# C5b — classify-before-merge on every steady-state Position (#275): pinned contract (2026-08-05) Written at HEAD `02578441` (branch `claude/acdream-physics-divergence-5aa784`; C5a landed at `6921a027`, #319 at `392c1e22`, AP-145/#318 at `f8e55ba5`). Every symbol below was re-verified **by symbol at this HEAD**, not inherited; §12 lists what the C5 scoping (`2026-08-05-c5-scoping.md`, written at `52175aa1`) got wrong. Inputs: the scoping's C5b section, register rows AP-131 / AD-60 / AP-130 / AP-135 / AP-146, the 4b-3 contract (`2026-08-04-c4-route-4b-3-contract.md` — D1 is C5b's direct ancestor), the C4 closeout handoff's seven process findings, the C5a contract (`2026-08-05-c5a-contract.md`), and issue #275. **One-paragraph verdict:** C5b is smaller than the scoping feared, because of a fact the scoping did not state: the merge's two flags (`installPlacementFrame` / `clearParent`) are a pure function of the **timestamp disposition** and the **hasAnimations proxy** — both available inside the merge itself, pre-merge, with no routing outcome and no `playerDistance`. Retail runs `unset_parent` and the `SetPlacementFrame` gate BEFORE `MoveOrTeleport` is consulted, so the flags are upstream of classification proper. C5b therefore needs **no route plumbing, no signature changes, no App→Runtime threading** — it replaces two `true` literals with a four-row truth table the classifier already encodes, and flips one `refreshPosition:` argument to `false`. The blast radius is correspondingly narrower than "45+ sites mis-reading a withheld wire cell", for a second reason the scoping missed entirely: **the merge stamp is one of THREE steady-state wire-cell writers, and the other two stay** (§5, W2/W3). What genuinely changes is the classification window, the refused-ForcePosition shape, and the (test-only) missile arm. The contract pins all of this. --- ## 1. Retail ground truth — Gate A and the pre-placement sequence, verified in `acclient_2013_pseudo_c.txt` `SmartBox::HandleReceivedPosition` @0x00453FD0 (pseudo-C lines 92896–93051). The exact order, with addresses: ``` 00453fe3 objcell_id = arg3->objcell_id // wire cell read into a LOCAL 00453ff4 Frame::operator=(&var_40, &arg3->frame) // wire frame copied into local Position var_48 0045400c GATE A: if (arg2 == player && newer_event(player, FORCE_POSITION_TS, arg9)): 0045402b-54 wrapped-compare update_times[4] (TELEPORT_TS) vs arg8 — the wire teleport stamp must NOT be OLDER (equal or newer both pass). CORRECTED 2026-08-05, see §15 — this line read "must NOT be newer" and it was backwards. 00454056-68 get_heading / Frame::set_heading(&var_40) // preserve body heading 00454074 SmartBox::BlipPlayer(this, &var_48) 00454079 player->update_times[0] = arg7 // stamp POSITION_TS 00454091 cmdinterp->SendPositionEvent() 0045409d return // BEFORE unset_parent / SetPlacementFrame 004540b7 if (!newer_event(arg2, POSITION_TS, arg7)) → return (the 004540e6 teleport-regression quirk stamps update_times[0] and returns @004540f6) 004540f9-11e if (parented && parent->id != player_id): weenie->SetParentedState(0) notification 00454129 CPhysicsObj::unset_parent(arg2) // UNCONDITIONAL on this path 00454137 if (CPhysicsObj::HasAnims(arg2) == 0): 00454142 CPhysicsObj::SetPlacementFrame(arg2, arg4, 1) 0045414d if (arg2 != player): // REMOTE branch 00454254 if (MoveOrTeleport(arg2, &var_48, arg8, arg5, arg6) != 0): 00454272 ConstrainTo(arg2, &arg2->m_position, …) // post-placement anchor 0045415f else if TELEPORT_TS newer: TeleportPlayer @00454168, ConstrainTo @0045418a anchored at the WIRE &var_48, set_velocity(0) @004541b4 else: ConstrainTo @004541ec; if UsePositionFromServer && arg5: InterpolateTo @0045422c ``` Five facts decide C5b: 1. **The wire cell is never written to the object.** `arg3->objcell_id` is read into a local @0x00453FE3 and flows only into the local `var_48` Position handed to `BlipPlayer` / `TeleportPlayer` / `MoveOrTeleport` / `ConstrainTo`. Nowhere in this function is the object's cell assigned. The object's `cell` changes only inside the placement family (`SetPositionInternal` @0x00515BD0 → `set_cell`; `enter_world` @0x00516310/0x00516170) or per-frame movement transit. This is the retail rule AD-60's executor half already encodes ("a wire position never directly makes the record resident"). 2. **Gate A (@0x0045400C) is decided on data that exists before any merge:** the entity is the player, FORCE_POSITION_TS advanced, and the wire TELEPORT_TS is **not older** than the stored one. It returns @0x0045409D **before `unset_parent` @0x00454129 and before the `SetPlacementFrame` gate @0x00454137** — a ForcePosition never unparents and never installs a placement frame. acdream's analog exists upstream: `PhysicsTimestampGate.TryAcceptPositionEvent:190-203` produces the `ForcePosition` disposition when `isLocalPlayer && IsNewer(FORCE_POSITION_TS) && teleport == _timestamps[Teleport]`. **CORRECTED 2026-08-05 (see §15): that third term is retail's Gate A pair NARROWED, not matched.** Retail's test is `teleport` equal-or-newer; acdream's is equal only. The narrowing is filed at **AP-148 / issue #325**. Everything C5b decides from Gate A is unaffected — the disposition C5b reads is the same one it always was, and the narrowing makes the `ForcePosition` set strictly SMALLER, so no packet C5b's truth table classifies as force would have been classified otherwise. **A remote entity can never receive the `ForcePosition` disposition** (`isLocalPlayer` guard at `:190`), so the flag truth table below needs no entity-kind term. 3. **The two pre-placement writes are gated on exactly two facts.** `unset_parent` @0x00454129 runs for every accepted non-Gate-A Position (including packets `MoveOrTeleport` will return 0 for — retail unparents BEFORE learning the routing outcome). `SetPlacementFrame` @0x00454142 is gated on `HasAnims(arg2) == 0` alone. **Neither gate reads the near/far/teleport classification** — which is why acdream's merge flags are a function of (disposition, hasAnimations) and nothing else. 4. **`MoveOrTeleport` @0x00516330 reads the BODY's own state at entry:** TELEPORT_TS @0x00516375 and `this_1->cell == 0` @0x00516386 — the committed cell, read before any placement — then contact `arg4` @0x0051638E. Route 4b-3's D1 fed the classifier the PRE-merge committed cell for exactly this reason; C5b's withhold (D2) makes that pre-merge value structurally equal to the record's `FullCellId` in the classification window (§4, "strengthened invariant"). 