docs(overhaul): bind S5 c1 clean evidence exception

Correct architecture and AD-21 to the existing transaction: normal non-login world frames participate, a walk contributes its exact landscape set, null-root completes an empty set without reconstruction, and login/portal-space retain no completed view.

Record the owner-authorized exception as in progress. Historical dirty-base artifacts remain preserved but clean exact-commit hermetic and InstalledDat evidence plus narrow review are still pending; no counts or hashes are invented.

Scope proof: no src or tests diff relative to b7a7eb9e2; git diff --check clean. No lanes or graphical client run by this commit.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docs/architecture/acdream-architecture.md

@@ -1163,10 +1163,14 @@ The walk's visited EnvCells and landscape land cells form different typed
 inputs. Campaign OVERHAUL S5-c1 made particle update borrow the exact completed
 landscape half for `CLandCell::IsInView`, while EnvCell owners use retail's
 constant-true `CEnvCell::IsInView` virtual. Point lights remain a separate
-resident-registry product and consume neither walk half. Null-root safety
+resident-registry product and consume neither walk half. Every non-login
-frames publish no cell-visibility answer; the former terrain frustum/AABB
+normal-world frame participates in the completed particle-visibility
-reconstruction and last-frame point-light feedback seam are deleted.
+transaction: a walk contributes its exact landscape set, while a null-root
-Directional shadows remain the next typed landscape consumer (S5-c2).
+safety frame completes `hasCompletedView=true` with an empty landscape set and
+no reconstructed fallback. Login and portal-space retain
+`hasCompletedView=false`. The former terrain frustum/AABB reconstruction and
+last-frame point-light feedback seam are deleted. Directional shadows remain
+the next typed landscape consumer (S5-c2).
 
 WorldBuilder contributes DAT decoding, mesh preparation, residency, and Vulkan
 batch mechanics only; it makes no visibility or ordering decision. Forced merge

