From 4e863f7486ea6b19237691f942f3bb0d057b7ef6 Mon Sep 17 00:00:00 2001 From: Erik Date: Fri, 4 Sep 2026 09:42:59 +0200 Subject: [PATCH] docs(overhaul): authorize bounded S4-c2 repair Record the owner override after the required stop and bind the one-attempt repair to exact EnvCell pass membership, retail CLIP state, bounded source scratch, and production-path discriminators. Keep G3/G4 unpassed and the implementation unlanded pending dual review. --- ...-09-01-campaign-overhaul-world-solidity.md | 1 + .../2026-09-04-s4-handoff.md | 37 ++-- .../s4-depth-alpha-packet.md | 160 ++++++++++++++++++ 3 files changed, 179 insertions(+), 19 deletions(-) diff --git a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md index c40d27c2..44d59013 100644 --- a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md +++ b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md @@ -676,6 +676,7 @@ Update immediately when a slice changes state. Chat is not the ledger. | S3 | chunk 2: `be9b4c1f`, `2f5373c7`, `434a7df2`; chunk 3: `4ee2866a`, `651badc2`, `e10765aa`, `896c63fe`, `74ac7aa2`; chunk 1: `02a82881`, `be81475c`, `88c70072` | G3 | chunk 3: revert newest-first `74ac7aa2` → `4ee2866a` as one unit (the per-cell terrain, the slot key, the deferred batching and the per-frame diagnostic go together); chunk 2: revert newest-first `434a7df2` → `be9b4c1f` (the counter, the leaf split and the flag deletion go together) | | S4 | — | G3 | OPEN 2026-09-03 night. Packet `docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md`: §1 records that S3 chunk 2 already delivered S4's chunk-1 latch/gate/seal scope (the latch owner, the gated flush→stamp→clear→seal block, the counted seals); what remains of chunk 1 is small and dispatched as **S4-c1** (`s4-c1.js`, worktree `s4-c1-impl` at `6385f4411`, contract = packet §6): C0 the far-punch constant — `portal_depth.vert` carries `0.99999988` = bits `0x3F7FFFFE`, retail's is `0x3F7FFFEF` (15 ULPs nearer; the depth spec's "wrong constant" row was right; lead bit check 2026-09-03) → retail's exact bits + a source pin; C1 the ±12 local-input reject at both portal-polygon producers (Ghidra table row 0x59BCD6–0x59BD28); C2 the portal-depth color-state register row (ColorWrite off vs retail's zero-alpha blend, identical output); C3 the depth truth-table Theory, the cross-frame latch test, look-ins isolated from the root latch. Chunk 2 = the two-FIFO alpha-list cutover (packet §3); chunk 3 = deletions (packet §4). G3 is S4's owner gate; the lead's S3-state G3 pre-run (20/20 frames, in the S3 row) is the baseline to diff against. | **S4-c1 ROUND 0 = `c7ab5b6d8` (Sonnet), THREE LENSES FAIL (2026-09-03 21:00–21:20):** one BLOCKING defect seen by all three — the ±12 guard's quantifier is inverted (rejects on ANY vertex on ANY plane; retail's PDB-paired bytes at 0x59BCD6–0x59BD66 reject only when EVERY vertex lies on the SAME plane) — and the LEAD's §6 paraphrase carried the same inversion (corrected in §6; lesson saved to memory: quote the decomp predicate, never paraphrase it). The production lens's DAT scan: 2,889 portal polygons carry a ±12 vertex and 2,163 EXIT polygons lie ENTIRELY on a ±12 plane — so the guard is very likely retail's never-sealed 'panel' mechanism (the #456/#465 family), which makes the PM/PC depth-event transcript comparison against the four alphadepth captures the chunk's real gate (never run in round 0). Also: the register-test gate is vacuous (no test reads the register), the manifest comment's ULP direction is inverted. C0 (retail's exact far-punch bits, verified at the binary), C2 (AD-119) and C3 (three new truth-table/latch pins, nine mutation texts) verified. FIX ROUND 1 = S4 packet §7 (`s4-c1-fix1.js`, dispatched 21:20): the four per-plane predicates at both producers with five-case