fix(runtime): give the no-window host a post-merge canonical cell commit (D1, AD-60/AD-64, AP-146/#320)

C5b (735f0a72) made the steady-state accepted-Position merge stop writing
residency. That is retail-correct — HandleReceivedPosition @0x00453FD0 reads
the wire objcell_id into a local and never assigns the object's cell — and it
stays. What C5b did not account for is that its replacement writers both live
in AcDream.App: the OnPosition prologue rebucket (AD-60's W2) and the
post-routing wire-cell adopt (W3, AP-135).

The two hosts run parallel, non-shared inbound routes. LiveEntitySessionController
-> LiveEntityNetworkUpdateController.OnPosition is graphical-only;
RuntimeLiveEntitySessionController.OnPositionUpdated is the no-window route and
is constructed only at HeadlessSessionHost.cs:682. So AcDream.Headless had NO
post-merge cell writer at all. Every remote's FullCellId was written at
create/placement and then frozen for the session — and RuntimeEntityObjectViews
.Snapshot projects exactly that field as RuntimeEntitySnapshot.CellId, i.e. every
bot's entire world view. The local player lost one of AP-146's three refresh
edges, which matters beyond cosmetics: RuntimeSetPositionState
.IsAffectedCollisionResident reads FullCellId to pick which bodies a landblock
retirement parks, so a bot running A->B without teleporting would have retired A
while parking a body physically in B.

The fix, in three parts:

1. RuntimeEntityObjectLifetime.CommitWireCellRebucket — a new Runtime owner for
   the committed VALUE, extracted verbatim from LiveEntityRuntime
   .RebucketLiveEntity. This is also the root-cause fix for the layering
   inversion the review found: AD-60 was documenting its own correctness by
   naming an App class the Runtime assembly cannot reference. Behaviour on the
   graphical side is unchanged — record.FullCellId is a proxy for
   record.Canonical.FullCellId, which is the record the callee reads, and the
   commit is still CommitRebucket. Verified load-bearing for BOTH hosts:
   sabotaging the preserve branch reddens the graphical
   LiveEntityRuntimeTests.CanonicalOnlyRebucket_DoesNotOverwriteAuthoritativeFullCell
   as well as the new headless assertion.

2. RuntimeLiveEntitySessionController.TryCommitAcceptedWireCell — the no-window
   W2, under the same reachability rules the graphical route applies: Rejected
   writes nothing (the shape the App authority gate produces by returning false);
   a bound-projectile packet writes nothing (routed by the graphical host through
   the canonical projectile placement owner, which returns before W2); an active
   initial-create residence writes nothing (RebucketLiveEntity's own early
   return — while the lease is live the SetPosition conductor is the sole cell
   authority); a local ForcePosition writes only when the accepted-Position drive
   declined it (NotApplicable), because a handled force is
   placement-receipt-authoritative. W2/W3 themselves are untouched.

3. On the committed value (the landblock-vs-cell trap). RebucketLiveEntity's
   preserve branch fires on a LANDBLOCK-shaped id — low 16 bits 0xFFFF — and
   exists for LocalPlayerProjectionController.Project, the per-frame local
   movement caller that emits exactly that shape. An inbound wire objcell_id is
   never landblock-shaped, so on the accepted-Position route the branch is not
   taken and the exact wire cell is committed. That is what W2 commits today and
   what this now commits; the no-window host has no per-frame caller at all.

Ordering is matched, not improved on: the force drive submits its placement
before the commit, so its first submit still reads the pre-commit FullCellId —
AP-138's amended route-2 CurrentCellId measurement.

Bookkeeping in this commit:
- AD-60 corrected. Its surviving-channel enumeration presented "the local force
  path, the missile arm" as exhaustive; the entire no-window host belonged in it.
  23aa62f2's W2/W3-redundancy measurement is preserved verbatim.
- AP-146 and #320 amended the same way — their three-edge list was written from
  the graphical host and silently assumed both hosts shared it. The no-window
  host had two of three; it now has all three.
- AD-64 filed: the reachability decision is now expressed once per host. The
  value is single-sourced; the gate set is not.
- #324 filed: unifying the two session controllers is the genuinely correct fix
  and is campaign-sized (presentation recovery, hydration, the equipped-child
  renderer, and the remote/projectile routing arms only one host has). Not
  attempted here, per the fix brief.

Gates. Release build 0 errors. Complete suite 11,141 passed / 4 skipped /
0 failed, against the 11,134 / 4 / 0 baseline at 23aa62f2 — net +7, exactly the
7 tests added. Eight sabotages verified, each red on at least one discriminating
test and green when reverted: remote commit removed (2 Runtime + the end-to-end
Headless test); local ordinary commit removed; local NotApplicable-force commit
removed; force commit made unconditional; residence gate removed; missile gate
removed; Rejected gate removed; preserve branch broken (red on both hosts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ISSUES.md

@@ -24,6 +24,68 @@ What does NOT go here:
 - Every session: scan OPEN issues at start; promote/close anything we touched during the session before ending.
 - Promoting to a Phase: mark as `DONE (promoted to Phase X)` + commit SHA where the Phase entry landed.
 