docs/architecture/retail-divergence-register.md

@@ -150,7 +150,7 @@ readiness/requeue adaptation. See
 | AD-18 | Aperture far-Z punch is two-pass stencil-gated with an invented mark bias: 0.0005 NDC capped to a 0.5 m EYE-SPACE span (`MarkBiasNdc`); retail's single DEPTHTEST_ALWAYS punch is safe only under painter's far→near order we don't have | `src/AcDream.App/Rendering/PortalDepthMaskRenderer.cs:149` | **#117** (2026-06-11): the unconditional punch erased nearer occluders, painting interiors through them; the two-pass form is the z-buffered equivalent of retail's ordering safety. **#129** (2026-06-12): the constant-NDC bias spanned ~190 m of eye depth at a landblock (non-linear depth) → distant occluders punched; the eye-space cap bounds the reach (`Issue129PunchBiasTests`). DO-NOT-RETRY: punch must stay depth-gated (ISSUES #108) | Door-plane-hugging geometry beyond the 0.5 m cap re-occludes the aperture (a **#108**-class regression at >10 m viewing range); an occluder within the cap in front of a distant aperture still punches through | `D3DPolyRender::DrawPortalPolyInternal` 0x0059bc90 (maxZ1=7 / maxZ2=6) |
 | AD-19 | Under outdoor roots, ALL dynamics draw in one z-buffered final pass; retail draws objects painter-ordered per landcell inside the landscape pass (interior roots route per **#118**) | `src/AcDream.App/Rendering/RetailPViewRenderer.cs:126` | The dynamics-drawn-LAST invariant is what makes the aperture depth punch safe (first BR-2 attempt punched after dynamics and erased the player, reverted `88be519`); z-buffer substitutes for painter's order on opaque geometry | Punch/seal correctness hinges on an ordering invariant — any pass added after DrawDynamicsLast, or alpha content needing painter order, gets erased inside apertures or composites wrong | `LScape::draw` → `DrawBlock` 0x005a17c0 → DrawSortCell pc:430124; `PView::DrawCells` 0x005a4840 |
 | AD-20 | Camera sweep fallback seeds the eye's `AdjustPosition` from the PLAYER's cell; retail re-seats at the sought eye's own tracked cell (rest of function is a verbatim `update_viewer` port) | `src/AcDream.App/Rendering/PhysicsCameraCollisionProbe.cs:97` | acdream's camera doesn't track the sought-eye's cell separately; the eye is near the player so the player-cell stab list is assumed to cover it | An eye outside the player cell's stab-list coverage (boundary corners, cross-landblock pull-back) seats in the wrong cell — and the viewer cell roots the whole render: one-frame wrong root (flap-class flash) | `SmartBox::update_viewer` 0x00453ce0, pc:92878-92883 |
-| AD-21 | Null-clipRoot legacy outdoor safety path (no portal visibility, no punches/seals, no-clip terrain) for debug/streaming-gap/legacy cameras; in-world retail always has a `viewer_cell` root | `src/AcDream.App/Rendering/WorldRenderFrameBuilder.cs` (`RuntimeWorldFrameRootSource`, `WorldRenderFrame.ClipRoot`); `src/AcDream.App/Rendering/WorldSceneRenderer.cs` (null-root safety draw) | Result is null ONLY when neither an interior root nor the synthetic outdoor node exists. Login is portal-covered and draws no live sky/world; a safety draw may render resident flat terrain/entities but publishes no cell-visibility answer | If viewer-root resolution ever returns null in-world (membership bug, fly-camera edge), the frame silently degrades — interiors stop drawing through doorways, outdoor particles fail closed, and the old two-branch FLAP reappears for that frame | `SmartBox::RenderNormalMode` decomp:92635; Campaign OVERHAUL S5-c1 |
