acdream/docs/plans/2026-08-02-placement-cutover.md

Placement production cutover — campaign plan (2026-08-02)

✅ CAMPAIGN LEDGER CLOSED — 2026-08-06, by user direction

Every slice is landed and dual-reviewed: C0–C4, C5a, C5b (#275; retired AP-131 + AD-60's legacy half), #280 (portal destination prefetch, user-accepted at its connected gate), #276's remainder, AP-22 and AD-10 (both retired). #309 was accepted as a standing divergence rather than fixed. Final gate: complete Release suite from a clean build, 11,196 passed / 4 skipped / 0 failed — campaign net +90 from 11,106.

The ledger closes with connected gates outstanding, by user direction — not because they were discharged. Only #280's reveal gate was run and passed. D-1's two reachability scenarios, AP-136's six-step park protocol, route-7 thickening, the two-client observation, the nine-stop soak and the lifecycle/reconnect route were NOT RUN; the probe family is deliberately NOT stripped for that reason. Anyone citing "the campaign passed" must cite §2.6 of the closeout alongside it: 2026-08-06-c5c-closeout-handoff.md.

Follow-ups generated and filed rather than folded in: #325, #330, #331, #332, AP-149, AP-152, AD-65, AD-66. Start with #331.

The final leg of the remaining physics-divergence campaign before AP-22 and AD-10: route graphical AND headless production placement through the residence + continuation-executor owner (38fd4b8d / 30012361 / 5db3de3c), delete the legacy duplicate authorities, and retire AP-1/AD-1 behind connected + user-visual gates.

Handoff checkpoint — 2026-08-03

Status: stabilization checkpoint accepted; campaign closeout is not yet complete. The C3c production cutover and the O(changed) collision publication checkpoint are now playable after five separately committed root-cause fixes:

• 01f4791e stops origin recenter from manufacturing and replaying a second retirement receipt for a pending-only live-projection bucket. Its exact binary passed the complete Release suite, lifecycle route, and canonical nine-stop soak (connected-r6-soak-20260802-204309, nine stops, zero failures/wait cues/pending retirements).
• 670f307c keeps remote Create placement, the local-player physics host, targeting, chasing, and attacks in the same world-coordinate frame. The user accepted monster placement/chase/hit behavior and static placement after portals.
• 1fc529cd materializes the canonical minimal static physics host before a distant Use/MoveTo route and reconciles the pre-PartArray startup motion suffix. The user accepted near and distant object use.
• f24532ad defers one-shot F754/F755 effects until canonical placement has bound presentation, retries projectile/static-animation sidecars on the committed visibility edge, and keeps effect cells synchronized. The user accepted buffs, recalls, arrows, combat spell projectiles, portals, and static animation.
• 175ad6b0 sends LoginComplete from the local first-placement terminal edge instead of raw PlayerCreate receipt, so ACE's intentional login Hidden/ materialization state cannot race placement. The user accepted the login haze behavior.

Focused verification after the final fix passed 90 App effect/projectile/ static-scheduler tests, two Runtime login tests, the exact live-entity cell tracking regression, all 79 Headless tests, and the Release solution build with zero errors. The long connected soak and complete solution suite have not been rerun on the final 175ad6b0 binary. A broader selected fixture run also exposed five LiveEntityRuntimeTests failures tied to the still-open placement cutover plus one old remote first-entry fixture that supplies an empty collision source; classify and fix those before claiming C5 closure. Resolved 2026-08-03 as #281 (DONE): the "six selected fixture failures" figure was itself a mis-measurement — the measured baseline found 43 (28 App broken by 670f307c, 2 more by f24532ad, 13 Runtime) — repaired without weakening assertions (6dcb94ac, 98e9f9e8 and the recent-regression cleanup closed at 2ef02f8c); every later checkpoint's complete suite ran 0-failed.

Remaining campaign work, in order:

1. Reproduce and repair the six fixture failures without weakening their assertions or adding compatibility bypasses. DONE 2026-08-03 (#281 — the real count was 43; see the correction above).
2. Finish C4's routes 2–7 and remove their legacy placement writers; fold in #276 and #277 where their route becomes authoritative. DONE 2026-08-05 except the four owed connected gates (see the C4 slice below). #276 was folded only PARTIALLY — route 5 closed its projectile half; the SpawnPlacementSettler settle-cell discard remains OPEN. #277 was NOT folded: no streaming/broadcast radius changed, so its service-window conversion remains a trigger-conditioned carry, not a completed item.
3. Resolve #280 with retail's configured destination-prefetch window so the portal viewport never reveals visibly constructing far terrain. DONE 2026-08-05 (implementation + suite); the connected/visual gate is batched into C5's matrix. Shape correction: retail has NO separate prefetch window — it has one landscape square (LScape::mid_radius) that is simultaneously the loaded, drawn and blocked-on set, and whose configured value is Render.LandscapeDrawDistance. acdream now derives its reveal window from the live streaming radii (QualitySettings.FarRadius) and made the render-completeness predicate tier-aware so the outer rings can satisfy it. Contract: 2026-08-05-280-contract.md. Residual filed as AP-149; the missing user-facing Viewing Distance option is filed separately as #326 and is explicitly NOT part of #280.
4. Run C5's complete Release suite, lifecycle/reconnect route, latest-binary nine-stop soak, two-client observation, and the remaining #269 slope-glide visual check. A pass from 01f4791e is evidence for that fix, not a substitute for the final-binary soak. Correction 2026-08-05: #269 was already closed and user-accepted 2026-07-31 (before this plan was written); the surviving visual item is #278(b)'s lateral-glide comparison, not #269.
5. Delete the superseded paths, retire AP-1/AD-1/AP-131 and AD-60's legacy half only when the code proves they are gone, then complete AP-22 and AD-10 and close the campaign ledger. DONE except the ledger close, 2026-08-05/06. AP-1/AD-1 retired at C5a (6921a027); AP-131 and AD-60's legacy half at C5b (735f0a72); AP-22 retired at bc4679cd (all three invented-cylinder copies deleted — the row listed one; reachability proved zero over all 5,935 installed Setups by four independent decoders); AD-10 retired by deletion at 886333a2 (its stated justification was false at HEAD — remotes DO run the sweep, so the projection was an extra non-retail layer, measured bit-identical when removed). Both dual-reviewed, both lenses PASS. Remaining: C5c's gates and the ledger close. Two new divergences were filed out of AD-10's work (AD-65, AD-66) and two issues (#331 uphill-resolve blockage, #332 headless remote dead-reckoning).

Inputs (read in order):

1. 2026-08-02-runtime-continuation-executor-handoff.md — the completed dormant mechanism and its cutover notes.
2. 2026-08-02-cutover-route-inventory.md — the full 8-route, both-host call-chain inventory with exact file:line for every duplicate authority to remove. THE map for all slices below.
3. 2026-07-31-remaining-physics-campaign-handoff.md — the original per-route requirements and prerequisite definitions.

Standing discipline per slice: pinned contract → single implementer → independent retail-conformance + architecture/adversarial reviews (both must PASS on the final diff) → focused + complete Runtime + Release build + complete solution gates → bisectable behavior commit (register rows in the same commit) → docs/handoff commit. No workarounds; no fused slices.

Confirmed pre-cutover gaps (from the inventory)

• The executor publishes only generic entity deltas; nothing bridges its completion to RuntimePlacementProjectionChannel, so no host can learn "my initial placement committed" through the built observer seam.
• No atomic controller/body publication owner exists (prerequisite C); App and headless hand-write divergent PlayerMovementController construction, and SubmitPreparedPlacement requires a canonical PhysicsBody that nothing currently publishes atomically.
• The dormant placement path's 1,880 B/operation (2,048 cap) allocation remains the activation blocker for frame-frequency routes.
• Execute's live inputs (UsePositionFromServer, PlayerDistance) are computed by no host; they must derive from Runtime's own character-option and local-player owners.
• RuntimePortalPlacementAuthority has zero producing call sites; the adapter from RuntimeWorldTransitState does not exist. Corrected 2026-08-04 (C4 route 3 closure, docs/research/2026-08-04-c4-route-3-contract.md), itself corrected 2026-08-05 (A10 architecture review — the first correction asserted a false fact of its own), and rewritten 2026-08-05 (N5 retail-review round-3 fix — the prior wording of this correction contradicted itself). The original bullet conflated two separate claims into one sentence, and only one of them was true. What pre-dated route 3 and WAS accurate: the RuntimePortalPlacementAuthority type existed (referenced by route 2's Pending.Portal field, always Present: false), its IsValid check existed, and the sinks' portal-authority gates plus BeginAcceptedPlacementCore's gate already read it. What was NOT accurate, and is what "zero producing call sites; the adapter does not exist" actually described: the PRODUCER half — nothing built a Present: true authority and called the consumer arm (RuntimeAcceptedPositionDriveController.TryExecuteAcceptedPortalArrival/ SubmitAndResolvePortal/ClassifyPortalArrival) — that consumer arm ALSO did not exist before route 3. Route 3 added the producer and the consumer together, in the same slice: the producer is LocalPlayerTeleportController.TryExecuteCanonicalPortalPlacement (now TryAdvancePortalCommit/TryExecuteCanonicalPortalPlacementCore, per the 2026-08-05 A1 review fix), which builds the authority from WorldRevealCoordinator/RuntimeWorldTransitState facts and calls TryExecuteAcceptedPortalArrival; the identical Runtime entry point is shared by the headless host. So: the type/IsValid/consumer-gate facts pre-dated route 3 and were true before it; the arm (both the producer that builds a live authority and the consumer that reads one) did not exist before route 3 and is what the original bullet's "zero producing call sites" language was pointing at.
• The exact-Setup mover chain (PrepareMover / RuntimeSetPositionMoverPreparer.TryBuild / IPreparedCollisionSource.ReadSetupCollision) exists piecewise, unwired.
• Corrected 2026-08-04 (C4 route 6 closure, docs/research/2026-08-04-c4-route-6-contract.md): all three clauses above were stale. Route-6 split-recovery does NOT need an effect-replay suppression signal — that premise was unsubstantiated; acdream's only create-time effect replay is the F754/F755 queue drain keyed by server GUID, and the one plausible mechanism (a cloned DefaultScriptType surviving BuildSpawn) never fires at create in either client (CPhysicsObj::play_default_script @0x005132B0/@0x00513300 has exactly two callers, both animation hooks, verified against acclient_2013_pseudo_c.txt). Route-7's TryCommitParent/ CommitWithdrawal cancellation-symmetry fixes and host-visible cancellation receipts were BOTH closed at C0 (see the C0 slice below). What actually remained for route 7: the child's canonical cell had two writers (Runtime committed it cell-less unconditionally in CommitAcceptedParentCellless, while EquippedChildRenderController .TickChild re-celled it from a per-frame render tick), and headless had no EquippedChildRenderController at all, so every headless parented child stayed cell-less forever — the same defect seen from two sides, not two separate gaps. Closed 2026-08-04 (docs/research/2026-08-04-c4-route-7-contract.md). Runtime is now the sole canonical writer: CommitAcceptedParentCellless completes retail set_parent's attach-time re-cell (D1), and every canonical cell write funnels through one directory chokepoint that recursively propagates to committed children on every parent cell crossing (D2 — docs/research/2026-08-04-retail-parent-cell-propagation.md), not only at attach. TickChild is demoted to a presentation-only draw-bucket move (D4); the headless host gained its own parent-realize drive running the same commit pair the graphical host does (D5, RuntimeLiveEntitySessionController.OnParentUpdated). The direct headless regression test (a bot with an equipped item shows the child's canonical FullCellId equal to the parent's) now passes.

