feat(physics): integrate live projectile runtime

Attach the retail projectile driver to canonical LiveEntityRecord ownership, sharing one PhysicsBody and full-cell identity with RemoteMotion regardless of creation order. Apply timestamp-gated state, vector, and position corrections in place, preserve active ordinary-body behavior when Missile clears, and keep renderer, effects, shadows, and spatial buckets synchronized across loaded/pending transitions.

Validate malformed packets before canonical timestamp mutation, validate adopted bodies from their current frame rather than stale CreateObject data, serialize late Setup resolution with streaming DAT reads, and preserve classification across clock anomalies. Retain shadow registrations through temporary leave-world residence while logical teardown remains generation-scoped.

Add 31 App lifecycle/adversarial tests plus Core shadow suspension coverage, and synchronize the retail pseudocode, architecture, milestones, roadmap, and durable physics memory.

Co-Authored-By: Codex <noreply@openai.com>

docs/architecture/acdream-architecture.md

@@ -179,6 +179,8 @@ src/
     ISelectionService.cs      -> done
   
   AcDream.App/               Layer 1 + Layer 4 wiring
+    Physics/
+      ProjectileController.cs -> live-record projectile orchestration/corrections
     Rendering/
       GameWindow.cs           -> still owns too much runtime wiring
       TerrainRenderer.cs      -> done
@@ -224,6 +226,28 @@ What exists and is active:
   AlignPath, Setup-sphere transition sweeps, and collision response. It owns no
   live entity, network, rendering, or App state; the App controller supplies
   those boundaries.
+- `ProjectileController` is that App boundary. It installs one body on the
+  canonical `LiveEntityRecord`, advances it on the update/render thread,
+  commits through `WorldEntity.SetPosition`, publishes the effect root,
+  synchronizes the existing shadow, and calls `RebucketLiveEntity` only when
+  the full cell changes. Pending/leave-world residence suspends the shadow's
+  cell rows while retaining its registration for exact re-entry. Timestamp-
+  gated State/Vector/Position/Movement packets correct or stop that same body;
+  every production MovementManager delegates full-cell reads/writes to the
+  incarnation-scoped live record, and projectile acquisition adopts its body
+  without replaying vectors already installed when that body was created,
+  regardless of component creation order. Accepted SetState flags reach that
+  canonical body before optional projectile acquisition, so absent/unsupported
+  DAT shape data cannot leave collision state stale; a non-finite local receipt
+  clock uses the controller's last finite game-clock value and cannot consume
+  first-time Missile classification. Shared-body acquisition validates the
+  adopted body's current frame/vectors, not obsolete CreateObject inputs.
+  Initial and late Setup resolution share GameWindow's `_datLock`, preserving
+  the single-reader `DatCollection` invariant while streaming is active.
+  Generic remote translation is suppressed while projectile integration
+  owns the frame;
+  delete, generation replacement, pickup/parent leave-world, and session reset
+  use `LiveEntityRuntime`'s normal lifecycle and never create a second GUID map.
 - `BSPQuery` contains the partial retail-style BSP collision dispatcher used by
   the transition path.
 - `TransitionTypes` carries `SpherePath`, `CollisionInfo`, `ObjectInfo`,