acdream/docs/research/2026-08-06-280-d1-fix-review.md

# #280 D-1 fix review — commit `73cdb95c`

**Date:** 2026-08-06
**Subject:** `fix(streaming): make a demoted landblock render-ready like a
published one (#280 D-1)`, commit `73cdb95c`, branch
`claude/acdream-physics-divergence-5aa784`.
**Mode:** adversarial, read-only, both lenses (retail conformance +
architecture). No subagents; everything below was executed inline.

## Verdicts

| Lens | Verdict |
|---|---|
| **Retail conformance** | **PASS** (one LOW documentation defect) |
| **Architecture** | **PASS** (three LOW latent risks, three style notes) |

**Is D-1 genuinely closed?** Yes, for the transition it names, and the fix is
at the state owner rather than at the predicate — the non-workaround shape.
Verified end to end: after a Near→Far demote the landblock ends with exactly
the spawn-adapter registration a `PublicationKind.Far` activation installs, on
both retirement call sites, and the reveal gate reopens.

---

## 1. What was reproduced independently

Everything below was run in this worktree at `73cdb95c`, from a **genuinely
clean rebuild** — all 42 `obj`/`bin` directories under `src/`, `tests/`,
`tools/` deleted first, so no stale test DLL could carry a deleted symbol.

| Claim | Result |
|---|---|
| Release build, 0 errors | ✅ reproduced (21 warnings total: 18 xUnit analyzer + 3 CS8767 nullability, all pre-existing) |
| Full suite `-m:1`, `ACDREAM_PAK_PATH` set | ✅ **11,192 passed / 4 skipped / 0 failed** |
| App.Tests 4157 → 4170 | ✅ App.Tests = 4,170 / 3 skips |
| +13 net reconciles to this commit | ✅ 3 readiness Facts + 1 integration Fact + 2 warmup Facts + 7 Theory rows = 13 |
| No new skips | ✅ 4 skips, unchanged from the `fafc0b65` baseline figure |
| Sabotage: no-op re-assert → the four new tests fail, others pass | ✅ **4 failed / 324 passed** in the Streaming filter; the four failures are exactly the four named tests |
| The `?? true` tautology is really dead | ✅ verified independently (below) |
| Blast radius: four types App-internal | ✅ Headless/Runtime/Core/Core.Net/UI.Abstractions reference them only in comments; Headless tests 89/89 green |
| Retail binary pairs with our PDB | ✅ `check_exe_pdb.py` → `MATCH` (GUID `9e847e2f-…`, linker 2013-09-06) |

Per-assembly breakdown of the 11,192: App 4170/3, Bake 15, Cli 4, Content 124,
Core.Net 764, Core 4263/1, Headless 89, Runtime 1217, UI.Abstractions 546.

**Tree restored.** Both sabotages (and a third, described in L1) were reverted;
`git status --short` is empty and the solution rebuilds clean.

### 1.1 The sabotage, reproduced

Inserted `if (landblockId != 0u) return;` immediately after the
`OnLandblockUnloaded` call in
`src/AcDream.App/Streaming/GpuWorldState.cs:1602`, rebuilt, ran the Streaming
filter:

```
NearToFarDemote_LeavesTheLandblockRenderReadyThroughTheRealPipeline   [FAIL]
NearToFarDemote_LeavesTheLandblockRenderReadyUnderBudgetedRetirement  [FAIL]
TieredWindow_StaysResidentAfterAnOuterRingDemote                      [FAIL]
OutdoorReveal_SurvivesAnOuterRingDemoteDuringTheHold                  [FAIL]
Failed: 4, Passed: 324, Total: 328
```

The commit's claim was "all four fail, 315 others pass"; the true sibling count
under a `~Streaming` filter is 324. The substance — exactly these four, nothing
else — holds.

### 1.2 The tautology-kill, verified rather than accepted

The commit claims the pre-existing `WorldRevealDerivedWindowIntegrationTests`
fixtures were stubbed out by `IsRenderReady`'s
`(_wbSpawnAdapter?.IsLandblockRenderReady(id) ?? true)`
(`GpuWorldState.cs:180-181`). I tested that directly: with the **production fix
still sabotaged**, I reverted only the new D-1 integration test's world
construction back to `new GpuWorldState()` (no adapter).
`OutdoorReveal_SurvivesAnOuterRingDemoteDuringTheHold` **passed**.