Slices

• C0 — Runtime bridge + live inputs — COMPLETE at 67f63e85 (2026-08-02, dual reviews PASS). The executor publishes an acknowledge-only ExecutorCompleted receipt through the one placement stream (registered before dispatch; correlation reaped on acknowledgement/discard/clear; PendingCompletionReceiptCount in IsConverged); all three production sinks acknowledge-and-ignore the kind via early returns proven behavior-preserving for every other kind (sanctioned seam completion — provably inert, no production publisher); UsePositionFromServer derives retail-exactly from RuntimeCharacterState.AutonomyLevel != 2 and PlayerDistance from the live movement controller with null-safe fallback to the caller struct; TryPrepareAndSubmitAuthoredPlacement chains the prepared-collision Setup read through PrepareMover to submission with zero validation changes; TryCommitParent/CommitWithdrawal gained the sibling cancellation flow (the LeaveWorld omission in TryCommitParent is retail-REQUIRED per set_parent 0x00515A90:283832-283833's single gated leave_world). Not fully dormant by design: the two cancellation fixes change live Runtime paths production already calls; everything else has no production caller. C3 prerequisites recorded from C0's reviews: (a) the completion receipt/trace surface is internal-only — C3 must define the public host consumption shape when it wires the hosts; (b) PlayerDistance is resolved once per Execute entry, not per continuation — a multi-Position FIFO classifies later entries against entry-time distance (documented deferral; refine at C3/C4 if the connected gates show it matters); (c) any future host exposure of TrySetAutonomyLevel must carry retail's SendAutonomyLevelEvent (699550).

• C1 — atomic controller/body publication — SATISFIED BY EXISTING MECHANISM (research finding 2026-08-02, plan amended same session). RuntimeLocalPlayerPhysicsPublicationState (1,033 lines) plus the ~15-method dormant local-activation family on RuntimeSetPositionState already implement the full sanctioned option-2 transaction: off-canonical preparation against a scratch quantum clock and a sealed candidate controller, one validated atomic Commit, and a staged Evaluate/Commit/FinalizeActivation chain re-validated against PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session identity at every entry — with zero production callers. See 2026-08-02-canonical-body-writer-map.md (6 canonical body writers; the two host escape hatches; both hosts' divergences). The remaining work — routing both hosts' local-player construction through the publication lifecycle, sealing the public RuntimeLocalPlayerMovementState.Controller setter, retiring App's direct object-clock bypasses, and containing headless's uncaught prepared-collision InvalidDataException — IS the C3 route-1 flip and moves there. No separate C1 commit.

