# C4 closeout handoff — every route landed; four connected gates owed (2026-08-05) Written at C4's implementation closeout. **Read this before touching anything.** > ## ⚠ BISECT HAZARD — commits `735f0a72..23aa62f2` > > Added 2026-08-05 at the C5b closeout. **A `git bisect` that lands anywhere > in that three-commit range will hit a live, unrelated headless defect.** > `735f0a72` (C5b) made the steady-state Position merge withhold the wire > cell and relied on a replacement writer that lives in `AcDream.App`; the > no-window host has no analogue, so across that range **every remote > entity's `FullCellId` is frozen at its placement value for the whole > session** in `AcDream.Headless`, and the local player loses one of > AP-146's three cell-refresh edges. Nothing throws; no test in the range > fails. A bot's `RuntimeEntitySnapshot.CellId` simply stops advancing and > `RuntimeSetPositionState.IsAffectedCollisionResident` parks bodies against > a landblock they have left. Fixed at `ff100cf3`. The range is exactly > `735f0a72`, `ed806997`, `23aa62f2`. > > If you are bisecting a headless cell/residency symptom, treat any `bad` > verdict inside that range as suspect and re-test with `ff100cf3`'s > `RuntimeLiveEntitySessionController.TryCommitAcceptedWireCell` cherry-picked > on top. Structural cause: issue **#324**. Residual duplication: **AD-64**. > Full write-up: `docs/research/2026-08-05-c5b-contract.md` §15.3. ## Where the branch is - Worktree `C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-visvesvaraya-e0a196` - Branch `claude/acdream-physics-divergence-5aa784`, HEAD **`e0f96a55`** - **`main` is at `c7d5fc14` and must stay there.** The commits on this branch are deliberately unmerged. Do not merge, rebase, or push unless the user asks. - Complete Release suite: **11,090 passed / 4 skipped / 0 failed** at `e0f96a55`. This is the measured baseline (up from 11,027 at `2eb39a02`, the previous handoff's figure). Any deviation is a regression you introduced. Measure, never inherit: ``` $env:ACDREAM_PAK_PATH = "$env:USERPROFILE\Documents\Asheron's Call\acdream.pak" dotnet test AcDream.slnx -c Release -m:1 ``` - Two known flakes — do **not** chase, and do **not** conflate (they have been conflated twice): **#302** `PortalProjectionTests.ClipToRegion_FrameOwnedStore_…`, a GC-allocation assertion in App.Tests; **#308** `NakEmissionTests.LossSoak_…`, a wall-clock deadline in Core.Net.Tests that fails only under full-suite load. A third look-alike (`WarmedSteadyContactRefreshDoesNotAllocate`) appeared once during route 7 and was proven NOT route 7's by reachability (zero `SetFullCell`/`ParentAttachments` references in the measured window) — it is the #302 class. ## What landed this session C4 is **implementation-complete**. Every route now places through the canonical Runtime owner; what remains for C4 is exclusively the four owed connected gates below, then C5. | commit | what | review record | |---|---|---| | `6dc7ba51` | **route 4b-3** — remote teleport + cell-less through canonical placement; deletes `RemoteTeleportController` (605), `RemoteTeleportPlacement` (85), ~1,709 test lines | dual round 1 FAIL/FAIL → round 2 delta PASS/PASS; three NPC-arm MAJORs closed (A1 zero-arm leash regression, R1 missing D2 shape, R3/A2 synthesized run-cycle velocity). Docs at `8c269ad1` | | `21cd6e9b` | 4b-3's connected gate recorded **PASSED (partial)** — 16 `[remote-teleport]` probe lines, 7 creatures, all `cause=teleport-ts`; `cause=cellless` never observed (gate 4 below) | — | | `1b484937` | **route 6** — drops/split-recovery **closure, zero production lines**; 7 sabotage-verified coverage tests over the C3c-flipped path; corrected the campaign plan's false effect-replay premise | contract-governed closure, no dual reviews (nothing to review — the stop condition was "any production diff means the finding is wrong") | | `daef7c98` / `b260bcd1` | **#314** — split recovery threw instead of recovering (retained Movement/ServerControlledMove timestamps). Found BY route 6's coverage tests, in the exact mechanism the scoping cited as evidence drops converge. Split into its own commit immediately (process rule 2) | — | | `a89bcb39` | **#316 filed** — player-arm LANDING TRANSITION block never publishes the collision shadow. Found by the OnPosition-collapse scoping; neither 4b-3 review round caught it | — | | `edc911b0` | the **OnPosition dual-tail collapse** — one shared player/NPC remote tail | — | | `aaf0811f` / `30d3d114` | **#315 closed** — cached remote-arm callbacks instead of a