That is conclusive: the null adapter degenerated `IsRenderReady` to `IsLoaded`,
the fixture change is load-bearing, and the new test would have been another
green-covering-nothing test without it.

---

## 2. Architecture lens — the four attack surfaces

### 2.1 Can the re-assert fire when it must not? — No.

The guard is
`_loaded.TryGetValue(canonical, …)` **and**
`_tierByLandblock[canonical] == Far` (`GpuWorldState.cs:1604-1611`).
Checked by symbol against every teardown path:

- **Full retirement.** `DetachLandblock` removes both maps —
  `_tierByLandblock.Remove(canonical)` at `GpuWorldState.cs:1298` and
  `RemoveLoadedLandblock` at `:1299` (→ `_loaded.Remove` at `:435`). It runs at
  `LandblockRetirementCoordinator.cs:680-682`, **before** the ticket is created
  at `:702`, so by the time `AdvanceTicket`/`AdvanceTicketOne` reach the
  `MeshReferences` stage both conditions are already false.
- **Origin recenter.** `DetachAllForOriginRecenter` does `_loaded.Clear()`
  (`:1481`) and `_tierByLandblock.Clear()` (`:1485`) synchronously inside the
  call; `AdoptDetachedFull` only creates ledgers afterwards
  (`LandblockRetirementCoordinator.cs:393-474`).
- **Landblock replacement at the same canonical id while a receipt is still
  draining.** Fenced. `StreamingController.IsPublicationBlockedByRetirement`
  (`:2094`) is installed as the completion queue's peek predicate (`:1707`), so
  no `Loaded`/`Promoted` completion is applied while any retirement is pending
  for that id — the one funnel every completion goes through. This is what
  makes the resurrection scenario unreachable, and it is also why the
  `retained` record the re-assert reads is guaranteed to be the post-demote
  record and not a newer generation.
- **Near-layer retirement of a landblock that is not loaded** (pending-near or
  pending-render-ids only): `DetachNearLayer` returns a receipt without ever
  entering the `_loaded` branch (`:1854-1889`), so `_tierByLandblock` is
  untouched and the guard's `_loaded` lookup fails.
- **Mixed-kind ordering.** NearLayer ticket pending, then a Full begins:
  `BeginCore`'s same-kind scan (`:647-668`) does not match, `DetachLandblock`
  clears both maps, and the stale NearLayer ticket's release finds nothing.
  Reverse order: `DetachNearLayer` returns `null` (`hadNearLayer` false), so no
  second ticket exists.

**Verdict:** the guard cannot resurrect a registration on a genuinely unloaded
landblock. No scenario found.

### 2.2 Ordering, interleaving, double-fire, clobbering — clean.

- **"Converges before the re-assert" is structurally enforced, not asserted.**
  `LandblockSpawnAdapter.OnLandblockUnloaded` ends in `ThrowFailures`
  (`:180-182`), so any unreleased reference throws out of the method and the
  re-assert is unreachable. The retirement ticket retries; the second pass
  finds the registration already dropped (`:161-162` early return), does not
  throw, and the re-assert then fires. Convergent.
- **No reentrancy.** For a demote the re-assert's `unique` set is empty, so
  `OnLandblockLoaded` makes **zero** adapter calls. The unload's
  `DecrementRefCount` path (`WbMeshAdapter.cs:405-409`) only forwards to
  `ObjectMeshManager` and never re-enters `GpuWorldState`.
- **Cannot fire twice per ticket.** `RunOnce`/`RunOnceStep` mark the
  `MeshReferences` stage complete on success.
- **Cannot clobber a live registration.** This is the important one, and it is
  a real safety property rather than an accident:
  `OnLandblockLoaded` calls `MarkAllUndesired` **only** inside
  `else if (!registration.WantsLoaded)` (`LandblockSpawnAdapter.cs:103-112`).
  Re-asserting an empty set over a still-live registration therefore marks
  nothing undesired, releases only already-undesired leftovers, and re-acquires
  desired-but-unheld ones. It is a convergence step, never a teardown.

