acdream/docs/research/2026-08-05-c5b-contract.md

C5b — classify-before-merge on every steady-state Position (#275): pinned contract (2026-08-05)

Written at HEAD 02578441 (branch claude/acdream-physics-divergence-5aa784; C5a landed at 6921a027, #319 at 392c1e22, AP-145/#318 at f8e55ba5). Every symbol below was re-verified by symbol at this HEAD, not inherited; §12 lists what the C5 scoping (2026-08-05-c5-scoping.md, written at 52175aa1) got wrong. Inputs: the scoping's C5b section, register rows AP-131 / AD-60 / AP-130 / AP-135 / AP-146, the 4b-3 contract (2026-08-04-c4-route-4b-3-contract.md — D1 is C5b's direct ancestor), the C4 closeout handoff's seven process findings, the C5a contract (2026-08-05-c5a-contract.md), and issue #275.

One-paragraph verdict: C5b is smaller than the scoping feared, because of a fact the scoping did not state: the merge's two flags (installPlacementFrame / clearParent) are a pure function of the timestamp disposition and the hasAnimations proxy — both available inside the merge itself, pre-merge, with no routing outcome and no playerDistance. Retail runs unset_parent and the SetPlacementFrame gate BEFORE MoveOrTeleport is consulted, so the flags are upstream of classification proper. C5b therefore needs no route plumbing, no signature changes, no App→Runtime threading — it replaces two true literals with a four-row truth table the classifier already encodes, and flips one refreshPosition: argument to false. The blast radius is correspondingly narrower than "45+ sites mis-reading a withheld wire cell", for a second reason the scoping missed entirely: the merge stamp is one of THREE steady-state wire-cell writers, and the other two stay (§5, W2/W3). What genuinely changes is the classification window, the refused-ForcePosition shape, and the (test-only) missile arm. The contract pins all of this.

---

1. Retail ground truth — Gate A and the pre-placement sequence, verified in acclient_2013_pseudo_c.txt

SmartBox::HandleReceivedPosition @0x00453FD0 (pseudo-C lines 92896–93051). The exact order, with addresses:

00453fe3   objcell_id = arg3->objcell_id          // wire cell read into a LOCAL
00453ff4   Frame::operator=(&var_40, &arg3->frame) // wire frame copied into local Position var_48
0045400c   GATE A: if (arg2 == player && newer_event(player, FORCE_POSITION_TS, arg9)):
0045402b-54    wrapped-compare update_times[4] (TELEPORT_TS) vs arg8 — the wire
               teleport stamp must NOT be OLDER (equal or newer both pass).
               CORRECTED 2026-08-05, see §15 — this line read "must NOT be
               newer" and it was backwards.
00454056-68    get_heading / Frame::set_heading(&var_40)   // preserve body heading
00454074       SmartBox::BlipPlayer(this, &var_48)
00454079       player->update_times[0] = arg7              // stamp POSITION_TS
00454091       cmdinterp->SendPositionEvent()
0045409d       return                                      // BEFORE unset_parent / SetPlacementFrame
004540b7   if (!newer_event(arg2, POSITION_TS, arg7)) → return (the 004540e6 teleport-regression
           quirk stamps update_times[0] and returns @004540f6)
004540f9-11e if (parented && parent->id != player_id): weenie->SetParentedState(0) notification
00454129   CPhysicsObj::unset_parent(arg2)                 // UNCONDITIONAL on this path
00454137   if (CPhysicsObj::HasAnims(arg2) == 0):
00454142       CPhysicsObj::SetPlacementFrame(arg2, arg4, 1)
0045414d   if (arg2 != player):                            // REMOTE branch
00454254       if (MoveOrTeleport(arg2, &var_48, arg8, arg5, arg6) != 0):
00454272           ConstrainTo(arg2, &arg2->m_position, …)  // post-placement anchor
0045415f   else if TELEPORT_TS newer: TeleportPlayer @00454168, ConstrainTo @0045418a
           anchored at the WIRE &var_48, set_velocity(0) @004541b4
           else: ConstrainTo @004541ec; if UsePositionFromServer && arg5: InterpolateTo @0045422c

Five facts decide C5b:

1. The wire cell is never written to the object. arg3->objcell_id is read into a local @0x00453FE3 and flows only into the local var_48 Position handed to BlipPlayer / TeleportPlayer / MoveOrTeleport / ConstrainTo. Nowhere in this function is the object's cell assigned. The object's cell changes only inside the placement family (SetPositionInternal @0x00515BD0 → set_cell; enter_world @0x00516310/0x00516170) or per-frame movement transit. This is the retail rule AD-60's executor half already encodes ("a wire position never directly makes the record resident").
2. Gate A (@0x0045400C) is decided on data that exists before any merge: the entity is the player, FORCE_POSITION_TS advanced, and the wire TELEPORT_TS is not older than the stored one. It returns @0x0045409D before unset_parent @0x00454129 and before the SetPlacementFrame gate @0x00454137 — a ForcePosition never unparents and never installs a placement frame. acdream's analog exists upstream: PhysicsTimestampGate.TryAcceptPositionEvent:190-203 produces the ForcePosition disposition when isLocalPlayer && IsNewer(FORCE_POSITION_TS) && teleport == _timestamps[Teleport]. CORRECTED 2026-08-05 (see §15): that third term is retail's Gate A pair NARROWED, not matched. Retail's test is teleport equal-or-newer; acdream's is equal only. The narrowing is filed at AP-148 / issue #325. Everything C5b decides from Gate A is unaffected — the disposition C5b reads is the same one it always was, and the narrowing makes the ForcePosition set strictly SMALLER, so no packet C5b's truth table classifies as force would have been classified otherwise. A remote entity can never receive the ForcePosition disposition (isLocalPlayer guard at :190), so the flag truth table below needs no entity-kind term.
3. The two pre-placement writes are gated on exactly two facts. unset_parent @0x00454129 runs for every accepted non-Gate-A Position (including packets MoveOrTeleport will return 0 for — retail unparents BEFORE learning the routing outcome). SetPlacementFrame @0x00454142 is gated on HasAnims(arg2) == 0 alone. Neither gate reads the near/far/teleport classification — which is why acdream's merge flags are a function of (disposition, hasAnimations) and nothing else.
4. MoveOrTeleport @0x00516330 reads the BODY's own state at entry: TELEPORT_TS @0x00516375 and this_1->cell == 0 @0x00516386 — the committed cell, read before any placement — then contact arg4 @0x0051638E. Route 4b-3's D1 fed the classifier the PRE-merge committed cell for exactly this reason; C5b's withhold (D2) makes that pre-merge value structurally equal to the record's FullCellId in the classification window (§4, "strengthened invariant").
5. store_position @0x00515CE2 is SetPositionInternal's no-transition branch (placement ran, no walkable transition → GotoLostCell @0x00515CF2), not a MoveOrTeleport path. A retail placement that fails leaves the wire pose in m_position and the object HIDDEN in the lost cell — acdream's surviving wire-cell-on-non-commit behaviour (W2, §5) is the visible variant of this, already filed across AP-136/AP-138/#309. C5b does not re-litigate it.