T2, the seal count order, the automated PM/PC gate over the captures (a diverging pose is tagged KnownFailure and written up, never weakened), comment truth. **S4-c2 CONTRACT DRAFTED** (packet §8, 2026-09-03 21:50): two FIFO lists of 3000, the spec §4 router as one pure function, the four flush sites (the sort-cell EXIT valve as a new walk event kind), `FlushFartherThan`/AP-34/every viewer distance deleted, and the AM/FL transcript gate over the five captures (10,556 `AM` lines, all `clip=0`; `FL` by site 13,705/309/18/23) as the proof; dispatched only after c1 lands. **S4-c1 FIX ROUND 1 = `2bd353234` (Sonnet, 295 tool calls), THREE LENSES 2026-09-03 22:07–23:00: retail-faithful PASS, production PASS, gate-honesty FAIL.** Confirmed at the bytes: the four per-plane accumulators at both producers, the count-after-guard order, the PM/PC gate's reading of retail's lines; five transcript poses pass (cathedral-arrival, cathedral-leak, foundry-deep, holtburg-doorway-still) with terrace-edge tagged KnownFailure. Findings, all on that one row plus one pin gap: (blocking) the KnownFailure write-up claims the PC sequence matches — false and never evaluated (the PM assert throws first); (major ×2) the divergence is a harness initial-condition choice — seed `portalsDrawnCount` from the fixture's first observed counter and the row turns green while the two-pass priming retires; (major) T2's five cases do not discriminate 'every vertex on SOME plane' from retail's 'every vertex on the SAME plane'; (minor ×4) stale seal-path summaries, an unobservable mutation named in the F2 pin's comment, doc-comment DAT figures an independent scan does not fully reproduce, a vacuous 'register tests' gate claim. The lead's own replay of the gate at `2bd353234` with the new `cathedral-stair-arch` capture added as a sixth Fact PASSES (its seed value is 8). **FIX ROUND 2 = packet §9 (the LAST round; dispatched 23:10):** seed the counter from the fixture (one pass), compare and print both sequences together, the discriminating ±12 case, the sixth pose, comment truth. **FIX ROUND 2 = `9ba8f013e` (Sonnet; on the two cherry-picked capture commits), THREE LENSES 2026-09-03 23:10–23:38: retail PASS (byte evidence: `portalsDrawnCount` has exactly one increment site 0x59BD74 and one reset site 0x5A489E under `view_count > 0`, `forceClear` has no writer; the discriminating case is admitted by retail's four per-plane accumulators), production PASS (round-2 src diff = comment text only; no pin weakened; gates reproduce on a fresh Release build), gate-honesty FAIL on comment truth only (the terrace-edge Fact's comment claimed a PC match that seeding, not the pre-fix state, produced; the stair-arch comment states a rejection count the PM/PC tuple cannot observe; a DAT-scan comment cites a pin that does not pin). All six transcript poses PASS (terrace-edge's KnownFailure removed; seed values 0/0/1/2/2/8). **S4-c1 LANDED 2026-09-03 23:38–23:40** as `d1e3e64f6` + `5de42a12f` + `323f5a334` (cherry-picks of rounds 0–2) + `766f9e749` (the LEAD corrected the four flagged sentences — a third implementer round is barred by §5; code unchanged; owner to review). Landing gates: Release 0 warnings; six transcript Facts 6/6; hermetic 6,833/6,833; InstalledDat 249 pass / 4 known (#383 ×2, TowerAscent, #458) / 1 skip. Landing self-gates: route.txt four poses `logs/selfgate-20260903-234934-s4c1-landed-route2` (Facility panels present, mean RGB (79,20,25)); capture poses `logs/selfgate-20260903-234030-s4c1-landed-g3b` and `…-235044-s4c1-landed-g3b2` — frames 13/14/16 in band, **frame 15 (holtburg-doorway) shows an empty plane under fog TWICE** where the S3-state run `logs/selfgate-20260903-165634-g3b` showed the village. Lead read 2026-09-04: the server snapped the requested y 13.39→17.39 in