docs(overhaul): establish #476 capture-before-submit defect

Keep screenshot repair separate from the active #475 retirement chunk. Record independently verified source ordering, invalid first-resize PNG, provenance limits and required next proof; no production change or gate PASS.

docs/ISSUES.md

@@ -41,7 +41,8 @@ remain closed. See
 
 ## #476 — First post-resize graphical gate PNG is horizontally corrupted
 
-**Status:** OPEN, observed2026-09-05 during #474 regression; source unproven.
+**Status:** OPEN, observed2026-09-05 during #474 regression; capture-lifetime
+defect statically confirmed, no repair implemented.
 The first PNG after1366x768→1024x768 resize in
 `logs/selfgate-20260905-095924-474-portal-reveal-r1/artifacts/screenshots/474-00-login.png`
 has severe horizontal corruption. The following six captures are coherent.
@@ -51,6 +52,12 @@ counted as visual PASS. Exact binary and inspection: `research/2026-09-01-overha
 That run also needs a settled post-completion PNG to resolve its early
 portal-space text; checkpoint completion alone is not a visual assertion.
 Keep this separate from #475's permission/retirement change.
+`research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md` records the
+source proof: screenshot readback runs before `EndFrame` records/submits the
+current image copy; a newly resized capture buffer can therefore be read
+before its first GPU write. Requested/capture dimensions do match; the old
+allocation contents and their row stride remain unproven. Repair contract
+and real first-frame/resize validation follow #475, not inside its chunk.
 