### 2.3 Is the empty set genuinely empty? — Yes, verified both halves.

- `DetachNearLayer` (`GpuWorldState.cs:1866-1885`) puts only `ServerGuid != 0`
  entities into `retainedLive`; every `ServerGuid == 0` entity goes to
  `retiredEntities` and `RemoveFlatEntity`.
- `OnLandblockLoaded`'s atlas-tier filter skips exactly `ServerGuid != 0`
  (`LandblockSpawnAdapter.cs:88`). Intersection is empty by construction.
- **Live server entities lose nothing**, because they were never registered
  here — they belong to `EntitySpawnAdapter`, and nothing in
  `ReleaseLandblockMeshReferences` touches it.
- **Prepared (EnvCell shell) ids also match**, which the commit asserts but does
  not show. Verified: a `PublicationKind.Far` transaction builds
  `farLandblock` with `Array.Empty<WorldEntity>()` and
  `new LandblockBuild(farLandblock, Origin)` — no `EnvCells`
  (`LandblockPresentationPipeline.cs:442-464`), so
  `renderIds = transaction.Build.EnvCells?.Shells…` is `null` at `:899-901`.
  The re-assert's `additionalReadinessIds: null` therefore reproduces the Far
  registration exactly, `Prepared` dictionary included.
- The ordering claim added to `StreamingController.cs:271-279` also checks out:
  presentation (terrain upload) commits at `PresentationCommitted`
  (`LandblockPresentationPipeline.cs:874`) **before**
  `SpatialPresentationCommitted` runs `ActivateLandblockPresentation` →
  `OnLandblockLoaded` (`:882-925`).

### 2.4 All four call sites — correct, and the placement argument holds.

| Site | Path | Behaviour under the new meaning |
|---|---|---|
| `LandblockRetirementCoordinator.cs:740` (`AdvanceTicket`, legacy) | after detach commit | full → guard fails; near-layer → re-assert. Correct. |
| `LandblockRetirementCoordinator.cs:801` (`AdvanceTicketOne`, budgeted) | after detach commit | same. This is production's path (`CreateBudgeted`) and has its own test. |
| `GpuWorldState.cs:1549` (`RemoveLandblock`) | after `DetachLandblock` | both maps cleared → guard fails. Correct. |
| `GpuWorldState.cs:1907` (`RemoveEntitiesFromLandblock`) | after `DetachNearLayer` | re-assert fires. Correct — it is the same demote semantics. |

The architecture review's "test-only compatibility edge" flag on
`RemoveEntitiesFromLandblock` is accurate and harmless: `grep` shows zero
production callers for it or for `GpuWorldState.RemoveLandblock` (the many
`.RemoveLandblock(` hits are on `TerrainModernRenderer`, `EnvCellRenderer`,
`CellVisibility`, `PhysicsEngine.ShadowObjects`, `CellGraph` — different
types). Placing the fix at the state owner rather than the retirement stage is
the right call: it covers all four with one invariant, and the two compat edges
now agree with production instead of diverging from it.

### 2.5 R-2 (composite-warmup trigger) — a real restoration, gate not weakened.

Checked against `3aab05b0^` (pre-#280): `Prepare` used a single
`radius = RequiredRenderRadius(cell)` = `OutdoorNeighborhoodRadius` = 1 for
**both** the readiness test and `_prepareCompositeTextures`. Trigger scope ==
domain scope. #280 widened only the gate. The new
`_isRenderNeighborhoodReady(cell, near, near)` restores that identity.