every run; the CLIENT then seated the player in the house-interior cell `0xA9B4013F` at (134.07, 17.36) in both landed runs versus the outdoor cell `0xA9B40029` at (133.60, 17.39) in the S3-state run (0.46 m apart on the doorway threshold), so the frame roots from the interior cell with the eye outside — a placement/membership boundary at the doorway, not a draw change; S4-c1 touched no placement code. A pre-S4 control at `6575cfcee` (`s3-review-fix/logs/selfgate-20260904-042324-pre-s4-g3b`) produced 0 frames: the login reveal at `0xA9B40176` never went visible (#462 class) and the process exited 0xE0434352 after the graceful logout (#461 class) → INCONCLUSIVE; the A/B re-run (landed tip twice + pre-S4 once) is owed before any further self-gate is trusted at that pose. **S4-c2 DISPATCH 2026-09-03 23:41 DIED** on the account's session limit / credit exhaustion with no commit; worktree `s4-c2-impl` reset clean at `766f9e749`. Session handed to a new account 2026-09-04 morning; ACE was NOT running at hand-over (no UDP 9000 listener), so every connected gate waits on the owner starting it. **HAND-OFF 2026-09-04 morning:** `docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md` (read order, landed state, the S4-c2 implementer dispatched ~08:35 into `s4-c2-impl`, the #464 RenderDoc plan, the Holtburg doorway A/B, owner-owed items, tooling gotchas, paste-prompt). **OWNER 2026-09-04 morning: running `766f9e749`, reports the cathedral stairwell artifact (#464) appears FIXED** — plausible mechanism = S4-c1's ±12 reject now drops the 12 hall-doorway punches retail also rejects; PROVISIONAL until the lead re-runs `route-464-tilt3.txt` at the tip and diffs frame `01-neg160` against `logs/selfgate-20260903-225434-464-tilt3` (owner client running — not launched yet). **S4-c2 IMPLEMENTER DONE 2026-09-04 09:35: `048d5b12f` in `s4-c2-impl`** (19 files, +1,697/−543): two FIFO lists + `RetailAlphaMeshRouter` + `SortCellExit` event + four flush sites, `FlushFartherThan`/viewer distance deleted; hermetic 6,855/6,855; shader classes 32/32; InstalledDat 249 pass + the 4 known + SIX new KnownFailure Facts. Implementer's own deviations for the lead to rule on: (a) C4 (EnvCell transparent subsets through the queue) NOT done; (b) AP-34 not retired but narrowed into AP-236 (EnvCell-immediate residual) + AP-237 (AlphaBlend cannot tell retail's ALPHA from the Translucent+ClipMap CLIP override; cloud GfxObj 0x01004C35); (c) G-c2's per-list drained-count dimension is KnownFailure on ALL six poses because the hermetic harness carries no mesh content — only the (site, threshold) sequence matches. REVIEW ROUND 1 dispatched. **REVIEW ROUND 1 (2026-09-04 ~10:00–10:40): retail lens FAIL** — every core predicate confirmed exact at the bytes (list select, 0xbb8 capacity, `test ah,5; jp` strict-less on both counts → 2250 drains, CLIP-then-ALPHA, rows 1–5, the four call sites, ::flush=0.75f, delay 0x0E, SortCellExit at 0x5a1a07 under the DrawSortCell gate); BLOCKING: the particle site's 'rows 1/2/4/5 unreachable' assert throws on an Opaque-classified mesh-particle batch (data-driven row 5; `TryAppendMeshDraws` filters nothing); MAJOR: the CLIP list is structurally unreachable for ordinary content (ClipMap kinds are `IsOpaque`, drawn alpha-to-coverage; 4,183/10,556 captured AM entries are CLIP) with no register row; contract C3's detail input hardcoded false while building shells reach the alpha path and the DRAIN applies the detail pass retail's replay never has (`DrawBuilding` installs `building_detail_surface` @0x0059f2eb before its flush/shell draw → row 1 immediate); `IsFirstForList` = first-since-drain where retail's `new` is per-DrawMesh-invocation (`0059d4cc/0059d4d0`; captures new=1 on 9,685/10,556); gate G-c2 all-KnownFailure → zero CI signal and zero