docs(overhaul): contract s5 closeout witness harness

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -696,7 +696,7 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S5-#470 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL A/B PROVISIONAL PASS.** Campaign implementation stack `15a796c3a` -> `7506e5f14` -> `b333edb4f`; route `19b44e5e3`; reviewed scratch `51f974da4` -> `2cad9c84` -> `98c004aa7`; packet §§27–30. | G4 UNPASSED | Retail/behavior pass 2/10 and production pass 4/10 closed the two evidence-only findings. Fresh campaign Release 0W/0E and focused 48/48; exact scratch hermetic 16,976/16,976 and canonical InstalledDat 386/10/1, manifests 30/30. Pinned gate `logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1`: retail/off -> High -> retail/off, 3/3 PNGs, exit 0, graceful, no client; visual PASS provisional. The stale recipe-8 pre-route launch is excluded and recorded in §30. |
 | S5-#469 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL TRANSITION PROVISIONAL PASS.** Contract `809887524`; reviewed scratch `c09b6cf0f`; campaign implementation `94ddde69a`; route `62efc72cb`; packet §§31–32. | G4 UNPASSED | Retail/deviation pass 1/10 and production pass 2/10 both PASS with no finding. The two atmospheric vertex receivers keep retail's authored unnormalized `uLights` direction across every shadow gate; celestial direction remains for opt-in shadow/volumetric projection; IA-24 corrected in the same commit. Exact scratch: Release 0W/0E, focused 126/126, Vulkan 2/2, hermetic 16,983/16,983, InstalledDat 386/10/1. Fresh campaign Release 0W/0E, focused 82/82, Vulkan 2/2. Gate `logs/selfgate-20260905-040449-s5-469-lighting-transition-r1`: five PNGs, active 2,500-caster/four-cascade High rows, no near-black relight, exit 0/graceful, no client; visual PASS provisional. |
 | S5-c5 | **CLOSED + LANDED 2026-09-05; LEAD GRAPHICAL SMOKE PROVISIONAL PASS.** Contract `b77989c32`; campaign `bf53e2ad6` -> `e625dc4e6` -> `1b7ee4e58`; reviewed scratch tip `158656f0d`; packet §§33–35. | G4 UNPASSED | Retail/deletion pass 1/10 PASS. Production pass 2/10 found one static-field hole in the owner guard; fix round 1 reproduced both static-owner mutations, and production pass 3/10 PASS. Exact scratch hermetic 16,921/16,921, canonical InstalledDat 368/9/1, manifests 30/30. Fresh campaign Release 0W/0E, App 146/146, Core 8/8. A stale recipe-8 preflight is excluded; a non-destructive recipe-10 bake produced 2,237,865 keys with zero failures. Corrected gate `logs/selfgate-20260905-052130-s5-c5-landed-v10`: five PNGs, exit 0/graceful, no fatal/deleted-prefix match, no client left; geometry matches S5-c4, visual PASS provisional. |
-| S5 | IN FLIGHT — c1–c5 plus #470/#469 landed, review-closed, and provisionally self-gated; closeout C1 contracted; connected/performance C2 and G4 remain | G4 | Packet §§7 and 12–36 are binding. C1 runs the literal offline correctness/evidence matrix and may expose a missing deterministic-product-hash witness; then C2 runs lifecycle/performance and G4 follows. Never merge main before G4. |
+| S5 | IN FLIGHT — c1–c5 plus #470/#469 landed, review-closed, and provisionally self-gated; closeout C1 evidence complete; C1a narrow test harness contracted; connected/performance C2 and G4 remain | G4 | Packet §§7 and 12–37 are binding. C1 passed the literal offline matrix and confirmed two harness gaps: the unconsumed stair-arch walk fixture and no canonical runtime geometry/membership product hash. C1a closes those gaps without production changes; then C2 runs lifecycle/performance and G4 follows. Never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -3312,3 +3312,184 @@ production/gate-honesty lens review filters, provenance, manifests, negative
 results, and absence of retries. Any missing witness becomes a separately
 contracted narrow harness chunk; otherwise C1 closes and C2 runs the connected
 lifecycle/performance program.
+
+## 37. S5 closeout C1 result and C1a narrow harness contract — 2026-09-05
+
+### 37.1 C1 result: the offline matrix is green and two evidence gaps are real
+
+Section 36's code base was `29c05e48c8379678603efb8715f86ede04c775ea`;
+the executed clean contract tip was
+`aa51cb88b00c843f87aa48047f9f3ce939755909`. One OpenAI implementer ran each
+official gate exactly once, with no retry, edit, client launch, package bake,
+surrogate witness, or cleanup:
+
+```powershell
+& tools/run-release-gate.ps1 `
+  -ArtifactsDirectory artifacts/s5-closeout-c1-hermetic-aa51cb88b `
+  -TestFilter 'Lane!=InstalledDat&Lane!=Linux&Lane!=Manual&Lane!=Timing&Lane!=Live&Lane!=PreparedPackage'
+
+$env:ACDREAM_RUN_INSTALLED_DAT_TESTS='1'
+$env:ACDREAM_DAT_DIR='C:\Users\erikn\Documents\Asheron''s Call'
+& tools/run-release-gate.ps1 `
+  -ArtifactsDirectory artifacts/s5-closeout-c1-installeddat-aa51cb88b `
+  -SkipRestore -SkipBuild `
+  -TestFilter 'Lane=InstalledDat&Purpose!=Diagnostic'
+```
+
+The two temporary environment variables were removed after the second gate.
