docs(overhaul): contract S5 c4 material-state fix

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -692,8 +692,8 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S5-c1 | **LANDED 2026-09-04 after the owner-authorized documentation/evidence exception.** Mandatory stop `efb075619` remains in history; final campaign tip `1718832e2`, reviewed scratch tip `b2d56f9e3`. | G4 UNPASSED | Narrow exception re-review PASS. Clean evidence: hermetic 16,760/16,760; inclusive InstalledDat 385 pass / the same documented 10 fail / 1 skip; both exact `d6592d3ac`, `WorktreeDirty=false`, manifests fully verified. Fresh campaign Release 0W/0E, Core 111/111, visibility 38/38, allocation/AP-116 4/4. Lead graphical portal-haze gate PROVISIONAL PASS, exit 0/graceful, 10 PNGs under `logs/selfgate-20260904-171137-s5c1-particle-visibility`; owner inspection pending. |
 | S5-c2 | **LANDED + REVIEW-CLOSED 2026-09-04; lead graphical gate PROVISIONAL PASS.** Campaign stack `a4de2efc4` -> `048027e71` -> `ef819eedf`; reviewed scratch tip `521f5edda54`; packet §§14–16. The opt-in IA-24 path borrows the exact prior-completed landscape set/flag, selects world casters through S2 CELLARRAY or building `EffectCellId`, selects authored terrain slots, and projects exact active instance runs without rebuilding retained topology. Pack-off remains unchanged. | G4 UNPASSED | Retail/deviation PASS; production's documentation-only fix round 1 narrowly re-reviewed PASS. Fresh campaign Release 0W/0E and affected 137/137. Official evidence: hermetic 16,768/16,768; broader InstalledDat 468 pass / 10 fail / 1 skip; canonical 385 pass / the same 10 fail / 1 skip; manifests and nonpassing identities exact. Valid lead gate `logs/selfgate-20260904-183925-s5c2-candidate-shadow-ab`: seven PNGs, exit 0, graceful logout, no fatal match, no client left. Exact parent `5c106bcdf` A/B at `s5-c2-ab-parent/logs/selfgate-20260904-183815-s5c2-parent-shadow-ab` proves the gate-visible dark lighting switch predates c2; #469/IA-24 carry it for resolution or explicit owner acceptance before G4. Owner PNG inspection pending. |
 | S5-c3 | **LANDED + REVIEW-CLOSED 2026-09-04** at `c673f767e` (reviewed scratch `01e5a15d0`; packet §§17–21). | **C3 SCOPE SELF-GATE PROVISIONAL PASS; whole-renderer finding #470 OPEN. G4 UNPASSED.** | OpenAI retail pass 3/10 PASS and production narrow re-review pass 5/10 PASS. Fix round 3 added ordinary landblock-lifetime ownership for every unique nonzero ladder GfxObj, rearmed walk-frame miss requests, and made the one-tick-before-BeginFrame proof discriminating. Fresh clean campaign: Release 0W/0E; focused 101/101; hermetic 16,811/16,811; InstalledDat 469 pass / the unchanged documented 10 fail / 1 skip; manifests 30/30. Self-gate `logs/selfgate-20260904-223345-s5c3-building-degrade` produced five PNGs, exited 0/gracefully, and left no client. The selected building shells are complete; the Holtburg frame also exposed pre-existing atmospheric ordered-draw sidecar defect #470, which is not a c3 regression and blocks renderer-solid/G4 until repaired. |
-| S5-c4 | **CONTRACTED 2026-09-04** in packet §22; implementation next. | G4 UNPASSED | Exact retail one-pass building/EnvCell detail equation, including final alpha `a*qA²`, original per-subset framebuffer state, explicit authored material opacity in prepared/GPU data, removal of every second overlay draw, and production ordered-path omission #471. OpenAI-only implementation then sequential retail and production reviews, maximum ten passes. |