per-packet `Func` closure (+ closing-SHA correction) | — | | `36255af0` | **route 5** — projectile authoritative placement (#276 partial). Byte-decode hard gate first (`MoveOrTeleport` @0x00516330 never reads its velocity arg); conjunctive `ProjectileAuthoritative` predicate; AP-141 filed | three dual rounds, 8 MAJORs closed; round 3: retail PASS (C1 must-fix doc correction), architecture FAIL on coverage-only C1, closed in-commit with two sabotage-verified `Advance()` retry-arm tests | | `cff52c44` | stale `set_velocity` comment correction at the 4a velocity commit (spawned #317) | — | | `ca96ea5e` | research: retail parent-cell propagation settled + route 3 scoped | — | | `19ebf043` | route 3 contract pinned (the portal producer adapter) | — | | `cd3129e9` | **route 7** — child cell propagation moves from a render tick into Runtime; `ClassifyLeaveWorld` family deleted; headless parent-realize drive; iterative-worklist propagation (depth cap deleted); AP-142/AP-143 filed | dual round 1 FAIL/FAIL (R1–R11 / A1–A10) → round 2 delta PASS/PASS (N/B findings) → coordinator-required third pass (the depth-cap deletion both round-2 reviews independently demanded, N4/B3); 5 MAJORs total | | `e0f96a55` | **route 3** — portal placement authority (local player); the first `RuntimePortalPlacementAuthority` producer; both duplicate authorities deleted; AP-144/AP-145 filed, AD-42 deleted, #318 filed | dual round 1 FAIL/FAIL → dual round 2 FAIL/FAIL (near miss) → round-3 fix pass accepted per both round-2 reviews' explicit pass conditions (§G of each). **No standalone round-3 review doc exists** — the round-3 record is the commit message, #318, and AP-144/AP-145 | Suite trajectory across the session, all measured: 11,027 (`2eb39a02`) → 11,013 (`6dc7ba51`, net of the 1,709-line test deletion) → 11,020 (`1b484937`) → 11,036 (`30d3d114`) → 11,063 (`36255af0`) → 11,079 (`cd3129e9`) → **11,090 (`e0f96a55`)**. Zero failures at every checkpoint. ## The four owed connected gates — NONE has been run These are the whole of C4's remaining debt. Each pass criterion includes its probe evidence: **a clean-looking session with no probe lines is a not-run, never a pass** (process rule 5; the 4b-2 #309 precedent and the 4b-3 partial both exist because of this rule). ### Gate 1 — route 6: drops (user-run, visual) Recipe (route 6 contract, Gates section): 1. Drop a whole item on open ground — lands at your feet, resting, immediately pickable. 2. Split a partial stack to the ground — correct quantity on the pile, remainder in inventory. 3. Drop a second item within ~1 m — both remain visible and separately pickable. 4. Repeat once indoors and once after a portal recall. 5. Walk two landblocks away and back — both piles still there, still pickable. Pass criterion: all five visuals clean. Regressions to watch: item at world origin or your *previous* position (stale pose); invisible but blocking (#184 class); sunk into / floating above the floor; not pickable; the split pile never appears (recovery window failed — the #314 mechanism); the second drop swallowed by the first. No probe exists for this route (it is route-1 traffic); this is the one purely visual gate. ### Gate 2 — route 7: equip/carry across landblock boundaries (two-client) `ACDREAM_PROBE_CHILD_CELL=1`. Recipe (route 7 contract §7): 1. Equip/unequip cycle — weapon then shield, five times, observer watching: in the hand, at the hand, oriented with the hand, clean disappearance on unwield. 2. **Carry across ≥2 landblock boundaries and back**, both directions of observation, including one indoor/dungeon traversal (EnvCell-to-EnvCell crossings are the high-frequency case). 3. Pickup: drop the weapon, pick it back up — leaves the ground, no ghost, no invisible collider at the drop site. 4. Loot an equipped item from a kill (the delete edge under load). 5. Reconnect with equipment — re-attaches. 6. Portal recall while equipped — equipment present and following after arrival. **Pass criterion — CORRECTED 2026-08-05, the original was unfalsifiable.** The original read: *"the session counts ONLY if `[child-cell]` lines with `cause=propagate` appear during step 2."* **That criterion cannot fail in the presence of the bug it exists to catch.