research(render): retail portal-polygon vertex capture at the #464 pose + the pm-verts cdb template

Sixteen DrawPortalPolyInternal attempts per frame, vertex-identical to
acdream's sixteen collect-time punches; twelve lie entirely on the local
y=12 plane and are rejected by the ±12 guard in both clients, so the hall
building's doorways are never punched in either.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-09-03 22:42:01 +02:00
parent d26a2ed035
commit 3a6aa7eef4
3 changed files with 369 additions and 0 deletions

View file

@ -13,6 +13,7 @@ capture is the detach frame and carries no events — never count it.
| `terrace-edge` | outdoor `f418000b` (14 buildings, identical to FW0) | walk / parts / alphadepth |
| `foundry-deep` | interior `a9b40176`, ov=1 | walk / parts / alphadepth |
| `cathedral-stair-arch` (#464 artifact pose, owner 2026-09-03 23:0x: `/teleloc F4180113 39.502899 19.832422 180.976700 1 0 0 0`, default distance tilted slightly up; retail eye `(39.58,16.99,182.79)`; retail screenshot in the #464 issue thread shows the solid far face above the arch) | interior `f4180114`, ov=7 | walk / alphadepth (no parts) |
| `cathedral-stair-arch` portal-polygon vertices (lead, 2026-09-03 22:36; new template `oh-capture-pm-verts.cdb.template`: `PV poly= mode= n= counterBefore=` + one `V x y z` raw-hex line per vertex in the polygon's own frame, at `DrawPortalPolyInternal` ENTRY, i.e. every ATTEMPT incl. the ones the ±12 guard rejects) | interior `f4180114`, ov=7 | `pmverts` (3 frames, 16 attempts/frame; matches acdream's 16 collect-time punches vertex for vertex) |
| `holtburg-doorway-still` #458 follow-up (2026-09-03 afternoon, a NEARBY pose — its own `P` line, not the walk capture's) | interior `a9b4013f`, ov=2 | `blockset` (every `Render::block_check` call of one frame: 2,601 blocks × 2 views + the return codes; `oh-capture-blockset.cdb.template`) / `blockcheck` (block `a9c9` only: the four corner interval vectors, z slab 75..330, ret 1 then 0; `oh-capture-blockcheck.cdb.template`) |
`oh-recon.log` is the offset/breakpoint recon that PASSED before the poses.

View file

@ -0,0 +1,337 @@
Opened log file 'C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\docs\research\2026-09-01-overhaul\oh-capture\cathedral-stair-arch.pmverts.log'
0:018> .sympath C:\Users\erikn\source\repos\acdream\refs
Symbol search path is: C:\Users\erikn\source\repos\acdream\refs
Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs
************* Path validation summary **************
Response Time (ms) Location
OK C:\Users\erikn\source\repos\acdream\refs
0:018> .symopt+ 0x40
Symbol options are 0xB0367:
0x00000001 - SYMOPT_CASE_INSENSITIVE
0x00000002 - SYMOPT_UNDNAME
0x00000004 - SYMOPT_DEFERRED_LOADS
0x00000020 - SYMOPT_OMAP_FIND_NEAREST
0x00000040 - SYMOPT_LOAD_ANYTHING
0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS
0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS
0x00010000 - SYMOPT_AUTO_PUBLICS
0x00020000 - SYMOPT_NO_IMAGE_SEARCH
0x00080000 - SYMOPT_NO_PROMPTS
0:018> .reload /f acclient.exe
0:018>
0:018> r $t0 = 0
