docs(overhaul): stop S4 c3a after final review

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -678,7 +678,7 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S4-c2 stop | **STOPPED UNLANDED 2026-09-04** — lead final-round contract `ac74fbd84`; evidence commit `c4cbc1d0d` in `s4-c2-impl` on `cc8e5677a`/`048d5b12f`; campaign renderer remains S4-c1 `766f9e749` | G3/G4 UNPASSED | Both sequential final lenses FAIL, so the required repair is the forbidden THIRD round. EnvCell transparent/ClipMap batches still draw in the opaque pass before FIFO submission and then redraw; CLIP/detail-immediate replay binds StraightAlpha with depth-write off rather than retail clip-test/depth-writing state; tests omit the preceding opaque call and pipeline descriptors. Source-owned EnvCell lists are unbounded under queue rejection, the claimed scan/filter/RHI 0-B evidence bypasses those paths, and AP-238/AP-240/result truth is false. Full file:line and gate record: S4 packet §13. No chunk cherry-pick, graphical gate, or soak. Resume only on explicit owner process change. |
 | S4-c2 owner repair | **STOPPED UNLANDED 2026-09-04** — owner-authorized implementation `a094bf2b7` is clean in `s4-c2-impl`; packet §15 is the review record | G3/G4 UNPASSED | The repaired renderer behavior passed the retail lens: exact whole-leaf pass membership, `0x08`/`0x09` CLIP, row-3 override, blend/reference/depth state, sentinel separation, detail state, rollback, allocation, AP-238/AP-240. The lens still returned FAIL: commit body omitted the required per-mutation first failures, packet mutation 5 names the wrong first assertion/address, and four source/test comments are stale. Sequential production lens therefore did not run. Correcting those items is a post-review fourth repair, which §14 does not authorize. Nothing landed or graphically gated; resume only by explicit owner process decision. |
 | S4-c2 attempts 1–5 | **ATTEMPT 1/5 CONSUMED; ATTEMPT 2/5 PASSED AND LANDED 2026-09-04** — reviewed implementation `daaeab0ba`; campaign stack `89f1e2676` → `9ccb61a8e` → `0aa166aa0` → `252886e84`; packet §17 | G3/G4 UNPASSED | Sequential retail/evidence then production/gate-honesty PASS. Fresh: Release 0W/0E; shader 32/32; affected 37/37; real allocation 2/2 at 0 B; production 239/239. Official no-retry hermetic 16,734/1: sole unchanged global `Console.Out` capture race, exact theory 2/2 isolated. InstalledDat 255/10 documented/1. Validation routes `selfgate-20260904-115818-s4c2-landed-route` and `selfgate-20260904-120025-s4c2-landed-g3b` PASS provisional. First soak failed on known #461/#462; retry and S4-c1 control both 9/9 graceful; stationary averages CPU p95 −0.01 ms, GPU p95 +0.16 ms, alloc p50 +1.2 KiB, update p95 −0.12 ms. Three attempts remain unused. |
-| S4-c3a | **CONTRACT READY — packet §18**. Fresh landed-source audit found the S4 chunk-2 “insertion sort” item was not actually implemented: production feeds the correct two-list FIFO in registry/static-then-dynamic/particle-tail order, while named retail `UpdateObjCell` + `CShadowPart::insertion_sort` orders each cell's object and particle parts by stable descending CYpt before append (`0x005A0690`, `0x005A0786`, `0x005A18A3`, `0x006B5130`) | G3/G4 UNPASSED | Port one per-cell pre-append CYpt order and object/particle delayed merge without sorting inside the FIFO or crossing a barrier; file the two narrow residuals AP-241/AP-242 in the same commit; keep sort-center facts until live. Then c3b deletes only proven dead residue and corrects `AlphaFlushCounts_*` truth. Old packet §4 is not dispatchable. |
+| S4-c3a | **STOPPED UNLANDED 2026-09-04 — owner attempts 3–5 exhausted; packet §19.** Scratch stack `44e2bc227b` → `b6bf6c131` → `eea5793d2` → `14397b14c` → `359061b82`; campaign renderer remains S4-c2 through `252886e84` and only c3a's contract `5c9da6fc2` is landed | G3/G4 UNPASSED | Attempt 3 retail FAIL: billboard particles used rendered/AABB center, plus stale prose. Attempt 4 retail re-review FAIL: real GfxObj with no Surface lost SortCenter. Attempt 5 retail PASS and production behavior/lifecycle/allocation/scope all clean, but gate-honesty FAIL: mutation #9 falsely says missing AP-241 first fails `Assert.Single`; the earlier AP-boundary `Assert.True` fails first. Correcting it is the forbidden third c3a fix round. No landing, graphical gate, c3b, or G3; resume only after explicit owner process change. |
 | S5 | — | G4 | fill |
 
