docs(overhaul): record s5 closeout retail capture stop

docs/ISSUES.md

@@ -39,6 +39,41 @@ confirmed closed by the owner, 11 need a focused live gate, and 43 are safe to
 remain closed. See
 [`docs/research/2026-08-28-owner-closed-issue-validity-audit.md`](research/2026-08-28-owner-closed-issue-validity-audit.md).
 
+## #472 — Stair-arch walk fixture cannot distinguish retail e229 residency from block rejection
+
+**Status:** OPEN — blocks Campaign OVERHAUL v2 S5 closeout C1a and G4; one
+targeted owner retail capture is required.
+**Severity:** EVIDENCE BLOCKER (no production renderer defect established)
+**Component:** InstalledDat walk-conformance harness / retail capture corpus
+
+**Finding:** the new exact replay of all four complete frames in
+`cathedral-stair-arch.walk.log` stops at the same three aligned differences.
+Replay adds `LC/SC:e2290001`; separately, the test recorder omits retail's
+second `EC:f4180106` in two floods because it emits one EC per cell instead of
+one per live view. Production already emits EC per captured `SliceCount`, so
+the latter is test instrumentation only.
+
+Static retail evidence cannot classify e229. In
+`LScape::draw_check_blocks @0x00505F80`, retail emits no land-cell turn both
+when the ring slot is null (`0x00506184`) and when a resident block's
+`Render::block_check @0x005061DF` returns `OUTSIDE`. The committed transcript
+contains neither residency nor rejected checks. The replay builder eagerly
+loads every extant DAT block; production correctly permits unstreamed null
+slots. Although e229's ring-18 boundary is consistent with AD-118, applying
+that precision deviation without proving retail residency would be a guess.
+
+**Required capture:** at the exact fixture F1 pose
+`P f4180114 421e545d 4187e406 4336c9e1 3f800000 b71e18af 30947ee4 348114b1`,
+reuse the two #458 templates under `tools/walk-oracle/oh/`, targeting DID
+`0xE229FFFF`. Preserve a complete blockset plus the filtered block-check
+intervals, z slab, and verdicts as
+`cathedral-stair-arch-e229.blockset.log` and `.blockcheck.log`.
+
+**Acceptance:** null slot contracts a replay-residency correction. Resident
+plus `OUTSIDE` contracts the test-only EC multiplicity correction and classifies
+e229 under existing AD-118. Do not change production, normalize the fixture,
+or add a KnownFailure before this fact is observed. Packet §38 is authoritative.
+
 ## #471 — Production walk-ordered building detail was classified but never rendered
 
