a32aba35d1
C2 landed at 63c601ff with dual review PASS after two fix rounds. The
plan records the halved allocation result and tightened gate, the
class-wide token-based staleness rework the pooling forced, the
documented residual floor (Core-side ~520 B/op deferred to the C3
activation gate as a possible C2b), and the two review maintenance
notes. Next slice: C3, the spawn-frequency host cutover of routes 1+8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
140 lines
8.7 KiB
Markdown
140 lines
8.7 KiB
Markdown
# Placement production cutover — campaign plan (2026-08-02)
|
|
|
|
The final leg of the remaining physics-divergence campaign before AP-22 and
|
|
AD-10: route graphical AND headless production placement through the
|
|
residence + continuation-executor owner (`38fd4b8d` / `30012361` /
|
|
`5db3de3c`), delete the legacy duplicate authorities, and retire AP-1/AD-1
|
|
behind connected + user-visual gates.
|
|
|
|
**Inputs (read in order):**
|
|
1. [`2026-08-02-runtime-continuation-executor-handoff.md`](../research/2026-08-02-runtime-continuation-executor-handoff.md)
|
|
— the completed dormant mechanism and its cutover notes.
|
|
2. [`2026-08-02-cutover-route-inventory.md`](../research/2026-08-02-cutover-route-inventory.md)
|
|
— the full 8-route, both-host call-chain inventory with exact file:line
|
|
for every duplicate authority to remove. THE map for all slices below.
|
|
3. [`2026-07-31-remaining-physics-campaign-handoff.md`](../research/2026-07-31-remaining-physics-campaign-handoff.md)
|
|
— the original per-route requirements and prerequisite definitions.
|
|
|
|
**Standing discipline per slice:** pinned contract → single implementer →
|
|
independent retail-conformance + architecture/adversarial reviews (both must
|
|
PASS on the final diff) → focused + complete Runtime + Release build +
|
|
complete solution gates → bisectable behavior commit (register rows in the
|
|
same commit) → docs/handoff commit. No workarounds; no fused slices.
|
|
|
|
## Confirmed pre-cutover gaps (from the inventory)
|
|
|
|
- The executor publishes only generic entity deltas; nothing bridges its
|
|
completion to `RuntimePlacementProjectionChannel`, so no host can learn
|
|
"my initial placement committed" through the built observer seam.
|
|
- No atomic controller/body publication owner exists (prerequisite C);
|
|
App and headless hand-write divergent `PlayerMovementController`
|
|
construction, and `SubmitPreparedPlacement` requires a canonical
|
|
`PhysicsBody` that nothing currently publishes atomically.
|
|
- The dormant placement path's 1,880 B/operation (2,048 cap) allocation
|
|
remains the activation blocker for frame-frequency routes.
|
|
- `Execute`'s live inputs (`UsePositionFromServer`, `PlayerDistance`) are
|
|
computed by no host; they must derive from Runtime's own character-option
|
|
and local-player owners.
|
|
- `RuntimePortalPlacementAuthority` has zero producing call sites; the
|
|
adapter from `RuntimeWorldTransitState` does not exist.
|
|
- The exact-Setup mover chain (`PrepareMover` /
|
|
`RuntimeSetPositionMoverPreparer.TryBuild` /
|
|
`IPreparedCollisionSource.ReadSetupCollision`) exists piecewise, unwired.
|
|
- Route-6 split-recovery creates need an effect-replay suppression signal;
|
|
route-7 needs `TryCommitParent`/`CommitWithdrawal` cancellation-symmetry
|
|
fixes and host-visible cancellation receipts; headless lacks any
|
|
parent-realize sequence (pre-existing, adjacent).
|
|
|
|
## Slices
|
|
|
|
- **C0 — Runtime bridge + live inputs — COMPLETE at `67f63e85`
|
|
(2026-08-02, dual reviews PASS).** The executor publishes an
|
|
acknowledge-only `ExecutorCompleted` receipt through the one placement
|
|
stream (registered before dispatch; correlation reaped on
|
|
acknowledgement/discard/clear; `PendingCompletionReceiptCount` in
|
|
`IsConverged`); all three production sinks acknowledge-and-ignore the
|
|
kind via early returns proven behavior-preserving for every other kind
|
|
(sanctioned seam completion — provably inert, no production publisher);
|
|
`UsePositionFromServer` derives retail-exactly from
|
|
`RuntimeCharacterState.AutonomyLevel != 2` and `PlayerDistance` from the
|
|
live movement controller with null-safe fallback to the caller struct;
|
|
`TryPrepareAndSubmitAuthoredPlacement` chains the prepared-collision
|
|
Setup read through `PrepareMover` to submission with zero validation
|
|
changes; `TryCommitParent`/`CommitWithdrawal` gained the sibling
|
|
cancellation flow (the `LeaveWorld` omission in `TryCommitParent` is
|
|
retail-REQUIRED per `set_parent` 0x00515A90:283832-283833's single gated
|
|
`leave_world`). Not fully dormant by design: the two cancellation fixes
|
|
change live Runtime paths production already calls; everything else has
|
|
no production caller.