SortCellExit drains exercised; MINOR: AP-237's cloud example is disproven (Type 0x10114 carries alpha-family bits → mask 0x02 both sides), DrawBlock cited at its loop head 0x005a18d0 instead of 0x005a17c0, 'return site' = the call address. Lead verification concurs and adds C4 (EnvCell detail-off append is bounded — `RenderTransparentOrdered` exists). **FIX ROUND 1 = packet §11 (M1–M8)**; **production/gate lens FAIL** (all four claimed gates reproduced, four mutation checks re-performed): same blocking particle throw; the count gate is unmatchable by construction (CLIP structurally empty — 75 % of cathedral-arrival's expected drains are CLIP — and per-instance vs per-subset cardinality); a THIRD production `FlushLandscapeAlpha` caller (`RetailPViewRenderer.cs:485`, the #132 outdoor-root drain) is mislabelled as retail's DrawCells flush, which never runs on an outdoor root; AP-236 REUSES an id filed and retired on main by #132; the unreachability enumeration lists masks that cannot occur; `ApplyScratchRetention` passes the entry count as the source count; §10 sequences off by one; the 'independent' router oracle is the same if-chain. Recorded as packet §11.1 (A1–A8). **FIX ROUND 1 DISPATCHED** (one Sonnet implementer in `s4-c2-impl` on `048d5b12f`, contract §11 + §11.1). **FIX ROUND 1 DONE = `cc8e5677a` (Sonnet, 2026-09-04 ~12:10; 27 files, +1,248/−352):** every M/A item reported landed — the two router throws deleted with rows 1/5 drawn immediately (particle `has_alpha` from `CMaterial::CheckAlphaValues` @0x005396a0 / `SetTranslucencySimple` @0x005396f0 — TO VERIFY), the detail-surface router input + immediate building-shell draw (AD-120) + no detail on the drain, EnvCell detail-off FIFO (one token per cell), `IsFirstForList` deleted, the six Facts split into live `AlphaFlushSites_*` (InstalledDat lane) and KnownFailure `AlphaFlushCounts_*` with the truthful three-part reason, a live valve pin through `Replay`'s SortCellExit arm, the outdoor-root `FlushLandscapeAlpha` deleted (A1) with a renderer pin, register: `~~AP-34~~` restored, AP-236→AP-238, AP-237→AP-239, new AP-240 (structurally empty CLIP list), AD-120, AP header 159 / AD 92, AP-239's real instance surface `0x08000015` on GfxObj `0x010001EC`. Implementer gates: hermetic 6,864/6,864; InstalledDat 255/10 (4 known + 6 Counts)/1; shaders 32/32; six focused classes 120/120. Lead reproduction 12:15: Release build 0 errors, hermetic 6,864/6,864. **NEXT = review round 1 of `cc8e5677a` (two lenses), then landing** — hand-off `2026-09-04-s4-handoff.md` §3 carries the exact procedure. **#464 CONFIRMED FIXED at `766f9e749` (2026-09-04 08:15 UTC+2, lead scripted route `logs/selfgate-20260904-061530-464-tilt3-s4c1`):** identical probe eye to the 2026-09-03 artifact run, solid wall above the arch, hall columns gone; matrix row 'Cathedral stairwell, camera zoomed out' = PASS (provisional). **Holtburg doorway frame RESOLVED — not render (2026-09-04 08:40): the player FALLS through the world at that pose** (probe run `logs/selfgate-20260904-063313-hd-probe`: seated in interior cell 0xA9B4013F at a floorless point, z 96 → −20 m; the frame is the terrain from below); filed **#468** (placement, tactical); route-g3b pose 15 moved to the good run's outdoor standing point in 0xA9B40029; the pre-S4 control stalled twice at login (#462 recurrence noted). | S4-c2 stop | **STOPPED UNLANDED 2026-09-04** — lead final-round contract `ac74fbd84`; evidence commit `c4cbc1d0d` in `s4-c2-impl` on `cc8e5677a`/`048d5b12f`; campaign renderer remains S4-c1 `766f9e749` | G3/G4 UNPASSED | Both sequential final lenses FAIL, so the required repair is the forbidden THIRD round. EnvCell transparent/ClipMap batches still draw in the opaque pass before FIFO submission and then redraw; CLIP/detail-immediate replay