5. **`store_position` @0x00515CE2 is `SetPositionInternal`'s no-transition branch** (placement ran, no walkable transition → `GotoLostCell` @0x00515CF2), not a `MoveOrTeleport` path. A retail placement that fails leaves the wire pose in `m_position` and the object HIDDEN in the lost cell — acdream's surviving wire-cell-on-non-commit behaviour (W2, §5) is the visible variant of this, already filed across AP-136/AP-138/#309. C5b does not re-litigate it. ## 2. The two scoping-identified sites, re-verified at HEAD `02578441` ### S1 — the steady-state merge's unconditional flags `InboundPhysicsStateController.TryApplyPosition` (`src/AcDream.Runtime/Entities/InboundPhysicsStateController.cs:610`), hardcoding `installPlacementFrame: true, clearParent: true` at **`:662-663`** (scoping exact). Production chain at HEAD, every hop verified: `LiveEntityNetworkUpdateController.OnPosition:1948` → `LiveEntityInboundAuthorityGate.TryAcceptPosition:161` (`src/AcDream.App/Physics/` — the scoping gave no directory) → `LiveEntityRuntime.TryApplyPosition:2550` → `RuntimeEntityObjectLifetime.TryApplyPosition:1789` (scoping said `:1781`) → `RuntimeEntityDirectory.TryApplyPosition:654` → the S1 overload. The route-flag-threaded sibling (`ApplyAcceptedPositionSnapshot:673`, flags at `:681-682`) already exists and is what the continuation executor uses (`RuntimeInitialCreateContinuationExecutor.cs:1983-1993`, classified flags at `:1991-1992`, withhold at `:1996`) — scoping §1b verified exact. **What changes semantically (not "what gets deleted"):** the merged snapshot's `Physics.AnimationFrame` / `PlacementId` and its `ParentGuid` / `ParentLocation` / `Physics.Parent` stop being unconditionally wire-installed / wire-cleared and start obeying retail's two gates: | disposition | installPlacementFrame | clearParent | classifier row (cite, don't restate) | |---|---|---|---| | `Rejected` | unread (timestamp-only path `:793-794`) | unread | — | | `ForcePosition` (local player only, teleport-equal) | **false** | **false** | `RuntimeAuthoritativePositionRouteClassifier.cs:311-333` (Gate A) | | `Apply` | **`!hasAnimations`** | **true** (unchanged) | classifier `:336-465` — every accepted non-force route carries `UnparentBeforeRouting: true, ApplyPlacementFrameBeforeRouting: !request.HasAnimations` | `hasAnimations` is the AP-130 static proxy, computed from the PRE-merge snapshot `old` with the identical expression `RuntimeAcceptedPositionRouteRequests.cs:99-101` uses (`old.MotionTableId ?? old.Physics?.MotionTableId) is { } id && id != 0u`). `WorldSession.EntitySpawn.MotionTableId` exists (`WorldSession.cs:103`); the inbound controller's `_snapshots[guid]` and `canonical.Snapshot` are the same data pre-merge, so the two computations cannot diverge. Two observability notes that decide the test plan (§8): - The `ForcePosition` placement-frame half is **inert**: for `disposition is not Apply`, `appliedPlacement` keeps `old.PlacementId` under either flag value (`:815-819`). Gate A's force half discriminates ONLY through parent retention (`:855-857`). - The `Apply` placement-frame half is live exactly when `hasAnimations == true`: today the wire frame (`update.PlacementId ?? 0u`) is stamped onto an animated entity's snapshot where retail's `HasAnims` gate skips `SetPlacementFrame`. That is AP-131's animation snap/reset half. ### S2 — the wire-acceptance-derived `FullCellId` stamp `RuntimeEntityObjectLifetime.cs:1923-1926` — `Entities.RefreshSnapshot(canonical, snapshot, refreshPosition: acceptedPosition)` (argument at `:1926`, matching the C5a contract's corrected citation; the register's `:1338` and the scoping's `:1918` are both stale — cite by symbol). `refreshPosition: true` routes through `RuntimeEntityRecord.RefreshDerivedState:230-237` → `SetFullCell(position.LandblockId, …)` — the wire cell, stamped on bare acceptance, plus `PropagateFullCellToChildren` (`RuntimeEntityDirectory.cs:240-246`) when it changes. **What changes semantically:** `refreshPosition: false`. The merge stops being a residency writer. In the window between the merge and the OnPosition prologue rebucket, `canonical.FullCellId` IS the pre-merge committed cell — which is exactly what 4b-3's D1 threads out-of-band today (`timestamps.PreMergeCommittedCellId`, `:1904-1907`). Post-D2, 4b-3's convention becomes a structural property of the record. **The executor's analogue is unchanged and untouched** (`refreshPosition: false` at executor `:1996` — its CANONICAL CELL SEMANTICS comment at `:1966-1976` is the model for S2's new comment). ## 3. Design decisions — pinned, not open for redesign ### D1 — the merge flags become the classifier's truth table, computed pre-merge inside the merge In S1's `TryApplyPosition`, replace the two literals at `:662-663` with the table in §2-S1, computed from `disposition` and `hasAnimations(old)`. No signature changes; no new parameters; no route construction in the merge; `playerDistance` is never needed (the full route's near/far decision is downstream of retail's unset_parent/SetPlacementFrame order and stays post-merge in `ClassifyRemoteAcceptedPosition`). The post-merge classification (`LiveEntityNetworkUpdateController.cs:2167-2175` → `RuntimeEntityObjectLifetime.ClassifyRemoteAcceptedPosition` → `RuntimeAcceptedPositionRouteRequests.Build`) is **untouched**: it computes the full route from the same retained inputs, so its `ApplyPlacementFrameBeforeRouting` / `UnparentBeforeRouting` fields equal the merge's flags by construction. The consistency is pinned by test (§8 test 4), not by a shared code path — the two computations are small, pure, and separately sabotage-verifiable. Doc comments that must be made true in the same commit (process rule (c)): the `:595-608` "Round 4 R4-15 … no HasContact or route-classification concept" remarks; the `:657-661` "Legacy immediate-apply reproduces EXACT prior behavior" comment; `ApplyAcceptedPosition`'s `:772-781` two-caller doc; the `:809-814` PositionPack comment's "retail skips it entirely while HasAnimations is true" (already true — now load-bearing for BOTH callers). ### D2 — the steady-state merge withholds the wire cell (`refreshPosition: false`) One argument flip at S2 plus the comment rewrite. The 4b-3 D1 comment at `:1894-1907` is extended, not deleted: it currently explains why the classifier needs the threaded pre-merge value; it must add that after this change the post-merge record CARRIES that same value through the classification window, making the threading a belt-and-suspenders duplicate that stays (the threaded value remains the classifier's input of record — process finding (b), read the observable once). **Two publish-side effects, both pinned (trap T3):** 1. The merge's publish-kind ternary (`:1948`, `beforeCell != canonical.FullCellId ? Rebucketed : Updated`) becomes always-`Updated` — the merge can no longer change the cell. The `Rebucketed` edge for a wire-cell-changing packet moves to the prologue rebucket's `CommitRebucket` (`RuntimeEntityObjectLifetime.cs:1956-1987`), which TODAY early-outs publish-less (`previous == fullCellId` at `:1973` — because the merge already stamped it) and after D2 publishes. **Net observable: exactly one `Rebucketed` delta per cell-changing accepted Position — same kind, same value, same publisher, later point in the same call.