From 1d0ac478d9808abc63581cffe42b0c98d37b196f Mon Sep 17 00:00:00 2001 From: Erik Date: Sat, 5 Sep 2026 10:25:04 +0200 Subject: [PATCH] docs(overhaul): establish #476 capture-before-submit defect Keep screenshot repair separate from the active #475 retirement chunk. Record independently verified source ordering, invalid first-resize PNG, provenance limits and required next proof; no production change or gate PASS. --- docs/ISSUES.md | 9 +- ...-09-01-campaign-overhaul-world-solidity.md | 2 +- .../476-capture-lifetime-diagnosis.md | 90 +++++++++++++++++++ .../s5-consumers-material-closeout-packet.md | 9 ++ 4 files changed, 108 insertions(+), 2 deletions(-) create mode 100644 docs/research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md diff --git a/docs/ISSUES.md b/docs/ISSUES.md index 6e04dc82c..4a03d0a56 100644 --- a/docs/ISSUES.md +++ b/docs/ISSUES.md @@ -41,7 +41,8 @@ remain closed. See ## #476 — First post-resize graphical gate PNG is horizontally corrupted -**Status:** OPEN, observed2026-09-05 during #474 regression; source unproven. +**Status:** OPEN, observed2026-09-05 during #474 regression; capture-lifetime +defect statically confirmed, no repair implemented. The first PNG after1366x768→1024x768 resize in `logs/selfgate-20260905-095924-474-portal-reveal-r1/artifacts/screenshots/474-00-login.png` has severe horizontal corruption. The following six captures are coherent. @@ -51,6 +52,12 @@ counted as visual PASS. Exact binary and inspection: `research/2026-09-01-overha That run also needs a settled post-completion PNG to resolve its early portal-space text; checkpoint completion alone is not a visual assertion. Keep this separate from #475's permission/retirement change. +`research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md` records the +source proof: screenshot readback runs before `EndFrame` records/submits the +current image copy; a newly resized capture buffer can therefore be read +before its first GPU write. Requested/capture dimensions do match; the old +allocation contents and their row stride remain unproven. Repair contract +and real first-frame/resize validation follow #475, not inside its chunk. ## #475 — Debt-free collision retirement yields a frame per prefix diff --git a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md index b52258b2b..ac6112c7c 100644 --- a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md +++ b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md @@ -698,7 +698,7 @@ Update immediately when a slice changes state. Chat is not the ledger. | S5-#470 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL A/B PROVISIONAL PASS.** Campaign implementation stack `15a796c3a` -> `7506e5f14` -> `b333edb4f`; route `19b44e5e3`; reviewed scratch `51f974da4` -> `2cad9c84` -> `98c004aa7`; packet §§27–30. | G4 UNPASSED | Retail/behavior pass 2/10 and production pass 4/10 closed the two evidence-only findings. Fresh campaign Release 0W/0E and focused 48/48; exact scratch hermetic 16,976/16,976 and canonical InstalledDat 386/10/1, manifests 30/30. Pinned gate `logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1`: retail/off -> High -> retail/off, 3/3 PNGs, exit 0, graceful, no client; visual PASS provisional. The stale recipe-8 pre-route launch is excluded and recorded in §30. | | S5-#469 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL TRANSITION PROVISIONAL PASS.** Contract `809887524`; reviewed scratch `c09b6cf0f`; campaign implementation `94ddde69a`; route `62efc72cb`; packet §§31–32. | G4 UNPASSED | Retail/deviation pass 1/10 and production pass 2/10 both PASS with no finding. The two atmospheric vertex receivers keep retail's authored unnormalized `uLights` direction across every shadow gate; celestial direction remains for opt-in shadow/volumetric projection; IA-24 corrected in the same commit. Exact scratch: Release 0W/0E, focused 126/126, Vulkan 2/2, hermetic 16,983/16,983, InstalledDat 386/10/1. Fresh campaign Release 0W/0E, focused 82/82, Vulkan 2/2. Gate `logs/selfgate-20260905-040449-s5-469-lighting-transition-r1`: five PNGs, active 2,500-caster/four-cascade High rows, no near-black relight, exit 0/graceful, no client; visual PASS provisional. | | S5-c5 | **CLOSED + LANDED 2026-09-05; LEAD GRAPHICAL SMOKE PROVISIONAL PASS.