binds StraightAlpha with depth-write off rather than retail clip-test/depth-writing state; tests omit the preceding opaque call and pipeline descriptors. Source-owned EnvCell lists are unbounded under queue rejection, the claimed scan/filter/RHI 0-B evidence bypasses those paths, and AP-238/AP-240/result truth is false. Full file:line and gate record: S4 packet §13. No chunk cherry-pick, graphical gate, or soak. Resume only on explicit owner process change. | +| S4-c2 owner repair | **ACTIVE 2026-09-04 — explicit owner override “Ok do fix it”**; packet §14 is the one-attempt contract; implementation base remains clean unlanded `c4cbc1d0d` | G3/G4 UNPASSED | Fix only the §13 defects: opaque-pass membership; exact EnvCell CLIP ONE/INVSRCALPHA, GREATER_EQUAL ref 100/255 paletted or 200/255 DDS, depth write, and row-3 `overrideClipmap=false`; rejection-bounded source scratch; whole-leaf + real RHI/pipeline/allocation discriminators; AP-238/AP-240/result truth. Implementer returns a diff, lead verifies and commits, then retail lens followed by production/gate lens. Any new code/test/register finding stops again; dual PASS is required before landing/self-gate. | | S5 | — | G4 | fill | --- diff --git a/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md b/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md index bcfd8278..cb4a73b2 100644 --- a/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md +++ b/docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md @@ -1,11 +1,11 @@ -# Campaign OVERHAUL v2 — hand-off at S4 chunk 2 STOPPED UNLANDED after the final allowed round (2026-09-04) +# Campaign OVERHAUL v2 — hand-off at S4 chunk 2 owner-authorized repair (2026-09-04) -**2026-09-04 takeover closeout:** packet §12's final-fix implementation is -`c4cbc1d0d` in `s4-c2-impl`, but both sequential final lenses FAIL on real -EnvCell code/test/register defects. A further fix is round 3, so the campaign -stop rule fired. The implementation is clean and deliberately UNLANDED; the -campaign branch still contains S4-c1 renderer code `766f9e749`. Read packet -§13 and this file's §3 before any stale “review then land” instruction below. +**2026-09-04 owner override:** the §13 stop remains the audit record, but the +owner explicitly replied “Ok do fix it.” Packet §14 is now the binding, +one-attempt repair contract on clean evidence commit `c4cbc1d0d` in +`s4-c2-impl`. The implementation remains UNLANDED; the campaign branch still +contains S4-c1 renderer code `766f9e749`. Read packet §§13–14 and this file's +§3 before any stale “review then land” instruction below. ## 0. Read order @@ -55,7 +55,7 @@ Scratch worktrees (detached): | Worktree | At | Purpose | |---|---|---| -| `s4-c2-impl` | `c4cbc1d0d` (final fix round) on `cc8e5677a` on `048d5b12f` on `766f9e749`; clean | **STOPPED evidence only; do not land** — packet §13 | +| `s4-c2-impl` | `c4cbc1d0d` (final fix round) on `cc8e5677a` on `048d5b12f` on `766f9e749`; clean | owner-authorized bounded repair from packet §14; still do not land before dual review PASS | | `s4-c1-impl` | `9ba8f013e` | S4-c1 baseline BINARY, built (Release App + Cli) for the landing soak A/B; keep until S4-c2 lands | | `s2-final-ab` | `78068b2c` | S2-final binary for same-session perf A/B (keep) | | `s3-review-fix` | `6575cfcee` | pre-S4 control build; stalls at the foundry login (#462) — not usable as a control | @@ -97,20 +97,19 @@ every deviation gets a register row in the same commit. chamber; the zoomed-out FRONT view from the stairwell (hall arches + sky); #458's far-block admission (AD-118, 0.5 % edge-plane precision). -## 3. S4 chunk 2 — STOPPED UNLANDED after final-round review +## 3. S4 chunk 2 — owner-authorized repair, still UNLANDED **Binding current state (supersedes the historical procedure later