docs(overhaul): capture retail cathedral ramp membership

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -862,6 +862,16 @@ No production/FPS changes and no new intentional deviation. Full evidence:
 `477-cathedral-recurrence.md`. Actual initiating GPU fault and C1a retail
 membership closure remain unresolved; short clean runs do not close #477/G4.
 
+**Direct retail membership2026-09-05 17:58+02:** owner-authorized paired2013
+read-only snapshots now prove the ramp's retained set is exactly
+F4180112/F4180113/F4180009 (21 entries); loaded F4180114 has zero ramp parts.
+Both installed source DAT pairs hash-identical. This contradicts the existing
+complete-production four-cell/28-entry result and rules out blessing that
+golden. `c1a-retail-membership-capture.md`, packet§61. AP159 repair still needs
+its bounded scope/input/containment proof; no production change or new
+intentional deviation, no AMD-cause inference. Debugger detached, both
+owner-held clients remain open. FPS deferred; C1a/#477/G4 remain unclosed.
+
 ## 14. Risk register (condensed)
 
 - **R1 second scene graph.** Graph records own only topology/membership facts;

docs/research/2026-09-01-overhaul/c1a-bridge-audit-finding.md

@@ -1,5 +1,12 @@
 # C1a bridge audit — contract finding, no golden or production change
 
+**17:58+02 follow-up:** owner-authorized direct paired-retail snapshots now
+establish F4180112/F4180113/F4180009,21 ramp entries; loaded F4180114 contains
+zero ramp references. Both installed source DAT pairs hash-identical.
+`c1a-retail-membership-capture.md` supersedes the unknown-live-set portion of
+this earlier audit, not its unimplemented repair/scope boundary. No four-cell
+golden, production repair, visual-cause or AMD-cause claim is justified.
+
 2026-09-05, after final lighting verification. The existing C1a test-only
 contract remains blocked as written. The complete publication setup calls
 `CacheBuildings`; the older three-cell comparator does not. Full production