• C2 — placement allocation budget — COMPLETE at 63c601ff (2026-08-02, dual reviews PASS after two fix rounds). 2,032 → 944 B/op via pooled operation envelopes (bounded, reset-at-rent, double- retire guarded, reset/dispose-cleared, ledger-visible), a cached collision-callback delegate over an explicit context stack, and a non-boxing pending-head read; gate tightened to 1,536. The pooling forced a class-wide staleness rework: captured-token-vs-fresh-lookup at every reentrancy-spanning frame (26-site audit), hoisted stack locals for retail's handle_all_collisions bits, token-gated bookkeeping writes, and a deliberately identity-agnostic settle path (retail's SetPositionInternal completes unconditionally even for displaced operations). Residual floor (documented at the gate, decision deferred to the C3 activation gate where the user is in the loop): ~520 B/op inside Core's PhysicsEngine.SetPosition (transition init / query-footprint materialization — a potential C2b if C3's connected profile shows it matters) and ~208 B/op of sorted-tree node per pending receipt. Maintenance notes from review (no action): the no-reentrancy proofs on the 15 surviving reference-based currency checks are comment-enforced; IsCurrent(Operation) remains available and a new reentrancy-spanning call site would silently inherit the tautology — its doc comment warns.

• C3 — spawn-frequency cutover: routes 1 + 8 — DECOMPOSED 2026-08-02 after the first implementation pass stopped with findings. C3-1 (the public executor-completion surface via RuntimePlacementProjectionChannel.TryGetInitialCreateCompletion) landed separately. Two structural gaps halted the flip, both real and neither in the planning docs: (B) the local player's residence lease opens its SetPosition operation at Create time, but SubmitPreparedPlacementCore requires a pre-existing canonical body that only the zero-caller publication chain can attach — first-entry needs an explicit resumable sequence (begin-placement → publication Prepare/Commit attaches the body → authored-mover submit → Place receipt → Execute), which matches the campaign handoff's route-1 required order but exists nowhere as a driveable state machine; (C) ordinary remote-creature Creates classify to SetPosition but have NO production body-construction path at Create time (bodies arrive with first motion today; retail constructs physics at CreateObject via ACCObjectMaint::CreateObject/set_description, which our retail notes fully document — the defaults come from the wire PhysicsDesc, not invention). Sub-slices, each with the standing contract/dual-review/gate discipline:

  • C3a — Runtime first-entry sequencing — COMPLETE at 960373df (2026-08-02, dual reviews PASS). RuntimeLocalPlayerFirstEntryState: five stages (mover-prep → publication Prepare/Commit → activation → acknowledgement → Execute) in retail's own order — mover shapes BEFORE placement, matching makeObject/set_description preceding enter_world; the original contract prose had it backwards and the tested preconditions forced the faithful order. Acknowledge-stage authority discrimination, automatic convergence through the (now multicast, snapshot-iterated) retirement fan-out, ownership-ledger fold, transactional late-bind Publication seam. Dormant: C3c's first act is the GameRuntime binding + production Advance drive. Carried findings for C3c: the controller is live from the activation commit onward (abandonment leaves it to ordinary entity teardown — retail has no entry-flow rollback); EvaluateActivation's post-commit DeferredCell overload is encapsulated behind Advance.
  • C3b — remote body construction at Create — COMPLETE at 0934a121 (2026-08-02, dual reviews PASS). RuntimeRemoteBodyDescription + RuntimeRemoteFirstEntryState: the full set_description order with the byte-certain gates (friction [0,1] inclusive, NaN sanctioned-skip; elasticity clamp with retail's unordered-to-zero; translucency != 0.0f), the movement-branch discriminator on retail's movement_buffer != 0 (empty-buffer → placement branch, no autonomy), motion-table zero-id pass, ctor-defaults for absent wire fields, and never-clobber coexistence with the build-at-first-motion production path. The acknowledge discriminator is one shared body (RuntimeFirstEntryAcknowledgement) for both conductors. Dormant.
  • C3c — the host flips (production) — COMPLETE at 529e0e9d (2026-08-02, dual Opus reviews: initial FAIL 2+2 MAJOR → R1 fix round → delta PASS both). Both hosts register initial Creates through residence + conductors via the shared RuntimeFirstEntryDriveController; Controller setter sealed; rebucketing presentation-only strictly while the residence is ACTIVE (post-residence entities take the full legacy path including the prepare_to_enter_world clock edges); content-less headless keeps pre-flip direct registration. Five fix slices landed inside the cutover, each connected-gated: F1 (Runtime ownership seam for movement stats/server physics — the post-logout retired-controller crash), F2 (the login activation wedge: admission-prefix gate factored from the seal, rearm generation identity, auto-entry requires the published controller), F3 (landblock-prefix 0-sentinel → explicit absent-id; corner landblocks legal), F4 (diagnosis only: the nine-stop soak's convergence failure is pre-existing 6b28ff99 whole-world collision-clone throughput — its fix is the next slice before C5), F5 (local-player first-entry ground contact via the shared SpawnPlacementSettler at FinalizeActivation; the standing-cast airborne rejections are gone; register AD-61). R1 additionally armed the login constraint leash at the committed placement (HandleReceivedPosition 0x00453FD0 analog) and refreshed AD-42. Final gates: complete solution 10,816/0/4 skips; lifecycle/reconnect gate PASS (connected-world-gate-20260802- 175401). Closeout: 2026-08-02-c3c-cutover-closeout.md. Carried to C4/C5: route-1 far-Create service-window conversion if either streaming/broadcast radius changes (#277); the window-departure park narrowing; NotifyRetirement-on-active-entry subscriber invariant; the reachable equip-mid-conductor fail-fast; settle-CellId discard (#276-adjacent, see ISSUES).

