acdream/docs/research/2026-08-02-c3c-cutover-closeout.md

C3c production placement cutover — closeout (2026-08-02)

Behavior commit: 529e0e9d (68 files, +5,979/−833, register rows AD-61 + AD-42 refresh in-commit). Plan: 2026-08-02-placement-cutover.md. Session evidence trail: the campaign scratchpad's implementer-progress.md sections Continuation 1-4, C3c-F1..C3c-F5, C3c-R1 (not committed; summarized here).

What shipped

Both production hosts (graphical + headless) register every initial wire Create through the C0-C3b residence/executor/conductor machinery. One shared RuntimeFirstEntryDriveController pumps the local-player and remote conductors from the placement-receipt flow (per-frame graphical, per-tick headless). MaterializeProjection/RebucketLiveEntity are presentation-only strictly while the initial-create residence is ACTIVE (exact-token check; ExecutorCompleted is the presentation-binding receipt); post-residence entities take the full legacy path including retail's prepare_to_enter_world (0x00511FA0) clock rebase. RuntimeLocalPlayerMovementState.Controller's setter is sealed; every controller mutation flows through the publication lifecycle. Content-less headless sessions (validated-legal config) keep the pre-flip direct registration until C4/C5 revisit.

The five fix slices (each connected-gated inside the cutover)

• F1 — live movement-stat + server-physics application moved behind Runtime ownership (RuntimeMovementStatsApplication, ApplyServerPhysicsState); the post-logout ingest crash on the retired controller is eliminated; RuntimeMovementSkillProjection deleted.
• F2 — the login activation wedge (world never revealed): the collision-admission prefix gate factored out of the seal (reentrant commit could yield terminal RejectedAuthority), the rearm's generation identity corrected (parked G vs post-retirement G+1), and PlayerModeAutoEntry now requires the Runtime-published controller (IsPlayerControllerReady was a constant true — one early attempt permanently sealed the reveal).
• F3 — landblock-prefix 0-sentinel replaced by explicit absent-id representation; map-corner landblocks (grid row/col 0, e.g. 0x0000FFFF) are legal through admission, park/rearm/retire, quiescence, and outdoor shadow seeds.
• F4 — diagnosis only: the nine-stop soak's convergence failure (pendingPublications=1, farBacklog nonzero, landblock/mesh dimensions) is pre-existing 6b28ff99 (2026-07-31, "make collision activation starvation-free"): every far publication clones the complete collision world (median ~19.7k leaves / 3.64 ms), so the queue drains ~10 landblocks/s and never catches its window. Fix requires an O(changed) clone (structural sharing or per-landblock atomic unit) — a semantics change to that slice's asserted one-leaf-per-step invariant; scheduled as its own slice BEFORE C5 (whose gate matrix includes the soak).
• F5 — local-player first-entry ground contact: retail seeds contact from the first gravity frame's transition touch (enter_world 0x00516170 carries no seed; local player and remotes share the mechanism via HandleCreateObject 0x00454C80). The shared SpawnPlacementSettler (moved App→Core) runs at FinalizeActivation exactly once; genuinely airborne spawns stay airborne; the outbound contact bit chain is asserted end-to-end. The legacy path's unconditional Contact|OnWalkable|Active force-seed (non-retail, no plane) still runs during candidate preparation and is OVERWRITTEN by the faithful settle (register AD-61). Fixes the user-observed standing-cast "You can't do that while in the air!" rejections.

Review round R1 (dual Opus: initial FAIL 2+2 MAJOR → delta PASS both)

Retail MAJORs: the login constraint leash (deleted with the legacy resolve path; re-armed at the committed placement in FinalizeActivation — HandleReceivedPosition 0x00453FD0 arms on every accepted position) and the post-residence rebucket scope (fixed to exact-token active-residence). Adversarial MAJORs: content-less headless (no drive → legacy registration) and the register rows. Nine minors fixed (owner conversion API with active-residence throw, wire-landblock guards, drive-pending ledger in IsConverged, route attach/detach latch, celless conversion for far headless remotes, doc-comment truth, per-incarnation cylinder cache, executor-drain drift model documented + source-pinned); two tracked (#276, #277 in ISSUES).

Final gates

Runtime 1,003; App 4,039/3 skips; Headless 79; complete solution 10,816 / 0 failed / 4 skips (Release, -m:1). Connected lifecycle/reconnect gate PASS (connected-world-gate-20260802-175401; graceful exits, world-visible, zero airborne-rejection strings; run -174811 failed on user-interference fingerprint — activeTeleportCount=1 at the stable checkpoint — and is attributed, not counted). The soak stays red for the pre-existing F4 attribution.

Process lessons (carried to memory)

1. Report artifacts over marker logs — three wrong classifications this campaign came from reading route/marker logs instead of report.json (the soak "clean route" was Passed=false with 37 convergence failures).
2. Log lifetime before absence claims — a 26-second, 67-line log's silence about a defect proves nothing (the 122749 misread inverted a root-cause classification twice).
3. User observation is the cheapest gate — the standing-cast airborne rejections and the black-screen reveal were both user-spotted minutes before harness detection.
4. The seal finds the bypasses — sealing the controller setter surfaced a runtime-mutation bypass (F1) the compile-break audit could not see; expect the same class when sealing any long-lived escape hatch.