2. The two scoping-identified sites, re-verified at HEAD 02578441

S1 — the steady-state merge's unconditional flags

InboundPhysicsStateController.TryApplyPosition (src/AcDream.Runtime/Entities/InboundPhysicsStateController.cs:610), hardcoding installPlacementFrame: true, clearParent: true at :662-663 (scoping exact). Production chain at HEAD, every hop verified: LiveEntityNetworkUpdateController.OnPosition:1948 → LiveEntityInboundAuthorityGate.TryAcceptPosition:161 (src/AcDream.App/Physics/ — the scoping gave no directory) → LiveEntityRuntime.TryApplyPosition:2550 → RuntimeEntityObjectLifetime.TryApplyPosition:1789 (scoping said :1781) → RuntimeEntityDirectory.TryApplyPosition:654 → the S1 overload.

The route-flag-threaded sibling (ApplyAcceptedPositionSnapshot:673, flags at :681-682) already exists and is what the continuation executor uses (RuntimeInitialCreateContinuationExecutor.cs:1983-1993, classified flags at :1991-1992, withhold at :1996) — scoping §1b verified exact.

What changes semantically (not "what gets deleted"): the merged snapshot's Physics.AnimationFrame / PlacementId and its ParentGuid / ParentLocation / Physics.Parent stop being unconditionally wire-installed / wire-cleared and start obeying retail's two gates:

disposition	installPlacementFrame	clearParent	classifier row (cite, don't restate)
Rejected	unread (timestamp-only path :793-794)	unread	—
ForcePosition (local player only, teleport-equal)	false	false	RuntimeAuthoritativePositionRouteClassifier.cs:311-333 (Gate A)
Apply	!hasAnimations	true (unchanged)	classifier :336-465 — every accepted non-force route carries UnparentBeforeRouting: true, ApplyPlacementFrameBeforeRouting: !request.HasAnimations

hasAnimations is the AP-130 static proxy, computed from the PRE-merge snapshot old with the identical expression RuntimeAcceptedPositionRouteRequests.cs:99-101 uses (old.MotionTableId ?? old.Physics?.MotionTableId) is { } id && id != 0u). WorldSession.EntitySpawn.MotionTableId exists (WorldSession.cs:103); the inbound controller's _snapshots[guid] and canonical.Snapshot are the same data pre-merge, so the two computations cannot diverge.

Two observability notes that decide the test plan (§8):

• The ForcePosition placement-frame half is inert: for disposition is not Apply, appliedPlacement keeps old.PlacementId under either flag value (:815-819). Gate A's force half discriminates ONLY through parent retention (:855-857).
• The Apply placement-frame half is live exactly when hasAnimations == true: today the wire frame (update.PlacementId ?? 0u) is stamped onto an animated entity's snapshot where retail's HasAnims gate skips SetPlacementFrame. That is AP-131's animation snap/reset half.

S2 — the wire-acceptance-derived FullCellId stamp

RuntimeEntityObjectLifetime.cs:1923-1926 — Entities.RefreshSnapshot(canonical, snapshot, refreshPosition: acceptedPosition) (argument at :1926, matching the C5a contract's corrected citation; the register's :1338 and the scoping's :1918 are both stale — cite by symbol). refreshPosition: true routes through RuntimeEntityRecord.RefreshDerivedState:230-237 → SetFullCell(position.LandblockId, …) — the wire cell, stamped on bare acceptance, plus PropagateFullCellToChildren (RuntimeEntityDirectory.cs:240-246) when it changes.

What changes semantically: refreshPosition: false. The merge stops being a residency writer. In the window between the merge and the OnPosition prologue rebucket, canonical.FullCellId IS the pre-merge committed cell — which is exactly what 4b-3's D1 threads out-of-band today (timestamps.PreMergeCommittedCellId, :1904-1907). Post-D2, 4b-3's convention becomes a structural property of the record.

The executor's analogue is unchanged and untouched (refreshPosition: false at executor :1996 — its CANONICAL CELL SEMANTICS comment at :1966-1976 is the model for S2's new comment).

3. Design decisions — pinned, not open for redesign

D1 — the merge flags become the classifier's truth table, computed pre-merge inside the merge

In S1's TryApplyPosition, replace the two literals at :662-663 with the table in §2-S1, computed from disposition and hasAnimations(old). No signature changes; no new parameters; no route construction in the merge; playerDistance is never needed (the full route's near/far decision is downstream of retail's unset_parent/SetPlacementFrame order and stays post-merge in ClassifyRemoteAcceptedPosition).

The post-merge classification (LiveEntityNetworkUpdateController.cs:2167-2175 → RuntimeEntityObjectLifetime.ClassifyRemoteAcceptedPosition → RuntimeAcceptedPositionRouteRequests.Build) is untouched: it computes the full route from the same retained inputs, so its ApplyPlacementFrameBeforeRouting / UnparentBeforeRouting fields equal the merge's flags by construction. The consistency is pinned by test (§8 test 4), not by a shared code path — the two computations are small, pure, and separately sabotage-verifiable.

Doc comments that must be made true in the same commit (process rule (c)): the :595-608 "Round 4 R4-15 … no HasContact or route-classification concept" remarks; the :657-661 "Legacy immediate-apply reproduces EXACT prior behavior" comment; ApplyAcceptedPosition's :772-781 two-caller doc; the :809-814 PositionPack comment's "retail skips it entirely while HasAnimations is true" (already true — now load-bearing for BOTH callers).

