acdream/docs/research/2026-08-04-c4-route-4b-2-round3-correction.md

C4 route 4b-2 — round 3 correction (2026-08-04)

Both round-2 reviews returned FAIL. The findings are now small and local; this is a closing-out round, not a structural change.

Do NOT revert the shared-core park change. Both reviewers verified it removes a session-permanent strand from routes 1 and 2: RuntimeEntityObjectLifetime.cs:1767-1769 calls Forget(canonical, restoreCancelledPark: true) on every accepted Position for every entity, so before this round a local-player ForcePosition or a first-entry placement that hit either quiescence park was left InWorld = false, clock suspended, FullCellId = 0, with its operation destroyed by the next packet. The change is directionally right and fixes shipped behaviour.

A1 — one relocation closes both shared-core MAJORs

IsRestorableQuiescencePark (RuntimeSetPositionState.cs:3877-3880) has two independent defects, and moving the decision fixes both:

1. It compares against one quiescence, not the set. It tests quiescence.Token.LandblockPrefix — the token TryGetBlockingQuiescence returned — but both overloads (:3906-3925, :3927-3949) return the minimum-OperationId match, not the only one. _collisionPrefixQuiescence is a per-prefix dictionary (:589, :885) and streaming opens one per landblock mutation (activation RuntimePhysicsState.cs:1820-1824, retirement :2025-2030), so a recenter has several live. Source S quiescing before destination D: the predicate tests D != S, returns true, and the restore re-admits the spatial root into D, which is quiescing — the AP-136 pin. At 5-10 Hz the park→cancel→restore→re-park cycle can starve D's mutation permission for as long as S stays quiescing (:927).
2. Its input is not the value the restore uses. It is fed deferred.CellId / held.CellId (:2982, :3036), but RestoreParkWithdrawal reads body.CellPosition.ObjCellId (:3481), set by ParkDeferred's body.SnapToCell (:4346-4349) → PhysicsBody.StageDormantCellFrame (PhysicsBody.cs:212-223), which for any outdoor cell runs LandDefs.AdjustToOutside. That function's own doc (LandDefs.cs:115-122) says the resulting cell id may belong to a neighbour landblock. Reachability NOT VERIFIED, and the relocation removes the question.

Fix: move the restorable decision inside ParkDeferred, after SnapToCell, and express it as !IsCollisionPrefixQuiescing(body.CellPosition.ObjCellId). That method (:827-829) already exists, is internal, masks its own argument, and is the pre-flight's own predicate; it subsumes the current test exactly. Make it non-static as needed; the CollisionPrefixQuiescence parameter then goes away.

Blast radius note that must not be lost: the remote far-snap arm is masked from defect 1 by CanAttemptDestination's destination pre-flight (RuntimeRemotePlacementDriveController.cs:599, :1155). The exposed callers are routes 1 and 2, which have no such pre-flight (RuntimeAcceptedPositionDriveController.TryExecuteAcceptedLocalPosition:330-392 goes straight from ClassifyForcePosition to TryBeginExclusiveAuthoredPlacement). All three new quiescence tests drive the remote arm and explicitly assert the safe configuration (:1193, :1268), so none of them can see it.

A2 — two tests the round is missing

• Concurrent quiescences, source OperationId < destination OperationId, far snap S → D: assert the record is not re-admitted as a spatial root in D, or that D's mutation permission still converges.
• A route-2 local-player ForcePosition parking at :2948 under a quiescing source: assert body.InWorld && record.ObjectClock.IsActive && record.FullCellId != 0 after the next packet's merge-time Forget.

A3 — say "blocking prefix", or make it true

IsRestorableQuiescencePark's doc (:3866-3868) and AP-136's narrowed row both claim "the rollback re-admits nothing into the retiring prefix." It re-admits nothing into the blocking prefix, which is a different statement. A1's fix makes the stronger claim true; if any wording survives it, scope it.

A4 — #309's acceptance steps are now stale

AP-136 says this needs the two-client connected check in #309, but docs/ISSUES.md is unmodified in this diff. #309's steps (docs/ISSUES.md:82-95) describe only "a landblock the observer has not streamed" — the plain unplaceable park. They do not exercise a quiescing source or a quiescing swept neighbour, which are exactly the shapes this round newly makes restorable, and step 4 asks only that route 2's corrections "still land unchanged" without naming the local-player-parks-into-a-quiescing-landblock case that is now behaviourally different. Deferring the run is fine; leaving its scope stale is not. Update the steps in this commit. Also AP-136's Risk column still says "a remote" — the local player now traverses the same restore.

A5 — record the dependency at CanAttemptDestination

N3's "a retained retry can no longer strand" property and MAJOR 1's masking both depend on the pre-flight staying in place. The class doc calls it "an optimisation" with no mention of either. If it is ever deleted as redundant, both re-open silently. Write that down at the pre-flight.

(The round's stated reason for declining N3's CurrentCellId re-check — that it would "re-derive a private Core predicate outside Core" — is false; CanAttemptDestination already calls Core's own internal IsCollisionPrefixQuiescing. The conclusion still holds, for the reason above. Correct the reason.)

B1 — a 36-line doc block was detached from its method

RuntimeRemotePlacementDriveController.cs:1009-1085. CountLivePending() was inserted between CountLiveAwaitingAcknowledgement's existing doc and its method. Now :1009-1044 (which describes pruning _awaitingAcknowledgement, the second ownership registration, and _awaitingAcknowledgementScratch) documents CountLivePending() at :1066 — which prunes _pending, backs the first registration, and uses _pendingScratch. Every specific is wrong for the member it now sits on. :1045-1065 is a second <summary> on the same member, and CountLiveAwaitingAcknowledgement() at :1085 has no doc.

B2 — the stage rule is true by coincidence and stated as a falsehood

:172-188 and :993-1005 assert that RejectedByPlacement's producers are "returned AFTER _physics.Engine.SetPosition ran". RuntimeSetPositionStatus.Rejected has three producers and only one is post-engine:

site	what	stage
:2854	entry validation (!ownsToken, stage mismatch, null body, stale IsPreparationAuthorityCurrent, velocity-version mismatch)	pre-engine
:2945	!IsStructurallyValid(canonicalRequest)	pre-engine
:3044	!result.IsSuccessful after the engine ran at :2997	post-engine

Both pre-engine sites reach SubmitAndResolve's default: and are filed RejectedByPlacement → no store — contradicting the round's own rule (RejectedPreparation's doc :128-142) that a producer which never reached the engine stores.

The reviewer traced both unreachable today, but only by duplicated guards: PrepareMover (:1563-1577) re-checks everything :2830-2855 re-checks with nothing reentrant between; IsPreparationAuthorityCurrent (:5290-5306) catches all seven version dimensions one stage earlier as RejectedAuthority → RejectedPreparation; the AwaitingCell divergence needs DormantLocalActivation, which :1380 forbids for a record with a body; and :2945 is shadowed by PrepareMover:1636's identical check.

Either state in the default: comment that :3044 is the only reachable producer and why, or thread the stage out of Core so the split is enforced. As written the comment says something false about Core — the same shape as round 1's MAJOR A, which was also a false clause in that same comment.

B3 — the deleted phrase came back

RuntimeRemotePlacementDriveControllerTests.cs:1191, an added line: // The complete pre-flight passes: it reads only the destination. CanAttemptDestination's doc in the same diff (:1111-1113) says it is "correcting this comment's earlier 'the complete pre-flight' framing", and the whole of MAJOR B is that no pre-flight can be complete. The sentence also contradicts itself in eight words.

Minor

• m1 — TryAdoptWireCellAfterRouting's new scope paragraph (LiveEntityNetworkUpdateController.cs:1128-1143) enumerates commit and RejectedByPlacement and "every outcome that resolved NO cell". Deferred is in neither: ParkDeferred:4345-4349 snaps to the parked result cell, WithdrawCanonical zeroes FullCellId, and RestoreParkWithdrawal:3485-3491 re-commits from body.CellPosition.ObjCellId — the swept cell for the post-sweep park, not necessarily the wire cell. Behaviour is unaffected (the suppression keys on the arm); the claim is not.
• m2 — Contention's doc (:118-127) names two producers; there are at least four. TryBeginExclusiveAuthoredPlacement:1349-1354 also refuses on HasRetainedCompletion(key) — ordinary right after a Committed far snap whose projection sink declined — and BeginAcceptedPlacementCore:1404-1418 on !_entities.IsCurrent(record). Both pre-engine, so the store side is right.
• m3 — the MAJOR D test (:1516-1552) reaches the superseded state via lifetime.Entities.RemoveActive(record) and picks Refused, which never calls CancelToken. It pins that the guard exists, not that it sits after the synchronous cancellation receipt — the defect's actual mechanism.
• m4 — NotApplicable via record.Key is null (body non-null) stores (:576-581 → :800); the enum doc :97-101 justifies only the no-body sub-case. Unreachable in production (RuntimeEntityObjectLifetime.cs:600-612).
• m5 — ParkCollisionResidents (:3689-3696) relies on restorableOnCancel defaulting false. The old blanket doc was itself the guard against a forgetful caller; now that it is gone, pass false explicitly.
• n1 — :644 cites classifier :467 for StopInterpolating: !nearby; it is :468. Pre-existing.
• n2 — ParkDeferred carries two adjacent <summary> blocks (:4292-4301, :4302-4325); only the second is emitted.
• n3 — the Runtime test class doc (:30-33) asserts every test was revert-verified, with no per-test mapping in the tree. Either map them or drop the claim to what the file can show.

Do not churn — verified across both reviews

Retail decode of SetPositionInternal @0x00515BD0 (both storing and non-storing branches) is exact and matches the enum docs line-for-line. The 7-value switch is exhaustive with _ => throw, and no consumer outside the controller reads the value for a decision, so the Rejected split cannot silently miss a case. Deferred-not-storing is right, with a stronger unreachability proof than the comment gives (ParkCollisionResidents:3563-3568 throws rather than parking an entity that already holds an operation). MAJOR D's guard is the correct predicate (RuntimeEntityDirectory.cs:75-77), sufficient, and correctly placed after the receipt at both sites. N5 is genuinely unconstructible — :917-923/:935-940 throw on binding a component whose body differs from canonical. Pose parity survives the remote.Body → record.PhysicsBody change byte-for-byte. The neighbour test's construction is arithmetically verified (191.95 mod 24 = 23.95 > 24 - 0.1 → lx+1 → 0xB3), it provably hits the post-sweep park, and its Z arm discriminates (terrain 7, authored 6). N7's reframing is accurate. All six required tests discriminate; the cancelled-after-commit construction is genuinely clever. Route 2's re-issue funnel does not interact with the restore (it decides on PositionAuthorityVersion/_newestForce, none of which the restore moves). RestoreParkWithdrawal writes exactly five things and no sweep footprint, cross-cell registration, or BSP residency among them. No added line in the diff carries a source line-number citation — that failure mode is fixed.

Gate

Complete Release suite. Baseline 10,968 / 4 / 0 at 1b631f12. Round 2 measured 11,004 / 4 / 0 while containing everything above. Known flakes, do not chase or conflate: #302 (PortalProjectionTests…, App.Tests), #308 (NakEmissionTests.LossSoak_…, Core.Net.Tests).