+| S5-c4 | **IMPLEMENTED; RETAIL REVIEW PASS 1/10 FAILED 2026-09-05. FIX ROUND 1 CONTRACTED** in packet §23. Scratch implementation `91fb80de6` remains unlanded. | G4 UNPASSED | The one-pass `a*qA²` material, explicit opacity, overlay deletion, and #471 ordered arm are correct. Review proved production did not carry exact raw SetSurface blend families, Wb final-`X` ClipMap reference, or raw-Additive fog disable; the existing table was partly a CPU-only oracle. §23 requires resolved extraction-to-command material state, production recordings, mutations, register correction, narrow retail re-review, then the full production lens. Nothing lands or launches yet. |
-| S5 | IN FLIGHT — c1–c3 landed/review-closed/provisionally self-gated; c4 contracted; c5, #469/#470 disposition, closeout, and G4 remain | G4 | Packet §§7 and 12–22 are binding. Next: implement S5-c4 exactly; never merge main before G4. |
+| S5 | IN FLIGHT — c1–c3 landed/review-closed/provisionally self-gated; c4 fix round 1 contracted; c5, #469/#470 disposition, closeout, and G4 remain | G4 | Packet §§7 and 12–23 are binding. Next: implement S5-c4 fix round 1 on `91fb80de6`, then sequential review; never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -1812,3 +1812,180 @@ bounded fix contract and narrow re-review; documentation-only findings may be
 corrected directly by the lead. At most ten c4 review passes may run; stop
 before an eleventh. Nothing lands or launches graphically until both lenses
 pass.
+
+## 23. S5-c4 fix round 1 — production SetSurface state reaches the one-pass draw
+
+### 23.1 Review result and independently re-verified retail boundary
+
+Retail/material review pass 1/10 returned **FAIL** on clean implementation tip
+`91fb80de6e0f536819100890ebc218169070aadc`. The shared one-pass material
+equation is correct, but three production-state gaps make several §22 rows
+model-only rather than rendered truth:
+
+1. production collapses raw `Additive`, `Alpha|Additive`, and
+`InvAlpha|Additive` into one `TranslucencyKind.Additive` / Vulkan
+`SRCALPHA,ONE` pipeline. Retail instead uses `ONE,ONE`, `SRCALPHA,ONE`, and
+`INVSRCALPHA,ONE` respectively. EnvCell additionally chooses its raw
+`IsAdditive` bucket before the already-resolved translucent override and owns no
+inverse pipeline, so both ordinary inverse alpha and
+`Translucent|ClipMap|Additive` can reach the wrong base state;
+2. building/Wb commands never set push `ParamB`, so a detail-active ClipMap
+fragment falls back to `0.05` rather than retail's final-`X` reference of
+`100/255` for paletted input or `200/255` for DDS/non-paletted input. The
+command also lacks the state needed for ClipMap combined with another blend
+family; and
+3. both one-pass fragment families always apply fog, although retail disables
+fixed-function fog whenever the raw Additive bit is present, including a row
+whose later Translucent branch changes its blend family.
+
+The existing `RetailDetailTextureContractTests` policy table did not expose
+these failures: it omitted Additive-without-Alpha and
+InverseAlpha-with-Additive, computed framebuffer results only through a CPU
+oracle, and returned expected pipeline values without invoking extraction or a
+production draw owner. `EnvCellAlphaDrawSourceTests` also synthesized
+`IsAdditive` from the collapsed `TranslucencyKind`, unlike real extraction.
