diff --git a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md
index 2fa48d70..f4a5dbe5 100644
--- a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md
+++ b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md
@@ -659,7 +659,7 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | v1 OH1 | SUPERSEDED | research contracts committed at `5cd4fd2c`/`5d907ae9` (kept, binding) | T0–T3 evidence grammar parked on `quarantine/oh1-evidence-grammar-2026-09-02` | reviews found the grammar a false oracle three times | n/a | n/a | see §15 |
 | S1 Geometry | **CLOSED — G1 PASSED 2026-09-02** | `oh2-cellstruct-surface-contract.md` (§3.5 arbitrated on the binary) | chunk A `acf17246`; chunk B `b681717c`; hygiene `0840d5fb`; review fixes `e2543d0e`; G1 regression fix `8c6563ca` (segment/batch pairing) + its pin test (next commit) | lead verified both chunks against the named pseudo-C and the paired binary; two Opus lens reviews, 8 findings all verified by the lead and fixed; the review round's own upload-order change desynchronized cell-shell index segments from batches (first G1 launch: magenta/stretched/missing walls in every dungeon) and was root-caused and fixed by the lead before the re-gate | build 0/0; Content 213/213 (incl. PreparedPackage on the recipe-8 pak); Core 4,948/4,948 (one load-sensitive allocation test outside S1 passes alone); Bake 21/21; Launcher.Core 365/365; Runtime 1,884/1,884; App hermetic 6,757/6,757 | **G1 PASS**: Facility Hub stairs/doorways, Holtburg house interior, ordinary dungeon, town portal network all whole with correct materials on `8c6563ca` + recipe 8; cathedral shows the ORIGINAL symptom family (neighbor-cell walls drawn through portals over the room), explicitly outside G1 and carried to S3/S4 | dev pak recipe 8 (597,369,112 B; `acdream.recipe7.pak` kept); TOC delta explained; corpus scan old-only 3,197 (all untextured), new-only 0, unexplained 0 |
 | Capture | READY | §7 + `tools/walk-oracle/oh/README.md` | scripts committed `ebaa41df` + `14d8fe64`; lead resolved DBObj::m_DID=+0x28 and the cdecl alpha-function conventions; recon attach re-confirms | — | recon dt/x/uf dumps at session start | owner session ~1 h | before S3 |
-| S2 World graph | CLOSED — G2 PASSED (owner, 2026-09-03): Facility Hub PASS, Holtburg house PASS, cathedral leak unchanged/not worse (S3/S4 target), portal haze FIXED by chunk 6 and owner-confirmed; the terrain doorway-punch finding is carried to S4; the chunk-6 retail-lens review (Opus) returned no blocking finding; its one MAJOR (a cell reached through two portals got two particle turns per frame) and the minor items are fixed in the follow-up commit: frame-scoped particle-turn dedupe beside the shell dedupe, zero-emitter cells cost one count check, the scope-cost counter maintained on the cell path, the dead `OutdoorSceneParticleEntityIds` stub chain deleted through the composition root, AD-117 item 4 names the owner-cell substitution and the absent per-emission `AddPartToShadowCells`, and a sink-level pin that an emitter's cell membership is the owner's pose cell and survives the projection-visibility switch (the review's F7 one-frame eligibility lag is the per-frame view pass, documented in the pin). RETAIL AXIOM (owner, 2026-09-03, at the capture session, 2013 v11.4186 client on local ACE): standing on the cathedral stairs, RETAIL ITSELF shows part of the same artifact — the outside structure leaking into the interior — CONFIRMED in BOTH the 2013 v11.4186 client and the 2015 EoR client (owner switched clients to check), so the cathedral leak is retail behavior S3/S4 must REPRODUCE, not remove; the retail transcript at that pose is captured as `logs/oh-capture/cathedral-leak.