** A test pins this at the observable (one delta, not zero, not two); it does not pin the source site. 2. `PropagateFullCellToChildren` for a parent whose accepted Position changes its cell moves from the merge's directory wrapper (`RuntimeEntityDirectory.cs:240-246`) to `CommitRebucket`'s public `SetFullCell` (`:355`). Same packet, same value, same single propagation. This is the #319 child-equality channel — a directory-level test pins exactly one propagation per parent cell change on the steady-state path, for BOTH parent classes (player `0x5…` and creature `0x8…`; process rule from #319 — a test population that only ever sees sequence-0 parents is blind to the player class). ### D3 — the other two wire-cell writers STAY, and the register says so The scoping's premise — withholding S2 "moves residency changes onto placement/simulation commits only" — is **false at HEAD** (§12 item 1). Two more steady-state wire-cell writers exist downstream of the merge in `OnPosition`, and C5b keeps both: - **W2 — the prologue rebucket** (`LiveEntityNetworkUpdateController.cs:2329` `RebucketLiveEntity(update.Guid, p.LandblockId)` → `LiveEntityRuntime.cs:935-945` → `CommitRebucket` → `SetFullCell(wire cell)`). Runs for EVERY classification reaching the generic tail — near, far, teleport, cell-less, unrouted, and every ordinary local-player Apply echo. Its other jobs (draw-bucket move, bucket-promotion recovery, `prepare_to_enter_world` clock edges) are not cell writes and are not in scope. **Do NOT gate W2 by classification (trap T5):** for the local player W2's echo-driven commit is the mechanism that advances the canonical cell across landblocks during ordinary movement (AP-146/#320 machinery — the per-tick projection deliberately passes a landblock id and preserves the cell, `LiveEntityRuntime.cs:935-938`); gating it silently freezes the player's cell between teleports and #319's child equality inherits the freeze. - **W3 — the post-routing wire-cell adopt** (`TryAdoptWireCellAfterRouting`, `LiveEntityNetworkUpdateController.cs:1613-1624`): `RemoteMotion.CellId = wire` for every non-placing arm, writing through to `FullCellId` via `CommitCanonicalCell`. Already filed as retained bookkeeping under **AP-135**; the placing arms (far/teleport) are suppressed there because the placement receipt is the cell authority. W2/W3's population note: packets that RETURN before `:2329` never see W2 — the force-local path (Committed/Deferred `:2055`, Rejected/Contention `:2066`) and the missile arm (`:2256`). For those, post-D2 residency is placement-receipt-authoritative (or, on a refused/contended force, unchanged at the last commit — retail's shape, since retail's `BlipPlayer`-era body keeps its last placed cell; AD-62 already files the non-commit force outcomes). This is D2's genuinely new steady-state surface and it is **retail-correcting**, asserted by §8 test 6. ### D4 — register bookkeeping, in the implementation commit - **AP-131 RETIRES** (§7 evidence). Its "legacy caller is deleted at the production cutover" framing is overtaken: the caller is not deleted, it is **corrected** — the unconditional literals are replaced by the classified computation. The retirement commit rewrites the row's text to past tense with the evidence, per register rule 1 (a deviation found without a row is a bug twice over; a retired divergence needs its retirement recorded, which the C5a/AP-1 and 4b-3/AP-137 rewrites established as the house style). - **AD-60 — legacy half RETIRES, row REWRITTEN, not deleted** (4b-3's D8 precedent: silent whole-row deletion would hide surviving wire-cell channels). The rewrite keeps the executor half as the standing rule, records the legacy half's retirement with §7's evidence, and **names the surviving wire-cell channels**: W2 (prologue rebucket commit — cross-cited into AP-146 for the local player) and W3 (already AP-135). The row's surviving claim is therefore precise: "a wire Position never makes a record resident *inside the merge or ahead of classification*; the post-routing controller still adopts the wire cell for non-placement outcomes as the bounded-residency bridge, filed at AP-135/W2." - **AP-130 amendment (bookkeeping, not retirement):** its Site column names only the executor's `hasAnimations` local; the merge now consumes the same static proxy. One sentence added. The proxy itself MUST NOT be "improved" to a live animation-queue read in this slice (trap T7). - **AP-146 / #320 amendment (bookkeeping):** #320's edge list cites "an accepted inbound Position/ForcePosition (`RuntimeEntityDirectory.RefreshSnapshot` → `RuntimeEntityRecord.cs:234`)" as a local-player cell writer. After D2 that writer is the generic-tail rebucket's `CommitRebucket` (and, for ForcePosition, the placement receipt). Amend both in the same commit or the next reader files a phantom regression. - **AP-135 stays, its writes stay** (must-remain-true item 3). - **AP-1, AD-1, AP-141–AP-145, AD-61, AD-62: pinned untouchable.** ## 4. What must REMAIN true (process rule — the contract causes the defect) For every path this slice touches, including every refusal and rejection: 1. **Classification reads pre-merge inputs only.** 4b-3's D1 binds in full: `PreMergeCommittedCellId` is threaded exactly as today (`RuntimeEntityObjectLifetime.cs:1904-1907`), measured by the SAME `TryApplyPosition` call, never re-read after the merge. D2 adds the structural property (the record equals it in the window) but the threaded value stays the classifier's input of record. 2. **The D4 constraint-arm partition (4b-3) does not move.** One post-operation `ConstrainTo` site, its partition table unchanged. C5b touches no arming code. 3. **AP-135's bookkeeping writes stay** — the server-cell adopt (`RemoteMotion.CellId`) and `LastServerPos`/`LastServerPosTime` samples in `LiveEntityNetworkUpdateController`, on both airborne no-op neighbourhoods. 4. **Dual-parent-class test discipline.** Every new test touching parent/ child cell propagation runs a player (`0x5…`) parent AND a creature (`0x8…`) parent (#319's lesson; the handoff's corrected gate-2 criterion). 