D2 — the steady-state merge withholds the wire cell (refreshPosition: false)

One argument flip at S2 plus the comment rewrite. The 4b-3 D1 comment at :1894-1907 is extended, not deleted: it currently explains why the classifier needs the threaded pre-merge value; it must add that after this change the post-merge record CARRIES that same value through the classification window, making the threading a belt-and-suspenders duplicate that stays (the threaded value remains the classifier's input of record — process finding (b), read the observable once).

Two publish-side effects, both pinned (trap T3):

1. The merge's publish-kind ternary (:1948, beforeCell != canonical.FullCellId ? Rebucketed : Updated) becomes always-Updated — the merge can no longer change the cell. The Rebucketed edge for a wire-cell-changing packet moves to the prologue rebucket's CommitRebucket (RuntimeEntityObjectLifetime.cs:1956-1987), which TODAY early-outs publish-less (previous == fullCellId at :1973 — because the merge already stamped it) and after D2 publishes. Net observable: exactly one Rebucketed delta per cell-changing accepted Position — same kind, same value, same publisher, later point in the same call. A test pins this at the observable (one delta, not zero, not two); it does not pin the source site.
2. PropagateFullCellToChildren for a parent whose accepted Position changes its cell moves from the merge's directory wrapper (RuntimeEntityDirectory.cs:240-246) to CommitRebucket's public SetFullCell (:355). Same packet, same value, same single propagation. This is the #319 child-equality channel — a directory-level test pins exactly one propagation per parent cell change on the steady-state path, for BOTH parent classes (player 0x5… and creature 0x8…; process rule from #319 — a test population that only ever sees sequence-0 parents is blind to the player class).

D3 — the other two wire-cell writers STAY, and the register says so

The scoping's premise — withholding S2 "moves residency changes onto placement/simulation commits only" — is false at HEAD (§12 item 1). Two more steady-state wire-cell writers exist downstream of the merge in OnPosition, and C5b keeps both:

• W2 — the prologue rebucket (LiveEntityNetworkUpdateController.cs:2329 RebucketLiveEntity(update.Guid, p.LandblockId) → LiveEntityRuntime.cs:935-945 → CommitRebucket → SetFullCell(wire cell)). Runs for EVERY classification reaching the generic tail — near, far, teleport, cell-less, unrouted, and every ordinary local-player Apply echo. Its other jobs (draw-bucket move, bucket-promotion recovery, prepare_to_enter_world clock edges) are not cell writes and are not in scope. Do NOT gate W2 by classification (trap T5): for the local player W2's echo-driven commit is the mechanism that advances the canonical cell across landblocks during ordinary movement (AP-146/#320 machinery — the per-tick projection deliberately passes a landblock id and preserves the cell, LiveEntityRuntime.cs:935-938); gating it silently freezes the player's cell between teleports and #319's child equality inherits the freeze.
• W3 — the post-routing wire-cell adopt (TryAdoptWireCellAfterRouting, LiveEntityNetworkUpdateController.cs:1613-1624): RemoteMotion.CellId = wire for every non-placing arm, writing through to FullCellId via CommitCanonicalCell. Already filed as retained bookkeeping under AP-135; the placing arms (far/teleport) are suppressed there because the placement receipt is the cell authority.

W2/W3's population note: packets that RETURN before :2329 never see W2 — the force-local path (Committed/Deferred :2055, Rejected/Contention :2066) and the missile arm (:2256). For those, post-D2 residency is placement-receipt-authoritative (or, on a refused/contended force, unchanged at the last commit — retail's shape, since retail's BlipPlayer-era body keeps its last placed cell; AD-62 already files the non-commit force outcomes). This is D2's genuinely new steady-state surface and it is retail-correcting, asserted by §8 test 6.

D4 — register bookkeeping, in the implementation commit

• AP-131 RETIRES (§7 evidence). Its "legacy caller is deleted at the production cutover" framing is overtaken: the caller is not deleted, it is corrected — the unconditional literals are replaced by the classified computation. The retirement commit rewrites the row's text to past tense with the evidence, per register rule 1 (a deviation found without a row is a bug twice over; a retired divergence needs its retirement recorded, which the C5a/AP-1 and 4b-3/AP-137 rewrites established as the house style).
• AD-60 — legacy half RETIRES, row REWRITTEN, not deleted (4b-3's D8 precedent: silent whole-row deletion would hide surviving wire-cell channels). The rewrite keeps the executor half as the standing rule, records the legacy half's retirement with §7's evidence, and names the surviving wire-cell channels: W2 (prologue rebucket commit — cross-cited into AP-146 for the local player) and W3 (already AP-135). The row's surviving claim is therefore precise: "a wire Position never makes a record resident inside the merge or ahead of classification; the post-routing controller still adopts the wire cell for non-placement outcomes as the bounded-residency bridge, filed at AP-135/W2."
• AP-130 amendment (bookkeeping, not retirement): its Site column names only the executor's hasAnimations local; the merge now consumes the same static proxy. One sentence added. The proxy itself MUST NOT be "improved" to a live animation-queue read in this slice (trap T7).
• AP-146 / #320 amendment (bookkeeping): #320's edge list cites "an accepted inbound Position/ForcePosition (RuntimeEntityDirectory.RefreshSnapshot → RuntimeEntityRecord.cs:234)" as a local-player cell writer. After D2 that writer is the generic-tail rebucket's CommitRebucket (and, for ForcePosition, the placement receipt). Amend both in the same commit or the next reader files a phantom regression.
• AP-135 stays, its writes stay (must-remain-true item 3).
• AP-1, AD-1, AP-141–AP-145, AD-61, AD-62: pinned untouchable.