 ## #475 — Debt-free collision retirement yields a frame per prefix
 

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -698,7 +698,7 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S5-#470 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL A/B PROVISIONAL PASS.** Campaign implementation stack `15a796c3a` -> `7506e5f14` -> `b333edb4f`; route `19b44e5e3`; reviewed scratch `51f974da4` -> `2cad9c84` -> `98c004aa7`; packet §§27–30. | G4 UNPASSED | Retail/behavior pass 2/10 and production pass 4/10 closed the two evidence-only findings. Fresh campaign Release 0W/0E and focused 48/48; exact scratch hermetic 16,976/16,976 and canonical InstalledDat 386/10/1, manifests 30/30. Pinned gate `logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1`: retail/off -> High -> retail/off, 3/3 PNGs, exit 0, graceful, no client; visual PASS provisional. The stale recipe-8 pre-route launch is excluded and recorded in §30. |
 | S5-#469 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL TRANSITION PROVISIONAL PASS.** Contract `809887524`; reviewed scratch `c09b6cf0f`; campaign implementation `94ddde69a`; route `62efc72cb`; packet §§31–32. | G4 UNPASSED | Retail/deviation pass 1/10 and production pass 2/10 both PASS with no finding. The two atmospheric vertex receivers keep retail's authored unnormalized `uLights` direction across every shadow gate; celestial direction remains for opt-in shadow/volumetric projection; IA-24 corrected in the same commit. Exact scratch: Release 0W/0E, focused 126/126, Vulkan 2/2, hermetic 16,983/16,983, InstalledDat 386/10/1. Fresh campaign Release 0W/0E, focused 82/82, Vulkan 2/2. Gate `logs/selfgate-20260905-040449-s5-469-lighting-transition-r1`: five PNGs, active 2,500-caster/four-cascade High rows, no near-black relight, exit 0/graceful, no client; visual PASS provisional. |
 | S5-c5 | **CLOSED + LANDED 2026-09-05; LEAD GRAPHICAL SMOKE PROVISIONAL PASS.** Contract `b77989c32`; campaign `bf53e2ad6` -> `e625dc4e6` -> `1b7ee4e58`; reviewed scratch tip `158656f0d`; packet §§33–35. | G4 UNPASSED | Retail/deletion pass 1/10 PASS. Production pass 2/10 found one static-field hole in the owner guard; fix round 1 reproduced both static-owner mutations, and production pass 3/10 PASS. Exact scratch hermetic 16,921/16,921, canonical InstalledDat 368/9/1, manifests 30/30. Fresh campaign Release 0W/0E, App 146/146, Core 8/8. A stale recipe-8 preflight is excluded; a non-destructive recipe-10 bake produced 2,237,865 keys with zero failures. Corrected gate `logs/selfgate-20260905-052130-s5-c5-landed-v10`: five PNGs, exit 0/graceful, no fatal/deleted-prefix match, no client left; geometry matches S5-c4, visual PASS provisional. |
-| S5 | **#473 EXTERIOR REPAIR OWNER-ACCEPTED `bf23673f3`; portal-reveal repair #474 LANDED + REVIEW-CLOSED, nine-hop convergence verified; latency475 in bounded repair (2026-09-05).** c1–c5 plus #470/#469 landed; C1c test/doc correction REVIEW-CLOSED, pending landing. | G4 UNPASSED | Packet §§7 and12–48 bind. §42 repaired opaque detail alpha-to-coverage, with both reviews PASS, Release0W/0E, affected158/158, mutation12/12 and all52 affected prepared payloads matching fresh extraction. §42.6 sampled exterior PNGs were provisional; the owner now accepts the repaired exteriors. §43 C1c retail/production reviews are closed; nine-file test/doc return remains unlanded, lead scoped68/68 only, no canonical full-lane claim. §44 manual owner session PID16892 ran unchanged bf23673f3. §45 geometry witness contract remains not dispatched. §46/new diagnosis474 proves a destination publication/placement acknowledgement cycle at3031FFFF: engine committed, exact valid Place into30310014 at global FIFO head, spatial backend absent and publication waiting on that acknowledgement. #474 round0 is integrated at220bda797 (reviewed scratch774a2cd1c), contract31960039b plus correctionfc1a24b6d: real reset/recenter converges publication before cancellation, so no new cancellation API. Retail pass1 found only a stale test comment, corrected directly; production/lifetime pass2 PASS. Lead Release0W/0E, App135/135 and Runtime42/42; three discriminating mutations with controller single-cycle byte restoration independently repeated. 