|
|
**C3 prerequisites recorded from C0's reviews:** (a) the completion
|
|
receipt/trace surface is internal-only — C3 must define the public host
|
|
consumption shape when it wires the hosts; (b) `PlayerDistance` is
|
|
resolved once per `Execute` entry, not per continuation — a multi-Position
|
|
FIFO classifies later entries against entry-time distance (documented
|
|
deferral; refine at C3/C4 if the connected gates show it matters);
|
|
(c) any future host exposure of `TrySetAutonomyLevel` must carry retail's
|
|
`SendAutonomyLevelEvent` (699550).
|
|
- **C1 — atomic controller/body publication — SATISFIED BY EXISTING
|
|
MECHANISM (research finding 2026-08-02, plan amended same session).**
|
|
`RuntimeLocalPlayerPhysicsPublicationState` (1,033 lines) plus the
|
|
~15-method dormant local-activation family on `RuntimeSetPositionState`
|
|
already implement the full sanctioned option-2 transaction:
|
|
off-canonical preparation against a scratch quantum clock and a sealed
|
|
candidate controller, one validated atomic Commit, and a staged
|
|
Evaluate/Commit/FinalizeActivation chain re-validated against
|
|
PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session
|
|
identity at every entry — with zero production callers. See
|
|
[`2026-08-02-canonical-body-writer-map.md`](../research/2026-08-02-canonical-body-writer-map.md)
|
|
(6 canonical body writers; the two host escape hatches; both hosts'
|
|
divergences). The remaining work — routing both hosts' local-player
|
|
construction through the publication lifecycle, sealing the public
|
|
`RuntimeLocalPlayerMovementState.Controller` setter, retiring App's
|
|
direct object-clock bypasses, and containing headless's uncaught
|
|
prepared-collision `InvalidDataException` — IS the C3 route-1 flip and
|
|
moves there. No separate C1 commit.
|
|
- **C2 — placement allocation budget — COMPLETE at `63c601ff`
|
|
(2026-08-02, dual reviews PASS after two fix rounds).** 2,032 → 944
|
|
B/op via pooled operation envelopes (bounded, reset-at-rent, double-
|
|
retire guarded, reset/dispose-cleared, ledger-visible), a cached
|
|
collision-callback delegate over an explicit context stack, and a
|
|
non-boxing pending-head read; gate tightened to 1,536. The pooling
|
|
forced a class-wide staleness rework: captured-token-vs-fresh-lookup at
|
|
every reentrancy-spanning frame (26-site audit), hoisted stack locals
|
|
for retail's handle_all_collisions bits, token-gated bookkeeping
|
|
writes, and a deliberately identity-agnostic settle path (retail's
|
|
SetPositionInternal completes unconditionally even for displaced
|
|
operations).
|
|
**Residual floor (documented at the gate, decision deferred to the C3
|
|
activation gate where the user is in the loop):** ~520 B/op inside
|
|
Core's `PhysicsEngine.SetPosition` (transition init / query-footprint
|
|
materialization — a potential C2b if C3's connected profile shows it
|
|
matters) and ~208 B/op of sorted-tree node per pending receipt.
|
|
**Maintenance notes from review (no action):** the no-reentrancy
|
|
proofs on the 15 surviving reference-based currency checks are
|
|
comment-enforced; `IsCurrent(Operation)` remains available and a new
|
|
reentrancy-spanning call site would silently inherit the tautology —
|
|
its doc comment warns.
|
|
- **C3 — spawn-frequency cutover: routes 1 + 8.** Flip graphical AND
|
|
headless initial Create/login registration to
|
|
`RegisterEntityWithInitialResidence` + executor + placement receipts
|
|
together; `MaterializeProjection`/`BuildControllerAndCamera`/
|
|
`SynchronizeLocalPlayer` become projection + acknowledgement only;
|
|
presentation-only rebucketing (`RebucketLiveEntity` loses `CommitRebucket`).
|
|
Gates add the exact lifecycle/reconnect connected route.
|
|
- **C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the
|
|
`RuntimeWorldTransitState` → `RuntimePortalPlacementAuthority` adapter),
|
|
4 (remote Create/Position; delete `RemoteTeleportController`/`Placement`
|
|
and the inline MoveOrTeleport duplicate), 5 (projectile authoritative),
|
|
6 (drops + split-recovery marking), 7 (residual pickup/parent/delete
|
|
polish).** May land as more than one commit if a route proves large;
|
|
each sub-landing keeps the full review discipline.
|
|
- **C5 — legacy deletion + closeout gates.** Delete every superseded legacy
|
|
path; parity tests; exact lifecycle/reconnect + canonical nine-stop
|
|
connected routes; two-client observation; **user visual matrix** (the
|
|
campaign's stopping point for user acceptance). Retire AP-1, AD-1,
|
|
AP-131, AD-60's legacy half, and close #275. Update register/roadmap/
|
|
milestones/architecture/memory + successor handoff.
|
|
|
|
After C5: AP-22 (authored collision shapes), then AD-10 (remote
|
|
contact-plane projection), then the campaign's final matrix and ledger
|
|
closeout; vendor Slice 5 resumes.
|