4. What must REMAIN true (process rule — the contract causes the defect)

For every path this slice touches, including every refusal and rejection:

1. Classification reads pre-merge inputs only. 4b-3's D1 binds in full: PreMergeCommittedCellId is threaded exactly as today (RuntimeEntityObjectLifetime.cs:1904-1907), measured by the SAME TryApplyPosition call, never re-read after the merge. D2 adds the structural property (the record equals it in the window) but the threaded value stays the classifier's input of record.
2. The D4 constraint-arm partition (4b-3) does not move. One post-operation ConstrainTo site, its partition table unchanged. C5b touches no arming code.
3. AP-135's bookkeeping writes stay — the server-cell adopt (RemoteMotion.CellId) and LastServerPos/LastServerPosTime samples in LiveEntityNetworkUpdateController, on both airborne no-op neighbourhoods.
4. Dual-parent-class test discipline. Every new test touching parent/ child cell propagation runs a player (0x5…) parent AND a creature (0x8…) parent (#319's lesson; the handoff's corrected gate-2 criterion).
5. The executor path is untouched — its classified flags, its refreshPosition: false, its replay semantics (ApplyAcceptedPositionExecutionRejectedSnapshot). Do not unify the two merge callsites into one helper "while here" (trap T8).
6. The timestamp gate is untouched; Gate A's teleport-concurrent shape stays upstream (PhysicsTimestampGate.cs:190-217; a force with a teleport advance falls through to Apply, and ValidAcceptedAuthority's PreviousTeleport == AcceptedTeleport rule handles the classified side). CORRECTED 2026-08-05 (§15): that fallthrough is not retail's shape. Retail's Gate A accepts a force carrying a NEWER teleport stamp and returns before ever advancing TELEPORT_TS. Both acdream sites named in this item encode the narrower equality; both are filed at AP-148 / #325, and both stay untouched by C5b — closing them is its own slice with its own gate.
7. The OnPosition routing/arms are untouched — generic render-pose gate, W2, the arm dispatch, W3, the unified tail, AP-87's catch-up, AP-139's landing clear, AP-140's InContact gates.
8. The local player's cell-freshness path (echo → generic tail → W2 → CommitRebucket) is unchanged. AP-146 stays accurate after its §D4 amendment.
9. The initial-residence branch of TryApplyPosition (:1800-1860) is untouched — it is the executor's enqueue path, already classified.
10. Physics.ObserveLocalWorldFrame keeps reading the wire landblock directly (:1887-1889); it is not a FullCellId consumer.
11. No new skip (process rule (d)) and no test weakened to make the withhold pass (trap T2 — the withhold assertion lives at the merge boundary, never at OnPosition level, where W2 legitimately re-stamps).

5. THE BLAST RADIUS — itemised by consumer class

Premise: S2's withhold is the only residency write C5b removes; W2/W3 stay (D3). So the consumers that ever read a value that is intentionally NOT the wire cell are (a) everything in the classification window (merge → :2329), and (b) steady state after packets that return before W2 (force path, missile arm). Everyone else reads the same value as today. The #319 lesson is applied, not assumed: a stale cell is worse than a zero cell for derived/presentation copies — but FullCellId's whole semantic post-D2 is "the last committed cell", which is retail's this->cell; that is not staleness, it is the definition. Zero would be the lie here.

Class A — placement owners (read at/after placement). Verdict: CORRECT, no gate.

RuntimeSetPositionState (pre-flight reads :1172-1255, commit compares :2305/:2760/:5020, parks :3004/:3031/:3677-3697, :3795/:3954, :5225/:5242), RuntimeRemotePlacementDriveController (:1053-1068 — verified: reads record.FullCellId AFTER the placement commit for the shadow publish; the commit just wrote it), RuntimeAcceptedPositionDriveController (receipt resolvedCell: reads :914-1535). Retail's placement reads this->cell — the committed cell, never the wire cell. These get a MORE honest input post-D2.

Class B — per-tick simulation. Verdict: CORRECT, no gate.

RuntimeOrdinaryPhysicsUpdater:127 (transits FROM record.FullCellId — retail's per-frame cell transit reads this->cell), RuntimePhysicsState (:958, commit :2145-2159), RuntimeProjectilePhysicsUpdater (:53-293), the free-fall sweep's rm.CellId != 0 gate (AP-135). The simulation is the retail-sanctioned residency writer between packets.

Class C — classification inputs. Verdict: CORRECT — strengthened.

RuntimeAcceptedPositionRouteRequests (:57 route-1 overload — executor scope, unchanged; :641-family drive-controller builds for the local player — reads the local player's committed cell, whose freshness path is W2, unchanged). The remote PositionEvent build is the threaded PreMergeCommittedCellId — post-D2 the record in the window equals it structurally (§3 D2). 4b-3's D1 moves from convention-defended to structure-defended.

Class D — presentation/projection, event-time readers. Verdict: HARMLESS, with three named window sites.

Event-time readers (landblock-loaded, visibility-changed, per-tick sync) run outside the per-packet window, and W2 keeps steady-state values identical to today for every generic-tail packet: RuntimePlacementPresentationSink:286 (post-commit receipts), LiveRenderProjectionJournal:270-271 (falls back when 0), EntityEffectController:481, LiveStaticAnimationResidency:25, StaticLiveRootCommitter:76, ArchRenderScene (Residency.FullCellId — statics), HeadlessLocalPlayerFrameHost:87, HeadlessRuntimePlacementProjectionSink:103 (token compare), RemotePhysicsUpdater:239/:294 / LiveEntityOrdinaryPhysicsUpdater:107 (simulation-snapshot → ParentCellId sync).

Named window sites (inside merge→W2, or pre-W2 returns) — verdict per site:

site	reads	verdict
LiveEntityHydrationController:592 (?? candidate.FullCellId fallback)	landblock-loaded event	HARMLESS — event-time, post-W2 population; the fallback is third in a ?? chain behind projection/snapshot position
LiveEntityHydrationController:1077 (FullCellId != 0 gate)	projection recovery inside the window	VERIFY at implementation: after D2 it reads the committed cell (correct — recovery should re-place from the last commit, not from an unplaced wire claim). Pre-D2 it could read the just-stamped wire cell; that was the AP-1-shaped read this slice exists to remove
LiveEntityRuntime:1219 / :1564 (token.ExactCellId compares)	hydration/migration tokens	VERIFY: token cells are create/placement-derived, not wire-derived; the comparison against the committed cell is the intended predicate
LiveEntityPresentationController:220 (RestoreShadow's FullCellId == 0 bail)	visibility-edge restore	HARMLESS/CORRECT — a cell-less body correctly restores no shadow row; the force-path population keeps its committed cell

Class E — residency/liveness predicates (the "45+ sites"). Verdict: HARMLESS, two CORRECT-AND-LOAD-BEARING.