+
+- literal hermetic artifact
+  `artifacts/s5-closeout-c1-hermetic-aa51cb88b`: Release build 0 warnings / 0
+  errors, 16,942 passed / 0 failed / 0 skipped, manifest 32/32;
+- canonical InstalledDat artifact
+  `artifacts/s5-closeout-c1-installeddat-aa51cb88b`: 368 passed / the accepted
+  nine failures / one accepted look-in skip, manifest 30/30.
+
+The nonpassing identities match S5-c5 exactly. The skip is
+`WalkLookInGateSweepTests.Sweep_the_lookin_gate_decodes_against_the_street_fixture`.
+The failures are
+`WalkTraceConformanceTests.AlphaFlushCounts_CathedralArrival_MatchesRetailFrame2`,
+`WalkTraceConformanceTests.AlphaFlushCounts_CathedralLeak_MatchesRetailFrame2`,
+`WalkTraceConformanceTests.AlphaFlushCounts_CathedralStairArch_MatchesRetailFrame2`,
+`WalkTraceConformanceTests.AlphaFlushCounts_FoundryDeep_MatchesRetailFrame2`,
+`WalkTraceConformanceTests.AlphaFlushCounts_HoltburgDoorwayStill_MatchesRetailFrame2`,
+`WalkTraceConformanceTests.AlphaFlushCounts_TerraceEdge_MatchesRetailFrame2`,
+`WalkTraceConformanceTests.Oh_doorway_still_first_frame_diff`,
+`LayoutImporterInvisibleSweepTests.EveryAuthoredInvisibleWidget_StartsHiddenAcrossAllLayouts`,
+and
+`LayoutImporterMediaBearingChildSweepTests.MainGameUiAndChatInput_MediaBearingChildrenNowBuildAsRealWidgets`.
+The two summary JSON files identify the exact HEAD/branch, report
+`WorktreeDirty=false`, and their SHA manifests independently re-verify.
+
+The TRX map covers the focused App, Content, Core, Runtime, and Launcher
+requirements, including `BeginWalkFrame`, outside-view reassembly, retail
+membership, FIFO/barrier/order, material, degrade, visibility consumers,
+reset/abort/dispose, architecture guards, and the real warmed-allocation pins.
+It also proved two missing witnesses rather than hiding them:
+
+1. `cathedral-stair-arch.walk.log` is the only committed OH walk transcript
+   with no test consumer. Its `.alphadepth` sibling is consumed, but that is a
+   different product and cannot stand in for the walk transcript.
+2. No executable gate hashes a canonical runtime geometry product together
+   with the committed retail membership product. The existing installed-DAT
+   CellStruct hash covers counts/metadata rather than vertex/index values,
+   transforms, or membership; the scene digest is synthetic; and the existing
+   retail comparator uses test-assembled terrain and copied publication
+   dispatch. Equal source, package, log, or TRX hashes are not substitutes.
+
+These are test-harness gaps, not evidence of a renderer behavior defect. C1
+therefore closes as an honest offline inventory and C1a below is the required
+narrow correction before connected/performance C2.
+
+### 37.2 C1a scope: consume the sixth walk fixture
+
+Edit only the following walk tests for this half:
+
+- add `(OhRoot, "cathedral-stair-arch.walk")` to
+  `WalkOracleTraceTests.AllFixtures`, so the ordinary complete-frame parser
+  contract consumes the checked-in walk log; and
+- add a dedicated installed-DAT conformance test shaped like
+  `Oh_foundry_deep_reproduces_every_complete_frame_exactly` in
+  `WalkTraceConformanceTests`. Replay every complete marked stair-arch frame
+  and compare the complete eight-kind `Signature8` exactly. A row in
+  `Still_fixture_first_frame_reproduces_exactly` is insufficient because that
+  theory checks only `frames[1]`. Do not compare only event counts or borrow
+  the alpha-depth transcript.
+
+The new row must load the existing committed file. Do not recapture, rewrite,
+normalize, or manufacture a fixture. If the production replay cannot reproduce
+the row under the same adapter used by the other OH rows, return the exact
+first divergence as a finding; do not weaken the signature.
+
+### 37.3 C1a scope: canonical runtime geometry/membership product witness
+
+Add one InstalledDat App test class, plus at most one test-only data adapter if
+the class cannot remain readable. Production source, fixtures, package files,
+gate scripts, shaders, and register documents are out of scope. Each of two
+independent runs inside the test must open a fresh installed `DatCollection`
+and construct fresh extraction, physics, and membership owners. Use canonical
+cathedral landblock `0xF418FFFF` with origin `(0xF4,0x18)`, real region height
+data, complete EnvCells, and independent interior statics.
