fix(physics): #297 — keep the PWD bitfield live so PK status reaches the client

The user typed @pklite and then walked straight through other PKLite players.

Root cause: ClientObject.PublicWeenieBitfield was written exactly once, from the
0xF745 CreateObject parse, and never refreshed. ACE's only PK-change message is
PropertyInt.PlayerKillerStatus (134) over 0x02CE/0x02CD, which we parsed and
stored into Properties.Ints[134] but never translated back into the bitfield —
and ACE never re-sends a PublicWeenieDesc at all (EnqueueBroadcastUpdateObject
has zero live callers), so that property is the ONLY signal a client can learn
from. Both sides of the collision test read the frozen value, so
CollisionExemption's "4c. both PKLite -> collide" rule could never fire.

Retail's missing port: PublicWeenieDesc::SetPlayerKillerStatus @0x005AC7C0
rewrites _bitfield in place — PK(4) -> (b & 0xfddfffff) | 0x20; PKLite(0x40) ->
(b & 0xffdfffdf) | 0x2000000; Free(0x20) -> (b & 0xfdffffdf) | 0x200000; else
b &= 0xfddfffdf. Mutually exclusive, verified byte-for-byte, with input values
confirmed against retail's own PKStatusEnum (acclient.h:6412-6427), not just
ACE's. Driven from ACCWeenieObject::OnStatUpdated @0x0058DF20 case 0x86.

The fix rewrites the value at its source rather than patching consumers. Two
review rounds were needed because the first pass missed that there are TWO
snapshot stores: InboundPhysicsStateController keeps its own private _snapshots
dictionary, and every untimestamped-field merge (ApplyAcceptedObjDesc and
friends) reads `old` from THAT store, not from RuntimeEntityRecord.Snapshot.
Refreshing only the active record left the target-side shadow flags correct
until the remote's next equip or unequip — ACE broadcasts an ObjDesc on every
one — at which point the appearance path rebuilt the registration from the
frozen spawn and dropped the bit permanently. The regression test demanded by
review is what surfaced that; it is verified discriminating (reverting gives
Actual: 8 instead of 33554440).

Five stores now hold this value, kept coherent from one source by two
ObjectUpdated subscribers plus the appearance-rebuild path. The two shadow-flag
writers are the same invalidation applied at the two edges that can invalidate
it, not competing authorities — review enumerated every drift path and closed
each. That coherence invariant is new as of this commit and is recorded as
register row AP-134, with AP-133 as the precedent for filing a row when the
danger is a future writer rather than current behaviour.

Also corrects TS-23's retirement narrative, which claimed every mover-flags call
site read the mover's "real" PK bits from 2026-07-30. The bits existed but their
source was frozen, so that only became true here; the site enumeration also
missed RuntimeSetPositionMoverPreparation, a seventh site that decodes the
snapshot directly.

Unblocks #298 (melee/missile admission needs the local player's own PKLite bit).
Follow-ups filed: #300 (Properties.Ints[134] vs bitfield mirror gap), #301 (same
defect class for radar blip colour and radar behaviour), #302 (a pre-existing
PortalProjection allocation-assertion flake, 1 in 6, found while verifying this
gate), #303 (LiveEntityPvpBitfieldSync is App-resident but Runtime-owned-state).

Gates: complete Release solution 10,895 passed / 4 skipped / 0 failed (baseline
10,887 including #299). Adversarial + retail-conformance review PASS after one
FAIL round. Every new test discrimination-verified by reverting the fix.
Connected acceptance NOT run — needs a live two-client PKLite session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/AcDream.Runtime.Tests/Physics/RuntimeSetPositionMoverPreparationTests.cs

@@ -113,6 +113,47 @@ public sealed class RuntimeSetPositionMoverPreparationTests
             command.ExpectedVelocityAuthorityVersion);
     }
 
+    [Fact]
+    public void LivePkStatusUpdate_ReachesMoverFlagsOnNextPlacement()
+    {
+        // #297 F2 (review round 2): RuntimeSetPositionMoverPreparer.TryBuild
+        // reads record.Snapshot.ObjectDescriptionFlags directly — a
+        // PLACEMENT/teleport/spawn-settle mover-flags resolve, distinct from
+        // the per-tick sweep path that already read the live table via
+        // EntityCollisionFlagsExt.ResolveMoverPvpState. Before
+        // RuntimeEntityPvpBitfieldSnapshotSync existed, this record's
+        // snapshot stayed frozen at whatever CreateObject captured, so a
+        // PKLite remote teleporting or landing next to the local player
+        // de-overlapped under the wrong (stale, non-PKLite) exemption.
+        using var lifetime = new RuntimeEntityObjectLifetime();
+        RuntimeEntityRecord record = CreateRecord(
+            lifetime,
+            objectDescriptionFlags: 0x8u); // BF_PLAYER only, no PK/PKLite yet
+
+        lifetime.Objects.AddOrUpdate(new AcDream.Core.Items.ClientObject
+        {
+            ObjectId = record.ServerGuid,
+            PublicWeenieBitfield = 0x8u,
+        });
+        lifetime.Objects.UpdateIntProperty(
+            record.ServerGuid,
+            AcDream.Core.Items.ClientObjectTable.PlayerKillerStatusPropertyId,
+            value: AcDream.Core.Items.PlayerKillerStatusBitfield.PkLite);
+
+        RuntimeEntityPlacementToken token = Begin(lifetime, record);
+        ImmutableArray<FlatCollisionSphere> spheres =
+            [new(new Vector3(1f, 2f, 3f), 0.1f)];
+        FlatSetupCollision setup = Setup(spheres, 0f, 0f);
+        RuntimeSetPositionMoverPreparation input =
+            Input(RuntimeSetPositionMoverSetup.Resolved(SetupId, setup));
+
+        RuntimeSetPositionMoverPreparationStatus status = lifetime.Physics
+            .SetPosition.PrepareMover(token, input, out var command);
+
+        Assert.Equal(RuntimeSetPositionMoverPreparationStatus.Prepared, status);
+        Assert.True(command.Physics.MoverFlags.HasFlag(ObjectInfoState.IsPKLite));
+    }
+
     [Fact]
     public void LocalPortalKindAndAuthorityArePreservedWithoutInference()
     {