feat(runtime): C3c - production placement cutover: both hosts on the residence conductors (routes 1+8)

Campaign P remaining-physics-divergence, placement cutover slice C3c
(docs/plans/2026-08-02-placement-cutover.md). Both production hosts now
register every initial Create through the residence + continuation-
executor + first-entry-conductor machinery (C0-C3b):

- Graphical (route 1): RegisterEntityWithInitialResidence at Create; the
  shared RuntimeFirstEntryDriveController pumps both conductors from the
  placement-receipt flow; MaterializeProjection and RebucketLiveEntity
  are presentation-only while a residence is ACTIVE (ExecutorCompleted is
  the presentation-binding receipt); post-residence entities take the
  full legacy path including the prepare_to_enter_world clock edges.
  PlayerModeController attaches presentation to the Runtime-published
  controller; its legacy resolve/step-heights/host-construction path is
  deleted; presentation-only rollback (retail has no entry-flow rollback).
- Headless (route 8): OnSpawned registers with residence when a drive
  exists; content-less sessions keep the pre-flip direct registration;
  SynchronizeLocalPlayer/CreateController/ApplySetupStepHeights deleted;
  prepared-collision read failure is a typed AwaitingCollisionSource
  retry; far remotes outside the service window complete celless.
- RuntimeLocalPlayerMovementState.Controller setter sealed internal; all
  controller mutation flows through the publication lifecycle.

Fix slices landed within this cutover, each dual-gated:
- F1: live movement-stat/server-physics application routed through the
  Runtime ownership seam (post-logout ingest crash on the retired
  controller eliminated; RuntimeMovementSkillProjection deleted).
- F2: login activation wedge - collision-admission prefix gate factored
  out of the seal (reentrant-commit RejectedAuthority), rearm generation
  identity corrected, PlayerModeAutoEntry requires the Runtime-published
  controller (world reveal can no longer seal unmaterialized).
- F3: landblock-prefix 0-sentinel replaced by explicit absent-id guards;
  map-corner landblocks (grid row/col 0) fully legal through admission,
  park/rearm/retire, quiescence, and outdoor shadow seeds.
- F5: local-player first-entry ground contact seeded by the shared
  SpawnPlacementSettler (moved App->Core) at FinalizeActivation - the
  retail first-gravity-frame touch (enter_world 0x00516170 carries no
  seed); the legacy unconditional force-seed is overwritten by a real
  floor-found contact; airborne spawns stay airborne; outbound contact
  bit verified end-to-end. Fixes the standing-cast 'You can't do that
  while in the air!' rejections.
- R1 (dual-review round): login constraint leash armed at the committed
  placement (HandleReceivedPosition 0x00453FD0 analog); register rows
  AD-61 (settle-timing compression now covering the local player) and
  AD-42 (repointed off the deleted resolve split) in this commit;
  residence-conversion owner API; wire-landblock guards; drive-pending
  ledger in IsConverged; route attach/detach latch; executor-drain drift
  model documented + source-pinned.

Gates: Runtime 1,003, App 4,039/3 skips, Headless 79, complete solution
10,816/0 failed/4 skips (Release, -m:1); connected lifecycle/reconnect
gate PASS (logs/connected-world-gate-20260802-175401; graceful exits,
world-visible, zero airborne rejections). The nine-stop soak remains red
for the pre-existing 6b28ff99 whole-world collision-clone throughput
regression (attributed with evidence; scheduled as its own slice before
C5). Dual Opus reviews (retail-conformance + adversarial): delta PASS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Runtime/Physics/RuntimePhysicsState.cs

