diff --git a/docs/active-work.md b/docs/active-work.md
index 5f4f830..66f86fb 100644
--- a/docs/active-work.md
+++ b/docs/active-work.md
@@ -319,7 +319,7 @@ Framing
 this base, the panel-replay prerequisite recorded as DISCHARGED by #243,
 and the both-axis effect witness still owed.
 
-**Landed so far** (latest verified code head `a2d5b26`)**:** B1's per-target fractional
+**Landed so far** (latest verified code head `deb3f0b`)**:** B1's per-target fractional
 wheel residual (the producer), B2's daemon-side horizontal panel leg,
 B3/B7's shared `scroll_window_columns` with its saturated bound and wrap
 pin, B4's middle-click PRIMARY paste, **B6's minimap wheel routing**,
@@ -393,16 +393,23 @@ setup assertions rather than by reading:
   mode and content width**, so a geometry or wrap change reaches the
   follow one frame late. L7a and L8 paint twice and say why.
 
-**`a2d5b26` then closed clause 5's replacement half**, which the first
-latch commit had left undone: three TUI paths replace a window's buffer
-— `switch_active_buffer_for`, `install_buffer_in_window` and the
-daemon's `align_primary_document_window` — and **none cleared
-`view_left` or the latch**. Two already reset cursor, selection and
+**Clause 5's replacement half took two passes, and the first census
+was wrong.** `a2d5b26` named "three TUI paths" — the ones that had been
+thought of. A grep for every write of a window's `buffer_id` finds
+**four** production sites: `switch_active_buffer_for`,
+`install_buffer_in_window`, **`kill_buffer`'s fallback rebind**, and
+the daemon's `align_primary_document_window`. None cleared `view_left`
+or the latch. `EditorCore::from_bytes` also assigns one and is
+deliberately excluded — it builds a fresh core with no prior origin to
+inherit — recorded so the next census need not re-decide it.
+
+**A census taken by recall is not a census.** This is the second time
+in this lane a count was stated from memory and found short by review;
+the first was `reshape` call sites that no geometry path reached. Two already reset cursor, selection and
 `view_top` a line at a time; the horizontal origin was simply missing
-from the list. One `Window::forget_manual_horizontal_origin`, three
-call sites, three rows (L8b/L8c/L8d), each firing only on its own call
-site's removal. L8d sits in `daemon.rs` because that function is
-private there.
+from the list. One `Window::forget_manual_horizontal_origin`, four call sites, four
+rows (L8b–L8e), each firing only on its own call site's removal. L8d
+sits in `daemon.rs` because that function is private there.
 
 Two witness repairs in the same commit, both of the same shape — an
 assertion that looked strict and was not:
@@ -416,7 +423,11 @@ assertion that looked strict and was not:
   the caret clamped to their end, LEFT of the origin — so the origin
   discriminated too and the reason given for using the latch instead
   did not hold. The filler is now 120 columns and the row asserts the
-  caret is still inside, through `pos_to_display`.
+  caret is still inside, through `pos_to_display` — **on both edges.**
+  `is_some()` alone rules out only the left one; a caret past the RIGHT
+  edge still returns `Some`, and there a normal follow moves the
+  origin, which is exactly the state the row claims cannot
+  discriminate. The probe requires `col < last_content_cols`.
 
 **Still owed on this axis: L7b (content shrink), and the GPU's entire
 read side with L2 and L5's GPU leg.** The GPU's four writes remain
diff --git a/docs/ci-red-signatures.md b/docs/ci-red-signatures.md
index 84b80c7..fd52888 100644
--- a/docs/ci-red-signatures.md
+++ b/docs/ci-red-signatures.md
@@ -1100,7 +1100,7 @@ one loaded machine. One test alone does not carry that argument.
 | **job / flavor** | local (Linux), bare `cargo test --lib` (default features), full-lib load, **not** `scripts/gate` |
 | **required fragments** | `composition machinery added more than 10% overhead` + a ratio; the run also printed `dispatch overhead : 87.9%` and `realistic overhead : 82.1%` |
 | **status** | **ONE occurrence.** Not reproduced in six subsequent full-lib runs — three on the observing tree and three on the same tree with the observing diff reverted |
-| **margin** | **1.879 against a 1.10 budget** (`single=158789 ns, dispatch=298366 ns`). Recorded because U11 taught this registry what a missing margin costs. It is the largest this selector has shown: U6's were 1.297, 1.182, 1.592, 1.527 and one unrecorded. Against the previous worst of 1.592 that is **1.18× as large as a ratio, or 1.48× as much budget excess** (0.879 over vs 0.592 over) — two different numbers for two different questions, which is why neither is summarized here as a single adjective |
+| **margin** | **1.879 against a 1.10 budget** (`single=158789 ns, dispatch=298366 ns`). Recorded because U11 taught this registry what a missing margin costs. It is the largest this selector has shown: U6's were 1.297, 1.182, 1.592, 1.527 and one unrecorded. Against the previous worst of 1.592: **1.18× as a ratio**; **1.48× as much overhead above the 1.0 no-overhead baseline** (0.879 vs 0.592); **1.58× as much excess over the 1.10 budget** (0.779 vs 0.492). Three numbers for three questions, which is why none is compressed into an adjective — an earlier draft called the middle one "budget excess", which it is not: the budget is 1.10, not 1.0 |
 | **what IS established** | the observing diff (`9cb610e`, the TUI horizontal-authority latch) adds work to the paint path, so it was a live suspect. Three full-lib runs with the diff and three with `src/editor.rs` and `src/window.rs` restored to HEAD: **all six green.** That establishes **non-reproduction in six runs, and nothing more** — this registry's own rule is that reruns establish intermittence only |
 | **what is NOT** | why it fired. The load confound is once again unmeasured — no `/proc/loadavg` reading was taken at the moment of failure, which is the same gap U15 exists to close |