** #319 makes a player-parented child emit NO probe line at all, so the defect's signature is ABSENCE — which the old wording reads as "you didn't exercise it" rather than "it is broken." Two captured gate logs (`c4-gates.log`, `c5-gates.log`) contain #319 and neither flags it; the second was even run specifically to thicken this gate. A gate whose failure mode is indistinguishable from a not-run manufactures confidence. Replace it with a POSITIVE assertion: 1. **Assert the equipped child's `FullCellId` EQUALS the parent's** after a landblock crossing — read it, do not infer it from probe volume. A zero child cell is a FAILURE, not a silence. 2. Then, and only as a secondary check, expect `cause=propagate` counts in double digits across several crossings. 3. Run it with a **player** parent AND a **creature** parent. #319 exists precisely because every probe-firing parent in both captured logs was `0x7…`/`0x8…` (instance sequence 0) and the sole `0x5…` player parent was the sole failure. A gate that only ever sees sequence-0 parents is blind to the entire player class. Regressions: weapon drawn at the world origin or its last ground position; invisible while equipped; **left behind at a landblock boundary** (the D4 demotion's specific risk); invisible-but-solid at a former position (#184); child culled while the parent is visible or vice versa. The headless half's direct regression test (`DirectSink_D5_StandaloneParentEventCommitsChildToParentsExactCell`) is already in-tree and green; a headless probe session (`cause=headless-attach`/`propagate`) remains a nice-to-have per the contract. ### Gate 3 — route 3: portal/recall (user-run, two-client) Release build, `ACDREAM_RETAIL_UI=1`, `ACDREAM_PROBE_LOCAL_TELEPORT=1`, live ACE. One session exercising, in order (route 3 contract §9): 1. a physical outdoor portal (e.g. Holtburg portal); 2. a dungeon portal (indoor destination — the EnvCell readiness path); 3. `/ls` lifestone recall AND one spell recall (the F751 recall family); 4. an ACE admin teleport of the LOCAL player (`@teleto`/`@teleloc`); 5. a same-destination revisit (ACE may omit CreateObject on revisit); 6. autorun through a portal — arrival must be at REST (the `PlayerTeleported` port observable: autorun cancels on arrival); 7. graceful close. **Pass criterion: the session counts ONLY if `[local-tp]` lines actually appear** — one per arrival with `placement=Committed`, the portal generation/sequence, resolved destination cell, `leash=armed`, `autorun=cancelled`, and zero `Refused`/`Contention` lines in ordinary play. Plus: the accepted purple-materialization visuals with no opaque pop, camera reset behind the player, movement works immediately with W held, idle stance (no run-in-place), no rubber-band/tether; a second client observing sees a normal materialization and stance; the exact lifecycle/reconnect gate passes with every `transitOwnership` counter zero at stable checkpoints. The two refusal causes (`stale-reveal`, `host-token-unavailable`) now log through `LogLocalTeleportArrival` under the same probe flag — the round-2 review's blindness finding is fixed, so refusals cannot hide. **This gate is explicitly NOT scored as covering #318.** The connected session exercises the live path but asserts nothing about `PhysicsEngine.ShadowObjects`; #318's composition test is a separate, C5 deliverable. Do not fold them. Honest-gap rule carried from the contract: mid-transit supersession and mid-transit disconnect are hard to provoke against ACE — if the session does not produce them, record the stale-generation behaviour as test-verified-only, never inside a blanket "gate passed". ### Gate 4 — route 4b-3's `cause=cellless` case: still unexercised, and its recorded recipe is now INVALID The 4b-3 gate passed for `cause=teleport-ts` only (`21cd6e9b`). The recorded closure recipe — "unwield-to-3D is the cheapest reachable trigger" — **was invalidated by route 7** (route 7 contract §11; the supersession note is already appended to the 4b-3 contract): after D1/D2, a committed child's canonical cell is deterministically the parent's, so an unwield Position arrives with a NON-zero pre-merge cell and classifies by TELEPORT_TS/distance — which is retail's own predicate population (retail's `unset_parent` does no cell work either). The old recipe only ever worked because of the render-tick two-writer defect route 7 closed. **The replacement trigger is UNESTABLISHED.