+## #324 — The graphical and no-window hosts run parallel, non-shared inbound entity routes
+
+**Status:** OPEN
+**Severity:** MEDIUM (no live symptom today; it is the structure that PRODUCED
+D1, and it will produce the next one)
+**Filed:** 2026-08-05, in the C5b architecture-review D1 fix commit, per that
+fix's brief ("if the correct answer is to unify the two session controllers,
+say so and file it rather than attempting it here")
+**Component:** runtime / session routing / host structure
+
+**Description.** Two inbound entity routes exist and neither is derived from
+the other:
+
+- graphical: `src/AcDream.App/Net/LiveEntitySessionController.cs` →
+  `LiveEntityNetworkUpdateController.OnPosition` (and siblings)
+- no-window: `src/AcDream.Runtime/Session/RuntimeLiveEntitySessionController.cs`
+  (`OnPositionUpdated` and siblings), constructed only at
+  `src/AcDream.Headless/Hosting/HeadlessSessionHost.cs:682`
+
+They share the canonical Runtime owners underneath (Slice J's whole point) but
+NOT the routing decisions on top: which packet shapes reach which owner, in
+what order, under what gates. Every canonical rule expressed in the graphical
+route's control flow has to be re-derived by hand for the other, and nothing
+enforces that it was.
+
+**Why this is filed as its own issue rather than fixed inline.** This is the
+structural cause of defect D1 from the C5b architecture review (both reviewers
+found it independently). C5b made the steady-state Position merge stop writing
+residency — retail-correct — and moved the write to the `OnPosition`
+prologue rebucket. That rebucket is graphical-only, so the no-window host
+silently lost canonical cell tracking for every entity: remotes froze at their
+placement cell for the whole session, and the local player lost one of
+AP-146's three refresh edges. Nothing failed; the host just stopped being
+right. The D1 fix gives the no-window route its own commit over a shared
+Runtime value owner and files the residual duplication at AD-64 — it does not
+remove the class.
+
+**What unification has to reconcile (why it is campaign-sized, not a slice):**
+
+1. The graphical route performs presentation recovery the no-window route has
+   no analogue for (`RequiresSpatialProjectionRecovery`, the equipped-child
+   `ChildUnparentDisposition` arm, `LiveEntityHydrationController`).
+2. The graphical route performs remote contact routing, far-snap/teleport
+   placement arms, and projectile routing; the no-window route performs none
+   of them and returns early for `!isLocal`. Unifying means deciding whether
+   the no-window host GAINS those arms (a behaviour change with its own gate)
+   or whether the shared route is parameterized over them.
+3. Ordering constraints are load-bearing and already documented as
+   measurements, not intentions — AP-138's route-2 first-submit
+   `CurrentCellId` observation depends on the force drive submitting BEFORE
+   the wire-cell commit, and AD-60/AP-147 on the merge publishing before the
+   rebucket. A unified route must preserve each, per host.
+4. `LiveEntityRuntime`'s spatial/presentation half and its canonical half are
+   currently interleaved in one method (`RebucketLiveEntity`); the D1 fix
+   split out the canonical value derivation, but the residence gate, the
+   object-clock enter-world rebase, and the visibility publication are still
+   entangled with the bucket move.
+
+**Acceptance:** one route object owns the inbound decision set for both hosts,
+with presentation and routing supplied as collaborators; AD-64 is deleted in
+the same commit; the eight D1 sabotages still discriminate.
+
 ## #320 — The local player's canonical cell does not track ordinary movement (follow-up from #319)
 
 **Status:** OPEN
@@ -61,6 +123,33 @@ survey: a local **ForcePosition** returns before that tail, so its residency
 is now placement-receipt-authoritative — a refused or contended force writes
 no cell at all (retail's own shape; AD-62).
 
+**Corrected 2026-08-05 by the C5b architecture review's D1 fix.** The
+three-edge enumeration above was written from the graphical host and silently
+assumed both hosts shared it. They do not. `AcDream.App` and
+`AcDream.Headless` run parallel, non-shared inbound routes
+(`LiveEntitySessionController` → `LiveEntityNetworkUpdateController.OnPosition`
+versus `RuntimeLiveEntitySessionController.OnPositionUpdated`), and C5b's
+replacement writer lived only in the former — so the no-window host had only
+TWO of the three edges, login activation and the teleport/portal commit, and
+its remotes' cells were frozen from placement onward as well. That is fixed:
+`RuntimeLiveEntitySessionController.TryCommitAcceptedWireCell` now commits the
+same value through a shared Runtime owner,
+`RuntimeEntityObjectLifetime.CommitWireCellRebucket`, which is also where the
+landblock-preserve branch this issue's item 1 is about now lives (it moved
+verbatim out of `LiveEntityRuntime.cs:935-938`; update that citation when
+reading item 1). The reachability duplication the fix leaves behind is filed
+at AD-64, and controller unification at #324.
+
+**What this changes for item 6, the unresolved first verification step.** It
+does not answer it, but it removes a strictly-worse case that was hiding
+underneath it: before the fix, a no-window bot lacked the inbound-Position
+edge entirely, so a bot running A→B without ever teleporting kept
+`FullCellId` at A for the whole session — retiring A would park a body that
+is physically in B, and retiring B would miss it. Both hosts now refresh at
+ACE's 5-10 Hz Position cadence. The question item 6 actually asks — whether a
+stale-cell landblock retirement can sweep a spatial-root local player — is
+unchanged and still open.
+
 **Why this is not #319's blast radius.** #319's fix makes a player-parented
 equipped child inherit the parent's (the player's) canonical cell EXACTLY —
 an equality invariant, not a freshness one. The child is stale-but-equal