fix(planning): keep counterfactual moves off the shared final plan

Since assigning a date shares unchanged activations with the parent
state, counterfactual analysis edited an activation it shared with the
final plan, so a later alternative date could inherit an earlier one's
dates and be judged eligible. It now replaces the moved activation.
Every counterfactual over seeds 280000-289999 matches the engine before
the sharing step again.

When every one of several obligation solutions fails earned-entitlement
chronology, the planner again reports the obligation conflict, as when
every preview failed. No seeded request reaches that path, so the
frozen engine is unchanged.

Also marks the ranking's known limit as a shortcut and fixes stale
documentation found in review.

Part of #302.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/benchmark/README.md

@@ -6,7 +6,8 @@
 unchanged Node acceptance protocol on the documented development laptop:
 **298.6 seconds**, including one warm-up and two measured repetitions of all
 seven scenarios, without coverage, with one worker and a 2 GiB Node heap.
-The full protocol keeps a 240-second timeout only as a hang guard (see
+After [#302](issue-302.md#benchmark-protocol), the Bun protocol takes about 41
+seconds, and its timeout is a 240-second hang guard (see
 [Relative CI gate](#relative-ci-gate)). All expected outcomes,
 placement counts, final stages and determinism checks pass. The fixture inputs
 are unchanged; the test now prints its existing report.

docs/benchmark/issue-302.md

@@ -6,6 +6,15 @@ identical to the frozen engine at `a871f8f`. The
 [frozen-engine differential check](README.md#frozen-engine-differential-check),
 including its cancelled asynchronous comparisons, passes after every step.
 
+That check does not compare counterfactual analyses. Code review found that the
+last exact step, which shares unchanged activations between states, let
+counterfactual analysis edit an activation it shared with the final plan, so a
+later alternative date could inherit an earlier one's dates. A follow-up commit
+replaces that activation instead of editing it. Afterwards, every
+counterfactual of every plan placement for seeds 280000 to 289999, 8,750
+analyses, matched the engine before that step; the same comparison found 4
+differences with the step alone.
+
 ## Per-step measurements
 
 Each step was timed against its parent in the same session, on the development
@@ -146,7 +155,9 @@ objectives then the tie-breaks of each obligation-only plan, with enumeration
 order breaking equal ranks. It runs the preference stages once, on the first
 solution. If that run ends with earned leave available only after its final
 merged time-off period, the stages restart on the next solution, and a
-conflict is reported only when every solution fails.
+conflict is reported only when every solution fails. With several solutions,
+that is the obligation conflict the previews reported when every preview
+failed.
 
 ### Timing