• GetRootObjectClockDisposition (LiveEntityRuntime:2602-2617), HasSpatialRuntimeProjection (:3340-3345), the ordinary-root gates (:953-956, :3452-3455): tick/edge-time, read the committed cell — retail's this->cell != 0 predicate shape. CORRECT; unchanged in value for generic-tail packets (W2), changed only for refused-force (retail's shape).
• IsAffectedCollisionResident (RuntimeSetPositionState:3949) and its !HasCommittedParent companion gates, the collision-retirement sweeps (:3771/:3796/:3990/:4052): event-time (landblock retirement), read the committed cell. CORRECT — a retirement sweep must act on where the body IS, not where an unplaced wire packet claimed.
• The initial-create residence FullCellId != 0 refusal (RuntimeInitialCreateResidenceState:583) and executor baselines (:877-1182, executor :1836/:2484): pending-residence records never take the steady-state merge branch. UNAFFECTED.
• 4b-3's cell-less classification input: threaded pre-merge value (Class C).
• RuntimeEntityDirectory:492 child propagation and RuntimeEntityObjectLifetime:1546-1555 parent-attach propagation: write-side (D2's propagation-source move, pinned in §3 D2 item 2).
• ProjectileController:279/:568/:930 and the missile arm: the ONLY population whose residency becomes exclusively placement-receipt-driven post-D2 (the arm returns before W2, :2256). Test-only today (AP-141: ACE never sends a missile UpdatePosition). CORRECT — retail's projectile cell comes from SetPosition, full stop.

The headline behavioural delta, stated once

Post-C5b, a refused or contended local ForcePosition (AD-62's shapes (iv)-(vi)) leaves FullCellId at the last committed cell where today the merge stamps the refused packet's wire cell. Retail cannot refuse (AD-62) and its body keeps the last placed cell — the new shape is the retail-reachable one. Every other steady-state observable is either unchanged (W2/W3) or retail-correcting (the classification window, the placement-authoritative force/portal/missile arms).

6. Proof obligations (must prove, not assume)

1. The truth table is the classifier's. §8 test 4 drives both the merge and RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition (via RuntimeAcceptedPositionRouteRequests.Build) over the packet-shape matrix and asserts the merge-installed AnimationFrame/PlacementId/ParentGuid/ParentLocation/Physics.Parent equal what the route's flags would install. Not a restated table in the test body — the production classifier is the oracle (process rule (e): no test that re-encodes the constant under test).
2. The withhold is at the merge boundary. §8 test 5 asserts at RuntimeEntityObjectLifetime.TryApplyPosition level: an accepted Position whose wire cell differs from the committed cell leaves canonical.FullCellId == beforeCell immediately after the call. It MUST NOT be asserted at OnPosition level — W2 legitimately commits the wire cell there, and an OnPosition-level assertion would fail and tempt a weakening (trap T2).
3. Publish-delta conservation. One Rebucketed delta per cell-changing accepted Position on the steady-state path (§3 D2 item 1), and one child propagation per parent cell change (item 2), both asserted at the observable, both parent classes (must-remain-true item 4).
4. The refused-force shape. A ForcePosition whose drive execution refuses/contends writes NO residency change anywhere (§8 test 6) — merge, W2 (unreached), receipt (none). This is the assertion that makes AD-60's retirement mean something.
5. Sabotage-verify every new discriminating test in BOTH directions (process rule (e)) — the canonical half and the presentation/snapshot half separately, per route 7's finding.

7. Retirement evidence — AP-131 and AD-60's legacy half (same commit as the change)

AP-131 retires because:

1. The literals at InboundPhysicsStateController.cs:662-663 no longer exist; the merged flags are computed by the §2-S1 truth table. A grep in the commit message shows no production caller passes unconditional true/true (the executor's :1991-1992 threading is the classified path, already retail-exact).
2. §8 tests 1-4 pin the new behaviour against the classifier-as-oracle, sabotage-verified: (a) Apply + animated entity → wire frame NOT installed (sabotage installPlacementFrame: true fails it); (b) Apply + non-animated → wire frame installed (sabotage false fails it); (c) ForcePosition + parented entity → parent fields retained (sabotage clearParent: true fails it); (d) the matrix consistency test.
3. The row's risk column ("animated entity installs a placement frame retail would skip; ForcePosition unparents where Gate A never reaches unset_parent") describes code that no longer exists — the two production behaviours are now the classifier's own rows (RuntimeAuthoritativePositionRouteClassifier.cs:311-333 and :336-465).

AD-60's legacy half retires because:

1. RuntimeEntityObjectLifetime.cs:1926 reads refreshPosition: false; RefreshDerivedState's SetFullCell(position.LandblockId, …) is unreachable from the steady-state merge.
2. §8 tests 5-6 pin the withhold at the merge boundary and the refused-force shape.
3. The row rewrite (§3 D4) names W2/W3 as the surviving, separately-filed wire-cell channels, so the retirement cannot be misread as "wire acceptance never changes residency anywhere" — it means "never inside the merge, never ahead of classification, never for a packet whose placement was declined", with the post-routing adoption for non-placement outcomes filed where it belongs (AP-135 / the W2 citation).

8. Test plan

Focused Runtime tests (tests/AcDream.Runtime.Tests), each asserting the layer that broke historically (merged snapshot fields, canonical cell, publish deltas — never source-text pins):

1. Apply, animated remote (MotionTableId != 0): merged snapshot keeps old.Physics.AnimationFrame / old.PlacementId; pose and timestamps still merge. Sabotage: force installPlacementFrame: true.
2. Apply, non-animated remote: merged snapshot installs update.PlacementId ?? 0u. Sabotage: force installPlacementFrame: false.
3. ForcePosition, parented local player: merged snapshot retains ParentGuid / ParentLocation / Physics.Parent; heading preservation (:797-807) unchanged. Sabotage: force clearParent: true.
4. Matrix consistency (proof obligation 1): {Apply, ForcePosition} × {animated, not} × {parented, not} × {player 0x5…, creature 0x8…} — merge outcome == classifier route flags' outcome.
5. Withhold at the merge boundary (proof obligation 2): wire cell ≠ committed cell → canonical.FullCellId unchanged after TryApplyPosition; Snapshot.Position DID refresh (the pose half of the merge is not the withheld half); a subsequent canonical placement commit still changes FullCellId.
6. Refused-force shape (proof obligation 4): drive a ForcePosition whose execution refuses (destination outside the service window) through the drive controller; assert no residency write from merge, receipt, or rebound — FullCellId is the pre-packet value throughout.
7. Publish-delta conservation (proof obligation 3): one Rebucketed per cell-changing accepted Position; one child propagation per parent cell change; player parent AND creature parent.
8. The existing InboundPhysicsStateController unit tests that assert the UNCONDITIONAL flags are rewritten, never delete-only (the scoping's §3 row, carried): each becomes its classified-flag counterpart.