- **The gate is untouched.** `Evaluate` still calls
  `_isRenderNeighborhoodReady(cell, required.NearRadius, required.FarRadius)`
  and still ANDs `_areCompositeTexturesReady()`
  (`WorldRevealReadinessBarrier.cs:184-194`).
- **The trigger is not a rubber stamp.** With `farRadius == nearRadius`, every
  member of `IsRenderNeighborhoodResident`'s loop satisfies `isInnerRing`, so it
  demands `IsNearTier && IsRenderReady` for the whole near square — the strict
  pre-#280 predicate, not a relaxation.
- **Starting earlier cannot latch a stale ready.**
  `WbDrawDispatcher.PrepareCompositeTextures` is built for repeated per-frame
  calls: `RequiresCompositeWarmupRebuild` / `ShouldBeginCompositeWarmupRescan`
  run *before* the `if (CompositeTexturesReady) return` early-out (`:168-189`),
  and a rescan resets `CompositeTexturesReady` (`:330-332`). Far-tier builds
  carry no entities, so far-ring publication adds nothing to the domain anyway.
- Two tests cover both directions
  (`Prepare_StartsWarmupOnceTheNearSubWindowIsPublished`,
  `Prepare_StillWaitsWhenTheNearSubWindowIsIncomplete`), and the first also
  asserts `IsReady` is still false.

It **is** a behaviour change riding in a fix commit. It is disclosed in the
message, scoped to warmup timing, tested, and provably a restoration rather
than a new position. Acceptable.

### 2.6 R-1 (`ParseRadius` floor 1) — correct and inert.

`ACDREAM_PROBE_REVEAL_RADIUS=0` yielded `far = 0` for an outdoor destination
(`ApplyRevealRadiusOverride`, `StreamingDiagnostics.cs:48-51`), which Runtime's
`invalid-readiness-shape` invariant rejects on every acknowledgement. Rejecting
it at the parser makes the probe fall back to the derivation. Diagnostic-only,
7-case table test, no production behaviour touched.

### 2.7 Blast radius across both hosts — verified.

`GpuWorldState`, `LandblockSpawnAdapter`, `WorldRevealReadinessBarrier`,
`StreamingDiagnostics` appear in `AcDream.Headless`, `AcDream.Runtime`,
`AcDream.Core`, `AcDream.Core.Net`, `AcDream.UI.Abstractions` **only in
comments**: `HeadlessSessionWorldProjection.cs:963`,
`RuntimeRemotePlacementDriveController.cs:13` and `:356`,
`RuntimeWorldTransitState.cs:576`, `WorldEntity.cs:14`. `AcDream.Headless.Tests`
ran 89/89 green in my own clean run. C5b's "survey skipped the no-window host"
failure mode is not repeated.

Worth recording: `tests/AcDream.Core.Tests/Streaming/GpuWorldStateTwoTierTests.cs`
exercises `GpuWorldState` from the *Core* test project. That is a test-project
reference, not a production dependency, and all 4,263 Core tests are green — but
it means "App-internal" is true of production only.

---

## 3. Retail-conformance lens

All addresses below were decoded from
`C:\Users\erikn\Downloads\acclient.exe`, confirmed `MATCH` against
`refs/acclient.pdb`. **Where a comparison or constant is load-bearing I
disassembled rather than trusting Binary Ninja**, per the C5b/#317 lesson: BN
prints `bool p_2 = /* unimplemented {test ah, 0x41} */` at the exact site
AP-150 rests on.

### 3.1 AP-150 clause 1 — "unconditional per tunnel rotation segment": CONFIRMED

`gmSmartBoxUI::UseTime` @`0x004D6E30`. Decoded from `0x004D6FC1`:

```
004D6FC1  dc 86 40 06 00 00   fadd  qword [esi+0x640]   ; + teleportRotationStartTime
004D6FC7  dc 5c 24 18         fcomp qword [esp+0x18]    ; vs Timer::cur_time
004D6FCB  df e0               fnstsw ax
004D6FCD  f6 c4 41            test  ah, 0x41            ; C0|C3
004D6FD0  0f 8a de 00 00 00   jp    0x004D70B6
```

`test ah,0x41` sets PF from the popcount of `ah & 0x41`: `0x00` (segment still
running) and `0x41` (unordered) are even → **jump taken**, into the
angle-interpolation block at `0x004D70B6`. `0x01` (expired) and `0x40` (exactly
equal) are odd → **fall through**, into the re-randomise + emit block. So the
notice sits on the segment-**expired** path, which is what AP-150 says.