** What is needed: a Position on a body that is genuinely withdrawn/never-celled at merge time (between a `CommitWithdrawal`/`CommitAcceptedParentCellless` cell-less edge and its next accepted Position, or an initial Create that never resolved a cell). Whether ACE ever emits an UpdatePosition in that exact window is not established — this needs its own investigation before a live recipe can be written down. Until then the cell-less arm remains covered by the synthetic `PreMergeCommittedCellId == 0` fixtures only; do not re-label those as live behaviour, and do not score any teleport-ts session against this gate. ## Open issues created or touched this session | # | status | one line | |---|---|---| | #313 | OPEN | retail `DeclareValid`'s `SetSelectedObject` split-recovery selection transfer not ported; selection UX, deliberately kept out of the placement closure | | #314 | **CLOSED** (`daef7c98`) | split recovery threw on nonzero retained Movement/ServerControlledMove timestamps — found by route 6's coverage tests in the exact mechanism cited as evidence of convergence | | #315 | **CLOSED** (`aaf0811f`; SHA corrected `30d3d114`) | per-packet `runTeleportHook` closures replaced by cached remote-arm callbacks | | #316 | OPEN | player-arm LANDING TRANSITION block never publishes the collision shadow. **Measure before fixing** — either a ~33 ms cosmetic lag or a real #184 instance; the issue names the measurement | | #317 | OPEN | `TryCommitAuthoritativeVelocity`'s call site has no established retail basis (route 5's byte-decode disproved the comment it carried); needs a full accepted-Position velocity-chain audit | | #318 | OPEN → C5 | route 3 §8 items 8/9/10 residual: no end-to-end composition test, no shadow assertion, no T8 ordering proof (below) | | #309 | OPEN, re-scoped | largely superseded by #312 (closed `b1f914d5` last session); the surviving narrow half is retail's `GotoLostCell` hidden-until-`reenter_visibility` behaviour | Register rows this session: **AP-141** (route 5 projectile shapes; narrowed round 2, risk column corrected round 3 — the "drag toward a stale anchor" claim retracted by its own author), **AP-142** (parented-child single-field cell model; amended twice; clause (e)'s depth cap RETIRED outright — replaced by the iterative worklist), **AP-143** (headless parent-realize skips all three graphical attach validations; inertness argued per check), **AP-144** (portal movement-event send gates on `UsePositionFromServer` (`autonomy_level != 2`) where retail's `SendMovementEvent` gate is `!= 0`; diverges only at unreachable level 1), **AP-145** (the collision-shadow cache-without-publish asymmetry, carried as #318). AD-42 deleted (route 3 ported its last citation); AD-2 amended. ## What C5 inherits 1. **The #318 composition test** — drive a real portal arrival through the canonical drive controller and the REAL `RuntimePlacementPresentationSink` against a REAL `PhysicsEngine`, then assert **`PhysicsEngine.ShadowObjects` holds a row at the destination cell/position — not just `LocalPlayerShadowState`'s internal dedup cache** — plus the T8 write ordering. That discriminating assertion exists because of **AP-145's asymmetry**: `TryPublishPlace` calls `LocalPlayerShadowState.Set` directly, a plain cache write that bypasses `LocalPlayerShadowSynchronizer.SyncPose`'s `ShadowObjects` publish AND pre-seeds `SyncPose`'s dedup check with the destination pose — so the next movement tick can skip its own publish too. A test that asserts only the cache is satisfied by the bug. 2. **The legacy-deletion sweep + closeout gates** (the C5 slice as planned): parity tests, final-binary suite/soak/lifecycle routes, two-client observation, user visual matrix; retire AP-1, AD-1, AP-131, AD-60's legacy half; close #275. Named sweep candidates recorded by route 3: `ILocalPlayerTeleportPlacement` (now a thin acknowledge seam) and the test-only `BeginAcceptedPlacement`/`BeginAuthoredPlacement` wrappers. 3. **#280** (portal destination prefetch) — campaign plan item 3, its own slice with its own visual gate; deliberately NOT bundled with route 3. 4. **#276 remainder** — route 5 closed only its projectile half; the `SpawnPlacementSettler` settle-cell discard stays open. **#277** was not folded (no radius changed); its service-window conversion remains trigger-conditioned on any streaming/broadcast radius change. 5. **#316's measurement**, **#317's velocity-chain audit**, **#313** (selection UX, outside placement), **#309's re-scoped narrow half**. 6. **The cell-less live-trigger investigation** (gate 4 above). 7. **The TEMPORARY probe family strip** once physics settles: `ACDREAM_PROBE_REMOTE_LANDING`, `ACDREAM_PROBE_REMOTE_SLIDE`, `ACDREAM_PROBE_PARK`, `ACDREAM_PROBE_REMOTE_TELEPORT`, `ACDREAM_PROBE_CHILD_CELL`, `ACDREAM_PROBE_LOCAL_TELEPORT` — strip as a family, but NOT before the four owed gates have consumed them. ## Process findings — stated as rules for the next session These are distilled from what actually went wrong (and right) this campaign. Each carries its citation so you can check it instead of trusting it. **(a) The contract causes the defect.