fix(physics): AP-129 review fix - port CanMoveInto/IsAllowedIn, stop failing closed

Campaign P Slice P4 Opus review verdict: FIX-FIRST. RestrictionObjPrevalenceInspectionTests
(commit 3b5e0992) found 103,766 of 729,888 installed EnvCells (1,293 landblocks -
the whole housing estate) carry a baked RestrictionObj. The AP-71 gate's
unconditional fail-closed default (CanMoveInto unmodeled) would have locked
every apartment/cottage/villa interior for every player, including its own
owner - a live regression, not the "inert in dev content" the original
register row assumed.

Ports ACCWeenieObject::CanMoveInto (0x0058da40, pc:407982-408056) and
RestrictionDB::IsAllowedIn (0x005ae8f0, pc:444493-444516) verbatim into
ObjectInfo.CheckEntryRestrictions:
- owner_iid == 0 or == mover's own guid -> admit (open/owner)
- no RestrictionDB (retail _db == 0, i.e. never authored or not yet
  received) -> admit
- present RestrictionDB -> IsAllowedIn: open-to-public flag, OR mover
  shares the house's allegiance monarch, OR mover's own guid is a
  guest-table member
- unresolved restriction object -> fails CLOSED, exactly retail's own
  fallback when GetObjectA can't resolve it (pc:704-716)

Wire feed (Core.Net):
- CreateObject.cs: HouseOwner (WeenieHeaderFlag 0x02000000), HouseRestrictions
  (0x04000000), and Monarch (0x40) PWD-tail fields were parsed-and-skipped;
  now captured. Also fixes the HouseRestrictions PHashTable header
  misconception: the wire is ONE packed u32 (low 24 bits = entry count),
  not a separate count(u16)+numBuckets(u16) pair - verified against
  Chorizite's RestrictionDB.generated.cs. The old skip's byte-count
  happened to match for realistic guest-list sizes, but a future
  numBuckets value >255 would have corrupted the parse; now correct
  regardless.
- GameEvents.cs/GameEventWiring.cs: new House_UpdateRestrictions (0x0248)
  parser + wiring - retail's live guest-list refresh, whole-unit replace.
  No-ops if the house object hasn't arrived via CreateObject yet.
- ClientObject/WeenieData/ClientObjectTable: HouseOwnerId, MonarchId,
  Restrictions (new HouseRestrictionRecord) fields + merge-preserving
  Ingest + targeted UpdateHouseRestrictions.

Physics wiring:
- PhysicsEngine gains an Objects (ClientObjectTable?) property, mirroring
  the existing DataCache pattern - acdream's GetObjectA equivalent, used
  ONLY by the entry-restriction gate.
- RuntimeEntityObjectLifetime wires Physics.Engine.Objects = Objects in
  all three constructors, right alongside the table's own construction -
  the same canonical table every other subsystem borrows from, never a
  second one. This is the production fix: without it the gate still fails
  closed on every restricted cell (unresolvable object), so the wiring is
  load-bearing, not cosmetic.

Register: AP-129 narrowed (not retired) to the genuine remaining residual -
House_UpdateRestrictions' Sequence byte isn't used for staleness/reordering
rejection (low-probability, self-correcting), and outdoor CLandCell
restriction (a separate DAT structure) remains unported and unaffected by
this fix.

Tests: 15 new/updated in Ap71EntryRestrictionGateTests.cs (resolved-unowned
admits, owner admits, present-list-excluded blocks, present-list-included
admits, open-to-public admits, shared-allegiance-monarch admits, unresolved
blocks via null and via an empty table, plus two new end-to-end
PhysicsEngine.Objects-wired scenarios); 2 new CreateObject parser tests +
2 new GameEventWiring tests for the wire feed.

AcDream.Core.Tests: 4049 passed, 2 skipped, 0 failed.
AcDream.Core.Net.Tests: 761 passed, 0 skipped, 0 failed.
Complete solution suite: 9,961 total, 9,956 passed, 5 skipped, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.Core/Items/ClientObject.cs

