fix(streaming): commit EnvCell landblocks atomically (#214)

Carry one complete cell payload with each streaming completion and publish visibility, physics, and render state on the render thread. Remove the obsolete post-readiness login reload that triggered a duplicate dungeon build.

Co-Authored-By: Codex <noreply@openai.com>

docs/architecture/acdream-architecture.md

@@ -394,6 +394,24 @@ bypass; no Scissor over-include). This is a **consolidation of existing machiner
 (`PortalVisibilityBuilder` + `ClipFrame`), not a rewrite. Do NOT add a fourth special-case
 gate to mask a seam — that anti-pattern produced the patchwork.
 
+### Streaming publication ownership
+
+The streaming worker may read dats and build CPU payloads, but it must not mutate
+live render-frame registries. A near-tier job produces one `LandblockBuild` whose
+optional `EnvCellLandblockBuild` owns the complete portal-cell and drawable-shell
+sets for that landblock. The exact build object crosses the `LandblockStreamer`
+completion channel. On the render thread, `StreamingController` applies that one
+completion to `CellVisibility`, cell physics state, `EnvCellRenderer`, and finally
+`GpuWorldState` during the same update-frame drain.
+
+This is the publication boundary: per-job builders are private and single-use;
+completed payloads are immutable snapshots; live landblock stores are replaced as
+complete units. Process-wide pending bags or renderer-owned pending lists are not
+valid streaming seams because a duplicate load or a second landblock can drain or
+replace state produced by another job. CPU mesh extraction may still be scheduled
+onto `ObjectMeshManager`'s thread-safe work queue, but the worker never publishes
+partially hydrated cell membership or shell placement to the renderer.
+
 ## Roadmap Model
 
 The old R1-R8 architecture sequence was a useful early refactor sketch, but it

docs/architecture/code-structure.md

@@ -183,7 +183,7 @@ src/AcDream.App/
 │   ├── TextureCache.cs                 # (already exists)
 │   ├── ParticleRenderer.cs             # (already exists)
 │   ├── Sky/                            # (already exists)
-│   ├── Wb/                             # (already exists — WB seam)
+│   ├── Wb/                             # WB seam + EnvCellLandblockBuild transaction
 │   └── Vfx/                            # (already exists)
 ├── Net/
 │   └── LiveSessionController.cs        # owns WorldSession lifecycle, login/handshake, reconnect
@@ -191,7 +191,7 @@ src/AcDream.App/
 │   └── LiveEntityRuntime.cs            # owns per-entity state dicts + ServerGuid↔entity.Id translation
 ├── Interaction/
 │   └── SelectionInteractionController.cs  # owns WorldPicker, selection state, Use/PickUp dispatch
-├── Streaming/                          # (already exists)
+├── Streaming/                          # LandblockStreamer + immutable LandblockBuild completion
 ├── Input/                              # (already exists)
 ├── Audio/                              # (already exists)
 └── Plugins/                            # (already exists)

docs/architecture/worldbuilder-inventory.md

@@ -26,6 +26,15 @@ our tree (see CLAUDE.md for the full breakdown):
   `ObjectMeshManager`, `WbMeshAdapter`, `WbDrawDispatcher`, texture cache,
   shader infra, EnvCell/portal/scenery/terrain-blending pipeline classes.
 
+**EnvCell streaming seam:** `EnvCellLandblockBuildBuilder` is an acdream-owned
+adapter around the extracted WB rendering path. One streaming job privately builds
+the complete portal-cell + shell-placement payload, and `EnvCellRenderer.CommitLandblock`
+publishes that completed snapshot on the render thread. WB's geometry-id arithmetic
+and mesh preparation remain unchanged; the transaction wrapper exists because
+acdream streams asynchronously while the WB editor's manager owned its own loading
+loop. Do not reintroduce worker-side `RegisterCell` calls or shared pending cell
+collections.
+
 `DatCollectionAdapter` bridges our `IDatCollection` to the `IDatReaderWriter`
 interface WB's internals expect (O-D7 fallback; `ObjectMeshManager` has 26
 internal `_dats.*` call sites — above the 20-site inline-swap threshold).