5. **The executor path is untouched** — its classified flags, its `refreshPosition: false`, its replay semantics (`ApplyAcceptedPositionExecutionRejectedSnapshot`). Do not unify the two merge callsites into one helper "while here" (trap T8). 6. **The timestamp gate is untouched**; Gate A's teleport-concurrent shape stays upstream (`PhysicsTimestampGate.cs:190-217`; a force with a teleport advance falls through to `Apply`, and `ValidAcceptedAuthority`'s `PreviousTeleport == AcceptedTeleport` rule handles the classified side). **CORRECTED 2026-08-05 (§15): that fallthrough is not retail's shape.** Retail's Gate A accepts a force carrying a NEWER teleport stamp and returns before ever advancing TELEPORT_TS. Both acdream sites named in this item encode the narrower equality; both are filed at AP-148 / #325, and both stay untouched by C5b — closing them is its own slice with its own gate. 7. **The OnPosition routing/arms are untouched** — generic render-pose gate, W2, the arm dispatch, W3, the unified tail, AP-87's catch-up, AP-139's landing clear, AP-140's `InContact` gates. 8. **The local player's cell-freshness path** (echo → generic tail → W2 → `CommitRebucket`) is unchanged. AP-146 stays accurate after its §D4 amendment. 9. **The initial-residence branch of `TryApplyPosition`** (`:1800-1860`) is untouched — it is the executor's enqueue path, already classified. 10. **`Physics.ObserveLocalWorldFrame`** keeps reading the wire landblock directly (`:1887-1889`); it is not a `FullCellId` consumer. 11. **No new skip** (process rule (d)) and no test weakened to make the withhold pass (trap T2 — the withhold assertion lives at the merge boundary, never at OnPosition level, where W2 legitimately re-stamps). ## 5. THE BLAST RADIUS — itemised by consumer class Premise: S2's withhold is the only residency write C5b removes; W2/W3 stay (D3). So the consumers that ever read a value that is intentionally NOT the wire cell are (a) everything in the classification window (merge → `:2329`), and (b) steady state after packets that return before W2 (force path, missile arm). Everyone else reads the same value as today. The #319 lesson is applied, not assumed: a stale cell is worse than a zero cell **for derived/presentation copies** — but `FullCellId`'s whole semantic post-D2 is "the last committed cell", which is retail's `this->cell`; that is not staleness, it is the definition. Zero would be the lie here. ### Class A — placement owners (read at/after placement). Verdict: CORRECT, no gate. `RuntimeSetPositionState` (pre-flight reads `:1172-1255`, commit compares `:2305/:2760/:5020`, parks `:3004/:3031/:3677-3697`, `:3795/:3954`, `:5225/:5242`), `RuntimeRemotePlacementDriveController` (`:1053-1068` — verified: reads `record.FullCellId` AFTER the placement commit for the shadow publish; the commit just wrote it), `RuntimeAcceptedPositionDriveController` (receipt `resolvedCell:` reads `:914-1535`). Retail's placement reads `this->cell` — the committed cell, never the wire cell. These get a MORE honest input post-D2. ### Class B — per-tick simulation. Verdict: CORRECT, no gate. `RuntimeOrdinaryPhysicsUpdater:127` (transits FROM `record.FullCellId` — retail's per-frame cell transit reads `this->cell`), `RuntimePhysicsState` (`:958`, commit `:2145-2159`), `RuntimeProjectilePhysicsUpdater` (`:53-293`), the free-fall sweep's `rm.CellId != 0` gate (AP-135). The simulation is the retail-sanctioned residency writer between packets. ### Class C — classification inputs. Verdict: CORRECT — strengthened. `RuntimeAcceptedPositionRouteRequests` (`:57` route-1 overload — executor scope, unchanged; `:641`-family drive-controller builds for the local player — reads the local player's committed cell, whose freshness path is W2, unchanged). The remote PositionEvent build is the threaded `PreMergeCommittedCellId` — post-D2 the record in the window equals it structurally (§3 D2). 4b-3's D1 moves from convention-defended to structure-defended. ### Class D — presentation/projection, event-time readers. Verdict: HARMLESS, with three named window sites. Event-time readers (landblock-loaded, visibility-changed, per-tick sync) run outside the per-packet window, and W2 keeps steady-state values identical to today for every generic-tail packet: `RuntimePlacementPresentationSink:286` (post-commit receipts), `LiveRenderProjectionJournal:270-271` (falls back when 0), `EntityEffectController:481`, `LiveStaticAnimationResidency:25`, `StaticLiveRootCommitter:76`, `ArchRenderScene` (`Residency.FullCellId` — statics), `HeadlessLocalPlayerFrameHost:87`, `HeadlessRuntimePlacementProjectionSink:103` (token compare), `RemotePhysicsUpdater:239/:294` / `LiveEntityOrdinaryPhysicsUpdater:107` (simulation-snapshot → `ParentCellId` sync). Named window sites (inside merge→W2, or pre-W2 returns) — verdict per site: | site | reads | verdict | |---|---|---| | `LiveEntityHydrationController:592` (`?? candidate.FullCellId` fallback) | landblock-loaded event | HARMLESS — event-time, post-W2 population; the fallback is third in a `??` chain behind projection/snapshot position | | `LiveEntityHydrationController:1077` (`FullCellId != 0` gate) | projection recovery inside the window | VERIFY at implementation: after D2 it reads the committed cell (correct — recovery should re-place from the last commit, not from an unplaced wire claim). Pre-D2 it could read the just-stamped wire cell; that was the AP-1-shaped read this slice exists to remove | | `LiveEntityRuntime:1219` / `:1564` (`token.ExactCellId` compares) | hydration/migration tokens | VERIFY: token cells are create/placement-derived, not wire-derived; the comparison against the committed cell is the intended predicate | | `LiveEntityPresentationController:220` (`RestoreShadow`'s `FullCellId == 0` bail) | visibility-edge restore | HARMLESS/CORRECT — a cell-less body correctly restores no shadow row; the force-path population keeps its committed cell | ### Class E — residency/liveness predicates (the "45+ sites"). Verdict: HARMLESS, two CORRECT-AND-LOAD-BEARING. - `GetRootObjectClockDisposition` (`LiveEntityRuntime:2602-2617`), `HasSpatialRuntimeProjection` (`:3340-3345`), the ordinary-root gates (`:953-956`, `:3452-3455`): tick/edge-time, read the committed cell — retail's `this->cell != 0` predicate shape. CORRECT; unchanged in value for generic-tail packets (W2), changed only for refused-force (retail's shape). - `IsAffectedCollisionResident` (`RuntimeSetPositionState:3949`) and its `!HasCommittedParent` companion gates, the collision-retirement sweeps (`:3771/:3796/:3990/:4052`): event-time (landblock retirement), read the committed cell. CORRECT — a