fix(phys): #106 follow-up — legacy Resolve returns full prefixed cell ids (teleport bare-id wedge)

The #106 live gate run was sabotaged by a pre-existing bug the corrective
ACE teleport exposed: PhysicsEngine.Resolve (the legacy Phase-D resolve,
still used by the teleport-arrival snap at GameWindow.cs:4869 and the
player-mode-entry snap at :11295) returned BARE low-word cell ids on
every computed exit (ComputeOutdoorCellId, bestCell.CellId & 0xFFFF,
nextCellIndex, enterCellIndex). The teleport committed 0x0000013F into
PlayerMovementController.CellId, and a bare indoor id wedges the entire
membership chain:

- GetCellStruct(0x0000013F) misses (cells are keyed full-prefix) -> no
  indoor wall BSP -> walk through walls;
- the b3ce505 #98 gate reads "indoor primary" -> outdoor object radial
  sweep skipped -> NO object collision anywhere in the world;
- BuildCellSetAndPickContaining early-returns an unresolvable id forever
  (block 0x0000 is a real far-NW map block) -> membership frozen;
- render root never resolves -> interiors draw empty when stepping in.

Probe evidence: probe-cell-106-gate.log has exactly 2 [cell-transit]
lines for the whole session, both reason=teleport — the second one
(0xA9B3003C -> 0x0000013F) is the wedge. This is the L.2e "player CellId
tracked as bare low byte" finding (2026-05-12) finally biting; prefix
survival until now was a race artifact — Resolve only preserved the full
id when the landblock had not streamed in yet (passthrough exit), which
is why login snaps usually came out prefixed.

Fix: capture the matched landblock's key in Resolve's containment loop
and return lbPrefix | (targetCellId & 0xFFFF) on the computed exit —
the same full-32-bit convention Resolve's own doc comment states for
its inputs, and what both production callers (player snaps) require.
The passthrough exits (no landblock / step-reject) still return the
caller's id unchanged.

Tests: Resolve_IndoorStay_ReturnsFullPrefixedCellId (the teleport
shape, red pre-fix) + Resolve_OutdoorStay_ReturnsFullPrefixedCellId;
Resolve_LeaveIndoorCell_TransitionsToOutdoor's unmasked
`CellId < 0x100` assertion codified the bare behavior — now masked +
asserts the prefix. Full suite: 294+218+420 green; Core 1371 green +
the same 4 pre-existing door/#99-era failures + 1 skip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ISSUES.md

@@ -66,6 +66,20 @@ geometry goldens (0xA9B40031 → 0xA9B30038/0xA9B30034) and a non-anchor-frame
 northbound return. Pseudocode + decomp-artifact notes:
 `docs/research/2026-06-09-landdefs-outside-cells-pseudocode.md`.
 
+**Gate attempt 1 (2026-06-09):** outside-looking-in correct + running distortion gone,
+but the walk was sabotaged by a PRE-EXISTING bug the corrective ACE teleport exposed:
+the teleport-arrival snap (`GameWindow.cs:4869`) committed a BARE indoor cell id
+(`0x0000013F`) from the legacy `PhysicsEngine.Resolve`, which returned low-word-only
+cell ids on every computed exit (the L.2e bare-low-byte finding from 2026-05-12).
+A bare indoor id wedges the chain: no wall BSP (`GetCellStruct` miss), the #98
+`b3ce505` gate reads "indoor primary" and skips the outdoor object sweep (NO object
+collision anywhere), and the pick can never re-resolve a malformed id (probe log:
+2 `[cell-transit]` lines all session, both teleports). Follow-up fix: `Resolve` now
+returns the matched landblock's full prefixed id on every computed exit; the
+unmasked `CellId < 0x100` test assertion that codified the bare behavior fixed.
+Prefix survival before this was a race artifact — `Resolve` only preserved the full
+id when the landblock wasn't streamed in yet (passthrough exit).
+
 **Description:** Walking outdoors across a landblock boundary does NOT update the player's
 outdoor cell: `playerCell` stays pinned to the last cell of the previous landblock,
 indefinitely. Every downstream consumer degrades: entering any building in the new landblock