@@ -267,6 +267,31 @@ public sealed class ClientObject
     /// the base object name.
     /// </summary>
     public uint? MaterialType { get; set; }
+    /// <summary>
+    /// AP-129 (Campaign P Slice P4 review fix): retail <c>PublicWeenieDesc
+    /// ._house_owner_iid</c>. Present only on a house/dwelling restriction
+    /// object (wire <c>WeenieHeaderFlag.Owner</c>, 0x02000000). Zero or a
+    /// match against the mover's own id admits regardless of the guest list.
+    /// </summary>
+    public uint? HouseOwnerId { get; set; }
+    /// <summary>
+    /// AP-129 (Campaign P Slice P4 review fix): retail <c>PublicWeenieDesc
+    /// ._monarch_iid</c> (wire <c>WeenieHeaderFlag.Monarch</c>, 0x40) — this
+    /// object's OWN allegiance monarch. Present on any weenie, not just house
+    /// objects; a player's own value is what <c>RestrictionDB::IsAllowedIn</c>
+    /// compares against a house's <see cref="HouseRestrictionRecord.AllegianceMonarchId"/>.
+    /// </summary>
+    public uint? MonarchId { get; set; }
+    /// <summary>
+    /// AP-129 (Campaign P Slice P4 review fix): retail <c>PublicWeenieDesc
+    /// ._db</c> (<c>RestrictionDB*</c>) — the house's own guest/ban list.
+    /// Null means retail's <c>_db == 0</c> ("no list", i.e. open) OR simply
+    /// that neither a CreateObject HouseRestrictions field nor a live
+    /// <c>House_UpdateRestrictions (0x0248)</c> has arrived yet for this
+    /// object — acdream cannot distinguish the two, and both resolve to
+    /// the same retail-faithful "allow" default.
+    /// </summary>
+    public HouseRestrictionRecord? Restrictions { get; set; }
     public PropertyBundle Properties { get; } = new();
 
     /// <summary>
@@ -332,7 +357,14 @@ public readonly record struct WeenieData(
     double? CooldownDuration = null,
     uint? HookItemTypes = null,
     uint? HookType = null,
-    uint? MaterialType = null);
+    uint? MaterialType = null,
+    // AP-129 (Campaign P Slice P4 review fix): house-restriction PWD tail
+    // fields. Restrictions is null-preserving (a CreateObject that doesn't
+    // carry HouseRestrictions this time must not clobber a value fed
+    // separately by a live House_UpdateRestrictions event).
+    uint? HouseOwnerId = null,
+    uint? MonarchId = null,
+    HouseRestrictionRecord? Restrictions = null);
 
 /// <summary>
 /// Retail ITEM_USEABLE helpers (acclient.h:6478, ItemUses::* at 0x004fccd0).

src/AcDream.Core/Items/ClientObjectTable.cs

@@ -771,6 +771,23 @@ public sealed class ClientObjectTable
         return true;
     }
 
+    /// <summary>
+    /// AP-129 (Campaign P Slice P4 review fix): live <c>House_UpdateRestrictions
+    /// (0x0248)</c> refresh of a house object's guest/ban list — retail resends
+    /// the whole <c>RestrictionDB</c> (open flag + allegiance monarch + guest
+    /// table) as one unit rather than a delta. No-ops (returns false) if the
+    /// house object hasn't arrived via CreateObject yet, matching every other
+    /// targeted property update in this table.
+    /// </summary>
+    public bool UpdateHouseRestrictions(uint guid, HouseRestrictionRecord restrictions)
+    {
+        ArgumentNullException.ThrowIfNull(restrictions);
+        if (!_objects.TryGetValue(guid, out var item)) return false;
+        item.Restrictions = restrictions;
+        ObjectUpdated?.Invoke(item);
+        return true;
+    }
+
     /// <summary>
     /// Canonical CreateObject ingestion: create-if-absent, else patch the
     /// wire-carried fields in place (retail SetWeenieDesc). Preserves the
@@ -828,6 +845,9 @@ public sealed class ClientObjectTable
         if (d.MaxStructure is { } ms) obj.MaxStructure = ms;
         if (d.Workmanship is { } wm) obj.Workmanship = wm;
         if (d.MaterialType is { } materialType) obj.MaterialType = materialType;
+        if (d.HouseOwnerId is { } houseOwnerId) obj.HouseOwnerId = houseOwnerId;
+        if (d.MonarchId is { } monarchId) obj.MonarchId = monarchId;
+        if (d.Restrictions is { } restrictions) obj.Restrictions = restrictions;
 
