# Placement production cutover — campaign plan (2026-08-02) > ## ✅ CAMPAIGN LEDGER CLOSED — 2026-08-06, by user direction > > Every slice is landed and dual-reviewed: **C0–C4**, **C5a**, **C5b** > (#275; retired AP-131 + AD-60's legacy half), **#280** (portal destination > prefetch, user-accepted at its connected gate), **#276's remainder**, > **AP-22** and **AD-10** (both retired). **#309** was accepted as a standing > divergence rather than fixed. Final gate: complete Release suite from a > clean build, **11,196 passed / 4 skipped / 0 failed** — campaign net +90 > from 11,106. > > **The ledger closes with connected gates outstanding, by user direction — > not because they were discharged.** Only #280's reveal gate was run and > passed. D-1's two reachability scenarios, AP-136's six-step park protocol, > route-7 thickening, the two-client observation, the nine-stop soak and the > lifecycle/reconnect route were **NOT RUN**; the probe family is > **deliberately NOT stripped** for that reason. Anyone citing "the campaign > passed" must cite §2.6 of the closeout alongside it: > [`2026-08-06-c5c-closeout-handoff.md`](../research/2026-08-06-c5c-closeout-handoff.md). > > Follow-ups generated and filed rather than folded in: **#325**, **#330**, > **#331**, **#332**, **AP-149**, **AP-152**, **AD-65**, **AD-66**. Start with > **#331**. The final leg of the remaining physics-divergence campaign before AP-22 and AD-10: route graphical AND headless production placement through the residence + continuation-executor owner (`38fd4b8d` / `30012361` / `5db3de3c`), delete the legacy duplicate authorities, and retire AP-1/AD-1 behind connected + user-visual gates. ## Handoff checkpoint — 2026-08-03 **Status: stabilization checkpoint accepted; campaign closeout is not yet complete.** The C3c production cutover and the O(changed) collision publication checkpoint are now playable after five separately committed root-cause fixes: - `01f4791e` stops origin recenter from manufacturing and replaying a second retirement receipt for a pending-only live-projection bucket. Its exact binary passed the complete Release suite, lifecycle route, and canonical nine-stop soak (`connected-r6-soak-20260802-204309`, nine stops, zero failures/wait cues/pending retirements). - `670f307c` keeps remote Create placement, the local-player physics host, targeting, chasing, and attacks in the same world-coordinate frame. The user accepted monster placement/chase/hit behavior and static placement after portals. - `1fc529cd` materializes the canonical minimal static physics host before a distant Use/MoveTo route and reconciles the pre-PartArray startup motion suffix. The user accepted near and distant object use. - `f24532ad` defers one-shot F754/F755 effects until canonical placement has bound presentation, retries projectile/static-animation sidecars on the committed visibility edge, and keeps effect cells synchronized. The user accepted buffs, recalls, arrows, combat spell projectiles, portals, and static animation. - `175ad6b0` sends LoginComplete from the local first-placement terminal edge instead of raw PlayerCreate receipt, so ACE's intentional login Hidden/ materialization state cannot race placement. The user accepted the login haze behavior. Focused verification after the final fix passed 90 App effect/projectile/ static-scheduler tests, two Runtime login tests, the exact live-entity cell tracking regression, all 79 Headless tests, and the Release solution build with zero errors. The long connected soak and complete solution suite have **not** been rerun on the final `175ad6b0` binary. A broader selected fixture run also exposed five `LiveEntityRuntimeTests` failures tied to the still-open placement cutover plus one old remote first-entry fixture that supplies an empty collision source; classify and fix those before claiming C5 closure. **Resolved 2026-08-03 as #281 (DONE):** the "six selected fixture failures" figure was itself a mis-measurement — the measured baseline found **43** (28 App broken by `670f307c`, 2 more by `f24532ad`, 13 Runtime) — repaired without weakening assertions (`6dcb94ac`, `98e9f9e8` and the recent-regression cleanup closed at `2ef02f8c`); every later checkpoint's complete suite ran 0-failed. Remaining campaign work, in order: 1. Reproduce and repair the six fixture failures without weakening their assertions or adding compatibility bypasses. **DONE 2026-08-03 (#281 — the real count was 43; see the correction above).** 2. Finish C4's routes 2–7 and remove their legacy placement writers; fold in #276 and #277 where their route becomes authoritative. **DONE 2026-08-05 except the four owed connected gates (see the C4 slice below). #276 was folded only PARTIALLY — route 5 closed its projectile half; the `SpawnPlacementSettler` settle-cell discard remains OPEN. #277 was NOT folded: no streaming/broadcast radius changed, so its service-window conversion remains a trigger-conditioned carry, not a completed item.