fix(physics): port ordered part-array building transit

docs/architecture/acdream-architecture.md

@@ -1143,12 +1143,20 @@ composition/pass facades. The superseded `PortalVisibilityBuilder`,
 OVERHAUL S5-c5; production has one visibility graph and one walk owner.
 **Campaign OVERHAUL S2 (chunks 1-5, closed 2026-09-03) gave render
 and physics cross-cell membership one canonical owner:**
-`ShadowObjectRegistry` computes retail's exact CELLARRAY
+`ShadowObjectRegistry` computes the retail CELLARRAY (with the source and
+boundary residuals tracked in AD-117/AP-159)
 (`calc_cross_cells_static`/`add_shadows_to_cells`, Contract A/B) once per
 registration/move transaction and retains it both as collision rows
 (`GetOwnerCells`) and per-cell `RetailPartEntry` render rows
 (`GetRetailPartEntriesInCell`) — one flood drives both, never two
-independent ones. The equipped-child controller publishes every DAT-resolved
+independent ones. The part-array outdoor building bridge uses the distinct
+retail reciprocal-plane sphere/box and destination-containment gates, then
+immediately expands each admitted destination using the complete part array
+before the next building portal, even for a duplicate destination. It shares
+the existing growing worklist and outside latch; ordinary sphere/player
+building transit remains separate. Positive malformed reciprocal indices
+fail at the managed content-integrity boundary (AP-159), not a second owner.
+The equipped-child controller publishes every DAT-resolved
 effective Setup part (after `AnimPartChanged`) through the same strict
 prepared-collision publisher used by ordinary live hydration before it calls
 `AttachChild`; children still inherit the parent's CELLARRAY and acquire only

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -952,6 +952,19 @@ source approximation remains open. Verification in
 part-array building bridge and immediate transit ordering, ordinary sphere
 callers unchanged. No geometry fix or C1a/G4 PASS yet; FPS deferred.
 
+**C1a/AP159 production bridge review-closed (packet§67):** distinct building
+part-array box/containment gates and immediate full-array transit now replace
+only the wrong sphere-only caller. Focused52/52, ordering omission mutation
+fails as intended, exact restoration52/52; six Release builds0W0E. Two
+explicit test-fixture corrections, no production repair after its first patch;
+narrow independent retail/ordering and production/coverage PASS. AP159 narrows
+in this implementation commit and records the malformed-positive-reciprocal
+InvalidDataException adaptation. Its two boundary ties and AD117 remain.
+Next: integrate the original nonempty-shell-guarded witness, establish actual
+three-cell/21-entry installed membership and deterministic product, then the
+remaining final gates. No original golden relaxed, no known retail leak/FPS
+change, no C1a/G4 pass yet. Evidence: `c1a-building-bridge-verification.md`.
+
 ## 14. Risk register (condensed)
 
 - **R1 second scene graph.** Graph records own only topology/membership facts;