{walk,parts,alphadepth}.log` (walk 5 frames with LC/SC landscape order, parts 3 frames, alpha-depth 5 frames, recon-verified offsets) | `s2-membership-ownership-map.md` (`e7ad25a7`) + Contracts A/B; closeout evidence §8/§9 | chunk 1a `059b8883`; chunk 1b `5a2792d6`; chunk 2 `707d2803` (render statics borrow the registry's retail array; render flood deleted); chunk 3 `afbd2410` (one flood per registration feeds collision rows and render entries; staged SetPosition carries both products); chunk 4 `75ea269d` (movement publishes from the transition's cells; children inherit at registration); chunk 5 + closeout `c94a1a40` (borrowed per-cell views, render-only registration, sweeps/fallbacks deleted; reflood forwards the part array; NON-COLLIDING DAT STATICS register render-only from both publishers; the dual-review fix batch: Suspend clears the retail product, attach/detach advance the mutation revision, an attached child never floods on its own, RemoveLandblock/RetireOwnerFromLandblock prune retail rows, render-only owners move with their destination cell (retail's zero-sphere `find_cell_list` 0x0052b4e0, verified statically 2026-09-03 — AD-117 item 1 dropped), empty part array == null, per-move closures removed, EnvCell shells out of the entity-id index, index predicate compares the id, dead per-cell scene indices deleted) | lead corrected 1a's route decision before landing; chunk 2 verified by the lead; chunk 5's agent report missed the non-colliding-static population (found by the self-gate PIXEL DIFF, not by eye: Facility wall panels grey); S2 dual review (arch + retail lens, Opus) produced 12 + 7 findings, every one lead-verified against the source before an edit; the four BLOCKING/MAJOR lifetime gaps were real | at `c94a1a40`: Core 4,984/4,984; Content 214/214; Runtime 1,884/1,884; App hermetic lane 6,760/6,760; App InstalledDat 217 pass / 1 skip / 2 pre-existing #383; App Windows 1/1 | G2 PROVISIONAL PASS. Self-gate runs (kit `ea546f38`, pwsh): `logs/selfgate-20260902-231426-baseline-g1-binary` (reference), `…231642-s2-chunk3`, `…233845-s2-chunk4` (identical), `logs/selfgate-20260903-002632-s2-chunk5-reflood` (FAIL: Facility wall panels grey, left-wall mean RGB 29,26,23 vs baseline 65,17,21 — missing non-colliding statics), `logs/selfgate-20260903-010022-s2-review-fixes-3` (candidate: panels back at 79,20,25 = chunk-3/4; cathedral 13.6% / Facility 15.0% / house 13.4% px differ vs baseline, the chunk-3/4 band; graceful logout, zero exceptions). Membership-probe run `logs/selfgate-20260903-003013-s2-chunk5-membership-probe`: `[walk-membership]` fired only on two transient Holtburg login frames, never in Facility Hub or the cathedral. Connected R6 soak on the chunk-4 build `6717a3e5` (`logs/connected-r6-soak-20260902-234016.report.json`): 9 destinations in 511 s, zero invariant failures, graceful exit — route PASS (its `-CollisionShadowEvery` referee is the obsolete I5 graph-vs-flat comparator; retire in S5). Connected R6 soak on the FINAL S2 build (`logs/connected-r6-soak-20260903-010403.report.json`, binary matches source, exit 0, graceful=True): 9 canonical checkpoints, 0 failures, 10 warnings (server-side population drift + DAT VFX table messages), 522 s — route PASS. OWNER G2 CHECK 2026-09-03 (client at `4b0b29e4`): Facility Hub PASS, Holtburg house PASS; cathedral: the original leak unchanged, NOT worse (S3/S4 target, G2 bar met); TWO NEW OWNER FINDINGS block G2 closure — (a) parts of buildings leak through terrain outdoors in Holtburg — owner screenshot shows doorway-sized fragments of the houses on the terrace BELOW showing through the hill; mechanism identified: `PortalDepthMaskRenderer` draws every visited cell's `OtherCellId == 0xFFFF` portal fan (`RetailPViewPassExecutor` `DrawDepthFan`) with depth compare `Always` + depth write, so a building doorway BEHIND terrain still punches far depth through the hill and the interior draws through the hole; retail's far punch cannot be `Always` against terrain — the exact z-func is S4's first question (the #117 punch stencil is already on S4's delete list; the retail-world contract §5.4 wording must be re-read at the capture). Pre-existing (not an S2 regression), assigned to S4; (b) the purple portal-exit haze on the character no longer appears on arrival — ROOT CAUSE FOUND (instrumented runs `logs/selfgate-20260903-053731-haze-candidate`, `…-054153-haze-candidate-2`, chunk-4 control `…/bisect-chunk4/logs/selfgate-20260903-054328-haze-chunk4`): the