X-20 is answered, and the player could not be built to answer it

[Nghaiz]

Two things the ledger was waiting on, and one that had to be cleared first.

X-20 — the collider name decides nothing, because nothing was blocked

The row said the collider NAME would separate the two readings: terrain or a building means real
cover, the victim's own body means the -2049 mask reading. It is neither.

artifacts/lane-b/x20-occlusion-01, spawn pinned to slot 0, 3 of 3 clients exit 0, 7 of 7
checkpoints each:

240 trigger frames, every one   occlusionHit[none-this-shot]
occluded=0  presentFallbacks=0  resolved=6  hits=0
victim (OBS-A, actor 42) on 100 health at all 7 checkpoints

none-this-shot is the freshness path added by #180, not a default — the instrument worked and
reported that the thing it was built to describe did not happen. Both readings die for this
run rather than one winning, and this does not retroactively settle the baseline: x19-fixed-04
held at 10.1 m unpinned, this run stands at 4.7 m pinned. Different geometry, so the question is
retired, not won.

What the run exposed instead. Everything upstream is now correct, and the artifact says so
rather than assuming it — present.torso == frame.torso to seven digits, frame.tick == wanted.tick, aim.resolved on actor 42 at 4.65 m, nothing in the way. The shot still misses.
HitboxSet.FromSize stops torso and arms at 1.550 and starts the head at 1.580, so nothing
covers 1.550..1.580 — a 3 cm seam across a standing body. A ray through it returns Miss
before the occlusion test runs, which is exactly why occluded stays 0. The logged ray arrives
1.5684 m above the target's feet: inside the seam.

The limit of that claim, stated rather than buried. The seam is a fact of the source. That
this ray threaded it is arithmetic over a log line whose aim is rounded to two decimals, and
±0.005 in y is ±0.024 m at 4.74 m — wider than the seam itself. Consistent, not proven. The next
measurement is one line in LagCompensator.Resolve, which already loops all four boxes: on a
miss, record the nearest box and its signed miss distance instead of discarding them. Nothing
should be fixed before it exists.

Filed rather than fixed, per phase-3 §6 — X-24 (the seam; a game defect, a human aiming at
chest-to-chin height gets the same nothing) and X-25 (the aim point; ScriptedTargetSolver
raises both endpoints by EYE_HEIGHT, landing 0.02 m inside the head box's edge instead of centre
of mass — which is why no lane-B combat run has ever scored a hit).

The blocker: no Unity player could be built at all

com.ivanmurzak.unity.mcp 0.90.0 and its ten extension packages (#175) installed McpPlugin.dll
and McpPlugin.Common.dll with defineConstraints: [], while every other DLL of the same closure
— R3, ReflectorNet, SignalR, Microsoft.CodeAnalysis — carried - UNITY_EDITOR. McpPlugin.dll
references R3, so the player included the first, excluded the second, and UnityLinker died naming
R3 — the file that is correct — and never naming McpPlugin.dll, the file that is wrong.

Two .meta lines fix it: same tree, same command, Failure → Success.

This was never only a compile problem. defineConstraints are evaluated per target and
UNITY_EDITOR is false in every player, so the shipping Linux dedicated server was equally
unbuildable — and a build that had linked would have carried an HTTP bridge hosting Roslyn
into the game server image, the exact thing EditorBuild.StripEditorOnlyDefines exists to prevent.

Nothing in CI could see it: no job builds a Unity player, images.yml downloads a pre-built Linux
artifact from a release, and build-test is dotnet build over the pure-.NET libraries, which
never reads Assets/Plugins. Four days, unnoticed. And these .meta files are generated by the
MCP package's own NuGet installer, so the next upgrade would have silently undone a hand-fix.

So the fix ships with a gate. tools/check-plugin-define-constraints.ps1 reads the bridge's
package list from .nuget-installed.json rather than hardcoding DLL names, so a fourth bridge DLL
is covered the day it lands. Mutation-proved — reverting McpPlugin.dll.meta turns it red
naming that exact file; restoring it turns it green.

A first version of that gate is recorded in the report because it was wrong in a useful way: it
walked assembly references and reported 22 violations against a tree whose build succeeds. The
BCL shims in that folder reference each other, and in a player those names resolve against Unity's
own netstandard2.1 profile rather than the excluded plugin copies. Telling a real break from a
backfilled shim needs the Editor's playback-engine assembly set, which CI does not have. That gate
would have blocked every PR on its first day. The shipped one answers the narrower question
truthfully and says in its header which question it declines.

Branch protection — require-status-check is on

The page declined to require build-test because build-test was red, and it stayed red
because nothing required anyone to look. X-23 (#178) and #181 cleared that, so the condition the
page set for itself was met.

Done in §1's order, each step checked: red fixed → build-test watched green once on develop at
76734c5 → the two check names read back from GET /commits/{sha}/check-runs rather than copied
off the page → ci.yml confirmed to run on pull_request with no workflow-level paths: filter,
the deadlock that page warns about twice. Added to the existing protect-shared-branches ruleset;
verified afterwards by asking which rules apply to each ref rather than trusting the PUT.

Two consequences recorded before they surprise anyone: a direct push to main or develop is
now refused, and with no bypass actor a CI outage blocks merging entirely (§1's deliberate
choice). Required approvals stay off — GitHub forbids approving your own PR, so on a
single-owner repository that would deadlock every merge; §2's one-approval row was written for the
four-person team.

This PR is the first thing the new rule applies to, which is also the first honest test of it.

Verification

lane-B run	3/3 clients exit 0, 7/7 checkpoints, programme complete
Windows player build	Build Finished, Result: Success (was Failure on the same tree)
check-plugin-define-constraints.ps1	PASS; mutation → RED naming McpPlugin.dll
check-unity-meta.ps1	PASS, 1872 assets / 1944 .meta
Seeds	UnityEngine.Random=20260821, NetworkSimulator=off/12345

No C# changed, so the test suite is untouched by this PR.