retirement sweep must act on where the body IS, not where an unplaced wire packet claimed. - The initial-create residence `FullCellId != 0` refusal (`RuntimeInitialCreateResidenceState:583`) and executor baselines (`:877-1182`, executor `:1836/:2484`): pending-residence records never take the steady-state merge branch. UNAFFECTED. - 4b-3's cell-less classification input: threaded pre-merge value (Class C). - `RuntimeEntityDirectory:492` child propagation and `RuntimeEntityObjectLifetime:1546-1555` parent-attach propagation: write-side (D2's propagation-source move, pinned in §3 D2 item 2). - `ProjectileController:279/:568/:930` and the missile arm: the ONLY population whose residency becomes exclusively placement-receipt-driven post-D2 (the arm returns before W2, `:2256`). Test-only today (AP-141: ACE never sends a missile UpdatePosition). CORRECT — retail's projectile cell comes from `SetPosition`, full stop. ### The headline behavioural delta, stated once Post-C5b, a **refused or contended local ForcePosition** (AD-62's shapes (iv)-(vi)) leaves `FullCellId` at the last committed cell where today the merge stamps the refused packet's wire cell. Retail cannot refuse (AD-62) and its body keeps the last placed cell — the new shape is the retail-reachable one. Every other steady-state observable is either unchanged (W2/W3) or retail-correcting (the classification window, the placement-authoritative force/portal/missile arms). ## 6. Proof obligations (must prove, not assume) 1. **The truth table is the classifier's.** §8 test 4 drives both the merge and `RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition` (via `RuntimeAcceptedPositionRouteRequests.Build`) over the packet-shape matrix and asserts the merge-installed `AnimationFrame`/`PlacementId`/`ParentGuid`/`ParentLocation`/`Physics.Parent` equal what the route's flags would install. Not a restated table in the test body — the production classifier is the oracle (process rule (e): no test that re-encodes the constant under test). 2. **The withhold is at the merge boundary.** §8 test 5 asserts at `RuntimeEntityObjectLifetime.TryApplyPosition` level: an accepted Position whose wire cell differs from the committed cell leaves `canonical.FullCellId == beforeCell` immediately after the call. It MUST NOT be asserted at `OnPosition` level — W2 legitimately commits the wire cell there, and an OnPosition-level assertion would fail and tempt a weakening (trap T2). 3. **Publish-delta conservation.** One `Rebucketed` delta per cell-changing accepted Position on the steady-state path (§3 D2 item 1), and one child propagation per parent cell change (item 2), both asserted at the observable, both parent classes (must-remain-true item 4). 4. **The refused-force shape.** A ForcePosition whose drive execution refuses/contends writes NO residency change anywhere (§8 test 6) — merge, W2 (unreached), receipt (none). This is the assertion that makes AD-60's retirement mean something. 5. Sabotage-verify every new discriminating test in BOTH directions (process rule (e)) — the canonical half and the presentation/snapshot half separately, per route 7's finding. ## 7. Retirement evidence — AP-131 and AD-60's legacy half (same commit as the change) **AP-131** retires because: 1. The literals at `InboundPhysicsStateController.cs:662-663` no longer exist; the merged flags are computed by the §2-S1 truth table. A grep in the commit message shows no production caller passes unconditional `true/true` (the executor's `:1991-1992` threading is the classified path, already retail-exact). 2. §8 tests 1-4 pin the new behaviour against the classifier-as-oracle, sabotage-verified: (a) `Apply` + animated entity → wire frame NOT installed (sabotage `installPlacementFrame: true` fails it); (b) `Apply` + non-animated → wire frame installed (sabotage `false` fails it); (c) `ForcePosition` + parented entity → parent fields retained (sabotage `clearParent: true` fails it); (d) the matrix consistency test. 3. The row's risk column ("animated entity installs a placement frame retail would skip; ForcePosition unparents where Gate A never reaches `unset_parent`") describes code that no longer exists — the two production behaviours are now the classifier's own rows (`RuntimeAuthoritativePositionRouteClassifier.cs:311-333` and `:336-465`). **AD-60's legacy half** retires because: 1. `RuntimeEntityObjectLifetime.cs:1926` reads `refreshPosition: false`; `RefreshDerivedState`'s `SetFullCell(position.LandblockId, …)` is unreachable from the steady-state merge. 2. §8 tests 5-6 pin the withhold at the merge boundary and the refused-force shape. 3. The row rewrite (§3 D4) names W2/W3 as the surviving, separately-filed wire-cell channels, so the retirement cannot be misread as "wire acceptance never changes residency anywhere" — it means "never inside the merge, never ahead of classification, never for a packet whose placement was declined", with the post-routing adoption for non-placement outcomes filed where it belongs (AP-135 / the W2 citation). ## 8. Test plan Focused Runtime tests (`tests/AcDream.Runtime.Tests`), each asserting the layer that broke historically (merged snapshot fields, canonical cell, publish deltas — never source-text pins): 1. `Apply`, animated remote (`MotionTableId != 0`): merged snapshot keeps `old.Physics.AnimationFrame` / `old.PlacementId`; pose and timestamps still merge. Sabotage: force `installPlacementFrame: true`. 2. `Apply`, non-animated remote: merged snapshot installs `update.PlacementId ?? 0u`. Sabotage: force `installPlacementFrame: false`. 3. `ForcePosition`, parented local player: merged snapshot retains `ParentGuid` / `ParentLocation` / `Physics.Parent`; heading preservation (`:797-807`) unchanged. Sabotage: force `clearParent: true`. 4. Matrix consistency (proof obligation 1): {Apply, ForcePosition} × {animated, not} × {parented, not} × {player `0x5…`, creature `0x8…`} — merge outcome == classifier route flags' outcome. 5. Withhold at the merge boundary (proof obligation 2): wire cell ≠ committed cell → `canonical.FullCellId` unchanged after `TryApplyPosition`; `Snapshot.Position` DID refresh (the pose half of the merge is not the withheld half); a subsequent canonical placement commit still changes `FullCellId`. 6. Refused-force shape (proof obligation 4): drive a ForcePosition whose execution refuses (destination outside the service window) through the drive controller; assert no residency write from merge, receipt, or rebound — `FullCellId` is the pre-packet value throughout. 7. Publish-delta conservation (proof obligation 3): one `Rebucketed` per cell-changing accepted Position; one child propagation per parent cell change; player parent AND creature parent. 