diff --git a/docs/ISSUES.md b/docs/ISSUES.md
index e2707ba0..7ebb0f5b 100644
--- a/docs/ISSUES.md
+++ b/docs/ISSUES.md
@@ -39,6 +39,16 @@ confirmed closed by the owner, 11 need a focused live gate, and 43 are safe to
 remain closed. See
 [`docs/research/2026-08-28-owner-closed-issue-validity-audit.md`](research/2026-08-28-owner-closed-issue-validity-audit.md).
 
+## #468 — Teleport to the Holtburg cottage doorway pose seats the player in the house-interior cell at a point outside its floor; the player falls through the world
+
+**Status:** OPEN — found 2026-09-04 by the lead while running the G3 self-gate's capture pose 15 (`tools/overhaul-selfgate/route-g3b.txt`, `/teleloc A9B4013F 133.603592 13.391837 96.330009 …`, the retail capture's EYE pose used as a player pose). Placement/collision, NOT Campaign OVERHAUL v2 (the frame it produces is a correct render of a player in free fall); tactical, own fix. START at `claude-memory/project_placement_cutover_closed.md` (#331) and `project_physics_collision_digest.md`.
+
+**Evidence (probe run `logs/selfgate-20260904-063313-hd-probe`, `ACDREAM_PROBE_FLAP=1 ACDREAM_PROBE_TELEPORT=1 ACDREAM_PROBE_PLACEMENT_FAIL=1`, Release `3e76f71d5`):** `live: teleport materialized - snapped to <134.06796, 17.36479, 96.33501> cell=0xA9B4013F` — the requested (133.60, 13.39) moved 4.0 m in +y and 0.46 m in +x by the placement resolve and was claimed by the INTERIOR cell 0xA9B4013F; `[flap-cam]` then holds `playerCell=0xA9B4013F player=(134.07,17.36,96.34)` with the camera sweep resolving the eye (1.66 m above, outside the house) to the OUTDOOR cell `viewerCell=root=0xA9B40029`; once simulation resumes the player falls with no floor under it — z 96.34 → 95.54 → 93.36 → 89.80 → … → −20 m and beyond, accelerating, still `playerCell=0xA9B4013F`. No `[place-fail]` line fired. The frame at the screenshot is the terrain seen from BELOW (a flat plane under blue fog with the hills along the top edge) — the same picture the landed S4-c1 runs `logs/selfgate-20260903-234030-s4c1-landed-g3b`, `…-235044-s4c1-landed-g3b2` and `logs/selfgate-20260904-062148-g3b-tip-a2` produced at this pose (all three seated at (134.07, 17.36) in 0x13F). The S3-state run `logs/selfgate-20260903-165634-g3b` seated the SAME request at `<133.60359, 17.391838, 96.33501> cell=0xA9B40029` (outdoors, on the cobbles in front of the door) and stood — so the placement resolve is not deterministic for this request, and the same +4.0 m y move happened in every run.
+
+**Reading:** the requested point lies in the cottage's doorway wall/threshold; the placement resolve walks it out (+4 m y in every run) and then either lands outdoors in 0x29 (stands) or 0.46 m east claiming the interior cell 0x13F at a point outside the interior volume (falls — no walkable floor in that cell's BSP under the point, and an indoor-classified object never consults the terrain). First checks: (1) which resolve moves the point 4 m (`AdjustSetPosition` validation? the server's own `/teleloc`? — compare the wire Position in `PlayerMovementController.CommitCanonicalTeleportFrame` with the snapped result); (2) why the containing pick returns 0x13F for a point the good run classified as 0x29 — `CellTransit.BuildCellSetAndPickContaining`'s keep-current tail (retail `find_cell_list` leaves the result null and the caller keeps `curr_cell`; at a teleport the 'current' cell is the REQUESTED cell) versus the outdoor XY-column candidate; (3) what differed between the S3-state run and the three later runs (hydration order at materialization? the previous position/heading?). A fall after a valid materialization is the #145/#138 family's opposite: the world was ready, the point was wrong. The pre-S4 A/B control could not run (#462 stalled the 6575cfcee build's login twice); no longer needed once the probe showed the fall.
+
+**Gate consequence:** route-g3b pose 15 is moved to the good run's standing point `/teleloc A9B40029 133.603592 17.391838 96.330009 0.977940 -0.143531 -0.022038 0.150157` (commit with this entry) so the G3 frame is deterministic; the original pose stays here as the reproduction.
