docs(overhaul): correct reset convergence contract for #474

docs/research/2026-09-01-overhaul/474-publication-repair-contract.md

@@ -1,6 +1,6 @@
 # #474 bounded repair — destination backend before restore acknowledgement
 
-Status: lead contract, round0, 2026-09-05. Diagnosis/evidence base
+Status: lead contract, round0 amendment A, 2026-09-05. Diagnosis/evidence base
 `3a9d5b01a881e56bd93211a5f78a80ea2767a7c0`. This is the immediate S5/G4 blocker;
 C1c and section45 geometry work remain preserved/unmodified.
 
@@ -20,9 +20,11 @@ Expected production scope:
 - `src/AcDream.App/Streaming/GraphicalRemotePlacementServiceWindow.cs`;
 - `src/AcDream.App/Composition/SessionPlayerComposition.cs`.
 
-`LandblockPhysicsPublisher.cs` is allowed only if required to preserve its
-post-engine cancellation/acknowledgement lifecycle, with an exact test.
-No other production file without a lead contract amendment.
+Amendment A excludes `LandblockPhysicsPublisher.cs` and changes to the
+cancellation API: the asserted controller cancellation path was disproved
+below. Remove only this chunk's temporary cancellation edits with an explicit
+patch; preserve all other work. No other production file without a lead
+contract amendment.
 Tests: concrete-pipeline, controller-readiness and remote-service-window
 tests; one focused new test/fixture file if sharing the real Runtime/sink
 composition cannot be cleanly expressed in the existing concrete fixture.
@@ -66,20 +68,31 @@ commit; this ordering is an explicit async adaptation, not a retail algorithm.
    reserve work twice, bypass the meter from a Settings/reset callback, repeat
    static scripts or report completion while an exact suffix is outstanding.
 
-### Cancellation hole that MUST be exercised
+### Reset/recenter lifecycle — amendment A corrects the original assumption
 
 The engine transfer can succeed just as the meter expires BEFORE the early
-spatial helper runs. A later recenter/reset calls CancelPendingPublications;
-`LandblockPhysicsPublication.TryCancel` sets CancellationRequested and Runtime
-then waits on the same restore ACK. Ordinary AdvanceCompleteOne refuses a
-cancelled publication. Therefore testing only cancellation AFTER the backend
-is installed is insufficient. Explicitly cover cancellation between engine
-transfer and backend activation, including a yielded/throwing activation.
-Keep the committed engine; resume only the required metered backend/ACK suffix
-under exact retained ownership, then let the existing retirement flow detach
-and clean it. No post-engine rollback, unmetered hidden resume or leaked
-ready fence. If this needs a broader owner/API change, report the exact seam
-to the lead before making it.
+spatial helper runs. The original contract incorrectly asserted that a later
+ordinary reset/recenter cancels this retained transaction. Both production
+controller paths first call `AdvanceGeneration`, which returns false until
+`ConvergePendingPublications` finishes every retained publication. Only then
+can they reach `CancelPendingPublications`. The intervening production
+`LandblockStreamer.ClearPendingLoads` posts a worker `ClearLoads` job; it
+does not create a pipeline publication. Thus the normal controller reaches
+cancellation with no retained publication, not with this post-engine receipt.
+The lead and implementer independently checked both callers and the binding
+in `SessionPlayerComposition` against the unchanged contract-base source.
+
+Test that ACTUAL reset/recenter convergence before and after early backend
+activation, including a yielded/throwing activation. Keep the committed engine;
+resume the metered backend/ACK suffix before the existing retirement flow
+detaches and cleans it. No post-engine rollback, unmetered hidden resume or
+leaked ready fence. Do not add cancellation machinery or manipulate private
+controller flags solely to satisfy the disproved mechanism. The existing
+`LandblockPhysicsPublisherTests.ReplacementYieldsAtHeldWithdrawAndPlaceWithoutPostEngineReseal`
+already exercises direct `TryCancel` before/after its exact Place ACK; rerun
+it unchanged, and label that evidence separately from real controller coverage.
+If a genuine production cancellation counterexample is found, report its
+exact caller/state before widening this repair.
 
 ## 3. Mandatory discriminating regressions
 
@@ -102,11 +115,13 @@ predicate alone does not prove the regression.
 - **T3 metering:** small entity budget and deterministic clock exhaustion at
   the post-engine/pre-backend edge. Next admissible frame must make progress;
   limits hold, engine transfer and completed prefix effects never repeat.
-- **T4 cancellation/retry:** both before and after backend activation after
+- **T4 reset/recenter/retry:** both before and after backend activation after
   engine transfer; include an injected activation/reconciliation failure.
   Preserve no-rollback, exact suffix retry, balanced pins/scripts and eventual
-  withdrawal/retirement. Test the real controller cancellation path where the
-  meter/retained publication interaction matters, not only `TryCancel` alone.
+  withdrawal/retirement. Test the real controller convergence path where the
+  meter/retained publication interaction matters, for both reset and recenter;
+  do not relabel it as cancellation. Also rerun the existing direct `TryCancel`
+  lifecycle regression without changing that API.
 - **T5 admission controls:** unpublished/pending-only/Far remains rejected;
   completed Near accepted; incomplete unrelated landblock does not block the
   selected destination; complete presentation with later replay/recovery

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -4415,12 +4415,29 @@ No merge main before G4.
 regressions. It permits the existing observer-atomic spatial operation after
 engine commit but before restore acknowledgement, while retaining the original
 physics/static-plugin completion order and explicit readiness/service-window
-fences. It calls out cancellation after engine transfer but before a metered
-backend step as a mandatory test, and requires a real cross-prefix seam control
+fences. Its original cancellation-path assumption is corrected by amendment A
+below; actual reset/recenter convergence after engine transfer but before a
+metered backend step remains mandatory. It requires a real cross-prefix seam control
 before claiming broader closure. The lead independently verified the named
 landscape initialization order against the paired PE; the modern receipt split
 remains an AD-2 adaptation. Contract committed31960039b; round0 implementation
 DISPATCHED to one OpenAI agent in fresh
 `C:\Users\erikn\source\repos\acdream\.claude\worktrees\s5-474-openai-impl`,
 branch`codex/s5-474-openai-impl`, at that exact base. No implementation result,
-review or gate is yet claimed. C1c's nine-file return remains untouched.
+review or gate was claimed at dispatch. C1c's nine-file return remains untouched.
+
+### Round0 amendment A — lifecycle assumption disproved
+
+Before independent review, the lead and implementer independently verified
+that BOTH production reset/recenter paths call `AdvanceGeneration` and fully
+`ConvergePendingPublications` before `CancelPendingPublications`; the intervening
+worker-inbox clear cannot create a publication. The original contract assumed
+a normal post-engine cancellation path that does not execute. Correct the
+contract rather than build machinery around that assumption: remove this
+chunk's temporary publisher/cancellation API edits, test the actual metered
+reset/recenter convergence and activation-failure retry, and rerun the existing
+direct `TryCancel` regression unchanged. This is a contract correction, not a
+new retail behavior/deviation or a completed review pass. T1 has a discriminating
+old-order missing-backend failure and a green repair run; the implementer's
+T1–T3 checkpoint is 3/3. Remaining mandatory cases, final review and graphical
+gate are still outstanding; no broad completion is inferred from those tests.