0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0081ef00+4), poi(0081ef00+0x3c), poi(0081ef00+0x40), poi(0081ef00+0x44), poi(0081ef00+8), poi(0081ef00+0xc), poi(0081ef00+0x10), poi(0081ef00+0x14); .if (@$t0 < 0n3) { gc }"
0:018> bp 005a4840 ".printf \"PC ov=%d counter=%04x fc=%d\\n\", poi(@ecx+0x38), wo(008719b4), poi(008ed824); gc"
0:018> bp 0059bc90 ".printf \"PV poly=%08x mode=%d n=%d counterBefore=%04x\\n\", poi(@esp+4), by(@esp+8), by(poi(@esp+4)+0xe), wo(008719b4); r $t1 = 0; .for (; @$t1 < by(poi(@esp+4)+0xe); r $t1 = @$t1 + 1) { .printf \"V %08x %08x %08x\\n\", poi(poi(poi(poi(@esp+4))+@$t1*4)), poi(poi(poi(poi(@esp+4))+@$t1*4)+4), poi(poi(poi(poi(@esp+4))+@$t1*4)+8) }; gc"
0:018> g
F 1
P f4180114 421e5469 4187e32e 4336c9db 3f800000 00000000 00000000 00000000
PC ov=7 counter=0008 fc=0
PV poly=12980fd4 mode=1 n=7 counterBefore=0008
V 40900ebf 413ec8b4 41af288d
V 40900ebf 413ec8b4 41d9999a
V 4037b741 413ec8b4 41ec0000
V 00000000 413ec8b4 41f5999a
V c03d143c 413ec8b4 41ec0000
V c095ff2e 413ec8b4 41d9999a
V c095ff2e 413ec8b4 41af288d
PV poly=12981004 mode=1 n=4 counterBefore=0008
V 40a77c85 413ec8b4 411ccccd
V 40933f92 413ec8b4 41a00000
V c09af877 413ec8b4 41a00000
V c0af9f80 413ec8b4 411ccccd
PC ov=0 counter=0008 fc=0
PC ov=0 counter=0008 fc=0
PV poly=12981004 mode=1 n=4 counterBefore=0008
V 40a77c85 413ec8b4 411ccccd
V 40933f92 413ec8b4 41a00000
V c09af877 413ec8b4 41a00000
V c0af9f80 413ec8b4 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=12981004 mode=1 n=4 counterBefore=0008
V 40a77c85 413ec8b4 411ccccd
V 40933f92 413ec8b4 41a00000
V c09af877 413ec8b4 41a00000
V c0af9f80 413ec8b4 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=1cc24bd4 mode=1 n=7 counterBefore=0008
V c09cb780 41400000 41d9999a
V c04a84e0 41400000 41ec0000
V be570a3d 41400000 41f5999a
V 402a469d 41400000 41ec0000
V 4089566d 41400000 41d9999a
V 4089566d 41400000 41af288d
V c09cb780 41400000 41af288d
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PC ov=0 counter=0008 fc=0
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=4dbb5e2c mode=1 n=3 counterBefore=0008
V 40266666 41400000 41af288d
V 40900ebf 41400000 41af288d
V 40900ebf 41400000 41d9999a
PC ov=0 counter=0008 fc=0
PV poly=4dbb5dcc mode=1 n=6 counterBefore=0008
V 40266666 41400000 41af288d
V 40900ebf 41400000 41d9999a
V 4037b741 41400000 41ec0000
V 00000000 41400000 41f5999a
V c03d143c 41400000 41ec0000
V c095ff2e 41400000 41af288d
PC ov=0 counter=0008 fc=0
PV poly=4dbb5dfc mode=1 n=3 counterBefore=0008
V c03d143c 41400000 41ec0000
V c095ff2e 41400000 41d9999a
V c095ff2e 41400000 41af288d
PC ov=0 counter=0008 fc=0
PV poly=4dbb5d6c mode=1 n=3 counterBefore=0008
V 40266666 41400000 41a00000
V 40266666 41400000 41af288d
V c095ff2e 41400000 41af288d
PC ov=0 counter=0008 fc=0
PV poly=4dbb5e5c mode=1 n=3 counterBefore=0008
V 40266666 41400000 41a00000
V c095ff2e 41400000 41af288d
V c09af84d 41400000 41a00000
PC ov=0 counter=0008 fc=0
PV poly=4dbb5d3c mode=1 n=3 counterBefore=0008
V 40933f7d 41400000 41a00000
V 40266666 41400000 41a00000
V 40a77cc4 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=4dbb5d9c mode=1 n=4 counterBefore=0008
