acdream/docs/research/2026-08-05-c5b-contract.md

C5b — classify-before-merge on every steady-state Position (#275): pinned contract (2026-08-05)

Written at HEAD 02578441 (branch claude/acdream-physics-divergence-5aa784; C5a landed at 6921a027, #319 at 392c1e22, AP-145/#318 at f8e55ba5). Every symbol below was re-verified by symbol at this HEAD, not inherited; §12 lists what the C5 scoping (2026-08-05-c5-scoping.md, written at 52175aa1) got wrong. Inputs: the scoping's C5b section, register rows AP-131 / AD-60 / AP-130 / AP-135 / AP-146, the 4b-3 contract (2026-08-04-c4-route-4b-3-contract.md — D1 is C5b's direct ancestor), the C4 closeout handoff's seven process findings, the C5a contract (2026-08-05-c5a-contract.md), and issue #275.

One-paragraph verdict: C5b is smaller than the scoping feared, because of a fact the scoping did not state: the merge's two flags (installPlacementFrame / clearParent) are a pure function of the timestamp disposition and the hasAnimations proxy — both available inside the merge itself, pre-merge, with no routing outcome and no playerDistance. Retail runs unset_parent and the SetPlacementFrame gate BEFORE MoveOrTeleport is consulted, so the flags are upstream of classification proper. C5b therefore needs no route plumbing, no signature changes, no App→Runtime threading — it replaces two true literals with a four-row truth table the classifier already encodes, and flips one refreshPosition: argument to false. The blast radius is correspondingly narrower than "45+ sites mis-reading a withheld wire cell", for a second reason the scoping missed entirely: the merge stamp is one of THREE steady-state wire-cell writers, and the other two stay (§5, W2/W3). What genuinely changes is the classification window, the refused-ForcePosition shape, and the (test-only) missile arm. The contract pins all of this.

---

1. Retail ground truth — Gate A and the pre-placement sequence, verified in acclient_2013_pseudo_c.txt

SmartBox::HandleReceivedPosition @0x00453FD0 (pseudo-C lines 92896–93051). The exact order, with addresses:

00453fe3   objcell_id = arg3->objcell_id          // wire cell read into a LOCAL
00453ff4   Frame::operator=(&var_40, &arg3->frame) // wire frame copied into local Position var_48
0045400c   GATE A: if (arg2 == player && newer_event(player, FORCE_POSITION_TS, arg9)):
00454044       wrapped-compare update_times[4] (TELEPORT_TS) vs arg8 — teleport must NOT be newer
00454056-68    get_heading / Frame::set_heading(&var_40)   // preserve body heading
00454074       SmartBox::BlipPlayer(this, &var_48)
00454079       player->update_times[0] = arg7              // stamp POSITION_TS
00454091       cmdinterp->SendPositionEvent()
0045409d       return                                      // BEFORE unset_parent / SetPlacementFrame
004540b7   if (!newer_event(arg2, POSITION_TS, arg7)) → return (the 004540e6 teleport-regression
           quirk stamps update_times[0] and returns @004540f6)
004540f9-11e if (parented && parent->id != player_id): weenie->SetParentedState(0) notification
00454129   CPhysicsObj::unset_parent(arg2)                 // UNCONDITIONAL on this path
00454137   if (CPhysicsObj::HasAnims(arg2) == 0):
00454142       CPhysicsObj::SetPlacementFrame(arg2, arg4, 1)
0045414d   if (arg2 != player):                            // REMOTE branch
00454254       if (MoveOrTeleport(arg2, &var_48, arg8, arg5, arg6) != 0):
00454272           ConstrainTo(arg2, &arg2->m_position, …)  // post-placement anchor
0045415f   else if TELEPORT_TS newer: TeleportPlayer @00454168, ConstrainTo @0045418a
           anchored at the WIRE &var_48, set_velocity(0) @004541b4
           else: ConstrainTo @004541ec; if UsePositionFromServer && arg5: InterpolateTo @0045422c

Five facts decide C5b:

1. The wire cell is never written to the object. arg3->objcell_id is read into a local @0x00453FE3 and flows only into the local var_48 Position handed to BlipPlayer / TeleportPlayer / MoveOrTeleport / ConstrainTo. Nowhere in this function is the object's cell assigned. The object's cell changes only inside the placement family (SetPositionInternal @0x00515BD0 → set_cell; enter_world @0x00516310/0x00516170) or per-frame movement transit. This is the retail rule AD-60's executor half already encodes ("a wire position never directly makes the record resident").
2. Gate A (@0x0045400C) is decided on data that exists before any merge: the entity is the player, FORCE_POSITION_TS advanced, TELEPORT_TS equal. It returns @0x0045409D before unset_parent @0x00454129 and before the SetPlacementFrame gate @0x00454137 — a ForcePosition never unparents and never installs a placement frame. acdream's exact analog exists upstream: PhysicsTimestampGate.TryAcceptPositionEvent:190-203 produces the ForcePosition disposition only when isLocalPlayer && IsNewer(FORCE_POSITION_TS) && teleport == _timestamps[Teleport] — retail's Gate A pair, verified at HEAD. A remote entity can never receive the ForcePosition disposition (isLocalPlayer guard at :190), so the flag truth table below needs no entity-kind term.
3. The two pre-placement writes are gated on exactly two facts. unset_parent @0x00454129 runs for every accepted non-Gate-A Position (including packets MoveOrTeleport will return 0 for — retail unparents BEFORE learning the routing outcome). SetPlacementFrame @0x00454142 is gated on HasAnims(arg2) == 0 alone. Neither gate reads the near/far/teleport classification — which is why acdream's merge flags are a function of (disposition, hasAnimations) and nothing else.
4. MoveOrTeleport @0x00516330 reads the BODY's own state at entry: TELEPORT_TS @0x00516375 and this_1->cell == 0 @0x00516386 — the committed cell, read before any placement — then contact arg4 @0x0051638E. Route 4b-3's D1 fed the classifier the PRE-merge committed cell for exactly this reason; C5b's withhold (D2) makes that pre-merge value structurally equal to the record's FullCellId in the classification window (§4, "strengthened invariant").
5. store_position @0x00515CE2 is SetPositionInternal's no-transition branch (placement ran, no walkable transition → GotoLostCell @0x00515CF2), not a MoveOrTeleport path. A retail placement that fails leaves the wire pose in m_position and the object HIDDEN in the lost cell — acdream's surviving wire-cell-on-non-commit behaviour (W2, §5) is the visible variant of this, already filed across AP-136/AP-138/#309. C5b does not re-litigate it.