** Three separate defects came from a contract asserting a mechanism that did not exist. Route 4b-2 round 1: the contract said "arm `ConstrainTo` on refusal" without "and still advance the pose" — a frozen remote. Route 7 R1: the contract enumerated `enter_cell`'s five writes but silently dropped the `part_array` guard AROUND them — a guard the propagation research itself had called "load-bearing"; the commit message names it "a right finding that evaporated across two handoffs with nobody re-reading the source". Route 3 round 1 (the worst): the contract assumed `TeleportAnimEvent.Place` re-fires on later Ticks after a refusal; it does not, so a refused Place released the player at the pre-teleport position while the anim stream marched on. **Rule: before building on a load-bearing premise, verify it in code at implementation start — a contract's "the mechanism will retry" is a claim, not a fact, until you have read the retry.** **(b) Inferring a fact you can observe is how a fix becomes silent.** Route 3 round 2 "fixed" round 1 by inferring "the placement committed" from a global `PendingCount == 0` — which three non-committing paths also produce (including the drive's own documented modal outcome). The SAME bug then completed cleanly and passed its invariant: strictly worse than round 1, which at least tripped the portal-complete-before-materialized invariant. Round 3 latches the commit where it actually happens (`ReconcileAndAcknowledgePortal` → `TryConsumePortalCommit`, keyed on reveal generation + teleport sequence), sabotage-verified on both hosts. **Rule: never infer from an aggregate what the system can tell you directly. If the observable exists, read it; if it does not, build it — an inference that happens to correlate today is a defect with a delay timer.** (Commit `e0f96a55`; arch round-2 B1.) **(c) Planning documents go stale across cutovers.** Five (at least) were wrong against HEAD this session: the campaign plan (route 6's effect-replay premise `:98-100`, unsubstantiated — corrected at `1b484937`; the route-3 "adapter does not exist" line — only the producer was missing, corrected at `e0f96a55`'s docs); the 2026-08-02 cutover route inventory (wrong in eight enumerated ways — route 3 scoping §3); the routes-6-7 scoping (five substantively false or superseded claims — route 7 contract §10); the 2026-07-16 portal-completion pseudocode (portal arrival attributed to `enter_world`, which is the login path — corrected in `e0f96a55`); and the 2026-08-04 session handoff (#280 bundling overridden with cause; its cell-less recipe later invalidated by route 7). Related: the 2026-08-03 handoff's "six fixture failures" was a mis-measurement — the baseline found 43 (#281). **Rule: re-verify every inherited claim by symbol, never by line number; measure every count, never inherit one; and when you correct a document, date the correction in place rather than deleting the history.** **(d) A skipped test is a permanent false signal.** Route 3's fix pass refused to accept 7 skipped tests and drove the count to zero — and that refusal uncovered a production bug that made an entire code path dead: `TryExecuteCanonicalPortalPlacement` re-read the accepted destination at Place time, but `TryBeginPortalReveal` had already consumed that slot at Aim time, so the canonical portal arm was 100% dead code and every real Place would have refused with `host-token-unavailable`. The skips were the only symptom. **Rule: a skip is an assertion nobody is making. Do not park a test as skipped to protect a green count — the thing it cannot assert is exactly where the defect is.** (Commit `e0f96a55`.) **(e) Sabotage-verify — and beware a test that reads a production constant it also perturbs.** Every new discriminating test this session was sabotage-verified (break the behaviour, watch the test fail, restore). Two findings sharpen the practice. First: route 7 shipped a test that survived deleting the entire behaviour it claimed to pin, because its assertion read a field (`WorldEntity.ParentCellId`) written unconditionally one line before the demoted call — the sabotage must be run in BOTH directions (canonical half and presentation half separately; route 7 contract §6 test 10). Second: the route-7 depth test both READ `MaxPropagationDepth` and SIZED its chain by it — so a perturbation of the constant built a 64,000-node chain and stack-overflowed the test host (arch round-2 B7, which then swept `tests/` for the same shape and found one more with real blast radius: `LandblockLoaderTests.cs:210`). **Rule: sabotage both halves of every dual-layer assertion, and never derive a test's workload from the constant under test — pin the constant with a literal first, then use literals.