docs(overhaul): contract S5 c3 fix round 3

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -1,8 +1,8 @@
 # Campaign OVERHAUL v2 — S5 consumers, material, and closeout packet
 
 **Status:** S5-c1 and S5-c2 LANDED + lead graphical gates PROVISIONAL PASS;
-S5-c3 implemented in scratch; retail review passes 1 and 2 FAIL, and bounded
-fix round 2 is contracted under §19.
+S5-c3 implemented in scratch; retail review pass 3 PASS, production review
+pass 4 FAIL, and bounded fix round 3 is contracted under §20.
 **Branch:** `claude/campaign-w-retail-frame-walk`.
 **Gate:** G4 remains unpassed. Nothing merges to `main` before G4.
 
@@ -1236,8 +1236,9 @@ one shared owner/tick, one typed selection, no retained mutation/base fallback/
 renderer DAT read/topology rebuild, async residency, transform/material/
 lifecycle identity, allocation, allowed scope, build/lane provenance, and at
 least three reproduced sabotage claims. Reviews run sequentially. A failed
-lens gets one bounded fix contract; a chunk needing a third fix round stops
-and is written up.
+lens gets one bounded fix contract. Under the owner override, S5-c3 may use at
+most ten review passes and stops before an eleventh; documentation-only
+findings may be corrected directly by the lead.
 
 ## 18. S5-c3 fix round 1 — x87 store schedule and register truth
 
@@ -1305,7 +1306,7 @@ reverse the FPS slot direction. Restore every mutation before return.
 already feeds `RuntimeSettingsController`'s live far radius, and the Config
 controller maps its persisted default 8 to the selected Medium entry. Remove
 that control from AP-198, change every six-row statement to five, and delete
-the obsolete no-highlight sub-note. Keep the actual Config dim set at 17/27;
+the obsolete no-highlight sub-note. Keep the actual Config dim set at 16/27;
 S5-c3 still changes only Automatic Degrades, Graphics Performance, and Degrade
 Distance from store-only to live. No row is added or retired, so active table
 counts do not change. Add or update a truth pin that fails on the old six-row
@@ -1342,7 +1343,7 @@ OpenAI retail review pass 2/10 returned **FAIL** on one remaining MAJOR F1
 defect. Fix round 1 otherwise passed: the FPS witness is `0x43A6AAAB`, the
 14-FPS candidate is `0x3BB2BC0A`, the selector boundary stays at level zero,
 the qword `0.01` edge and physical FPS slot direction pass, and AP-198 now
-states the exact five-row residual while AD-78 remains 17/27. The reviewer
+states the exact five-row residual while AD-78 is corrected to 16/27. The reviewer
 also re-confirmed the paired executable/PDB identity, clean allowed scope,
 the exact installed census, and the official evidence identities.
 