** Contract `b77989c32`; campaign `bf53e2ad6` -> `e625dc4e6` -> `1b7ee4e58`; reviewed scratch tip `158656f0d`; packet §§33–35. | G4 UNPASSED | Retail/deletion pass 1/10 PASS. Production pass 2/10 found one static-field hole in the owner guard; fix round 1 reproduced both static-owner mutations, and production pass 3/10 PASS. Exact scratch hermetic 16,921/16,921, canonical InstalledDat 368/9/1, manifests 30/30. Fresh campaign Release 0W/0E, App 146/146, Core 8/8. A stale recipe-8 preflight is excluded; a non-destructive recipe-10 bake produced 2,237,865 keys with zero failures. Corrected gate `logs/selfgate-20260905-052130-s5-c5-landed-v10`: five PNGs, exit 0/graceful, no fatal/deleted-prefix match, no client left; geometry matches S5-c4, visual PASS provisional. | -| S5 | **#473 EXTERIOR REPAIR OWNER-ACCEPTED `bf23673f3`; portal-reveal repair #474 LANDED + REVIEW-CLOSED, nine-hop convergence verified; latency475 in bounded repair (2026-09-05).** c1–c5 plus #470/#469 landed; C1c test/doc correction REVIEW-CLOSED, pending landing. | G4 UNPASSED | Packet §§7 and12–48 bind. §42 repaired opaque detail alpha-to-coverage, with both reviews PASS, Release0W/0E, affected158/158, mutation12/12 and all52 affected prepared payloads matching fresh extraction. §42.6 sampled exterior PNGs were provisional; the owner now accepts the repaired exteriors. §43 C1c retail/production reviews are closed; nine-file test/doc return remains unlanded, lead scoped68/68 only, no canonical full-lane claim. §44 manual owner session PID16892 ran unchanged bf23673f3. §45 geometry witness contract remains not dispatched. §46/new diagnosis474 proves a destination publication/placement acknowledgement cycle at3031FFFF: engine committed, exact valid Place into30310014 at global FIFO head, spatial backend absent and publication waiting on that acknowledgement. #474 round0 is integrated at220bda797 (reviewed scratch774a2cd1c), contract31960039b plus correctionfc1a24b6d: real reset/recenter converges publication before cancellation, so no new cancellation API. Retail pass1 found only a stale test comment, corrected directly; production/lifetime pass2 PASS. Lead Release0W/0E, App135/135 and Runtime42/42; three discriminating mutations with controller single-cycle byte restoration independently repeated. 474-round0-verification.md carries exact commands/hashes. Both clients are now absent; retail exited externally, never closed/attached by lead. Last privileged ACE check: UDP9000 PID13340 up. Clean c76f43c2f nine-hop run reached all destinations/occurrences with zero reveal failures, exit0/graceful; three30310005 visits revealed. Overall FAIL: adjacent86–89s, final1838retirements, first post-resize PNG corrupt476; six later PNGs coherent, settled cue check owed. 474-graphical-regression-r1.md records timings/PNGs/hashes. 475-debt-free-retirement-contract.md removes only synthetic no-debt frame waits while preserving exact callbacks/ACKs/meter/FIFO; implementation next. Both clients absent after run. Repair475/review/re-gate and476 capture check precede C1c landing, real geometry/membership hash, full-lane closure, C2 and owner G4. Never merge main before G4. | +| S5 | **#473 EXTERIOR REPAIR OWNER-ACCEPTED `bf23673f3`; portal-reveal repair #474 LANDED + REVIEW-CLOSED, nine-hop convergence verified; latency475 in bounded repair (2026-09-05).** c1–c5 plus #470/#469 landed; C1c test/doc correction REVIEW-CLOSED, pending landing. | G4 UNPASSED | Packet §§7 and12–48 bind. §42 repaired opaque detail alpha-to-coverage, with both reviews PASS, Release0W/0E, affected158/158, mutation12/12 and all52 affected prepared payloads matching fresh extraction. §42.6 sampled exterior PNGs were provisional; the owner now accepts the repaired exteriors. §43 C1c retail/production reviews are closed; nine-file test/doc return remains unlanded, lead scoped68/68 only, no canonical full-lane claim. §44 manual owner session PID16892 ran unchanged bf23673f3. §45 geometry witness contract remains not dispatched. §46/new diagnosis474 proves a destination publication/placement acknowledgement cycle at3031FFFF: engine committed, exact valid Place into30310014 at global FIFO head, spatial backend absent and publication waiting on that acknowledgement. #474 round0 is integrated at220bda797 (reviewed scratch774a2cd1c), contract31960039b plus correctionfc1a24b6d: real reset/recenter converges publication before cancellation, so no new cancellation API. Retail pass1 found only a stale test comment, corrected directly; production/lifetime pass2 PASS. Lead Release0W/0E, App135/135 and Runtime42/42; three discriminating mutations with controller single-cycle byte restoration independently repeated. 