         List<uint>? changedContainers = RemoveFromOtherContainerIndexes(
             obj.ObjectId,

src/AcDream.Core/Items/HouseRestrictions.cs

@@ -0,0 +1,44 @@
+using System.Collections.Generic;
+
+namespace AcDream.Core.Items;
+
+/// <summary>
+/// AP-129 (Campaign P Slice P4 review fix, 2026-07-30). Retail
+/// <c>RestrictionDB</c> — the access-control list carried on a house/dwelling
+/// object's <c>PublicWeenieDesc</c> (<c>WeenieHeaderFlag.HouseRestrictions</c>,
+/// 0x04000000) and refreshed live via <c>House_UpdateRestrictions (0x0248)</c>.
+/// Wire shape confirmed verbatim against
+/// <c>references/Chorizite.ACProtocol/Chorizite.ACProtocol/Types/RestrictionDB.generated.cs</c>
+/// and <c>protocol.xml:6270-6275</c>: <c>uint Version, uint Flags (0=private,
+/// 1=open), ObjectId MonarchId, PHashTable&lt;ObjectId,uint&gt; Permissions</c>.
+/// </summary>
+/// <param name="OpenToPublic">Wire <c>Flags != 0</c> — retail's <c>_bitmask
+/// &amp; 1</c>. When true, every mover is admitted regardless of the guest
+/// list.</param>
+/// <param name="AllegianceMonarchId">Wire <c>MonarchId</c> — retail
+/// <c>_monarch_iid</c>. A mover whose own monarch matches this id is admitted
+/// (allegiance-wide access), independent of the guest list.</param>
+/// <param name="Guests">Wire <c>Permissions</c> — guid to permission value
+/// (0 = dwelling access only, 1 = storage access also). Retail's
+/// <c>IsAllowedIn</c> only consults key membership for entry; the permission
+/// value is preserved for wire fidelity but not consulted here.</param>
+public sealed record HouseRestrictionRecord(
+    bool OpenToPublic,
+    uint AllegianceMonarchId,
+    IReadOnlyDictionary<uint, uint> Guests)
+{
+    /// <summary>
+    /// Verbatim port of retail <c>RestrictionDB::IsAllowedIn</c>
+    /// (named-retail pc:444493-444516, 0x005ae8f0):
+    /// <c>if ((_bitmask &amp; 1) == 0) { if (_monarch_iid == 0 || arg3 !=
+    /// _monarch_iid) { if (arg2 == 0) return 0; if (!table.find(arg2)) return
+    /// 0; } } return 1;</c> — open bit set, OR mover shares the house's
+    /// allegiance monarch, OR mover's own guid is a table member.
+    /// </summary>
+    public bool IsAllowedIn(uint moverId, uint moverMonarchId)
+    {
+        if (OpenToPublic) return true;
+        if (AllegianceMonarchId != 0 && moverMonarchId == AllegianceMonarchId) return true;
+        return moverId != 0 && Guests.ContainsKey(moverId);
+    }
+}

src/AcDream.Core/Physics/PhysicsEngine.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.Numerics;
+using AcDream.Core.Items;
 
 namespace AcDream.Core.Physics;
 
@@ -125,6 +126,20 @@ public sealed class PhysicsEngine
     }
     private PhysicsDataCache? _dataCache;
 
+    /// <summary>
+    /// AP-129 (Campaign P Slice P4 review fix, 2026-07-30): optional live
+    /// weenie-object table, consulted ONLY by
+    /// <see cref="Transition.FindEnvCollisions"/>'s entry-restriction gate to
+    /// resolve a cell's <c>RestrictionObj</c> into its owner/guest-list data
+    /// (retail <c>ACCWeenieObject::CanMoveInto</c>). Mirrors the
+    /// <see cref="DataCache"/> pattern: nullable, settable, defaults null so
+    /// every existing test/one-shot caller is unaffected. An unset table
+    /// makes a restricted cell fail CLOSED — exactly retail's own fallback
+    /// when the restriction weenie can't be resolved — so production MUST
+    /// wire this to the live table for the fix to actually admit anyone.
+    /// </summary>
+    public ClientObjectTable? Objects { get; set; }
+
     private sealed record LandblockPhysics(
         TerrainSurface Terrain,
         IReadOnlyList<CellSurface> Cells,

src/AcDream.Core/Physics/TransitionTypes.cs

@@ -1,6 +1,7 @@
 using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.Numerics;
+using AcDream.Core.Items;
 using DatReaderWriter.Types;
 
