docs(render): S4 packet §7 — S4-c1 fix round 1 (retail's ±12 quantifier, seal count order, the automated PM/PC depth-event gate)

The round-0 retail and production lenses both found the guard's
quantifier inverted (the lead's paraphrase); the production lens's DAT
scan found 2,163 exit polygons lying entirely on a ±12 plane, which makes
the guard the likely mechanism behind retail's never-sealed seam family.
The PM/PC transcript comparison becomes the chunk's own gate.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md

@@ -209,6 +209,96 @@ lines of the alpha-depth captures — S4-c1 changes no event unless a ±12
 polygon exists in a captured pose, in which case the transcript is the
 proof); the lead's four-pose self-gate with validation on (zero errors).
 
+## 7. S4-c1 fix round 1 (lead, 2026-09-03 night — after the three-lens review of `c7ab5b6d8`; round 1 of the two the plan allows)
+
+**Verdicts.** Retail lens FAIL, production lens FAIL, build lens (see the
+addendum below). The BLOCKING finding is one defect seen by both: C1's
+quantifier is inverted — the port rejects a polygon when ANY vertex lies on
+ANY ±12 plane; retail (PDB-paired bytes at VA 0x59BCD6–0x59BCE5:
+`fld`/`fcomp 12.0`/`fnstsw`/`test ah,0x44`/`jnp` over `xor bl,bl` — four
+accumulating per-plane flags) rejects only when EVERY vertex lies on the
+SAME plane. The lead's §6 paraphrase carried the same inversion and is
+already corrected (§6 R2/C1/T2). Consequences the lenses proved: the T2
+pins lock the wrong rule in; the guard's doc claims authored polygons
+"essentially never" hit the bound, but the production lens's DAT scan found
+2,889 portal polygons with a ±12 vertex and 2,163 EXIT polygons lying
+ENTIRELY on a ±12 plane; and the §6 depth-event transcript gate (PM/PC
+lines) was neither run nor automated — the one check that would have shown
+the effect on real data. Minor: the manifest re-pin comment has the ULP
+direction inverted and points at the wrong test class.
+
+**Why this matters beyond the round.** If 2,163 exit polygons lie entirely
+on a bounding plane, retail never punches or seals THOSE portals — which is
+the "never-drawn portal polygon = panel" family the PV campaign named
+(#456) and very likely the mechanism behind retail's own cathedral seam
+leak (#465's "hole"). Porting the guard correctly therefore changes acdream's
+seal/punch set at many poses toward retail's; the captured `PM`/`PC` lines
+are the only proof that the change lands exactly, so F3 builds that
+comparison as this slice's own gate (S4's automated gate already requires
+"depth-event transcripts exact against the §7 captures").
+
+**F1 (BLOCKING) — port the quantifier retail has.** Replace
+`IsRejectedByPortalPolygonBoundaryGuard`'s any-vertex test with four
+per-plane predicates (x=+12, x=−12, y=+12, y=−12), each initially true and
+cleared by the first vertex NOT on that plane; reject iff any predicate
+survives all vertices (exact float equality, LOCAL coordinates, before any
+transform), at both producers (`WalkFrameDriver.OnPunchGeometry`'s punch
+path and `RetailPViewPassExecutor`'s seal enumeration). Rewrite the doc
+comment with the DAT counts (recompute them with a scratch scan over the
+installed DAT and cite the numbers in the commit body — the "essentially
+never" sentence is deleted). T2 becomes: every vertex at x=12 → rejected;
+one vertex at x=12, the rest inside → kept, punched/sealed, counted; every
+vertex at x=11.999 → kept; every vertex at y=−12 → rejected; vertices split
+across x=12 and y=12 (none on one common plane) → kept. MUTATION: restore
+the any-vertex form → the "one vertex" and "split planes" cases fail;
+delete the guard → the all-on-plane cases fail. Rewrite the existing T2
+tests and `WalkFrameDriverTests.OnPunchGeometry_RejectsWholePolygonOn…` to
+these semantics (the names say what they pin).
+
+**F2 — count order at the seal path.** Retail: guard → transform → clip →
+count; the fan is skipped when the CLIPPED count is under 3, AFTER the
+counter increment (`0x59BDBC–0x59BDBF`). `RetailPViewPassExecutor`'s seal
+loop drops sub-3-vertex LOCAL polygons before the guard and before
+counting. Port retail's order (authored polygons always have ≥3 vertices,
+so this changes no real frame — pin it with a synthetic 2-vertex polygon:
+counted, not drawn) and note the register row AD-119's neighbour if a
+comment there describes the old order.
+
+**F3 — the depth-event transcript gate, automated.** Parse the four
+`oh-capture/*.alphadepth.log` fixtures' `PM poly=<ptr> mode=<0|1>
+counterBefore=<hex>` and `PC ov=<n> counter=<hex> fc=<0|1>` lines per frame
+(the `oh-capture-alpha-depth.cdb.template` documents them) into per-frame
+sequences of (mode, counterBefore) and (ov, counter, fc); replay each
+pose's frame 2 through `RetailFrameWalk`/`WalkFrameDriver` with a recording
+leaf (the existing `WalkTraceReplayContext` + DAT builder; punch fans =
+mode 1 events, exit seals = mode 0 events; the driver's `PortalsDrawnCount`
+before each event = counterBefore; the interior turn's ov/count/forceClear
+= PC) and compare the sequences exactly. Pointers are not compared. Expect:
+with F1 correct, the four poses match; if a pose does not, the test prints
+both sequences and is tagged `Status=KnownFailure` with the divergence
+written into this section — never weakened. The oracle-side parser lives
+beside `WalkOracleTrace` (a `WalkAlphaDepthTrace`), the comparison beside
+`WalkTraceConformanceTests`. This is the slice's own gate, not extra
+infrastructure.
+
+**F4 — comment truth.** `VulkanShaderManifestTests.cs:80-81`: `0x3F7FFFFE`
+is FARTHER from the camera (larger z/w), and T1 is
+`PortalDepthVert_FarPunchConstant_MatchesRetailExactBits` in that same
+file, not in `WalkVisibilityMathTests`.
+
+**F5 — commit message:** every mutation text verbatim (F1's four, F2's
+one, F3's "swap one PM mode" mutation), the DAT scan numbers and the scan
+method, the per-pose PM/PC match/mismatch table, `Co-Authored-By` last.
+
+**Gates:** build 0 warnings; hermetic fully green; InstalledDat exactly the
+four known plus, if F3 finds a divergence, that row tagged KnownFailure and
+written up here; the shader and register test classes green; the lead's
+four-pose validation self-gate afterwards (zero validation errors; the
+cathedral floating-stairs frame diffed against the S3-closed gate — a
+changed seal set is EXPECTED to change the exterior-slab region if retail's
+panel family is what the guard reproduces; the owner's retail screenshot is
+the oracle for that pose).
+
 ## 5. Open questions to settle before dispatch
 
 - SETTLED (2026-09-03): the walk's `SC` turn is `IWalkEventSink.OnSortCellTurn`