# C3c production placement cutover — closeout (2026-08-02)

Behavior commit: `529e0e9d` (68 files, +5,979/−833, register rows AD-61 +
AD-42 refresh in-commit). Plan:
[`2026-08-02-placement-cutover.md`](../plans/2026-08-02-placement-cutover.md).
Session evidence trail: the campaign scratchpad's `implementer-progress.md`
sections `Continuation 1-4`, `C3c-F1`..`C3c-F5`, `C3c-R1` (not committed;
summarized here).

## What shipped

Both production hosts (graphical + headless) register every initial
wire Create through the C0-C3b residence/executor/conductor machinery.
One shared `RuntimeFirstEntryDriveController` pumps the local-player and
remote conductors from the placement-receipt flow (per-frame graphical,
per-tick headless). `MaterializeProjection`/`RebucketLiveEntity` are
presentation-only strictly while the initial-create residence is ACTIVE
(exact-token check; `ExecutorCompleted` is the presentation-binding
receipt); post-residence entities take the full legacy path including
retail's `prepare_to_enter_world` (0x00511FA0) clock rebase.
`RuntimeLocalPlayerMovementState.Controller`'s setter is sealed; every
controller mutation flows through the publication lifecycle. Content-less
headless sessions (validated-legal config) keep the pre-flip direct
registration until C4/C5 revisit.

## The five fix slices (each connected-gated inside the cutover)

- **F1** — live movement-stat + server-physics application moved behind
  Runtime ownership (`RuntimeMovementStatsApplication`,
  `ApplyServerPhysicsState`); the post-logout ingest crash on the
  retired controller is eliminated; `RuntimeMovementSkillProjection`
  deleted.
- **F2** — the login activation wedge (world never revealed): the
  collision-admission prefix gate factored out of the seal (reentrant
  commit could yield terminal `RejectedAuthority`), the rearm's
  generation identity corrected (parked G vs post-retirement G+1), and
  `PlayerModeAutoEntry` now requires the Runtime-published controller
  (`IsPlayerControllerReady` was a constant `true` — one early attempt
  permanently sealed the reveal).
- **F3** — landblock-prefix `0`-sentinel replaced by explicit absent-id
  representation; map-corner landblocks (grid row/col 0, e.g.
  `0x0000FFFF`) are legal through admission, park/rearm/retire,
  quiescence, and outdoor shadow seeds.
- **F4** — diagnosis only: the nine-stop soak's convergence failure
  (pendingPublications=1, farBacklog nonzero, landblock/mesh dimensions)
  is **pre-existing `6b28ff99`** (2026-07-31, "make collision activation
  starvation-free"): every far publication clones the complete collision
  world (median ~19.7k leaves / 3.64 ms), so the queue drains ~10
  landblocks/s and never catches its window. Fix requires an O(changed)
  clone (structural sharing or per-landblock atomic unit) — a semantics
  change to that slice's asserted one-leaf-per-step invariant; scheduled
  as its own slice BEFORE C5 (whose gate matrix includes the soak).
- **F5** — local-player first-entry ground contact: retail seeds contact
  from the first gravity frame's transition touch (`enter_world`
  0x00516170 carries no seed; local player and remotes share the
  mechanism via `HandleCreateObject` 0x00454C80). The shared
  `SpawnPlacementSettler` (moved App→Core) runs at `FinalizeActivation`
  exactly once; genuinely airborne spawns stay airborne; the outbound
  contact bit chain is asserted end-to-end. The legacy path's
  unconditional `Contact|OnWalkable|Active` force-seed (non-retail, no
  plane) still runs during candidate preparation and is OVERWRITTEN by
  the faithful settle (register AD-61). Fixes the user-observed
  standing-cast "You can't do that while in the air!" rejections.

## Review round R1 (dual Opus: initial FAIL 2+2 MAJOR → delta PASS both)

Retail MAJORs: the login constraint leash (deleted with the legacy
resolve path; re-armed at the committed placement in
`FinalizeActivation` — `HandleReceivedPosition` 0x00453FD0 arms on every
accepted position) and the post-residence rebucket scope (fixed to
exact-token active-residence). Adversarial MAJORs: content-less headless
(no drive → legacy registration) and the register rows. Nine minors
fixed (owner conversion API with active-residence throw, wire-landblock
guards, drive-pending ledger in `IsConverged`, route attach/detach
latch, celless conversion for far headless remotes, doc-comment truth,
per-incarnation cylinder cache, executor-drain drift model documented +
source-pinned); two tracked (#276, #277 in ISSUES).

## Final gates

Runtime 1,003; App 4,039/3 skips; Headless 79; complete solution
**10,816 / 0 failed / 4 skips** (Release, `-m:1`). Connected
lifecycle/reconnect gate **PASS** (`connected-world-gate-20260802-175401`;
graceful exits, world-visible, zero airborne-rejection strings; run
`-174811` failed on user-interference fingerprint —
`activeTeleportCount=1` at the stable checkpoint — and is attributed,
not counted). The soak stays red for the pre-existing F4 attribution.

## Process lessons (carried to memory)

1. **Report artifacts over marker logs** — three wrong classifications
   this campaign came from reading route/marker logs instead of
   `report.json` (the soak "clean route" was Passed=false with 37
   convergence failures).
2. **Log lifetime before absence claims** — a 26-second, 67-line log's
   silence about a defect proves nothing (the 122749 misread inverted a
   root-cause classification twice).
3. **User observation is the cheapest gate** — the standing-cast
   airborne rejections and the black-screen reveal were both
   user-spotted minutes before harness detection.
4. **The seal finds the bypasses** — sealing the controller setter
   surfaced a runtime-mutation bypass (F1) the compile-break audit could
   not see; expect the same class when sealing any long-lived escape
   hatch.