in this section):** lead contract `ac74fbd84` added packet §12. Final implementation -`c4cbc1d0d` passed its implementer matrix, then the retail lens and the -production/gate lens both returned FAIL. The blockers are: transparent -EnvCell subsets still draw in the opaque pass before FIFO submission; CLIP -and detail-immediate subsets use alpha/no-depth state rather than retail's -clip-test/depth-writing state; the tests omit the preceding opaque draw and -pipeline descriptors; source-owned EnvCell lists are not bounded under -capacity rejection; the 0-B tests bypass the claimed scan/filter/RHI paths; -AP-238/AP-240 and the result note are therefore false. Packet §13 is the full -file:line/evidence record. A code/test/register repair is a forbidden third -round. No cherry-pick, graphical gate, or soak ran. G3/G4 remain unpassed. +`c4cbc1d0d` passed its implementer matrix, then both lenses failed for the +defects recorded in packet §13. The stop rule fired and no chunk commit was +landed or graphically gated. The owner has now explicitly authorized exactly +one repair attempt; packet §14 is its bounded contract. It fixes opaque-pass +membership, exact CLIP blend/alpha-reference/depth state and row-3 override, +rejection-bounded source scratch, whole-leaf/RHI production pins, allocation +truth, and AP-238/AP-240/result prose. Any new code/test/register finding after +the §14 reviews stops again; no fourth round is implicit. G3/G4 remain +unpassed. **Historical state before the final round (kept for audit; do not execute its landing procedure):** diff --git a/docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md b/docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md index 9142ab05..167bc6cc 100644 --- a/docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md +++ b/docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md @@ -807,3 +807,163 @@ the tested behavior only; they do not repair the missing discriminators. truth. That is a THIRD fix round and is NOT authorized by this campaign chunk. Resume only by an explicit owner decision that changes the process; otherwise S4-c2 is stopped and G3/G4 remain unpassed. + +## 14. S4-c2 owner-authorized repair after the stop (2026-09-04) + +**Authority and base.** The owner replied “Ok do fix it” after receiving the +§13 stop explanation. That explicitly authorizes the otherwise-forbidden third +fix round for this chunk only. It does not weaken plan §5's general two-round +rule. Work from clean evidence commit `c4cbc1d0d` in `s4-c2-impl`; the campaign +branch remains at stop record `dc971ea2b` with S4-c1 `766f9e749` as its latest +renderer until both review lenses pass. This exception is one bounded repair: +any new code/test/register finding after its reviews stops again and returns to +the owner; there is no implicit fourth round. + +The lead re-read `docs/architecture/worldbuilder-inventory.md` before writing +this contract and re-verified the surface state in the named retail decomp and +the paired executable/PDB. `D3DPolyRender::SetSurface` @0x0059c4d0 does the +following for a pure `Base1ClipMap` surface when `overrideClipmap == 0`: + +- @0x0059c724..0x0059c743 selects `BLEND_ONE/BLEND_INVSRCALPHA`, enables + alpha test, and leaves alpha blending enabled; +- @0x0059c73c..0x0059c75d selects alpha-test reference 100 for a paletted + texture and 200 for a DDS/non-paletted texture; @0x0059c821..0x0059c838 + uses `GREATER_EQUAL`; +- @0x0059c7b7..0x0059c806 and the `SetDepthBufferMode` call @0x0059c866 keep + depth test and depth write enabled for this state. + +The existing prepared payload already preserves everything needed without a +Content/package change: `RetailSurfaceMask` identifies the CLIP subset and +`TextureKey.PaletteId` distinguishes the 100/255 versus 200/255 