docs(overhaul): seal matching cathedral capture and mutation release

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -965,6 +965,14 @@ three-cell/21-entry installed membership and deterministic product, then the
 remaining final gates. No original golden relaxed, no known retail leak/FPS
 change, no C1a/G4 pass yet. Evidence: `c1a-building-bridge-verification.md`.
 
+**C1a integrated actual-product capture:** bridge landed1e645ee40; original
+guarded witness landed66825e0bb. Clean capture Release0W0E reaches ONLY its
+final unpinned hash comparison: both fresh owner products agree byte-for-byte,
+real shell nonempty, ramp ordered0112/0113/0009 and21entries match retail.
+Exact hashes/counts/artifacts in `c1a-integrated-capture-verification.md`.
+This expected initial failure authorizes the recorded golden pin and five
+product mutations, not C1a/G4 PASS. Fresh-process/full/final gates still owed.
+
 ## 14. Risk register (condensed)
 
 - **R1 second scene graph.** Graph records own only topology/membership facts;

docs/research/2026-09-01-overhaul/c1a-integrated-capture-verification.md

@@ -0,0 +1,44 @@
+# C1a integrated installed-data capture
+
+2026-09-05. Clean source66825e0bb after bridge1e645ee40. Lead executed one
+Release App.Tests build0W0E and the single contracted geometry fact with
+explicit installed-DAT opt-in/directory. Prechecks18:30:06/18:30:32UTC found
+no clients/debugger, ACE UDP9000/PID13340. Exec51780 is terminal exit1.
+No other test, client, original or authored diagnostic ran.
+
+The sole failure is the final line73 comparison against
+REPLACE_AFTER_FIRST_VERIFIED_CAPTURE. Before that comparison BOTH fresh
+owner captures completed all semantic/non-vacuity assertions: real0104
+shell vertices/subsets/indices, seven ramp parts, exact ordered cells
+F4180112/F4180113/F4180009,21clip-required entries, bounding-box route,
+cross-owner content and owner/cell reciprocity. Both raw geometry and
+membership byte arrays, all three hashes and complete counts agreed.
+This is the expected initial unpinned failure, not a green test or relaxed
+four-cell oracle. Lead independently checked the failure location, source
+assertion ordering, output, four complete DAT identities and artifact hashes.
+
+| Product | SHA256 |
+|---|---|
+|geometry|3DA9040F65F58E2FF20EF2B4761A700C847298DFBEF370E3EA76AEE85B53D187|
+|membership|AC18FF6BAB798D4480AF1EFD0B90DE3E9252AD4B6C837AB60AAC6DC42A08BC9A|
+|combined|251A13A58133D79062B38A7145250E5B1FE018AF8E28E1D29A092C4B6C63ABF0|
+
+Geometry counts:24visibility cells,22shells,241published entities,
+35Setup meshes,59GfxObj meshes,4946vertices,222subsets,12300indices,
+72Setup parts. Membership counts:241published entities,229logical owners,
+229retained arrays,256retained array cells,55cell-domain IDs,440part entries.
+Four installed file hashes exactly match the accepted table in packet§45.3.
+
+Artifacts: `artifacts/s5-c1a-integrated-capture-20260905-r1/`.
+
+| Artifact | SHA256 |
+|---|---|
+|release-build.log|166BE05FA047C6E534A66512E11441FAB7E2F68107A19BE804A475565E5FA85B|
+|capture.log|81358D10606A8CE2F65A1009973C63BA1DFD2BE2624EA667CFE7E0B18C5B286F|
+|capture.trx|BC46C7F509D460FE0B29A7D76B60C81FD022086E1B5FD11486206544F20DAAFF|
+
+These observations authorize pinning only the recorded combined hash, under
+`c1a-product-discrimination-contract.md`. They do not establish the required
+mutation coverage, fresh-process repeatability, full solution/canonical
+gates, lifecycle/stability or owner G4 acceptance. The managed source/tie
+residuals remain registered; no AMD or known-retail-leak causation is claimed.