• C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the RuntimeWorldTransitState → RuntimePortalPlacementAuthority adapter), 4 (remote Create/Position; delete RemoteTeleportController/Placement and the inline MoveOrTeleport duplicate), 5 (projectile authoritative), 6 (drops + split-recovery marking), 7 (residual pickup/parent/delete polish). — route 2 COMPLETE AND USER-ACCEPTED 2026-08-03 (9966b531); routes 3/4/5/6/7 remain OPEN.

  C4 IMPLEMENTATION COMPLETE 2026-08-05. Every route now places through the canonical Runtime owner; the campaign's remaining C4 debt is exactly the four owed connected gates listed at the end of this bullet. Per-route record (each with contract + independent dual reviews per the standing discipline; suite counts measured, never inherited — final complete Release suite 11,090 passed / 4 skipped / 0 failed at e0f96a55):

  • 4a LANDED 44830a0e; 4b-1 LANDED 2e8e09ac (dormant infrastructure); 4b-2 LANDED 7f1c1f5a (recorded in the sub-bullets below with its four fix rounds and user-passed far-snap gate).

  • 4b-3 LANDED 6dc7ba51 (2026-08-04) — remote teleport + cell-less through the canonical placement; RemoteTeleportController (605 lines), RemoteTeleportPlacement (85), and ~1,709 test lines deleted. Dual round 1 FAIL/FAIL → round 2 delta PASS/PASS; three NPC-arm MAJORs closed. Connected gate PASSED-partial (21cd6e9b): 16 [remote-teleport] probe lines over 7 creatures, all cause=teleport-ts — cause=cellless was never observed and remains test-covered only (owed gate 4 below). Docs at 8c269ad1; findings chain in 2026-08-04-c4-route-4b-3-*.md.

  • Route 5 LANDED 36255af0 (2026-08-04) — projectile authoritative placement (#276 partial), preceded by a mandatory byte-decode gate (MoveOrTeleport @0x00516330 never reads its velocity argument, which also spawned #317). Three dual review rounds closing 8 MAJORs; round 3 retail PASS with the AP-141 risk-column retraction (C1), architecture FAIL on a coverage-only C1 closed in-commit with two sabotage-verified retry-arm tests. NO connected gate exists for this route, by design — ACE never sends a missile UpdatePosition (WorldObject_Tick.cs:333-334); every proof is deterministic-test-gated and recorded as such. Interim landings alongside: the OnPosition dual-tail collapse (edc911b0, whose scoping found and filed #316), #315 closed (aaf0811f), #314 closed (daef7c98).

  • Route 6 CLOSED 1b484937 (2026-08-04) with ZERO production lines — C3c had already flipped both drop flavours onto the canonical create transaction; the landing is 7 sabotage-verified coverage tests, the retail split-marking record (#313 filed for the DeclareValid selection transfer), and the correction of this plan's own false effect-replay premise (see the corrected gap list above). Its coverage tests immediately found #314 (split recovery threw on retained timestamps), fixed in its own commit daef7c98. Connected gate owed (drops recipe — owed gate 1 below).

  • Route 7 LANDED cd3129e9 (2026-08-04) — child cell propagation moved from a render tick into Runtime: retail set_parent's attach-time re-cell completed in CommitAcceptedParentCellless, the recursive parent-cell-crossing propagation at the one directory funnel (iterative worklist — the initial depth-64 cap was deleted after both round-2 reviews independently found its truncation residue was the #184 shape), TickChild demoted to presentation-only, the headless parent-realize drive added (its direct regression test failed before this work), and the dead ClassifyLeaveWorld family deleted. Dual round 1 FAIL/FAIL → round 2 delta PASS/PASS plus a coordinator-required third pass; 5 MAJORs. AP-142/AP-143 filed. Connected gate owed (equip/carry with cause=propagate probe evidence — owed gate 2 below). Route 7 also INVALIDATED 4b-3's recorded cell-less live recipe (contract §11; the supersession note is appended to the 4b-3 contract).