Within that block the only conditional jumps are the temporary string's
refcount-release guard:

```
004D708C  75 0c   jnz 0x004D709A
004D7090  74 08   jz  0x004D709A
...
004D709A  8d 4c 24 30   lea  ecx, [esp+0x30]
004D709E  51            push ecx
004D709F  6a 1a         push 0x1A
004D70A1  e8 0a b5 1b 00 call 0x006925B0   ; ECM_UI::SendNotice_DisplayStringInfo
```

Both branch targets are `0x004D709A`, i.e. immediately *before* the call. There
is no `blocking_for_cells` test, no elapsed-time test, no once-only latch. The
emit is unconditional on every segment expiry while the state is one of
`TAS_TUNNEL{,_FADE_IN,_CONTINUE,_FADE_OUT}`. **Claim confirmed.**

### 3.2 AP-150 clause 2 — `RandDouble(0.6, 1.8)` at `0x004D6FE6`: CONFIRMED

```
004D6FE6  68 cc cc fc 3f   push 0x3FFCCCCC   ; hi(1.8)
004D6FEB  68 cd cc cc cc   push 0xCCCCCCCD   ; lo(1.8)
004D6FFA  68 33 33 e3 3f   push 0x3FE33333   ; hi(0.6)
004D6FFF  68 33 33 33 33   push 0x33333333   ; lo(0.6)
004D7016  e8 b5 d3 1a 00   call 0x006843D0   ; RandDouble  (symbols.json ✓)
004D701B  dd 9e 48 06 00 00 fstp qword [esi+0x648]  ; teleportRotationDuration
```

`0x3FFCCCCCCCCCCCCD` = 1.8, `0x3FE3333333333333` = 0.6. cdecl pushes reverse,
so the last push (0.6) is arg 1 → **`RandDouble(0.6, 1.8)`**, exactly as
claimed, and `0x004D6FE6` is the correct anchor. The sibling
`teleportRotationEndAngle = RandDouble(0, 360)` also checks out
(`push 0x40768000` @`0x004D702D` = hi(360.0), three `push 0` for lo/0.0).

acdream's `PortalTunnelPresentation.cs:62-63` are `RotationDurationMin = 0.6f`,
`RotationDurationMax = 1.8f`, and `TickRotation` re-randomises with
`NextDouble(0.0, 360.0)` — cadence is faithful. The arming is not:
`RuntimeWorldTransitState.cs:66-67` `RetailWaitCueDelay = 5 s`, enforced at
`:680` (`elapsed < RetailWaitCueDelay → return false`) with a once-only
`WaitCueShown` latch, and `PortalTunnelPresentation.cs:380` re-emits only
`if (_waitCueVisible)`. **"Only the arming is wrong" is exactly right.**

### 3.3 AP-150 clause 3 — the 5.0 at `0x007991B0` is unrelated: CONFIRMED

`CellManager::CheckPrefetchStatus` @`0x00455BE0`:

```
00455BE0  dd 05 a8 69 83 00   fld   qword [0x008369A8]  ; Timer::cur_time
00455BE9  dc 66 10            fsub  qword [esi+0x10]    ; - last_prefetch_check
00455BEE  dc 1d b0 91 79 00   fcomp qword [0x007991B0]  ; vs 5.0
00455BF4  df e0               fnstsw ax
00455BF6  f6 c4 41            test  ah, 0x41
00455BF9  75 2a               jnz   -> return 0
```

The double at `0x007991B0` is exactly `5.0`. It is a prefetch **retry throttle**
— skip `PreFetchCells` unless 5 s have elapsed. The tunnel-cue code path
`0x004D6FC0`–`0x004D70B2` contains no reference to `0x007991B0`. **#280's
commit message mis-attribution is correctly retracted.**

### 3.4 AP-151 — the gate is stricter than retail's DAT-residency predicate: CONFIRMED

`LScape::PreFetchCells` @`0x00505660` walks the `mid_radius` square, applies the
`>= 0x7f8` bounds test the `StreamingController` comment cites, and per member
does only `DBObj::PreFetch` → `CACHE_OBJECT_IN_MEMORY`/`IN_FILE` → `DBObj::Get`
non-null → `CLandBlock::PreFetchCells`. No geometry construction, no vertex
buffers, no upload — all of that is lazy at draw. acdream's per-member predicate
(worker DAT read, terrain mesh build, render-thread upload, spatial commit,
collision admission, spawn-adapter activation, metered) is unambiguously
heavier. **Claim confirmed**, and correctly recorded as the *opposite*
asymmetry from AP-149.

