docs: U20 claimed exoneration the reruns cannot support

Two corrections to U20 and the lane record for a2d5b26.

U20 said six green control runs establish that the observing diff is
not the cause. They do not. They establish non-reproduction in six
runs, which is all a rerun ever establishes in this registry --- a tree
that fails intermittently can carry a changed failure rate that six
runs are far too few to see. Treating non-reproduction as exoneration
is exactly the reasoning this file refuses when a rerun turns a red
green. What the controls actually do is remove the easy story and leave
the question open, and the row now says so.

The margin comparison was also arithmetic dressed as a phrase. "A third
again worse" than U6's 1.592 is not what 1.879 is: as a ratio it is
1.18x, as budget excess (0.879 over versus 0.592 over) it is 1.48x.
Both numbers are now given, with the note that they answer different
questions --- which is why neither gets compressed into an adjective.

The ledger records clause 5's replacement half and the two witness
repairs that came with it, both being assertions that looked strict and
were not: an origin that merely came down rather than landing on the
exact bound, and a rationale about the caret's position that the
fixture made false.

docs/active-work.md

@@ -319,7 +319,7 @@ Framing
 this base, the panel-replay prerequisite recorded as DISCHARGED by #243,
 and the both-axis effect witness still owed.
 
-**Landed so far** (latest verified code head `9cb610e`)**:** B1's per-target fractional
+**Landed so far** (latest verified code head `a2d5b26`)**:** B1's per-target fractional
 wheel residual (the producer), B2's daemon-side horizontal panel leg,
 B3/B7's shared `scroll_window_columns` with its saturated bound and wrap
 pin, B4's middle-click PRIMARY paste, **B6's minimap wheel routing**,
@@ -393,6 +393,31 @@ setup assertions rather than by reading:
   mode and content width**, so a geometry or wrap change reaches the
   follow one frame late. L7a and L8 paint twice and say why.
 
+**`a2d5b26` then closed clause 5's replacement half**, which the first
+latch commit had left undone: three TUI paths replace a window's buffer
+— `switch_active_buffer_for`, `install_buffer_in_window` and the
+daemon's `align_primary_document_window` — and **none cleared
+`view_left` or the latch**. Two already reset cursor, selection and
+`view_top` a line at a time; the horizontal origin was simply missing
+from the list. One `Window::forget_manual_horizontal_origin`, three
+call sites, three rows (L8b/L8c/L8d), each firing only on its own call
+site's removal. L8d sits in `daemon.rs` because that function is
+private there.
+
+Two witness repairs in the same commit, both of the same shape — an
+assertion that looked strict and was not:
+
+- **L7a asserted only that the origin came DOWN.** Any arbitrary
+  reduction satisfied that, including an off-by-one that strands a
+  column. It now asserts `widest − viewport` exactly, against a named
+  fixture constant, and is mutation-checked with that off-by-one.
+- **L4's stated rationale was false.** It claimed the caret stays
+  inside the viewport after the vertical wheel; with short filler lines
+  the caret clamped to their end, LEFT of the origin — so the origin
+  discriminated too and the reason given for using the latch instead
+  did not hold. The filler is now 120 columns and the row asserts the
+  caret is still inside, through `pos_to_display`.
+
 **Still owed on this axis: L7b (content shrink), and the GPU's entire
 read side with L2 and L5's GPU leg.** The GPU's four writes remain
 inert until something consults them.

docs/ci-red-signatures.md

@@ -1100,17 +1100,23 @@ one loaded machine. One test alone does not carry that argument.
 | **job / flavor** | local (Linux), bare `cargo test --lib` (default features), full-lib load, **not** `scripts/gate` |
 | **required fragments** | `composition machinery added more than 10% overhead` + a ratio; the run also printed `dispatch overhead : 87.9%` and `realistic overhead : 82.1%` |
 | **status** | **ONE occurrence.** Not reproduced in six subsequent full-lib runs — three on the observing tree and three on the same tree with the observing diff reverted |
-| **margin** | **1.879 against a 1.10 budget** (`single=158789 ns, dispatch=298366 ns`). Recorded because U11 taught this registry what a missing margin costs. This is far the largest margin any occurrence of this selector has shown: U6's five were 1.297, 1.182, 1.592, 1.527 and one unrecorded |
-| **what IS established** | the observing diff (`9cb610e`, the TUI horizontal-authority latch) adds work to the paint path, so it was a live suspect. It was tested rather than argued about: three full-lib runs with the diff and three with `src/editor.rs` and `src/window.rs` restored to HEAD. **All six green.** The single failure is therefore not reproducible either way |
+| **margin** | **1.879 against a 1.10 budget** (`single=158789 ns, dispatch=298366 ns`). Recorded because U11 taught this registry what a missing margin costs. It is the largest this selector has shown: U6's were 1.297, 1.182, 1.592, 1.527 and one unrecorded. Against the previous worst of 1.592 that is **1.18× as large as a ratio, or 1.48× as much budget excess** (0.879 over vs 0.592 over) — two different numbers for two different questions, which is why neither is summarized here as a single adjective |
+| **what IS established** | the observing diff (`9cb610e`, the TUI horizontal-authority latch) adds work to the paint path, so it was a live suspect. Three full-lib runs with the diff and three with `src/editor.rs` and `src/window.rs` restored to HEAD: **all six green.** That establishes **non-reproduction in six runs, and nothing more** — this registry's own rule is that reruns establish intermittence only |
 | **what is NOT** | why it fired. The load confound is once again unmeasured — no `/proc/loadavg` reading was taken at the moment of failure, which is the same gap U15 exists to close |
 
 **The margin is the part that does not fit.** 1.879 is not a budget
 missed by a hair; it is the machinery costing nearly twice what the
-budget allows, and it is a third again worse than U6's worst. A
-load-sensitive assertion can produce that, but so can a real
-regression, and this row does not pretend the size of the margin
-resolves the question. What it does establish is that the observing
-diff is not the cause, because six controlled runs say so.
+budget allows. A load-sensitive assertion can produce that, but so can
+a real regression, and this row does not pretend the size of the margin
+resolves the question.
+
+**Nor do the six controlled runs.** An earlier draft of this row said
+they establish that the observing diff is not the cause. They do not: a
+tree that fails intermittently can carry a *changed failure rate* that
+six runs are far too few to see, and treating non-reproduction as
+exoneration is precisely the reasoning this registry refuses when a
+rerun turns a red green. What the controls do is remove the easy
+story — "the diff obviously did it" — and leave the question open.
 
 **If this selector reds alone again, this row is where it goes**, and
 the first thing to capture is a contemporaneous load reading — the one