docs(rendering): close slice F shadow gate

Record exact capped, uncapped, and dense physical parity evidence before any production draw-source cutover. The pre-F/G runtime rollback anchor remains e7d9d6fa.

docs/plans/2026-07-24-modern-runtime-slices-f-g-render-scene.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-24
 
-**Status:** approved 2026-07-24; Slice F active
+**Status:** approved 2026-07-24; Slice F complete, Slice G active
 
 **Program:** `docs/plans/2026-07-24-modern-runtime-architecture.md`
 
@@ -22,8 +22,8 @@ retail-faithful gameplay
 | F2 — static projection journal | complete | Static and EnvCell-shell projections now append ordered deltas only after the final activation receipt and exact detach receipt. Same-landblock rehydrate reconciles retained/new/omitted identities; stale Far completions are inert. Seven focused lifecycle tests pass inside the 3,708-App / 8,192-solution Release gate. The scene remains unconstructed and non-drawing in production. |
 | F3 — live/equipped projection | complete | Exact EntityReady/resource teardown, visibility, attachment pose/removal, and active-only final-frame seams now drive generation/incarnation-gated live records. Duplicate CreateObject, pending/loaded rebucket, hidden/appearance, reentrancy, session clear, attachment, and GUID-generation replacement pass 11 focused tests. Production still constructs no render scene. |
 | F4 — dynamic indices | complete | The contained scene now maintains outdoor/static, per-cell static/dynamic, special dynamic-route, translucent, selectable, light-candidate, and dirty indices incrementally. Final-frame live/equipped synchronization remains active-only, and active animated statics are synchronized from the scheduler's active workset rather than a resident-world scan. The production scene remains unconstructed and non-drawing. |
-| F5 | active — connected redrive | Lifecycle automation now constructs the otherwise-absent non-drawing scene, drains ordered static/live deltas after post-network spatial reconciliation, compares the accepted current partition every 30 rendered frames and at every canonical checkpoint, retains only the first field-level mismatch, and publishes scene/journal/index/memory evidence in checkpoint JSON. The first exact `056bbd4e` capped route passed the harness and graceful-shutdown gates but correctly exposed missing live roots after a same-location Sawato revisit. Root synchronization now recovers ordinary roots from `LiveEntityRuntime`'s canonical active spatial workset while attached children remain callback-authoritative. Immutable selection geometry is fingerprinted once per GfxObj/mesh identity, and retained scene/journal update paths have zero-allocation regression tests. Release is green at 3,733 App tests / 3 skips and 8,217 complete-solution tests / 5 skips; all three connected routes must be redriven before F5 closes. |
-| G0–G5 | pending | No production consumer has switched. |
+| F5 | complete | Exact `81e2f1a5` passed capped and uncapped nine-stop routes plus uncapped dense Arwic. Across the final checkpoints the referee completed 1,663 + 1,677 + 81 comparisons with zero mismatches, zero pending deltas, zero rejected operations, exact binary/source identity, and graceful shutdown. Evidence: `docs/research/2026-07-24-slice-f5-render-scene-shadow-gate.md`. |
+| G0–G5 | active | F's non-drawing referee is accepted. No production consumer has switched yet; G0 begins the borrowed double-buffered frame product. |
 
 The exact pre-F/G runtime rollback anchor remains `e7d9d6fa`. F0 is
 non-drawing diagnostic infrastructure and therefore is not a visual-cutover
@@ -479,6 +479,23 @@ removal, and final logical teardown. Missing-projection diagnostics also carry
 the expected class, server GUID, local ID, and parent cell for any further
 failure. Repeat capped F5 on the exact corrective commit before advancing.
 
+The exact corrective commit `81e2f1a5` passed the complete physical gate:
+
+- capped nine-stop route `connected-r6-soak-20260724-232827`: 1,663/1,663
+  successful comparisons;
+- uncapped nine-stop route `connected-r6-soak-20260724-233826`: 1,677/1,677
+  successful comparisons;
+- uncapped dense-Arwic route `connected-dense-town-20260724-234807`: 81/81
+  successful comparisons.
+
+Every canonical checkpoint had the shadow enabled, the active projection count
+equal to the current-path oracle, no first mismatch, no journal carry-over, and
+no rejected delta. All three processes used a Release binary whose embedded
+commit exactly matched source and all closed gracefully. This closes Slice F.
+The shadow scene remains diagnostic-only and is safe to retain if a later
+production cutover is reverted. The pre-cutover runtime rollback anchor remains
+`e7d9d6fa`.
+
 ## 6. Slice G — Frame product and production cutover
 