8. The existing `InboundPhysicsStateController` unit tests that assert the UNCONDITIONAL flags are **rewritten, never delete-only** (the scoping's §3 row, carried): each becomes its classified-flag counterpart. ## 9. Gates - Focused tests above. - Complete Release suite: `$env:ACDREAM_PAK_PATH` set, `dotnet test AcDream.slnx -c Release -m:1`. **Re-measure the baseline; do not inherit.** Recorded figures: 11,112 passed / 4 skipped / 0 failed at `392c1e22` (C5a contract) and 11,106 at `6921a027` post-C5a (the tasking figure). C5b's net count moves only by test rewrites/additions; the commit message reconciles the net explicitly. Three known flakes, filed separately, never conflated, never chased: **#302** (`PortalProjectionTests.ClipToRegion_FrameOwnedStore_…`, App.Tests), **#308** (`NakEmissionTests.LossSoak_…`, Core.Net.Tests, full-suite load), **#321** (`DatSoundCacheTests` concurrent-decode-dedup, Core.Tests, full-suite load — filed 2026-08-05, deliberately separate from the other two; do NOT fold it in). If any appears, re-run and say which. - **Connected gate: YES — argued, not assumed.** The change is on the hottest wire path (every steady-state Position) and the campaign's standing discipline is a connected gate per live-path behaviour change. But the gate's pass evidence must be positive, because C5b's *improvement* is absence-of-signal (a placement frame NOT installed; an animation NOT popping — the #319/rule-(g) unfalsifiable-criterion trap). Recipe (two-client, Release, `ACDREAM_RETAIL_UI=1`, `ACDREAM_PROBE_REMOTE_TELEPORT=1`, pre-C5c so the probe still exists): 1. **Pickup-then-drop** a ground item, several times — the positive probe assertion: `[remote-teleport]` lines appear with `hookRan=True placement=Committed`, proving the pre-merge-fed cell-less/teleport classification still fires and commits after the merge stopped being a residency writer. (Gate 4's closure at `af828a8a` established this recipe reaches the arm; the probe label may read `teleport-ts` for the short-circuit reason the handoff records — that is expected, not a gap.) 2. **A walking/running creature across ≥1 landblock boundary**, observed: visible, smooth, correct cell, no freeze, no origin-snap — the W2 regression watch (the one writer C5b leans on hardest). 3. **`@teleto`/`@teleloc` a creature** (never a player character — rule (g)): teleport arm unchanged, leash re-armed, no rubber-band, no run-in-place. 4. **Local `@teleto` + one portal recall**: the force/portal paths are now placement-authoritative for residency — arrival pose correct, leash armed, movement immediate. 5. **An animated creature idling/fighting at UpdatePosition cadence**: watch for NEW animation popping (regression) — recorded as an observation only, explicitly NOT a pass criterion (the absence of the OLD pop is the improvement and is test-gated, §8 test 1). Graceful close per the standing rule. **No new probe flag for C5b**: the discriminating signals are either absence-of-signal (ungateable) or already carried by `[remote-teleport]`; adding a seventh temporary probe for one session and stripping it in C5c is churn without evidence value. ## 10. Size and split call Calibrated against the campaign (route 3 ~418, #319 76, 4b-3 ~250-700): | piece | production lines | test lines | |---|---|---| | D1 truth table + comment rewrites | ~25-40 | ~200-350 (matrix + rewrites) | | D2 withhold + comment + publish-edge pins | ~15-25 | ~100-250 | | Register rewrites + #320/AP-130 amendments | 0 (docs) | 0 | **Total ~40-65 production, ~300-600 test** — well under the ~500-line split threshold, and dramatically under the scoping's ~150-400 estimate, because the scoping assumed route plumbing (it did not see that the flags are disposition-determined; §12 item 2). **One landing.** If the test rewrite balloons past ~600 lines, the split line falls between D1's flag tests and D2's withhold tests — but the PRODUCTION change lands atomically: D1+D2 in one commit is one coherent behaviour (classify-then-merge); a half-flipped intermediate (classified flags with the wire stamp, or vice versa) is exactly the mixed-residency state this campaign keeps paying for. Single implementer, dual reviews (retail-conformance + architecture) per the campaign's discipline, both re-run on the final diff. ## 11. Traps (routes 6/7 style) - **T1 — reading `hasAnimations` post-merge.** Compute from `old` (the pre-merge snapshot) inside `TryApplyPosition`. For Position packets the merge cannot change `MotionTableId`, so the failure mode is latent, not live — pin the discipline anyway, because the NEXT field added to this computation may not share the property. - **T2 — the withhold assertion at the wrong boundary.** W2 re-stamps the wire cell at `:2329` for every generic-tail packet, BY DESIGN. A test asserting "FullCellId unchanged after OnPosition" fails and invites a weakening or a W2 gate. The assertion lives at `RuntimeEntityObjectLifetime.TryApplyPosition` (§8 test 5). This is the slice's "weaken a test to make the withhold pass" trap. - **T3 — the moved publish edges.** `Rebucketed` moves from the merge's ternary to `CommitRebucket`; child propagation moves with it. Pin the observable (counts), never the source site; do not delete the coverage when the old assertion site goes quiet. - **T4 — the ForcePosition placement-frame half is inert** (`appliedPlacement` keeps `old.PlacementId` under either flag). The force-half discriminating assertion is PARENT RETENTION. Sabotaging the placement frame on a ForcePosition proves nothing. - **T5 — do not gate W2 "for symmetry".** The local player's canonical cell freshness runs THROUGH W2 (echo → generic tail → `CommitRebucket`; AP-146/#320). Gating it freezes the player's cell between teleports and #319's child equality inherits the freeze. W2 is also the far arm's destination-streaming nudge. - **T6 — the missile arm returns before W2** (`:2256`). Post-D2 its residency is placement-receipt-only; fixtures driving refused/deferred missile placements must not assert wire-cell residency. - **T7 — do not "improve" `hasAnimations`** to a live animation-queue read. AP-130 files the static proxy deliberately; the merge consumes the same proxy and the row is amended, not escalated. - **T8 — no while-here unification** of the two merge callsites, the executor's replay merge, or the timestamp gate. - **T9 — flake discipline.** #302/#308/#321 are three separate filed flakes; a full-suite red in any of them is re-run and named, never folded into "the flake class" and never masked (#321's filing note: no retry, no Skip, no delay). ## 12. Scoping claims found wrong or stale at HEAD `02578441` 1. **The scoping's core premise for the withhold is false.