** 3. Resolve #280 with retail's configured destination-prefetch window so the portal viewport never reveals visibly constructing far terrain. **DONE 2026-08-05 (implementation + suite); the connected/visual gate is batched into C5's matrix. Shape correction: retail has NO separate prefetch window** — it has one landscape square (`LScape::mid_radius`) that is simultaneously the loaded, drawn and blocked-on set, and whose configured value is `Render.LandscapeDrawDistance`. acdream now derives its reveal window from the live streaming radii (`QualitySettings.FarRadius`) and made the render-completeness predicate tier-aware so the outer rings can satisfy it. Contract: [`2026-08-05-280-contract.md`](../research/2026-08-05-280-contract.md). Residual filed as AP-149; the missing user-facing Viewing Distance option is filed separately as #326 and is explicitly NOT part of #280. 4. Run C5's complete Release suite, lifecycle/reconnect route, latest-binary nine-stop soak, two-client observation, and the remaining #269 slope-glide visual check. A pass from `01f4791e` is evidence for that fix, not a substitute for the final-binary soak. **Correction 2026-08-05: #269 was already closed and user-accepted 2026-07-31 (before this plan was written); the surviving visual item is #278(b)'s lateral-glide comparison, not #269.** 5. Delete the superseded paths, retire AP-1/AD-1/AP-131 and AD-60's legacy half only when the code proves they are gone, then complete AP-22 and AD-10 and close the campaign ledger. **DONE except the ledger close, 2026-08-05/06.** AP-1/AD-1 retired at C5a (`6921a027`); AP-131 and AD-60's legacy half at C5b (`735f0a72`); **AP-22** retired at `bc4679cd` (all three invented-cylinder copies deleted — the row listed one; reachability proved zero over all 5,935 installed Setups by four independent decoders); **AD-10** retired by deletion at `886333a2` (its stated justification was false at HEAD — remotes DO run the sweep, so the projection was an extra non-retail layer, measured bit-identical when removed). Both dual-reviewed, both lenses PASS. Remaining: C5c's gates and the ledger close. Two new divergences were filed out of AD-10's work (AD-65, AD-66) and two issues (#331 uphill-resolve blockage, #332 headless remote dead-reckoning). **Inputs (read in order):** 1. [`2026-08-02-runtime-continuation-executor-handoff.md`](../research/2026-08-02-runtime-continuation-executor-handoff.md) — the completed dormant mechanism and its cutover notes. 2. [`2026-08-02-cutover-route-inventory.md`](../research/2026-08-02-cutover-route-inventory.md) — the full 8-route, both-host call-chain inventory with exact file:line for every duplicate authority to remove. THE map for all slices below. 3. [`2026-07-31-remaining-physics-campaign-handoff.md`](../research/2026-07-31-remaining-physics-campaign-handoff.md) — the original per-route requirements and prerequisite definitions. **Standing discipline per slice:** pinned contract → single implementer → independent retail-conformance + architecture/adversarial reviews (both must PASS on the final diff) → focused + complete Runtime + Release build + complete solution gates → bisectable behavior commit (register rows in the same commit) → docs/handoff commit. No workarounds; no fused slices. ## Confirmed pre-cutover gaps (from the inventory) - The executor publishes only generic entity deltas; nothing bridges its completion to `RuntimePlacementProjectionChannel`, so no host can learn "my initial placement committed" through the built observer seam. - No atomic controller/body publication owner exists (prerequisite C); App and headless hand-write divergent `PlayerMovementController` construction, and `SubmitPreparedPlacement` requires a canonical `PhysicsBody` that nothing currently publishes atomically. - The dormant placement path's 1,880 B/operation (2,048 cap) allocation remains the activation blocker for frame-frequency routes. - `Execute`'s live inputs (`UsePositionFromServer`, `PlayerDistance`) are computed by no host; they must derive from Runtime's own character-option and local-player owners. - `RuntimePortalPlacementAuthority` has zero producing call sites; the adapter from `RuntimeWorldTransitState` does not exist. **Corrected 2026-08-04 (C4 route 3 closure, `docs/research/2026-08-04-c4-route-3-contract.md`), itself corrected 2026-08-05 (A10 architecture review — the first correction asserted a false fact of its own), and rewritten 2026-08-05 (N5 retail-review round-3 fix — the prior wording of this correction contradicted itself).** The original bullet conflated two separate claims into one sentence, and only one of them was true. What pre-dated route 3 and WAS accurate: the `RuntimePortalPlacementAuthority` type existed (referenced by route 2's `Pending.Portal` field, always `Present: false`), its `IsValid` check existed, and the sinks' portal-authority gates plus `BeginAcceptedPlacementCore`'s gate already read it. What was NOT accurate, and is what "zero producing call sites; the adapter does not exist" actually described: the PRODUCER half — nothing built a `Present: true` authority and called the consumer arm (`RuntimeAcceptedPositionDriveController.TryExecuteAcceptedPortalArrival`/ `SubmitAndResolvePortal`/`ClassifyPortalArrival`) — that consumer arm ALSO did not exist before route 3. Route 3 added the producer and the consumer together, in the same slice: the producer is `LocalPlayerTeleportController.TryExecuteCanonicalPortalPlacement` (now `TryAdvancePortalCommit`/`TryExecuteCanonicalPortalPlacementCore`, per the 2026-08-05 A1 review fix), which builds the authority from `WorldRevealCoordinator`/`RuntimeWorldTransitState` facts and calls `TryExecuteAcceptedPortalArrival`; the identical Runtime entry point is shared by the headless host. So: the type/`IsValid`/consumer-gate facts pre-dated route 3 and were true before it; the arm (both the producer that builds a live authority and the consumer that reads one) did not exist before route 3 and is what the original bullet's "zero producing call sites" language was pointing at. - The exact-Setup mover chain (`PrepareMover` / `RuntimeSetPositionMoverPreparer.TryBuild` / `IPreparedCollisionSource.ReadSetupCollision`) exists piecewise, unwired. - **Corrected 2026-08-04 (C4 route 6 closure, `docs/research/2026-08-04-c4-route-6-contract.md`): all three clauses above were stale.