docs(overhaul): contract S5 c3 fix round 3

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -691,8 +691,8 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S4-c3b | **LANDED 2026-09-04** — implementation `26e97ba41`, provenance contract `5110bf676`, packet-only correction `3f2f00c9f`; packet §22–§25. Dead classic-group `LocalSortCenters`/`CachedBatch.LocalSortCenter` storage and the alpha camera-parameter/digest chain are deleted. Live per-cell/particle CYpt keys, opaque `SortDistance`, building/private/portal distances, two FIFO lists, all state/barriers, and AP/AD rows remain. | **G3 LEAD SELF-GATE PROVISIONAL PASS; owner acceptance/owner-only rows pending. G4 UNPASSED.** | Retail/deletion lens PASS. Production lens found no code defect and one artifact-provenance omission; packet-only fix round 1 passed its narrow re-review. Fresh campaign: Release 0W/0E; App 132/132; Core 29/29; allocation 2/2 at 0 B; shader 32/32. G3: route 1 13/13, route 2 4/4, route 3 retry 3/3, all exit 0/graceful. The first route-3 attempt stopped before Nanto on registered #462. Exact PNG paths: packet §25. |
 | S5-c1 | **LANDED 2026-09-04 after the owner-authorized documentation/evidence exception.** Mandatory stop `efb075619` remains in history; final campaign tip `1718832e2`, reviewed scratch tip `b2d56f9e3`. | G4 UNPASSED | Narrow exception re-review PASS. Clean evidence: hermetic 16,760/16,760; inclusive InstalledDat 385 pass / the same documented 10 fail / 1 skip; both exact `d6592d3ac`, `WorktreeDirty=false`, manifests fully verified. Fresh campaign Release 0W/0E, Core 111/111, visibility 38/38, allocation/AP-116 4/4. Lead graphical portal-haze gate PROVISIONAL PASS, exit 0/graceful, 10 PNGs under `logs/selfgate-20260904-171137-s5c1-particle-visibility`; owner inspection pending. |
 | S5-c2 | **LANDED + REVIEW-CLOSED 2026-09-04; lead graphical gate PROVISIONAL PASS.** Campaign stack `a4de2efc4` -> `048027e71` -> `ef819eedf`; reviewed scratch tip `521f5edda54`; packet §§14–16. The opt-in IA-24 path borrows the exact prior-completed landscape set/flag, selects world casters through S2 CELLARRAY or building `EffectCellId`, selects authored terrain slots, and projects exact active instance runs without rebuilding retained topology. Pack-off remains unchanged. | G4 UNPASSED | Retail/deviation PASS; production's documentation-only fix round 1 narrowly re-reviewed PASS. Fresh campaign Release 0W/0E and affected 137/137. Official evidence: hermetic 16,768/16,768; broader InstalledDat 468 pass / 10 fail / 1 skip; canonical 385 pass / the same 10 fail / 1 skip; manifests and nonpassing identities exact. Valid lead gate `logs/selfgate-20260904-183925-s5c2-candidate-shadow-ab`: seven PNGs, exit 0, graceful logout, no fatal match, no client left. Exact parent `5c106bcdf` A/B at `s5-c2-ab-parent/logs/selfgate-20260904-183815-s5c2-parent-shadow-ab` proves the gate-visible dark lighting switch predates c2; #469/IA-24 carry it for resolution or explicit owner acceptance before G4. Owner PNG inspection pending. |
-| S5-c3 | **IMPLEMENTED IN SCRATCH; RETAIL REVIEW PASSES 1–2 FAIL; FIX ROUND 2 CONTRACTED 2026-09-04.** Packet §17 is the base contract; §§18–19 are bounded repairs. | G4 UNPASSED | The typed building selection, exact complete-body gate/order, Setup part zero, selected shell/residency, shared owner, Config wiring, census, scope, and mutations passed lead verification. Fix round 1 corrected the FPS, selector, qword-stability, candidate witness, and AP-198 findings. Narrow review pass 2 proved one remaining MAJOR exact-port defect: CalcDegLevel stores its evolving numerator to binary32 after w0/w1/w2/w3, then adds w4 and divides wide; the implementation combined all five terms before one store. The discriminating 16.25-FPS candidate is one bit wrong. OpenAI fix round 2 is limited to that schedule and its bit pin; narrow retail review pass 3 then the full sequential production review precede landing. |
+| S5-c3 | **IMPLEMENTED IN SCRATCH; RETAIL REVIEW PASS 3 PASS; PRODUCTION REVIEW PASS 4 FAIL; FIX ROUND 3 CONTRACTED 2026-09-04.** Packet §17 is the base contract; §§18–20 are bounded repairs. | G4 UNPASSED | Retail arithmetic, typed selection, complete-body gate/order, selected transform/surfaces, Config wiring, census, scope, and allocation paths pass. Production review found that nonzero ladder meshes lack ordinary landblock-lifetime ownership, normal walk frames do not rearm miss requests, and the exactly-once tick proof survives duplicate ticks. §20 bounds those lifecycle repairs and the discriminating order proof; narrow OpenAI production re-review pass 5 precedes landing. |
-| S5 | IN FLIGHT — c1 and c2 landed/review-closed/provisionally self-gated; c3 fix round 2 contracted; c4–c5, #469 disposition, closeout, and G4 remain | G4 | Packet §§7 and 12–19 are binding; S5-c3's bounded review repair is next; never merge main before G4. |
+| S5 | IN FLIGHT — c1 and c2 landed/review-closed/provisionally self-gated; c3 fix round 3 contracted; c4–c5, #469 disposition, closeout, and G4 remain | G4 | Packet §§7 and 12–20 are binding; S5-c3's bounded lifecycle repair is next; never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -1,8 +1,8 @@
 # Campaign OVERHAUL v2 — S5 consumers, material, and closeout packet
 