** §2: withholding S2 "moves residency changes onto placement/simulation commits only — the retail rule". At HEAD the steady-state path has TWO MORE wire-cell writers downstream of the merge (W2 `LiveEntityNetworkUpdateController.cs:2329` → `CommitRebucket`; W3 `TryAdoptWireCellAfterRouting:1613`), and C5b keeps both (§3 D3). The retirement must be scoped to the merge boundary and the survivors named in the register rewrite, or AD-60's retirement is a shell game. This is the contract's load-bearing correction. 2. **The size estimate over-counts.** Scoping §7: "~150-400 changed on the hottest inbound path". The flags are disposition+hasAnimations-determined (§2-S1 truth table; retail runs both gates BEFORE the `MoveOrTeleport` branch decision) — no route construction, no `playerDistance` threading, no signature changes. Re-estimate: ~40-65 production lines (§10). 3. **Stale line citations (all re-verified):** `TryApplyPosition` at `RuntimeEntityObjectLifetime.cs:1789` (scoping `:1781`); the threaded overload's signature at `InboundPhysicsStateController.cs:673` (scoping `:681` — that is its flags parameter line); S2's call at `RuntimeEntityObjectLifetime.cs:1923-1926` (C5a's `:1926` correct; the register's `:1338` still stale); `LiveEntityInboundAuthorityGate` lives under `src/AcDream.App/Physics/` (scoping gave no directory; `:161` exact). Everything else in scoping §1b/§2 holds. 4. **#320's edge list goes stale the day D2 lands** — its "accepted inbound Position (`RefreshSnapshot` → `RuntimeEntityRecord.cs:234`)" writer becomes the generic-tail rebucket's `CommitRebucket`. Amendment mandated in the implementation commit (§3 D4), or the next reader files a phantom regression. 5. **The scoping's §5 cell-less falsification session is overtaken:** gate 4 CLOSED at `af828a8a` (the `cause=cellless` label was a probe-artifact — the pickup-then-drop recipe exercised the arm all along). C5b does not inherit that investigation; its connected gate reuses the same recipe as positive evidence (§9). Route-7 thickening and #316's measurement are C5c-ledger items, not C5b design inputs — the implementation session checks the ledger for their status before starting, and does not block on them. ## 13. What C5b does NOT do - Does NOT wire the continuation executor into the steady-state path (#275's alternative branch — the issue's "or delete it with the route"; the steady-state merge stays a live, now-classified, production caller). - Does NOT gate, move, or delete W2/W3 (§3 D3). - Does NOT touch the OnPosition routing, arms, constraint partition, generic render-pose gate, or interpolation machinery. - Does NOT touch the timestamp gate, the executor, the initial-residence branch, or the projectile arm's routing. - Does NOT strip any probe (C5c), fix #316/#317/#320, or re-open AP-145's seam. - Does NOT add a live animation-queue read (AP-130 stands). --- ## 14. Implementation outcome (appended at landing, 2026-08-05) Both design decisions landed exactly as pinned: `installPlacementFrame: !force && !hasAnimations, clearParent: !force` at the S1 call site, and `refreshPosition: false` at S2. No signature changed, no route was plumbed, `playerDistance` was never needed, W2/W3 were not touched. The production diff is 129 insertions / 38 deletions across two files, of which the BEHAVIOUR is **seven lines** — four computing `force`/`hasAnimations`, two flag arguments, one `refreshPosition` argument. Everything else in that delta is the §3-D1 mandated comment rewrites. Well inside §10's ~40-65 estimate; the estimate itself was counting comments. **§5's blast-radius survey missed three consumer sites.** All three are D2-caused, all three were found by the test suite rather than by reading, and all three turned out to be the intended semantics rather than regressions — but the survey did not enumerate them, so they are recorded here: 1. **`DatLiveEntityProjectionMaterializer`'s self-projection branch** (`src/AcDream.App/Rendering/DatLiveEntityProjectionMaterializer.cs`, the `residence is AwaitRuntimePlacement && expectedCanonical.FullCellId != 0u && !HasActiveInitialCreateResidence` gate). This is a Class-D window site: it runs inside `OnPosition`'s prologue recovery (`:1973` / `:2089`/`:2102`), ahead of W2. Pre-D2 it read the just-merged wire cell and installed the spatial bucket there; post-D2 it reads 0 for a withdrawn/inventory-only record and correctly declines to project from an unplaced wire claim. Production still installs the bucket in the SAME `OnPosition` call, at W2 (`:2329`) — verified by reading every `return` between the recovery call and W2: none is conditioned on `IsSpatiallyProjected` or `FullCellId`. Two `LiveEntityHydrationControllerTests` cases asserted the bucket at the recovery boundary and were extended to drive the production W2 step; this is the same shape as trap T2, one layer up. 2. **`ProjectileController.SyncPresentationFromResolvedBody`** (`entity.ParentCellId = record.FullCellId`). Trap T6 named the missile arm's residency but not this presentation writer. On a REFUSED missile placement the entity's pose still moves to the destination (acdream's `StoreAcceptedDestinationPose` fallback) while `ParentCellId` now stays at the committed source cell. The MAJOR-1 invariant the covering test exists to protect (`ParentCellId == record.FullCellId != body.CellPosition .ObjCellId`) is unchanged and is now asserted as that identity rather than as a wire-cell constant. 3. **The `Rebucketed` publish edge does NOT always move to `CommitRebucket`.