checkpoint: preserve user-gated FW closeout fixes

docs/plans/2026-04-11-roadmap.md

@@ -538,6 +538,18 @@ Stages FW0–FW6; no long-lived dual path.
 **Spec:** [`docs/superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md`](../superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md).
 **Plan + ledger:** [`docs/plans/2026-08-30-campaign-fw-frame-walk.md`](2026-08-30-campaign-fw-frame-walk.md).
 
+**2026-08-31 checkpoint — code complete, final connected gate pending.**
+`RetailFrameWalk` is now the only production visibility/order owner. Exact
+walk portal polygons route shells, statics, and dynamics through the same
+Vulkan clip slots (`11e68aad`), fixing the cathedral defect's actual mechanism:
+accepted content was previously emitted whole after a Boolean sphere test.
+The stale frame-product carrier is deleted, and the retail camera adjustment
+laws are complete (`90eba0ec`, `4d037974`). Release hermetic App gates passed
+6,729/6,729 before a still-open character-selection client locked the Release
+outputs. Campaign FW remains ACTIVE until both standard connected routes and
+the complete cathedral/transition/physical-camera visual matrix pass. Safety
+rollback before the final batch: `572de1ec`.
+
 ### Phase O — DatPath Unification — SHIPPED 2026-05-21
 
 **Tagline:** ONE thing touches the DATs.

docs/plans/2026-05-12-milestones.md

@@ -12,6 +12,17 @@ world-lifecycle automation protects fresh login, outdoor/world-edge/dungeon
 travel, same-location revisit, exact graceful disconnect, and uncapped
 fresh-process reconnect with canonical JSON/PNG evidence.
 
+**Active render prerequisite (2026-08-31): Campaign FW — retail frame walk.**
+The production cutover and camera port are code-complete: one retail-derived
+walk now owns rooting, portal recursion, per-view clipping, draw order, depth
+events, and shared-alpha barriers. The cathedral through-wall mechanism was a
+whole-mesh submission after Boolean portal admission; exact walk aperture clip
+slots now route shells, statics, and dynamics together. The campaign remains
+ACTIVE until the standard connected routes and owner visual matrix prove the
+positioned cathedral player/NPC transition, particles, seams, doorways, portal
+arrival, and retail camera feel. Plan/ledger:
+[`2026-08-30-campaign-fw-frame-walk.md`](2026-08-30-campaign-fw-frame-walk.md).
+
 Before new M4 quest/emote/character-creation subsystem bodies enter the App
 layer, the active structural prerequisite is the behavior-preserving
 `GameWindow` decomposition in

docs/plans/2026-08-30-campaign-fw-frame-walk.md

@@ -549,6 +549,48 @@ z-tested) where the old apparatus had no entry. The legacy !walkActive
 path keeps the old seal draw. Suites: hermetic 6,762/0, Walk lane 213/1,
 InstalledDat walk conformance 40/1.
 
