docs(roadmap+milestones): mark A6.P1/A6.P2 shipped; update M1.5 demo

A6.P1 (cdb probe spike) + A6.P2 (analysis report) both SHIPPED this
session. Updated:

  docs/plans/2026-04-11-roadmap.md — M1.5 phase block now shows A6.P1
  + A6.P2 SHIPPED with commit refs; A6.P3 entry expanded with the
  Finding-2-first sequencing recommendation from A6.P2; A6.P4 entry
  notes the original "Holtburg Sewer end-to-end" acceptance walk is
  unreachable (sewer doesn't exist).

  docs/plans/2026-05-12-milestones.md — M1.5 demo scenario split into
  building/cellar half (achievable post-A6.P3) + dungeon half (blocked
  on issue #95 visibility blowup; promote to post-M1.5 if #95 isn't
  fixed in scope). Issue list updated: added #95 + indoor sling-out
  (new from scen4); marked stairs/2nd-floor/cellar as characterized by
  A6.P2 Finding 2 family.

  CLAUDE.md — Currently-working-toward block now points at A6.P3 as
  the active phase. A6.P1 + A6.P2 ship noted with the findings doc
  pointer. Demo-scenario note updated to reflect the sewer + #95
  reality. Issues-in-scope updated.

Also includes a 1-line trailing-prompt addition to scen3 + scen4
retail.log files (cdb wrote one more `0:000>` after the kill that
landed after the original capture commits).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/plans/2026-04-11-roadmap.md

@@ -142,27 +142,55 @@ successfully 2026-04-30 for the steep-roof case. Matching binaries
 (acclient.exe v11.4186) + PDB present.
 
 **Sub-pieces (slices):**
-- **A6.P1 — cdb probe spike** (~3 days). Build cdb scripts capturing
-  retail's per-tick state at 9 scenarios:
-  - 4 building sites: Holtburg inn doorway, inn stairs, inn 2nd floor,
-    cottage cellar.
-  - 5 dungeon sites: Holtburg Sewer entry portal, first stair descent,
-    inter-room portal transition, open central area, dark corridor.
-  Breakpoints on `set_collide`, `step_sphere_up`, `step_sphere_down`,
-  `transitional_insert`, `set_contact_plane`, `validate_walkable`.
-  Mirror with our equivalent probes (`[indoor-bsp]`, `[cp-write]`,
-  new `[push-back]`).
-- **A6.P2 — Analysis report** (~1 day). Quantify the per-call-site
-  gap. Identify which BSP path(s) over- or under-correct. Output:
-  1–3 specific bug findings with retail decomp anchors.
-- **A6.P3 — Fix the BSP correction paths** (~3–5 days). Surgical
-  fixes informed by A6.P2 data. Likely touches `BSPQuery.AdjustSphereToPlane`,
-  `AdjustOffsetToPlane`, Path 5 / Path 6 branches, sub-step state
-  mutation.
-- **A6.P4 — Remove workarounds** (~1 day). Revert #90 sphere-overlap
-  stickiness in `PhysicsEngine.ResolveCellId`. Delete
-  `Transition.TryFindIndoorWalkablePlane` + its caller in
-  `FindEnvCollisions`. Verify behavior holds without the workarounds.
+- **✓ SHIPPED — A6.P1 — cdb probe spike** (2026-05-21). Built cdb
+  scripts (`tools/cdb/a6-probe.cdb` v4 with PDB-verified offsets +
+  hex-bits float output + Python decoder), PowerShell runner with
+  ASCII encoding, PDB-match verification, and the new
+  `[push-back]`/`[push-back-disp]`/`[push-back-cell]` acdream probe
+  family (env `ACDREAM_PROBE_PUSH_BACK=1`). Captured 5 of 9 scenarios
+  with paired retail+acdream traces (scen1 inn doorway, scen2 inn
+  stairs, scen3 inn 2nd floor, scen4 cottage cellar, scen5 town
+  network portal as substitute for Holtburg Sewer entry). Scen6-9
+  cancelled — Holtburg Sewer doesn't exist on this server, and any
+  substitute dungeon hits issue #95 (portal-graph visibility blowup)
+  on portal entry, making physics-only analysis impossible. Five
+  captures are sufficient evidence for A6.P2. Commits: infra Tasks
+  1-14 + cdb iterations + scen1 capture (prior session); scen2-5
+  captures (`a9a427f`, `297d1c5`, `4b5aebc`, `46c6e08`, `35d5c58`)
+  + issue #95 filing (`5be784e`) (this session).
+- **✓ SHIPPED — A6.P2 — Analysis report** (2026-05-21, `184933d`).
+  Output: [`docs/research/2026-05-21-a6-cdb-capture-findings.md`](../research/2026-05-21-a6-cdb-capture-findings.md).
+  Four findings ready for A6.P3: Finding 2 (ContactPlane resynthesis
+  blowup — 250× to ∞× more CP writes in acdream; primary M1.5 root
+  cause) is HIGH severity and the highest-confidence single-cause
+  fix candidate. Finding 1 (dispatcher entry frequency mismatch —
+  4× to 281× fewer dispatcher entries in acdream) is likely a
+  secondary effect of Finding 2's missing retention paths. Finding 3
+  (indoor cell-resolver sling-out captured in scen4) — HIGH severity,
+  separate fix surface in ResolveCellId/CheckBuildingTransit.
+  Finding 4 (portal-graph visibility blowup discovered incidentally
+  in scen5) — filed as issue #95, scope-adjacent, handled outside A6.
+  Tables 1+2 (per-site push-back delta + path-frequency diff)
+  deferred to optional A6.P1.5 (entry+exit BPs in cdb script);
+  not blocking A6.P3. M1.5 symptom coverage matrix shows every
+  in-scope physics symptom mapped to at least one finding.
+- **A6.P3 — Fix the BSP correction paths** (~3–5 days). Sequencing
+  per A6.P2 recommendation: Finding 2 first (highest-confidence
+  single-cause; suspect site is `Transition.FindEnvCollisions` indoor
+  branch + the retention mechanisms that should keep ContactPlane
+  across frames). Re-run scen1-5 captures after the PR. If CP-write
+  ratios drop from ~1,000× to ~1×, Finding 2 is closed and Finding 1
+  may close as side-effect. Then Finding 3 (cell-resolver stickiness
+  in ResolveCellId + CheckBuildingTransit; same PR also removes #90
+  workaround). Issue #95 is NOT in A6.P3 scope.
+- **A6.P4 — Remove workarounds + visual verification** (~1 day after
+  P3). Revert #90 sphere-overlap stickiness in
+  `PhysicsEngine.ResolveCellId`. Delete `Transition.TryFindIndoorWalkablePlane`
+  + its caller in `FindEnvCollisions`. Visual verification at Holtburg
+  inn + cellar + (if #95 is also fixed by then) a dungeon. The
+  original A6.P4 plan named "Holtburg Sewer end-to-end" as the
+  acceptance walk; since the sewer doesn't exist, the M1.5 demo
+  scenario needs an alternative (see milestones doc).
 
 #### Phase A7 — Indoor lighting fidelity (RenderDoc + retail-decomp driven)