  • Route 3 LANDED e0f96a55 (2026-08-05) — the LAST route: the first production RuntimePortalPlacementAuthority producer, the portal arm on route 2's drive controller, CommitCanonicalTeleportFrame with the PlayerTeleported port (autorun cancel + one movement event), and both duplicate authorities deleted (LocalPlayerTeleportPlacement.Place, ResynchronizeLocalPlayerForPortalArrival — AD-42's row deleted with them). Contract at 19ebf043; scoping/propagation research at ca96ea5e. Dual round 1 FAIL/FAIL → dual round 2 FAIL/FAIL (near miss) → round-3 fix pass accepted per both round-2 reviews' explicit pass conditions; the round-3 record is the commit message plus #318 and AP-144/AP-145 (no standalone round-3 review doc). The fix pass's refusal to accept 7 skipped tests uncovered a real production bug (the canonical portal arm was 100% dead code — the accepted-destination slot it re-read at Place time was already consumed at Aim time). Connected gate owed (portal/recall with [local-tp] probe evidence — owed gate 3 below — and explicitly NOT scored as covering #318).

  • The four owed connected gates, with recipes and pass criteria in 2026-08-05-c4-closeout-handoff.md: (1) route 6 drops; (2) route 7 equip/carry across landblock boundaries, counted only with [child-cell] cause=propagate lines; (3) route 3 portal/recall, counted only with [local-tp] lines, not scored against #318; (4) 4b-3's cause=cellless case, whose recorded trigger route 7 invalidated — the replacement provocation is UNESTABLISHED and needs its own investigation. None has been run. Route 4 SPLIT into 4a and 4b (user-directed 2026-08-03). Scoping (2026-08-03-c4-route-4-scoping.md) put whole-route 4 at 1,500-2,500 production lines against a stated ~400 budget, so it is split to keep each landing reviewable:

  • 4a — the steady state. The classifier's Interpolate (contact, PlayerDistance < 96 m) and NoPositionOperation (no contact) branches. NEITHER runs a SetPosition, so 4a has no deferred-cell park, no service-window work, and no placement-allocation exposure. Fixes two of the three unfiled divergences (the NPC airborne hard-snap that ignores the wire IsGrounded bit; ConstrainTo armed before the operation instead of after). Highest visible value — this is what makes creatures move smoothly.

  • 4b — the edges. SetPosition / SetPositionSimple: teleport, far-snap (>= 96 m), and cell-less first placement. This is where the parks, the Position-time service-window guard, #277's broken bound, N3 (headless never calls RetryPending), and the third divergence (ConstrainTo never armed on the remote teleport branch) all live.

    4b also inherits 4a's ownership remainder — scheduled here, not implied by code comments. Two independent reviews flagged that 4a satisfies contract items 1 and 2 only partially, and the plan must carry that rather than leaving it in // 4b deletes this fallback comments:

    • Runtime owns the classification, the request construction (one shared builder, RuntimeAcceptedPositionRouteRequests), the near-InterpolateTo decision with AP-87, and the post-operation ConstrainTo. App still owns branch selection, the airborne early return, the RemoteMotion.CellId write, the WorldEntity pose write, and the collision-shadow publish — all in LiveEntityNetworkUpdateController.
    • Item 2 ("both hosts drive the identical Runtime entry point") is satisfied only VACUOUSLY: RuntimeLiveEntitySessionController returns early for remotes, so no no-window host exercises this path at all and nothing can diverge yet. That stops being true the moment a headless host needs remote motion.
    • Every legacy fallback 4a deliberately left in place is 4b's to delete: the pre-operation unconditional ConstrainTo, the player arm's !update.IsGrounded no-op, the player and NPC legacy near/far routing (each still carrying its own duplicate 96f / 4f constants), and the airborne-precedence carve-out (LiveEntityNetworkUpdateController.ApplyRemoteContactRouting) that keeps a landing body snapping. Retiring the last one is a real behaviour decision — retail makes no player/NPC distinction there — and needs its own live evidence, not a silent convergence.
    • Register row AP-135 (the airborne no-op's retained acdream bookkeeping: the server cell id for the free-fall sweep gate, and the last-server-position sample) — CORRECTED 2026-08-04: this row does NOT retire with 4b. Its own stated condition is retirement together with the free-fall sweep gate (RuntimeRemotePhysicsUpdater.cs:342), which 4b does not touch, and its sites are the airborne no-op branches — 4a-owned dispositions, not 4b's far-snap/teleport/cell-less. The trap is that those two writes sit physically inside OnPosition, which 4b rewrites heavily, so an implementer will assume they go. They stay. See 2026-08-04-c4-route-4b-scoping-and-split.md.
    • 4b is itself split into 4b-1 / 4b-2 / 4b-3 (2026-08-04). Scoping put 4b at 1,300-2,200 production lines — 4-6x route 4a — plus ~2,500-3,500 lines of test work. 4b-1 is infrastructure with no remote behaviour change (the per-entity placement owner, the service-window guard, the refuse-rather-than-park policy, N3's headless RetryPending pump); 4b-2 is the far branch alone; 4b-3 is teleport/cell-less and the ~739-line class deletions. 4b-1 stays a separate landing regardless: it is where the park-withdraws-the-entity failure mode is decided, and it must not be reviewed alongside a large deletion.
    • 4b-2 LANDED at 7f1c1f5a (2026-08-04); far-snap connected gate USER-PASSED same day. Four fix rounds, eight Opus reviews; the slice was fully green at 10,990 / 10,997 / 11,004 while containing real defects (a frozen remote pinned as correct by its own test; a fallback that over-wrote on the exact retail paths that decline to store; a park guard incomplete on two independent axes). Final suite 11,009 / 4 / 0 against a measured 10,968 baseline — the 10,973 figure used earlier was wrong. Its real yield was a defect under routes 1 and 2, not the far snap: ParkDeferred's quiescence parks withdrew the entity and were never restorable while Forget(restoreCancelledPark: true) runs for every accepted Position on every entity. The restorable decision now lives inside ParkDeferred after SnapToCell, read against every live quiescence. Still outstanding: #309. The ACDREAM_PROBE_PARK=1 capture from the accepting session shows 11 parks, all cause=unplaceable — zero quiescence-cause parks, so the shared-core park change is NOT yet connected-verified. Without the probe that session would have been recorded as a pass. Re-scoped 2026-08-04: #309 is largely superseded by #312 (closed b1f914d5, user-passed); what survives is the narrow GotoLostCell half — retail keeps a lost-cell object hidden until reenter_visibility; acdream re-shows it on cancel. Re-scope before running it. Process lesson recorded: the round-1 defect was caused by the contract omitting "and still advance the pose", and the park defect should have been split into its own slice the moment it surfaced in round 2 instead of riding inside 4b-2 for three more rounds. Findings chain: contract → round 1 → round 2 → round 3 → round 4. Note the route-4 Create half is ALREADY DONE (C3b/C3c); the remaining work is steady-state remote Position plus the deletions. AP-131 is NOT retired by either sub-slice — see the scoping doc for why route 4 alone cannot. 4a contract: 2026-08-03-c4-route-4a-contract.md. Route 2 connected gate PASSED (user, 2026-08-03). Provoked with the retail @pklite entry-collision bump (69ba9486 — the only reachable ACE trigger for ObjectForcePosition; admin teleports advance ObjectTeleport and exercise route 3 instead, see 2026-08-03-c4-route-2-visual-gate.md). The user observed the visible slide off the overlapped character (the ForcePosition applied), correct animation, no heading change, and no leash tethering or rubber-band after the correction — so the two named behaviour changes (ack after commit; no ConstrainTo re-arm on this route) are accepted live. Both Opus reviews PASS on the final diff after three FAIL rounds. Adjacent, NOT a route 2 regression: shipping @pklite made PK Lite reachable for the first time and immediately exposed pre-existing PvP gaps — melee/ranged attacks refuse a PKLite target (auto-target retargets to the nearest other; auto-target off does nothing) while spells on the same target work. Under investigation; filed separately. Route 2 (ForcePosition) — implemented 2026-08-03, contract: 2026-08-03-c4-route-2-contract.md, plan: 2026-08-03-c4-route-2-implementation-plan.md. RuntimeAcceptedPositionDriveController (src/AcDream.Runtime/Session/RuntimeAcceptedPositionDriveController.cs) is the single accepted-Position execution seam for a ForcePosition on the already-live local player; LocalForcePositionTransaction and HeadlessSessionWorldProjection.BlipLocalPlayer are deleted, and the generic App render-tail is skipped for the local player's ForcePosition. Named behaviour changes (both retail-exact, ISSUES #285): the outbound ack now fires strictly after the canonical commit, and the constraint leash is no longer re-armed on this route (retail's FORCE_POSITION branch never reaches ConstrainTo). Fix round (2026-08-03): both independent dual reviews (retail- conformance + architecture/adversarial) FAILed the first pass — see 2026-08-03-c4-route-2-review-findings.md for the full R1-R9 list. The critical finding (R1) was that the DeferredCell park could not survive a single ACE broadcast interval in production (RuntimeEntityObjectLifetime.TryApplyPosition's unconditional Forget on every accepted Position cancelled it before its collision generation could commit), silently dropping the correction forever; RuntimeAcceptedPositionDriveController.Advance now detects the dead watch and re-issues from the entity's current canonical snapshot. R2/R3 restored headless's collision re-centering and login-window fallback; R4 stopped the force-ack from stealing a receipt the presentation sink had legitimately declined; R5/R6/R9 corrected false doc claims, closed a _pending-leak/overwrite gap, and fixed streaming-observer/pose-dirty side effects firing on a declined placement. R7 corrected a fixture bug (a dummy Setup sphere with its centre at the origin) that had been written up as a retail fidelity gain; R8 added App-layer double-write source pins and corrected an overclaimed single-ack test. Full detail: 2026-08-03-c4-route-2-review-findings.md. Complete Release solution after the fix round: 10,853 passed / 4 skipped / 0 failed (baseline 10,844/4/0; first pass 10,848/4/0).

