acdream/docs/plans/2026-08-02-placement-cutover.md

Placement production cutover — campaign plan (2026-08-02)

The final leg of the remaining physics-divergence campaign before AP-22 and AD-10: route graphical AND headless production placement through the residence + continuation-executor owner (38fd4b8d / 30012361 / 5db3de3c), delete the legacy duplicate authorities, and retire AP-1/AD-1 behind connected + user-visual gates.

Inputs (read in order):

1. 2026-08-02-runtime-continuation-executor-handoff.md — the completed dormant mechanism and its cutover notes.
2. 2026-08-02-cutover-route-inventory.md — the full 8-route, both-host call-chain inventory with exact file:line for every duplicate authority to remove. THE map for all slices below.
3. 2026-07-31-remaining-physics-campaign-handoff.md — the original per-route requirements and prerequisite definitions.

Standing discipline per slice: pinned contract → single implementer → independent retail-conformance + architecture/adversarial reviews (both must PASS on the final diff) → focused + complete Runtime + Release build + complete solution gates → bisectable behavior commit (register rows in the same commit) → docs/handoff commit. No workarounds; no fused slices.

Confirmed pre-cutover gaps (from the inventory)

• The executor publishes only generic entity deltas; nothing bridges its completion to RuntimePlacementProjectionChannel, so no host can learn "my initial placement committed" through the built observer seam.
• No atomic controller/body publication owner exists (prerequisite C); App and headless hand-write divergent PlayerMovementController construction, and SubmitPreparedPlacement requires a canonical PhysicsBody that nothing currently publishes atomically.
• The dormant placement path's 1,880 B/operation (2,048 cap) allocation remains the activation blocker for frame-frequency routes.
• Execute's live inputs (UsePositionFromServer, PlayerDistance) are computed by no host; they must derive from Runtime's own character-option and local-player owners.
• RuntimePortalPlacementAuthority has zero producing call sites; the adapter from RuntimeWorldTransitState does not exist.
• The exact-Setup mover chain (PrepareMover / RuntimeSetPositionMoverPreparer.TryBuild / IPreparedCollisionSource.ReadSetupCollision) exists piecewise, unwired.
• Route-6 split-recovery creates need an effect-replay suppression signal; route-7 needs TryCommitParent/CommitWithdrawal cancellation-symmetry fixes and host-visible cancellation receipts; headless lacks any parent-realize sequence (pre-existing, adjacent).