474-round0-verification.md carries exact commands/hashes. Both clients are now absent; retail exited externally, never closed/attached by lead. Last privileged ACE check: UDP9000 PID13340 up. Clean c76f43c2f nine-hop run reached all destinations/occurrences with zero reveal failures, exit0/graceful; three30310005 visits revealed. Overall FAIL: adjacent86–89s, final1838retirements, first post-resize PNG corrupt476; six later PNGs coherent, settled cue check owed. 474-graphical-regression-r1.md records timings/PNGs/hashes. 475-debt-free-retirement-contract.md removes only synthetic no-debt frame waits while preserving exact callbacks/ACKs/meter/FIFO; implementation active in the exact-base s5-475-openai-impl scratch. Both clients absent after run; ACE9000 PID13340 rechecked. #476 source defect is confirmed in476-capture-lifetime-diagnosis.md: pre-submit screenshot readback can consume a newly allocated buffer before its first GPU copy. No476 code changed; its bounded repair follows475. Repair475/review/re-gate and476 capture repair precede C1c landing, real geometry/membership hash, full-lane closure, C2 and owner G4. Never merge main before G4. | --- diff --git a/docs/research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md b/docs/research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md new file mode 100644 index 000000000..dc91ce20b --- /dev/null +++ b/docs/research/2026-09-01-overhaul/476-capture-lifetime-diagnosis.md @@ -0,0 +1,90 @@ +# #476 — capture reads before the current GPU frame is submitted + +Status: **source defect confirmed, repair not implemented** (2026-09-05). +This is a read-only follow-up to `474-graphical-regression-r1.md`, kept +separate from the active #475 retirement implementation. The lead inspected +the production bodies, log, metadata and PNG independently of the OpenAI +production reviewer's diagnosis. No client, debugger, build or test was run +for this diagnosis. + +## Evidence and its limits + +Campaign source inspected at `2e2c5fc5f4797162e727d7dfaef9e6702165af46`; +the recorded graphical run launched clean `c76f43c2f`, production `220bda797`. +Run root: `logs/selfgate-20260905-095924-474-portal-reveal-r1/`. +The exact executable/package hashes and all seven PNG verdicts remain in the +graphical report; this note does not replace them. + +`client.log:206–218` records the 1366x768 → 1024x768 resize, swapchain +recreation, then the first screenshot request and reported completion. +`artifacts/screenshots/474-00-login.metadata.json` reports 1024x768, as does +the PNG. The lead opened the PNG again: severe horizontal stripes, **FAIL**. +PNG SHA-256: `0F4EBAE0CF643A58893037976ECCC9041321C8F32BDE8F3760751A9D93A14C75`. + +This is not proof of a 1366-versus-1024 requested-size mismatch: the GPU API +throws on mismatched capture dimensions. Nor does the available evidence +recover the prior contents of the new allocation. Reused memory could explain +the stripes, but its original row stride is unproven. The six later coherent +PNGs do not erase the invalid first-capture path. No separate production +building defect, persistent portal-text defect, or harmlessness claim follows. + +## Actual production order + +All paths below are relative to `src/AcDream.App/`. + +1. `Rendering/GameWindow.cs:1819` calls `VulkanGraphicsContext.PrepareFrame` + before opening a frame. After a resize, `Rendering/Gpu/Vk/VulkanGraphicsContext.cs:144` + calls `Device.ConfigureBackbufferAttachments`. +2. `Rendering/Gpu/Vk/VulkanGpuDevice.Resources.cs:1489–1518` + (`ConfigureBackbufferCapture`) disposes the old buffer and allocates a new + host-readable transfer destination at the new dimensions. No submitted or + completed-copy validity marker accompanies that allocation. +3. `Rendering/PrivatePresentationRenderer.cs:93` calls `CapturePending` while + the GPU