+**FW4 FINAL CUTOVER — CODE COMPLETE 2026-08-31.** The cathedral remote
+player defect was not a wrong-cell admission bug. Exact installed-DAT replay
+at the owner's reported poses proved that retail legitimately reaches
+0xF4180112 through a small, bounded four-plane portal view; suppressing that
+cell or its dynamics would have hidden valid content. The defect was the
+modern leaf contract: acdream used the drawing sphere as a Boolean admission
+test and then emitted the complete shell/entity mesh through clip slot zero.
+Retail instead loops every `portal_view`, runs `viewconeCheck`, and draws the
+accepted content through that exact aperture. Commit `11e68aad` carries each
+walk visit's authored pixel polygon into a Vulkan clip slot and routes the
+same slot to the cell shell, statics, and dynamics. Multiple surviving views
+therefore produce multiple clipped draws; particles remain positionally
+contained by their owner turn and alpha barriers. Focused walk/installed-DAT
+tests pass 22/22 and the hermetic App suite passed 6,727/6,727 in Release.
+
+The remaining production carrier deletion landed in `69e69408`, `cb22691b`,
+and `a2f2eb7d`: the old executor/product frame, `PortalFrame`, `ClipAssembly`,
+`WalkLookInViews`, and borrowed-product exchange are gone. The concrete
+`RetailPViewRenderer`/`RetailPViewPassExecutor` class names remain as narrow
+composition/pass facades around the single `WalkFrameDriver`; they no longer
+own a competing visibility product. `PortalVisibilityBuilder` has no
+production caller and remains test/research material. The walk's visible set
+feeds preparation, particles, lights, and shadows. `PortalDepthMaskRenderer`
+is retained deliberately because it now performs the walk's retail far-Z
+punches and true-depth exit seals, not the removed visibility decision.
+
+**FW4 cathedral gate PASSED 2026-08-31.** The first closeout round exposed
+one concrete cutover regression: `877e935a` published `VisitedCells` (EnvCell
+flood/look-ins) as the complete visibility answer but omitted
+`VisitedLandscapeCellIds`. The draw stream still carried the exact cathedral
+waterfall owners, yet `ParticleVisibilityController` made every outdoor
+emitter fail retail's `CObjCell::IsInView` gate. The correction publishes the
+union to particle/light/shadow consumers while keeping EnvCell batch
+preparation scoped to EnvCells. The live probe now records every
+`0xCF418000..13` waterfall owner reaching the deferred alpha queue across the
+0x104 -> outdoor -> 0x101/0x100 transition; Walk tests pass 220/1 and the exact
+installed-DAT subset passes 21/0. The owner then passed the live matrix:
+waterfalls/outdoor particles restored, the player and special NPC hidden by
+opaque cathedral walls, no player disappearance at the cell transition, and
+no seam/building distortion. Both standard connected routes remain mandatory
+before the campaign status changes from ACTIVE.
+
 - Entities gate per view via `Render::viewconeCheck` at their cell's walk
   turn; dynamics-last and alpha interleave per the walk's stages
   (`RetailAlphaQueue` becomes the stream's alpha stage or is absorbed —
@@ -588,6 +630,17 @@ InstalledDat walk conformance 40/1.
   side-by-side feel gate vs retail (chase, zoom saturation ≈13 m boom,
   collision, slope align).
 
+**CODE COMPLETE 2026-08-31 (`90eba0ec`, `4d037974`).** Retail's
+multiplicative distance adjustment, per-component write-refusal gates,
+eight-degree raise/lower/rotate step, `FilterMouseInput × sensitivity × 1/15`
+mouse scaling, and first-person special cases are ported from the named
+decomp. `Closer` in-head correctly stays in-head because its 0.18 m candidate
+fails the 0.5 m near gate; `Farther` takes the authored 0.6 m back/0.5 m up
+escape; in-head Raise/Lower changes target direction Z by 0.2 and clamps to
+±0.8 without moving the eye. Camera tests pass 55/55 and the post-camera
+hermetic App suite passed 6,729/6,729 in Release. TS-56 is retired. The
+physical-display feel matrix remains part of the final owner gate.
+
 ### FW6 — closeout
 
 - Divergence-register reconciliation (added: landblock-stage streaming
@@ -611,6 +664,14 @@ Each stage lands as its own commit series; record `git revert` anchors
 here as stages close (the Modern Runtime plan's convention). FW3 and FW4
 are the cutover stages — their revert anchors are mandatory entries.
 
+- **Night-work safety anchor:** `572de1ec30d981abfb5c88f331e1a20c6213b63b`
+  (`checkpoint: preserve cathedral look-in investigation state`). Reverting
+  the 2026-08-31 aperture/camera/cleanup batch means returning exactly to this
+  commit; no history rewrite is required.
+- **Portal-slice clipping:** `11e68aad`.
+- **Camera completion:** `90eba0ec`, `4d037974`.
+- **Final stale frame-product removal:** `a2f2eb7d`.
+
 ## Risks (tracked, from the spec)
 
 - **Perf** — decided by FW3's checkpoint, numbers over hope.