@@ -1389,3 +1390,109 @@ Return the exact two-file diff, `git diff --check`, Release solution build
 0W/0E, every lane above, and the mutation's first failure. The same OpenAI
 retail lens performs narrow review pass 3/10 over §19 first. Only its PASS
 unlocks the sequential full architecture/production/gate-honesty review.
+
+## 20. S5-c3 fix round 3 — ladder ownership, retry rearm, and tick proof
+
+OpenAI retail review pass 3/10 returned **PASS** after independently pairing
+the exact executable and PDB and confirming the literal four-store CalcDeg
+schedule. The sequential OpenAI architecture/production/gate-honesty review
+pass 4/10 returned **FAIL** on two production lifecycle defects and one
+non-discriminating test. Typed selection, complete-body gating/order, selected
+transform and surface borrowing, Config wiring, exact installed census,
+allocation-free controller/selector/classifier paths, and the restored retail
+math witnesses otherwise passed. This bounded round does not reopen retail
+selection math or rendering policy.
+
+### 20.1 R3-A — own every nonzero building ladder mesh
+
+Selected non-base degrade meshes are requested through
+`WbMeshAdapter.EnsureLoaded`, but asynchronous publication is admitted only
+while `ObjectMeshManager` sees an ownership reference. Landblock registration
+owns retained base `MeshRefs` and prepared EnvCell geometry, not the nonzero
+GfxObj IDs in building degrade ladders. A selected ladder ID can therefore
+remain permanently non-drawable unless an unrelated owner happens to hold it.
+
+Carry the unique nonzero ladder GfxObj IDs derived from the worker-built
+`EnvCellLandblockBuild.WalkBuildings` through the existing landblock
+publication/lifetime transaction as **ordinary mesh ownership**, distinct
+from prepared EnvCell IDs. Requirements:
+
+1. exclude the retail zero sentinel and deduplicate ladder IDs, including any
+   overlap with retained base `MeshRefs`;
+2. acquire them through the existing `IncrementRefCount`/ordinary desired and
+   held path before readiness can complete; do not treat them as prepared
+   EnvCell pins and do not acquire them from the per-frame classifier;
+3. balance ownership across initial publication, Far-to-Near promotion,
+   Near-to-Far retirement, full unload, replacement, partial publication
+   failure, reset, and same-location revisit, without duplicate increments;
+4. preserve selected-only submission: an unavailable selected mesh remains a
+   skipped shell, never a resident-base fallback; and
+5. keep the carrier precomputed/immutable and the frame walk allocation-free.
+
+Add a production-path proof using the real `ObjectMeshManager` and
+`WbMeshAdapter`, without direct `ObjectRenderData` injection: a non-base
+selected ladder dependency becomes owned, its valid prepared result reaches
+upload/publication, and a later frame can submit it. Add focused lifecycle
+proofs for balanced release, cancellation/partial failure, reset, and revisit.
+Sabotage by dropping ladder dependency publication and by dropping one release
+edge; record the first failing assertions and restore both mutations.
+
+### 20.2 R3-B — rearm mesh-miss requests at the real walk-frame boundary
+
+`WbDrawDispatcher` clears `_missRequested` only from the legacy flat/entity
+dispatch boundary. Normal PView walk frames use `BeginWalkPartFrame`, so a
+once-missed selected ID remains suppressed across later frames and after
+cancellation, eviction, or revisit.
+
+Clear `_missRequested` once at the successful `BeginWalkPartFrame` boundary,
+after its double-open guard has accepted the new frame. Preserve
+`_missLogged` as the once-per-lifetime diagnostic set. Prove that the same ID
+requested twice in one frame emits one preparation request, the next accepted
+frame can request it again, and cancellation/eviction/revisit converge without
+an unbounded request-dedup set. Sabotage by deleting the frame-boundary clear
+and record the first failure, then restore it.
+
+### 20.3 R3-C — make exactly-once tick and ordering discriminating
+
+The production orchestrator contains one accepted-frame degrade tick, but its
+test uses constant `0.05` samples and checks only eventual 20 FPS; duplicating
+the production tick survives that proof.
+
+Strengthen the orchestrator lane with an independent call-count and order
+recorder: each accepted nonzero-area render frame ticks the one shared owner
+exactly once, a zero-area/rejected frame ticks zero times, and the tick occurs
+before `BeginFrame` and downstream walk work. Use a nonuniform, hard-coded
+duration sequence with exact expected published FPS bits so a duplicate or
+shifted sample changes the result. Sabotage by duplicating the tick and
+independently moving it after `BeginFrame`; both mutations must fail at named
+assertions and then be restored.
+
+### 20.4 Lead-owned documentation corrections
+
+The lead may directly repair the Config controller prose to describe the three
+now-live degrade controls; pin AP-198's five residual rows; correct the Config
+dim set and AD-78 count to 16/27; change both portal-gate diagnostic effective-
+distance calculations to use the selected distance 50 rather than 100; and
+add a Config-test aggregate pin that exactly 16 rows remain store-only.
+
+### 20.5 Scope, return, and review order
+
+Production scope is limited to the worker-built ladder dependency carrier,
+the landblock publication receipt and ordinary/prepared ownership split through
+`GpuWorldState`/`LandblockSpawnAdapter`, the successful walk-frame boundary,
+and the existing render orchestrator seam needed for a discriminating order
+test. Tests may extend the corresponding focused build, publication,
+dispatcher, classifier, and orchestrator suites. Do not change retail degrade
+math, selector thresholds, complete-body logic, transforms, surfaces,
+fallback policy, RHI/shaders, DAT readers, or unrelated lifecycle owners. No
+client, commit, campaign-doc edit, or subagent; the lead owns those actions.
+
+Return the exact changed-file list, `git diff --check`, Release solution build
+0W/0E, the focused ownership/lifecycle/retry/order lanes, all prior S5-c3
+math/selection/census/allocation lanes, official hermetic lane, inclusive
+InstalledDat lane with every documented nonpassing identity, and the five
+required mutation failures. The same OpenAI production lens performs narrow
+review pass 5/10 over §20 and the full corrected stack. Its PASS, together
+with retail pass 3, unlocks lead integration and the clean-HEAD graphical
+self-gate; any further code finding receives another bounded contract, with a
+hard stop before review pass 11.