diff --git a/docs/ISSUES.md b/docs/ISSUES.md
index e5f87b71..2b2b01f0 100644
--- a/docs/ISSUES.md
+++ b/docs/ISSUES.md
@@ -39,6 +39,59 @@ confirmed closed by the owner, 11 need a focused live gate, and 43 are safe to
 remain closed. See
 [`docs/research/2026-08-28-owner-closed-issue-validity-audit.md`](research/2026-08-28-owner-closed-issue-validity-audit.md).
 
+## #462 — Login reveal into an interior cell stays `ready=True materialized=False` for 180 s (foundry `0xA9B40176`)
+
+**Status:** OPEN — found 2026-09-03 by the Campaign OVERHAUL v2 G3 self-gate part C (`logs/selfgate-20260903-165745-g3c`, Release at `2fbfdf18a`).
+**Severity:** HIGH for automation, MEDIUM for play (a fresh login that never leaves portal space)
+**Component:** Runtime reveal generation (Login kind) — the readiness → materialization edge
+
+**Symptom:** the previous run (part B) logged out gracefully inside the Manikin Foundry
+(`0xA9B40176`, the foundry-deep capture pose). The next launch logged in there:
+`[world-reveal] event=begin generation=1 kind=Login cell=0xA9B40176 indoor=True radius=0` (`client.log:83`),
+readiness reached `render=True composites=True collision=True ready=True`, but `materialized` never
+flipped; the probe's `wait world-visible 180000` timed out (`:231`) and the eventual cancel line
+(`:254`) still reads `ready=True materialized=False completed=False cancelled=True`. INTERMITTENT:
+the same character logged into the same cell three times within ten minutes — part B
+(`selfgate-20260903-165634-g3b`, `client.log:208`) and part C attempt 2
+(`selfgate-20260903-170456-g3c`, `:207`) materialized normally; only part C attempt 1 stalled. The
+attempt that stalled launched 15 s after part B's graceful logout of the same character, so a
+server-side teardown race (ACE still releasing the previous session's objects while the new login's
+CreateObject stream arrives) is the first suspect; a client-side readiness/materialization race is
+the second. `radius=0` on a Login reveal reads oddly next to the Portal kind's `radius=25` — confirm
+it is the intended Login value before reading anything into it.
+
+**Consequence:** the aborted script requested a graceful logout, which then crashed the client (#461).
+
+**Fix direction:** reproduce headlessly (a Headless session config pointing the character at an
+interior cell — the character is parked in `0xA9B40176` right now on the local ACE), read the reveal
+owner's materialization condition for `kind=Login` (`RuntimeWorldRevealState` / the J6.2 latch), and
+add the deterministic world-lifecycle case for "fresh login inside an EnvCell" — the existing lifecycle
+automation covers fresh login outdoors, travel, and revisit, not this.
+
+## #461 — Inbound motion update after a graceful logout mutates the retired movement controller and crashes the process
+
+**Status:** OPEN — found 2026-09-03 by the Campaign OVERHAUL v2 G3 self-gate part C (`logs/selfgate-20260903-165745-g3c/client.err.log`, Release at `2fbfdf18a`).
+**Severity:** HIGH (unhandled exception, exit code `0xE0434352`, on an ordinary logout race)
+**Component:** `LiveEntityNetworkUpdateController.OnMotion` → `PlayerMovementController.SetLastMoveWasAutonomous` after `RuntimeLocalPlayerMovementState` retired the controller
+
+**Stack (verbatim head):** `System.InvalidOperationException: A sealed, retired, or discarded Runtime
+movement controller cannot be mutated.` at `PlayerMovementController.EnsureConfigurationMutable`
+(`PlayerMovementController.cs:1049`) ← `SetLastMoveWasAutonomous` (`:1785`) ←
+`LiveEntityNetworkUpdateController.OnMotion` (`LiveEntityNetworkUpdateController.cs:645`) ←
+`LiveEntitySessionController.OnMotionUpdated` (`:65`) ← `LiveSessionEventRouter` (`:554`) ←
+`WorldSession.ProcessDatagram` (`WorldSession.cs:2138`) ← `WorldSession.Tick` (`:1423`) ←
+`LiveSessionController.Tick` (`:726`) ← `UpdateFrameOrchestrator.Tick` (`:187`) ← `GameWindow.OnUpdate`
+(`GameWindow.cs:1781`). Sequence in `client.log`: `[session] graceful logout requested` (`:252`),
+`graceful logout confirmed` (`:253`), the Login reveal cancelled (`:254`), two `[stat-chain]` lines,
+then the crash — a `0xF74C`/`0xF625`-class motion update for the local player arrived after the
+controller was retired by the logout, and the inbound route still forwards it to the controller.
+
+**Fix direction:** the inbound motion route must consult the controller's lifetime (the same
+sealed/retired state `EnsureConfigurationMutable` throws on) and drop local-player motion once the
+session is logging out — the J5.4/J5.7 terminal ledger owns that state; retail discards inbound
+movement for a character that has left the world. Add the ordered-teardown test: logout confirmed →
+a late `UpdateMotion` for the local player → no throw, no mutation.
+
 ## #460 — Shutdown hangs windowless at 100 % of one core after a close request that follows an aborted automation script (Nanto pose)
 
 **Status:** OPEN — found 2026-09-03 by the Campaign OVERHAUL v2 G3 self-gate (`logs/selfgate-20260903-162027-g3`, Release at `5b43d8d55`).