 namespace AcDream.Core.Physics;
@@ -169,22 +170,51 @@ public sealed class ObjectInfo
     /// cannot bypass): retail resolves the live restriction weenie
     /// (<c>CPhysicsObj::GetObjectA</c>) and asks <c>CanMoveInto</c> (house
     /// owner IID + guest/ban list, <c>ACCWeenieObject::CanMoveInto</c>
-    /// 0x0058da40). acdream has no restriction-weenie resolution or
-    /// guest-list wire model yet (see the AP-71 register history for the
-    /// narrower unfed-input row this leaves), so it cannot correctly answer
-    /// <c>CanMoveInto</c> — it fails CLOSED (<see
-    /// cref="TransitionState.Collided"/>), exactly matching retail's own
-    /// fallback when the restriction object can't be resolved (pc:704-716
-    /// falls through to <c>COLLIDED_TS</c>).
+    /// 0x0058da40, named-retail pc:407982-408056). AP-129 (Campaign P Slice
+    /// P4 review fix, 2026-07-30) ports this verbatim via
+    /// <paramref name="objects"/> (retail's <c>GetObjectA</c> equivalent —
+    /// the house object is an ordinary <c>CreateObject</c> entity in range):
     /// </para>
+    /// <list type="bullet">
+    ///   <item>Unresolved restriction object (<paramref name="objects"/> is
+    ///     null, or has no row for <paramref name="cellRestrictionObj"/>) —
+    ///     fails CLOSED (<see cref="TransitionState.Collided"/>), exactly
+    ///     retail's own fallback when <c>rObj == 0</c> (pc:704-716 falls
+    ///     through to <c>COLLIDED_TS</c>).</item>
+    ///   <item>Resolved, <c>HouseOwnerId</c> zero or equal to the mover's own
+    ///     id — OK (owner always in, or no owner set = open).</item>
+    ///   <item>Resolved, no <c>Restrictions</c> (retail <c>_db == 0</c>) — OK
+    ///     (an un-received or never-authored guest list is open, same as a
+    ///     retail client that hasn't been sent restrictions yet).</item>
+    ///   <item>Resolved with a <c>Restrictions</c> list — delegates to
+    ///     <see cref="HouseRestrictionRecord.IsAllowedIn"/> (retail
+    ///     <c>RestrictionDB::IsAllowedIn</c> 0x005ae8f0): open-to-public,
+    ///     OR mover shares the house's allegiance monarch, OR the mover's
+    ///     own guid is a guest-table member.</item>
+    /// </list>
     /// </summary>
-    public TransitionState CheckEntryRestrictions(uint cellRestrictionObj)
+    public TransitionState CheckEntryRestrictions(
+        uint cellRestrictionObj,
+        ClientObjectTable? objects)
     {
         if (!IsPlayer) return TransitionState.OK;               // NPCs/props bypass entirely
         if (CanBypassMoveRestrictions) return TransitionState.OK;
         if (cellRestrictionObj == 0) return TransitionState.OK; // ordinary cell — no-op
 
-        return TransitionState.Collided;
+        ClientObject? restrictionObject = objects?.Get(cellRestrictionObj);
+        if (restrictionObject is null) return TransitionState.Collided; // retail: rObj==0 -> COLLIDED
+
+        uint moverId = SelfEntityId;
+        uint houseOwnerId = restrictionObject.HouseOwnerId ?? 0;
+        if (houseOwnerId == 0 || houseOwnerId == moverId) return TransitionState.OK;
+
+        HouseRestrictionRecord? restrictions = restrictionObject.Restrictions;
+        if (restrictions is null) return TransitionState.OK;   // retail: _db==0 -> open
+
+        uint moverMonarchId = objects?.Get(moverId)?.MonarchId ?? 0;
+        return restrictions.IsAllowedIn(moverId, moverMonarchId)
+            ? TransitionState.OK
+            : TransitionState.Collided;
     }
 
     /// <summary>
@@ -3033,8 +3063,12 @@ public sealed class Transition
             // find_env_collisions (pc:309576) calls check_entry_restrictions
             // as its FIRST statement — before any HasPhysics/BSP dispatch.
             // cellPhysics is null-safe: an uncached/BSP-less cell has no
-            // authored restriction data either.
-            var restrictionState = ObjectInfo.CheckEntryRestrictions(cellPhysics?.RestrictionObj ?? 0);
+            // authored restriction data either. AP-129 (review fix): pass
+            // engine.Objects so the gate can resolve CanMoveInto instead of
+            // failing closed on every restricted cell (see PhysicsEngine.Objects).
+            var restrictionState = ObjectInfo.CheckEntryRestrictions(
+                cellPhysics?.RestrictionObj ?? 0,
+                engine.Objects);
             if (restrictionState != TransitionState.OK)
             {
                 if ((ObjectInfo.State & ObjectInfoState.Contact) == 0)