 **Status:** S5-c1 and S5-c2 LANDED + lead graphical gates PROVISIONAL PASS;
-S5-c3 implemented in scratch; retail review passes 1 and 2 FAIL, and bounded
+S5-c3 implemented in scratch; retail review pass 3 PASS, production review
-fix round 2 is contracted under §19.
+pass 4 FAIL, and bounded fix round 3 is contracted under §20.
 **Branch:** `claude/campaign-w-retail-frame-walk`.
 **Gate:** G4 remains unpassed. Nothing merges to `main` before G4.
 
@@ -1236,8 +1236,9 @@ one shared owner/tick, one typed selection, no retained mutation/base fallback/
 renderer DAT read/topology rebuild, async residency, transform/material/
 lifecycle identity, allocation, allowed scope, build/lane provenance, and at
 least three reproduced sabotage claims. Reviews run sequentially. A failed
-lens gets one bounded fix contract; a chunk needing a third fix round stops
+lens gets one bounded fix contract. Under the owner override, S5-c3 may use at
-and is written up.
+most ten review passes and stops before an eleventh; documentation-only
+findings may be corrected directly by the lead.
 
 ## 18. S5-c3 fix round 1 — x87 store schedule and register truth
 
@@ -1305,7 +1306,7 @@ reverse the FPS slot direction. Restore every mutation before return.
 already feeds `RuntimeSettingsController`'s live far radius, and the Config
 controller maps its persisted default 8 to the selected Medium entry. Remove
 that control from AP-198, change every six-row statement to five, and delete
-the obsolete no-highlight sub-note. Keep the actual Config dim set at 17/27;
+the obsolete no-highlight sub-note. Keep the actual Config dim set at 16/27;
 S5-c3 still changes only Automatic Degrades, Graphics Performance, and Degrade
 Distance from store-only to live. No row is added or retired, so active table
 counts do not change. Add or update a truth pin that fails on the old six-row
@@ -1342,7 +1343,7 @@ OpenAI retail review pass 2/10 returned **FAIL** on one remaining MAJOR F1
 defect. Fix round 1 otherwise passed: the FPS witness is `0x43A6AAAB`, the
 14-FPS candidate is `0x3BB2BC0A`, the selector boundary stays at level zero,
 the qword `0.01` edge and physical FPS slot direction pass, and AP-198 now
-states the exact five-row residual while AD-78 remains 17/27. The reviewer
+states the exact five-row residual while AD-78 is corrected to 16/27. The reviewer
 also re-confirmed the paired executable/PDB identity, clean allowed scope,
 the exact installed census, and the official evidence identities.
 