2. The two scoping-identified sites, re-verified at HEAD 02578441

S1 — the steady-state merge's unconditional flags

InboundPhysicsStateController.TryApplyPosition (src/AcDream.Runtime/Entities/InboundPhysicsStateController.cs:610), hardcoding installPlacementFrame: true, clearParent: true at :662-663 (scoping exact). Production chain at HEAD, every hop verified: LiveEntityNetworkUpdateController.OnPosition:1948 → LiveEntityInboundAuthorityGate.TryAcceptPosition:161 (src/AcDream.App/Physics/ — the scoping gave no directory) → LiveEntityRuntime.TryApplyPosition:2550 → RuntimeEntityObjectLifetime.TryApplyPosition:1789 (scoping said :1781) → RuntimeEntityDirectory.TryApplyPosition:654 → the S1 overload.

The route-flag-threaded sibling (ApplyAcceptedPositionSnapshot:673, flags at :681-682) already exists and is what the continuation executor uses (RuntimeInitialCreateContinuationExecutor.cs:1983-1993, classified flags at :1991-1992, withhold at :1996) — scoping §1b verified exact.

What changes semantically (not "what gets deleted"): the merged snapshot's Physics.AnimationFrame / PlacementId and its ParentGuid / ParentLocation / Physics.Parent stop being unconditionally wire-installed / wire-cleared and start obeying retail's two gates:

disposition	installPlacementFrame	clearParent	classifier row (cite, don't restate)
Rejected	unread (timestamp-only path :793-794)	unread	—
ForcePosition (local player only, teleport-equal)	false	false	RuntimeAuthoritativePositionRouteClassifier.cs:311-333 (Gate A)
Apply	!hasAnimations	true (unchanged)	classifier :336-465 — every accepted non-force route carries UnparentBeforeRouting: true, ApplyPlacementFrameBeforeRouting: !request.HasAnimations

hasAnimations is the AP-130 static proxy, computed from the PRE-merge snapshot old with the identical expression RuntimeAcceptedPositionRouteRequests.cs:99-101 uses (old.MotionTableId ?? old.Physics?.MotionTableId) is { } id && id != 0u). WorldSession.EntitySpawn.MotionTableId exists (WorldSession.cs:103); the inbound controller's _snapshots[guid] and canonical.Snapshot are the same data pre-merge, so the two computations cannot diverge.

Two observability notes that decide the test plan (§8):

• The ForcePosition placement-frame half is inert: for disposition is not Apply, appliedPlacement keeps old.PlacementId under either flag value (:815-819). Gate A's force half discriminates ONLY through parent retention (:855-857).
• The Apply placement-frame half is live exactly when hasAnimations == true: today the wire frame (update.PlacementId ?? 0u) is stamped onto an animated entity's snapshot where retail's HasAnims gate skips SetPlacementFrame. That is AP-131's animation snap/reset half.

S2 — the wire-acceptance-derived FullCellId stamp

RuntimeEntityObjectLifetime.cs:1923-1926 — Entities.RefreshSnapshot(canonical, snapshot, refreshPosition: acceptedPosition) (argument at :1926, matching the C5a contract's corrected citation; the register's :1338 and the scoping's :1918 are both stale — cite by symbol). refreshPosition: true routes through RuntimeEntityRecord.RefreshDerivedState:230-237 → SetFullCell(position.LandblockId, …) — the wire cell, stamped on bare acceptance, plus PropagateFullCellToChildren (RuntimeEntityDirectory.cs:240-246) when it changes.

What changes semantically: refreshPosition: false. The merge stops being a residency writer. In the window between the merge and the OnPosition prologue rebucket, canonical.FullCellId IS the pre-merge committed cell — which is exactly what 4b-3's D1 threads out-of-band today (timestamps.PreMergeCommittedCellId, :1904-1907). Post-D2, 4b-3's convention becomes a structural property of the record.

The executor's analogue is unchanged and untouched (refreshPosition: false at executor :1996 — its CANONICAL CELL SEMANTICS comment at :1966-1976 is the model for S2's new comment).

3. Design decisions — pinned, not open for redesign

D1 — the merge flags become the classifier's truth table, computed pre-merge inside the merge

In S1's TryApplyPosition, replace the two literals at :662-663 with the table in §2-S1, computed from disposition and hasAnimations(old). No signature changes; no new parameters; no route construction in the merge; playerDistance is never needed (the full route's near/far decision is downstream of retail's unset_parent/SetPlacementFrame order and stays post-merge in ClassifyRemoteAcceptedPosition).

