docs: reconcile ambiguous test contracts

docs/reviews/2026-08-18-r3-test-truth-ledger.md

@@ -133,7 +133,7 @@ identifiable in the lane report.
 | T-002 physics tautology | high-confidence cleanup batch A | Compare old-model and new-model reflection decisions, as the surrounding contract states. |
 | T-003 duplicate theory row | high-confidence cleanup batch A | Remove literal `0x41000012`, which is identical to `MotionCommand.Crouch`; remove the temporary analyzer suppression. |
 | T-004 warning mismatches | resolved in R2 | Clean rebuild is zero-warning with repository-wide warnings-as-errors. |
-| T-005 unreachable panel stack | requires production reachability proof | Do not delete 52 meaningful tests until the dead presentation surface and any supported plugin compatibility promise are verified together. |
+| T-005 dormant panel stack | production reachability and architecture intent reconciled in batch P; user taxonomy decision remains | No shipping code implements `IPanelRenderer`/`IPanelHost` or constructs `ChatPanel`, `DebugPanel`, or `VitalsPanel`, but the architecture explicitly preserves this first-party developer-panel contract for issue #258. Do not call its behavioral tests useless or delete the contract as dead code. Decide separately whether 26 fake-renderer self-tests belong in the release count. |
 | T-006 misleading installed-DAT reason | resolved in batch B | Shared opt-in is now `ACDREAM_RUN_INSTALLED_DAT_TESTS=1` (legacy switch retained), the reason names the lane, and all nine owners carry `Lane=InstalledDat`. |
 | T-007 271 silent passing gates | resolved in batch G | All 280 directly found gates plus three later-reconciled sites now fail explicitly when their selected lane lacks its prerequisite. The only three syntax candidates left are reviewed cross-platform branch false positives. |
 | T-008 incapable-of-failing diagnostics | resolved in batches A, C, and L | The literal wiring smoke test was deleted, the GPU contract tautology was repaired, and the six remaining constant-truth diagnostic assertions were removed after their output was preserved under `Purpose=Diagnostic`. |
@@ -507,6 +507,60 @@ No source-freeze fact is removed in this classification batch. The 46 staged
 facts are an ambiguous architecture decision and will be presented for user
 approval in behavior-owner groups rather than deleted from a numeric heuristic.
 
+### Source-freeze approval groups
+
+The 46 campaign-era facts are not equivalent. Their current semantic coverage
+and safest replacement path divide into six owner groups:
+
+| Owner group | Facts | What the literal checks still prove | R3 recommendation |
+|---|---:|---|---|
+| Composition-root wiring | 13 | `GameWindow` calls the intended phase objects and no longer contains the extracted construction bodies. Phase-local tests cover ordering and rollback inside each phase, but not every root-to-phase link. | Keep until one symbol-aware composition-graph guard proves the root links. Then remove the literal constructor/local-name checks. |
+| Runtime root, host, and lifetime | 12 | One canonical Runtime root/command surface, typed owner handoffs, acquisition order, and native-window-last shutdown. Existing Runtime/lifecycle tests prove much of the behavior, but several sole-owner and transfer claims remain unique. | Replace with direct ownership receipts, terminal-ledger assertions, and metadata dependency guards before removing any source freeze. |
+| Render delegation and cleanup | 4 | Rendering is delegated and `GameWindow` does not regain leaf draw branches or resource ownership. The owning render suites already exercise the executor, frame builder, renderer, and resource disposal behavior. | Best first conversion: add one symbol-aware boundary guard for the absence/delegation claim, then remove the four literal checks. |
+| Streaming publication | 4 | The window does not own render/physics publication bodies, captured build origins flow through the extracted owners, and streamer teardown follows session reset. Publisher/build/origin suites already provide broad behavioral coverage. | Best second conversion: consolidate the absence claims into a whole-tree architecture guard and retain the behavioral origin/teardown contracts. |
+| Live-entity composition | 2 | Typed sources replace window closures and reset closes every streaming/readiness owner. Lifecycle tests cover convergence, but the exact constructor-shape claim is still literal. | Replace with constructor/field metadata inspection plus the existing teardown ledger; do not delete alone. |
+| Frame orchestration | 11 | Exact-once publication, frame-stage order, adapter ownership, and a deliberately thin `OnUpdate`. These are high-value order rules, but exact statement fragments are the most brittle implementation specification in the set. | Replace order assertions with an observable fake event trace and use a symbol-aware dependency guard for the thin-root rule. This is the largest conversion and should be last. |
+
+Approval should authorize this replacement sequence, not wholesale deletion:
+render delegation, streaming, live entities, composition roots, Runtime/host
+lifetime, then frame orchestration. If the semantic replacement exposes a
+claim that exists only as historical campaign wording, preserve the rationale
+and bring that individual deletion back for review.
+
+## Batch P dormant panel reachability reconciliation
+
+T-005's production-reachability half is now proved: repository-wide C# usage
+contains no production `IPanelRenderer` or `IPanelHost` implementation and no
+shipping construction of `ChatPanel`, `DebugPanel`, or `VitalsPanel`. The old
+ImGui backend is gone; retained `UiHost`/`UiRoot` controllers are the sole
+shipping presentation stack, and plugin UI uses
+`IUiRegistry.AddMarkupPanel` rather than `IPanel`.
+
+That does **not** make the complete abstraction useless. The architecture
+document explicitly says `AcDream.UI.Abstractions` and the
+`IPanel`/`IPanelRenderer` developer-panel contract survive intact for a future
+host tracked by issue #258. `ChatVM` and `VitalsVM` are also live shared models
+consumed by retained UI, so their model/parser/command tests are production
+coverage and are outside T-005.
+
+The dormant presentation-only subset currently contains 51 attributed methods
+(57 expanded cases):
+
+| Subset | Methods | Disposition |
+|---|---:|---|
+| `IPanelRendererWidgetTests` and `IPanelRendererMainMenuBarTests` | 26 | They exercise only `FakePanelRenderer`, not a production backend. Treat as test-harness/contract self-tests; user decision whether to retain outside the release total, consolidate, or remove. |
+| `PanelContextTests` | 2 | Small public-contract value, but only compiler-generated record round-trip/equality. Same taxonomy decision as the renderer self-tests. |
+| `ChatPanel` layout, input, focus, and colored-render behavior | 23 | Meaningful executable behavior for the explicitly preserved future developer-panel contract. Retain unless that architecture promise is intentionally retired. |
+
+The earlier audit's recommendation to remove the whole stack was therefore too
+broad. The maintainability problem is narrower: 28 harness/trivial contract
+methods inflate release totals despite having no production renderer, while 23
+panel behavior methods protect a deliberately dormant API. The UI framework
+plan also has stale present-tense statements that ImGui remains permanent,
+whereas the architecture authority correctly records its deletion; that is a
+documentation-reconciliation item, not evidence that the old backend still
+exists.
+
 ## Batch J descriptive test identities
 
 The first T-016 naming batch changes no oracle or production behavior. It