frame is still open, after UI command recording. Production wiring + is in `Composition/FrameRootComposition.cs:725–746`. +4. `Rendering/Gpu/Vk/VulkanGpuDevice.Resources.cs:1405–1433` + (`CaptureBackbuffer`) checks allocation/dimensions, calls `DeviceWaitIdle`, + then reads the retained buffer. Waiting for submitted work cannot submit + the still-open frame, or populate a buffer that has never received a copy. +5. Only later, `Rendering/RenderFrameOrchestrator.cs:289` closes the frame in + its `finally`. The real adapter is `Rendering/GpuDeviceFrameLifetime.cs`, + which calls the current `IGpuFrame.End`. +6. `Rendering/Gpu/Vk/VulkanGpuDevice.cs:439` records the image-to-buffer copy + during `EndFrame`, before command-buffer end, `QueueSubmit2`, and present. + The copy correctly uses the still-acquired image. Reading the swapchain + after present is not an alternative repair. + +Thus the first capture after allocation can read an uninitialized buffer; +ordinary captures normally read the preceding submitted frame rather than +the frame whose UI just requested the screenshot. The automation's +`wait framebuffer` checks window dimensions (`UI/Testing/RetailUiAutomationScriptRunner.cs:544`, +bound at `Composition/FrameRootComposition.cs:670`), not capture completion. +It is not a synchronization barrier for GPU pixels. + +The separate bring-up host already captures after disposing its frame +(`Rendering/Gpu/Vk/VulkanBringUpHost.cs:180–201`). Preserve that correct caller +and the existing top-left RGBA/BGRA swizzle plus caller/controller row-flip +contract. This diagnosis does not propose a shader or mesh change. + +## Repair boundary to contract after #475 + +Move the real complete-frame readback to a successfully closed/submitted +frame boundary, and ensure the retained buffer cannot be advertised as valid +before its first copy. Preserve one frame close, failure propagation, +zero-area handling, UI/draw order, screenshot-before-diagnostics observation, +and capture-off production cost. Read the actual diagnostics and lifecycle +consumers before moving their boundary; do not invent a second frame owner. + +Required proof: a real orchestrator/controller composition whose fake GPU +publishes distinct pixels only on frame submission; startup and resize first +captures must contain those current-frame pixels. Exercise failed frame close, +zero area, queued requests and dimension changes. Mutation must fail when +readback returns to the old pre-submit position. Then run real Release Vulkan +resize captures and a settled portal/world PNG. Sleeping, discarding the first +PNG, warming several arbitrary frames, or retrying until an image looks right +does not repair the lifetime contract. + +No #476 implementation is authorized by this diagnostic note. The lead will +commit a bounded contract and dispatch one implementer after #475, with both +review lenses and the campaign's normal gate/ledger rules. C1c, the geometry +witness, full lanes, C2 and owner G4 remain outstanding; never merge main. diff --git a/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md b/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md index dcd68b522..85f96a1b9 100644 --- a/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md +++ b/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md @@ -4510,3 +4510,12 @@ Fresh `codex/s5-475-openai-impl` at `.claude/worktrees/s5-475-openai-impl` was created at that exact base; OpenAI James is implementing the bounded return. No implementation/review PASS claimed yet. Lead owns the current ledger; #476 may receive read-only diagnosis only alongside this work. + +Read-only #476 diagnosis is now complete, with lead source/log/PNG verification: +`476-capture-lifetime-diagnosis.md`. The production screenshot executes before +the current GPU frame is submitted; resize allocates a new retained buffer +without first-copy validity. This proves an invalid capture path, not a mesh +defect or a recovered old row stride. No #476 code changed. Its bounded repair +contract follows #475; no sleep/discard-first-image workaround. Both clients +remain absent and ACE UDP9000 PID13340 was rechecked at10:23+02. #475 is actively +implementing in its exact-base scratch; no frozen return or review PASS yet.