+
 ## #467 — Running forward from the cathedral stairwell stops at the corridor mouth: the character runs in place
 
 **Status:** OPEN — found 2026-09-03 21:19 by the lead's #464 running reproduction (Release `590fbb66c`, local ACE, GM character with run skill 15230). Not a Campaign OVERHAUL v2 item (movement/collision, not world solidity); tactical, own fix.
@@ -152,6 +162,8 @@ a 0.1 ms median is flagged; the stationary sample already waits. Until then, jud
 
 ## #462 — Login reveal into an interior cell stays `ready=True materialized=False` for 180 s (foundry `0xA9B40176`)
 
+**Recurrence (lead, 2026-09-04):** the pre-S4 A/B control build (`6575cfcee`, worktree `s3-review-fix`) stalled at the login reveal in `0xA9B40176` (foundry) twice in a row — `logs/selfgate-20260904-042324-pre-s4-g3b` and `logs/selfgate-20260904-062354-pre-s4-g3b-2`: `event=readiness … ready=True` then never `materialized`, `event=cancel` at the graceful logout, process exit 0xE0434352 (#461 class). The S4-c1 tip logged in at the same cell fine minutes earlier; whether the stall is build- or timing-dependent is unknown.
+
 **Status:** OPEN — found 2026-09-03 by the Campaign OVERHAUL v2 G3 self-gate part C (`logs/selfgate-20260903-165745-g3c`, Release at `2fbfdf18a`).
 **Severity:** HIGH for automation, MEDIUM for play (a fresh login that never leaves portal space)
 **Component:** Runtime reveal generation (Login kind) — the readiness → materialization edge
diff --git a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md
index 6ec5d1f9..b474b5a9 100644
--- a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md
+++ b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md
@@ -674,7 +674,7 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S1 | `acf17246`, `b681717c`, `0840d5fb`, `e2543d0e`, `8c6563ca` (+ pin test) | G1 PASS 2026-09-02 | revert newest-first; then restore `acdream.recipe7.pak` over `acdream.pak` in the dev DAT dir (the recipe-8 consumer rejects a recipe-7 pak, and vice versa) |
 | S2 | `059b8883`, `5a2792d6`, `707d2803`, `afbd2410`, `75ea269d`, `c94a1a40`, `f6b4584b` | G2 PASSED 2026-09-03 (owner-confirmed after the chunk-6 haze fix; terrain punch carried to S4) | revert newest-first `c94a1a40` → `059b8883`; the registry's retail product and the walk's borrowed views go together — do not revert a middle chunk alone |
 | S3 | chunk 2: `be9b4c1f`, `2f5373c7`, `434a7df2`; chunk 3: `4ee2866a`, `651badc2`, `e10765aa`, `896c63fe`, `74ac7aa2`; chunk 1: `02a82881`, `be81475c`, `88c70072` | G3 | chunk 3: revert newest-first `74ac7aa2` → `4ee2866a` as one unit (the per-cell terrain, the slot key, the deferred batching and the per-frame diagnostic go together); chunk 2: revert newest-first `434a7df2` → `be9b4c1f` (the counter, the leaf split and the flag deletion go together) |
-| S4 | — | G3 | OPEN 2026-09-03 night. Packet `docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md`: §1 records that S3 chunk 2 already delivered S4's chunk-1 latch/gate/seal scope (the latch owner, the gated flush→stamp→clear→seal block, the counted seals); what remains of chunk 1 is small and dispatched as **S4-c1** (`s4-c1.js`, worktree `s4-c1-impl` at `6385f4411`, contract = packet §6): C0 the far-punch constant — `portal_depth.vert` carries `0.99999988` = bits `0x3F7FFFFE`, retail's is `0x3F7FFFEF` (15 ULPs nearer; the depth spec's "wrong constant" row was right; lead bit check 2026-09-03) → retail's exact bits + a source pin; C1 the ±12 local-input reject at both portal-polygon producers (Ghidra table row 0x59BCD6–0x59BD28); C2 the portal-depth color-state register row (ColorWrite off vs retail's zero-alpha blend, identical output); C3 the depth truth-table Theory, the cross-frame latch test, look-ins isolated from the root latch. Chunk 2 = the two-FIFO alpha-list cutover (packet §3); chunk 3 = deletions (packet §4). G3 is S4's owner gate; the lead's S3-state G3 pre-run (20/20 frames, in the S3 row) is the baseline to diff against. | **S4-c1 ROUND 0 = `c7ab5b6d8` (Sonnet), THREE LENSES FAIL (2026-09-03 21:00–21:20):** one BLOCKING defect seen by all three — the ±12 guard's quantifier is inverted (rejects on ANY vertex on ANY plane; retail's PDB-paired bytes at 0x59BCD6–0x59BD66 reject only when EVERY vertex lies on the SAME plane) — and the LEAD's §6 paraphrase carried the same inversion (corrected in §6; lesson saved to memory: quote the decomp predicate, never paraphrase it). The production lens's DAT scan: 2,889 portal polygons carry a ±12 vertex and 2,163 EXIT polygons lie ENTIRELY on a ±12 plane — so the guard is very likely retail's never-sealed 'panel' mechanism (the #456/#465 family), which makes the PM/PC depth-event transcript comparison against the four alphadepth captures the chunk's real gate (never run in round 0). Also: the register-test gate is vacuous (no test reads the register), the manifest comment's ULP direction is inverted. C0 (retail's exact far-punch bits, verified at the binary), C2 (AD-119) and C3 (three new truth-table/latch pins, nine mutation texts) verified. FIX ROUND 1 = S4 packet §7 (`s4-c1-fix1.js`, dispatched 21:20): the four per-plane predicates at both producers with five-case T2, the seal count order, the automated PM/PC gate over the captures (a diverging pose is tagged KnownFailure and written up, never weakened), comment truth. **S4-c2 CONTRACT DRAFTED** (packet §8, 2026-09-03 21:50): two FIFO lists of 3000, the spec §4 router as one pure function, the four flush sites (the sort-cell EXIT valve as a new walk event kind), `FlushFartherThan`/AP-34/every viewer distance deleted, and the AM/FL transcript gate over the five captures (10,556 `AM` lines, all `clip=0`; `FL` by site 13,705/309/18/23) as the proof; dispatched only after c1 lands. **S4-c1 FIX ROUND 1 = `2bd353234` (Sonnet, 295 tool calls), THREE LENSES 2026-09-03 22:07–23:00: retail-faithful PASS, production PASS, gate-honesty FAIL.** Confirmed at the bytes: the four per-plane accumulators at both producers, the count-after-guard order, the PM/PC gate's reading of retail's lines; five transcript poses pass (cathedral-arrival, cathedral-leak, foundry-deep, holtburg-doorway-still) with terrace-edge tagged KnownFailure. Findings, all on that one row plus one pin gap: (blocking) the KnownFailure write-up claims the PC sequence matches — false and never evaluated (the PM assert throws first); (major ×2) the divergence is a harness initial-condition choice — seed `portalsDrawnCount` from the fixture's first observed counter and the row turns green while the two-pass priming retires; (major) T2's five cases do not discriminate 'every vertex on SOME plane' from retail's 'every vertex on the SAME plane'; (minor ×4) stale seal-path summaries, an unobservable mutation named in the F2 pin's comment, doc-comment DAT figures an independent scan does not fully reproduce, a vacuous 'register tests' gate claim. The lead's own replay of the gate at `2bd353234` with the new `cathedral-stair-arch` capture added as a sixth Fact PASSES (its seed value is 8). **FIX ROUND 2 = packet §9 (the LAST round; dispatched 23:10):** seed the counter from the fixture (one pass), compare and print both sequences together, the discriminating ±12 case, the sixth pose, comment truth. **FIX ROUND 2 = `9ba8f013e` (Sonnet; on the two cherry-picked capture commits), THREE LENSES 2026-09-03 23:10–23:38: retail PASS (byte evidence: `portalsDrawnCount` has exactly one increment site 0x59BD74 and one reset site 0x5A489E under `view_count > 0`, `forceClear` has no writer; the discriminating case is admitted by retail's four per-plane accumulators), production PASS (round-2 src diff = comment text only; no pin weakened; gates reproduce on a fresh Release build), gate-honesty FAIL on comment truth only (the terrace-edge Fact's comment claimed a PC match that seeding, not the pre-fix state, produced; the stair-arch comment states a rejection count the PM/PC tuple cannot observe; a DAT-scan comment cites a pin that does not pin). All six transcript poses PASS (terrace-edge's KnownFailure removed; seed values 0/0/1/2/2/8). **S4-c1 LANDED 2026-09-03 23:38–23:40** as `d1e3e64f6` + `5de42a12f` + `323f5a334` (cherry-picks of rounds 0–2) + `766f9e749` (the LEAD corrected the four flagged sentences — a third implementer round is barred by §5; code unchanged; owner to review). Landing gates: Release 0 warnings; six transcript Facts 6/6; hermetic 6,833/6,833; InstalledDat 249 pass / 4 known (#383 ×2, TowerAscent, #458) / 1 skip. Landing self-gates: route.txt four poses `logs/selfgate-20260903-234934-s4c1-landed-route2` (Facility panels present, mean RGB (79,20,25)); capture poses `logs/selfgate-20260903-234030-s4c1-landed-g3b` and `…-235044-s4c1-landed-g3b2` — frames 13/14/16 in band, **frame 15 (holtburg-doorway) shows an empty plane under fog TWICE** where the S3-state run `logs/selfgate-20260903-165634-g3b` showed the village. Lead read 2026-09-04: the server snapped the requested y 13.39→17.39 in every run; the CLIENT then seated the player in the house-interior cell `0xA9B4013F` at (134.07, 17.36) in both landed runs versus the outdoor cell `0xA9B40029` at (133.60, 17.39) in the S3-state run (0.46 m apart on the doorway threshold), so the frame roots from the interior cell with the eye outside — a placement/membership boundary at the doorway, not a draw change; S4-c1 touched no placement code. A pre-S4 control at `6575cfcee` (`s3-review-fix/logs/selfgate-20260904-042324-pre-s4-g3b`) produced 0 frames: the login reveal at `0xA9B40176` never went visible (#462 class) and the process exited 0xE0434352 after the graceful logout (#461 class) → INCONCLUSIVE; the A/B re-run (landed tip twice + pre-S4 once) is owed before any further self-gate is trusted at that pose. **S4-c2 DISPATCH 2026-09-03 23:41 DIED** on the account's session limit / credit exhaustion with no commit; worktree `s4-c2-impl` reset clean at `766f9e749`. Session handed to a new account 2026-09-04 morning; ACE was NOT running at hand-over (no UDP 9000 listener), so every connected gate waits on the owner starting it. **HAND-OFF 2026-09-04 morning:** `docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md` (read order, landed state, the S4-c2 implementer dispatched ~08:35 into `s4-c2-impl`, the #464 RenderDoc plan, the Holtburg doorway A/B, owner-owed items, tooling gotchas, paste-prompt). **OWNER 2026-09-04 morning: running `766f9e749`, reports the cathedral stairwell artifact (#464) appears FIXED** — plausible mechanism = S4-c1's ±12 reject now drops the 12 hall-doorway punches retail also rejects; PROVISIONAL until the lead re-runs `route-464-tilt3.txt` at the tip and diffs frame `01-neg160` against `logs/selfgate-20260903-225434-464-tilt3` (owner client running — not launched yet). **S4-c2 IMPLEMENTER DONE 2026-09-04 09:35: `048d5b12f` in `s4-c2-impl`** (19 files, +1,697/−543): two FIFO lists + `RetailAlphaMeshRouter` + `SortCellExit` event + four flush sites, `FlushFartherThan`/viewer distance deleted; hermetic 6,855/6,855; shader classes 32/32; InstalledDat 249 pass + the 4 known + SIX new KnownFailure Facts. Implementer's own deviations for the lead to rule on: (a) C4 (EnvCell transparent subsets through the queue) NOT done; (b) AP-34 not retired but narrowed into AP-236 (EnvCell-immediate residual) + AP-237 (AlphaBlend cannot tell retail's ALPHA from the Translucent+ClipMap CLIP override; cloud GfxObj 0x01004C35); (c) G-c2's per-list drained-count dimension is KnownFailure on ALL six poses because the hermetic harness carries no mesh content — only the (site, threshold) sequence matches. REVIEW ROUND 1 dispatched. **REVIEW ROUND 1 (2026-09-04 ~10:00–10:40): retail lens FAIL** — every core predicate confirmed exact at the bytes (list select, 0xbb8 capacity, `test ah,5; jp` strict-less on both counts → 2250 drains, CLIP-then-ALPHA, rows 1–5, the four call sites, ::flush=0.75f, delay 0x0E, SortCellExit at 0x5a1a07 under the DrawSortCell gate); BLOCKING: the particle site's 'rows 1/2/4/5 unreachable' assert throws on an Opaque-classified mesh-particle batch (data-driven row 5; `TryAppendMeshDraws` filters nothing); MAJOR: the CLIP list is structurally unreachable for ordinary content (ClipMap kinds are `IsOpaque`, drawn alpha-to-coverage; 4,183/10,556 captured AM entries are CLIP) with no register row; contract C3's detail input hardcoded false while building shells reach the alpha path and the DRAIN applies the detail pass retail's replay never has (`DrawBuilding` installs `building_detail_surface` @0x0059f2eb before its flush/shell draw → row 1 immediate); `IsFirstForList` = first-since-drain where retail's `new` is per-DrawMesh-invocation (`0059d4cc/0059d4d0`; captures new=1 on 9,685/10,556); gate G-c2 all-KnownFailure → zero CI signal and zero SortCellExit drains exercised; MINOR: AP-237's cloud example is disproven (Type 0x10114 carries alpha-family bits → mask 0x02 both sides), DrawBlock cited at its loop head 0x005a18d0 instead of 0x005a17c0, 'return site' = the call address. Lead verification concurs and adds C4 (EnvCell detail-off append is bounded — `RenderTransparentOrdered` exists). **FIX ROUND 1 = packet §11 (M1–M8)**; **production/gate lens FAIL** (all four claimed gates reproduced, four mutation checks re-performed): same blocking particle throw; the count gate is unmatchable by construction (CLIP structurally empty — 75 % of cathedral-arrival's expected drains are CLIP — and per-instance vs per-subset cardinality); a THIRD production `FlushLandscapeAlpha` caller (`RetailPViewRenderer.cs:485`, the #132 outdoor-root drain) is mislabelled as retail's DrawCells flush, which never runs on an outdoor root; AP-236 REUSES an id filed and retired on main by #132; the unreachability enumeration lists masks that cannot occur; `ApplyScratchRetention` passes the entry count as the source count; §10 sequences off by one; the 'independent' router oracle is the same if-chain. Recorded as packet §11.1 (A1–A8). **FIX ROUND 1 DISPATCHED** (one Sonnet implementer in `s4-c2-impl` on `048d5b12f`, contract §11 + §11.1). **#464 CONFIRMED FIXED at `766f9e749` (2026-09-04 08:15 UTC+2, lead scripted route `logs/selfgate-20260904-061530-464-tilt3-s4c1`):** identical probe eye to the 2026-09-03 artifact run, solid wall above the arch, hall columns gone; matrix row 'Cathedral stairwell, camera zoomed out' = PASS (provisional).
+| S4 | — | G3 | OPEN 2026-09-03 night. Packet `docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md`: §1 records that S3 chunk 2 already delivered S4's chunk-1 latch/gate/seal scope (the latch owner, the gated flush→stamp→clear→seal block, the counted seals); what remains of chunk 1 is small and dispatched as **S4-c1** (`s4-c1.js`, worktree `s4-c1-impl` at `6385f4411`, contract = packet §6): C0 the far-punch constant — `portal_depth.vert` carries `0.99999988` = bits `0x3F7FFFFE`, retail's is `0x3F7FFFEF` (15 ULPs nearer; the depth spec's "wrong constant" row was right; lead bit check 2026-09-03) → retail's exact bits + a source pin; C1 the ±12 local-input reject at both portal-polygon producers (Ghidra table row 0x59BCD6–0x59BD28); C2 the portal-depth color-state register row (ColorWrite off vs retail's zero-alpha blend, identical output); C3 the depth truth-table Theory, the cross-frame latch test, look-ins isolated from the root latch. Chunk 2 = the two-FIFO alpha-list cutover (packet §3); chunk 3 = deletions (packet §4). G3 is S4's owner gate; the lead's S3-state G3 pre-run (20/20 frames, in the S3 row) is the baseline to diff against. | **S4-c1 ROUND 0 = `c7ab5b6d8` (Sonnet), THREE LENSES FAIL (2026-09-03 21:00–21:20):** one BLOCKING defect seen by all three — the ±12 guard's quantifier is inverted (rejects on ANY vertex on ANY plane; retail's PDB-paired bytes at 0x59BCD6–0x59BD66 reject only when EVERY vertex lies on the SAME plane) — and the LEAD's §6 paraphrase carried the same inversion (corrected in §6; lesson saved to memory: quote the decomp predicate, never paraphrase it). The production lens's DAT scan: 2,889 portal polygons carry a ±12 vertex and 2,163 EXIT polygons lie ENTIRELY on a ±12 plane — so the guard is very likely retail's never-sealed 'panel' mechanism (the #456/#465 family), which makes the PM/PC depth-event transcript comparison against the four alphadepth captures the chunk's real gate (never run in round 0). Also: the register-test gate is vacuous (no test reads the register), the manifest comment's ULP direction is inverted. C0 (retail's exact far-punch bits, verified at the binary), C2 (AD-119) and C3 (three new truth-table/latch pins, nine mutation texts) verified. FIX ROUND 1 = S4 packet §7 (`s4-c1-fix1.js`, dispatched 21:20): the four per-plane predicates at both producers with five-case T2, the seal count order, the automated PM/PC gate over the captures (a diverging pose is tagged KnownFailure and written up, never weakened), comment truth. **S4-c2 CONTRACT DRAFTED** (packet §8, 2026-09-03 21:50): two FIFO lists of 3000, the spec §4 router as one pure function, the four flush sites (the sort-cell EXIT valve as a new walk event kind), `FlushFartherThan`/AP-34/every viewer distance deleted, and the AM/FL transcript gate over the five captures (10,556 `AM` lines, all `clip=0`; `FL` by site 13,705/309/18/23) as the proof; dispatched only after c1 lands. **S4-c1 FIX ROUND 1 = `2bd353234` (Sonnet, 295 tool calls), THREE LENSES 2026-09-03 22:07–23:00: retail-faithful PASS, production PASS, gate-honesty FAIL.** Confirmed at the bytes: the four per-plane accumulators at both producers, the count-after-guard order, the PM/PC gate's reading of retail's lines; five transcript poses pass (cathedral-arrival, cathedral-leak, foundry-deep, holtburg-doorway-still) with terrace-edge tagged KnownFailure. Findings, all on that one row plus one pin gap: (blocking) the KnownFailure write-up claims the PC sequence matches — false and never evaluated (the PM assert throws first); (major ×2) the divergence is a harness initial-condition choice — seed `portalsDrawnCount` from the fixture's first observed counter and the row turns green while the two-pass priming retires; (major) T2's five cases do not discriminate 'every vertex on SOME plane' from retail's 'every vertex on the SAME plane'; (minor ×4) stale seal-path summaries, an unobservable mutation named in the F2 pin's comment, doc-comment DAT figures an independent scan does not fully reproduce, a vacuous 'register tests' gate claim. The lead's own replay of the gate at `2bd353234` with the new `cathedral-stair-arch` capture added as a sixth Fact PASSES (its seed value is 8). **FIX ROUND 2 = packet §9 (the LAST round; dispatched 23:10):** seed the counter from the fixture (one pass), compare and print both sequences together, the discriminating ±12 case, the sixth pose, comment truth. **FIX ROUND 2 = `9ba8f013e` (Sonnet; on the two cherry-picked capture commits), THREE LENSES 2026-09-03 23:10–23:38: retail PASS (byte evidence: `portalsDrawnCount` has exactly one increment site 0x59BD74 and one reset site 0x5A489E under `view_count > 0`, `forceClear` has no writer; the discriminating case is admitted by retail's four per-plane accumulators), production PASS (round-2 src diff = comment text only; no pin weakened; gates reproduce on a fresh Release build), gate-honesty FAIL on comment truth only (the terrace-edge Fact's comment claimed a PC match that seeding, not the pre-fix state, produced; the stair-arch comment states a rejection count the PM/PC tuple cannot observe; a DAT-scan comment cites a pin that does not pin). All six transcript poses PASS (terrace-edge's KnownFailure removed; seed values 0/0/1/2/2/8). **S4-c1 LANDED 2026-09-03 23:38–23:40** as `d1e3e64f6` + `5de42a12f` + `323f5a334` (cherry-picks of rounds 0–2) + `766f9e749` (the LEAD corrected the four flagged sentences — a third implementer round is barred by §5; code unchanged; owner to review). Landing gates: Release 0 warnings; six transcript Facts 6/6; hermetic 6,833/6,833; InstalledDat 249 pass / 4 known (#383 ×2, TowerAscent, #458) / 1 skip. Landing self-gates: route.txt four poses `logs/selfgate-20260903-234934-s4c1-landed-route2` (Facility panels present, mean RGB (79,20,25)); capture poses `logs/selfgate-20260903-234030-s4c1-landed-g3b` and `…-235044-s4c1-landed-g3b2` — frames 13/14/16 in band, **frame 15 (holtburg-doorway) shows an empty plane under fog TWICE** where the S3-state run `logs/selfgate-20260903-165634-g3b` showed the village. Lead read 2026-09-04: the server snapped the requested y 13.39→17.39 in every run; the CLIENT then seated the player in the house-interior cell `0xA9B4013F` at (134.07, 17.36) in both landed runs versus the outdoor cell `0xA9B40029` at (133.60, 17.39) in the S3-state run (0.46 m apart on the doorway threshold), so the frame roots from the interior cell with the eye outside — a placement/membership boundary at the doorway, not a draw change; S4-c1 touched no placement code. A pre-S4 control at `6575cfcee` (`s3-review-fix/logs/selfgate-20260904-042324-pre-s4-g3b`) produced 0 frames: the login reveal at `0xA9B40176` never went visible (#462 class) and the process exited 0xE0434352 after the graceful logout (#461 class) → INCONCLUSIVE; the A/B re-run (landed tip twice + pre-S4 once) is owed before any further self-gate is trusted at that pose. **S4-c2 DISPATCH 2026-09-03 23:41 DIED** on the account's session limit / credit exhaustion with no commit; worktree `s4-c2-impl` reset clean at `766f9e749`. Session handed to a new account 2026-09-04 morning; ACE was NOT running at hand-over (no UDP 9000 listener), so every connected gate waits on the owner starting it. **HAND-OFF 2026-09-04 morning:** `docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md` (read order, landed state, the S4-c2 implementer dispatched ~08:35 into `s4-c2-impl`, the #464 RenderDoc plan, the Holtburg doorway A/B, owner-owed items, tooling gotchas, paste-prompt). **OWNER 2026-09-04 morning: running `766f9e749`, reports the cathedral stairwell artifact (#464) appears FIXED** — plausible mechanism = S4-c1's ±12 reject now drops the 12 hall-doorway punches retail also rejects; PROVISIONAL until the lead re-runs `route-464-tilt3.txt` at the tip and diffs frame `01-neg160` against `logs/selfgate-20260903-225434-464-tilt3` (owner client running — not launched yet). **S4-c2 IMPLEMENTER DONE 2026-09-04 09:35: `048d5b12f` in `s4-c2-impl`** (19 files, +1,697/−543): two FIFO lists + `RetailAlphaMeshRouter` + `SortCellExit` event + four flush sites, `FlushFartherThan`/viewer distance deleted; hermetic 6,855/6,855; shader classes 32/32; InstalledDat 249 pass + the 4 known + SIX new KnownFailure Facts. Implementer's own deviations for the lead to rule on: (a) C4 (EnvCell transparent subsets through the queue) NOT done; (b) AP-34 not retired but narrowed into AP-236 (EnvCell-immediate residual) + AP-237 (AlphaBlend cannot tell retail's ALPHA from the Translucent+ClipMap CLIP override; cloud GfxObj 0x01004C35); (c) G-c2's per-list drained-count dimension is KnownFailure on ALL six poses because the hermetic harness carries no mesh content — only the (site, threshold) sequence matches. REVIEW ROUND 1 dispatched. **REVIEW ROUND 1 (2026-09-04 ~10:00–10:40): retail lens FAIL** — every core predicate confirmed exact at the bytes (list select, 0xbb8 capacity, `test ah,5; jp` strict-less on both counts → 2250 drains, CLIP-then-ALPHA, rows 1–5, the four call sites, ::flush=0.75f, delay 0x0E, SortCellExit at 0x5a1a07 under the DrawSortCell gate); BLOCKING: the particle site's 'rows 1/2/4/5 unreachable' assert throws on an Opaque-classified mesh-particle batch (data-driven row 5; `TryAppendMeshDraws` filters nothing); MAJOR: the CLIP list is structurally unreachable for ordinary content (ClipMap kinds are `IsOpaque`, drawn alpha-to-coverage; 4,183/10,556 captured AM entries are CLIP) with no register row; contract C3's detail input hardcoded false while building shells reach the alpha path and the DRAIN applies the detail pass retail's replay never has (`DrawBuilding` installs `building_detail_surface` @0x0059f2eb before its flush/shell draw → row 1 immediate); `IsFirstForList` = first-since-drain where retail's `new` is per-DrawMesh-invocation (`0059d4cc/0059d4d0`; captures new=1 on 9,685/10,556); gate G-c2 all-KnownFailure → zero CI signal and zero SortCellExit drains exercised; MINOR: AP-237's cloud example is disproven (Type 0x10114 carries alpha-family bits → mask 0x02 both sides), DrawBlock cited at its loop head 0x005a18d0 instead of 0x005a17c0, 'return site' = the call address. Lead verification concurs and adds C4 (EnvCell detail-off append is bounded — `RenderTransparentOrdered` exists). **FIX ROUND 1 = packet §11 (M1–M8)**; **production/gate lens FAIL** (all four claimed gates reproduced, four mutation checks re-performed): same blocking particle throw; the count gate is unmatchable