server keeps the player Hidden until acdream sends LoginComplete at reveal `complete` (retail-correct); the Hidden-state script's emitters spawn in the arrival cell at `materialized`, are view-eligible at `world-visible`, and are never DRAWN (frame `h02-arrive-400ms`: room, no character, no cloud) because the walk draws an owner's emitters only through the owner's registry rows and a hidden owner's shadow is suspended; the deleted chunk-5 fallback used to carry them. Retail gives every emitter its OWN cell membership (`add_particle_shadow_to_cell` 0x00514a70, one shadow in its own cell, no clip planes, drawn at that cell's turn regardless of the parent's hidden state) — the branch AD-117 item 4 had deferred as 'no production path'. Fix = S2 chunk 6 `f6b4584b` (packet §10): `ParticleSystem` per-pass cell→handles index + `DrawForCell`; the walk draws particles BY CELL at the existing turns; every owner-union particle path deleted; the post-replay per-cell pass deleted (it double-submitted the root flood — the implementer flagged it, the lead verified `EmitCellContentsTurn` fires `CellParticles` for root-flood and look-in cells alike); AD-117 item 4 → port note; temporary probes removed. VERIFIED: `logs/selfgate-20260903-062522-haze-chunk6` frame `h02-arrive-400ms` shows the purple cloud at the character in Facility Hub; three-pose self-gate `logs/selfgate-20260903-062615-s2-chunk6` in the accepted band (cathedral 12.7% / Facility 15.1% / house 13.9% px vs baseline, wall-panel mean 79,20,25), zero exceptions. Gates at `f6b4584b`: Core 4,987/4,987; Content 214/214; Runtime 1,884/1,884; App hermetic 6,760/6,760; App InstalledDat 217 / 2 pre-existing #383. Owner re-check of the haze: CONFIRMED FIXED 2026-09-03 ("Ok yeah it is fixed now"). Morning handoff: `docs/research/2026-09-01-overhaul/2026-09-03-g2-morning-handoff.md` | owner double-checks G2 (handoff checklist); then the owner capture session (the S3 packet §7 names the two traces); then S3 |
+| S2 World graph | CLOSED — G2 PASSED (owner, 2026-09-03): Facility Hub PASS, Holtburg house PASS, cathedral leak unchanged/not worse (S3/S4 target), portal haze FIXED by chunk 6 and owner-confirmed; the terrain doorway-punch finding is carried to S4; the chunk-6 retail-lens review (Opus) returned no blocking finding; its one MAJOR (a cell reached through two portals got two particle turns per frame) and the minor items are fixed in the follow-up commit: frame-scoped particle-turn dedupe beside the shell dedupe, zero-emitter cells cost one count check, the scope-cost counter maintained on the cell path, the dead `OutdoorSceneParticleEntityIds` stub chain deleted through the composition root, AD-117 item 4 names the owner-cell substitution and the absent per-emission `AddPartToShadowCells`, and a sink-level pin that an emitter's cell membership is the owner's pose cell and survives the projection-visibility switch (the review's F7 one-frame eligibility lag is the per-frame view pass, documented in the pin). RETAIL AXIOM (owner, 2026-09-03, at the capture session, 2013 v11.4186 client on local ACE): standing on the cathedral stairs, RETAIL ITSELF shows part of the same artifact — the outside structure leaking into the interior — CONFIRMED in BOTH the 2013 v11.4186 client and the 2015 EoR client (owner switched clients to check), so the cathedral leak is retail behavior S3/S4 must REPRODUCE, not remove; the retail transcript at that pose is captured as `logs/oh-capture/cathedral-leak.