+| AD-21 | Null-clipRoot legacy outdoor safety path (no portal visibility, no punches/seals, no-clip terrain) for debug/streaming-gap/legacy cameras; in-world retail always has a `viewer_cell` root | `src/AcDream.App/Rendering/WorldRenderFrameBuilder.cs` (`RuntimeWorldFrameRootSource`, `WorldRenderFrame.ClipRoot`); `src/AcDream.App/Rendering/WorldSceneRenderer.cs` (null-root safety draw) | Result is null ONLY when neither an interior root nor the synthetic outdoor node exists. Every non-login normal-world frame participates in the completed particle-visibility transaction: a walk contributes its exact landscape set when present, while a null-root safety draw completes `hasCompletedView=true` with an empty landscape set and no reconstructed fallback. Login and portal-space retain `hasCompletedView=false`; the safety draw may still render resident flat terrain/entities | If viewer-root resolution ever returns null in-world (membership bug, fly-camera edge), the frame silently degrades — interiors stop drawing through doorways, outdoor particles fail closed, and the old two-branch FLAP reappears for that frame | `SmartBox::RenderNormalMode` decomp:92635; Campaign OVERHAUL S5-c1 |
 | AD-22 | Async streamed mesh loading with bounded CPU replay residency, per-frame upload budgets, and point-of-use self-heal (`EnsureLoaded` re-request in the dispatcher's mesh-missing path, **#128**); retail loads synchronously — geometry is never absent | `src/AcDream.App/Rendering/Wb/WbMeshAdapter.cs`; `src/AcDream.App/Rendering/Wb/MeshUploadCaches.cs`; `src/AcDream.App/Rendering/Wb/MeshUploadFrameBudget.cs` | Immutable preparation descriptors and the bounded CPU cache can re-stage an evicted mesh; dispatcher self-heal makes absence transient while upload budgets prevent a portal arrival from monopolizing a frame | A future consumer that neither retains an owner nor reaches the self-heal/replay path can remain invisible; under heavy admission pressure a valid mesh can pop in later than retail's synchronous path | retail synchronous content load; `docs/architecture/worldbuilder-inventory.md` portal-readiness and bounded-residency seams |
 | ~~AD-23~~ | **RETIRED 2026-09-03 at Campaign OVERHAUL v2 S3 review fix round 1 (`6575cfcee`).** The mechanism this row described — `ClipSlotCull` of live entities with `ServerGuid != 0` and null `ParentCellId` "while indoor clip routing is active" — is deleted with the per-cell clip routing itself (`SetClipRouting`, `_clipRoutingActive`, `ResolveSlotForFrame`'s routing arm): the routing had ZERO callers since the walk cutover, so the culling never ran, and the walk admits every part by retail's sphere test (`DrawMeshInternal` @0x0059f360) with cell membership owned by the S2 graph. Historical text: live entities with `ServerGuid != 0` and null `ParentCellId` were culled while indoor clip routing was active; retail objects are always cell-resident (synchronous add-to-cell at creation) | (deleted) formerly `src/AcDream.App/Rendering/Wb/WbDrawDispatcher.cs` `ResolveSlotForFrame`/`ClipSlotCull` | Phase U.4 policy: parentless = unresolved indoors, equivalent to retail's not-in-any-visible-cell ⇒ not drawn, *given membership resolves promptly* | An entity whose membership lags (late CreateObject hydration, resolver hiccup) blinks invisible while the player is indoors, even in plain sight | retail per-cell object lists in PView traversal |
 | AD-24 | EnvCell shell geometry content-deduplicated and instanced; retail draws each CEnvCell's own structure directly | `src/AcDream.Core/Rendering/Wb/EnvCellGeometryIdentity.cs` | Phase A8 retained WB's 31× hash; the 2026-07-24 full-DAT gate proved a real collision (`0x00030175`/`0x01BC0105`), so App+Bake now share a namespaced FNV-1a tuple identity and the bake rejects any full-tuple collision | A future collision outside the installed full-DAT gate could still merge different shells at runtime; the stronger 59-bit payload makes this extremely unlikely, and every bake fails loudly rather than publishing it | retail `PView::DrawCells` → per-cell drawing_bsp (cited at the former renderer `:319`) |