V c09af84d 41400000 41a00000
V c0af9f6b 41400000 411ccccd
V 40a77cc4 41400000 411ccccd
V 40266666 41400000 41a00000
PC ov=0 counter=0008 fc=0
PV poly=4d56db84 mode=0 n=3 counterBefore=0000
V 40933f7d c122a440 41a00000
V 40266666 c122a440 41a00000
V 40a77cc4 c122a440 411ccccd
PV poly=4d56dbb4 mode=0 n=4 counterBefore=0001
V c09af84d c122a440 41a00000
V c0af9f6b c122a440 411ccccd
V 40a77cc4 c122a440 411ccccd
V 40266666 c122a440 41a00000
PV poly=4dcd637c mode=0 n=3 counterBefore=0002
V 40266666 c122a440 41a00000
V 40266666 c122a440 41af288d
V c095ff2e c122a440 41af288d
PV poly=4dcd63ac mode=0 n=3 counterBefore=0003
V 40266666 c122a440 41a00000
V c095ff2e c122a440 41af288d
V c09af84d c122a440 41a00000
PV poly=1563015c mode=0 n=3 counterBefore=0004
V 40266666 c122a440 41af288d
V 40900ebf c122a440 41af288d
V 40900ebf c122a440 41d9999a
PV poly=156300fc mode=0 n=6 counterBefore=0005
V 40266666 c122a440 41af288d
V 40900ebf c122a440 41d9999a
V 4037b741 c122a440 41ec0000
V 00000000 c122a440 41f5999a
V c03d143c c122a440 41ec0000
V c095ff2e c122a440 41af288d
PV poly=156300cc mode=0 n=9 counterBefore=0006
V 40019a41 c0140903 41cce48f
V 3fd7d5bb c0140903 41d69518
V 3f8ac3ca c0140903 41df6e2f
V ba0fb808 c0140903 41e78312
V bf8a848c c0140903 41df6e2f
V bfd79629 c0140903 41d69518
V c0017acc c0140903 41cce48f
V c0017b20 c0140903 41af288d
V 40019a41 c0140903 41af288d
PV poly=1563012c mode=0 n=3 counterBefore=0007
V c03d143c c122a440 41ec0000
V c095ff2e c122a440 41d9999a
V c095ff2e c122a440 41af288d
F 2
P f4180114 421e546c 4187e258 4336c9df 3f800000 00000000 00000000 00000000
PC ov=7 counter=0008 fc=0
PV poly=12980fd4 mode=1 n=7 counterBefore=0008
V 40900ebf 413ec8b4 41af288d
V 40900ebf 413ec8b4 41d9999a
V 4037b741 413ec8b4 41ec0000
V 00000000 413ec8b4 41f5999a
V c03d143c 413ec8b4 41ec0000
V c095ff2e 413ec8b4 41d9999a
V c095ff2e 413ec8b4 41af288d
PV poly=12981004 mode=1 n=4 counterBefore=0008
V 40a77c85 413ec8b4 411ccccd
V 40933f92 413ec8b4 41a00000
V c09af877 413ec8b4 41a00000
V c0af9f80 413ec8b4 411ccccd
PC ov=0 counter=0008 fc=0
PC ov=0 counter=0008 fc=0
PV poly=12981004 mode=1 n=4 counterBefore=0008
V 40a77c85 413ec8b4 411ccccd
V 40933f92 413ec8b4 41a00000
V c09af877 413ec8b4 41a00000
V c0af9f80 413ec8b4 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=12981004 mode=1 n=4 counterBefore=0008
V 40a77c85 413ec8b4 411ccccd
V 40933f92 413ec8b4 41a00000
V c09af877 413ec8b4 41a00000
V c0af9f80 413ec8b4 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=1cc24bd4 mode=1 n=7 counterBefore=0008
V c09cb780 41400000 41d9999a
V c04a84e0 41400000 41ec0000
V be570a3d 41400000 41f5999a
V 402a469d 41400000 41ec0000
V 4089566d 41400000 41d9999a
V 4089566d 41400000 41af288d
V c09cb780 41400000 41af288d
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PC ov=0 counter=0008 fc=0
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=1cc24c34 mode=1 n=4 counterBefore=0008
V c0b657bc 41400000 411ccccd
V c0a1b0c9 41400000 41a00000
V 408c8740 41400000 41a00000
V 40a0c49c 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=4dbb5e2c mode=1 n=3 counterBefore=0008
V 40266666 41400000 41af288d
