence, and outdoor shadow seeds.
+- **F4** — diagnosis only: the nine-stop soak's convergence failure
+  (pendingPublications=1, farBacklog nonzero, landblock/mesh dimensions)
+  is **pre-existing `6b28ff99`** (2026-07-31, "make collision activation
+  starvation-free"): every far publication clones the complete collision
+  world (median ~19.7k leaves / 3.64 ms), so the queue drains ~10
+  landblocks/s and never catches its window. Fix requires an O(changed)
+  clone (structural sharing or per-landblock atomic unit) — a semantics
+  change to that slice's asserted one-leaf-per-step invariant; scheduled
+  as its own slice BEFORE C5 (whose gate matrix includes the soak).
+- **F5** — local-player first-entry ground contact: retail seeds contact
+  from the first gravity frame's transition touch (`enter_world`
+  0x00516170 carries no seed; local player and remotes share the
+  mechanism via `HandleCreateObject` 0x00454C80). The shared
+  `SpawnPlacementSettler` (moved App→Core) runs at `FinalizeActivation`
+  exactly once; genuinely airborne spawns stay airborne; the outbound
+  contact bit chain is asserted end-to-end. The legacy path's
+  unconditional `Contact|OnWalkable|Active` force-seed (non-retail, no
+  plane) still runs during candidate preparation and is OVERWRITTEN by
+  the faithful settle (register AD-61). Fixes the user-observed
+  standing-cast "You can't do that while in the air!" rejections.
+
+## Review round R1 (dual Opus: initial FAIL 2+2 MAJOR → delta PASS both)
+
+Retail MAJORs: the login constraint leash (deleted with the legacy
+resolve path; re-armed at the committed placement in
+`FinalizeActivation` — `HandleReceivedPosition` 0x00453FD0 arms on every
+accepted position) and the post-residence rebucket scope (fixed to
+exact-token active-residence). Adversarial MAJORs: content-less headless
+(no drive → legacy registration) and the register rows. Nine minors
+fixed (owner conversion API with active-residence throw, wire-landblock
+guards, drive-pending ledger in `IsConverged`, route attach/detach
+latch, celless conversion for far headless remotes, doc-comment truth,
+per-incarnation cylinder cache, executor-drain drift model documented +
+source-pinned); two tracked (#276, #277 in ISSUES).
+
+## Final gates
+
+Runtime 1,003; App 4,039/3 skips; Headless 79; complete solution
+**10,816 / 0 failed / 4 skips** (Release, `-m:1`). Connected
+lifecycle/reconnect gate **PASS** (`connected-world-gate-20260802-175401`;
+graceful exits, world-visible, zero airborne-rejection strings; run
+`-174811` failed on user-interference fingerprint —
+`activeTeleportCount=1` at the stable checkpoint — and is attributed,
+not counted). The soak stays red for the pre-existing F4 attribution.
+
+## Process lessons (carried to memory)
+
+1. **Report artifacts over marker logs** — three wrong classifications
+   this campaign came from reading route/marker logs instead of
+   `report.json` (the soak "clean route" was Passed=false with 37
+   convergence failures).
+2. **Log lifetime before absence claims** — a 26-second, 67-line log's
+   silence about a defect proves nothing (the 122749 misread inverted a
+   root-cause classification twice).
+3. **User observation is the cheapest gate** — the standing-cast
+   airborne rejections and the black-screen reveal were both
+   user-spotted minutes before harness detection.
+4. **The seal finds the bypasses** — sealing the controller setter
+   surfaced a runtime-mutation bypass (F1) the compile-break audit could
+   not see; expect the same class when sealing any long-lived escape
+   hatch.