research(render): retail portal-polygon vertex capture at the #464 pose + the pm-verts cdb template

Sixteen DrawPortalPolyInternal attempts per frame, vertex-identical to
acdream's sixteen collect-time punches; twelve lie entirely on the local
y=12 plane and are rejected by the ±12 guard in both clients, so the hall
building's doorways are never punched in either.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tools/walk-oracle/oh/oh-capture-pm-verts.cdb.template

@@ -0,0 +1,31 @@
+* OH capture: portal-polygon VERTICES at every DrawPortalPolyInternal call
+* (lead, 2026-09-03 night, #464). Same F marker and auto-detach recipe as
+* oh-capture-alpha-depth.cdb.template; one extra line kind:
+*
+*   PV poly=<ptr> mode=<m> n=<num_pts>            -- DrawPortalPolyInternal ENTRY
+*   V <x> <y> <z>                                  -- one line per vertex, raw
+*                                                     IEEE-754 hex, in the
+*                                                     polygon's OWN frame (the
+*                                                     object matrix set by
+*                                                     Render::CalcObjectMatrix
+*                                                     at the call: the building
+*                                                     frame for a building punch,
+*                                                     the cell frame for a seal)
+*
+* CPolygon (acclient.h): +0 CVertex** vertices, +0xC int16 poly_id,
+* +0xE char num_pts. CVertex: origin x,y,z at +0/+4/+8.
+* Never qd inside a bp action (project_retail_debugger.md).
+
+.logopen <LOG>
+.sympath C:\Users\erikn\source\repos\acdream\refs
+.symopt+ 0x40
+.reload /f acclient.exe
+
+r $t0 = 0
+bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0081ef00+4), poi(0081ef00+0x3c), poi(0081ef00+0x40), poi(0081ef00+0x44), poi(0081ef00+8), poi(0081ef00+0xc), poi(0081ef00+0x10), poi(0081ef00+0x14); .if (@$t0 < 0n<FRAMES>) { gc }"
+bp 005a4840 ".printf \"PC ov=%d counter=%04x fc=%d\\n\", poi(@ecx+0x38), wo(008719b4), poi(008ed824); gc"
+bp 0059bc90 ".printf \"PV poly=%08x mode=%d n=%d counterBefore=%04x\\n\", poi(@esp+4), by(@esp+8), by(poi(@esp+4)+0xe), wo(008719b4); r $t1 = 0; .for (; @$t1 < by(poi(@esp+4)+0xe); r $t1 = @$t1 + 1) { .printf \"V %08x %08x %08x\\n\", poi(poi(poi(poi(@esp+4))+@$t1*4)), poi(poi(poi(poi(@esp+4))+@$t1*4)+4), poi(poi(poi(poi(@esp+4))+@$t1*4)+8) }; gc"
+g
+.echo ===DETACHING===
+qd
+.logclose