reference. +`RetailAlphaMeshRouter.Route` is also decisive here: this EnvCell call site +hardcodes `multiPassAlpha:false`, so ordinary mask `0x08` is row 3, CLIP, +`OverrideClipmap=false`. The current hardcoded `true` is not an approximation. + +### 14.1 F3-1 — a deferred EnvCell subset is absent from the opaque turn + +Correct both pass-filter loops in `EnvCellRenderer.RenderModernMDIInternal`. +`WbRenderPass.Opaque` admits only non-additive, non-transparent batches; +`WbRenderPass.Transparent` admits the transparent/additive batches selected by +the exact route filter. Do not change `SinglePass` behavior. Consequently, +`WalkProductionLeafRenderer.DrawCellShell` may call `DrawOpaqueCellShells` +before transparent dispatch, but canonical `F4180104` / surface `08000BFF` +must produce no draw there, append one CLIP token, and draw exactly once at the +next real queue drain. + +The required production pin calls the real leaf's `DrawCellShell`, not the +static dispatcher in isolation. It records the complete sequence through the +preceding opaque call, submission, and queue drain. Mutating either pass-filter +loop back to the current predicate must first fail the “no pre-drain ClipMap +draw” assertion. Keep a mixed opaque + `0x08` + `0x02` cell in the fixture so +the opaque subset still draws once at the turn while CLIP and ALPHA do not. + +### 14.2 F3-2 — exact CLIP state and exact row-3 override + +Add the backend blend spelling for `ONE/ONE_MINUS_SRC_ALPHA` (normally named +premultiplied/source-over) and map it explicitly in the Vulkan blend table. +Add an EnvCell CLIP pipeline using the existing `mesh_modern` shader and world +mesh layout: that blend, depth test ON, depth write ON, retail world compare, +clockwise front face with the existing per-range cull override, alpha-to- +coverage OFF. Do not add a shader. + +Extend the existing shader/pass-state input just enough to express retail's +CLIP test: `GREATER_EQUAL 100/255` when `TextureKey.PaletteId != 0`, otherwise +`GREATER_EQUAL 200/255`. Preserve ordinary opaque/alpha/additive behavior. +Because one MDI run cannot carry two alpha references or two base states, +range grouping must include the CLIP-vs-ALPHA/additive state and the applicable +reference; it must not infer state from `IsTransparent` alone. Detail-active +row-1 replay uses the same CLIP base state before the already-established +detail combine and applies the same alpha reference. Do not route a pure +ClipMap subset through `_alphaPipeline` or `_transparentDetailPipeline`'s +no-depth base state. + +Queue submission for the ordinary mask-`0x08` EnvCell token carries +`overrideClipmap:false`, exactly as the router decision says. Either retain the +decision/flag in the EnvCell token or make the row-3-only invariant explicit +and pinned; do not hardcode `true`, and do not add a generic flag that replay +ignores. + +Production RHI pins inspect actual `GpuRecordedPipelineBind` calls and the +created pipeline descriptions, not only MDI counts. They prove: + +- CLIP drain: the CLIP pipeline immediately precedes its draw; blend factors + are ONE/ONE_MINUS_SRC_ALPHA; depth test/write are true; A2C is false; the + paletted and DDS thresholds are 100/255 and 200/255; +- ALPHA drain remains StraightAlpha with depth write off; mixed CLIP/ALPHA + replay does not cross-feed subsets; +- detail ON draws at the leaf turn, queues nothing, and a pure ClipMap base + draw still uses CLIP/depth-writing state before its detail contribution; +- the recorded queue entry for canonical row 3 has `OverrideClipmap=false`. + +Mutations selecting `_alphaPipeline` for CLIP, disabling CLIP depth write, +swapping either alpha reference, using strict `GREATER` instead of +`GREATER_EQUAL`, or restoring `overrideClipmap:true` must each fail