9. Gates

• Focused tests above.
• Complete Release suite: $env:ACDREAM_PAK_PATH set, dotnet test AcDream.slnx -c Release -m:1. Re-measure the baseline; do not inherit. Recorded figures: 11,112 passed / 4 skipped / 0 failed at 392c1e22 (C5a contract) and 11,106 at 6921a027 post-C5a (the tasking figure). C5b's net count moves only by test rewrites/additions; the commit message reconciles the net explicitly. Three known flakes, filed separately, never conflated, never chased: #302 (PortalProjectionTests.ClipToRegion_FrameOwnedStore_…, App.Tests), #308 (NakEmissionTests.LossSoak_…, Core.Net.Tests, full-suite load), #321 (DatSoundCacheTests concurrent-decode-dedup, Core.Tests, full-suite load — filed 2026-08-05, deliberately separate from the other two; do NOT fold it in). If any appears, re-run and say which.
• Connected gate: YES — argued, not assumed. The change is on the hottest wire path (every steady-state Position) and the campaign's standing discipline is a connected gate per live-path behaviour change. But the gate's pass evidence must be positive, because C5b's improvement is absence-of-signal (a placement frame NOT installed; an animation NOT popping — the #319/rule-(g) unfalsifiable-criterion trap). Recipe (two-client, Release, ACDREAM_RETAIL_UI=1, ACDREAM_PROBE_REMOTE_TELEPORT=1, pre-C5c so the probe still exists):
  1. Pickup-then-drop a ground item, several times — the positive probe assertion: [remote-teleport] lines appear with hookRan=True placement=Committed, proving the pre-merge-fed cell-less/teleport classification still fires and commits after the merge stopped being a residency writer. (Gate 4's closure at af828a8a established this recipe reaches the arm; the probe label may read teleport-ts for the short-circuit reason the handoff records — that is expected, not a gap.)
  2. A walking/running creature across ≥1 landblock boundary, observed: visible, smooth, correct cell, no freeze, no origin-snap — the W2 regression watch (the one writer C5b leans on hardest).
  3. @teleto/@teleloc a creature (never a player character — rule (g)): teleport arm unchanged, leash re-armed, no rubber-band, no run-in-place.
  4. Local @teleto + one portal recall: the force/portal paths are now placement-authoritative for residency — arrival pose correct, leash armed, movement immediate.
  5. An animated creature idling/fighting at UpdatePosition cadence: watch for NEW animation popping (regression) — recorded as an observation only, explicitly NOT a pass criterion (the absence of the OLD pop is the improvement and is test-gated, §8 test 1). Graceful close per the standing rule. No new probe flag for C5b: the discriminating signals are either absence-of-signal (ungateable) or already carried by [remote-teleport]; adding a seventh temporary probe for one session and stripping it in C5c is churn without evidence value.

10. Size and split call

Calibrated against the campaign (route 3 ~418, #319 76, 4b-3 ~250-700):

piece	production lines	test lines
D1 truth table + comment rewrites	~25-40	~200-350 (matrix + rewrites)
D2 withhold + comment + publish-edge pins	~15-25	~100-250
Register rewrites + #320/AP-130 amendments	0 (docs)	0

Total ~40-65 production, ~300-600 test — well under the ~500-line split threshold, and dramatically under the scoping's ~150-400 estimate, because the scoping assumed route plumbing (it did not see that the flags are disposition-determined; §12 item 2). One landing. If the test rewrite balloons past ~600 lines, the split line falls between D1's flag tests and D2's withhold tests — but the PRODUCTION change lands atomically: D1+D2 in one commit is one coherent behaviour (classify-then-merge); a half-flipped intermediate (classified flags with the wire stamp, or vice versa) is exactly the mixed-residency state this campaign keeps paying for.

Single implementer, dual reviews (retail-conformance + architecture) per the campaign's discipline, both re-run on the final diff.

11. Traps (routes 6/7 style)

• T1 — reading hasAnimations post-merge. Compute from old (the pre-merge snapshot) inside TryApplyPosition. For Position packets the merge cannot change MotionTableId, so the failure mode is latent, not live — pin the discipline anyway, because the NEXT field added to this computation may not share the property.
• T2 — the withhold assertion at the wrong boundary. W2 re-stamps the wire cell at :2329 for every generic-tail packet, BY DESIGN. A test asserting "FullCellId unchanged after OnPosition" fails and invites a weakening or a W2 gate. The assertion lives at RuntimeEntityObjectLifetime.TryApplyPosition (§8 test 5). This is the slice's "weaken a test to make the withhold pass" trap.
• T3 — the moved publish edges. Rebucketed moves from the merge's ternary to CommitRebucket; child propagation moves with it. Pin the observable (counts), never the source site; do not delete the coverage when the old assertion site goes quiet.
• T4 — the ForcePosition placement-frame half is inert (appliedPlacement keeps old.PlacementId under either flag). The force-half discriminating assertion is PARENT RETENTION. Sabotaging the placement frame on a ForcePosition proves nothing.
• T5 — do not gate W2 "for symmetry". The local player's canonical cell freshness runs THROUGH W2 (echo → generic tail → CommitRebucket; AP-146/#320). Gating it freezes the player's cell between teleports and #319's child equality inherits the freeze. W2 is also the far arm's destination-streaming nudge.
• T6 — the missile arm returns before W2 (:2256). Post-D2 its residency is placement-receipt-only; fixtures driving refused/deferred missile placements must not assert wire-cell residency.
• T7 — do not "improve" hasAnimations to a live animation-queue read. AP-130 files the static proxy deliberately; the merge consumes the same proxy and the row is amended, not escalated.
• T8 — no while-here unification of the two merge callsites, the executor's replay merge, or the timestamp gate.
• T9 — flake discipline. #302/#308/#321 are three separate filed flakes; a full-suite red in any of them is re-run and named, never folded into "the flake class" and never masked (#321's filing note: no retry, no Skip, no delay).