docs/research/2026-09-01-overhaul/c1a-product-discrimination-contract.md

@@ -0,0 +1,82 @@
+# C1a golden pin and five product discriminators
+
+Lead bounded test-only execution release2026-09-05. Read original packet
+§37.3–37.4 and§45, guarded integration contract, and
+`c1a-integrated-capture-verification.md`. Bridge1e645ee40 is review-closed;
+clean66825e0bb's real installed capture reaches only the expected final
+placeholder failure after two complete fresh owner products agree.
+
+## Allowed implementation and ownership
+
+Wegener may edit only the campaign test
+`tests/AcDream.App.Tests/Streaming/LandblockGeometryMembershipInstalledDatTests.cs`
+and one short return note `c1a-product-discrimination-verification.md`.
+Pin ExpectedCombinedHash exactly to
+251A13A58133D79062B38A7145250E5B1FE018AF8E28E1D29A092C4B6C63ABF0.
+No other lasting test change, production/fixture/package/shader/script/
+register/ledger change, original-scratch edit, agent creation or commit.
+No AuthoredDiagnostic run. Lead owns independent review and integration.
+
+Implementer owns EXCLUSIVE build/test execution until frozen return. Root
+will perform only read-only work or unrelated ledger preparation during that
+window. Before EVERY build/test authoritatively check both client names and
+debuggers absent and ACE UDP9000; no graphical launch belongs here. Release
+only, one process at a time, preserve each build/stdout/TRX in fresh
+`artifacts/s5-c1a-product-discrimination-20260905-r1/` with unique phase names.
+Use explicit ACDREAM_RUN_INSTALLED_DAT_TESTS=1 and the Documents/Asheron's Call
+directory; exact geometry fact only. No broad suite or opportunistic retry.
+
+## Evidence sequence
+
+First pin, seal source hash, build green and run the exact fact once green.
+Then perform the five required mutations ONE AT A TIME, rebuilding and
+running that same fact once per mutation. Each must be reached by actual
+installed content and fail the pinned product assertion, not a self-equality
+or artificial sentinel. Preserve all original semantic assertions. Restore
+the exact pinned source bytes with apply_patch after EVERY mutation and
+verify its hash before the next. No reset/checkout/clean/stash.
+
+1. Change one real serialized vertex float bit with counts unchanged. Use
+   an actually nonempty extracted mesh/vertex, not an invented vertex.
+2. Swap two distinct real indices in an actual ordered upload subset, with
+   counts unchanged; assert the selected values differ before swapping.
+3. Swap two different actual ramp Setup-part MeshRefs BEFORE
+   PublishStaticCollision. Lead verified that the real publisher consumes
+   entity.MeshRefs through FromStaticRenderParts into the registered part
+   array. Swap refs0/1 (different real GfxObj ids) without changing count,
+   not two hash fields after publication. Confirm the published part-index/
+   GfxObj product actually reflects the reordered input. Do not reconstruct
+   expected membership or call Register* yourself.
+4. Flip one actual retained ramp entry's ClipPlanesRequired in the real
+   registry-backed list after the unmodified semantic checks and before
+   SerializeMembership, so the pinned product detects it. The getter returns
+   the actual List<RetailPartEntry>; no production seam is needed. Prove the
+   selected entry is the real ramp and was true; replace only that record's
+   bool. Counts and other fields remain unchanged.
+5. Swap two real entries of different owners in the same observed cell-wide
+   list, after semantic checks and before serialization. Use the actual
+   non-vacuous CrossOwnerCellId, preserving count and each owner's complete
+   entry projection/CELLARRAY. No owner-grouped copy or fabricated pair.
+
+No permanent mutation helper/flag remains. Each mutated capture still has
+two fresh owners, identical changed products within that invocation, and
+unchanged relevant counts; the final golden comparison must be the intended
+failure. Report exact product hashes/counts and first assertion per mutation,
+plus enough mutation description to establish the real target. If a mutation
+is not reached, does not change the actual required product, changes counts,
+unexpectedly passes, or cannot be formed without production changes, stop
+and return the finding rather than weaken the requirement or expand scope.
+
+After exact restoration, build green and run the focused fact once again.
+Return frozen test hash (only the golden literal differs from66825e0bb),
+build/test counts and exit codes, raw evidence paths/hashes, and no live
+execution handle. Do not run a third corrective round. Expected mutation
+failures are discriminators, not repair rounds.
+
+C1c already owns the sixth missing-fixture mutation. Its unchanged shared
+25-frame consumer is rerun later by lead; do not create another parser path.
+Lead then performs the two sequential review lenses and commits the exact
+candidate, followed by two fresh focused processes on one clean checkpoint
+and official literal-hermetic/canonical-InstalledDat gates. All known
+nonpassing identities remain classified. C1a/G4 remain unpassed, no client
+launch, no FPS work, no known retail leak change, no main merge.