acdream/docs/plans/2026-08-02-placement-cutover.md

Placement production cutover — campaign plan (2026-08-02)

The final leg of the remaining physics-divergence campaign before AP-22 and AD-10: route graphical AND headless production placement through the residence + continuation-executor owner (38fd4b8d / 30012361 / 5db3de3c), delete the legacy duplicate authorities, and retire AP-1/AD-1 behind connected + user-visual gates.

Inputs (read in order):

1. 2026-08-02-runtime-continuation-executor-handoff.md — the completed dormant mechanism and its cutover notes.
2. 2026-08-02-cutover-route-inventory.md — the full 8-route, both-host call-chain inventory with exact file:line for every duplicate authority to remove. THE map for all slices below.
3. 2026-07-31-remaining-physics-campaign-handoff.md — the original per-route requirements and prerequisite definitions.

Standing discipline per slice: pinned contract → single implementer → independent retail-conformance + architecture/adversarial reviews (both must PASS on the final diff) → focused + complete Runtime + Release build + complete solution gates → bisectable behavior commit (register rows in the same commit) → docs/handoff commit. No workarounds; no fused slices.

Confirmed pre-cutover gaps (from the inventory)

• The executor publishes only generic entity deltas; nothing bridges its completion to RuntimePlacementProjectionChannel, so no host can learn "my initial placement committed" through the built observer seam.
• No atomic controller/body publication owner exists (prerequisite C); App and headless hand-write divergent PlayerMovementController construction, and SubmitPreparedPlacement requires a canonical PhysicsBody that nothing currently publishes atomically.
• The dormant placement path's 1,880 B/operation (2,048 cap) allocation remains the activation blocker for frame-frequency routes.
• Execute's live inputs (UsePositionFromServer, PlayerDistance) are computed by no host; they must derive from Runtime's own character-option and local-player owners.
• RuntimePortalPlacementAuthority has zero producing call sites; the adapter from RuntimeWorldTransitState does not exist.
• The exact-Setup mover chain (PrepareMover / RuntimeSetPositionMoverPreparer.TryBuild / IPreparedCollisionSource.ReadSetupCollision) exists piecewise, unwired.
• Route-6 split-recovery creates need an effect-replay suppression signal; route-7 needs TryCommitParent/CommitWithdrawal cancellation-symmetry fixes and host-visible cancellation receipts; headless lacks any parent-realize sequence (pre-existing, adjacent).

Slices

• C0 — Runtime bridge + live inputs — COMPLETE at 67f63e85 (2026-08-02, dual reviews PASS). The executor publishes an acknowledge-only ExecutorCompleted receipt through the one placement stream (registered before dispatch; correlation reaped on acknowledgement/discard/clear; PendingCompletionReceiptCount in IsConverged); all three production sinks acknowledge-and-ignore the kind via early returns proven behavior-preserving for every other kind (sanctioned seam completion — provably inert, no production publisher); UsePositionFromServer derives retail-exactly from RuntimeCharacterState.AutonomyLevel != 2 and PlayerDistance from the live movement controller with null-safe fallback to the caller struct; TryPrepareAndSubmitAuthoredPlacement chains the prepared-collision Setup read through PrepareMover to submission with zero validation changes; TryCommitParent/CommitWithdrawal gained the sibling cancellation flow (the LeaveWorld omission in TryCommitParent is retail-REQUIRED per set_parent 0x00515A90:283832-283833's single gated leave_world). Not fully dormant by design: the two cancellation fixes change live Runtime paths production already calls; everything else has no production caller. C3 prerequisites recorded from C0's reviews: (a) the completion receipt/trace surface is internal-only — C3 must define the public host consumption shape when it wires the hosts; (b) PlayerDistance is resolved once per Execute entry, not per continuation — a multi-Position FIFO classifies later entries against entry-time distance (documented deferral; refine at C3/C4 if the connected gates show it matters); (c) any future host exposure of TrySetAutonomyLevel must carry retail's SendAutonomyLevelEvent (699550).
• C1 — atomic controller/body publication — SATISFIED BY EXISTING MECHANISM (research finding 2026-08-02, plan amended same session). RuntimeLocalPlayerPhysicsPublicationState (1,033 lines) plus the ~15-method dormant local-activation family on RuntimeSetPositionState already implement the full sanctioned option-2 transaction: off-canonical preparation against a scratch quantum clock and a sealed candidate controller, one validated atomic Commit, and a staged Evaluate/Commit/FinalizeActivation chain re-validated against PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session identity at every entry — with zero production callers. See 2026-08-02-canonical-body-writer-map.md (6 canonical body writers; the two host escape hatches; both hosts' divergences). The remaining work — routing both hosts' local-player construction through the publication lifecycle, sealing the public RuntimeLocalPlayerMovementState.Controller setter, retiring App's direct object-clock bypasses, and containing headless's uncaught prepared-collision InvalidDataException — IS the C3 route-1 flip and moves there. No separate C1 commit.
• C2 — placement allocation budget. Pool or eliminate the operation/ projection envelope allocations on the accepted placement path (root cause, not a raised cap), or obtain explicit user approval for a measured budget. Re-measure; the regression gate keeps the ceiling.
• C3 — spawn-frequency cutover: routes 1 + 8. Flip graphical AND headless initial Create/login registration to RegisterEntityWithInitialResidence + executor + placement receipts together; MaterializeProjection/BuildControllerAndCamera/ SynchronizeLocalPlayer become projection + acknowledgement only; presentation-only rebucketing (RebucketLiveEntity loses CommitRebucket). Gates add the exact lifecycle/reconnect connected route.
• C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the RuntimeWorldTransitState → RuntimePortalPlacementAuthority adapter), 4 (remote Create/Position; delete RemoteTeleportController/Placement and the inline MoveOrTeleport duplicate), 5 (projectile authoritative), 6 (drops + split-recovery marking), 7 (residual pickup/parent/delete polish). May land as more than one commit if a route proves large; each sub-landing keeps the full review discipline.
• C5 — legacy deletion + closeout gates. Delete every superseded legacy path; parity tests; exact lifecycle/reconnect + canonical nine-stop connected routes; two-client observation; user visual matrix (the campaign's stopping point for user acceptance). Retire AP-1, AD-1, AP-131, AD-60's legacy half, and close #275. Update register/roadmap/ milestones/architecture/memory + successor handoff.

After C5: AP-22 (authored collision shapes), then AD-10 (remote contact-plane projection), then the campaign's final matrix and ledger closeout; vendor Slice 5 resumes.