 **Status:** DONE — fixed by Campaign OVERHAUL v2 S5-c4 at `03a108ffa`

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -696,7 +696,7 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S5-#470 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL A/B PROVISIONAL PASS.** Campaign implementation stack `15a796c3a` -> `7506e5f14` -> `b333edb4f`; route `19b44e5e3`; reviewed scratch `51f974da4` -> `2cad9c84` -> `98c004aa7`; packet §§27–30. | G4 UNPASSED | Retail/behavior pass 2/10 and production pass 4/10 closed the two evidence-only findings. Fresh campaign Release 0W/0E and focused 48/48; exact scratch hermetic 16,976/16,976 and canonical InstalledDat 386/10/1, manifests 30/30. Pinned gate `logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1`: retail/off -> High -> retail/off, 3/3 PNGs, exit 0, graceful, no client; visual PASS provisional. The stale recipe-8 pre-route launch is excluded and recorded in §30. |
 | S5-#469 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL TRANSITION PROVISIONAL PASS.** Contract `809887524`; reviewed scratch `c09b6cf0f`; campaign implementation `94ddde69a`; route `62efc72cb`; packet §§31–32. | G4 UNPASSED | Retail/deviation pass 1/10 and production pass 2/10 both PASS with no finding. The two atmospheric vertex receivers keep retail's authored unnormalized `uLights` direction across every shadow gate; celestial direction remains for opt-in shadow/volumetric projection; IA-24 corrected in the same commit. Exact scratch: Release 0W/0E, focused 126/126, Vulkan 2/2, hermetic 16,983/16,983, InstalledDat 386/10/1. Fresh campaign Release 0W/0E, focused 82/82, Vulkan 2/2. Gate `logs/selfgate-20260905-040449-s5-469-lighting-transition-r1`: five PNGs, active 2,500-caster/four-cascade High rows, no near-black relight, exit 0/graceful, no client; visual PASS provisional. |
 | S5-c5 | **CLOSED + LANDED 2026-09-05; LEAD GRAPHICAL SMOKE PROVISIONAL PASS.** Contract `b77989c32`; campaign `bf53e2ad6` -> `e625dc4e6` -> `1b7ee4e58`; reviewed scratch tip `158656f0d`; packet §§33–35. | G4 UNPASSED | Retail/deletion pass 1/10 PASS. Production pass 2/10 found one static-field hole in the owner guard; fix round 1 reproduced both static-owner mutations, and production pass 3/10 PASS. Exact scratch hermetic 16,921/16,921, canonical InstalledDat 368/9/1, manifests 30/30. Fresh campaign Release 0W/0E, App 146/146, Core 8/8. A stale recipe-8 preflight is excluded; a non-destructive recipe-10 bake produced 2,237,865 keys with zero failures. Corrected gate `logs/selfgate-20260905-052130-s5-c5-landed-v10`: five PNGs, exit 0/graceful, no fatal/deleted-prefix match, no client left; geometry matches S5-c4, visual PASS provisional. |
-| S5 | IN FLIGHT — c1–c5 plus #470/#469 landed, review-closed, and provisionally self-gated; closeout C1 evidence complete; C1a narrow test harness contracted; connected/performance C2 and G4 remain | G4 | Packet §§7 and 12–37 are binding. C1 passed the literal offline matrix and confirmed two harness gaps: the unconsumed stair-arch walk fixture and no canonical runtime geometry/membership product hash. C1a closes those gaps without production changes; then C2 runs lifecycle/performance and G4 follows. Never merge main before G4. |
+| S5 | **STOPPED at C1a on #472's retail-live fact** — c1–c5 plus #470/#469 landed, review-closed, and provisionally self-gated; closeout C1 evidence complete; C1a exact transcript attempt stopped clean; connected/performance C2 and G4 remain | G4 | Packet §§7 and 12–38 are binding. C1 passed the literal offline matrix. C1a proved the stair transcript's two missing `EC:f4180106` tokens are a test-recorder multiplicity defect while the extra `LC/SC:e2290001` cannot be classified statically: retail may have had no resident e229 slot, or a resident slot may have failed `block_check`. Scratch returned clean with no commit/gate/client. One targeted retail blockset/blockcheck capture at the exact fixture pose unblocks the bounded test-only correction and geometry/membership witness. Never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -1,7 +1,8 @@
 # Campaign OVERHAUL v2 — S5 consumers, material, and closeout packet
 
-**Status:** S5-c1 through S5-c4 plus #470/#469 LANDED + REVIEW-CLOSED with lead
+**Status:** S5-c1 through S5-c5 plus #470/#469 LANDED + REVIEW-CLOSED with lead
-graphical gates PROVISIONAL PASS; S5-c5, closeout, and G4 remain.
+graphical gates PROVISIONAL PASS; closeout C1 passed; C1a is STOPPED on the
+retail-live fact in #472; connected/performance C2 and G4 remain.
 **Branch:** `claude/campaign-w-retail-frame-walk`.
 **Gate:** G4 remains unpassed. Nothing merges to `main` before G4.
 
