fix(overhaul): integrate reviewed debt-free retirement #475

docs/architecture/acdream-architecture.md

@@ -1238,6 +1238,15 @@ fenced only by an older receipt for the same canonical landblock; the active
 destination's exact receipt may advance ahead of unrelated cleanup without
 reordering the remaining FIFO.
 
+Within a retirement ticket, Runtime's collision-prefix permission continues
+through the same invocation after parking when the exact token remains current
+and no real projection, placement, resident, or collision-dispatch debt exists.
+That lets the coordinator spend its remaining frame meter on subsequent
+debt-free tickets instead of manufacturing one frame boundary per prefix.
+Synchronous cancellation and parking callbacks are exact-owner revalidation
+points; genuine receipt or re-entrant debt still yields at the unchanged FIFO
+head and resumes only after its own acknowledgement.
+
 Accepted publication is likewise retained at its exact priority-queue head.
 `LandblockPresentationPipeline` meters render, physics, static, building, and
 EnvCell receipts one operation at a time; each owner captures stable ordered

docs/research/2026-09-01-overhaul/475-lead-verification.md

@@ -1,6 +1,7 @@
 # #475 — lead verification and review record
 
-Status2026-09-05: **NOT integration-ready; test-only fix round1 in progress.**
+Status2026-09-05: **Test-only fix round1 independently verified; production/
+lifetime review2 PASS with no actionable findings. Graphical timing pending.**
 Contract: `475-debt-free-retirement-contract.md`, including §6 at3db6546eb.
 No graphical475 run or owner acceptance is claimed.
 
@@ -119,3 +120,66 @@ whole-fixture rewrite, screenshot repair, budget change or reveal bypass.
 The production/lifetime review follows the corrected frozen return and lead
 verification; no extra wholesale retail rerun is planned for test-only edits.
 Graphical timing/PNG evidence and owner G4 remain unproven.
+
+## Fix round1 — independently verified corrected return
+
+Only three test files changed in round1; both production raw hashes above
+remain byte-identical. The lead read the entire correction and checked these
+raw file hashes against the frozen return:
+
+| Test file | SHA256 |
+|---|---|
+| RuntimePhysicsStateTests.cs |3F3BD2FD8A28A806ECB092B02FED419D4385ECBBBD98B4C21DA841B845E19088|
+| HeadlessSessionHostTests.cs |4008A19CCBAE4789A0CA46D7E2E58210F88008B2C985BF6FF23C88D951326DE2|
+| RuntimeCollisionPrefixQuiescenceTests.DebtFreeRetirement.cs |05787B3017E194AD7E9018F45B153243B0D3D3BEC3C0CC004E976871DBABFF62|
+
+The allocation tests now assert pre-activation state, then measure the first
+actual CommitCollisionGeneration call; existing1MiB/4MiB bounds and payload,
+facade, notification, capture/seal and second-prefix rebase checks remain.
+The three stale names now truthfully say PayloadBoundedAllocation. Headless's
+empty transaction stops at completion with no synthetic yield; its real
+held Withdraw/Place path explicitly proves yield, kind, exact entity/cell
+identity and token acknowledgement. No Headless production change.
+
+The direct Runtime theory now installs canonical terrain and a nonempty
+indoor CellSurface/EnvCell graph. Before mutation it verifies the actual
+installed Cells entry; afterward, withdrawal removes the key/terrain while
+demotion retains terrain and empties installed Cells. Both remove the graph
+cell, complete on the first admissible call with generation2, and have zero
+terminal mutation/quiescence/projection debt.
+
+Lead inspected the implementer's two effect-mutation TRXs:
+`artifacts/475-round1/mutation-bypass-withdraw-final/475-r1-mutation-bypass-withdraw-final.trx`
+fails only the withdrawal row (terrain expected absent, actual present);
+`mutation-bypass-demote-final/475-r1-mutation-bypass-demote-final.trx`
+fails only the demotion row (installed Cells expected empty, actual one cell).
+Both are1passed/1failed and fail at the intended postcondition. The
+implementer reports raw pre/post restoration of both production files; lead
+independently verified their current exact hashes. These two effect mutations
+were NOT re-executed by the lead; the four earlier categories were.
+
+Fresh lead Release build with the same quiet command above:0W0E/exit0,
+`artifacts/475-lead/round1-release.log`. After client absence checks before
+every command, lead re-ran the same command template above:
+
+| Stem / project | Filter | Result |
+|---|---|---|
+| round1-runtime-hermetic / Runtime |Same six Lane exclusions as the earlier Runtime hermetic run|1891/1891,0skips,exit0|
+| round1-headless / Headless |Same two caller classes as headless-callers|48/48,0skips,exit0|
+| round1-app / App |Union of the exact app-final and app-callers filters above|297/297,0skips,exit0|
+
+The complete frozen scope is now11files (10modified +1new partial).
+Retail review1's test-only findings are reconciled by the lead; production/
+lifetime review2 is examining the complete corrected candidate. No separate
+wholesale retail review was launched and no graphical acceptance is inferred.
+
+Production/lifetime review2 returned PASS, no actionable findings. It checked
+all11 source/document hashes, current assemblies, intended mutation failures
+and the lead1891/48/297 green TRXs. Both lenses are closed; round1 changed
+tests only and the lead reconciled retail review1's two findings.
+
+The owner then requested the latest build immediately, with a two-minute
+availability window. Integrate, rebuild Release and launch a manual portal
+re-test before the automated nine-hop run; this explicit owner ordering does
+not constitute a timing PASS or G4 acceptance. Do not build/test while that
+client is open. The normal automated route remains owed.