acdream/docs/research/2026-08-04-c4-route-4b-2-round4-correction.md

C4 route 4b-2 — round 4 correction (final), 2026-08-04

Both round-3 reviews returned FAIL, and both bound the failure to the same place. No shared-core edit is warranted. Review A verified the relocation line by line and states plainly: the code is correct.

Round 4 is one test, one deleted sentence, two docs/ISSUES.md fixes, and a handful of doc corrections.

The MAJOR — both reviewers, independently

Nothing in the tree discriminates round 3's predicate from round 2's, and a test doc cites a sibling test that does not exist.

RuntimeRemotePlacementDriveControllerTests.cs:1343 names ConcurrentQuiescences_ParkIsNotRestoredIntoTheQuiescingDestination. That identifier occurs exactly twice in the tree, both inside that one comment.

Review A evaluated round 2's form (blockingToken.LandblockPrefix != (result.CellId & 0xFFFF0000)) against all six quiescence tests. Every row agrees with round 3. Revert the relocation to the single-token comparison and the suite is still green at 11,007. So A1's two stated defects — comparing one token instead of the live set, and reading the pre-snap cell instead of the post-snap one — have no automated floor under them at all, while the tree asserts otherwise.

Write the test. Both reviewers identified the same and only discriminating construction, in RuntimeAcceptedPositionDriveControllerTests (route 2 has no pre-flight, which is what makes it the caller that can reach the shape):

• two live quiescences, source OperationId < destination OperationId
• park at :2948 under the source
• assert !IsSpatialRoot(record) after the next packet's merge-time Forget

It fails under the round-2 form (Source != Dest → restorable → re-admitted into the retiring destination) and passes under round 3. Then delete or correct the :1343 cross-reference.

#309 — the gate currently passes while broken

S1. Step 5 (docs/ISSUES.md:115-119) says the player "recovers on the next server Position rather than staying withdrawn indefinitely". QuiescingDestinationPrefix_ForcePositionParkIsNotRestored (:906-912) asserts the opposite for that packet — InWorld == false, clock inactive, !IsSpatialRoot. Route 2's drive dispatches only for ForcePosition; an ordinary Apply merges behind it (RuntimeAcceptedPositionDriveController.cs:337). So the packet the step names is precisely the one that does not recover it. Name what actually does — a later ForcePosition, or the quiescence releasing plus a placement.

S2. Steps 4 and 5 both need a ForcePosition to land inside a transient collision-prefix quiescence window, which the user cannot synchronise with a teleport or portal arrival, and neither step names a signal confirming the park fired. A tester sees a clean teleport and records a pass. Give each step a stated confirmation signal — a probe line, or a documented CaptureOwnership().DeferredCellCount check. If a deterministic way to hold a prefix quiescing for the duration is cheap, prefer it.

Step 5's retirement-still-completes clause is good; steps 1-3 and 6 are performable as written.

Doc corrections

• D1 — AP-136 says restore covers the plain unplaceable park "unconditionally". It does not: ParkDeferred now gates every park, including :3063, on !IsCollisionPrefixQuiescing(body.CellPosition.ObjCellId) (:4358-4360). The same row states it correctly two sentences later — the row contradicts itself.
• D2 — AP-136's trailing parenthetical still summarises #309 as the original three steps plus "route 2's corrections are unchanged". This commit rewrote #309. The row's body says the scope widened; its own summary does not.
• D3 — RuntimeRemotePlacementDriveController.cs:1064-1066 attributes the null-body re-test to PrepareMover's guard clause (RuntimeSetPositionState.cs:1563-1577), which has no body test. The real dependency is RuntimeRemotePlacementDriveController.cs:625 (record.PhysicsBody is null → NotApplicable). Conclusion holds; the attribution points a maintainer at the wrong guard.
• D4 — B2's chosen value was not delivered. Choosing "state it" over "enforce it" is sound and both reviewers concur with the decision — but none of the four dependencies is annotated at its own site: PrepareMover's guard (:1563-1577), IsPreparationAuthorityCurrent (:5304-5320), PrepareDormantLocalActivationOwnership's record.PhysicsBody is not null (:1380), TryBeginExclusiveAuthoredPlacement's existing-operation refusal (:1349-1351). Deleting any one is invisible from the site, which is the whole thing "state it" was supposed to buy. Four one-line back-references close it.
• D5 — scope the CurrentCellId claim to the first submit. ParkDeferred's doc (:4300-4307, :4320-4325), AP-136 and AP-138(2) all say the pre-engine arm "names the destination" in production. True on the first submit, false for a retained retry: Advance() re-reads record.FullCellId at submit with no fresh merge (RuntimeRemotePlacementDriveController.cs:941-954, RuntimeAcceptedPositionDriveController.cs:663-667), and RemoteTeleportController.cs:532 is a shipped writer that moves it to the pre-teleport landblock. CanAttemptDestination's own doc (:1234-1241) already says this correctly — the three others contradict it. Otherwise the next reader concludes the CurrentCellId arm is dead code. Same family: :1252-1253 ("every shape this predicate cannot see is a merely-swept NEIGHBOUR") is contradicted by the third-landblock shape named ten lines above it.

D6 — make the Captured claim exact rather than caveated

Captured is a park-time snapshot. For the far snap the window is nanoseconds (SubmitAndResolve's DeferredCell arm cancels synchronously, :1038). For route 2 the park is retained (RuntimeAcceptedPositionDriveController.cs:745-753, AwaitingCommitWake: true) and the restore lands on the next packet's merge-time Forget, ~150 ms later. Streaming opens a quiescence per landblock mutation, so a prefix clean at park time can be quiescing at restore time, and RestoreParkWithdrawal re-admits into it unconditionally.

It self-heals and is no worse than the baseline, so it is a residual rather than a regression — but add the re-test: one IsCollisionPrefixQuiescing(residentCellId) condition at RuntimeSetPositionState.cs:3488, in the method that already reads that variable. That makes the docs' claim true at the moment it matters instead of requiring a "when the park was taken" caveat everywhere it appears. Prefer the exact claim over the caveat.

NIT

• N1 — IsCollisionPrefixQuiescing(0) re-opens the C3c-F3 sentinel conflation. AdjustToOutside zeroes the cell id on map-edge failure (LandDefs.cs:139), and prefix 0x00000000 is the legitimate corner landblock (0,0) per BeginCollisionPrefixQuiescence:840-846, not "no landblock". Review A could not construct a reachable path, but this file already carries a shipped-crash comment about exactly this conflation. Add the != 0u guard.
• N2 — FarSnap_ConcurrentQuiescences_RefusesBeforeOpeningAPark is behaviourally redundant with the destination-prefix test (both fail identically if the pre-flight's IsCollisionPrefixQuiescing half is removed), and its sourceQuiescence.OperationId < destinationQuiescence.OperationId assert never influences an observed outcome. Keep it, but its doc should not imply stronger A5 evidence than it carries.
• N3 — RuntimeAcceptedPositionExecutionStatus.DeferredCell's doc ("the destination landblock's collision generation was not ready") is the status two new route-2 tests assert for a quiescence park. Pre-existing, in a file this diff does not touch — the next stale comment in line. Fix it or file it.

Do not churn — verified across both reviews

The A1 relocation is mechanically correct: IsCollisionPrefixQuiescing consults the full map (:827-829; one live entry per prefix via Remove-then-Add :857/:885); the post-snap cell is exactly what RestoreParkWithdrawal:3484 restores at, with no writer in between; SnapToCell really does set InWorld = true (PhysicsBody.cs:201-205) so the three-local hoist is required, not stylistic; RetryDeferred re-parks without a second SnapToCell, keeping the decision bound to the cell it was taken against; the plain park at :3063 is provably unchanged (the :3017 quiescence check already returned false, and AdjustToOutside is idempotent on an adjusted pair); ParkCollisionResidents passes false explicitly; no prefix pin or streaming stall is possible (HasOldPrefixPlacementDebt:3829 skips WakeableLostCell, and the operation is retired before the restore). All four ParkDeferred call sites accounted for.

The pushback is a legitimate correction, traced independently through TryApplyPosition:1771-1774 → RefreshDerivedState:230-237 → SetFullCell, and the remote leg through RebucketLiveEntity → CommitRebucket:1816. Route 1 and remote creates cannot reach the source shape at all (CurrentCellId requires body.InWorld, false for a first-entry body).

Both route-2 tests drive production (MergeAccepted → real TryApplyPosition, real PhysicsTimestampGate, then TryExecuteAcceptedLocalPosition); nothing is hand-built. Keeping FarSnap_QuiescingSourceLandblock_ is right — the state is constructible in the fixture, only production cannot reach it — and its caveat is accurate. A5 is satisfied at the pre-flight itself. B1, B3, m1-m5, n2, n3 all fixed and accurate. n1 in the round-3 correction was MINE and wrong — classifier :467 is correct, :468 is ConstrainPhase, and the member-name replacement is exact. No added line carries a source line-number citation — verified by scanning every + line.

Gate

Complete Release suite. Baseline 10,968 / 4 / 0 at 1b631f12; round 3 measured 11,007 / 4 / 0. Known flakes, do not chase or conflate: #302 (PortalProjectionTests…, App.Tests), #308 (NakEmissionTests.LossSoak_…, Core.Net.Tests).