** Route-6 split-recovery does NOT need an effect-replay suppression signal — that premise was unsubstantiated; acdream's only create-time effect replay is the F754/F755 queue drain keyed by server GUID, and the one plausible mechanism (a cloned `DefaultScriptType` surviving `BuildSpawn`) never fires at create in either client (`CPhysicsObj::play_default_script @0x005132B0`/`@0x00513300` has exactly two callers, both animation hooks, verified against `acclient_2013_pseudo_c.txt`). Route-7's `TryCommitParent`/ `CommitWithdrawal` cancellation-symmetry fixes and host-visible cancellation receipts were BOTH closed at C0 (see the C0 slice below). What actually remained for route 7: the child's canonical cell had two writers (Runtime committed it cell-less unconditionally in `CommitAcceptedParentCellless`, while `EquippedChildRenderController .TickChild` re-celled it from a per-frame render tick), and headless had no `EquippedChildRenderController` at all, so every headless parented child stayed cell-less forever — the same defect seen from two sides, not two separate gaps. **Closed 2026-08-04 (`docs/research/2026-08-04-c4-route-7-contract.md`).** Runtime is now the sole canonical writer: `CommitAcceptedParentCellless` completes retail `set_parent`'s attach-time re-cell (D1), and every canonical cell write funnels through one directory chokepoint that recursively propagates to committed children on every parent cell crossing (D2 — `docs/research/2026-08-04-retail-parent-cell-propagation.md`), not only at attach. `TickChild` is demoted to a presentation-only draw-bucket move (D4); the headless host gained its own parent-realize drive running the same commit pair the graphical host does (D5, `RuntimeLiveEntitySessionController.OnParentUpdated`). The direct headless regression test (a bot with an equipped item shows the child's canonical `FullCellId` equal to the parent's) now passes. ## Slices - **C0 — Runtime bridge + live inputs — COMPLETE at `67f63e85` (2026-08-02, dual reviews PASS).** The executor publishes an acknowledge-only `ExecutorCompleted` receipt through the one placement stream (registered before dispatch; correlation reaped on acknowledgement/discard/clear; `PendingCompletionReceiptCount` in `IsConverged`); all three production sinks acknowledge-and-ignore the kind via early returns proven behavior-preserving for every other kind (sanctioned seam completion — provably inert, no production publisher); `UsePositionFromServer` derives retail-exactly from `RuntimeCharacterState.AutonomyLevel != 2` and `PlayerDistance` from the live movement controller with null-safe fallback to the caller struct; `TryPrepareAndSubmitAuthoredPlacement` chains the prepared-collision Setup read through `PrepareMover` to submission with zero validation changes; `TryCommitParent`/`CommitWithdrawal` gained the sibling cancellation flow (the `LeaveWorld` omission in `TryCommitParent` is retail-REQUIRED per `set_parent` 0x00515A90:283832-283833's single gated `leave_world`). Not fully dormant by design: the two cancellation fixes change live Runtime paths production already calls; everything else has no production caller. **C3 prerequisites recorded from C0's reviews:** (a) the completion receipt/trace surface is internal-only — C3 must define the public host consumption shape when it wires the hosts; (b) `PlayerDistance` is resolved once per `Execute` entry, not per continuation — a multi-Position FIFO classifies later entries against entry-time distance (documented deferral; refine at C3/C4 if the connected gates show it matters); (c) any future host exposure of `TrySetAutonomyLevel` must carry retail's `SendAutonomyLevelEvent` (699550). - **C1 — atomic controller/body publication — SATISFIED BY EXISTING MECHANISM (research finding 2026-08-02, plan amended same session).** `RuntimeLocalPlayerPhysicsPublicationState` (1,033 lines) plus the ~15-method dormant local-activation family on `RuntimeSetPositionState` already implement the full sanctioned option-2 transaction: off-canonical preparation against a scratch quantum clock and a sealed candidate controller, one validated atomic Commit, and a staged Evaluate/Commit/FinalizeActivation chain re-validated against PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session identity at every entry — with zero production callers. See [`2026-08-02-canonical-body-writer-map.md`](../research/2026-08-02-canonical-body-writer-map.md) (6 canonical body writers; the two host escape hatches; both hosts' divergences). The remaining work — routing both hosts' local-player construction through the publication lifecycle, sealing the public `RuntimeLocalPlayerMovementState.Controller` setter, retiring App's direct object-clock bypasses, and containing headless's uncaught prepared-collision `InvalidDataException` — IS the C3 route-1 flip and moves there. No separate C1 commit. - **C2 — placement allocation budget — COMPLETE at `63c601ff` (2026-08-02, dual reviews PASS after two fix rounds).