# Placement production cutover — campaign plan (2026-08-02) The final leg of the remaining physics-divergence campaign before AP-22 and AD-10: route graphical AND headless production placement through the residence + continuation-executor owner (`38fd4b8d` / `30012361` / `5db3de3c`), delete the legacy duplicate authorities, and retire AP-1/AD-1 behind connected + user-visual gates. **Inputs (read in order):** 1. [`2026-08-02-runtime-continuation-executor-handoff.md`](../research/2026-08-02-runtime-continuation-executor-handoff.md) — the completed dormant mechanism and its cutover notes. 2. [`2026-08-02-cutover-route-inventory.md`](../research/2026-08-02-cutover-route-inventory.md) — the full 8-route, both-host call-chain inventory with exact file:line for every duplicate authority to remove. THE map for all slices below. 3. [`2026-07-31-remaining-physics-campaign-handoff.md`](../research/2026-07-31-remaining-physics-campaign-handoff.md) — the original per-route requirements and prerequisite definitions. **Standing discipline per slice:** pinned contract → single implementer → independent retail-conformance + architecture/adversarial reviews (both must PASS on the final diff) → focused + complete Runtime + Release build + complete solution gates → bisectable behavior commit (register rows in the same commit) → docs/handoff commit. No workarounds; no fused slices. ## Confirmed pre-cutover gaps (from the inventory) - The executor publishes only generic entity deltas; nothing bridges its completion to `RuntimePlacementProjectionChannel`, so no host can learn "my initial placement committed" through the built observer seam. - No atomic controller/body publication owner exists (prerequisite C); App and headless hand-write divergent `PlayerMovementController` construction, and `SubmitPreparedPlacement` requires a canonical `PhysicsBody` that nothing currently publishes atomically. - The dormant placement path's 1,880 B/operation (2,048 cap) allocation remains the activation blocker for frame-frequency routes. - `Execute`'s live inputs (`UsePositionFromServer`, `PlayerDistance`) are computed by no host; they must derive from Runtime's own character-option and local-player owners. - `RuntimePortalPlacementAuthority` has zero producing call sites; the adapter from `RuntimeWorldTransitState` does not exist. - The exact-Setup mover chain (`PrepareMover` / `RuntimeSetPositionMoverPreparer.TryBuild` / `IPreparedCollisionSource.ReadSetupCollision`) exists piecewise, unwired. - Route-6 split-recovery creates need an effect-replay suppression signal; route-7 needs `TryCommitParent`/`CommitWithdrawal` cancellation-symmetry fixes and host-visible cancellation receipts; headless lacks any parent-realize sequence (pre-existing, adjacent). ## Slices - **C0 — Runtime bridge + live inputs — COMPLETE at `67f63e85` (2026-08-02, dual reviews PASS).** The executor publishes an acknowledge-only `ExecutorCompleted` receipt through the one placement stream (registered before dispatch; correlation reaped on acknowledgement/discard/clear; `PendingCompletionReceiptCount` in `IsConverged`); all three production sinks acknowledge-and-ignore the kind via early returns proven behavior-preserving for every other kind (sanctioned seam completion — provably inert, no production publisher); `UsePositionFromServer` derives retail-exactly from `RuntimeCharacterState.AutonomyLevel != 2` and `PlayerDistance` from the live movement controller with null-safe fallback to the caller struct; `TryPrepareAndSubmitAuthoredPlacement` chains the prepared-collision Setup read through `PrepareMover` to submission with zero validation changes; `TryCommitParent`/`CommitWithdrawal` gained the sibling cancellation flow (the `LeaveWorld` omission in `TryCommitParent` is retail-REQUIRED per `set_parent` 0x00515A90:283832-283833's single gated `leave_world`). Not fully dormant by design: the two cancellation fixes change live Runtime paths production already calls; everything else has no production caller. **C3 prerequisites recorded from C0's reviews:** (a) the completion receipt/trace surface is internal-only — C3 must define the public host consumption shape when it wires the hosts; (b) `PlayerDistance` is resolved once per `Execute` entry, not per continuation — a multi-Position FIFO classifies later entries against entry-time distance (documented deferral; refine at C3/C4 if the connected gates show it matters); (c) any future host exposure of `TrySetAutonomyLevel` must carry retail's `SendAutonomyLevelEvent` (699550). - **C1 — atomic controller/body publication — SATISFIED BY EXISTING MECHANISM (research finding 2026-08-02, plan amended same session).** `RuntimeLocalPlayerPhysicsPublicationState` (1,033 lines) plus the ~15-method dormant local-activation family on `RuntimeSetPositionState` already implement the full sanctioned option-2 transaction: off-canonical preparation against a scratch quantum clock and a sealed candidate controller, one validated atomic Commit, and a staged Evaluate/Commit/FinalizeActivation chain re-validated against PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session identity at every entry — with zero production callers. See [`2026-08-02-canonical-body-writer-map.md`](../research/2026-08-02-canonical-body-writer-map.md) (6 canonical body writers; the two host escape hatches; both hosts' divergences). The remaining work — routing both hosts' local-player construction through the publication lifecycle, sealing the public `RuntimeLocalPlayerMovementState.Controller` setter, retiring App's direct object-clock bypasses, and containing headless's uncaught prepared-collision `InvalidDataException` — IS the C3 route-1 flip and moves there. No separate C1 commit. - **C2 — placement allocation budget.** Pool or eliminate the operation/ projection envelope allocations on the accepted placement path (root cause, not a raised cap), or obtain explicit user approval for a measured budget. Re-measure; the regression gate keeps the ceiling. - **C3 — spawn-frequency cutover: routes 1 + 8.** Flip graphical AND headless initial Create/login registration to `RegisterEntityWithInitialResidence` + executor + placement receipts together; `MaterializeProjection`/`BuildControllerAndCamera`/ `SynchronizeLocalPlayer` become projection + acknowledgement only; presentation-only rebucketing (`RebucketLiveEntity` loses `CommitRebucket`). Gates add the exact lifecycle/reconnect connected route. - **C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the `RuntimeWorldTransitState` → `RuntimePortalPlacementAuthority` adapter), 4 (remote Create/Position; delete `RemoteTeleportController`/`Placement` and the inline MoveOrTeleport duplicate), 5 (projectile authoritative), 6 (drops + split-recovery marking), 7 (residual pickup/parent/delete polish).** May land as more than one commit if a route proves large; each sub-landing keeps the full review discipline. - **C5 — legacy deletion + closeout gates.** Delete every superseded legacy path; parity tests; exact lifecycle/reconnect + canonical nine-stop connected routes; two-client observation; **user visual matrix** (the campaign's stopping point for user acceptance). Retire AP-1, AD-1, AP-131, AD-60's legacy half, and close #275. Update register/roadmap/ milestones/architecture/memory + successor handoff. After C5: AP-22 (authored collision shapes), then AD-10 (remote contact-plane projection), then the campaign's final matrix and ledger closeout; vendor Slice 5 resumes.