  Acceptance item 2 is NOT met — recorded gap, B2 (2026-08-03 round 2). An earlier revision of this paragraph claimed R8 "added the App-layer double-write source pins the plan's own acceptance item required". That was a claim of coverage this changeset does not have, and it is corrected here rather than left as the citation a future session trusts (same rule that produced R7). The truth, per the adversarial review:

  • First half — "the generic tail no longer double-writes the local player": source-pinned, not proven. The pin is a regex/Assert.Single over LiveEntityNetworkUpdateController's source text, so it would still pass if a second write were spelled differently, and no test exercises the branch at runtime.
  • Second half — "the committed projection is what moves the render entity": uncovered at any layer. No test drives a route-2 ForcePosition through RuntimePlacementPresentationSink / TryApplyRuntimePlacementPlace and asserts the WorldEntity actually moved. Given R4 (the force-ack no longer consumes a declined Place), this is precisely the seam whose failure mode is silent: the canonical body moves and the render entity stays put. Closing this gap needs an App-layer test that runs the accepted ForcePosition end to end and asserts the render entity's position/cell came from the committed placement receipt — carry it into C5's parity tests or file it before this sub-landing closes. Not yet done: both reviews must be RE-RUN on this fixed diff, and the connected (user-gated) acceptance gate this campaign's standing discipline requires, before this sub-landing is considered closed — those, and the commit itself, are next. May land as more than one commit if a route proves large; each sub-landing keeps the full review discipline.

• C5 — legacy deletion + closeout gates — OPEN. Delete every superseded legacy path; parity tests; exact lifecycle/reconnect + canonical nine-stop connected routes; two-client observation; user visual matrix (the campaign's stopping point for user acceptance). Retire AP-1, AD-1, AP-131, AD-60's legacy half, and close #275. Update register/roadmap/ milestones/architecture/memory + successor handoff. Inheritance recorded at C4 closeout (2026-08-05, full detail in 2026-08-05-c4-closeout-handoff.md): the #318 end-to-end portal composition test, whose discriminating assertion is that PhysicsEngine.ShadowObjects holds a row at the destination — not just LocalPlayerShadowState's dedup cache (AP-145's cache-without-publish asymmetry is why a cache-only assertion is satisfied by the bug); the route-3 C5 sweep candidates (ILocalPlayerTeleportPlacement as a thin acknowledge seam; the test-only BeginAcceptedPlacement/ BeginAuthoredPlacement wrappers); #276's settle-cell remainder and #277's trigger-conditioned conversion; #316's measure-before-fix, #317's velocity-chain audit, #313, and #309's re-scoped narrow half; the cell-less live-trigger investigation (owed gate 4); and the TEMPORARY physics probe family strip (REMOTE_LANDING/REMOTE_SLIDE/PARK/ REMOTE_TELEPORT/CHILD_CELL/LOCAL_TELEPORT) — after, never before, the four owed gates consume them. #280's connected gate rides this matrix (added 2026-08-05). Release, ACDREAM_RETAIL_UI=1, ACDREAM_STREAM_RADIUS UNSET (it forces NearRadius and only raises FarRadius, so a run with it set measures a different window than production). Run the route TWICE on the same binary — once with ACDREAM_PROBE_REVEAL_RADIUS=1 (reproduces the pre-#280 gate) and once without — and report BOTH. The user-facing observable is an ABSENCE, so the pass criteria are three positive artifacts per stop, all from existing machinery: (1) a world-visible checkpoint JSON whose StreamingWork.NearBacklog / .FarBacklog / .DestinationBacklog / .PendingPublications are zero for the destination window at the moment the viewport opened; (2) a hold-duration pair — the post-fix hold is EXPECTED to be LONGER, and a hold that is not longer means the gate did not widen and the run proves nothing; (3) a paired screenshot per stop, where the pre-fix run is the one that shows the defect. wait world-visible 30000 in tools/connected-world-lifecycle.route.txt is the convergence ceiling — a trip is a failure, a longer pass is not. The reported repro was a RECALL, not /teleloc: the matrix needs a lifestone/recall leg, and it must include a first-login stop, because login shares the same barrier and its gate widened too.

After C5: AP-22 (RETIRED 2026-08-06, bc4679cd) and AD-10 (RETIRED 2026-08-06 by deletion, 886333a2) are both DONE. Historical text follows. After C5: AP-22 (authored collision shapes), then AD-10 (remote contact-plane projection), then the campaign's final matrix and ledger closeout; vendor Slice 5 resumes.