by construction (CLIP structurally empty — 75 % of cathedral-arrival's expected drains are CLIP — and per-instance vs per-subset cardinality); a THIRD production `FlushLandscapeAlpha` caller (`RetailPViewRenderer.cs:485`, the #132 outdoor-root drain) is mislabelled as retail's DrawCells flush, which never runs on an outdoor root; AP-236 REUSES an id filed and retired on main by #132; the unreachability enumeration lists masks that cannot occur; `ApplyScratchRetention` passes the entry count as the source count; §10 sequences off by one; the 'independent' router oracle is the same if-chain. Recorded as packet §11.1 (A1–A8). **FIX ROUND 1 DISPATCHED** (one Sonnet implementer in `s4-c2-impl` on `048d5b12f`, contract §11 + §11.1). **#464 CONFIRMED FIXED at `766f9e749` (2026-09-04 08:15 UTC+2, lead scripted route `logs/selfgate-20260904-061530-464-tilt3-s4c1`):** identical probe eye to the 2026-09-03 artifact run, solid wall above the arch, hall columns gone; matrix row 'Cathedral stairwell, camera zoomed out' = PASS (provisional). **Holtburg doorway frame RESOLVED — not render (2026-09-04 08:40): the player FALLS through the world at that pose** (probe run `logs/selfgate-20260904-063313-hd-probe`: seated in interior cell 0xA9B4013F at a floorless point, z 96 → −20 m; the frame is the terrain from below); filed **#468** (placement, tactical); route-g3b pose 15 moved to the good run's outdoor standing point in 0xA9B40029; the pre-S4 control stalled twice at login (#462 recurrence noted).
 | S5 | — | G4 | fill |
 
 ---
diff --git a/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md b/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md
index 51b89952..8d2f39a8 100644
--- a/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md
+++ b/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md
@@ -271,6 +271,8 @@ Read `docs/ISSUES.md` #464 in full first. Compressed state:
 
 ## 5. Open question: the Holtburg doorway frame (before trusting any self-gate there)
 
+> **RESOLVED 2026-09-04 08:40 — not a render question.** The probe run `logs/selfgate-20260904-063313-hd-probe` shows the player seated in the interior cell at a floorless point and FALLING (z 96 → −20 m); the frame is the terrain seen from below. Filed as #468 (placement, tactical). route-g3b pose 15 now teleports to the good run's outdoor standing point. The text below is the pre-resolution record.
+
 `tools/overhaul-selfgate/route-g3b.txt` frame 15 (`holtburg-doorway`,
 `/teleloc A9B4013F 133.603592 13.391837 96.330009 …`): the landed build's runs
 `logs/selfgate-20260903-234030-s4c1-landed-g3b` and `…-235044-s4c1-landed-g3b2`
diff --git a/tools/overhaul-selfgate/route-g3b.txt b/tools/overhaul-selfgate/route-g3b.txt
index f33d555e..da12fb2d 100644
--- a/tools/overhaul-selfgate/route-g3b.txt
+++ b/tools/overhaul-selfgate/route-g3b.txt
@@ -23,7 +23,9 @@ sleep 6000
 screenshot 14-capture-cathedral-arrival 15000
 
 # holtburg-doorway-still (walk log frame 2 P line)
-command /teleloc A9B4013F 133.603592 13.391837 96.330009 0.977940 -0.143531 -0.022038 0.150157
+# #468: the capture's eye pose (A9B4013F 133.60 13.39) lands in the doorway wall and the placement resolve
+# sometimes seats the player in the interior cell at a floorless point (free fall); use the good run's standing point outdoors.
+command /teleloc A9B40029 133.603592 17.391838 96.330009 0.977940 -0.143531 -0.022038 0.150157
 sleep 2000
 wait world-visible 90000
 sleep 6000
diff --git a/tools/overhaul-selfgate/route-holtburg-doorway-probe.txt b/tools/overhaul-selfgate/route-holtburg-doorway-probe.txt
new file mode 100644
index 00000000..03063b24
--- /dev/null
+++ b/tools/overhaul-selfgate/route-holtburg-doorway-probe.txt
@@ -0,0 +1,13 @@
+# Holtburg doorway capture pose (route-g3b frame 15) alone, for the placement/camera-root probes.
+# Run with ACDREAM_PROBE_FLAP=1 ACDREAM_PROBE_TELEPORT=1 ACDREAM_PROBE_PLACEMENT_FAIL=1.
+
+wait world-visible 180000
+sleep 4000
+
+command /teleloc A9B4013F 133.603592 13.391837 96.330009 0.977940 -0.143531 -0.022038 0.150157
+sleep 2000
+wait world-visible 90000
+sleep 6000
+screenshot hd-01-doorway 15000
+
+close-client