@@ -3493,3 +3494,98 @@ registration dispatch, canonicalization boundaries, InstalledDat lane
 provenance, manifest truth, and allowed scope. A failed lens gets one bounded
 fix contract; review stops only after pass 10. After C1a lands, C2 runs the
 connected lifecycle/performance closeout and G4 follows.
+
+## 38. S5 closeout C1a stopped result — one observer defect and one unrecoverable static fact
+
+### 38.1 The contracted exact transcript gate stopped before landing
+
+The OpenAI implementer worked in the clean scratch worktree
+`s5-closeout-harness` at contract base
+`4237a6b2b3d4e51ec0948257e2ff6f951b08c97c`. The ordinary parser consumer for
+`cathedral-stair-arch.walk.log` passed, and a draft of the independent
+geometry/membership digest formed a real product, but the required every-frame
+`Signature8` comparison failed. Section 37.4 says that inability to reproduce
+the committed fixture stops the whole chunk. The implementer therefore made no
+commit, ran no official gate or mutation, changed no production source or
+fixture, launched no client, and restored the scratch worktree clean at the
+contract base. The draft product hash is not evidence and is deliberately not
+landed or quoted as a golden.
+
+All four complete marked frames have the same exact alignment:
+
+- retail tokens: 2,158; replay tokens: 2,158; LCS: 2,156;
+- tokens 0 through 374 agree;
+- replay inserts `LC:e2290001` and `SC:e2290001` at replay positions 375–376;
+- retail contains a second consecutive `EC:f4180106` at retail position 2,126
+  and another at 2,141; replay emits one at each site.
+
+Per-frame `WalkLandscapeDatBuilder.SetViewer`, one discarded same-pose warmup,
+and both together produce the identical edit script in every frame. This is
+not stale viewer state, a first-frame-only effect, or a broad sequence shift.
+
+### 38.2 The two missing EC tokens are a test-recorder defect, not renderer behavior
+
+Retail `PView::DrawCells` (`0x005A4840`) reads a flood cell's live view count at
+`0x005A4AA9` and loops `setup_view` plus `RenderDeviceD3D::DrawEnvCell` at
+`0x005A4AB1–0x005A4ACC`; the paired bytes contain the `47 4B 75 E8` loop. Its
+object/`OC` pass remains once per cell at `0x005A4ADE–0x005A4B1A`.
+
+The InstalledDat test recorder instead calls
+`WalkTraceReplayContext.AppendFloodTurns`, which emits one `EC` per cell. Its
+own class comment already names this known limit and says S5 must remove it.
+Production is already correct: `WalkFrameDriver.EmitFloodTurns` captures each
+cell's route and prints one `EC` per `SliceCount`, then keeps one object turn per
+cell. The eventual test-only correction is bounded: while the callback still
+owns the live flood state, read each cell's `TopView.ViewCount`, emit that many
+`EC` tokens in reverse-cell order, then one `OC` per cell. It must not change
+production or weaken `Signature8`.
+
+### 38.3 The e229 cause cannot be recovered statically
+
+The named retail decomp and paired executable prove two distinct no-`LC`
+causes inside `LScape::draw_check_blocks` (`0x00505F80`): the
+`land_blocks` slot is null at `0x00506184`, or a resident block's
+`Render::block_check` call at `0x005061DF` returns `OUTSIDE`. The paired bytes
+at the latter site are `E8 6C 7A 04 00` (call `0x0054DC50`) followed by
+`85 C0 74 0E`. `WalkLandscape.CheckBlocks` has the same control-flow shape.
+
+The replay test builder eagerly installs every extant DAT block in its 51 × 51
+grid. Production `WalkLandscapeAssembler` deliberately leaves unstreamed slots
+null. The walk transcript records only submitted `LC`/`SC` turns; it does not
+record retail residency or rejected block checks. Therefore absence of
+`LC:e2290001` cannot distinguish the two retail causes from static evidence.
+The block is a one-cell coarse ring-18 block, so AD-118's measured D3D/x87
+edge-plane boundary is the strongest hypothesis, but applying that row without
+the missing residency/verdict fact would be speculation. No production
+visibility change, `KnownFailure`, fixture normalization, or new divergence
+row is authorized.
+
+The retail lens reverified the paired binary: executable SHA-256
+`006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1`, CodeView
+GUID `{9E847E2F-777C-4BD9-886C-22256BB87F32}`, age 1.
+
+### 38.4 Exact owner capture that unblocks C1a
+
+Issue #472 owns the stop. Reuse
+`tools/walk-oracle/oh/oh-capture-blockset.cdb.template` and
+`oh-capture-blockcheck.cdb.template`, changing the filtered DID to
+`0xE229FFFF`, at the exact first complete-frame pose from the committed
+fixture:
+
+```text
+P f4180114 421e545d 4187e406 4336c9e1 3f800000 b71e18af 30947ee4 348114b1
+```
+
+Keep the output as
+`cathedral-stair-arch-e229.blockset.log` and
+`cathedral-stair-arch-e229.blockcheck.log` beside the other OH captures. The
+blockset must prove whether retail has a resident e229 slot. If it is resident,
+the filtered capture must record every active-view interval vector, the z slab,
+and each `block_check` verdict. A null slot contracts a replay-residency harness
+correction; resident plus `OUTSIDE` contracts the test-recorder correction and
+classifies the remaining difference under AD-118. Any different result gets a
+new bounded contract from the observed facts.
+
+This is the campaign's explicit “retail fact cannot be recovered statically”
+stop condition. C1a, connected/performance C2, and G4 do not proceed until the
+capture exists. Nothing has merged to `main`.