+
+The lead independently re-read named
+`D3DPolyRender::SetSurface @0x0059C4D0` lines 425083–425303 and re-hashed the
+paired executable and all four §22 ranges. The executable remains SHA-256
+`006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1`; the
+four range hashes remain exactly those in §22.1. Paired bytes and named
+pseudo-C agree:
+
+- the Alpha arm selects `SRCALPHA,(Additive ? ONE : INVSRCALPHA)`;
+- the neither-Alpha-nor-InvAlpha arm selects
+  `ONE,(Additive ? ONE : ZERO)`;
+- the InvAlpha arm selects
+  `INVSRCALPHA,(Additive ? ONE : SRCALPHA)`;
+- ClipMap enables `GREATER_EQUAL` with the palette/DDS reference while
+  retaining a pre-existing blend family, except that a pure ClipMap supplies
+  `ONE,INVSRCALPHA`;
+- the later Translucent branch forces every `Translucent|ClipMap` combination
+  to straight alpha and disables its alpha test, but otherwise retains an
+  established Additive or InvAlpha family; and
+- the raw Additive bit disables fixed-function fog independent of that later
+  blend override.
+
+For the review's nontrivial §22 fixture, `X=0.11532` and
+`C=(0.3534682,0.2330118,0.5438054)`. Against
+`F.rgb=(0.17,0.37,0.71)`, retail raw Additive produces
+`(0.5234682,0.6030118,1.2538054)`, while the collapsed current pipeline
+produces approximately `(0.21076195,0.39687092,0.77271164)`;
+InverseAlpha+Additive produces approximately
+`(0.48270625,0.57614088,1.19109376)`. The current `0.05` Wb ClipMap fallback
+also lets `X=0.11532` survive where retail rejects it at both real references.
+The installed portal Surface census contains real Additive-only and
+Alpha+Additive families, so the distinction is not synthetic.
+
+### 23.2 Bounded production repair
+
+Carry one immutable, deterministic **resolved SetSurface material state** from
+the resolved source Surface at extraction time through `TextureBatchData`,
+recipe-9 serialization, `ObjectRenderBatch`, grouping/ordered-command data, and
+the exact Wb/EnvCell draw command. It must distinguish at least:
+
+- opaque; straight alpha; alpha-additive (`SRCALPHA,ONE`); raw additive
+  (`ONE,ONE`); inverse alpha (`INVSRCALPHA,SRCALPHA`); inverse-additive
+  (`INVSRCALPHA,ONE`); and pure ClipMap (`ONE,INVSRCALPHA`);
+- alpha test disabled, paletted `100/255`, or DDS/non-paletted `200/255`; and
+- fixed-function fog enabled versus raw-Additive-disabled.
+
+Resolve the complete precedence once from raw `Surface.Type`, actual texture
+presence/palette class, and the later Translucent rule. Do not infer it later
+from `TranslucencyKind`, `IsAdditive`, sampled alpha, texture-table identity,
+or a renderer-side DAT lookup. `TranslucencyKind` remains the existing
+queue/list-membership classification; the new state must not change the two
+FIFO queues, AP-239 raw-mask residual, AP-240 ordinary-Gfx ClipMap placement,
+or terrain/portal ordering.
+
+For a **detail-active** Wb or EnvCell command, select the pipeline for that
+resolved family, including new `ONE,ONE` and `INVSRCALPHA,ONE` Vulkan variants;
+arm `ParamB` with the resolved final-`X` alpha-test reference when enabled; and
+bypass post-combine fog exactly when the resolved state says raw Additive
+disabled it. EnvCell must use the resolved family rather than raw
+`IsAdditive` precedence and must have a real inverse path. Combined ClipMap
+families retain their blend factors and use the same final-`X` comparison;
+the Translucent+ClipMap override uses straight alpha with the test disabled.
+The ordinary and atmospheric shaders must implement the same fog decision.
+
+Keep the §22.2 detail-off fragment arithmetic and its existing production
+selection unchanged. If the smallest implementation cannot restrict a newly
+exact state transition to the detail-active path without altering detail-off
+rendering, stop and return the exact call/data reason rather than silently
+expanding this fix round. Any now-proven detail-off raw-state mismatch that
+therefore remains must receive a precise active deviation-register row in the
+same implementation commit. AP-232 may retire only the old two-draw overlay
+and the exact detail-active mechanism actually proved; remove its current
+overclaim of complete framebuffer/ClipMap closure and `none` residual unless
+the production evidence truly supports those words.
