fix(physics): guard the world-frame agreement proven unreachable by measurement

Closes #283 (plan S3) - as UNREACHABLE, not by restructuring ownership.

acdream has two owners that convert a landblock-local network origin into the
streamed world frame: LiveWorldOriginState for presentation/streaming, and
RuntimePhysicsState.TryGetWorldFrameOffset for placement. They rebase on
different edges - Runtime the instant an accepted Position carries
TeleportAdvanced, App only once StreamingOriginRecenterCoordinator observes
old-window retirement completion, many frames later. A one-landblock
disagreement places an entity 192 m from the geometry around it: the same
failure family as the zero-offset bug 670f307c fixed, with a wrong origin
instead of a missing one.

The plan's first step was to prove or disprove reachability BEFORE moving
ownership, because a restructure on a hypothesis is churn. The probe added in
898ff18b answered it: a connected Release session recorded ZERO disagreements
across 11 completed reveals and six destination landblocks (0x0904, 0x1134,
0x3032, 0x8763, 0xA9B4, 0xF682) spanning roughly 45 km. A gap of even one
frame would have printed an offset in the tens of thousands of metres.

Cause of the safety: BeginOriginRecenter detaches EVERY resident landblock
before the new origin is adopted, so the two rebases are serialized and no
conversion can observe the gap. Ownership is therefore left exactly as it is.

What lands instead is the invariant that keeps it true.
LiveWorldOriginState.EnsureAgreesWithRuntimeFrame is checked at the
landblock->world conversion and is terminal on disagreement, converting a
silent 192 m-multiple misplacement into a loud failure with the offset in
metres and the landblock being projected. Six focused tests pin it, including
the cross-world portal case (0x09 -> 0xF6 = 45,504 m). Disagreement can no
longer reach the probe, so ACDREAM_PROBE_WORLD_FRAME now emits a verbose
per-conversion agreement trace - useful when a placement looks displaced for
some reason OTHER than a frame disagreement.

Complete Release solution: 10,844 passed / 4 skipped / 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.App/World/LiveWorldOriginState.cs

@@ -44,6 +44,48 @@ internal sealed class LiveWorldOriginState
 
     public (int X, int Y) GetCenter() => (CenterX, CenterY);
 
+    /// <summary>
+    /// #283: asserts that this owner and Runtime's world frame agree on which
+    /// landblock is (0,0). Both convert landblock-local network origins into
+    /// the streamed world frame — this one for presentation and streaming,
+    /// <c>RuntimePhysicsState.TryGetWorldFrameOffset</c> for placement — so a
+    /// disagreement of one landblock places an entity 192 m from the geometry
+    /// around it.
+    ///
+    /// <para>They rebase on different edges: Runtime the instant an accepted
+    /// Position carries <c>TeleportAdvanced</c>, this owner only once
+    /// <c>StreamingOriginRecenterCoordinator</c> observes old-window
+    /// retirement completion. A 2026-08-03 connected run
+    /// (<c>ACDREAM_PROBE_WORLD_FRAME=1</c>, 11 reveals across six landblocks
+    /// spanning ~45 km) recorded ZERO disagreements: detaching every resident
+    /// landblock before adopting the new origin serializes the two rebases,
+    /// so no conversion can observe the gap. This is the permanent guard that
+    /// keeps that true — it converts a silent 192 m-multiple misplacement into
+    /// a loud failure if a future change ever reopens the window.</para>
+    /// </summary>
+    public void EnsureAgreesWithRuntimeFrame(
+        uint runtimeCenterLandblockId,
+        uint projectingLandblockId)
+    {
+        // Before either owner is established there is nothing to agree on;
+        // the placement itself is gated separately (#284).
+        if (!IsKnown || runtimeCenterLandblockId == 0u)
+            return;
+
+        int runtimeCenterX = (int)((runtimeCenterLandblockId >> 24) & 0xFFu);
+        int runtimeCenterY = (int)((runtimeCenterLandblockId >> 16) & 0xFFu);
+        if (runtimeCenterX == CenterX && runtimeCenterY == CenterY)
+            return;
+
+        throw new InvalidOperationException(
+            "World-frame owners disagree: Runtime centre "
+            + $"({runtimeCenterX},{runtimeCenterY}) vs streamed origin "
+            + $"({CenterX},{CenterY}) while projecting landblock "
+            + $"0x{projectingLandblockId:X8}. That offsets the entity by "
+            + $"({(runtimeCenterX - CenterX) * 192f:F0}m,"
+            + $"{(runtimeCenterY - CenterY) * 192f:F0}m) from its geometry.");
+    }
+
     /// <summary>
     /// Converts the streamed render frame back into retail's landblock-local
     /// physics frame at the one placement seed boundary.