 ---

docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md

@@ -1,10 +1,10 @@
-# Campaign OVERHAUL v2 — hand-off after S4 chunk 2 landing (2026-09-04)
+# Campaign OVERHAUL v2 — hand-off after S4-c3a stop (2026-09-04)
 
-**2026-09-04 current state:** the §13/§15 stops and packet §16 attempts remain
+**2026-09-04 current state:** S4-c2 remains LANDED through `252886e84`.
-the audit record. Owner-authorized attempt 2 passed both sequential reviews
+S4-c3a exhausted owner attempts 3–5 and is **STOPPED UNLANDED** by the mandatory
-and the complete S4-c2 stack is LANDED on the campaign branch through
+third-round rule; packet §19 is the exact record. The clean scratch candidate
-`252886e84`. Packet §17 and this file's §3 are binding; earlier “review then
+is `359061b82`, but nothing from it lands. c3b is locked and G3/G4 remain
-land” instructions are history only. G3/G4 remain unpassed.
+unpassed. Resume only after an explicit owner process change.
 
 ## 0. Read order
 
@@ -21,7 +21,8 @@ land” instructions are history only. G3/G4 remain unpassed.
    `feedback_every_new_pin_must_be_shown_to_fail`,
    `feedback_skip_ab_before_theorizing`, `feedback_verify_subagent_claims_against_source`,
    `feedback_agent_worktree_base`, `feedback_soak_numbers_need_same_session_type`).
-4. `docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md` — **§8 = the
+4. `docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md` — **§19 = the
+   binding S4-c3a stop record**; §18 = its contract; **§8 = the
    S4-c2 contract; §11 + §11.1 = the fix round 1 contract (M1–M8, A1–A8)**;
    §10 (the implementer's landing note) lives only in the chunk commit in
    worktree `s4-c2-impl` until the cherry-pick; §1–§4 what remains of S4.
@@ -55,6 +56,7 @@ Scratch worktrees (detached):
 | Worktree | At | Purpose |
 |---|---|---|
 | `s4-c2-impl` | `daaeab0ba` on `c4cbc1d0d` / `cc8e5677a` / `048d5b12f`; clean | retained immutable review source for landed attempt 2; both sequential lenses PASS |
+| `s4-c3a-impl` | `359061b82` on the five-commit scratch stack; clean | **STOPPED UNLANDED** after final retail PASS / production gate-honesty FAIL; immutable audit source, do not cherry-pick |
 | `s4-c1-impl` | `9ba8f013e` | retained S4-c1 baseline binary and same-session stationary-soak evidence |
 | `s2-final-ab` | `78068b2c` | S2-final binary for same-session perf A/B (keep) |
 | `s3-review-fix` | `6575cfcee` | pre-S4 control build; stalls at the foundry login (#462) — not usable as a control |
@@ -104,9 +106,8 @@ The reviewed implementation is `daaeab0ba`; the complete campaign stack is
 `89f1e2676` → `9ccb61a8e` → `0aa166aa0` → `252886e84`. Retail/evidence PASS
 preceded production/gate-honesty PASS. Fresh campaign build, focused, shader,
 allocation, graphical, and same-session stationary A/B gates pass as recorded
-below and in packet §17. Three of the five additional attempts remain unused.
+below and in packet §17. S4-c2 is closed. The remaining three owner attempts
-S4-c2 is closed. Next is packet §18's S4-c3a upstream-order repair,
+were consumed by S4-c3a and its two fix rounds; packet §19 is the binding stop.
-followed by a fresh S4-c3b deletion contract from the repaired landed code.
 
 **Historical state before the final round (kept for audit; do not execute its
 landing procedure):**
@@ -156,14 +157,12 @@ memory −17.7 MiB. G3/G4 remain unpassed.
 
 ## 4. After chunk 2
 
-1. **S4 chunk 3 — corrected into c3a order + c3b deletions.** The fresh landed
+1. **S4-c3a is STOPPED UNLANDED; c3b is locked.** Attempts 3–5 produced a
-   audit found the plan's chunk-2 `CShadowPart::insertion_sort` item is missing:
+   retail-correct, production-green scratch renderer, but the final production
-   production feeds the correct FIFO in registry/static-then-dynamic/particle-
+   lens caught one false mutation-first-failure sentence. Correcting it is the
-   tail order, not stable per-cell CYpt order. Packet §18 is c3a's binding
+   forbidden third c3a fix round. Packet §19 has the commits, review history,
-   contract: port the upstream object/particle order first. Only after dual
+   gates, and exact stop reason. Do not cherry-pick `359061b82`, write c3b, or
-   review and landing does the lead write c3b to delete proven dead camera/
+   start G3 without an explicit owner process change.
-   sort-center residue and re-check `AlphaFlushCounts_*` plus AP-238/AP-240.
-   Packet §4's 2026-09-03 deletion guess is explicitly not dispatchable.
 2. **G3 — S4's owner gate:** the lead runs `route-g3.txt` (13 matrix shots),
    `route-g3b.txt` (the capture poses; pose 15 now outdoors), `route-g3c.txt`
    (Nanto ×3, 300 s waits) with `pwsh -File tools/overhaul-selfgate/run-selfgate.ps1 -Label <l> -Route <file>`

docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md

@@ -1348,3 +1348,73 @@ isolation, two-list FIFO preservation, allocation/bounds/rollback, mutations,
 register count, allowed files, and every gate claim. A failed lens gets one
 bounded fix contract; a third fix round stops and is written up. Dual PASS
 lands c3a; the lead then writes c3b's deletion-only contract from that code.
+
+## 19. S4-c3a stop record — owner attempts 3–5 exhausted (2026-09-04)
+
+**STOPPED UNLANDED.** The clean scratch worktree
+`C:\Users\erikn\source\repos\acdream\.claude\worktrees\s4-c3a-impl`
+ends at `359061b8299dd77a2335935868b739b8295b9b0c`. Nothing from c3a was
+cherry-picked to the campaign branch; the campaign renderer remains the
+reviewed S4-c2 stack through `252886e84`, with this §18 contract at
+`5c9da6fc2`. c3b is locked and G3/G4 remain unpassed.
+
+The complete unlanded scratch stack is:
+
+1. `44e2bc227b` — initial c3a implementation;
+2. `b6bf6c131` — lead fix-round-1 contract;
+3. `eea5793d2` — fix round 1;
+4. `14397b14c` — lead fix-round-2 contract, explicitly the last round;
+5. `359061b82` — fix round 2.
+
+Attempt 3 failed the retail lens because billboard/mode-2–5 particles keyed
+CYpt from their rendered/AABB center instead of the GfxObj-authored
+`sort_center`; the same lens found one stale static-record-order comment.
+Fix round 1 separated authored and visual centers, applied particle scale and
+orientation to the authored point, made prepared payload reservation lazy,
+rolled back false/exception append exactly once, bounded preparation to 3,000
+CLIP plus 3,000 ALPHA candidates, and corrected the prose.
+
+Attempt 4 failed the retail re-review on one universal edge: a successfully
+decoded real GfxObj with no Surface DID was replaced by
+`ParticleGfxInfo.Default`, discarding its authored center. The installed scan
+found zero practical exposure (2,051 emitter records / 360 referenced GfxObjs,
+all with a nonzero first Surface DID), but retail's CYpt read is surface-
+independent. Fix round 2 preserved the decoded record and made only texture
+acquisition conditional; it also corrected the synthetic-fixture evidence
+wording.
+
+Attempt 5's final retail lens **PASSED**. It reconfirmed the paired executable
+and PDB, `CPhysicsPart::UpdateViewerDistance @0x0050E030`, stable descending
+per-cell order, combined static/dynamic membership, the real object/particle
+merge, building separation, unchanged two-list FIFO/router/row-5 behavior,
+and AP-241/AP-242/AP-243 truth/count in the scratch stack. Its focused
+reproduction passed 117/117.
+
+The final production/gate-honesty lens found no production, lifecycle,
+allocation, scope, register, or retained-memory defect. It nevertheless
+returned **FAIL** on one mandatory evidence error. The initial candidate's
+mutation ledger says renaming AP-241 first fails `Assert.Single`. The unchanged
+pin actually computes `rowIndex == -1` and first fails the earlier AP-section
+boundary `Assert.True` in `WalkStaticStreamPopulatorTests.cs`; `Assert.Single`
+is reached later. The other eighteen mutation claims match their actual first
+assertions. Correcting that sentence would be a third c3a fix round, forbidden
+by plan §5, packet §18.6, and the owner's explicit attempt limit. Therefore no
+evidence-only correction, landing, graphical gate, or c3b contract follows.
+
+Final read-only evidence on `359061b82`:
+
+- Release solution: 0 warnings / 0 errors;
+- focused §19 lane: 95/95; no-surface target: 1/1; final retail superset:
+  117/117;
+- AP boundary/count pin: 1/1; physical and unique AP counts: 162;
+- real allocation pins: 2/2 at 0 managed bytes;
+- shader/manifest/SPIR-V: 32/32;
+- one-shot hermetic artifact: 16,751 passed / 0 skipped / 0 failed at
+  `%TEMP%\acdream-s4-c3a-fix1-20260904-2215`;
+- inclusive InstalledDat artifact: 385 passed / 10 documented failures / 1
+  skip at `%TEMP%\acdream-s4-c3a-fix1-installed-inclusive-20260904-2222`;
+- `git diff --check`: PASS; scratch HEAD clean; no graphical client launched.
+
+Resume only after an explicit owner process change. The minimum mechanical
+correction is known, but the stop rule exists precisely to prevent a green
+renderer from bypassing a failed evidence contract.