** **(f) Reviewers retract; that is the process working.** Three self-retractions this campaign, two of which prevented shipping a wrong register row or a relocated defect: (1) route 5 round 1's R6 finding was retracted the following round as factually wrong — and complying with it had produced the campaign's one recorded fix-round defect, the `ParentCellId` regression; the round-3 fix is the REVERT to `record.FullCellId`, not the relocation R6 demanded. (2) Route 5 round 3's §C1: the retail reviewer retracted their OWN round-2 claim that a stale leash "would drag the body toward a stale anchor" ("I wrote the mistake it was copied from") — the port's `ConstraintManager` brakes, never pulls — preventing a wrong AP-141 risk column from landing in the register. (3) Route 3's retail round-1 §3.4 premise (that `TryApplyRuntimePlacementPlace` writes no pose) was verified WRONG by round 3 — it does write pose/rotation/`ParentCellId` and rebucket — dissolving the original blocking concern into #318's narrower coverage gap instead of a relocated "fix". **Rule (recorded in route 5's own commit): review findings are evidence to re-verify against the code, not commands to obey unconditionally — and a reviewer who retracts with cause is strengthening the record, not losing face.** **(g) Gates must be able to see the defect they gate.** Three gates were unpassable or blind as originally specified and were corrected BEFORE being run: (1) 4b-3's recipe named "a second character" as the teleport target — but a player-guid target cannot reach the NPC arm at all (`RemoteServerControlledVelocityCycle.Apply` early-returns for `0x50xxxxxx` guids), and all three of the fix round's MAJORs lived on the NPC branch, so a player-target run would have reported a clean pass over all three; corrected to creature-target (`@teleto` a drudge), and the passed gate's 16 probe lines prove the NPC branch ran. (2) Route 3's two refusal causes logged under `ACDREAM_PROBE_TELEPORT` — a DIFFERENT flag from the gate's pinned `ACDREAM_PROBE_LOCAL_TELEPORT` environment — so a refusing session would have looked identical to a committing one; rerouted through `LogLocalTeleportArrival` before the gate (retail round-2 finding). (3) 4b-3's cell-less closure recipe was invalidated by route 7 and is recorded as UNESTABLISHED (gate 4) instead of being left on file as a recipe that can no longer fire. Related in kind: route 5 has NO live gate by design (ACE never sends a missile UpdatePosition — `WorldObject_Tick.cs:333-334`) and says so, rather than inventing one. **Rule: before running any gate, walk the chain from the defect to the evidence channel and confirm each link actually fires under the gate's exact environment — and when a gate cannot exist, record that, never a substitute that measures something else.** ## Connected-test recipes that worked (carried forward) - **Far snap:** stand still; second character runs past ~100 m, stops, turns, runs back. Three or four times. - **Steep slide:** second character jumps onto a sloped roof. - **Park:** move to a landblock not visited this session, have the remote arrive while it is still streaming, have them take a step, then stand still. - **Remote teleport (4b-3):** `@teleto`/`@teleloc` a CREATURE into view — never a player character (see rule (g)). - Graceful close matters — a hard kill leaves ACE holding the session ~3 minutes. --- ## Connected gate RESULTS — 2026-08-05 (user-run, user-accepted) Run against the exact `e0f96a55` Release binary with the retail UI (`ACDREAM_RETAIL_UI=1`), `ACDREAM_PROBE_CHILD_CELL=1` and `ACDREAM_PROBE_LOCAL_TELEPORT=1`, live ACE at `127.0.0.1:9000`. Log: `c4-gates.log` (731 lines). **User verdict: "works great."** Three of the four owed gates were exercised in one session. Probe evidence, because a clean-looking session is not a pass: **Route 3 (portal) — PASS, unambiguous.** Three `[local-tp]` lines, every one `status=Committed hookTail=ran leash=armed`, across three distinct destinations (`0x00070143`, `0xA9B40019`, `0x1134001F`). `leash=armed` is the load-bearing observation: before the round-2 R3 fix the field read `IsFullyConstrained()` and was structurally incapable of printing anything but `unarmed`, so this line proves both the arm AND the corrected probe. **Route 7 (child cell) — PASS, but THIN.