** 2,032 → 944 B/op via pooled operation envelopes (bounded, reset-at-rent, double- retire guarded, reset/dispose-cleared, ledger-visible), a cached collision-callback delegate over an explicit context stack, and a non-boxing pending-head read; gate tightened to 1,536. The pooling forced a class-wide staleness rework: captured-token-vs-fresh-lookup at every reentrancy-spanning frame (26-site audit), hoisted stack locals for retail's handle_all_collisions bits, token-gated bookkeeping writes, and a deliberately identity-agnostic settle path (retail's SetPositionInternal completes unconditionally even for displaced operations). **Residual floor (documented at the gate, decision deferred to the C3 activation gate where the user is in the loop):** ~520 B/op inside Core's `PhysicsEngine.SetPosition` (transition init / query-footprint materialization — a potential C2b if C3's connected profile shows it matters) and ~208 B/op of sorted-tree node per pending receipt. **Maintenance notes from review (no action):** the no-reentrancy proofs on the 15 surviving reference-based currency checks are comment-enforced; `IsCurrent(Operation)` remains available and a new reentrancy-spanning call site would silently inherit the tautology — its doc comment warns. - **C3 — spawn-frequency cutover: routes 1 + 8 — DECOMPOSED 2026-08-02 after the first implementation pass stopped with findings.** C3-1 (the public executor-completion surface via `RuntimePlacementProjectionChannel.TryGetInitialCreateCompletion`) landed separately. Two structural gaps halted the flip, both real and neither in the planning docs: **(B)** the local player's residence lease opens its SetPosition operation at Create time, but `SubmitPreparedPlacementCore` requires a pre-existing canonical body that only the zero-caller publication chain can attach — first-entry needs an explicit resumable sequence (begin-placement → publication Prepare/Commit attaches the body → authored-mover submit → Place receipt → Execute), which matches the campaign handoff's route-1 required order but exists nowhere as a driveable state machine; **(C)** ordinary remote-creature Creates classify to `SetPosition` but have NO production body-construction path at Create time (bodies arrive with first motion today; retail constructs physics at CreateObject via `ACCObjectMaint::CreateObject`/`set_description`, which our retail notes fully document — the defaults come from the wire PhysicsDesc, not invention). Sub-slices, each with the standing contract/dual-review/gate discipline: - **C3a — Runtime first-entry sequencing — COMPLETE at `960373df` (2026-08-02, dual reviews PASS).** `RuntimeLocalPlayerFirstEntryState`: five stages (mover-prep → publication Prepare/Commit → activation → acknowledgement → Execute) in retail's own order — mover shapes BEFORE placement, matching makeObject/set_description preceding enter_world; the original contract prose had it backwards and the tested preconditions forced the faithful order. Acknowledge-stage authority discrimination, automatic convergence through the (now multicast, snapshot-iterated) retirement fan-out, ownership-ledger fold, transactional late-bind Publication seam. Dormant: C3c's first act is the GameRuntime binding + production Advance drive. **Carried findings for C3c:** the controller is live from the activation commit onward (abandonment leaves it to ordinary entity teardown — retail has no entry-flow rollback); EvaluateActivation's post-commit DeferredCell overload is encapsulated behind Advance. - **C3b — remote body construction at Create — COMPLETE at `0934a121` (2026-08-02, dual reviews PASS).** `RuntimeRemoteBodyDescription` + `RuntimeRemoteFirstEntryState`: the full `set_description` order with the byte-certain gates (friction [0,1] inclusive, NaN sanctioned-skip; elasticity clamp with retail's unordered-to-zero; translucency != 0.0f), the movement-branch discriminator on retail's `movement_buffer != 0` (empty-buffer → placement branch, no autonomy), motion-table zero-id pass, ctor-defaults for absent wire fields, and never-clobber coexistence with the build-at-first-motion production path. The acknowledge discriminator is one shared body (`RuntimeFirstEntryAcknowledgement`) for both conductors. Dormant. - **C3c — the host flips (production) — COMPLETE at `529e0e9d` (2026-08-02, dual Opus reviews: initial FAIL 2+2 MAJOR → R1 fix round → delta PASS both).