fix(simulation): PR #176 review round — all 12 findings + 2 recommendations addressed

H1 demux: ShapeProbe defensive multi-shape rejection (union frames now Err, not first-match; +2 tests) and doc claim made honest. H2/T1 SystemIndex.reset_test_state() folded into SimBridge.reset_test_state() (load() inline per autoload rule) + has_pending_request() accessor. H3 no-op tests now assert the replay flag both directions. H4 retry test actually ingests a failure and asserts the retry semantic. H5 error fixture uses the normalized status string. H6 bridge_tcp e2e sends all five frame shapes over real TCP (star-map + city-names buffers asserted). H7 positive replay-on-CONNECTED test via the test_local_bridge test-mode-flip precedent (stub bridge captures + decodes the request bytes). H8/T2 stale PLACEHOLDER doc replaced with the confirmed contract. H9 is_capital doc matches the COALESCE reality. T-r1 demux ceiling written down (next shape = tagged envelope). T-r2 AtlasLayerResponse governance ceiling comment. Lead item: the four cargo-fmt-formatted files from the gate round are now committed (layer_proxy/plugin/bridge-mod/main). H10 note for the record: the 13 snapshot_*.msgpack fixtures in commit 845737617 were regenerated because they were stale against their own generator (pre-existing version-key removal) — verified harmless, no client reads that key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/src/atlas/attractor_matching.rs

@@ -40,8 +40,9 @@ pub struct CityRecord {
     /// `atlas_city_names.kind == 'capital'` (authored, not derived from
     /// population). Threaded onto [`CityPlacement`] for the Atlas
     /// [`SettlementLayer`](crate::atlas::layer_proxy::SettlementLayer) (T-960 §2).
-    /// Defaults to `false` when the source doesn't track `kind` (e.g. the
-    /// believability harness's own settlement read).
+    /// Every current reader (`city_context_reader` and the believability
+    /// harness's own settlement read) selects `COALESCE(kind,'city')`, so an
+    /// un-authored `kind` yields `false` — there is no kind-less source left.
     pub is_capital: bool,
 }