{walk,parts,alphadepth}.log` (walk 5 frames with LC/SC landscape order, parts 3 frames, alpha-depth 5 frames, recon-verified offsets); owner's retail screenshot at the pose: an exterior wall slab cutting diagonally through the stair chamber over the interior ramps (`logs/oh-capture/cathedral-leak.retail.png`, owner-saved) | `s2-membership-ownership-map.md` (`e7ad25a7`) + Contracts A/B; closeout evidence §8/§9 | chunk 1a `059b8883`; chunk 1b `5a2792d6`; chunk 2 `707d2803` (render statics borrow the registry's retail array; render flood deleted); chunk 3 `afbd2410` (one flood per registration feeds collision rows and render entries; staged SetPosition carries both products); chunk 4 `75ea269d` (movement publishes from the transition's cells; children inherit at registration); chunk 5 + closeout `c94a1a40` (borrowed per-cell views, render-only registration, sweeps/fallbacks deleted; reflood forwards the part array; NON-COLLIDING DAT STATICS register render-only from both publishers; the dual-review fix batch: Suspend clears the retail product, attach/detach advance the mutation revision, an attached child never floods on its own, RemoveLandblock/RetireOwnerFromLandblock prune retail rows, render-only owners move with their destination cell (retail's zero-sphere `find_cell_list` 0x0052b4e0, verified statically 2026-09-03 — AD-117 item 1 dropped), empty part array == null, per-move closures removed, EnvCell shells out of the entity-id index, index predicate compares the id, dead per-cell scene indices deleted) | lead corrected 1a's route decision before landing; chunk 2 verified by the lead; chunk 5's agent report missed the non-colliding-static population (found by the self-gate PIXEL DIFF, not by eye: Facility wall panels grey); S2 dual review (arch + retail lens, Opus) produced 12 + 7 findings, every one lead-verified against the source before an edit; the four BLOCKING/MAJOR lifetime gaps were real | at `c94a1a40`: Core 4,984/4,984; Content 214/214; Runtime 1,884/1,884; App hermetic lane 6,760/6,760; App InstalledDat 217 pass / 1 skip / 2 pre-existing #383; App Windows 1/1 | G2 PROVISIONAL PASS. Self-gate runs (kit `ea546f38`, pwsh): `logs/selfgate-20260902-231426-baseline-g1-binary` (reference), `…231642-s2-chunk3`, `…233845-s2-chunk4` (identical), `logs/selfgate-20260903-002632-s2-chunk5-reflood` (FAIL: Facility wall panels grey, left-wall mean RGB 29,26,23 vs baseline 65,17,21 — missing non-colliding statics), `logs/selfgate-20260903-010022-s2-review-fixes-3` (candidate: panels back at 79,20,25 = chunk-3/4; cathedral 13.6% / Facility 15.0% / house 13.4% px differ vs baseline, the chunk-3/4 band; graceful logout, zero exceptions). Membership-probe run `logs/selfgate-20260903-003013-s2-chunk5-membership-probe`: `[walk-membership]` fired only on two transient Holtburg login frames, never in Facility Hub or the cathedral. Connected R6 soak on the chunk-4 build `6717a3e5` (`logs/connected-r6-soak-20260902-234016.report.json`): 9 destinations in 511 s, zero invariant failures, graceful exit — route PASS (its `-CollisionShadowEvery` referee is the obsolete I5 graph-vs-flat comparator; retire in S5). Connected R6 soak on the FINAL S2 build (`logs/connected-r6-soak-20260903-010403.report.json`, binary matches source, exit 0, graceful=True): 9 canonical checkpoints, 0 failures, 10 warnings (server-side population drift + DAT VFX table messages), 522 s — route PASS. OWNER G2 CHECK 2026-09-03 (client at `4b0b29e4`): Facility Hub PASS, Holtburg house PASS; cathedral: the original leak unchanged, NOT worse (S3/S4 target, G2 bar met); TWO NEW OWNER FINDINGS block G2 closure — (a) parts of buildings leak through terrain outdoors in Holtburg — owner screenshot shows doorway-sized fragments of the houses on the terrace BELOW showing through the hill; mechanism identified: `PortalDepthMaskRenderer` draws every visited cell's `OtherCellId == 0xFFFF` portal fan (`RetailPViewPassExecutor` `DrawDepthFan`) with depth compare `Always` + depth write, so a building doorway BEHIND terrain still punches far depth through the hill and the interior draws through the hole; retail's far punch cannot be `Always` against terrain — the exact z-func is S4's first question (the #117 punch stencil is already on S4's delete list; the retail-world contract §5.4 wording must be re-read at the capture). Pre-existing (not an S2 regression), assigned to S4; (b) the purple portal-exit haze on the character no longer appears on arrival — ROOT CAUSE FOUND (instrumented runs `logs/selfgate-20260903-053731-haze-candidate`, `…-054153-haze-candidate-2`, chunk-4 control `…/bisect-chunk4/logs/selfgate-20260903-054328-haze-chunk4`): the