The post-merge classification (LiveEntityNetworkUpdateController.cs:2167-2175 → RuntimeEntityObjectLifetime.ClassifyRemoteAcceptedPosition → RuntimeAcceptedPositionRouteRequests.Build) is untouched: it computes the full route from the same retained inputs, so its ApplyPlacementFrameBeforeRouting / UnparentBeforeRouting fields equal the merge's flags by construction. The consistency is pinned by test (§8 test 4), not by a shared code path — the two computations are small, pure, and separately sabotage-verifiable.

Doc comments that must be made true in the same commit (process rule (c)): the :595-608 "Round 4 R4-15 … no HasContact or route-classification concept" remarks; the :657-661 "Legacy immediate-apply reproduces EXACT prior behavior" comment; ApplyAcceptedPosition's :772-781 two-caller doc; the :809-814 PositionPack comment's "retail skips it entirely while HasAnimations is true" (already true — now load-bearing for BOTH callers).

D2 — the steady-state merge withholds the wire cell (refreshPosition: false)

One argument flip at S2 plus the comment rewrite. The 4b-3 D1 comment at :1894-1907 is extended, not deleted: it currently explains why the classifier needs the threaded pre-merge value; it must add that after this change the post-merge record CARRIES that same value through the classification window, making the threading a belt-and-suspenders duplicate that stays (the threaded value remains the classifier's input of record — process finding (b), read the observable once).

Two publish-side effects, both pinned (trap T3):

1. The merge's publish-kind ternary (:1948, beforeCell != canonical.FullCellId ? Rebucketed : Updated) becomes always-Updated — the merge can no longer change the cell. The Rebucketed edge for a wire-cell-changing packet moves to the prologue rebucket's CommitRebucket (RuntimeEntityObjectLifetime.cs:1956-1987), which TODAY early-outs publish-less (previous == fullCellId at :1973 — because the merge already stamped it) and after D2 publishes. Net observable: exactly one Rebucketed delta per cell-changing accepted Position — same kind, same value, same publisher, later point in the same call. A test pins this at the observable (one delta, not zero, not two); it does not pin the source site.
2. PropagateFullCellToChildren for a parent whose accepted Position changes its cell moves from the merge's directory wrapper (RuntimeEntityDirectory.cs:240-246) to CommitRebucket's public SetFullCell (:355). Same packet, same value, same single propagation. This is the #319 child-equality channel — a directory-level test pins exactly one propagation per parent cell change on the steady-state path, for BOTH parent classes (player 0x5… and creature 0x8…; process rule from #319 — a test population that only ever sees sequence-0 parents is blind to the player class).

D3 — the other two wire-cell writers STAY, and the register says so

The scoping's premise — withholding S2 "moves residency changes onto placement/simulation commits only" — is false at HEAD (§12 item 1). Two more steady-state wire-cell writers exist downstream of the merge in OnPosition, and C5b keeps both:

• W2 — the prologue rebucket (LiveEntityNetworkUpdateController.cs:2329 RebucketLiveEntity(update.Guid, p.LandblockId) → LiveEntityRuntime.cs:935-945 → CommitRebucket → SetFullCell(wire cell)). Runs for EVERY classification reaching the generic tail — near, far, teleport, cell-less, unrouted, and every ordinary local-player Apply echo. Its other jobs (draw-bucket move, bucket-promotion recovery, prepare_to_enter_world clock edges) are not cell writes and are not in scope. Do NOT gate W2 by classification (trap T5): for the local player W2's echo-driven commit is the mechanism that advances the canonical cell across landblocks during ordinary movement (AP-146/#320 machinery — the per-tick projection deliberately passes a landblock id and preserves the cell, LiveEntityRuntime.cs:935-938); gating it silently freezes the player's cell between teleports and #319's child equality inherits the freeze.
• W3 — the post-routing wire-cell adopt (TryAdoptWireCellAfterRouting, LiveEntityNetworkUpdateController.cs:1613-1624): RemoteMotion.CellId = wire for every non-placing arm, writing through to FullCellId via CommitCanonicalCell. Already filed as retained bookkeeping under AP-135; the placing arms (far/teleport) are suppressed there because the placement receipt is the cell authority.

W2/W3's population note: packets that RETURN before :2329 never see W2 — the force-local path (Committed/Deferred :2055, Rejected/Contention :2066) and the missile arm (:2256). For those, post-D2 residency is placement-receipt-authoritative (or, on a refused/contended force, unchanged at the last commit — retail's shape, since retail's BlipPlayer-era body keeps its last placed cell; AD-62 already files the non-commit force outcomes). This is D2's genuinely new steady-state surface and it is retail-correcting, asserted by §8 test 6.