** Both hosts register initial Creates through residence + conductors via the shared `RuntimeFirstEntryDriveController`; Controller setter sealed; rebucketing presentation-only strictly while the residence is ACTIVE (post-residence entities take the full legacy path including the `prepare_to_enter_world` clock edges); content-less headless keeps pre-flip direct registration. Five fix slices landed inside the cutover, each connected-gated: F1 (Runtime ownership seam for movement stats/server physics — the post-logout retired-controller crash), F2 (the login activation wedge: admission-prefix gate factored from the seal, rearm generation identity, auto-entry requires the published controller), F3 (landblock-prefix 0-sentinel → explicit absent-id; corner landblocks legal), F4 (diagnosis only: the nine-stop soak's convergence failure is pre-existing `6b28ff99` whole-world collision-clone throughput — its fix is the next slice before C5), F5 (local-player first-entry ground contact via the shared `SpawnPlacementSettler` at `FinalizeActivation`; the standing-cast airborne rejections are gone; register AD-61). R1 additionally armed the login constraint leash at the committed placement (`HandleReceivedPosition` 0x00453FD0 analog) and refreshed AD-42. Final gates: complete solution 10,816/0/4 skips; lifecycle/reconnect gate PASS (`connected-world-gate-20260802- 175401`). Closeout: [`2026-08-02-c3c-cutover-closeout.md`](../research/2026-08-02-c3c-cutover-closeout.md). **Carried to C4/C5:** route-1 far-Create service-window conversion if either streaming/broadcast radius changes (#277); the window-departure park narrowing; `NotifyRetirement`-on-active-entry subscriber invariant; the reachable equip-mid-conductor fail-fast; settle-CellId discard (#276-adjacent, see ISSUES). - **C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the `RuntimeWorldTransitState` → `RuntimePortalPlacementAuthority` adapter), 4 (remote Create/Position; delete `RemoteTeleportController`/`Placement` and the inline MoveOrTeleport duplicate), 5 (projectile authoritative), 6 (drops + split-recovery marking), 7 (residual pickup/parent/delete polish). — route 2 COMPLETE AND USER-ACCEPTED 2026-08-03 (`9966b531`); routes 3/4/5/6/7 remain OPEN.** **C4 IMPLEMENTATION COMPLETE 2026-08-05.** Every route now places through the canonical Runtime owner; the campaign's remaining C4 debt is exactly the four owed connected gates listed at the end of this bullet. Per-route record (each with contract + independent dual reviews per the standing discipline; suite counts measured, never inherited — final complete Release suite **11,090 passed / 4 skipped / 0 failed** at `e0f96a55`): - **4a LANDED `44830a0e`; 4b-1 LANDED `2e8e09ac` (dormant infrastructure); 4b-2 LANDED `7f1c1f5a`** (recorded in the sub-bullets below with its four fix rounds and user-passed far-snap gate). - **4b-3 LANDED `6dc7ba51` (2026-08-04)** — remote teleport + cell-less through the canonical placement; `RemoteTeleportController` (605 lines), `RemoteTeleportPlacement` (85), and ~1,709 test lines deleted. Dual round 1 FAIL/FAIL → round 2 delta PASS/PASS; three NPC-arm MAJORs closed. **Connected gate PASSED-partial (`21cd6e9b`)**: 16 `[remote-teleport]` probe lines over 7 creatures, all `cause=teleport-ts` — `cause=cellless` was never observed and remains test-covered only (owed gate 4 below). Docs at `8c269ad1`; findings chain in `2026-08-04-c4-route-4b-3-*.md`. - **Route 5 LANDED `36255af0` (2026-08-04)** — projectile authoritative placement (#276 partial), preceded by a mandatory byte-decode gate (`MoveOrTeleport` @0x00516330 never reads its velocity argument, which also spawned #317). Three dual review rounds closing 8 MAJORs; round 3 retail PASS with the AP-141 risk-column retraction (C1), architecture FAIL on a coverage-only C1 closed in-commit with two sabotage-verified retry-arm tests. **NO connected gate exists for this route, by design** — ACE never sends a missile UpdatePosition (`WorldObject_Tick.cs:333-334`); every proof is deterministic-test-gated and recorded as such. Interim landings alongside: the OnPosition dual-tail collapse (`edc911b0`, whose scoping found and filed #316), #315 closed (`aaf0811f`), #314 closed (`daef7c98`). - **Route 6 CLOSED `1b484937` (2026-08-04) with ZERO production lines** — C3c had already flipped both drop flavours onto the canonical create transaction; the landing is 7 sabotage-verified coverage tests, the retail split-marking record (#313 filed for the `DeclareValid` selection transfer), and the correction of this plan's own false effect-replay premise (see the corrected gap list above). Its coverage tests immediately found #314 (split recovery threw on retained timestamps), fixed in its own commit `daef7c98`. **Connected gate owed** (drops recipe — owed gate 1 below). - **Route 7 LANDED `cd3129e9` (2026-08-04)** — child cell propagation moved from a render tick into Runtime: retail `set_parent`'s attach-time re-cell completed in `CommitAcceptedParentCellless`, the recursive parent-cell-crossing propagation at the one directory funnel (iterative worklist — the initial depth-64 cap was deleted after both round-2 reviews independently found its truncation residue was the #184 shape), `TickChild` demoted to presentation-only, the headless parent-realize drive added (its direct regression test failed before this work), and the dead `ClassifyLeaveWorld` family deleted. Dual round 1 FAIL/FAIL → round 2 delta PASS/PASS plus a coordinator-required third pass; 5 MAJORs. AP-142/AP-143 filed. **Connected gate owed** (equip/carry with `cause=propagate` probe evidence — owed gate 2 below). Route 7 also INVALIDATED 4b-3's recorded cell-less live recipe (contract §11; the supersession note is appended to the 4b-3 contract). - **Route 3 LANDED `e0f96a55` (2026-08-05)** — the LAST route: the first production `RuntimePortalPlacementAuthority` producer, the portal arm on route 2's drive controller, `CommitCanonicalTeleportFrame` with the `PlayerTeleported` port (autorun cancel + one movement event), and both duplicate authorities deleted (`LocalPlayerTeleportPlacement.Place`, `ResynchronizeLocalPlayerForPortalArrival` — AD-42's row deleted with them). Contract at `19ebf043`; scoping/propagation research at `ca96ea5e`. Dual round 1 FAIL/FAIL → dual round 2 FAIL/FAIL (near miss) → round-3 fix pass accepted per both round-2 reviews' explicit pass conditions; the round-3 record is the commit message plus #318 and AP-144/AP-145 (no standalone round-3 review doc). The fix pass's refusal to accept 7 skipped tests uncovered a real production bug (the canonical portal arm was 100% dead code — the accepted-destination slot it re-read at Place time was already consumed at Aim time). **Connected gate owed** (portal/recall with `[local-tp]` probe evidence — owed gate 3 below — and explicitly NOT scored as covering #318). - **The four owed connected gates**, with recipes and pass criteria in [`2026-08-05-c4-closeout-handoff.md`](../research/2026-08-05-c4-closeout-handoff.md): (1) route 6 drops; (2) route 7 equip/carry across landblock boundaries, counted only with `[child-cell]` `cause=propagate` lines; (3) route 3 portal/recall, counted only with `[local-tp]` lines, not scored against #318; (4) 4b-3's `cause=cellless` case, whose recorded trigger route 7 invalidated — the replacement provocation is UNESTABLISHED and needs its own investigation. None has been run. **Route 4 SPLIT into 4a and 4b (user-directed 2026-08-03).** Scoping ([`2026-08-03-c4-route-4-scoping.md`](../research/2026-08-03-c4-route-4-scoping.md)) put whole-route 4 at 1,500-2,500 production lines against a stated ~400 budget, so it is split to keep each landing reviewable: - **4a — the steady state.** The classifier's `Interpolate` (contact, `PlayerDistance < 96 m`) and `NoPositionOperation` (no contact) branches. NEITHER runs a `SetPosition`, so 4a has no deferred-cell park, no service-window work, and no placement-allocation exposure. Fixes two of the three unfiled divergences (the NPC airborne hard-snap that ignores the wire `IsGrounded` bit; `ConstrainTo` armed before the operation instead of after). Highest visible value — this is what makes creatures move smoothly. - **4b — the edges.** `SetPosition` / `SetPositionSimple`: teleport, far-snap (>= 96 m), and cell-less first placement. This is where the parks, the Position-time service-window guard, #277's broken bound, N3 (headless never calls `RetryPending`), and the third divergence (`ConstrainTo` never armed on the remote teleport branch) all live. **4b also inherits 4a's ownership remainder — scheduled here, not implied by code comments.** Two independent reviews flagged that 4a satisfies contract items 1 and 2 only partially, and the plan must carry that rather than leaving it in `// 4b deletes this fallback` comments: - Runtime owns the classification, the request construction (one shared builder, `RuntimeAcceptedPositionRouteRequests`), the near-InterpolateTo decision with AP-87, and the post-operation `ConstrainTo`. **App still owns** branch selection, the airborne early return, the `RemoteMotion.CellId` write, the `WorldEntity` pose write, and the collision-shadow publish — all in `LiveEntityNetworkUpdateController`. - Item 2 ("both hosts drive the identical Runtime entry point") is satisfied only VACUOUSLY: `RuntimeLiveEntitySessionController` returns early for remotes, so no no-window host exercises this path at all and nothing can diverge yet. That stops being true the moment a headless host needs remote motion. - Every legacy fallback 4a deliberately left in place is 4b's to delete: the pre-operation unconditional `ConstrainTo`, the player arm's `!update.IsGrounded` no-op, the player and NPC legacy near/far routing (each still carrying its own duplicate `96f` / `4f` constants), and the airborne-precedence carve-out (`LiveEntityNetworkUpdateController.ApplyRemoteContactRouting`) that keeps a landing body snapping. Retiring the last one is a real behaviour decision — retail makes no player/NPC distinction there — and needs its own live evidence, not a silent convergence. - Register row **AP-135** (the airborne no-op's retained acdream bookkeeping: the server cell id for the free-fall sweep gate, and the last-server-position sample) — **CORRECTED 2026-08-04: this row does NOT retire with 4b.** Its own stated condition is retirement together with the free-fall sweep gate (`RuntimeRemotePhysicsUpdater.cs:342`), which 4b does not touch, and its sites are the airborne no-op branches — 4a-owned dispositions, not 4b's far-snap/teleport/cell-less. The trap is that those two writes sit physically inside `OnPosition`, which 4b rewrites heavily, so an implementer will assume they go. They stay. See [`2026-08-04-c4-route-4b-scoping-and-split.md`](../research/2026-08-04-c4-route-4b-scoping-and-split.md). - **4b is itself split into 4b-1 / 4b-2 / 4b-3** (2026-08-04). Scoping put 4b at 1,300-2,200 production lines — 4-6x route 4a — plus ~2,500-3,500 lines of test work. 4b-1 is infrastructure with no remote behaviour change (the per-entity placement owner, the service-window guard, the refuse-rather-than-park policy, N3's headless `RetryPending` pump); 4b-2 is the far branch alone; 4b-3 is teleport/cell-less and the ~739-line class deletions. 4b-1 stays a separate landing regardless: it is where the park-withdraws-the-entity failure mode is decided, and it must not be reviewed alongside a large deletion. - **4b-2 LANDED at `7f1c1f5a` (2026-08-04); far-snap connected gate USER-PASSED same day.