server keeps the player Hidden until acdream sends LoginComplete at reveal `complete` (retail-correct); the Hidden-state script's emitters spawn in the arrival cell at `materialized`, are view-eligible at `world-visible`, and are never DRAWN (frame `h02-arrive-400ms`: room, no character, no cloud) because the walk draws an owner's emitters only through the owner's registry rows and a hidden owner's shadow is suspended; the deleted chunk-5 fallback used to carry them. Retail gives every emitter its OWN cell membership (`add_particle_shadow_to_cell` 0x00514a70, one shadow in its own cell, no clip planes, drawn at that cell's turn regardless of the parent's hidden state) — the branch AD-117 item 4 had deferred as 'no production path'. Fix = S2 chunk 6 `f6b4584b` (packet §10): `ParticleSystem` per-pass cell→handles index + `DrawForCell`; the walk draws particles BY CELL at the existing turns; every owner-union particle path deleted; the post-replay per-cell pass deleted (it double-submitted the root flood — the implementer flagged it, the lead verified `EmitCellContentsTurn` fires `CellParticles` for root-flood and look-in cells alike); AD-117 item 4 → port note; temporary probes removed. VERIFIED: `logs/selfgate-20260903-062522-haze-chunk6` frame `h02-arrive-400ms` shows the purple cloud at the character in Facility Hub; three-pose self-gate `logs/selfgate-20260903-062615-s2-chunk6` in the accepted band (cathedral 12.7% / Facility 15.1% / house 13.9% px vs baseline, wall-panel mean 79,20,25), zero exceptions. Gates at `f6b4584b`: Core 4,987/4,987; Content 214/214; Runtime 1,884/1,884; App hermetic 6,760/6,760; App InstalledDat 217 / 2 pre-existing #383. Owner re-check of the haze: CONFIRMED FIXED 2026-09-03 ("Ok yeah it is fixed now"). Morning handoff: `docs/research/2026-09-01-overhaul/2026-09-03-g2-morning-handoff.md` | owner double-checks G2 (handoff checklist); then the owner capture session (the S3 packet §7 names the two traces); then S3 |
 | S3 Walk | PACKET DRAFTED 2026-09-03 — implementation BLOCKED on the §7 capture session | `s3-walk-ownership-map.md` (retail table, current owners, four chunks, review lenses, gate, the three exact captures to ask for) + built-mesh/world contracts | — | — | — | folded into G3 | owner capture session first (§7 of the packet names the three traces); chunk 2 may start on the decomp oracle alone |
 | S4 Depth + alpha | PLANNED | depth/alpha contracts + captures | — | — | — | G3 | retires AP-34 |
 | S5 Consumers + closeout | PLANNED | landscape contract; AP-232 | — | — | — | G4 | retires AP-117/AP-232; deletes probes |
diff --git a/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md b/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md
index 291b8263..88462fdd 100644
--- a/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md
+++ b/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md
@@ -145,8 +145,14 @@ Lead verifies every finding against the source before an edit (S2 precedent:
   `ov=4`, EC/OC stamps, 531 `LC`/`SC` land-cell draws per frame in far-to-near
   order over landblocks `f3`–`fe` × `00`–`18`), `cathedral-leak.parts.log`
   (3 frames, 5,933 PD / 965 DM), `cathedral-leak.alphadepth.log` (5 frames,
-  1,407 AM / 2,856 FL / 28 PM / 16 PC). This pose is S3/S4's primary oracle:
-  the target is to reproduce retail's frame at it, leak included.
+  1,407 AM / 2,856 FL / 28 PM / 16 PC). Owner's retail screenshot (2026-09-03, 2013 client, to be saved as
+  `logs/oh-capture/cathedral-leak.retail.png`): standing on the floating
+  stairs in `f4180108`, a large slab of the EXTERIOR wall (arched exterior
+  stone texture) cuts diagonally through the stair chamber from the upper
+  left, drawn over the interior landings and ramps that remain visible around
+  it — the same leak acdream shows at the same spot. This pose is S3/S4's
+  primary oracle: the target is to reproduce retail's frame at it, leak
+  included.
 - Remaining poses per the kit README: `cathedral-arrival`, `holtburg-doorway-still`,
   `terrace-edge`, `foundry-deep`.