474-round0-verification.md carries exact commands/hashes. Both clients are now absent; retail exited externally, never closed/attached by lead. Last privileged ACE check: UDP9000 PID13340 up. Clean c76f43c2f nine-hop run reached all destinations/occurrences with zero reveal failures, exit0/graceful; three30310005 visits revealed. Overall FAIL: adjacent86–89s, final1838retirements, first post-resize PNG corrupt476; six later PNGs coherent, settled cue check owed. 474-graphical-regression-r1.md records timings/PNGs/hashes. 475-debt-free-retirement-contract.md removes only synthetic no-debt frame waits while preserving exact callbacks/ACKs/meter/FIFO; implementation next. Both clients absent after run. Repair475/review/re-gate and476 capture check precede C1c landing, real geometry/membership hash, full-lane closure, C2 and owner G4. Never merge main before G4. |
+| S5 | **#473 EXTERIOR REPAIR OWNER-ACCEPTED `bf23673f3`; portal-reveal repair #474 LANDED + REVIEW-CLOSED, nine-hop convergence verified; latency475 in bounded repair (2026-09-05).** c1–c5 plus #470/#469 landed; C1c test/doc correction REVIEW-CLOSED, pending landing. | G4 UNPASSED | Packet §§7 and12–48 bind. §42 repaired opaque detail alpha-to-coverage, with both reviews PASS, Release0W/0E, affected158/158, mutation12/12 and all52 affected prepared payloads matching fresh extraction. §42.6 sampled exterior PNGs were provisional; the owner now accepts the repaired exteriors. §43 C1c retail/production reviews are closed; nine-file test/doc return remains unlanded, lead scoped68/68 only, no canonical full-lane claim. §44 manual owner session PID16892 ran unchanged bf23673f3. §45 geometry witness contract remains not dispatched. §46/new diagnosis474 proves a destination publication/placement acknowledgement cycle at3031FFFF: engine committed, exact valid Place into30310014 at global FIFO head, spatial backend absent and publication waiting on that acknowledgement. #474 round0 is integrated at220bda797 (reviewed scratch774a2cd1c), contract31960039b plus correctionfc1a24b6d: real reset/recenter converges publication before cancellation, so no new cancellation API. Retail pass1 found only a stale test comment, corrected directly; production/lifetime pass2 PASS. Lead Release0W/0E, App135/135 and Runtime42/42; three discriminating mutations with controller single-cycle byte restoration independently repeated. 474-round0-verification.md carries exact commands/hashes. Both clients are now absent; retail exited externally, never closed/attached by lead. Last privileged ACE check: UDP9000 PID13340 up. Clean c76f43c2f nine-hop run reached all destinations/occurrences with zero reveal failures, exit0/graceful; three30310005 visits revealed. Overall FAIL: adjacent86–89s, final1838retirements, first post-resize PNG corrupt476; six later PNGs coherent, settled cue check owed. 474-graphical-regression-r1.md records timings/PNGs/hashes. 475-debt-free-retirement-contract.md removes only synthetic no-debt frame waits while preserving exact callbacks/ACKs/meter/FIFO; implementation active in the exact-base s5-475-openai-impl scratch. Both clients absent after run; ACE9000 PID13340 rechecked. #476 source defect is confirmed in476-capture-lifetime-diagnosis.md: pre-submit screenshot readback can consume a newly allocated buffer before its first GPU copy. No476 code changed; its bounded repair follows475. Repair475/review/re-gate and476 capture repair precede C1c landing, real geometry/membership hash, full-lane closure, C2 and owner G4. Never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md