@@ -1987,9 +1987,13 @@ public sealed class RuntimePhysicsState : IDisposable
     {
         EnsureNotDisposed();
         EnsureCollisionMutationThread();
-        uint canonical = CanonicalLandblock(landblockId);
-        if (canonical == 0u)
+        // C3c-F3: the old `canonical == 0u` check was dead (CanonicalLandblock
+        // ORs in 0xFFFF, so it never returns 0) — the real absent-id guard is
+        // on the raw input. Landblock (0,0) canonicalizes to 0x0000FFFF and
+        // is fully legal here.
+        if (landblockId == 0u)
             throw new ArgumentOutOfRangeException(nameof(landblockId));
+        uint canonical = CanonicalLandblock(landblockId);
         return SetPosition.BeginCollisionPrefixQuiescence(
             canonical,
             collisionGeneration,
@@ -2034,6 +2038,13 @@ public sealed class RuntimePhysicsState : IDisposable
     {
         EnsureNotDisposed();
         EnsureCollisionMutationThread();
+        // C3c-F3: an absent landblock id (0) canonicalizes to 0x0000FFFF —
+        // the REAL map-corner landblock — so it must be rejected at the
+        // admission entrance. The prefix-0 sentinel used to (accidentally,
+        // and only at commit time) catch this caller bug; with prefix
+        // 0x00000000 now legal, the explicit guard is the only protection.
+        if (landblockId == 0u)
+            throw new ArgumentOutOfRangeException(nameof(landblockId));
         uint canonical = CanonicalLandblock(landblockId);
         if (_collisionPrefixMutations.ContainsKey(canonical))
         {
@@ -2622,9 +2633,13 @@ public sealed class RuntimePhysicsState : IDisposable
     {
         EnsureNotDisposed();
         EnsureCollisionMutationThread();
-        uint canonical = CanonicalLandblock(landblockId);
-        if (canonical == 0u)
+        // C3c-F3: absent-id guard on the raw input — the old
+        // `canonical == 0u` test was dead (CanonicalLandblock never returns
+        // 0), and the corner landblock (canonical 0x0000FFFF) retires like
+        // any other.
+        if (landblockId == 0u)
             throw new ArgumentOutOfRangeException(nameof(landblockId));
+        uint canonical = CanonicalLandblock(landblockId);
         if (kind is RuntimeCollisionPrefixMutationKind.Activation)
             throw new ArgumentOutOfRangeException(nameof(kind));
 
@@ -2944,6 +2959,27 @@ public sealed class RuntimePhysicsState : IDisposable
             : 1UL;
     }
 
+    /// <summary>
+    /// True when a collision evaluation may read this cell's landblock right
+    /// now — no admission is in flight for it and its prefix is not quiescing.
+    /// <see cref="TrySealCollisionEvaluationAuthority"/> enforces exactly this
+    /// per queried prefix, so any owner that is about to DEPEND on a
+    /// successful seal must consult the same predicate first. C3c-F2: the
+    /// dormant local-player activation rearm did not, so a collision-generation
+    /// commit that reentered the first-entry pump before its own admission
+    /// retired rearmed the parked lease out of AwaitingCell, immediately failed
+    /// this seal, and — no longer being AwaitingCell — was reported as
+    /// RejectedAuthority (terminal) instead of "still waiting". That dropped
+    /// the login conductor for the whole session.
+    /// </summary>
+    internal bool IsCollisionEvaluationPrefixAdmissible(uint exactCellId)
+    {
+        uint landblockId = CanonicalLandblock(exactCellId);
+        return landblockId != 0u
+            && !_collisionAdmissions.ContainsKey(landblockId)
+            && !SetPosition.IsCollisionPrefixQuiescing(landblockId);
+    }
+
     /// <summary>
     /// Exact collision-prefix generation authority used by private
     /// SetPosition evaluations. Beginning a replacement generation advances
@@ -3021,8 +3057,7 @@ public sealed class RuntimePhysicsState : IDisposable
         }
         foreach (uint prefix in prefixes)
         {
-            if (_collisionAdmissions.ContainsKey(prefix)
-                || SetPosition.IsCollisionPrefixQuiescing(prefix))
+            if (!IsCollisionEvaluationPrefixAdmissible(prefix))
                 return false;
         }