fix(physics): guard the world-frame agreement proven unreachable by measurement

Closes #283 (plan S3) - as UNREACHABLE, not by restructuring ownership.

acdream has two owners that convert a landblock-local network origin into the
streamed world frame: LiveWorldOriginState for presentation/streaming, and
RuntimePhysicsState.TryGetWorldFrameOffset for placement. They rebase on
different edges - Runtime the instant an accepted Position carries
TeleportAdvanced, App only once StreamingOriginRecenterCoordinator observes
old-window retirement completion, many frames later. A one-landblock
disagreement places an entity 192 m from the geometry around it: the same
failure family as the zero-offset bug 670f307c fixed, with a wrong origin
instead of a missing one.

The plan's first step was to prove or disprove reachability BEFORE moving
ownership, because a restructure on a hypothesis is churn. The probe added in
898ff18b answered it: a connected Release session recorded ZERO disagreements
across 11 completed reveals and six destination landblocks (0x0904, 0x1134,
0x3032, 0x8763, 0xA9B4, 0xF682) spanning roughly 45 km. A gap of even one
frame would have printed an offset in the tens of thousands of metres.

Cause of the safety: BeginOriginRecenter detaches EVERY resident landblock
before the new origin is adopted, so the two rebases are serialized and no
conversion can observe the gap. Ownership is therefore left exactly as it is.

What lands instead is the invariant that keeps it true.
LiveWorldOriginState.EnsureAgreesWithRuntimeFrame is checked at the
landblock->world conversion and is terminal on disagreement, converting a
silent 192 m-multiple misplacement into a loud failure with the offset in
metres and the landblock being projected. Six focused tests pin it, including
the cross-world portal case (0x09 -> 0xF6 = 45,504 m). Disagreement can no
longer reach the probe, so ACDREAM_PROBE_WORLD_FRAME now emits a verbose
per-conversion agreement trace - useful when a placement looks displaced for
some reason OTHER than a frame disagreement.

Complete Release solution: 10,844 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/ISSUES.md

@@ -72,7 +72,7 @@ reconciling #281's 43 test failures.
   lit statics are unchanged. The session's log corroborates it — 9 completed
   world reveals, 58 reveal events all `failures=0`, zero unhandled exceptions,
   and a graceful exit.
-- **#283 — OPEN — Runtime's world frame and App's render origin rebase at
+- **#283 — DONE (2026-08-03, proven unreachable) — Runtime's world frame and App's render origin rebase at
   different moments during a teleport.** `670f307c` gave Runtime its own world
   frame (`RuntimePhysicsState.ObserveLocalWorldFrame`), which rebases the
   instant an accepted Position carries `TeleportAdvanced`. App's
@@ -87,6 +87,25 @@ reconciling #281's 43 test failures.
   gate may or may not exclude Create during that window, and #280 says other
   work does continue arriving through it. Two owners of one fact; the campaign
   answer is that Runtime owns the frame and App projects it. Route-3 adjacent.
+  **Resolved 2026-08-03 as UNREACHABLE, not restructured.** The plan's first
+  step was to prove or disprove reachability before moving ownership.
+  `ACDREAM_PROBE_WORLD_FRAME=1` (`PhysicsDiagnostics.ProbeWorldFrameEnabled`)
+  compared both owners at
+  `DatLiveEntityProjectionMaterializer`'s landblock→world conversion — the
+  App-side counterpart of `TryGetWorldFrameOffset`. A connected Release
+  session recorded **zero** disagreements across 11 completed reveals and six
+  destination landblocks (`0x0904`, `0x1134`, `0x3032`, `0x8763`, `0xA9B4`,
+  `0xF682`) spanning ~45 km — a gap of even one frame would have printed an
+  offset in the tens of thousands of metres. Cause: `BeginOriginRecenter`
+  detaches EVERY resident landblock before the new origin is adopted, which
+  serializes the two rebases so no conversion can observe the gap.
+  Ownership is therefore left alone (restructuring on a disproven hypothesis
+  would have been churn). Instead
+  `LiveWorldOriginState.EnsureAgreesWithRuntimeFrame` is a permanent terminal
+  invariant at that conversion, turning a silent 192 m-multiple misplacement
+  into a loud failure if a future change ever reopens the window; six focused
+  tests pin it, including the cross-world portal case. The probe flag now
+  emits a verbose per-conversion agreement trace for future investigation.
 - **#284 — DONE (2026-08-03) — a placement that cannot resolve parks forever with no
   diagnostic.** A first-entry placement whose world frame is absent returns
   `RetrySetupUnavailable` (`RuntimeSetPositionState.PrepareMover:1535-1543`)