** Four fix rounds, eight Opus reviews; the slice was fully green at 10,990 / 10,997 / 11,004 while containing real defects (a frozen remote pinned as correct by its own test; a fallback that over-wrote on the exact retail paths that decline to store; a park guard incomplete on two independent axes). Final suite 11,009 / 4 / 0 against a **measured** 10,968 baseline — the 10,973 figure used earlier was wrong. Its real yield was a defect under routes 1 and 2, not the far snap: `ParkDeferred`'s quiescence parks withdrew the entity and were never restorable while `Forget(restoreCancelledPark: true)` runs for every accepted Position on every entity. The restorable decision now lives inside `ParkDeferred` after `SnapToCell`, read against every live quiescence. **Still outstanding: #309.** The `ACDREAM_PROBE_PARK=1` capture from the accepting session shows 11 parks, all `cause=unplaceable` — zero quiescence-cause parks, so the shared-core park change is NOT yet connected-verified. Without the probe that session would have been recorded as a pass. **Re-scoped 2026-08-04: #309 is largely superseded by #312 (closed `b1f914d5`, user-passed); what survives is the narrow `GotoLostCell` half — retail keeps a lost-cell object hidden until `reenter_visibility`; acdream re-shows it on cancel. Re-scope before running it.** Process lesson recorded: the round-1 defect was caused by the contract omitting "and still advance the pose", and the park defect should have been split into its own slice the moment it surfaced in round 2 instead of riding inside 4b-2 for three more rounds. Findings chain: [contract](../research/2026-08-04-c4-route-4b-2-contract.md) → [round 1](../research/2026-08-04-c4-route-4b-2-review-findings.md) → [round 2](../research/2026-08-04-c4-route-4b-2-delta-review-findings.md) → [round 3](../research/2026-08-04-c4-route-4b-2-round3-correction.md) → [round 4](../research/2026-08-04-c4-route-4b-2-round4-correction.md). Note the route-4 Create half is ALREADY DONE (C3b/C3c); the remaining work is steady-state remote Position plus the deletions. AP-131 is NOT retired by either sub-slice — see the scoping doc for why route 4 alone cannot. 4a contract: [`2026-08-03-c4-route-4a-contract.md`](../research/2026-08-03-c4-route-4a-contract.md). **Route 2 connected gate PASSED (user, 2026-08-03).** Provoked with the retail `@pklite` entry-collision bump (`69ba9486` — the only reachable ACE trigger for `ObjectForcePosition`; admin teleports advance `ObjectTeleport` and exercise route 3 instead, see [`2026-08-03-c4-route-2-visual-gate.md`](../research/2026-08-03-c4-route-2-visual-gate.md)). The user observed the visible slide off the overlapped character (the ForcePosition applied), correct animation, no heading change, and no leash tethering or rubber-band after the correction — so the two named behaviour changes (ack after commit; no `ConstrainTo` re-arm on this route) are accepted live. Both Opus reviews PASS on the final diff after three FAIL rounds. **Adjacent, NOT a route 2 regression:** shipping `@pklite` made PK Lite reachable for the first time and immediately exposed pre-existing PvP gaps — melee/ranged attacks refuse a PKLite target (auto-target retargets to the nearest other; auto-target off does nothing) while spells on the same target work. Under investigation; filed separately. **Route 2 (ForcePosition) — implemented 2026-08-03, contract:** [`2026-08-03-c4-route-2-contract.md`](../research/2026-08-03-c4-route-2-contract.md), **plan:** [`2026-08-03-c4-route-2-implementation-plan.md`](../research/2026-08-03-c4-route-2-implementation-plan.md). `RuntimeAcceptedPositionDriveController` (`src/AcDream.Runtime/Session/RuntimeAcceptedPositionDriveController.cs`) is the single accepted-Position execution seam for a ForcePosition on the already-live local player; `LocalForcePositionTransaction` and `HeadlessSessionWorldProjection.BlipLocalPlayer` are deleted, and the generic App render-tail is skipped for the local player's ForcePosition. Named behaviour changes (both retail-exact, ISSUES #285): the outbound ack now fires strictly after the canonical commit, and the constraint leash is no longer re-armed on this route (retail's FORCE_POSITION branch never reaches `ConstrainTo`). **Fix round (2026-08-03):** both independent dual reviews (retail- conformance + architecture/adversarial) FAILed the first pass — see [`2026-08-03-c4-route-2-review-findings.md`](../research/2026-08-03-c4-route-2-review-findings.md) for the full R1-R9 list. The critical finding (R1) was that the DeferredCell park could not survive a single ACE broadcast interval in production (`RuntimeEntityObjectLifetime.TryApplyPosition`'s unconditional `Forget` on every accepted Position cancelled it before its collision generation could commit), silently dropping the correction forever; `RuntimeAcceptedPositionDriveController.Advance` now detects the dead watch and re-issues from the entity's current canonical snapshot. R2/R3 restored headless's collision re-centering and login-window fallback; R4 stopped the force-ack from stealing a receipt the presentation sink had legitimately declined; R5/R6/R9 corrected false doc claims, closed a `_pending`-leak/overwrite gap, and fixed streaming-observer/pose-dirty side effects firing on a declined placement. R7 corrected a fixture bug (a dummy Setup sphere with its centre at the origin) that had been written up as a retail fidelity gain; R8 added App-layer double-write source pins and corrected an overclaimed single-ack test. Full detail: [`2026-08-03-c4-route-2-review-findings.md`](../research/2026-08-03-c4-route-2-review-findings.md). Complete Release solution after the fix round: **10,853 passed / 4 skipped / 0 failed** (baseline 10,844/4/0; first pass 10,848/4/0). **Acceptance item 2 is NOT met — recorded gap, B2 (2026-08-03 round 2).