@@ -0,0 +1,90 @@
+# #476 — capture reads before the current GPU frame is submitted
+
+Status: **source defect confirmed, repair not implemented** (2026-09-05).
+This is a read-only follow-up to `474-graphical-regression-r1.md`, kept
+separate from the active #475 retirement implementation. The lead inspected
+the production bodies, log, metadata and PNG independently of the OpenAI
+production reviewer's diagnosis. No client, debugger, build or test was run
+for this diagnosis.
+
+## Evidence and its limits
+
+Campaign source inspected at `2e2c5fc5f4797162e727d7dfaef9e6702165af46`;
+the recorded graphical run launched clean `c76f43c2f`, production `220bda797`.
+Run root: `logs/selfgate-20260905-095924-474-portal-reveal-r1/`.
+The exact executable/package hashes and all seven PNG verdicts remain in the
+graphical report; this note does not replace them.
+
+`client.log:206–218` records the 1366x768 → 1024x768 resize, swapchain
+recreation, then the first screenshot request and reported completion.
+`artifacts/screenshots/474-00-login.metadata.json` reports 1024x768, as does
+the PNG. The lead opened the PNG again: severe horizontal stripes, **FAIL**.
+PNG SHA-256: `0F4EBAE0CF643A58893037976ECCC9041321C8F32BDE8F3760751A9D93A14C75`.
+
+This is not proof of a 1366-versus-1024 requested-size mismatch: the GPU API
+throws on mismatched capture dimensions. Nor does the available evidence
+recover the prior contents of the new allocation. Reused memory could explain
+the stripes, but its original row stride is unproven. The six later coherent
+PNGs do not erase the invalid first-capture path. No separate production
+building defect, persistent portal-text defect, or harmlessness claim follows.
+
+## Actual production order
+
+All paths below are relative to `src/AcDream.App/`.
+
+1. `Rendering/GameWindow.cs:1819` calls `VulkanGraphicsContext.PrepareFrame`
+   before opening a frame. After a resize, `Rendering/Gpu/Vk/VulkanGraphicsContext.cs:144`
+   calls `Device.ConfigureBackbufferAttachments`.
+2. `Rendering/Gpu/Vk/VulkanGpuDevice.Resources.cs:1489–1518`
+   (`ConfigureBackbufferCapture`) disposes the old buffer and allocates a new
+   host-readable transfer destination at the new dimensions. No submitted or
+   completed-copy validity marker accompanies that allocation.
+3. `Rendering/PrivatePresentationRenderer.cs:93` calls `CapturePending` while
+   the GPU frame is still open, after UI command recording. Production wiring
+   is in `Composition/FrameRootComposition.cs:725–746`.
+4. `Rendering/Gpu/Vk/VulkanGpuDevice.Resources.cs:1405–1433`
+   (`CaptureBackbuffer`) checks allocation/dimensions, calls `DeviceWaitIdle`,
+   then reads the retained buffer. Waiting for submitted work cannot submit
+   the still-open frame, or populate a buffer that has never received a copy.
+5. Only later, `Rendering/RenderFrameOrchestrator.cs:289` closes the frame in
+   its `finally`. The real adapter is `Rendering/GpuDeviceFrameLifetime.cs`,
+   which calls the current `IGpuFrame.End`.
+6. `Rendering/Gpu/Vk/VulkanGpuDevice.cs:439` records the image-to-buffer copy
+   during `EndFrame`, before command-buffer end, `QueueSubmit2`, and present.
+   The copy correctly uses the still-acquired image. Reading the swapchain
+   after present is not an alternative repair.
+
+Thus the first capture after allocation can read an uninitialized buffer;
+ordinary captures normally read the preceding submitted frame rather than
+the frame whose UI just requested the screenshot. The automation's
+`wait framebuffer` checks window dimensions (`UI/Testing/RetailUiAutomationScriptRunner.cs:544`,
+bound at `Composition/FrameRootComposition.cs:670`), not capture completion.
+It is not a synchronization barrier for GPU pixels.
+
+The separate bring-up host already captures after disposing its frame
+(`Rendering/Gpu/Vk/VulkanBringUpHost.cs:180–201`). Preserve that correct caller
+and the existing top-left RGBA/BGRA swizzle plus caller/controller row-flip
+contract. This diagnosis does not propose a shader or mesh change.
+
+## Repair boundary to contract after #475
+
+Move the real complete-frame readback to a successfully closed/submitted
+frame boundary, and ensure the retained buffer cannot be advertised as valid
+before its first copy. Preserve one frame close, failure propagation,
+zero-area handling, UI/draw order, screenshot-before-diagnostics observation,
+and capture-off production cost. Read the actual diagnostics and lifecycle
+consumers before moving their boundary; do not invent a second frame owner.
+
+Required proof: a real orchestrator/controller composition whose fake GPU
+publishes distinct pixels only on frame submission; startup and resize first
+captures must contain those current-frame pixels. Exercise failed frame close,
+zero area, queued requests and dimension changes. Mutation must fail when
+readback returns to the old pre-submit position. Then run real Release Vulkan
+resize captures and a settled portal/world PNG. Sleeping, discarding the first
+PNG, warming several arbitrary frames, or retrying until an image looks right
+does not repair the lifetime contract.
+
+No #476 implementation is authorized by this diagnostic note. The lead will
+commit a bounded contract and dispatch one implementer after #475, with both
+review lenses and the campaign's normal gate/ledger rules. C1c, the geometry
+witness, full lanes, C2 and owner G4 remain outstanding; never merge main.

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -4510,3 +4510,12 @@ Fresh `codex/s5-475-openai-impl` at `.claude/worktrees/s5-475-openai-impl`
 was created at that exact base; OpenAI James is implementing the bounded
 return. No implementation/review PASS claimed yet. Lead owns the current
 ledger; #476 may receive read-only diagnosis only alongside this work.
+
+Read-only #476 diagnosis is now complete, with lead source/log/PNG verification:
+`476-capture-lifetime-diagnosis.md`. The production screenshot executes before
+the current GPU frame is submitted; resize allocates a new retained buffer
+without first-copy validity. This proves an invalid capture path, not a mesh
+defect or a recovered old row stride. No #476 code changed. Its bounded repair
+contract follows #475; no sleep/discard-first-image workaround. Both clients
+remain absent and ACE UDP9000 PID13340 was rechecked at10:23+02. #475 is actively
+implementing in its exact-base scratch; no frozen return or review PASS yet.