Slices

• C0 — Runtime bridge + live inputs — COMPLETE at 67f63e85 (2026-08-02, dual reviews PASS). The executor publishes an acknowledge-only ExecutorCompleted receipt through the one placement stream (registered before dispatch; correlation reaped on acknowledgement/discard/clear; PendingCompletionReceiptCount in IsConverged); all three production sinks acknowledge-and-ignore the kind via early returns proven behavior-preserving for every other kind (sanctioned seam completion — provably inert, no production publisher); UsePositionFromServer derives retail-exactly from RuntimeCharacterState.AutonomyLevel != 2 and PlayerDistance from the live movement controller with null-safe fallback to the caller struct; TryPrepareAndSubmitAuthoredPlacement chains the prepared-collision Setup read through PrepareMover to submission with zero validation changes; TryCommitParent/CommitWithdrawal gained the sibling cancellation flow (the LeaveWorld omission in TryCommitParent is retail-REQUIRED per set_parent 0x00515A90:283832-283833's single gated leave_world). Not fully dormant by design: the two cancellation fixes change live Runtime paths production already calls; everything else has no production caller. C3 prerequisites recorded from C0's reviews: (a) the completion receipt/trace surface is internal-only — C3 must define the public host consumption shape when it wires the hosts; (b) PlayerDistance is resolved once per Execute entry, not per continuation — a multi-Position FIFO classifies later entries against entry-time distance (documented deferral; refine at C3/C4 if the connected gates show it matters); (c) any future host exposure of TrySetAutonomyLevel must carry retail's SendAutonomyLevelEvent (699550).
• C1 — atomic controller/body publication — SATISFIED BY EXISTING MECHANISM (research finding 2026-08-02, plan amended same session). RuntimeLocalPlayerPhysicsPublicationState (1,033 lines) plus the ~15-method dormant local-activation family on RuntimeSetPositionState already implement the full sanctioned option-2 transaction: off-canonical preparation against a scratch quantum clock and a sealed candidate controller, one validated atomic Commit, and a staged Evaluate/Commit/FinalizeActivation chain re-validated against PhysicsOwnershipEpoch/ObjectClockEpoch/ControllerOwnershipEpoch/session identity at every entry — with zero production callers. See 2026-08-02-canonical-body-writer-map.md (6 canonical body writers; the two host escape hatches; both hosts' divergences). The remaining work — routing both hosts' local-player construction through the publication lifecycle, sealing the public RuntimeLocalPlayerMovementState.Controller setter, retiring App's direct object-clock bypasses, and containing headless's uncaught prepared-collision InvalidDataException — IS the C3 route-1 flip and moves there. No separate C1 commit.
• C2 — placement allocation budget — COMPLETE at 63c601ff (2026-08-02, dual reviews PASS after two fix rounds). 2,032 → 944 B/op via pooled operation envelopes (bounded, reset-at-rent, double- retire guarded, reset/dispose-cleared, ledger-visible), a cached collision-callback delegate over an explicit context stack, and a non-boxing pending-head read; gate tightened to 1,536. The pooling forced a class-wide staleness rework: captured-token-vs-fresh-lookup at every reentrancy-spanning frame (26-site audit), hoisted stack locals for retail's handle_all_collisions bits, token-gated bookkeeping writes, and a deliberately identity-agnostic settle path (retail's SetPositionInternal completes unconditionally even for displaced operations). Residual floor (documented at the gate, decision deferred to the C3 activation gate where the user is in the loop): ~520 B/op inside Core's PhysicsEngine.SetPosition (transition init / query-footprint materialization — a potential C2b if C3's connected profile shows it matters) and ~208 B/op of sorted-tree node per pending receipt. Maintenance notes from review (no action): the no-reentrancy proofs on the 15 surviving reference-based currency checks are comment-enforced; IsCurrent(Operation) remains available and a new reentrancy-spanning call site would silently inherit the tautology — its doc comment warns.
• C3 — spawn-frequency cutover: routes 1 + 8. Flip graphical AND headless initial Create/login registration to RegisterEntityWithInitialResidence + executor + placement receipts together; MaterializeProjection/BuildControllerAndCamera/ SynchronizeLocalPlayer become projection + acknowledgement only; presentation-only rebucketing (RebucketLiveEntity loses CommitRebucket). Gates add the exact lifecycle/reconnect connected route.
• C4 — remaining routes: 2 (ForcePosition), 3 (portal, with the RuntimeWorldTransitState → RuntimePortalPlacementAuthority adapter), 4 (remote Create/Position; delete RemoteTeleportController/Placement and the inline MoveOrTeleport duplicate), 5 (projectile authoritative), 6 (drops + split-recovery marking), 7 (residual pickup/parent/delete polish). May land as more than one commit if a route proves large; each sub-landing keeps the full review discipline.
• C5 — legacy deletion + closeout gates. Delete every superseded legacy path; parity tests; exact lifecycle/reconnect + canonical nine-stop connected routes; two-client observation; user visual matrix (the campaign's stopping point for user acceptance). Retire AP-1, AD-1, AP-131, AD-60's legacy half, and close #275. Update register/roadmap/ milestones/architecture/memory + successor handoff.

After C5: AP-22 (authored collision shapes), then AD-10 (remote contact-plane projection), then the campaign's final matrix and ledger closeout; vendor Slice 5 resumes.