 ### G0 — Borrowed double-buffered frame product

docs/research/2026-07-24-slice-f5-render-scene-shadow-gate.md

@@ -0,0 +1,85 @@
+# Slice F5 Render-Scene Shadow Gate
+
+**Date:** 2026-07-24
+
+**Candidate:** `81e2f1a57577457436f244f8c9d083e14a9de362`
+
+**Result:** accepted; Slice F is complete
+
+## Purpose
+
+Slice F built the future render scene without allowing it to draw. The physical
+gate compared its active projections with the accepted current renderer after
+streaming, network, teleport, animation, attachment composition, and the final
+update-boundary journal publication. This was an exact state referee, not a
+screenshot approximation.
+
+The retained scene can contain inactive identities that have temporarily left
+spatial presentation. Therefore the binding count is the active matched
+projection count, not total retained entity capacity. Logical teardown still
+removes those identities through `OnResourceUnregister`.
+
+## Exact physical evidence
+
+| Route | Report | Final comparisons | Mismatch | Pending | Rejected | Exit |
+|---|---|---:|---:|---:|---:|---|
+| Capped nine-stop | `logs/connected-r6-soak-20260724-232827.report.json` | 1,663 / 1,663 | 0 | 0 | 0 | graceful |
+| Uncapped nine-stop | `logs/connected-r6-soak-20260724-233826.report.json` | 1,677 / 1,677 | 0 | 0 | 0 | graceful |
+| Uncapped dense Arwic | `logs/connected-dense-town-20260724-234807.report.json` | 81 / 81 | 0 | 0 | 0 | graceful |
+
+Every route reported:
+
+- `Passed=true`, `ExitCode=0`, and `GracefulExit=true`;
+- source commit, embedded binary commit, and candidate commit equal to
+  `81e2f1a57577457436f244f8c9d083e14a9de362`;
+- shadow comparison enabled at every canonical checkpoint;
+- active matched projections equal to the current-path oracle;
+- `firstMismatch=null`;
+- cumulative rejected-generation, out-of-order, stale-incarnation, and
+  missing-record counts all zero.
+
+The two nine-stop routes covered Caul, Sawato, Rynthid, Aerlinthe, Holtburg,
+same-location Sawato revisit, Caul return, Sawato plateau, and Caul plateau.
+The route exercised movement, jump, combat, portal churn, repeated
+materialization, generation replacement, and graceful shutdown. Dense Arwic
+covered 15,040 active projections and 111 animated entities during the turn
+sample.
+
+## Shadow footprint
+
+The final checkpoint's estimated retained shadow footprint was:
+
+- capped Caul plateau: 21,891,296 bytes for 21,216 retained identities;
+- uncapped Caul plateau: 21,894,656 bytes for 21,218 retained identities;
+- dense Arwic: 20,001,016 bytes for 15,791 retained identities.
+
+This footprint is intentionally additional during Slice F because both the
+current and candidate representations coexist. Slice G must remove the old
+whole-world partition ownership after production parity; Slice F numbers are
+not the post-cutover steady-state memory target.
+
+## Rejected evidence and root corrections
+
+Earlier physical runs were deliberately rejected:
+
+- `056bbd4e`: ordinary roots could not be recovered after same-location
+  rehydration because derived synchronization walked only retained records;
+- `91463db5`: the ordinary journal drain was skipped while simulation was
+  quiesced instead of being a final update-frame commit;
+- `9fab1feb`: destination pose could not restore an equipped projection after
+  presentation withdrawal;
+- `bb1f4a64`: equipped spatial withdrawal was incorrectly treated as logical
+  identity destruction.
+
+The final model separates logical lifetime from spatial presence. Ordinary
+roots reconcile from `LiveEntityRuntime`'s canonical active workset. Equipped
+children remain callback-owned, retain their exact inactive scene identity
+during spatial withdrawal, reactivate only from an authoritative visibility or
+pose edge, and unregister only on logical resource teardown.
+
+## Rollback
+
+No production draw consumer changed in Slice F. The exact pre-F/G runtime
+rollback anchor remains `e7d9d6fa`. A later visual failure in Slice G must
+revert the exact production cutover commit recorded in the plan and render
+pipeline digest; it must not discard this referee or evidence work.