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -680,8 +680,8 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S4-c2 attempts 1–5 | **ATTEMPT 1/5 CONSUMED; ATTEMPT 2/5 PASSED AND LANDED 2026-09-04** — reviewed implementation `daaeab0ba`; campaign stack `89f1e2676` → `9ccb61a8e` → `0aa166aa0` → `252886e84`; packet §17 | G3/G4 UNPASSED | Sequential retail/evidence then production/gate-honesty PASS. Fresh: Release 0W/0E; shader 32/32; affected 37/37; real allocation 2/2 at 0 B; production 239/239. Official no-retry hermetic 16,734/1: sole unchanged global `Console.Out` capture race, exact theory 2/2 isolated. InstalledDat 255/10 documented/1. Validation routes `selfgate-20260904-115818-s4c2-landed-route` and `selfgate-20260904-120025-s4c2-landed-g3b` PASS provisional. First soak failed on known #461/#462; retry and S4-c1 control both 9/9 graceful; stationary averages CPU p95 −0.01 ms, GPU p95 +0.16 ms, alloc p50 +1.2 KiB, update p95 −0.12 ms. Three attempts remain unused. |
 | S4-c3a | **LANDED 2026-09-04 after the owner-authorized §21 evidence exception.** Reviewed scratch stack `44e2bc227b` → `b6bf6c131` → `eea5793d2` → `14397b14c` → `359061b82` → `255194e90` → `9cfddf301`; campaign cherry-picks `a86ec73ec` → `8e0c6fb14` → `01674bcc7` → `8bd75ba31` → `b6b015604` → `316193043` → `67c76026e`. The earlier stop remains in history at `06b986622`. | G3/G4 UNPASSED | Final retail lens PASS; production behavior/lifecycle/allocation/scope clean. The narrow independent gate-honesty re-review PASS reproduced the exact first failure (AP-table-boundary `Assert.True`, `rowIndex=-1`, before `Assert.Single`), restored AP-241 byte-identically, and passed the pin 1/1. Fresh campaign: Release 0W/0E; focused class lane 96/96; no-surface 1/1; AP pin 1/1; real allocation 2/2 at 0 B; shader 32/32; `git diff --check` clean. No client launched. NEXT: write c3b's deletion-only contract from the landed code; G3 stays locked until c3b lands. |
 | S4-c3b | **LANDED 2026-09-04** — implementation `26e97ba41`, provenance contract `5110bf676`, packet-only correction `3f2f00c9f`; packet §22–§25. Dead classic-group `LocalSortCenters`/`CachedBatch.LocalSortCenter` storage and the alpha camera-parameter/digest chain are deleted. Live per-cell/particle CYpt keys, opaque `SortDistance`, building/private/portal distances, two FIFO lists, all state/barriers, and AP/AD rows remain. | **G3 LEAD SELF-GATE PROVISIONAL PASS; owner acceptance/owner-only rows pending. G4 UNPASSED.** | Retail/deletion lens PASS. Production lens found no code defect and one artifact-provenance omission; packet-only fix round 1 passed its narrow re-review. Fresh campaign: Release 0W/0E; App 132/132; Core 29/29; allocation 2/2 at 0 B; shader 32/32. G3: route 1 13/13, route 2 4/4, route 3 retry 3/3, all exit 0/graceful. The first route-3 attempt stopped before Nanto on registered #462. Exact PNG paths: packet §25. |
-| S5-c1 | **IMPLEMENTED 2026-09-04; sequential review pending.** Packet `s5-consumers-material-closeout-packet.md` §§1–9. The exact walk landscape set is now the typed retained particle product; land cells require membership while non-null EnvCells retain their constant-true virtual. AP-117's null-root reconstruction and the dead point-light feedback seam are deleted; AP-117 is retired and AP-85/AD-21 are corrected. | G4 UNPASSED | Focused Core 111/111, App 146/146, real warmed allocation 1/1 at 0 B, Release 0W/0E. The first official artifact is preserved at 16,759/16,760 with only the stale AP-row-count pin; §8 corrected 162→161 and the exact pin passes 1/1. Fresh official hermetic 16,760/16,760; InstalledDat 385/10 documented/1 with no new identity. Directional shadows, building degrade, AP-232, probes, and closeout remain later chunks. |
+| S5-c1 | **OWNER-AUTHORIZED DOCUMENTATION/EVIDENCE EXCEPTION IN PROGRESS 2026-09-04.** Packet `s5-consumers-material-closeout-packet.md` §12. Production code and tests are unchanged; architecture and AD-21 are corrected to the existing non-login/PView/null-root transaction truth. | G4 UNPASSED | The earlier dirty-base artifacts remain historical and do not establish landing provenance. Clean commit-bound hermetic and InstalledDat evidence, then one narrow independent production/gate-honesty review, are pending. Directional shadows, building degrade, AP-232, probes, and closeout remain later chunks. |
-| S5 | IN FLIGHT — c1 implemented/review pending; c2–c5 and closeout remain | G4 | Packet §7 is the bounded decomposition; never merge main before G4. |
+| S5 | IN FLIGHT — c1 owner-authorized evidence exception pending clean evidence/review; c2–c5 and closeout remain | G4 | Packet §§7 and 12 are binding; never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -451,3 +451,21 @@ One narrow independent production/gate-honesty re-review verifies only the
 authorized documentation diff, exact clean artifact identity/counts/hashes,
 and absence of code/test changes. PASS permits landing and the graphical gate;
 any behavioral change or further correction-worthy finding stops again.
+
+### 12.1 Exception implementation result — clean evidence pending
+
+The authorized documentation correction aligns the architecture and AD-21
+with production's existing transaction without changing code or tests: every
+non-login normal-world frame participates, the walk contributes its exact
+landscape set when present, and null-root completes
+`hasCompletedView=true` with an empty set and no reconstruction; login and
+portal-space retain `hasCompletedView=false`.
+
+The pre-exception official artifacts remain preserved as historical evidence,
+including their dirty-base identities. They do not become clean commit-bound
+evidence by prose assertion. After this documentation commit, the lead will run
+the two §12 clean lanes; those summaries must name this exact commit with
+`WorktreeDirty=false` and will supersede the older dirty artifacts for landing
+provenance. Their counts and hashes are intentionally not recorded before the
+runs. The plan ledger therefore remains evidence-exception in progress with
+clean evidence and narrow review pending.