** An earlier revision of this paragraph claimed R8 "added the App-layer double-write source pins the plan's own acceptance item required". That was a claim of coverage this changeset does not have, and it is corrected here rather than left as the citation a future session trusts (same rule that produced R7). The truth, per the adversarial review: - *First half — "the generic tail no longer double-writes the local player":* **source-pinned, not proven.** The pin is a regex/`Assert.Single` over `LiveEntityNetworkUpdateController`'s source text, so it would still pass if a second write were spelled differently, and **no test exercises the branch** at runtime. - *Second half — "the committed projection is what moves the render entity":* **uncovered at any layer.** No test drives a route-2 ForcePosition through `RuntimePlacementPresentationSink` / `TryApplyRuntimePlacementPlace` and asserts the `WorldEntity` actually moved. Given R4 (the force-ack no longer consumes a declined `Place`), this is precisely the seam whose failure mode is silent: the canonical body moves and the render entity stays put. Closing this gap needs an App-layer test that runs the accepted ForcePosition end to end and asserts the render entity's position/cell came from the committed placement receipt — carry it into C5's parity tests or file it before this sub-landing closes. **Not yet done:** both reviews must be RE-RUN on this fixed diff, and the connected (user-gated) acceptance gate this campaign's standing discipline requires, before this sub-landing is considered closed — those, and the commit itself, are next. May land as more than one commit if a route proves large; each sub-landing keeps the full review discipline. - **C5 — legacy deletion + closeout gates — OPEN.** Delete every superseded legacy path; parity tests; exact lifecycle/reconnect + canonical nine-stop connected routes; two-client observation; **user visual matrix** (the campaign's stopping point for user acceptance). Retire AP-1, AD-1, AP-131, AD-60's legacy half, and close #275. Update register/roadmap/ milestones/architecture/memory + successor handoff. **Inheritance recorded at C4 closeout (2026-08-05, full detail in [`2026-08-05-c4-closeout-handoff.md`](../research/2026-08-05-c4-closeout-handoff.md)):** the #318 end-to-end portal composition test, whose discriminating assertion is that **`PhysicsEngine.ShadowObjects` holds a row at the destination — not just `LocalPlayerShadowState`'s dedup cache** (AP-145's cache-without-publish asymmetry is why a cache-only assertion is satisfied by the bug); the route-3 C5 sweep candidates (`ILocalPlayerTeleportPlacement` as a thin acknowledge seam; the test-only `BeginAcceptedPlacement`/ `BeginAuthoredPlacement` wrappers); #276's settle-cell remainder and #277's trigger-conditioned conversion; #316's measure-before-fix, #317's velocity-chain audit, #313, and #309's re-scoped narrow half; the cell-less live-trigger investigation (owed gate 4); and the TEMPORARY physics probe family strip (`REMOTE_LANDING`/`REMOTE_SLIDE`/`PARK`/ `REMOTE_TELEPORT`/`CHILD_CELL`/`LOCAL_TELEPORT`) — after, never before, the four owed gates consume them. **#280's connected gate rides this matrix (added 2026-08-05).** Release, `ACDREAM_RETAIL_UI=1`, `ACDREAM_STREAM_RADIUS` **UNSET** (it forces `NearRadius` and only raises `FarRadius`, so a run with it set measures a different window than production). Run the route TWICE on the same binary — once with `ACDREAM_PROBE_REVEAL_RADIUS=1` (reproduces the pre-#280 gate) and once without — and report BOTH. The user-facing observable is an ABSENCE, so the pass criteria are three positive artifacts per stop, all from existing machinery: (1) a `world-visible` checkpoint JSON whose `StreamingWork.NearBacklog` / `.FarBacklog` / `.DestinationBacklog` / `.PendingPublications` are zero for the destination window at the moment the viewport opened; (2) a hold-duration pair — **the post-fix hold is EXPECTED to be LONGER**, and a hold that is not longer means the gate did not widen and the run proves nothing; (3) a paired screenshot per stop, where the pre-fix run is the one that shows the defect. `wait world-visible 30000` in `tools/connected-world-lifecycle.route.txt` is the convergence ceiling — a trip is a failure, a longer pass is not. **The reported repro was a RECALL, not `/teleloc`: the matrix needs a lifestone/recall leg**, and it must include a first-login stop, because login shares the same barrier and its gate widened too. After C5: ~~AP-22~~ (RETIRED 2026-08-06, bc4679cd) and ~~AD-10~~ (RETIRED 2026-08-06 by deletion, 886333a2) are both DONE. Historical text follows. After C5: AP-22 (authored collision shapes), then AD-10 (remote contact-plane projection), then the campaign's final matrix and ledger closeout; vendor Slice 5 resumes.