docs: the census was wrong twice, and "budget excess" named the wrong budget

The ledger repeated a2d5b26's "three replacement paths", which was a
count taken by recall. It is four, and the entry now says how the
correct one was obtained --- grep every write of a window's buffer_id ---
along with the one site deliberately excluded and why, so the next
census does not re-decide it.

This is the second count in this lane stated from memory and found
short by review; the first was reshape call sites that no geometry path
reached. The pattern is worth the sentence it costs: both times the
list was of things that had been thought of, and both times review
found the member nobody had.

U20's margin comparison named the wrong baseline. 0.879 and 0.592 are
overheads above 1.0, not excesses over the 1.10 budget --- those are
0.779 and 0.492, which make the ratio 1.58x rather than 1.48x. All
three numbers are now given with what each measures.

Also records that L4's caret probe was closed at its right edge, and
why is_some() alone could not see that end.

docs/active-work.md

@@ -319,7 +319,7 @@ Framing
 this base, the panel-replay prerequisite recorded as DISCHARGED by #243,
 and the both-axis effect witness still owed.
 
-**Landed so far** (latest verified code head `a2d5b26`)**:** B1's per-target fractional
+**Landed so far** (latest verified code head `deb3f0b`)**:** B1's per-target fractional
 wheel residual (the producer), B2's daemon-side horizontal panel leg,
 B3/B7's shared `scroll_window_columns` with its saturated bound and wrap
 pin, B4's middle-click PRIMARY paste, **B6's minimap wheel routing**,
@@ -393,16 +393,23 @@ setup assertions rather than by reading:
   mode and content width**, so a geometry or wrap change reaches the
   follow one frame late. L7a and L8 paint twice and say why.
 
-**`a2d5b26` then closed clause 5's replacement half**, which the first
-latch commit had left undone: three TUI paths replace a window's buffer
-— `switch_active_buffer_for`, `install_buffer_in_window` and the
-daemon's `align_primary_document_window` — and **none cleared
-`view_left` or the latch**. Two already reset cursor, selection and
+**Clause 5's replacement half took two passes, and the first census
+was wrong.** `a2d5b26` named "three TUI paths" — the ones that had been
+thought of. A grep for every write of a window's `buffer_id` finds
+**four** production sites: `switch_active_buffer_for`,
+`install_buffer_in_window`, **`kill_buffer`'s fallback rebind**, and
+the daemon's `align_primary_document_window`. None cleared `view_left`
+or the latch. `EditorCore::from_bytes` also assigns one and is
+deliberately excluded — it builds a fresh core with no prior origin to
+inherit — recorded so the next census need not re-decide it.
+
+**A census taken by recall is not a census.** This is the second time
+in this lane a count was stated from memory and found short by review;
+the first was `reshape` call sites that no geometry path reached. Two already reset cursor, selection and
 `view_top` a line at a time; the horizontal origin was simply missing
-from the list. One `Window::forget_manual_horizontal_origin`, three
-call sites, three rows (L8b/L8c/L8d), each firing only on its own call
-site's removal. L8d sits in `daemon.rs` because that function is
-private there.
+from the list. One `Window::forget_manual_horizontal_origin`, four call sites, four
+rows (L8b–L8e), each firing only on its own call site's removal. L8d
+sits in `daemon.rs` because that function is private there.
 
 Two witness repairs in the same commit, both of the same shape — an
 assertion that looked strict and was not:
@@ -416,7 +423,11 @@ assertion that looked strict and was not:
   the caret clamped to their end, LEFT of the origin — so the origin
   discriminated too and the reason given for using the latch instead
   did not hold. The filler is now 120 columns and the row asserts the
-  caret is still inside, through `pos_to_display`.
+  caret is still inside, through `pos_to_display` — **on both edges.**
+  `is_some()` alone rules out only the left one; a caret past the RIGHT
+  edge still returns `Some`, and there a normal follow moves the
+  origin, which is exactly the state the row claims cannot
+  discriminate. The probe requires `col < last_content_cols`.
 
 **Still owed on this axis: L7b (content shrink), and the GPU's entire
 read side with L2 and L5's GPU leg.** The GPU's four writes remain

docs/ci-red-signatures.md

@@ -1100,7 +1100,7 @@ one loaded machine. One test alone does not carry that argument.
 | **job / flavor** | local (Linux), bare `cargo test --lib` (default features), full-lib load, **not** `scripts/gate` |
 | **required fragments** | `composition machinery added more than 10% overhead` + a ratio; the run also printed `dispatch overhead : 87.9%` and `realistic overhead : 82.1%` |
 | **status** | **ONE occurrence.** Not reproduced in six subsequent full-lib runs — three on the observing tree and three on the same tree with the observing diff reverted |
-| **margin** | **1.879 against a 1.10 budget** (`single=158789 ns, dispatch=298366 ns`). Recorded because U11 taught this registry what a missing margin costs. It is the largest this selector has shown: U6's were 1.297, 1.182, 1.592, 1.527 and one unrecorded. Against the previous worst of 1.592 that is **1.18× as large as a ratio, or 1.48× as much budget excess** (0.879 over vs 0.592 over) — two different numbers for two different questions, which is why neither is summarized here as a single adjective |
+| **margin** | **1.879 against a 1.10 budget** (`single=158789 ns, dispatch=298366 ns`). Recorded because U11 taught this registry what a missing margin costs. It is the largest this selector has shown: U6's were 1.297, 1.182, 1.592, 1.527 and one unrecorded. Against the previous worst of 1.592: **1.18× as a ratio**; **1.48× as much overhead above the 1.0 no-overhead baseline** (0.879 vs 0.592); **1.58× as much excess over the 1.10 budget** (0.779 vs 0.492). Three numbers for three questions, which is why none is compressed into an adjective — an earlier draft called the middle one "budget excess", which it is not: the budget is 1.10, not 1.0 |
 | **what IS established** | the observing diff (`9cb610e`, the TUI horizontal-authority latch) adds work to the paint path, so it was a live suspect. Three full-lib runs with the diff and three with `src/editor.rs` and `src/window.rs` restored to HEAD: **all six green.** That establishes **non-reproduction in six runs, and nothing more** — this registry's own rule is that reruns establish intermittence only |
 | **what is NOT** | why it fired. The load confound is once again unmeasured — no `/proc/loadavg` reading was taken at the moment of failure, which is the same gap U15 exists to close |