D4 — register bookkeeping, in the implementation commit

• AP-131 RETIRES (§7 evidence). Its "legacy caller is deleted at the production cutover" framing is overtaken: the caller is not deleted, it is corrected — the unconditional literals are replaced by the classified computation. The retirement commit rewrites the row's text to past tense with the evidence, per register rule 1 (a deviation found without a row is a bug twice over; a retired divergence needs its retirement recorded, which the C5a/AP-1 and 4b-3/AP-137 rewrites established as the house style).
• AD-60 — legacy half RETIRES, row REWRITTEN, not deleted (4b-3's D8 precedent: silent whole-row deletion would hide surviving wire-cell channels). The rewrite keeps the executor half as the standing rule, records the legacy half's retirement with §7's evidence, and names the surviving wire-cell channels: W2 (prologue rebucket commit — cross-cited into AP-146 for the local player) and W3 (already AP-135). The row's surviving claim is therefore precise: "a wire Position never makes a record resident inside the merge or ahead of classification; the post-routing controller still adopts the wire cell for non-placement outcomes as the bounded-residency bridge, filed at AP-135/W2."
• AP-130 amendment (bookkeeping, not retirement): its Site column names only the executor's hasAnimations local; the merge now consumes the same static proxy. One sentence added. The proxy itself MUST NOT be "improved" to a live animation-queue read in this slice (trap T7).
• AP-146 / #320 amendment (bookkeeping): #320's edge list cites "an accepted inbound Position/ForcePosition (RuntimeEntityDirectory.RefreshSnapshot → RuntimeEntityRecord.cs:234)" as a local-player cell writer. After D2 that writer is the generic-tail rebucket's CommitRebucket (and, for ForcePosition, the placement receipt). Amend both in the same commit or the next reader files a phantom regression.
• AP-135 stays, its writes stay (must-remain-true item 3).
• AP-1, AD-1, AP-141–AP-145, AD-61, AD-62: pinned untouchable.

4. What must REMAIN true (process rule — the contract causes the defect)

For every path this slice touches, including every refusal and rejection:

1. Classification reads pre-merge inputs only. 4b-3's D1 binds in full: PreMergeCommittedCellId is threaded exactly as today (RuntimeEntityObjectLifetime.cs:1904-1907), measured by the SAME TryApplyPosition call, never re-read after the merge. D2 adds the structural property (the record equals it in the window) but the threaded value stays the classifier's input of record.
2. The D4 constraint-arm partition (4b-3) does not move. One post-operation ConstrainTo site, its partition table unchanged. C5b touches no arming code.
3. AP-135's bookkeeping writes stay — the server-cell adopt (RemoteMotion.CellId) and LastServerPos/LastServerPosTime samples in LiveEntityNetworkUpdateController, on both airborne no-op neighbourhoods.
4. Dual-parent-class test discipline. Every new test touching parent/ child cell propagation runs a player (0x5…) parent AND a creature (0x8…) parent (#319's lesson; the handoff's corrected gate-2 criterion).
5. The executor path is untouched — its classified flags, its refreshPosition: false, its replay semantics (ApplyAcceptedPositionExecutionRejectedSnapshot). Do not unify the two merge callsites into one helper "while here" (trap T8).
6. The timestamp gate is untouched; Gate A's teleport-concurrent shape stays upstream (PhysicsTimestampGate.cs:190-217; a force with a teleport advance falls through to Apply, and ValidAcceptedAuthority's PreviousTeleport == AcceptedTeleport rule handles the classified side).
7. The OnPosition routing/arms are untouched — generic render-pose gate, W2, the arm dispatch, W3, the unified tail, AP-87's catch-up, AP-139's landing clear, AP-140's InContact gates.
8. The local player's cell-freshness path (echo → generic tail → W2 → CommitRebucket) is unchanged. AP-146 stays accurate after its §D4 amendment.
9. The initial-residence branch of TryApplyPosition (:1800-1860) is untouched — it is the executor's enqueue path, already classified.
10. Physics.ObserveLocalWorldFrame keeps reading the wire landblock directly (:1887-1889); it is not a FullCellId consumer.
11. No new skip (process rule (d)) and no test weakened to make the withhold pass (trap T2 — the withhold assertion lives at the merge boundary, never at OnPosition level, where W2 legitimately re-stamps).

5. THE BLAST RADIUS — itemised by consumer class

Premise: S2's withhold is the only residency write C5b removes; W2/W3 stay (D3). So the consumers that ever read a value that is intentionally NOT the wire cell are (a) everything in the classification window (merge → :2329), and (b) steady state after packets that return before W2 (force path, missile arm). Everyone else reads the same value as today. The #319 lesson is applied, not assumed: a stale cell is worse than a zero cell for derived/presentation copies — but FullCellId's whole semantic post-D2 is "the last committed cell", which is retail's this->cell; that is not staleness, it is the definition. Zero would be the lie here.

Class A — placement owners (read at/after placement). Verdict: CORRECT, no gate.

RuntimeSetPositionState (pre-flight reads :1172-1255, commit compares :2305/:2760/:5020, parks :3004/:3031/:3677-3697, :3795/:3954, :5225/:5242), RuntimeRemotePlacementDriveController (:1053-1068 — verified: reads record.FullCellId AFTER the placement commit for the shadow publish; the commit just wrote it), RuntimeAcceptedPositionDriveController (receipt resolvedCell: reads :914-1535). Retail's placement reads this->cell — the committed cell, never the wire cell. These get a MORE honest input post-D2.

Class B — per-tick simulation. Verdict: CORRECT, no gate.

RuntimeOrdinaryPhysicsUpdater:127 (transits FROM record.FullCellId — retail's per-frame cell transit reads this->cell), RuntimePhysicsState (:958, commit :2145-2159), RuntimeProjectilePhysicsUpdater (:53-293), the free-fall sweep's rm.CellId != 0 gate (AP-135). The simulation is the retail-sanctioned residency writer between packets.

Class C — classification inputs. Verdict: CORRECT — strengthened.

RuntimeAcceptedPositionRouteRequests (:57 route-1 overload — executor scope, unchanged; :641-family drive-controller builds for the local player — reads the local player's committed cell, whose freshness path is W2, unchanged). The remote PositionEvent build is the threaded PreMergeCommittedCellId — post-D2 the record in the window equals it structurally (§3 D2). 4b-3's D1 moves from convention-defended to structure-defended.

Class D — presentation/projection, event-time readers. Verdict: HARMLESS, with three named window sites.

Event-time readers (landblock-loaded, visibility-changed, per-tick sync) run outside the per-packet window, and W2 keeps steady-state values identical to today for every generic-tail packet: RuntimePlacementPresentationSink:286 (post-commit receipts), LiveRenderProjectionJournal:270-271 (falls back when 0), EntityEffectController:481, LiveStaticAnimationResidency:25, StaticLiveRootCommitter:76, ArchRenderScene (Residency.FullCellId — statics), HeadlessLocalPlayerFrameHost:87, HeadlessRuntimePlacementProjectionSink:103 (token compare), RemotePhysicsUpdater:239/:294 / LiveEntityOrdinaryPhysicsUpdater:107 (simulation-snapshot → ParentCellId sync).

Named window sites (inside merge→W2, or pre-W2 returns) — verdict per site:

site	reads	verdict
LiveEntityHydrationController:592 (?? candidate.FullCellId fallback)	landblock-loaded event	HARMLESS — event-time, post-W2 population; the fallback is third in a ?? chain behind projection/snapshot position
LiveEntityHydrationController:1077 (FullCellId != 0 gate)	projection recovery inside the window	VERIFY at implementation: after D2 it reads the committed cell (correct — recovery should re-place from the last commit, not from an unplaced wire claim). Pre-D2 it could read the just-stamped wire cell; that was the AP-1-shaped read this slice exists to remove
LiveEntityRuntime:1219 / :1564 (token.ExactCellId compares)	hydration/migration tokens	VERIFY: token cells are create/placement-derived, not wire-derived; the comparison against the committed cell is the intended predicate
LiveEntityPresentationController:220 (RestoreShadow's FullCellId == 0 bail)	visibility-edge restore	HARMLESS/CORRECT — a cell-less body correctly restores no shadow row; the force-path population keeps its committed cell

Class E — residency/liveness predicates (the "45+ sites"). Verdict: HARMLESS, two CORRECT-AND-LOAD-BEARING.

• GetRootObjectClockDisposition (LiveEntityRuntime:2602-2617), HasSpatialRuntimeProjection (:3340-3345), the ordinary-root gates (:953-956, :3452-3455): tick/edge-time, read the committed cell — retail's this->cell != 0 predicate shape. CORRECT; unchanged in value for generic-tail packets (W2), changed only for refused-force (retail's shape).
• IsAffectedCollisionResident (RuntimeSetPositionState:3949) and its !HasCommittedParent companion gates, the collision-retirement sweeps (:3771/:3796/:3990/:4052): event-time (landblock retirement), read the committed cell. CORRECT — a retirement sweep must act on where the body IS, not where an unplaced wire packet claimed.
• The initial-create residence FullCellId != 0 refusal (RuntimeInitialCreateResidenceState:583) and executor baselines (:877-1182, executor :1836/:2484): pending-residence records never take the steady-state merge branch. UNAFFECTED.
• 4b-3's cell-less classification input: threaded pre-merge value (Class C).
• RuntimeEntityDirectory:492 child propagation and RuntimeEntityObjectLifetime:1546-1555 parent-attach propagation: write-side (D2's propagation-source move, pinned in §3 D2 item 2).
• ProjectileController:279/:568/:930 and the missile arm: the ONLY population whose residency becomes exclusively placement-receipt-driven post-D2 (the arm returns before W2, :2256). Test-only today (AP-141: ACE never sends a missile UpdatePosition). CORRECT — retail's projectile cell comes from SetPosition, full stop.

The headline behavioural delta, stated once

Post-C5b, a refused or contended local ForcePosition (AD-62's shapes (iv)-(vi)) leaves FullCellId at the last committed cell where today the merge stamps the refused packet's wire cell. Retail cannot refuse (AD-62) and its body keeps the last placed cell — the new shape is the retail-reachable one. Every other steady-state observable is either unchanged (W2/W3) or retail-correcting (the classification window, the placement-authoritative force/portal/missile arms).

6. Proof obligations (must prove, not assume)

1. The truth table is the classifier's. §8 test 4 drives both the merge and RuntimeAuthoritativePositionRouteClassifier.ClassifyAcceptedPosition (via RuntimeAcceptedPositionRouteRequests.Build) over the packet-shape matrix and asserts the merge-installed AnimationFrame/PlacementId/ParentGuid/ParentLocation/Physics.Parent equal what the route's flags would install. Not a restated table in the test body — the production classifier is the oracle (process rule (e): no test that re-encodes the constant under test).
2. The withhold is at the merge boundary. §8 test 5 asserts at RuntimeEntityObjectLifetime.TryApplyPosition level: an accepted Position whose wire cell differs from the committed cell leaves canonical.FullCellId == beforeCell immediately after the call. It MUST NOT be asserted at OnPosition level — W2 legitimately commits the wire cell there, and an OnPosition-level assertion would fail and tempt a weakening (trap T2).
3. Publish-delta conservation. One Rebucketed delta per cell-changing accepted Position on the steady-state path (§3 D2 item 1), and one child propagation per parent cell change (item 2), both asserted at the observable, both parent classes (must-remain-true item 4).
4. The refused-force shape. A ForcePosition whose drive execution refuses/contends writes NO residency change anywhere (§8 test 6) — merge, W2 (unreached), receipt (none). This is the assertion that makes AD-60's retirement mean something.
5. Sabotage-verify every new discriminating test in BOTH directions (process rule (e)) — the canonical half and the presentation/snapshot half separately, per route 7's finding.

7. Retirement evidence — AP-131 and AD-60's legacy half (same commit as the change)

AP-131 retires because:

1. The literals at InboundPhysicsStateController.cs:662-663 no longer exist; the merged flags are computed by the §2-S1 truth table. A grep in the commit message shows no production caller passes unconditional true/true (the executor's :1991-1992 threading is the classified path, already retail-exact).
2. §8 tests 1-4 pin the new behaviour against the classifier-as-oracle, sabotage-verified: (a) Apply + animated entity → wire frame NOT installed (sabotage installPlacementFrame: true fails it); (b) Apply + non-animated → wire frame installed (sabotage false fails it); (c) ForcePosition + parented entity → parent fields retained (sabotage clearParent: true fails it); (d) the matrix consistency test.
3. The row's risk column ("animated entity installs a placement frame retail would skip; ForcePosition unparents where Gate A never reaches unset_parent") describes code that no longer exists — the two production behaviours are now the classifier's own rows (RuntimeAuthoritativePositionRouteClassifier.cs:311-333 and :336-465).

AD-60's legacy half retires because:

1. RuntimeEntityObjectLifetime.cs:1926 reads refreshPosition: false; RefreshDerivedState's SetFullCell(position.LandblockId, …) is unreachable from the steady-state merge.
2. §8 tests 5-6 pin the withhold at the merge boundary and the refused-force shape.
3. The row rewrite (§3 D4) names W2/W3 as the surviving, separately-filed wire-cell channels, so the retirement cannot be misread as "wire acceptance never changes residency anywhere" — it means "never inside the merge, never ahead of classification, never for a packet whose placement was declined", with the post-routing adoption for non-placement outcomes filed where it belongs (AP-135 / the W2 citation).

8. Test plan

Focused Runtime tests (tests/AcDream.Runtime.Tests), each asserting the layer that broke historically (merged snapshot fields, canonical cell, publish deltas — never source-text pins):

1. Apply, animated remote (MotionTableId != 0): merged snapshot keeps old.Physics.AnimationFrame / old.PlacementId; pose and timestamps still merge. Sabotage: force installPlacementFrame: true.
2. Apply, non-animated remote: merged snapshot installs update.PlacementId ?? 0u. Sabotage: force installPlacementFrame: false.
3. ForcePosition, parented local player: merged snapshot retains ParentGuid / ParentLocation / Physics.Parent; heading preservation (:797-807) unchanged. Sabotage: force clearParent: true.
4. Matrix consistency (proof obligation 1): {Apply, ForcePosition} × {animated, not} × {parented, not} × {player 0x5…, creature 0x8…} — merge outcome == classifier route flags' outcome.
5. Withhold at the merge boundary (proof obligation 2): wire cell ≠ committed cell → canonical.FullCellId unchanged after TryApplyPosition; Snapshot.Position DID refresh (the pose half of the merge is not the withheld half); a subsequent canonical placement commit still changes FullCellId.
6. Refused-force shape (proof obligation 4): drive a ForcePosition whose execution refuses (destination outside the service window) through the drive controller; assert no residency write from merge, receipt, or rebound — FullCellId is the pre-packet value throughout.
7. Publish-delta conservation (proof obligation 3): one Rebucketed per cell-changing accepted Position; one child propagation per parent cell change; player parent AND creature parent.
8. The existing InboundPhysicsStateController unit tests that assert the UNCONDITIONAL flags are rewritten, never delete-only (the scoping's §3 row, carried): each becomes its classified-flag counterpart.

9. Gates

• Focused tests above.
• Complete Release suite: $env:ACDREAM_PAK_PATH set, dotnet test AcDream.slnx -c Release -m:1. Re-measure the baseline; do not inherit. Recorded figures: 11,112 passed / 4 skipped / 0 failed at 392c1e22 (C5a contract) and 11,106 at 6921a027 post-C5a (the tasking figure). C5b's net count moves only by test rewrites/additions; the commit message reconciles the net explicitly. Three known flakes, filed separately, never conflated, never chased: #302 (PortalProjectionTests.ClipToRegion_FrameOwnedStore_…, App.Tests), #308 (NakEmissionTests.LossSoak_…, Core.Net.Tests, full-suite load), #321 (DatSoundCacheTests concurrent-decode-dedup, Core.Tests, full-suite load — filed 2026-08-05, deliberately separate from the other two; do NOT fold it in). If any appears, re-run and say which.
• Connected gate: YES — argued, not assumed. The change is on the hottest wire path (every steady-state Position) and the campaign's standing discipline is a connected gate per live-path behaviour change. But the gate's pass evidence must be positive, because C5b's improvement is absence-of-signal (a placement frame NOT installed; an animation NOT popping — the #319/rule-(g) unfalsifiable-criterion trap). Recipe (two-client, Release, ACDREAM_RETAIL_UI=1, ACDREAM_PROBE_REMOTE_TELEPORT=1, pre-C5c so the probe still exists):
  1. Pickup-then-drop a ground item, several times — the positive probe assertion: [remote-teleport] lines appear with hookRan=True placement=Committed, proving the pre-merge-fed cell-less/teleport classification still fires and commits after the merge stopped being a residency writer. (Gate 4's closure at af828a8a established this recipe reaches the arm; the probe label may read teleport-ts for the short-circuit reason the handoff records — that is expected, not a gap.)
  2. A walking/running creature across ≥1 landblock boundary, observed: visible, smooth, correct cell, no freeze, no origin-snap — the W2 regression watch (the one writer C5b leans on hardest).
  3. @teleto/@teleloc a creature (never a player character — rule (g)): teleport arm unchanged, leash re-armed, no rubber-band, no run-in-place.
  4. Local @teleto + one portal recall: the force/portal paths are now placement-authoritative for residency — arrival pose correct, leash armed, movement immediate.
  5. An animated creature idling/fighting at UpdatePosition cadence: watch for NEW animation popping (regression) — recorded as an observation only, explicitly NOT a pass criterion (the absence of the OLD pop is the improvement and is test-gated, §8 test 1). Graceful close per the standing rule. No new probe flag for C5b: the discriminating signals are either absence-of-signal (ungateable) or already carried by [remote-teleport]; adding a seventh temporary probe for one session and stripping it in C5c is churn without evidence value.

10. Size and split call

Calibrated against the campaign (route 3 ~418, #319 76, 4b-3 ~250-700):

piece	production lines	test lines
D1 truth table + comment rewrites	~25-40	~200-350 (matrix + rewrites)
D2 withhold + comment + publish-edge pins	~15-25	~100-250
Register rewrites + #320/AP-130 amendments	0 (docs)	0

Total ~40-65 production, ~300-600 test — well under the ~500-line split threshold, and dramatically under the scoping's ~150-400 estimate, because the scoping assumed route plumbing (it did not see that the flags are disposition-determined; §12 item 2). One landing. If the test rewrite balloons past ~600 lines, the split line falls between D1's flag tests and D2's withhold tests — but the PRODUCTION change lands atomically: D1+D2 in one commit is one coherent behaviour (classify-then-merge); a half-flipped intermediate (classified flags with the wire stamp, or vice versa) is exactly the mixed-residency state this campaign keeps paying for.

Single implementer, dual reviews (retail-conformance + architecture) per the campaign's discipline, both re-run on the final diff.

11. Traps (routes 6/7 style)

• T1 — reading hasAnimations post-merge. Compute from old (the pre-merge snapshot) inside TryApplyPosition. For Position packets the merge cannot change MotionTableId, so the failure mode is latent, not live — pin the discipline anyway, because the NEXT field added to this computation may not share the property.
• T2 — the withhold assertion at the wrong boundary. W2 re-stamps the wire cell at :2329 for every generic-tail packet, BY DESIGN. A test asserting "FullCellId unchanged after OnPosition" fails and invites a weakening or a W2 gate. The assertion lives at RuntimeEntityObjectLifetime.TryApplyPosition (§8 test 5). This is the slice's "weaken a test to make the withhold pass" trap.
• T3 — the moved publish edges. Rebucketed moves from the merge's ternary to CommitRebucket; child propagation moves with it. Pin the observable (counts), never the source site; do not delete the coverage when the old assertion site goes quiet.
• T4 — the ForcePosition placement-frame half is inert (appliedPlacement keeps old.PlacementId under either flag). The force-half discriminating assertion is PARENT RETENTION. Sabotaging the placement frame on a ForcePosition proves nothing.
• T5 — do not gate W2 "for symmetry". The local player's canonical cell freshness runs THROUGH W2 (echo → generic tail → CommitRebucket; AP-146/#320). Gating it freezes the player's cell between teleports and #319's child equality inherits the freeze. W2 is also the far arm's destination-streaming nudge.
• T6 — the missile arm returns before W2 (:2256). Post-D2 its residency is placement-receipt-only; fixtures driving refused/deferred missile placements must not assert wire-cell residency.
• T7 — do not "improve" hasAnimations to a live animation-queue read. AP-130 files the static proxy deliberately; the merge consumes the same proxy and the row is amended, not escalated.
• T8 — no while-here unification of the two merge callsites, the executor's replay merge, or the timestamp gate.
• T9 — flake discipline. #302/#308/#321 are three separate filed flakes; a full-suite red in any of them is re-run and named, never folded into "the flake class" and never masked (#321's filing note: no retry, no Skip, no delay).

12. Scoping claims found wrong or stale at HEAD 02578441

1. The scoping's core premise for the withhold is false. §2: withholding S2 "moves residency changes onto placement/simulation commits only — the retail rule". At HEAD the steady-state path has TWO MORE wire-cell writers downstream of the merge (W2 LiveEntityNetworkUpdateController.cs:2329 → CommitRebucket; W3 TryAdoptWireCellAfterRouting:1613), and C5b keeps both (§3 D3). The retirement must be scoped to the merge boundary and the survivors named in the register rewrite, or AD-60's retirement is a shell game. This is the contract's load-bearing correction.
2. The size estimate over-counts. Scoping §7: "~150-400 changed on the hottest inbound path". The flags are disposition+hasAnimations-determined (§2-S1 truth table; retail runs both gates BEFORE the MoveOrTeleport branch decision) — no route construction, no playerDistance threading, no signature changes. Re-estimate: ~40-65 production lines (§10).
3. Stale line citations (all re-verified): TryApplyPosition at RuntimeEntityObjectLifetime.cs:1789 (scoping :1781); the threaded overload's signature at InboundPhysicsStateController.cs:673 (scoping :681 — that is its flags parameter line); S2's call at RuntimeEntityObjectLifetime.cs:1923-1926 (C5a's :1926 correct; the register's :1338 still stale); LiveEntityInboundAuthorityGate lives under src/AcDream.App/Physics/ (scoping gave no directory; :161 exact). Everything else in scoping §1b/§2 holds.
4. #320's edge list goes stale the day D2 lands — its "accepted inbound Position (RefreshSnapshot → RuntimeEntityRecord.cs:234)" writer becomes the generic-tail rebucket's CommitRebucket. Amendment mandated in the implementation commit (§3 D4), or the next reader files a phantom regression.
5. The scoping's §5 cell-less falsification session is overtaken: gate 4 CLOSED at af828a8a (the cause=cellless label was a probe-artifact — the pickup-then-drop recipe exercised the arm all along). C5b does not inherit that investigation; its connected gate reuses the same recipe as positive evidence (§9). Route-7 thickening and #316's measurement are C5c-ledger items, not C5b design inputs — the implementation session checks the ledger for their status before starting, and does not block on them.

13. What C5b does NOT do

• Does NOT wire the continuation executor into the steady-state path (#275's alternative branch — the issue's "or delete it with the route"; the steady-state merge stays a live, now-classified, production caller).
• Does NOT gate, move, or delete W2/W3 (§3 D3).
• Does NOT touch the OnPosition routing, arms, constraint partition, generic render-pose gate, or interpolation machinery.
• Does NOT touch the timestamp gate, the executor, the initial-residence branch, or the projectile arm's routing.
• Does NOT strip any probe (C5c), fix #316/#317/#320, or re-open AP-145's seam.
• Does NOT add a live animation-queue read (AP-130 stands).

---

14. Implementation outcome (appended at landing, 2026-08-05)

Both design decisions landed exactly as pinned: installPlacementFrame: !force && !hasAnimations, clearParent: !force at the S1 call site, and refreshPosition: false at S2. No signature changed, no route was plumbed, playerDistance was never needed, W2/W3 were not touched. The production diff is 129 insertions / 38 deletions across two files, of which the BEHAVIOUR is seven lines — four computing force/hasAnimations, two flag arguments, one refreshPosition argument. Everything else in that delta is the §3-D1 mandated comment rewrites. Well inside §10's ~40-65 estimate; the estimate itself was counting comments.

§5's blast-radius survey missed three consumer sites. All three are D2-caused, all three were found by the test suite rather than by reading, and all three turned out to be the intended semantics rather than regressions — but the survey did not enumerate them, so they are recorded here:

1. DatLiveEntityProjectionMaterializer's self-projection branch (src/AcDream.App/Rendering/DatLiveEntityProjectionMaterializer.cs, the residence is AwaitRuntimePlacement && expectedCanonical.FullCellId != 0u && !HasActiveInitialCreateResidence gate). This is a Class-D window site: it runs inside OnPosition's prologue recovery (:1973 / :2089/:2102), ahead of W2. Pre-D2 it read the just-merged wire cell and installed the spatial bucket there; post-D2 it reads 0 for a withdrawn/inventory-only record and correctly declines to project from an unplaced wire claim. Production still installs the bucket in the SAME OnPosition call, at W2 (:2329) — verified by reading every return between the recovery call and W2: none is conditioned on IsSpatiallyProjected or FullCellId. Two LiveEntityHydrationControllerTests cases asserted the bucket at the recovery boundary and were extended to drive the production W2 step; this is the same shape as trap T2, one layer up.
2. ProjectileController.SyncPresentationFromResolvedBody (entity.ParentCellId = record.FullCellId). Trap T6 named the missile arm's residency but not this presentation writer. On a REFUSED missile placement the entity's pose still moves to the destination (acdream's StoreAcceptedDestinationPose fallback) while ParentCellId now stays at the committed source cell. The MAJOR-1 invariant the covering test exists to protect (ParentCellId == record.FullCellId != body.CellPosition .ObjCellId) is unchanged and is now asserted as that identity rather than as a wire-cell constant.
3. The Rebucketed publish edge does NOT always move to CommitRebucket. §3 D2 item 1 says the merge's ternary "becomes always-Updated". It does not, and the ternary is deliberately kept: the Physics.SetPosition.Forget (canonical, restoreCancelledPark: true) call a few statements earlier can roll a wakeable lost-cell park back, and RestoreParkWithdrawal restores canonical residency at the body's committed cell. That is a real cell edge produced inside TryApplyPosition by a placement owner and must still publish as Rebucketed. Collapsing the ternary would have silently downgraded it.

One §5 verdict was checked and stands: LiveEntityHydrationController :1077's FullCellId != 0 gate is unreachable from this change — it sits inside the canonicalSpawn.Position is null branch, and a merged steady-state Position always carries one.

Not done, deliberately: no automated OnPosition-level test drives the full pickup→drop→reproject sequence (no such fixture exists; the collapse matrix fixture does not cover pickup). The claim that production reprojects a dropped item at W2 rests on the code reading above plus the two hydration tests now driving recovery-then-W2 in production order. §9's connected gate recipe item 1 (pickup-then-drop, several times) is the positive evidence for it and has not been run.