12. Scoping claims found wrong or stale at HEAD 02578441

1. The scoping's core premise for the withhold is false. §2: withholding S2 "moves residency changes onto placement/simulation commits only — the retail rule". At HEAD the steady-state path has TWO MORE wire-cell writers downstream of the merge (W2 LiveEntityNetworkUpdateController.cs:2329 → CommitRebucket; W3 TryAdoptWireCellAfterRouting:1613), and C5b keeps both (§3 D3). The retirement must be scoped to the merge boundary and the survivors named in the register rewrite, or AD-60's retirement is a shell game. This is the contract's load-bearing correction.
2. The size estimate over-counts. Scoping §7: "~150-400 changed on the hottest inbound path". The flags are disposition+hasAnimations-determined (§2-S1 truth table; retail runs both gates BEFORE the MoveOrTeleport branch decision) — no route construction, no playerDistance threading, no signature changes. Re-estimate: ~40-65 production lines (§10).
3. Stale line citations (all re-verified): TryApplyPosition at RuntimeEntityObjectLifetime.cs:1789 (scoping :1781); the threaded overload's signature at InboundPhysicsStateController.cs:673 (scoping :681 — that is its flags parameter line); S2's call at RuntimeEntityObjectLifetime.cs:1923-1926 (C5a's :1926 correct; the register's :1338 still stale); LiveEntityInboundAuthorityGate lives under src/AcDream.App/Physics/ (scoping gave no directory; :161 exact). Everything else in scoping §1b/§2 holds.
4. #320's edge list goes stale the day D2 lands — its "accepted inbound Position (RefreshSnapshot → RuntimeEntityRecord.cs:234)" writer becomes the generic-tail rebucket's CommitRebucket. Amendment mandated in the implementation commit (§3 D4), or the next reader files a phantom regression.
5. The scoping's §5 cell-less falsification session is overtaken: gate 4 CLOSED at af828a8a (the cause=cellless label was a probe-artifact — the pickup-then-drop recipe exercised the arm all along). C5b does not inherit that investigation; its connected gate reuses the same recipe as positive evidence (§9). Route-7 thickening and #316's measurement are C5c-ledger items, not C5b design inputs — the implementation session checks the ledger for their status before starting, and does not block on them.

13. What C5b does NOT do

• Does NOT wire the continuation executor into the steady-state path (#275's alternative branch — the issue's "or delete it with the route"; the steady-state merge stays a live, now-classified, production caller).
• Does NOT gate, move, or delete W2/W3 (§3 D3).
• Does NOT touch the OnPosition routing, arms, constraint partition, generic render-pose gate, or interpolation machinery.
• Does NOT touch the timestamp gate, the executor, the initial-residence branch, or the projectile arm's routing.
• Does NOT strip any probe (C5c), fix #316/#317/#320, or re-open AP-145's seam.
• Does NOT add a live animation-queue read (AP-130 stands).

---

14. Implementation outcome (appended at landing, 2026-08-05)

Both design decisions landed exactly as pinned: installPlacementFrame: !force && !hasAnimations, clearParent: !force at the S1 call site, and refreshPosition: false at S2. No signature changed, no route was plumbed, playerDistance was never needed, W2/W3 were not touched. The production diff is 129 insertions / 38 deletions across two files, of which the BEHAVIOUR is seven lines — four computing force/hasAnimations, two flag arguments, one refreshPosition argument. Everything else in that delta is the §3-D1 mandated comment rewrites. Well inside §10's ~40-65 estimate; the estimate itself was counting comments.

§5's blast-radius survey missed three consumer sites. All three are D2-caused, all three were found by the test suite rather than by reading, and all three turned out to be the intended semantics rather than regressions — but the survey did not enumerate them, so they are recorded here:

1. DatLiveEntityProjectionMaterializer's self-projection branch (src/AcDream.App/Rendering/DatLiveEntityProjectionMaterializer.cs, the residence is AwaitRuntimePlacement && expectedCanonical.FullCellId != 0u && !HasActiveInitialCreateResidence gate). This is a Class-D window site: it runs inside OnPosition's prologue recovery (:1973 / :2089/:2102), ahead of W2. Pre-D2 it read the just-merged wire cell and installed the spatial bucket there; post-D2 it reads 0 for a withdrawn/inventory-only record and correctly declines to project from an unplaced wire claim. Production still installs the bucket in the SAME OnPosition call, at W2 (:2329) — verified by reading every return between the recovery call and W2: none is conditioned on IsSpatiallyProjected or FullCellId. Two LiveEntityHydrationControllerTests cases asserted the bucket at the recovery boundary and were extended to drive the production W2 step; this is the same shape as trap T2, one layer up.
2. ProjectileController.SyncPresentationFromResolvedBody (entity.ParentCellId = record.FullCellId). Trap T6 named the missile arm's residency but not this presentation writer. On a REFUSED missile placement the entity's pose still moves to the destination (acdream's StoreAcceptedDestinationPose fallback) while ParentCellId now stays at the committed source cell. The MAJOR-1 invariant the covering test exists to protect (ParentCellId == record.FullCellId != body.CellPosition .ObjCellId) is unchanged and is now asserted as that identity rather than as a wire-cell constant.
3. The Rebucketed publish edge does NOT always move to CommitRebucket. §3 D2 item 1 says the merge's ternary "becomes always-Updated". It does not, and the ternary is deliberately kept: the Physics.SetPosition.Forget (canonical, restoreCancelledPark: true) call a few statements earlier can roll a wakeable lost-cell park back, and RestoreParkWithdrawal restores canonical residency at the body's committed cell. That is a real cell edge produced inside TryApplyPosition by a placement owner and must still publish as Rebucketed. Collapsing the ternary would have silently downgraded it.

One §5 verdict was checked and stands: LiveEntityHydrationController :1077's FullCellId != 0 gate is unreachable from this change — it sits inside the canonicalSpawn.Position is null branch, and a merged steady-state Position always carries one.

Not done, deliberately: no automated OnPosition-level test drives the full pickup→drop→reproject sequence (no such fixture exists; the collapse matrix fixture does not cover pickup). The claim that production reprojects a dropped item at W2 rests on the code reading above plus the two hydration tests now driving recovery-then-W2 in production order. §9's connected gate recipe item 1 (pickup-then-drop, several times) is the positive evidence for it and has not been run.