+
+Do not change the correct shared `w=a*qA`, `C`, or `X=a*qA*qA` equations;
+authored/live opacity multiplication; one-draw placement; #471's ordered arm;
+geometry, transform, local sidecars, cull, selection, lighting, sampler/mips,
+or debug-light bypass. Do not repair #469 or #470 here. Do not add a surface
+dictionary, per-frame map/allocation, DAT query, second draw, overlay, terrain
+flush, queue kind, or new ordering owner. Recipe identity remains 9 unless the
+serialized byte shape must change incompatibly; if it does, advance the recipe
+and every migration/compatibility pin together and return a fresh deterministic
+bake.
+
+Allowed production scope is the §22 prepared material chain and serializer;
+the smallest exact material-state type; Wb/EnvCell batch/group/ordered data and
+pipeline selection; GPU blend enum/mapping and required pipeline variants;
+ordinary/atmospheric fragment state input; compiled SPIR-V and manifest; and
+the directly affected render-pack validator/ABI. Tests may change only for
+those production surfaces. The only documentation allowed in the
+implementation commit is
+`docs/architecture/retail-divergence-register.md`, including every required
+correction/new row. Do not edit this packet, plan, issues, handoff, evidence,
+or unrelated architecture prose.
+
+### 23.3 Discriminating proof and mutation return
+
+Replace the model-only claim with production extractor-to-command recordings
+for both Building/Wb and EnvCell, detail on and off, covering at minimum:
+
+- Opaque, Alpha, `Alpha|Additive`, Additive without Alpha, InvAlpha, and
+  `InvAlpha|Additive`;
+- each applicable family with ClipMap, with both paletted and DDS reference
+  classes and final `X` immediately below/equal/above the reference;
+- `Translucent`, `Translucent|Additive`, `Translucent|InvAlpha`, and at least
+  `Translucent|ClipMap|Additive`, proving the late override and independent fog
+  disable; and
+- ordinary versus atmospheric selection with an adjacent non-detail command,
+  proving no stale blend/reference/fog state.
+
+Each detail-active row must prove one physical draw, source FIFO/order,
+concrete production pipeline blend factors, depth write/test, alpha-test
+enable/reference in push data, detail slot/tiling, emitted `(C,X)`, fog choice,
+and framebuffer result on the §23.1 destination. Each detail-off row must prove
+the current logical path was not changed. Use a real extracted fixture or the
+same production construction seam extraction uses; do not set `IsAdditive` or
+the resolved state from the expected `TranslucencyKind` in the fixture.
+Round-trip and equality tests must prove every new state bit survives prepared
+serialization and reaches both `ObjectRenderBatch` consumers.
+
+Apply and independently restore at least these additional mutations, recording
+the first failure in the fix commit body:
+
+1. collapse raw Additive back to `SRCALPHA,ONE`;
+2. collapse InverseAlpha+Additive to either existing additive pipeline;
+3. remove EnvCell's inverse-family selection;
+4. restore raw `IsAdditive` precedence over the Translucent+ClipMap override;
+5. zero Wb `ParamB` for a paletted row and separately substitute `0.05` for a
+   DDS row;
+6. remove alpha testing from an Alpha+ClipMap combined row;
+7. always fog a raw-Additive row; and
+8. disable fog from a non-Additive row.
+
+The original ten §22 mutations remain green and restored. Return one clean fix
+commit atop `91fb80de6`; exact file/line counts; `git diff --check`; Release
+solution 0W/0E; shader compilation and manifest/SPIR-V validation; focused
+content/serialization, production renderer/state/pixel/command/allocation and
+GPU mapping suites; the official hermetic lane; and inclusive InstalledDat
+with every accepted nonpassing identity named. No client launch.
+
+Retail/material narrow re-review is pass 2/10 and must independently reproduce
+the raw-state mappings, CLIP reference, fog rule, register truth, and at least
+three new mutations. Only after it passes may the full production/gate-honesty
+lens run. Nothing lands or launches graphically before both lenses pass.