V 40900ebf 41400000 41af288d
V 40900ebf 41400000 41d9999a
PC ov=0 counter=0008 fc=0
PV poly=4dbb5dcc mode=1 n=6 counterBefore=0008
V 40266666 41400000 41af288d
V 40900ebf 41400000 41d9999a
V 4037b741 41400000 41ec0000
V 00000000 41400000 41f5999a
V c03d143c 41400000 41ec0000
V c095ff2e 41400000 41af288d
PC ov=0 counter=0008 fc=0
PV poly=4dbb5dfc mode=1 n=3 counterBefore=0008
V c03d143c 41400000 41ec0000
V c095ff2e 41400000 41d9999a
V c095ff2e 41400000 41af288d
PC ov=0 counter=0008 fc=0
PV poly=4dbb5d6c mode=1 n=3 counterBefore=0008
V 40266666 41400000 41a00000
V 40266666 41400000 41af288d
V c095ff2e 41400000 41af288d
PC ov=0 counter=0008 fc=0
PV poly=4dbb5e5c mode=1 n=3 counterBefore=0008
V 40266666 41400000 41a00000
V c095ff2e 41400000 41af288d
V c09af84d 41400000 41a00000
PC ov=0 counter=0008 fc=0
PV poly=4dbb5d3c mode=1 n=3 counterBefore=0008
V 40933f7d 41400000 41a00000
V 40266666 41400000 41a00000
V 40a77cc4 41400000 411ccccd
PC ov=0 counter=0008 fc=0
PV poly=4dbb5d9c mode=1 n=4 counterBefore=0008
V c09af84d 41400000 41a00000
V c0af9f6b 41400000 411ccccd
V 40a77cc4 41400000 411ccccd
V 40266666 41400000 41a00000
PC ov=0 counter=0008 fc=0
PV poly=4d56db84 mode=0 n=3 counterBefore=0000
V 40933f7d c122a440 41a00000
V 40266666 c122a440 41a00000
V 40a77cc4 c122a440 411ccccd
PV poly=4d56dbb4 mode=0 n=4 counterBefore=0001
V c09af84d c122a440 41a00000
V c0af9f6b c122a440 411ccccd
V 40a77cc4 c122a440 411ccccd
V 40266666 c122a440 41a00000
PV poly=4dcd637c mode=0 n=3 counterBefore=0002
V 40266666 c122a440 41a00000
V 40266666 c122a440 41af288d
V c095ff2e c122a440 41af288d
PV poly=4dcd63ac mode=0 n=3 counterBefore=0003
V 40266666 c122a440 41a00000
V c095ff2e c122a440 41af288d
V c09af84d c122a440 41a00000
PV poly=1563015c mode=0 n=3 counterBefore=0004
V 40266666 c122a440 41af288d
V 40900ebf c122a440 41af288d
V 40900ebf c122a440 41d9999a
PV poly=156300fc mode=0 n=6 counterBefore=0005
V 40266666 c122a440 41af288d
V 40900ebf c122a440 41d9999a
V 4037b741 c122a440 41ec0000
V 00000000 c122a440 41f5999a
V c03d143c c122a440 41ec0000
V c095ff2e c122a440 41af288d
PV poly=156300cc mode=0 n=9 counterBefore=0006
V 40019a41 c0140903 41cce48f
V 3fd7d5bb c0140903 41d69518
V 3f8ac3ca c0140903 41df6e2f
V ba0fb808 c0140903 41e78312
V bf8a848c c0140903 41df6e2f
V bfd79629 c0140903 41d69518
V c0017acc c0140903 41cce48f
V c0017b20 c0140903 41af288d
V 40019a41 c0140903 41af288d
PV poly=1563012c mode=0 n=3 counterBefore=0007
V c03d143c c122a440 41ec0000
V c095ff2e c122a440 41d9999a
V c095ff2e c122a440 41af288d
F 3
P f4180114 421e546c 4187e25a 4336c9df 3f800000 00000000 00000000 00000000
eax=15ff3c88 ebx=00000009 ecx=00a575e0 edx=00000000 esi=00a575e0 edi=009a09b0
eip=00453aa0 esp=001afe84 ebp=001aff74 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200206
acclient!SmartBox::RenderNormalMode:
00453aa0 a130f38600 mov eax,dword ptr [acclient!RenderDevice::render_device (0086f330)] ds:002b:0086f330=00a65b98
0:000> .echo ===DETACHING===
===DETACHING===
0:000> qd
quit:
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis'
NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis'