acdream/docs/research/2026-08-05-c4-closeout-handoff.md

C4 closeout handoff — every route landed; four connected gates owed (2026-08-05)

Written at C4's implementation closeout. Read this before touching anything.

Where the branch is

• Worktree C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-visvesvaraya-e0a196
• Branch claude/acdream-physics-divergence-5aa784, HEAD e0f96a55
• main is at c7d5fc14 and must stay there. The commits on this branch are deliberately unmerged. Do not merge, rebase, or push unless the user asks.
• Complete Release suite: 11,090 passed / 4 skipped / 0 failed at e0f96a55. This is the measured baseline (up from 11,027 at 2eb39a02, the previous handoff's figure). Any deviation is a regression you introduced. Measure, never inherit:

  $env:ACDREAM_PAK_PATH = "$env:USERPROFILE\Documents\Asheron's Call\acdream.pak"
  dotnet test AcDream.slnx -c Release -m:1
  

• Two known flakes — do not chase, and do not conflate (they have been conflated twice): #302 PortalProjectionTests.ClipToRegion_FrameOwnedStore_…, a GC-allocation assertion in App.Tests; #308 NakEmissionTests.LossSoak_…, a wall-clock deadline in Core.Net.Tests that fails only under full-suite load. A third look-alike (WarmedSteadyContactRefreshDoesNotAllocate) appeared once during route 7 and was proven NOT route 7's by reachability (zero SetFullCell/ParentAttachments references in the measured window) — it is the #302 class.

What landed this session

C4 is implementation-complete. Every route now places through the canonical Runtime owner; what remains for C4 is exclusively the four owed connected gates below, then C5.

commit	what	review record
6dc7ba51	route 4b-3 — remote teleport + cell-less through canonical placement; deletes RemoteTeleportController (605), RemoteTeleportPlacement (85), ~1,709 test lines	dual round 1 FAIL/FAIL → round 2 delta PASS/PASS; three NPC-arm MAJORs closed (A1 zero-arm leash regression, R1 missing D2 shape, R3/A2 synthesized run-cycle velocity). Docs at 8c269ad1
21cd6e9b	4b-3's connected gate recorded PASSED (partial) — 16 [remote-teleport] probe lines, 7 creatures, all cause=teleport-ts; cause=cellless never observed (gate 4 below)	—
1b484937	route 6 — drops/split-recovery closure, zero production lines; 7 sabotage-verified coverage tests over the C3c-flipped path; corrected the campaign plan's false effect-replay premise	contract-governed closure, no dual reviews (nothing to review — the stop condition was "any production diff means the finding is wrong")
daef7c98 / b260bcd1	#314 — split recovery threw instead of recovering (retained Movement/ServerControlledMove timestamps). Found BY route 6's coverage tests, in the exact mechanism the scoping cited as evidence drops converge. Split into its own commit immediately (process rule 2)	—
a89bcb39	#316 filed — player-arm LANDING TRANSITION block never publishes the collision shadow. Found by the OnPosition-collapse scoping; neither 4b-3 review round caught it	—
edc911b0	the OnPosition dual-tail collapse — one shared player/NPC remote tail	—
aaf0811f / 30d3d114	#315 closed — cached remote-arm callbacks instead of a per-packet Func<bool> closure (+ closing-SHA correction)	—
36255af0	route 5 — projectile authoritative placement (#276 partial). Byte-decode hard gate first (MoveOrTeleport @0x00516330 never reads its velocity arg); conjunctive ProjectileAuthoritative predicate; AP-141 filed	three dual rounds, 8 MAJORs closed; round 3: retail PASS (C1 must-fix doc correction), architecture FAIL on coverage-only C1, closed in-commit with two sabotage-verified Advance() retry-arm tests
cff52c44	stale set_velocity comment correction at the 4a velocity commit (spawned #317)	—
ca96ea5e	research: retail parent-cell propagation settled + route 3 scoped	—
19ebf043	route 3 contract pinned (the portal producer adapter)	—
cd3129e9	route 7 — child cell propagation moves from a render tick into Runtime; ClassifyLeaveWorld family deleted; headless parent-realize drive; iterative-worklist propagation (depth cap deleted); AP-142/AP-143 filed	dual round 1 FAIL/FAIL (R1–R11 / A1–A10) → round 2 delta PASS/PASS (N/B findings) → coordinator-required third pass (the depth-cap deletion both round-2 reviews independently demanded, N4/B3); 5 MAJORs total
e0f96a55	route 3 — portal placement authority (local player); the first RuntimePortalPlacementAuthority producer; both duplicate authorities deleted; AP-144/AP-145 filed, AD-42 deleted, #318 filed	dual round 1 FAIL/FAIL → dual round 2 FAIL/FAIL (near miss) → round-3 fix pass accepted per both round-2 reviews' explicit pass conditions (§G of each). No standalone round-3 review doc exists — the round-3 record is the commit message, #318, and AP-144/AP-145

Suite trajectory across the session, all measured: 11,027 (2eb39a02) → 11,013 (6dc7ba51, net of the 1,709-line test deletion) → 11,020 (1b484937) → 11,036 (30d3d114) → 11,063 (36255af0) → 11,079 (cd3129e9) → 11,090 (e0f96a55). Zero failures at every checkpoint.

The four owed connected gates — NONE has been run

These are the whole of C4's remaining debt. Each pass criterion includes its probe evidence: a clean-looking session with no probe lines is a not-run, never a pass (process rule 5; the 4b-2 #309 precedent and the 4b-3 partial both exist because of this rule).

Gate 1 — route 6: drops (user-run, visual)

Recipe (route 6 contract, Gates section):

1. Drop a whole item on open ground — lands at your feet, resting, immediately pickable.
2. Split a partial stack to the ground — correct quantity on the pile, remainder in inventory.
3. Drop a second item within ~1 m — both remain visible and separately pickable.
4. Repeat once indoors and once after a portal recall.
5. Walk two landblocks away and back — both piles still there, still pickable.

Pass criterion: all five visuals clean. Regressions to watch: item at world origin or your previous position (stale pose); invisible but blocking (#184 class); sunk into / floating above the floor; not pickable; the split pile never appears (recovery window failed — the #314 mechanism); the second drop swallowed by the first. No probe exists for this route (it is route-1 traffic); this is the one purely visual gate.

Gate 2 — route 7: equip/carry across landblock boundaries (two-client)

ACDREAM_PROBE_CHILD_CELL=1. Recipe (route 7 contract §7):

1. Equip/unequip cycle — weapon then shield, five times, observer watching: in the hand, at the hand, oriented with the hand, clean disappearance on unwield.
2. Carry across ≥2 landblock boundaries and back, both directions of observation, including one indoor/dungeon traversal (EnvCell-to-EnvCell crossings are the high-frequency case).
3. Pickup: drop the weapon, pick it back up — leaves the ground, no ghost, no invisible collider at the drop site.
4. Loot an equipped item from a kill (the delete edge under load).
5. Reconnect with equipment — re-attaches.
6. Portal recall while equipped — equipment present and following after arrival.

Pass criterion: the session counts ONLY if [child-cell] lines with cause=propagate appear during step 2, child cell always equal to the player's. Regressions: weapon drawn at the world origin or its last ground position; invisible while equipped; left behind at a landblock boundary (the D4 demotion's specific risk); invisible-but-solid at a former position (#184); child culled while the parent is visible or vice versa. The headless half's direct regression test (DirectSink_D5_StandaloneParentEventCommitsChildToParentsExactCell) is already in-tree and green; a headless probe session (cause=headless-attach/propagate) remains a nice-to-have per the contract.

Gate 3 — route 3: portal/recall (user-run, two-client)

Release build, ACDREAM_RETAIL_UI=1, ACDREAM_PROBE_LOCAL_TELEPORT=1, live ACE. One session exercising, in order (route 3 contract §9):

1. a physical outdoor portal (e.g. Holtburg portal);
2. a dungeon portal (indoor destination — the EnvCell readiness path);
3. /ls lifestone recall AND one spell recall (the F751 recall family);
4. an ACE admin teleport of the LOCAL player (@teleto/@teleloc);
5. a same-destination revisit (ACE may omit CreateObject on revisit);
6. autorun through a portal — arrival must be at REST (the PlayerTeleported port observable: autorun cancels on arrival);
7. graceful close.

Pass criterion: the session counts ONLY if [local-tp] lines actually appear — one per arrival with placement=Committed, the portal generation/sequence, resolved destination cell, leash=armed, autorun=cancelled, and zero Refused/Contention lines in ordinary play. Plus: the accepted purple-materialization visuals with no opaque pop, camera reset behind the player, movement works immediately with W held, idle stance (no run-in-place), no rubber-band/tether; a second client observing sees a normal materialization and stance; the exact lifecycle/reconnect gate passes with every transitOwnership counter zero at stable checkpoints. The two refusal causes (stale-reveal, host-token-unavailable) now log through LogLocalTeleportArrival under the same probe flag — the round-2 review's blindness finding is fixed, so refusals cannot hide.

This gate is explicitly NOT scored as covering #318. The connected session exercises the live path but asserts nothing about PhysicsEngine.ShadowObjects; #318's composition test is a separate, C5 deliverable. Do not fold them.

Honest-gap rule carried from the contract: mid-transit supersession and mid-transit disconnect are hard to provoke against ACE — if the session does not produce them, record the stale-generation behaviour as test-verified-only, never inside a blanket "gate passed".

Gate 4 — route 4b-3's cause=cellless case: still unexercised, and its recorded recipe is now INVALID

The 4b-3 gate passed for cause=teleport-ts only (21cd6e9b). The recorded closure recipe — "unwield-to-3D is the cheapest reachable trigger" — was invalidated by route 7 (route 7 contract §11; the supersession note is already appended to the 4b-3 contract): after D1/D2, a committed child's canonical cell is deterministically the parent's, so an unwield Position arrives with a NON-zero pre-merge cell and classifies by TELEPORT_TS/distance — which is retail's own predicate population (retail's unset_parent does no cell work either). The old recipe only ever worked because of the render-tick two-writer defect route 7 closed.

The replacement trigger is UNESTABLISHED. What is needed: a Position on a body that is genuinely withdrawn/never-celled at merge time (between a CommitWithdrawal/CommitAcceptedParentCellless cell-less edge and its next accepted Position, or an initial Create that never resolved a cell). Whether ACE ever emits an UpdatePosition in that exact window is not established — this needs its own investigation before a live recipe can be written down. Until then the cell-less arm remains covered by the synthetic PreMergeCommittedCellId == 0 fixtures only; do not re-label those as live behaviour, and do not score any teleport-ts session against this gate.

Open issues created or touched this session

#	status	one line
#313	OPEN	retail DeclareValid's SetSelectedObject split-recovery selection transfer not ported; selection UX, deliberately kept out of the placement closure
#314	CLOSED (daef7c98)	split recovery threw on nonzero retained Movement/ServerControlledMove timestamps — found by route 6's coverage tests in the exact mechanism cited as evidence of convergence
#315	CLOSED (aaf0811f; SHA corrected 30d3d114)	per-packet runTeleportHook closures replaced by cached remote-arm callbacks
#316	OPEN	player-arm LANDING TRANSITION block never publishes the collision shadow. Measure before fixing — either a ~33 ms cosmetic lag or a real #184 instance; the issue names the measurement
#317	OPEN	TryCommitAuthoritativeVelocity's call site has no established retail basis (route 5's byte-decode disproved the comment it carried); needs a full accepted-Position velocity-chain audit
#318	OPEN → C5	route 3 §8 items 8/9/10 residual: no end-to-end composition test, no shadow assertion, no T8 ordering proof (below)
#309	OPEN, re-scoped	largely superseded by #312 (closed b1f914d5 last session); the surviving narrow half is retail's GotoLostCell hidden-until-reenter_visibility behaviour

Register rows this session: AP-141 (route 5 projectile shapes; narrowed round 2, risk column corrected round 3 — the "drag toward a stale anchor" claim retracted by its own author), AP-142 (parented-child single-field cell model; amended twice; clause (e)'s depth cap RETIRED outright — replaced by the iterative worklist), AP-143 (headless parent-realize skips all three graphical attach validations; inertness argued per check), AP-144 (portal movement-event send gates on UsePositionFromServer (autonomy_level != 2) where retail's SendMovementEvent gate is != 0; diverges only at unreachable level 1), AP-145 (the collision-shadow cache-without-publish asymmetry, carried as #318). AD-42 deleted (route 3 ported its last citation); AD-2 amended.

What C5 inherits

1. The #318 composition test — drive a real portal arrival through the canonical drive controller and the REAL RuntimePlacementPresentationSink against a REAL PhysicsEngine, then assert PhysicsEngine.ShadowObjects holds a row at the destination cell/position — not just LocalPlayerShadowState's internal dedup cache — plus the T8 write ordering. That discriminating assertion exists because of AP-145's asymmetry: TryPublishPlace calls LocalPlayerShadowState.Set directly, a plain cache write that bypasses LocalPlayerShadowSynchronizer.SyncPose's ShadowObjects publish AND pre-seeds SyncPose's dedup check with the destination pose — so the next movement tick can skip its own publish too. A test that asserts only the cache is satisfied by the bug.
2. The legacy-deletion sweep + closeout gates (the C5 slice as planned): parity tests, final-binary suite/soak/lifecycle routes, two-client observation, user visual matrix; retire AP-1, AD-1, AP-131, AD-60's legacy half; close #275. Named sweep candidates recorded by route 3: ILocalPlayerTeleportPlacement (now a thin acknowledge seam) and the test-only BeginAcceptedPlacement/BeginAuthoredPlacement wrappers.
3. #280 (portal destination prefetch) — campaign plan item 3, its own slice with its own visual gate; deliberately NOT bundled with route 3.
4. #276 remainder — route 5 closed only its projectile half; the SpawnPlacementSettler settle-cell discard stays open. #277 was not folded (no radius changed); its service-window conversion remains trigger-conditioned on any streaming/broadcast radius change.
5. #316's measurement, #317's velocity-chain audit, #313 (selection UX, outside placement), #309's re-scoped narrow half.
6. The cell-less live-trigger investigation (gate 4 above).
7. The TEMPORARY probe family strip once physics settles: ACDREAM_PROBE_REMOTE_LANDING, ACDREAM_PROBE_REMOTE_SLIDE, ACDREAM_PROBE_PARK, ACDREAM_PROBE_REMOTE_TELEPORT, ACDREAM_PROBE_CHILD_CELL, ACDREAM_PROBE_LOCAL_TELEPORT — strip as a family, but NOT before the four owed gates have consumed them.

Process findings — stated as rules for the next session

These are distilled from what actually went wrong (and right) this campaign. Each carries its citation so you can check it instead of trusting it.

(a) The contract causes the defect. Three separate defects came from a contract asserting a mechanism that did not exist. Route 4b-2 round 1: the contract said "arm ConstrainTo on refusal" without "and still advance the pose" — a frozen remote. Route 7 R1: the contract enumerated enter_cell's five writes but silently dropped the part_array guard AROUND them — a guard the propagation research itself had called "load-bearing"; the commit message names it "a right finding that evaporated across two handoffs with nobody re-reading the source". Route 3 round 1 (the worst): the contract assumed TeleportAnimEvent.Place re-fires on later Ticks after a refusal; it does not, so a refused Place released the player at the pre-teleport position while the anim stream marched on. Rule: before building on a load-bearing premise, verify it in code at implementation start — a contract's "the mechanism will retry" is a claim, not a fact, until you have read the retry.

(b) Inferring a fact you can observe is how a fix becomes silent. Route 3 round 2 "fixed" round 1 by inferring "the placement committed" from a global PendingCount == 0 — which three non-committing paths also produce (including the drive's own documented modal outcome). The SAME bug then completed cleanly and passed its invariant: strictly worse than round 1, which at least tripped the portal-complete-before-materialized invariant. Round 3 latches the commit where it actually happens (ReconcileAndAcknowledgePortal → TryConsumePortalCommit, keyed on reveal generation + teleport sequence), sabotage-verified on both hosts. Rule: never infer from an aggregate what the system can tell you directly. If the observable exists, read it; if it does not, build it — an inference that happens to correlate today is a defect with a delay timer. (Commit e0f96a55; arch round-2 B1.)

(c) Planning documents go stale across cutovers. Five (at least) were wrong against HEAD this session: the campaign plan (route 6's effect-replay premise :98-100, unsubstantiated — corrected at 1b484937; the route-3 "adapter does not exist" line — only the producer was missing, corrected at e0f96a55's docs); the 2026-08-02 cutover route inventory (wrong in eight enumerated ways — route 3 scoping §3); the routes-6-7 scoping (five substantively false or superseded claims — route 7 contract §10); the 2026-07-16 portal-completion pseudocode (portal arrival attributed to enter_world, which is the login path — corrected in e0f96a55); and the 2026-08-04 session handoff (#280 bundling overridden with cause; its cell-less recipe later invalidated by route 7). Related: the 2026-08-03 handoff's "six fixture failures" was a mis-measurement — the baseline found 43 (#281). Rule: re-verify every inherited claim by symbol, never by line number; measure every count, never inherit one; and when you correct a document, date the correction in place rather than deleting the history.

(d) A skipped test is a permanent false signal. Route 3's fix pass refused to accept 7 skipped tests and drove the count to zero — and that refusal uncovered a production bug that made an entire code path dead: TryExecuteCanonicalPortalPlacement re-read the accepted destination at Place time, but TryBeginPortalReveal had already consumed that slot at Aim time, so the canonical portal arm was 100% dead code and every real Place would have refused with host-token-unavailable. The skips were the only symptom. Rule: a skip is an assertion nobody is making. Do not park a test as skipped to protect a green count — the thing it cannot assert is exactly where the defect is. (Commit e0f96a55.)

(e) Sabotage-verify — and beware a test that reads a production constant it also perturbs. Every new discriminating test this session was sabotage-verified (break the behaviour, watch the test fail, restore). Two findings sharpen the practice. First: route 7 shipped a test that survived deleting the entire behaviour it claimed to pin, because its assertion read a field (WorldEntity.ParentCellId) written unconditionally one line before the demoted call — the sabotage must be run in BOTH directions (canonical half and presentation half separately; route 7 contract §6 test 10). Second: the route-7 depth test both READ MaxPropagationDepth and SIZED its chain by it — so a perturbation of the constant built a 64,000-node chain and stack-overflowed the test host (arch round-2 B7, which then swept tests/ for the same shape and found one more with real blast radius: LandblockLoaderTests.cs:210). Rule: sabotage both halves of every dual-layer assertion, and never derive a test's workload from the constant under test — pin the constant with a literal first, then use literals.

(f) Reviewers retract; that is the process working. Three self-retractions this campaign, two of which prevented shipping a wrong register row or a relocated defect: (1) route 5 round 1's R6 finding was retracted the following round as factually wrong — and complying with it had produced the campaign's one recorded fix-round defect, the ParentCellId regression; the round-3 fix is the REVERT to record.FullCellId, not the relocation R6 demanded. (2) Route 5 round 3's §C1: the retail reviewer retracted their OWN round-2 claim that a stale leash "would drag the body toward a stale anchor" ("I wrote the mistake it was copied from") — the port's ConstraintManager brakes, never pulls — preventing a wrong AP-141 risk column from landing in the register. (3) Route 3's retail round-1 §3.4 premise (that TryApplyRuntimePlacementPlace writes no pose) was verified WRONG by round 3 — it does write pose/rotation/ParentCellId and rebucket — dissolving the original blocking concern into #318's narrower coverage gap instead of a relocated "fix". Rule (recorded in route 5's own commit): review findings are evidence to re-verify against the code, not commands to obey unconditionally — and a reviewer who retracts with cause is strengthening the record, not losing face.

(g) Gates must be able to see the defect they gate. Three gates were unpassable or blind as originally specified and were corrected BEFORE being run: (1) 4b-3's recipe named "a second character" as the teleport target — but a player-guid target cannot reach the NPC arm at all (RemoteServerControlledVelocityCycle.Apply early-returns for 0x50xxxxxx guids), and all three of the fix round's MAJORs lived on the NPC branch, so a player-target run would have reported a clean pass over all three; corrected to creature-target (@teleto a drudge), and the passed gate's 16 probe lines prove the NPC branch ran. (2) Route 3's two refusal causes logged under ACDREAM_PROBE_TELEPORT — a DIFFERENT flag from the gate's pinned ACDREAM_PROBE_LOCAL_TELEPORT environment — so a refusing session would have looked identical to a committing one; rerouted through LogLocalTeleportArrival before the gate (retail round-2 finding). (3) 4b-3's cell-less closure recipe was invalidated by route 7 and is recorded as UNESTABLISHED (gate 4) instead of being left on file as a recipe that can no longer fire. Related in kind: route 5 has NO live gate by design (ACE never sends a missile UpdatePosition — WorldObject_Tick.cs:333-334) and says so, rather than inventing one. Rule: before running any gate, walk the chain from the defect to the evidence channel and confirm each link actually fires under the gate's exact environment — and when a gate cannot exist, record that, never a substitute that measures something else.

Connected-test recipes that worked (carried forward)

• Far snap: stand still; second character runs past ~100 m, stops, turns, runs back. Three or four times.
• Steep slide: second character jumps onto a sloped roof.
• Park: move to a landblock not visited this session, have the remote arrive while it is still streaming, have them take a step, then stand still.
• Remote teleport (4b-3): @teleto/@teleloc a CREATURE into view — never a player character (see rule (g)).
• Graceful close matters — a hard kill leaves ACE holding the session ~3 minutes.

---

Connected gate RESULTS — 2026-08-05 (user-run, user-accepted)

Run against the exact e0f96a55 Release binary with the retail UI (ACDREAM_RETAIL_UI=1), ACDREAM_PROBE_CHILD_CELL=1 and ACDREAM_PROBE_LOCAL_TELEPORT=1, live ACE at 127.0.0.1:9000. Log: c4-gates.log (731 lines). User verdict: "works great."

Three of the four owed gates were exercised in one session. Probe evidence, because a clean-looking session is not a pass:

Route 3 (portal) — PASS, unambiguous. Three [local-tp] lines, every one status=Committed hookTail=ran leash=armed, across three distinct destinations (0x00070143, 0xA9B40019, 0x1134001F). leash=armed is the load-bearing observation: before the round-2 R3 fix the field read IsFullyConstrained() and was structurally incapable of printing anything but unarmed, so this line proves both the arm AND the corrected probe.

Route 7 (child cell) — PASS, but THIN. 17 [child-cell] lines: 13 cause=attach, 3 cause=delete, 1 cause=propagate. The stated pass criterion (at least one cause=propagate) is met, so the gate passes — but propagation across a parent cell crossing is the slice's entire purpose, and one sample proves the path executes rather than that it is robust across repeated crossings. A future session should run several equipped landblock crossings and expect propagate counts in double digits.

Route 6 (drops) — PASS on visual only. Route 6 has no probe (zero production lines by design), so this gate rests entirely on the user's visual confirmation. That is inherent to the route, not a gap in the run.

Gate 4 (4b-3 cause=cellless) — STILL NOT RUN, as expected: its recorded trigger was invalidated by route 7 and the replacement is UNESTABLISHED.

Not exercised — recorded, not glossed

• Route 3's autorun cancel — CLOSED 2026-08-05, same session. An earlier revision of this section recorded it as live-unverified, because the first three portals reported autorun=unchanged. That was true of those three and wrong as a conclusion. The user then portalled WITH autorun engaged and the fourth line reads gen=5 seq=4 dest=0x00070145 resolved=0x00070145 hookTail=ran leash=armed autorun=cancelled.

  That verifies the PlayerTeleported @0x006B32B0 SetAutoRun(0,1) + SendMovementEvent port in live play, and it was a REAL gap before this slice: nothing cancelled the J5.4 autorun latch on arrival, so auto-running into a portal left you running on the far side where retail stops you.

  All four load-bearing fields on that line read correctly — Committed, hookTail=ran (inversion B: the local hook runs AFTER placement, opposite to 4b-3's remote arm), leash=armed (inversion A: armed here, opposite to route 2's ForcePosition rule), and autorun=cancelled.

• AP-144's autonomy divergence remains unreachable (TrySetAutonomyLevel has zero production callers), so nothing in this session could have exercised it either way.

• Per both round-2 reviewers' condition, this session is explicitly NOT scored as covering #318 (the end-to-end presentation composition test).