docs/research/2026-09-01-overhaul/c1a-building-bridge-verification.md

@@ -0,0 +1,98 @@
+# C1a / AP159 part-array building bridge verification
+
+2026-09-05, campaign base4e4e8e825. Implementation contract:
+`c1a-building-bridge-repair-contract.md`. This is the separate production
+repair supported by the preserved red authored-input diagnostic, not a
+third fix to that diagnostic. No known retail cathedral leak, drawing-sphere
+source, shared epsilon predicate, ordinary player sphere route or FPS change.
+
+## Candidate and discriminating evidence
+
+One new private helper in CellTransit and one changed caller in
+BuildShadowCellSetFromParts. Ordered building portals resolve loaded
+destinations and their reciprocal planes through existing graph/prepared
+access. The supplied matching parts use the inclusive building sphere-side
+gate, reciprocal CROSSING-or-SAME box gate and destination containment.
+An admitted destination receives immediate complete-array indoor transit
+even if its candidate ID already existed; the existing outer walk and
+outside-expansion latch remain the only traversal owners.
+
+The positive out-of-range reciprocal guard throws InvalidDataException only
+after existing negative/unavailable/rootless skips. That is the explicitly
+authorized managed corruption policy, not native trusted-metadata behavior;
+it must remain recorded with AP159 in the production commit.
+
+Lead independently read the complete source/test delta, the recovered
+named/paired native contract, and raw test outputs. Paired executable SHA
+006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1.
+The key bridge is006B52A0→0052C680, not sphere0052C5D0; immediate append/call
+0052C802/0052C812 resolves virtual+7C to0052CAE0. Predicate and raw authored
+evidence are retained in `c1a-bridge-native-contract.md` and
+`c1a-authored-input-diagnostic-verification.md`.
+
+Candidate production SHA256:
+B4AFA5FE2654E8AEA2961E2008DC253F368D153180B73B2D1D4A7B5003040591.
+Candidate Core test SHA256:
+EC835A9865DDD6CBFC046EF5B3C02739395348336888C445655E5AC94DDF4EAA.
+Ordinary CheckBuildingTransit overloads and existing tests are unchanged.
+
+Artifacts: `artifacts/s5-c1a-building-parts-20260905-r1/` in the campaign
+worktree. Lead independently parsed these TRX counters:
+
+| Run | Passed / failed / skipped | Meaning |
+|---|---|---|
+| pre-fix |12/15/0|Original production; includes one incorrect outside-origin fixture.|
+| pre-fix-validated |13/14/0|Corrected fixture; original production still fails bridge/ordering/side/guard checks.|
+| fixed-affected |51/1/0|Production repair; one cheap-equality fixture also reached the separately registered WhichSide tie.|
+| fixed-isolated-affected |52/0/0|Both cheap equalities and adjacent representable rejects now isolated from that unchanged tie.|
+| ordering-mutation |0/1/0|Omitting only immediate transit produces A,B,C rather than expected A,C,B.|
+| restored-affected |52/0/0|Exact production restoration, same source hash, final affected lane PASS.|
+
+The two harness corrections are explicit and exhausted: move the test part
+origin itself to the outside-cell boundary while retaining a local box;
+then place the cheap-equality point-box strictly within the existing epsilon
+band, at the supplied float-stored sphere's nearest point. Sphere centers
+remain exactly at both signed padded-radius limits, and adjacent
+representable outside values still reject. No production correction was
+needed after its first patch. Any further unexpected source/test failure
+returns a finding rather than another hidden correction.
+
+The27 new cases cover graph and prepared containment, decoy polygon ID7 at
+index0 versus reciprocal ID42 at index1, both sides and opposite box reject,
+both cheap equalities, later-part admission, complete-array immediate
+expansion, duplicates/shared outside latch, first-hit break, malformed
+reciprocals, empty/unloaded/rootless guards. The25 existing sphere, indoor-box
+and registration cases remain in the affected lane. The ordering mutation
+was a deliberate discriminator, not an unexpected failure or fix round.
+
+## Frozen return and narrow review
+
+Implementer returned execution ownership with no live build/test handle.
+All six Release builds exit0,0W0E. Lead independently checked final TRX52/52,
+zero skipped, and exact restored production/test hashes above. Independent
+retail/ordering and production/coverage review returned PASS with no findings;
+reviewer re-read named bodies and rehashed paired executable/windows. Its
+return preceded the last restored test; lead separately verified that final
+result. Two absent-private-helper failures in the pre-fix baseline are
+structural only; separate public-entry geometry/order failures establish the
+behavioral discrepancy. No further source/test correction followed the two
+explicit harness corrections.
+
+| Sealed artifact | SHA256 |
+|---|---|
+|pre-fix-validated.trx|FED5D47A793D35BF8C13408AFD5A5941C2BD7ADE5237A2824334F636EF5ADDF2|
+|ordering-mutation.trx|913A96897126B6EDDD55A063838BC24A9E8DDF14084A292667F1D37FF4AB37E4|
+|restored-build.log|09E89BFCEBCDF0AA181076C4B20A94D39D7BA2781788B2506D6E3F4A62F405F4|
+|restored-affected.trx|8A4E12C61C45FB4F4A000EC1B13A3D9E8C575D9C7E67AF05DE5708DAADEF97F1|
+
+AP159's building clause is narrowed and its managed corruption guard recorded
+in the same implementation commit; both boundary ties and AD117 remain open.
+Architecture retains one canonical membership owner. No full-suite or
+installed-DAT membership result is claimed here yet. The separate original
+geometry witness retains the three-cell/21-entry assertions and unpinned
+placeholder; its later execution needs the explicit lead release.
+
+Clients/debugger were absent and ACE UDP9000/PID13340 present at the lead's
+20:24 precheck. No graphical launch belongs to this chunk. G4 remains
+unpassed; real installed membership, final lifecycle/stability and owner
+acceptance remain required. No main merge.

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -5216,3 +5216,30 @@ Exact inputs, raw hashes, all edges and limits:
 `c1a-authored-input-diagnostic-verification.md`. No production geometry or
 graphical gate changed; clients/debugger absent, ACE up. C1a/G4 unpassed,
 known retail leakage unchanged, FPS deferred, no main merge.
+
+## 67. C1a/AP159 distinct building bridge review-closed — 2026-09-05
+
+The separately bounded production repair replaces only the part-array
+outdoor caller's sphere helper. Reciprocal-side inclusive sphere, authored
+box and destination containment gates now precede immediate complete-array
+destination transit, including duplicates, before the next building portal.
+Existing sphere/player overloads, indoor ties, shared primitives, residency
+and single registry ownership remain unchanged. AP159's building clause is
+narrowed in the same commit; its positive malformed-reciprocal integrity guard
+is explicitly recorded as a managed adaptation, not native trusted metadata.
+
+Original production gives13/14 on the corrected27-case baseline; the fixed
+affected lane52/52 passes. One deliberate immediate-transit omission fails
+expected A,C,B versus actual A,B,C. Exact restored source and final52/52
+confirmed by lead; all six Release builds0W0E. Two test-harness corrections
+are preserved and documented, not hidden green retries. Independent narrow
+retail/ordering and production/coverage review PASS, no source/test findings.
+Full evidence and hashes: `c1a-building-bridge-verification.md`.
+
+This closes the bridge repair's focused review, not the actual installed
+geometry witness or G4. AD117 and both AP159 boundary ties remain open.
+The original witness's three-cell/21-entry assertions and placeholder remain;
+only a nonempty actual F4180104 mesh guard was prepared under its separate
+write-only contract. Lead owns its explicit capture/mutation release and
+final campaign gates. No client launch, known retail leakage/FPS change or
+main merge in this chunk.