### 3.5 Collateral citations, all spot-checked

| Citation | Result |
|---|---|
| `SmartBox::set_mid_radius` @`0x00453180` (#326 correction) | ✅ `symbols.json`; and `0x004531D0` is genuinely the mid-function re-arm — `CellManager::ChangePosition(cell_manager, &player->m_position, 1)` |
| `SmartBox::SetRegion` @`0x004531F0` | ✅ and it assigns `mid_radius` from `Render::m_RenderPrefs.LandscapeDrawDistance` |
| `Render_LandscapeDrawDistance_Values` @`0x007CA988` = {3,5,8,11,15,25} | ✅ byte-read from `.rdata` |
| `LScape::SetMidRadius` @`0x00504C00`, `SmartBox::UseTime` @`0x00455410`, `CellManager::PreFetchCells` @`0x00455820`, `CEnvCell::PreFetchCells` @`0x0052D1E0`, `CLandBlock/CLandBlockInfo/CBldPortal::PreFetchCells` @`0x00530240`/`0x0052E7C0`/`0x0053BD00`, `gmSmartBoxUI::BeginTeleportAnimation` @`0x004D6300` | ✅ all match |
| Wait-cue string VA `0x007BD6A8` | ✅ `push 0x7BD6A8` @`0x004D705B` |
| Issue `#327` referenced by AP-151 | ✅ exists (`docs/ISSUES.md:1761`) |

---

## 4. Findings

### Defect — LOW (documentation)

**D1. AP-150 cites the wrong address for the notice call.**
`docs/architecture/retail-divergence-register.md:179` reads
"`ECM_UI::SendNotice_DisplayStringInfo` call @0x004D7064". `0x004D7064` is the
`PStringBase<unsigned short>::PStringBase` constructor call. The
`SendNotice_DisplayStringInfo` call is at **`0x004D70A1`**
(`e8 0a b5 1b 00` → `0x006925B0`, which `symbols.json` confirms is
`ECM_UI::SendNotice_DisplayStringInfo`). Every other address in the row is
correct, and neither `docs/ISSUES.md` #329 nor the contract doc repeats the
error. This is precisely the class of off-by-one-call-site citation error the
same commit corrected for #326 — worth fixing so a future reader setting a cdb
breakpoint from the register lands on the right instruction.

### Latent risks

**L1 — LOW. The "empty by construction" invariant is guarded, but not at the
seam this fix newly depends on.**
The new doc-comment on `ReleaseLandblockMeshReferences` states the re-assert is
safe because "the retained entity list holds only live server projections,
which the adapter's atlas-tier filter skips". I tested that dependency: I
removed the filter (`if (entity.ServerGuid != 0) continue;`,
`LandblockSpawnAdapter.cs:88`) and **all 4,170 App tests passed**. Only two
tests anywhere caught it, both in `AcDream.Core.Tests`
(`LandblockSpawnAdapterTests.OnLandblockLoaded_SkipsServerSpawnedEntities`,
`PendingSpawnIntegrationTests.LiveEntity_ParkedBeforeLandblock_DrainsButIsNotRegisteredWithAdapter`),
and both at the adapter's unit level rather than through a demote.
No test demotes a landblock retaining a live server projection that carries
`MeshRefs` — the discriminating case. The filter itself is protected, so this
is not a defect; but if it were ever relaxed deliberately, a Far-tier
landblock's `IsRenderReady` would start depending on live-entity mesh
readiness, which is a D-1 variant (a live entity whose mesh never becomes ready
makes the outer ring permanently un-ready) and nothing at the composition level
would fail. One test with a live entity carrying a `MeshRef` through
`BeginNearLayerRetirement` would close it.

