acdream/docs/plans/2026-08-02-placement-cutover.md

# Placement production cutover — campaign plan (2026-08-02)

The final leg of the remaining physics-divergence campaign before AP-22 and
AD-10: route graphical AND headless production placement through the
residence + continuation-executor owner (`38fd4b8d` / `30012361` /
`5db3de3c`), delete the legacy duplicate authorities, and retire AP-1/AD-1
behind connected + user-visual gates.

**Inputs (read in order):**
1. [`2026-08-02-runtime-continuation-executor-handoff.md`](../research/2026-08-02-runtime-continuation-executor-handoff.md)
   — the completed dormant mechanism and its cutover notes.
2. [`2026-08-02-cutover-route-inventory.md`](../research/2026-08-02-cutover-route-inventory.md)
   — the full 8-route, both-host call-chain inventory with exact file:line
   for every duplicate authority to remove. THE map for all slices below.
3. [`2026-07-31-remaining-physics-campaign-handoff.md`](../research/2026-07-31-remaining-physics-campaign-handoff.md)
   — the original per-route requirements and prerequisite definitions.

**Standing discipline per slice:** pinned contract → single implementer →
independent retail-conformance + architecture/adversarial reviews (both must
PASS on the final diff) → focused + complete Runtime + Release build +
complete solution gates → bisectable behavior commit (register rows in the
same commit) → docs/handoff commit. No workarounds; no fused slices.

## Confirmed pre-cutover gaps (from the inventory)

- The executor publishes only generic entity deltas; nothing bridges its
  completion to `RuntimePlacementProjectionChannel`, so no host can learn
  "my initial placement committed" through the built observer seam.
- No atomic controller/body publication owner exists (prerequisite C);
  App and headless hand-write divergent `PlayerMovementController`
  construction, and `SubmitPreparedPlacement` requires a canonical
  `PhysicsBody` that nothing currently publishes atomically.
- The dormant placement path's 1,880 B/operation (2,048 cap) allocation
  remains the activation blocker for frame-frequency routes.
- `Execute`'s live inputs (`UsePositionFromServer`, `PlayerDistance`) are
  computed by no host; they must derive from Runtime's own character-option
  and local-player owners.
- `RuntimePortalPlacementAuthority` has zero producing call sites; the
  adapter from `RuntimeWorldTransitState` does not exist.
- The exact-Setup mover chain (`PrepareMover` /
  `RuntimeSetPositionMoverPreparer.TryBuild` /
  `IPreparedCollisionSource.ReadSetupCollision`) exists piecewise, unwired.
- Route-6 split-recovery creates need an effect-replay suppression signal;
  route-7 needs `TryCommitParent`/`CommitWithdrawal` cancellation-symmetry
  fixes and host-visible cancellation receipts; headless lacks any
  parent-realize sequence (pre-existing, adjacent).

## Slices

- **C0 — Runtime bridge + live inputs — COMPLETE at `67f63e85`
  (2026-08-02, dual reviews PASS).** The executor publishes an
  acknowledge-only `ExecutorCompleted` receipt through the one placement
  stream (registered before dispatch; correlation reaped on
  acknowledgement/discard/clear; `PendingCompletionReceiptCount` in
  `IsConverged`); all three production sinks acknowledge-and-ignore the
  kind via early returns proven behavior-preserving for every other kind
  (sanctioned seam completion — provably inert, no production publisher);
  `UsePositionFromServer` derives retail-exactly from
  `RuntimeCharacterState.AutonomyLevel != 2` and `PlayerDistance` from the
  live movement controller with null-safe fallback to the caller struct;
  `TryPrepareAndSubmitAuthoredPlacement` chains the prepared-collision
  Setup read through `PrepareMover` to submission with zero validation
  changes; `TryCommitParent`/`CommitWithdrawal` gained the sibling
  cancellation flow (the `LeaveWorld` omission in `TryCommitParent` is
  retail-REQUIRED per `set_parent` 0x00515A90:283832-283833's single gated
  `leave_world`). Not fully dormant by design: the two cancellation fixes
  change live Runtime paths production already calls; everything else has
  no production caller.
  **C3 prerequisites recorded from C0's reviews:** (a) the completion
  receipt/trace surface is internal-only — C3 must define the public host
  consumption shape when it wires the hosts; (b) `PlayerDistance` is
  resolved once per `Execute` entry, not per continuation — a multi-Position
  FIFO classifies later entries against entry-time distance (documented
  deferral; refine at C3/C4 if the connected gates show it matters);
  (c) any future host exposure of `TrySetAutonomyLevel` must carry retail's
  `SendAutonomyLevelEvent` (699550).
- **C1 — atomic controller/body publication — SATISFIED BY EXISTING
  MECHANISM (research finding 2026-08-02, plan amended same session).**
  `RuntimeLocalPlayerPhysicsPublicationState` (1,033 lines) plus the
  ~15-method dormant local-activation family on `RuntimeSetPositionState`
  already implement the full sanctioned option-2 transaction:
  off-canonical preparation against a scratch quantum clock and a sealed
  candidate controller, one validated atomic Commit, and a staged
  Evaluate/Commit/FinalizeActivation chain re-validated against
  PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session
  identity at every entry — with zero production callers. See
  [`2026-08-02-canonical-body-writer-map.md`](../research/2026-08-02-canonical-body-writer-map.md)
  (6 canonical body writers; the two host escape hatches; both hosts'
  divergences). The remaining work — routing both hosts' local-player
  construction through the publication lifecycle, sealing the public
  `RuntimeLocalPlayerMovementState.Controller` setter, retiring App's
  direct object-clock bypasses, and containing headless's uncaught
  prepared-collision `InvalidDataException` — IS the C3 route-1 flip and
  moves there. No separate C1 commit.
- **C2 — placement allocation budget.** Pool or eliminate the operation/
  projection envelope allocations on the accepted placement path (root
  cause, not a raised cap), or obtain explicit user approval for a measured
  budget. Re-measure; the regression gate keeps the ceiling.
- **C3 — spawn-frequency cutover: routes 1 + 8.** Flip graphical AND
  headless initial Create/login registration to
  `RegisterEntityWithInitialResidence` + executor + placement receipts
  together; `MaterializeProjection`/`BuildControllerAndCamera`/
  `SynchronizeLocalPlayer` become projection + acknowledgement only;
  presentation-only rebucketing (`RebucketLiveEntity` loses `CommitRebucket`).
  Gates add the exact lifecycle/reconnect connected route.
- **C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the
  `RuntimeWorldTransitState` → `RuntimePortalPlacementAuthority` adapter),
  4 (remote Create/Position; delete `RemoteTeleportController`/`Placement`
  and the inline MoveOrTeleport duplicate), 5 (projectile authoritative),
  6 (drops + split-recovery marking), 7 (residual pickup/parent/delete
  polish).** May land as more than one commit if a route proves large;
  each sub-landing keeps the full review discipline.
- **C5 — legacy deletion + closeout gates.** Delete every superseded legacy
  path; parity tests; exact lifecycle/reconnect + canonical nine-stop
  connected routes; two-client observation; **user visual matrix** (the
  campaign's stopping point for user acceptance). Retire AP-1, AD-1,
  AP-131, AD-60's legacy half, and close #275. Update register/roadmap/
  milestones/architecture/memory + successor handoff.

After C5: AP-22 (authored collision shapes), then AD-10 (remote
contact-plane projection), then the campaign's final matrix and ledger
closeout; vendor Slice 5 resumes.