fix(streaming): commit EnvCell landblocks atomically (#214)

Carry one complete cell payload with each streaming completion and publish visibility, physics, and render state on the render thread. Remove the obsolete post-readiness login reload that triggered a duplicate dungeon build.

Co-Authored-By: Codex <noreply@openai.com>

docs/architecture/acdream-architecture.md

@@ -394,6 +394,24 @@ bypass; no Scissor over-include). This is a **consolidation of existing machiner
 (`PortalVisibilityBuilder` + `ClipFrame`), not a rewrite. Do NOT add a fourth special-case
 gate to mask a seam — that anti-pattern produced the patchwork.
 
+### Streaming publication ownership
+
+The streaming worker may read dats and build CPU payloads, but it must not mutate
+live render-frame registries. A near-tier job produces one `LandblockBuild` whose
+optional `EnvCellLandblockBuild` owns the complete portal-cell and drawable-shell
+sets for that landblock. The exact build object crosses the `LandblockStreamer`
+completion channel. On the render thread, `StreamingController` applies that one
+completion to `CellVisibility`, cell physics state, `EnvCellRenderer`, and finally
+`GpuWorldState` during the same update-frame drain.
+
+This is the publication boundary: per-job builders are private and single-use;
+completed payloads are immutable snapshots; live landblock stores are replaced as
+complete units. Process-wide pending bags or renderer-owned pending lists are not
+valid streaming seams because a duplicate load or a second landblock can drain or
+replace state produced by another job. CPU mesh extraction may still be scheduled
+onto `ObjectMeshManager`'s thread-safe work queue, but the worker never publishes
+partially hydrated cell membership or shell placement to the renderer.
+
 ## Roadmap Model
 
 The old R1-R8 architecture sequence was a useful early refactor sketch, but it