** §3 D2 item 1 says the merge's ternary "becomes always-`Updated`". It does not, and the ternary is deliberately kept: the `Physics.SetPosition.Forget (canonical, restoreCancelledPark: true)` call a few statements earlier can roll a wakeable lost-cell park back, and `RestoreParkWithdrawal` restores canonical residency at the body's committed cell. That is a real cell edge produced inside `TryApplyPosition` by a placement owner and must still publish as `Rebucketed`. Collapsing the ternary would have silently downgraded it. **One §5 verdict was checked and stands:** `LiveEntityHydrationController :1077`'s `FullCellId != 0` gate is unreachable from this change — it sits inside the `canonicalSpawn.Position is null` branch, and a merged steady-state Position always carries one. **Not done, deliberately:** no automated OnPosition-level test drives the full pickup→drop→reproject sequence (no such fixture exists; the collapse matrix fixture does not cover pickup). The claim that production reprojects a dropped item at W2 rests on the code reading above plus the two hydration tests now driving recovery-then-W2 in production order. §9's connected gate recipe item 1 (pickup-then-drop, several times) is the positive evidence for it and has not been run. --- ## 15. Corrections and hazards found at the C5b closeout (2026-08-05) Both C5b re-reviews (retail-conformance and architecture) returned PASS on `02578441..ff100cf3`. This section carries what they left behind, plus one correction neither of them made and both of them missed twice. ### 15.1 §1's Gate A teleport test was WRONG on primary source This document's §1 stated retail's Gate A teleport term two ways, and both were wrong: the trace line read "teleport must NOT be newer", and fact 2 read "TELEPORT_TS equal". It then blessed acdream's `teleport == _timestamps[Teleport]` (`PhysicsTimestampGate.cs:199`) as "retail's Gate A pair, verified at HEAD". **Verified against the PDB-paired binary** (`acclient.exe` v11.4186, CodeView GUID `9e847e2f-777c-4bd9-886c-22256bb87f32`, `check_exe_pdb.py` reports MATCH), disassembled with capstone at `SmartBox::HandleReceivedPosition` 0x0045402B–0x00454054: ``` 00453fff mov esi, [esp+0x68] ; arg2 (the object) 00454003 cmp esi, ecx ; == this->player ? 00454005 mov ebx, [esp+0x80] ; ebx = arg8 = WIRE teleport stamp 0045401c call 0x451b10 ; newer_event(player, 6=FORCE_POSITION_TS, arg9) 0045402b mov bp, word [ecx+0x16c] ; bp = player->update_times[4] == TELEPORT_TS ; (base 0x164, 2 bytes/entry -> index 4) 00454032 movzx edx, bx ; wire 00454035 movzx eax, bp ; stored 00454038 sub eax, edx / cdq / xor eax,edx / sub eax,edx ; abs(stored - wire) 0045403f cmp eax, 0x7fff 00454044 jg 0x45404b ; far apart -> wrapped compare 00454046 cmp bx, bp ; unwrapped: CF <=> wire < stored 00454049 jmp 0x45404e 0045404b cmp bp, bx ; wrapped: CF <=> stored < wire 0045404e sbb eax, eax / neg eax ; eax = CF 00454052 test eax, eax 00454054 jne 0x4540a0 ; CF set (wire strictly OLDER) -> SKIP Gate A ``` The shortcut is taken **iff the wire teleport stamp is equal or newer** (wrap-safe) — "not older". It is `CPhysicsObj::newer_event` @0x00451B10's identical idiom with the two compare operands swapped: `newer_event`'s unwrapped compare is `cmp si(stored), di(incoming)` and returns 1 on CF, i.e. "incoming is newer"; Gate A's is `cmp bx(wire), bp(stored)` and skips on CF, i.e. "wire is older". `acclient.h:6090` confirms `update_times[4] == TELEPORT_TS`, and 0x00454084's `mov word [edx+0x164], ax` confirms the array base via the POSITION_TS stamp. **Why two review rounds missed it.** Binary Ninja drops the flag test and renders the whole sequence as `if (-((eax_7 - eax_7)) == 0)` — vacuously true. Reading the pseudo-C, at any level of care, cannot recover this. Reading the bytes takes five minutes. This is the same class as the PE byte-decode finding in `claude-memory/reference_pe_byte_decode.md`: when a decomp renders a comparison as a tautology, that is a decompiler artifact signature, not a retail fact. **Consequence.** acdream's `ForcePosition` disposition is a strict SUBSET of retail's Gate A set. Filed as **AP-148** with issue **#325**. Not fixed here: see the AP row and the issue for why it is not a one-line comparison swap. **C5b's own effect on this row is marginally POSITIVE, not negative.** `clearParent` was unconditionally `true` before C5b and is `!force` after — unchanged for the misrouted `Apply`. `installPlacementFrame` went unconditional `true` → `!force && !hasAnimations`, i.e. toward retail's "Gate A never reaches `SetPlacementFrame`" for the animated half. C5b neither introduced nor widened the narrowing; it narrowed the damage. ### 15.2 The no-window route had no pre-merge payload validation Retail finding F2 / architecture finding L-A, found independently by both re-reviewers. Fixed in the closeout commit rather than documented: the no-window route (`RuntimeLiveEntitySessionController.OnPositionUpdated`) now applies the same predicate at the same point as the graphical route's `payloadIsValid` gate. See AD-64 and the method's own comment. The choice was the root fix rather than a documented asymmetry because the fix is five lines, reuses an existing Runtime predicate verbatim (`RuntimeAuthoritativePositionRouteClassifier.IsValidCreateWirePosition` plus the finite-velocity term — the exact pair `RuntimeEntityObjectLifetime.TryApplyPosition` already applies on its initial-residence branch), and leaving it would have left two written claims falsified by the code (the `TryCommitAcceptedWireCell` doc's "under the same reachability rules the graphical `OnPosition` route applies" and AD-64's "whose gates were derived from those returns one by one"). **It is a behaviour change, and its blast radius is bounded by argument, not by a gate.** Headless now drops packets it previously merged. Against ACE the set is empty: ACE resolves cell 0 at `Position` construction and never serializes a NaN/Inf frame, and `PositionPack` writes a real `ObjCellId`. The shape is unreachable in the same way it has always been unreachable for the graphical host, which has carried this gate since it was written. Two test fixtures did carry illegal cell ids (low word `0x41` and `0x51`, both above `LandDefs.CellLowInRange`'s `0x40` landcell ceiling); their constants were corrected, their assertions were not. ### 15.3 BISECT HAZARD — `735f0a72..23aa62f2` contain a live headless defect **A `git bisect` that lands anywhere in this range will hit a real, unrelated defect.** `735f0a72` (the C5b implementation) made the steady-state Position merge withhold the wire cell, and the replacement writer it relied on — the `OnPosition` prologue rebucket — lives in `AcDream.App`. The no-window host has no analogue, so across that range **every remote entity's `FullCellId` is frozen at its placement value for the whole session** in `AcDream.Headless`, and the local player loses one of AP-146's three cell-refresh edges. Nothing throws and no test in that range fails; a bot's `RuntimeEntitySnapshot.CellId` simply stops advancing, and `RuntimeSetPositionState.IsAffectedCollisionResident` parks bodies against a landblock they have left. Fixed at `ff100cf3` (the D1 fix). The range is three commits: `735f0a72`, `ed806997`, `23aa62f2`. If you are bisecting a headless cell/residency symptom, treat any `bad` verdict inside that range as suspect and re-test with `ff100cf3`'s `RuntimeLiveEntitySessionController.TryCommitAcceptedWireCell` cherry-picked on top. Structural cause: issue **#324** (two parallel, non-shared inbound routes); residual duplication: **AD-64**.