@@ -1389,3 +1390,109 @@ Return the exact two-file diff, `git diff --check`, Release solution build
 0W/0E, every lane above, and the mutation's first failure. The same OpenAI
 retail lens performs narrow review pass 3/10 over §19 first. Only its PASS
 unlocks the sequential full architecture/production/gate-honesty review.
+
+## 20. S5-c3 fix round 3 — ladder ownership, retry rearm, and tick proof
+
+OpenAI retail review pass 3/10 returned **PASS** after independently pairing
+the exact executable and PDB and confirming the literal four-store CalcDeg
+schedule. The sequential OpenAI architecture/production/gate-honesty review
+pass 4/10 returned **FAIL** on two production lifecycle defects and one
+non-discriminating test. Typed selection, complete-body gating/order, selected
+transform and surface borrowing, Config wiring, exact installed census,
+allocation-free controller/selector/classifier paths, and the restored retail
+math witnesses otherwise passed. This bounded round does not reopen retail
+selection math or rendering policy.
+
+### 20.1 R3-A — own every nonzero building ladder mesh
+
+Selected non-base degrade meshes are requested through
+`WbMeshAdapter.EnsureLoaded`, but asynchronous publication is admitted only
+while `ObjectMeshManager` sees an ownership reference. Landblock registration
+owns retained base `MeshRefs` and prepared EnvCell geometry, not the nonzero
+GfxObj IDs in building degrade ladders. A selected ladder ID can therefore
+remain permanently non-drawable unless an unrelated owner happens to hold it.
+
+Carry the unique nonzero ladder GfxObj IDs derived from the worker-built
+`EnvCellLandblockBuild.WalkBuildings` through the existing landblock
+publication/lifetime transaction as **ordinary mesh ownership**, distinct
+from prepared EnvCell IDs. Requirements:
+
+1. exclude the retail zero sentinel and deduplicate ladder IDs, including any
+   overlap with retained base `MeshRefs`;
+2. acquire them through the existing `IncrementRefCount`/ordinary desired and
+   held path before readiness can complete; do not treat them as prepared
+   EnvCell pins and do not acquire them from the per-frame classifier;
+3. balance ownership across initial publication, Far-to-Near promotion,
+   Near-to-Far retirement, full unload, replacement, partial publication
+   failure, reset, and same-location revisit, without duplicate increments;
+4. preserve selected-only submission: an unavailable selected mesh remains a
+   skipped shell, never a resident-base fallback; and
+5. keep the carrier precomputed/immutable and the frame walk allocation-free.
+
+Add a production-path proof using the real `ObjectMeshManager` and
+`WbMeshAdapter`, without direct `ObjectRenderData` injection: a non-base
+selected ladder dependency becomes owned, its valid prepared result reaches
+upload/publication, and a later frame can submit it. Add focused lifecycle
+proofs for balanced release, cancellation/partial failure, reset, and revisit.
+Sabotage by dropping ladder dependency publication and by dropping one release
+edge; record the first failing assertions and restore both mutations.
+
+### 20.2 R3-B — rearm mesh-miss requests at the real walk-frame boundary
+
+`WbDrawDispatcher` clears `_missRequested` only from the legacy flat/entity
+dispatch boundary. Normal PView walk frames use `BeginWalkPartFrame`, so a
+once-missed selected ID remains suppressed across later frames and after
+cancellation, eviction, or revisit.
+
+Clear `_missRequested` once at the successful `BeginWalkPartFrame` boundary,
+after its double-open guard has accepted the new frame. Preserve
+`_missLogged` as the once-per-lifetime diagnostic set. Prove that the same ID
+requested twice in one frame emits one preparation request, the next accepted
+frame can request it again, and cancellation/eviction/revisit converge without
+an unbounded request-dedup set. Sabotage by deleting the frame-boundary clear
+and record the first failure, then restore it.
+
+### 20.3 R3-C — make exactly-once tick and ordering discriminating
+
+The production orchestrator contains one accepted-frame degrade tick, but its
+test uses constant `0.05` samples and checks only eventual 20 FPS; duplicating
+the production tick survives that proof.
+
+Strengthen the orchestrator lane with an independent call-count and order
+recorder: each accepted nonzero-area render frame ticks the one shared owner
+exactly once, a zero-area/rejected frame ticks zero times, and the tick occurs
+before `BeginFrame` and downstream walk work. Use a nonuniform, hard-coded
+duration sequence with exact expected published FPS bits so a duplicate or
+shifted sample changes the result. Sabotage by duplicating the tick and
+independently moving it after `BeginFrame`; both mutations must fail at named
+assertions and then be restored.
+
+### 20.4 Lead-owned documentation corrections
+
+The lead may directly repair the Config controller prose to describe the three
+now-live degrade controls; pin AP-198's five residual rows; correct the Config
+dim set and AD-78 count to 16/27; change both portal-gate diagnostic effective-
+distance calculations to use the selected distance 50 rather than 100; and
+add a Config-test aggregate pin that exactly 16 rows remain store-only.
+
+### 20.5 Scope, return, and review order
+
+Production scope is limited to the worker-built ladder dependency carrier,
+the landblock publication receipt and ordinary/prepared ownership split through
+`GpuWorldState`/`LandblockSpawnAdapter`, the successful walk-frame boundary,
+and the existing render orchestrator seam needed for a discriminating order
+test. Tests may extend the corresponding focused build, publication,
+dispatcher, classifier, and orchestrator suites. Do not change retail degrade
+math, selector thresholds, complete-body logic, transforms, surfaces,
+fallback policy, RHI/shaders, DAT readers, or unrelated lifecycle owners. No
+client, commit, campaign-doc edit, or subagent; the lead owns those actions.
+
+Return the exact changed-file list, `git diff --check`, Release solution build
+0W/0E, the focused ownership/lifecycle/retry/order lanes, all prior S5-c3
+math/selection/census/allocation lanes, official hermetic lane, inclusive
+InstalledDat lane with every documented nonpassing identity, and the five
+required mutation failures. The same OpenAI production lens performs narrow
+review pass 5/10 over §20 and the full corrected stack. Its PASS, together
+with retail pass 3, unlocks lead integration and the clean-HEAD graphical
+self-gate; any further code finding receives another bounded contract, with a
+hard stop before review pass 11.