** 17 `[child-cell]` lines: 13 `cause=attach`, 3 `cause=delete`, **1 `cause=propagate`**. The stated pass criterion (at least one `cause=propagate`) was met, so the gate was recorded as passing — but see #319: that criterion was UNFALSIFIABLE and this very log contains an undetected defect. Corrected above. The remaining note stands: propagation across a parent cell crossing is the slice's entire purpose, and one sample proves the path executes rather than that it is robust across repeated crossings. A future session should run several equipped landblock crossings and expect `propagate` counts in double digits. **Route 6 (drops) — PASS on visual only.** Route 6 has no probe (zero production lines by design), so this gate rests entirely on the user's visual confirmation. That is inherent to the route, not a gap in the run. **Gate 4 (4b-3 `cause=cellless`) — STILL NOT RUN**, as expected: its recorded trigger was invalidated by route 7 and the replacement is UNESTABLISHED. ### Not exercised — recorded, not glossed - **Route 3's autorun cancel — CLOSED 2026-08-05, same session.** An earlier revision of this section recorded it as live-unverified, because the first three portals reported `autorun=unchanged`. That was true of those three and wrong as a conclusion. The user then portalled WITH autorun engaged and the fourth line reads `gen=5 seq=4 dest=0x00070145 resolved=0x00070145 hookTail=ran leash=armed autorun=cancelled`. That verifies the `PlayerTeleported` @0x006B32B0 `SetAutoRun(0,1)` + `SendMovementEvent` port in live play, and it was a REAL gap before this slice: nothing cancelled the J5.4 autorun latch on arrival, so auto-running into a portal left you running on the far side where retail stops you. All four load-bearing fields on that line read correctly — `Committed`, `hookTail=ran` (inversion B: the local hook runs AFTER placement, opposite to 4b-3's remote arm), `leash=armed` (inversion A: armed here, opposite to route 2's ForcePosition rule), and `autorun=cancelled`. - **AP-144's autonomy divergence remains unreachable** (`TrySetAutonomyLevel` has zero production callers), so nothing in this session could have exercised it either way. - Per both round-2 reviewers' condition, **this session is explicitly NOT scored as covering #318** (the end-to-end presentation composition test). --- ## Gate 4 (`cause=cellless`) — RESOLVED 2026-08-05: it was never a coverage gap The handoff previously carried gate 4 as "the cell-less half is unexercised, and route 7 invalidated its recorded trigger, so the replacement is UNESTABLISHED." **That framing was wrong, and the evidence to settle it was already in the captured logs.** `c5-gates.log` shows the user's pickup-then-drop test reaching the teleport arm five times, for the exact item guids in the `[B.5] pickup` lines (`0x800013B7`, `0x8000A6C6`), every one `hookRan=True placement=Committed` — but all labelled `cause=teleport-ts`. The classifier predicate is a SHORT-CIRCUIT OR (`RuntimeAuthoritativePositionRouteClassifier.cs:391`): ``` if (request.Authority.TeleportAdvanced || cellless) ``` `TryApplyPickup` zeroes the item's cell, so at the drop's classification `cellless` is genuinely TRUE — but ACE also advances TELEPORT_TS on the drop, so the FIRST operand matches and the probe reports `teleport-ts`. The cell-less condition occurs, classifies correctly, and commits correctly; only the probe's cause LABEL is shadowed by operand order. **Consequence: the cell-less path has been exercised in both gate sessions all along.** Gate 4 is closed, not owed. What was actually missing was never coverage — it was a probe whose label can be pre-empted by a co-occurring condition. **The general rule, worth more than the finding:** a probe that reports WHICH BRANCH MATCHED inside a short-circuit expression cannot distinguish "this condition did not occur" from "this condition occurred but another matched first." If a cause label is load-bearing for a gate, it must be computed from the conditions independently, not from the branch that won. Same family as #319's unfalsifiable criterion filed the same day: both are gates that cannot report the state they exist to report. To label it honestly, the probe would evaluate and emit both operands (e.g. `cause=teleport-ts+cellless`). Cheap, and it retires this whole question — but it is a probe change, so it belongs with the probe-family work in C5c, not as an urgent fix.