docs/research/2026-09-01-overhaul/c1a-retail-membership-capture.md

@@ -0,0 +1,110 @@
+# C1a cathedral ramp — direct retail membership capture
+
+2026-09-05, 17:58 +02. Result: **retail retains three cells / 21 part entries,
+not the complete-production diagnostic's four cells / 28 entries**. This
+settles the previously unknown live retail set for this installed scene. It
+does not identify the initiating AMD fault or close C1a/G4.
+
+## Authority and exact target
+
+Owner started retail and explicitly requested debugger attachment while their
+manual AcDream check remained open. ACE UDP9000/PID13340, AcDream PID25724
+(17:51:27+02), retail PID35048 (17:52:32+02), and absence of another debugger
+were checked first. No client launch, build, test suite, gameplay input,
+memory write, breakpoint, target function call, or process closure was used.
+
+Retail executable: `C:\Turbine\Asheron's Call\acclient.exe`, SHA256
+`006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1`.
+CodeView matches GUID `9e847e2f-777c-4bd9-886c-22256bb87f32`, age1.
+Live `lmv` confirms image base00400000, private matching
+`C:\Users\erikn\source\repos\acdream\refs\acclient.pdb`, version11.4186.
+
+Full SHA256 comparisons of both installed source directories
+(`C:\Turbine\Asheron's Call` and `C:\Users\erikn\Documents\Asheron's Call`):
+
+| File | Identical SHA256 in both directories |
+|---|---|
+| client_cell_1.dat | 6DB0ABF00FBCEED62C3F1EE842EE7C1F423D732BED77A5B7C102EE89A52AB99E |
+| client_portal.dat | DC6E500BA22E6B186DB7171E3F3345238B6444C85D798ADC85E550973B8D12E4 |
+
+Ordinary Get-FileHash could not share retail's open DAT handles; a read-only
+FileStream with FileShare.ReadWrite completed both hashes without closing
+retail or modifying files. No package regeneration or equivalence claim.
+
+## Method and result
+
+First inspect PDB layouts with non-invasive, non-suspending `cdb -pvr`.
+Then take two brief coherent snapshots with non-invasive `cdb -pv`; each
+command completed in under one second and ended at top-level `qd`.
+No debugger remained afterward; both original client PIDs still existed.
+
+Named `CPhysicsObj::add_shadows_to_cells`00514AE0 copies the CELLARRAY count
+and IDs into the retained owner array, then publishes each cell's part
+shadows. PDB-confirmed offsets: CPhysicsObj part_array10, position48,
+num_shadow_objects94, shadow_objects98; CShadowObj stride18, owner0C,
+cell_id10, cell14; CPartArray setup54/parts_count58/parts5C; CObjCell
+m_DID28/num_shadow_parts3C/shadow_part_list40; CShadowPart part0C;
+CPhysicsPart ownerE0/indexE4. These are hexadecimal offsets.
+
+Find F4180112 in `CEnvCell::visible_cell_table` (191 buckets/45 elements),
+walk its four static objects, and match the actual CSetup DID020009A2.
+Exactly one owner matches: 1AA34A00, physical rootF4180112, seven parts.
+Part0 GfxObj01001FE8; parts1–6 GfxObj01001FE6. Viewer cellF4180109.
+Read that owner's retained shadow array, then independently count references
+to that exact owner in each cell's retained shadow-part list. This is not a
+camera-visible draw subset, player FindCellList, or the old advisory PD cell.
+
+| Owner-array order | Cell | Ramp part entries |
+|---|---|---|
+| 0 | F4180112 | 7 |
+| 1 | F4180113 | 7 |
+| 2 | F4180009 | 7 |
+| absent | F4180114 | 0 |
+
+Both snapshots independently return the same owner array and21 retained
+entries. The confirmation additionally finds F4180114 at16F72178,
+loaded=1, constructed_mesh17C6FA90, with84 total shadow parts and **zero
+references to the ramp owner**. Thus absence is not merely an unloaded cell.
+The raw18-dword owner array corroborates the three structured ID records.
+Part-relative retained order is0,1,6,5,2,4,3 in each sampled member cell;
+absolute slots and other-object counts change between snapshots. These are
+observations, not a universal cross-owner ordering golden or a fresh-process
+repeat. Interior shadows have num_planes1; outdoor shadows0. Do not equate
+that count directly with our consumer's clipRequired flag.
+
+## Evidence, limits and next boundary
+
+All scripts and raw logs, including discarded attempts, are preserved under
+`artifacts/s5-c1a-retail-membership-20260905/` in the campaign worktree.
+
+| Evidence file | SHA256 |
+|---|---|
+| cathedral-retail-recon-20260905-r3.log | B50BFAE97CF5E6217A3A630C5E2E514803A8F9F4E6FDE2EDC234D8F3BDE1B58D |
+| cathedral-retail-roots-20260905.log | 3271C19A8D821EED6962B1D0151E20995A12CE47268631D063AF45EEF61E8002 |
+| cathedral-retail-membership-20260905-r2.log | 88BA5336E404E5AB1048E3B55CF96D93FB30DB6FB46408F16193B46C63449962 |
+| cathedral-retail-membership-20260905-confirm.log | A36DDA025BDD26B40D54AD2D0B919E47AD3E3BF9015C4F10D32907C571131DA7 |
+| cathedral-retail-membership-20260905-confirm.cdb | FD27FFB12ECBCAB91AF823F84D0128B9D225FA93FF4E530B567D237C9031C37E |
+
+Discarded attempts: debugger rejected `-netsym:no` before attachment;
+non-invasive mode rejected the redundant `-pd` before attachment; the first
+membership script rejected C-style `&&` (MASM needs `and`), then detached.
+None supplies membership evidence. The corrected snapshots above contain
+one matching owner, complete end markers, no expression/memory-read error,
+and explicit detach. No production implementation/fix round was consumed.
+
+Compared with the existing complete-publication result
+F4180112/F4180113/F4180009/F4180114 (28 entries), this proves a retained-set
+discrepancy for the ramp. Existing AP-159 identifies the sphere-only building
+bridge as the suspect; this capture does not yet prove which exact bridge
+predicate/input first diverges. It does not prove the owner's visual symptom
+or AMD crash was caused by this extra membership. Known retail cathedral
+visual quirks remain unchanged.
+
+Do not amend the witness to four cells. Preserve its three-cell expectation
+and placeholder hash. A production bridge repair still needs its separately
+bounded contract and independent input/containment checks described in
+`c1a-bridge-audit-finding.md`; the direct live result supplies the missing
+expected-set evidence, not the unimplemented repair. AP-159 remains open;
+no new intentional deviation. FPS deferred. G4 FAIL, no main merge.
+Both clients remain owner-held; no builds/tests/closure during their check.
+This is a memory-capture result, not a graphical gate: no PNG PASS claimed.

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -5055,3 +5055,22 @@ FAIL/open: roughly2–3-minute diagnostic routes cannot clear the observed
 roughly16-minute ordinary crash. Next useful evidence is longer ordinary
 reproduction plus first-acquire-failure preservation under a bounded contract,
 not repeating the same short clean route. C1a remains independently unclosed.
+
+## 61. Direct retail cathedral membership — 2026-09-05
+
+Owner opened retail and explicitly authorized read-only debugger attachment
+alongside their manual AcDream check. Paired2013 executable/PDB confirmed;
+two bounded non-invasive snapshots agree: Setup020009A2, physical rootF4180112,
+seven parts, retained cells F4180112/F4180113/F4180009,21 entries. Loaded
+F4180114 has84 other shadow parts and zero references to the ramp owner.
+Both installed cell/portal DAT pairs hash-identical. The complete-production
+four-cell/28-entry diagnostic therefore differs from directly observed retail;
+do not amend the original three-cell witness to four.
+
+`c1a-retail-membership-capture.md` records exact offsets, artifacts/hashes,
+discarded debugger-script attempts and limits. This supplies the missing
+live expected set, not independent proof of the first divergent predicate or
+a production AP159 repair. Neither a visual-cause nor AMD-cause claim follows.
+No source/package/FPS change or new intentional deviation. Debugger detached;
+AcDream25724 and retail35048 remain open for owner, ACE13340 stays up. No
+builds/tests/closure while owner checks. C1a/AP159 and #477/G4 remain open.