---

15. Corrections and hazards found at the C5b closeout (2026-08-05)

Both C5b re-reviews (retail-conformance and architecture) returned PASS on 02578441..ff100cf3. This section carries what they left behind, plus one correction neither of them made and both of them missed twice.

15.1 §1's Gate A teleport test was WRONG on primary source

This document's §1 stated retail's Gate A teleport term two ways, and both were wrong: the trace line read "teleport must NOT be newer", and fact 2 read "TELEPORT_TS equal". It then blessed acdream's teleport == _timestamps[Teleport] (PhysicsTimestampGate.cs:199) as "retail's Gate A pair, verified at HEAD".

Verified against the PDB-paired binary (acclient.exe v11.4186, CodeView GUID 9e847e2f-777c-4bd9-886c-22256bb87f32, check_exe_pdb.py reports MATCH), disassembled with capstone at SmartBox::HandleReceivedPosition 0x0045402B–0x00454054:

00453fff  mov   esi, [esp+0x68]        ; arg2 (the object)
00454003  cmp   esi, ecx               ; == this->player ?
00454005  mov   ebx, [esp+0x80]        ; ebx = arg8 = WIRE teleport stamp
0045401c  call  0x451b10               ; newer_event(player, 6=FORCE_POSITION_TS, arg9)
0045402b  mov   bp,  word [ecx+0x16c]  ; bp = player->update_times[4] == TELEPORT_TS
                                       ;      (base 0x164, 2 bytes/entry -> index 4)
00454032  movzx edx, bx                ; wire
00454035  movzx eax, bp                ; stored
00454038  sub   eax, edx / cdq / xor eax,edx / sub eax,edx   ; abs(stored - wire)
0045403f  cmp   eax, 0x7fff
00454044  jg    0x45404b               ; far apart -> wrapped compare
00454046  cmp   bx, bp                 ; unwrapped: CF <=> wire  < stored
00454049  jmp   0x45404e
0045404b  cmp   bp, bx                 ; wrapped:   CF <=> stored < wire
0045404e  sbb   eax, eax / neg eax     ; eax = CF
00454052  test  eax, eax
00454054  jne   0x4540a0               ; CF set (wire strictly OLDER) -> SKIP Gate A

The shortcut is taken iff the wire teleport stamp is equal or newer (wrap-safe) — "not older". It is CPhysicsObj::newer_event @0x00451B10's identical idiom with the two compare operands swapped: newer_event's unwrapped compare is cmp si(stored), di(incoming) and returns 1 on CF, i.e. "incoming is newer"; Gate A's is cmp bx(wire), bp(stored) and skips on CF, i.e. "wire is older". acclient.h:6090 confirms update_times[4] == TELEPORT_TS, and 0x00454084's mov word [edx+0x164], ax confirms the array base via the POSITION_TS stamp.

Why two review rounds missed it. Binary Ninja drops the flag test and renders the whole sequence as if (-((eax_7 - eax_7)) == 0) — vacuously true. Reading the pseudo-C, at any level of care, cannot recover this. Reading the bytes takes five minutes. This is the same class as the PE byte-decode finding in claude-memory/reference_pe_byte_decode.md: when a decomp renders a comparison as a tautology, that is a decompiler artifact signature, not a retail fact.

Consequence. acdream's ForcePosition disposition is a strict SUBSET of retail's Gate A set. Filed as AP-148 with issue #325. Not fixed here: see the AP row and the issue for why it is not a one-line comparison swap.

C5b's own effect on this row is marginally POSITIVE, not negative. clearParent was unconditionally true before C5b and is !force after — unchanged for the misrouted Apply. installPlacementFrame went unconditional true → !force && !hasAnimations, i.e. toward retail's "Gate A never reaches SetPlacementFrame" for the animated half. C5b neither introduced nor widened the narrowing; it narrowed the damage.

15.2 The no-window route had no pre-merge payload validation

Retail finding F2 / architecture finding L-A, found independently by both re-reviewers. Fixed in the closeout commit rather than documented: the no-window route (RuntimeLiveEntitySessionController.OnPositionUpdated) now applies the same predicate at the same point as the graphical route's payloadIsValid gate. See AD-64 and the method's own comment. The choice was the root fix rather than a documented asymmetry because the fix is five lines, reuses an existing Runtime predicate verbatim (RuntimeAuthoritativePositionRouteClassifier.IsValidCreateWirePosition plus the finite-velocity term — the exact pair RuntimeEntityObjectLifetime.TryApplyPosition already applies on its initial-residence branch), and leaving it would have left two written claims falsified by the code (the TryCommitAcceptedWireCell doc's "under the same reachability rules the graphical OnPosition route applies" and AD-64's "whose gates were derived from those returns one by one").

It is a behaviour change, and its blast radius is bounded by argument, not by a gate. Headless now drops packets it previously merged. Against ACE the set is empty: ACE resolves cell 0 at Position construction and never serializes a NaN/Inf frame, and PositionPack writes a real ObjCellId. The shape is unreachable in the same way it has always been unreachable for the graphical host, which has carried this gate since it was written. Two test fixtures did carry illegal cell ids (low word 0x41 and 0x51, both above LandDefs.CellLowInRange's 0x40 landcell ceiling); their constants were corrected, their assertions were not.

15.3 BISECT HAZARD — 735f0a72..23aa62f2 contain a live headless defect

A git bisect that lands anywhere in this range will hit a real, unrelated defect. 735f0a72 (the C5b implementation) made the steady-state Position merge withhold the wire cell, and the replacement writer it relied on — the OnPosition prologue rebucket — lives in AcDream.App. The no-window host has no analogue, so across that range every remote entity's FullCellId is frozen at its placement value for the whole session in AcDream.Headless, and the local player loses one of AP-146's three cell-refresh edges. Nothing throws and no test in that range fails; a bot's RuntimeEntitySnapshot.CellId simply stops advancing, and RuntimeSetPositionState.IsAffectedCollisionResident parks bodies against a landblock they have left.

Fixed at ff100cf3 (the D1 fix). The range is three commits: 735f0a72, ed806997, 23aa62f2.

If you are bisecting a headless cell/residency symptom, treat any bad verdict inside that range as suspect and re-test with ff100cf3's RuntimeLiveEntitySessionController.TryCommitAcceptedWireCell cherry-picked on top. Structural cause: issue #324 (two parallel, non-shared inbound routes); residual duplication: AD-64.