fix(phys): #106 follow-up — legacy Resolve returns full prefixed cell ids (teleport bare-id wedge)

The #106 live gate run was sabotaged by a pre-existing bug the corrective
ACE teleport exposed: PhysicsEngine.Resolve (the legacy Phase-D resolve,
still used by the teleport-arrival snap at GameWindow.cs:4869 and the
player-mode-entry snap at :11295) returned BARE low-word cell ids on
every computed exit (ComputeOutdoorCellId, bestCell.CellId & 0xFFFF,
nextCellIndex, enterCellIndex). The teleport committed 0x0000013F into
PlayerMovementController.CellId, and a bare indoor id wedges the entire
membership chain:

- GetCellStruct(0x0000013F) misses (cells are keyed full-prefix) -> no
  indoor wall BSP -> walk through walls;
- the b3ce505 #98 gate reads "indoor primary" -> outdoor object radial
  sweep skipped -> NO object collision anywhere in the world;
- BuildCellSetAndPickContaining early-returns an unresolvable id forever
  (block 0x0000 is a real far-NW map block) -> membership frozen;
- render root never resolves -> interiors draw empty when stepping in.

Probe evidence: probe-cell-106-gate.log has exactly 2 [cell-transit]
lines for the whole session, both reason=teleport — the second one
(0xA9B3003C -> 0x0000013F) is the wedge. This is the L.2e "player CellId
tracked as bare low byte" finding (2026-05-12) finally biting; prefix
survival until now was a race artifact — Resolve only preserved the full
id when the landblock had not streamed in yet (passthrough exit), which
is why login snaps usually came out prefixed.

Fix: capture the matched landblock's key in Resolve's containment loop
and return lbPrefix | (targetCellId & 0xFFFF) on the computed exit —
the same full-32-bit convention Resolve's own doc comment states for
its inputs, and what both production callers (player snaps) require.
The passthrough exits (no landblock / step-reject) still return the
caller's id unchanged.

Tests: Resolve_IndoorStay_ReturnsFullPrefixedCellId (the teleport
shape, red pre-fix) + Resolve_OutdoorStay_ReturnsFullPrefixedCellId;
Resolve_LeaveIndoorCell_TransitionsToOutdoor's unmasked
`CellId < 0x100` assertion codified the bare behavior — now masked +
asserts the prefix. Full suite: 294+218+420 green; Core 1371 green +
the same 4 pre-existing door/#99-era failures + 1 skip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.Core.Tests/Physics/PhysicsEngineTests.cs

@@ -365,12 +365,65 @@ public class PhysicsEngineTests
             new Vector3(50f, 50f, 55f), cellId: 0x0100, delta: new Vector3(-20f, 0f, 0f),
             stepUpHeight: 10f);
 
-        // Should transition back to outdoor.
-        Assert.True(result.CellId < 0x0100u);
+        // Should transition back to outdoor. (#106 follow-up: masked compare —
+        // Resolve now returns FULL prefixed cell ids; the old unmasked
+        // `CellId < 0x0100` assertion codified the bare-low-word bug.)
+        Assert.True((result.CellId & 0xFFFFu) < 0x0100u);
+        Assert.Equal(0xA9B40000u, result.CellId & 0xFFFF0000u);
         Assert.Equal(50f, result.Position.Z, precision: 1);
         Assert.True(result.IsOnGround);
     }
 
+    /// <summary>
+    /// #106 follow-up (2026-06-09): the live boundary-walk gate was sabotaged by
+    /// the teleport-arrival snap (GameWindow.cs:4869) receiving a BARE indoor
+    /// cell id from Resolve (`0x0000013F`). A bare indoor id wedges the whole
+    /// membership chain: GetCellStruct misses (no wall BSP), the #98 gate reads
+    /// "indoor primary" and skips the outdoor object sweep (no collision with
+    /// anything), and FindCellSet can never re-resolve a malformed id. Resolve
+    /// MUST return the matched landblock's full 32-bit cell id on every
+    /// computed exit — the same convention its own inputs use.
+    /// </summary>
+    [Fact]
+    public void Resolve_IndoorStay_ReturnsFullPrefixedCellId()
+    {
+        var engine = new PhysicsEngine();
+        var terrain = new TerrainSurface(FlatHeightmap(50), LinearHeightTable());
+
+        var cellVerts = new Dictionary<ushort, Vector3>
+        {
+            [0] = new(40f, 40f, 55f),
+            [1] = new(60f, 40f, 55f),
+            [2] = new(60f, 60f, 55f),
+            [3] = new(40f, 60f, 55f),
+        };
+        var cellPolys = new List<List<short>> { new() { 0, 1, 2, 3 } };
+        var cell = new CellSurface(0x0100, cellVerts, cellPolys);
+
+        engine.AddLandblock(0xA9B4FFFFu, terrain, new[] { cell }, Array.Empty<PortalPlane>(),
+            worldOffsetX: 0f, worldOffsetY: 0f);
+
+        // The teleport shape: full indoor cell id in, zero delta (pure snap).
+        var result = engine.Resolve(
+            new Vector3(50f, 50f, 55f), cellId: 0xA9B40100u, delta: Vector3.Zero,
+            stepUpHeight: 5f);
+
+        Assert.Equal(0xA9B40100u, result.CellId);
+    }
+
+    [Fact]
+    public void Resolve_OutdoorStay_ReturnsFullPrefixedCellId()
+    {
+        var engine = MakeFlatEngine(terrainZ: 50f);
+
+        var result = engine.Resolve(
+            new Vector3(96f, 96f, 50f), cellId: 0xA9B40029u, delta: new Vector3(1f, 0f, 0f),
+            stepUpHeight: 2f);
+
+        // (97, 96) is over grid (4, 4) → low = 4*8+4+1 = 0x25, prefixed.
+        Assert.Equal(0xA9B40025u, result.CellId);
+    }
+
     [Fact]
     public void Resolve_NoSurfaceUnderEntity_NotOnGround()
     {