**L2 — LOW. The fix is repair-after-self-inflicted-teardown, not
release-the-near-layer-only.**
`ReleaseLandblockMeshReferences` unregisters then re-registers. That is
functionally sound today because (a) nothing observes `WantsLoaded` between the
two synchronous calls, and (b) `RunOnce`/`RunOnceStep` make the whole method
all-or-nothing so it can never be suspended between them. The stronger shape
would be "release the Near layer's references and leave the registration
standing", which would carry the invariant structurally. As written, a future
budgeted split of this method into two metered steps would silently reopen
D-1 — the ticket-stage granularity is the only thing preventing it, and that is
not stated at the site.

**L3 — LOW. The restated P2 obligation is literally stronger than what the code
guarantees.**
`docs/research/2026-08-05-280-contract.md` now states: *"no transition may
revoke `IsRenderReady` from a landblock that stays inside `FarRadius`"*. A
Far→Near **promote** does revoke it transiently — new entity mesh references
are registered before their upload completes — and that is correct behaviour,
and is how the inner arm is meant to be satisfied. The obligation that actually
holds is *"…may revoke it with no path to restoration"*. Since the first
wording of P2 (discharged against residency instead of `IsRenderReady`) is
exactly what let D-1 ship, the precision of the restatement matters more here
than usual.

### Style

**S1.** `ReleaseLandblockMeshReferences` calls
`_wbSpawnAdapter.OnLandblockUnloaded(landblockId)` with the **raw** id
(`GpuWorldState.cs:1602`) but performs both guard lookups on `canonical`
(`:1604-1611`). Production always passes canonical ids (both coordinator paths
canonicalize at `Begin*`; both compat edges pass `retirement.LandblockId`), so
this is inert today. But inside a nine-line method the asymmetry invites a
future non-canonical caller into "unregister nothing, then register something",
which the registration's idempotence would silently absorb. Canonicalize once
at the top.

**S2.** `WorldRevealDerivedWindowIntegrationTests.RecordingMeshAdapter`
implements `IsRenderDataReady(ulong) => true`, so the mesh-readiness arm of
`IsLandblockRenderReady` is still stubbed in that file — the sibling
`ReadinessMeshAdapter` in `StreamingControllerReadinessTests` uses honest set
membership. The fixture change removed the load-bearing tautology (the
`?? true`), which is the one that mattered; this residual is worth a comment so
the next reader does not over-read "real spawn adapter" as "real readiness".

**S3.** `StreamingDiagnostics.ParseRadius` widened `private` → `internal` purely
so the 7-case table test could call it. Reasonable, noted only because it is a
test-driven visibility relaxation on a diagnostic owner.

---

## 5. Process-rule compliance

Checked against `CLAUDE.md`: no suppression flag, no grace period, no symptom
guard, no retry loop, no `try/catch` swallow, no new skip, no weakened
assertion. Skips stayed at 4. The rejected alternative
(`|| (IsFarTier && IsLoaded)` at the gate) is correctly identified as the
symptom-guard shape and correctly declined. The register rule was honoured —
AP-150 and AP-151 were filed in the same commit as the finding, AD-2's false
clause was corrected rather than left standing, AP-115 was scope-noted, and the
user-visible presentation change (retail's unconditional emit) was filed as
#329 rather than folded in. Known flakes #302/#308/#321 did not surface in my
run and are not conflated with anything above.

## 6. What was checked and found clean (so the PASS is auditable)

Guard reachability during full retirement, removal, origin recenter, session
reset, generation change and same-id replacement · retirement-ticket ordering
relative to spatial detach · same-kind and mixed-kind ticket interleaving ·
throwing-release retry semantics · adapter reentrancy into `GpuWorldState` ·
double-fire · live-registration clobbering · atlas-tier emptiness · prepared
(EnvCell) id parity between demote and Far arrival · terrain-upload-before-
registration ordering · all four `ReleaseLandblockMeshReferences` call sites ·
production-caller census for both compat edges · `Evaluate` unchanged by R-2 ·
`IsRenderNeighborhoodResident(cell, near, near)` strictness · composite-warmup
rescan/reopen semantics · R-1 probe floor · cross-assembly references from
Headless/Runtime/Core/Core.Net/UI.Abstractions · clean-rebuild suite totals and
their per-assembly decomposition · the +13 delta reconciliation · both
sabotages · nine retail symbol addresses, four byte-level decodes, and two
IEEE-754 constant pairs.