+
+Build through the real `LandblockBuildFactory.Build`. A test-only
+`IPreparedCollisionSource` may translate installed GfxObj, Setup, EnvCell, and
+CellStruct records through the existing `FlatCollisionAssetBuilder`
+flattening methods, but it may not compute membership. Read actual ordered
+EnvCell shell geometry through `DatPreparedAssetSource.Read` with the same
+`PreparedAssetRequest.EnvCellGeometry` product consumed by
+`ObjectMeshManager`; read every referenced Setup/GfxObj product through the
+same production extractor, including ordered Setup part placements. Publish
+membership through the real no-window production sequence on
+`LandblockPhysicsContentBuilder`: `BuildTerrainSurface`, `PublishPreparedCells`,
+`CacheBuildings`, `CachePreparedObjects`, `PhysicsEngine.AddLandblock`, then
+`PublishStaticCollision`. The test must not copy this branch dispatch or call
+`ShadowObjectRegistry.Register*` to construct the expected membership.
+
+Serialize a version-tagged binary product with explicit lengths and raw IEEE
+float bits, then SHA-256 it. The product must include:
+
+- geometry identities; every emitted vertex position, normal, and UV; every
+  index; semantic subset order and `SourceSurfaceIndex`, `RawSurfaceType`,
+  `RetailSurfaceMask`, and `IsCellShell`; ordered Setup part ids and full
+  transforms; and the actual placed cell/static transforms;
+- for every published owner, its `RetailCellArrayRoute`, its ordered CELLARRAY
+  from `TryGetRetailCellArray`, and every ordered per-cell `RetailPartEntry`
+  from `GetRetailPartEntriesInCell`: `EntityId`, `PartIndex`, `GfxObjId`,
+  `CellId`, and `ClipPlanesRequired`.
+
+Canonicalize only outer maps whose production semantics are unordered.
+CELLARRAY order, Setup-part order, subset order, index order, publication
+order, and per-cell entry order remain exact. Assert real shell geometry for
+cell `0xF4180104` with nonzero vertices/subsets/indices. Assert the
+production-built cathedral ramp Setup `0x020009A2` exists and that its seven
+parts produce 21 entries across the exact ordered CELLARRAY
+`[0xF4180112, 0xF4180113, 0xF4180009]`, all with
+`ClipPlanesRequired=true`. Assert at least one multi-cell product and one
+`BoundingBox` route. Return the per-domain counts plus geometry, membership,
+and combined hashes.
+
+Two fresh in-test runs must produce the same three hashes and exact counts.
+The focused test must also be run in two fresh test processes at the same
+clean commit, and its labeled digest/count output must agree. Equality only
+proves determinism, so pin the clean installed-DAT combined hash and the exact
+cathedral semantic facts above as correctness witnesses. If installed DAT
+identity differs from the campaign's accepted corpus, fail explicitly rather
+than refreshing the golden silently.
+
+The retail meaning remains the already-landed S2 contract: whole-part-array
+CELLARRAY calculation and ordered part insertion, anchored by named retail
+`CPhysicsObj::AddPartToShadowCells` (`0x00510e00`),
+`CPhysicsObj::add_shadows_to_cells` (`0x00514ae0`),
+`CObjCell::find_cell_list` (`0x0052b4e0`), and `CELLARRAY::add_cell`
+(`0x006b4ff0`). C1a changes no AC algorithm.
+
+### 37.4 Required discrimination, gates, and return
+
+Before committing, run and restore these mutations one at a time, recording
+the exact first failing assertion:
+
+1. change one serialized vertex float bit while preserving counts;
+2. swap two real subset indices while preserving counts;
+3. reverse two real ordered CELLARRAY cells or Setup parts before publication;
+4. flip the cathedral ramp's real `ClipPlanesRequired` value; and
+5. redirect the new stair-arch row to a nonexistent fixture.
+
+Each product mutation must be reached by the canonical corpus and must fail
+the pinned product proof, not merely a self-comparison. Restore every file
+byte-for-byte and prove `git diff --check` clean. Return one test-only commit,
+the exact changed-file list, all mutation transcripts, a zero-warning Release
+solution build, the new fixture-consumer and product-hash focused tests, then
+fresh official literal hermetic and canonical InstalledDat artifacts with
+verified manifests and exact nonpassing identities. Any production edit,
+fixture edit, hash-field omission, copied membership construction, new
+nonpassing identity, or inability to form a non-vacuous real product stops the
+chunk and returns a finding. No graphical client is authorized for C1a.
+
+Review is sequential. Retail/transcript pass 1 checks the exact committed
+fixture, `Signature8`, named-retail product/order meaning, field completeness,
+and golden discrimination. Production/gate-honesty pass 2 checks fresh-owner
+independence, real factory/mesh/publication reachability, absence of copied
+registration dispatch, canonicalization boundaries, InstalledDat lane
+provenance, manifest truth, and allowed scope. A failed lens gets one bounded
+fix contract; review stops only after pass 10. After C1a lands, C2 runs the
+connected lifecycle/performance closeout and G4 follows.