a named +assertion. Recompile the checked-in SPIR-V and run the shader contract/manifest +lane if shader source changes. + +### 14.3 F3-3 — rejected payload cannot grow source scratch + +Keep the queue rule from §12.4: a rejected first-use source is registered and +reset exactly once, and overflow drops rather than drawing immediately. Change +the EnvCell reservation API so a failed `TryAppend` rolls back the just- +reserved cell id (or equivalently never retains it after rejection). Accepted +token indices remain stable. Pending, prepared, and draw scratch may retain +warmed capacity, but each is bounded by the 3,000-entry list limit; repeated +rejection cannot grow count or retained capacity beyond the one bounded +geometric allocation needed for that limit. + +Pins use two sources and more than one full list's worth of rejected attempts. +They assert the rejected source participates in flush/end/abort cleanup, never +prepares/draws, its pending count returns to zero, and its retained capacity is +bounded after the rejection storm. Restoring reserve-without-rollback must +fail on the first bounded-count/capacity assertion. + +### 14.4 F3-4 — production-path allocation evidence, not delegate exercises + +Delete or relabel the two vacuous 0-B claims. The replacement EnvCell warmed +measurement must execute the real route scan, the real leaf submission, the +real list-filtered replay, and `EnvCellRenderer.SubmitRhi`. The particle +measurement must execute `DrawImmediateParticleSubmissionRhi`. Instrumentation +objects from `RecordingGpuDevice` are not production allocations; use a +preallocated/no-recording test RHI if necessary, but do not replace the +production method with a no-op delegate. After warm-up, the changed hot paths +must report 0 managed bytes per iteration. If production itself allocates, +fix the production path rather than weakening or rewording the assertion. + +### 14.5 F3-5 — truth, scope, gates, and return + +Correct the stale particle depth-bracket summary and the nonexistent +`Assert.Empty(log)` comment. Rewrite AP-238, AP-240, and the §12 result so they +state only what the repaired production path and tests prove. Any remaining +modern translation (including an alpha-reference or detail-combine mismatch) +gets a divergence-register row in the same implementation commit; do not bury +it in prose. No new row is needed for an exact port. + +**Allowed files:** `src/AcDream.App/**`, `tests/AcDream.App.Tests/**`, +`docs/architecture/retail-divergence-register.md`, and this packet. The +prepared Content model/serializer and recipe-8 package format do not change; +the existing `TextureKey.PaletteId` is the required source fact. One lead-made +implementation commit on top of `c4cbc1d0d`; the implementer returns a clean +diff and evidence but does not commit. + +**Must not:** reintroduce viewer distance or another flush site; change the +two-list FIFO/strict-less valve; change ordinary Wb ClipMap A2C (AP-240); add +particle A2C; add a shader; recover overflow with an immediate draw; run a +graphical client from the implementation or review worktree; touch S4-c1's +punch/seal behavior. + +**Automated return matrix:** Release solution build with zero warnings/errors; +hermetic lane wholly green; InstalledDat exactly the expected known-failure +set from §12 unless a named, evidenced count changes; shader classes and SPIR-V +manifest green; focused queue/router/walk/particle/Wb/EnvCell/PView suite; the +new whole-leaf, pipeline-state, rejection-storm, and real production allocation +pins; register identity/count checks; `git diff --check`. The commit body names +every mutation and its actual first failing assertion. + +**Sequential reviews:** first retail-faithful against +`ConstructMesh`/`DrawMesh`/`SetSurface` and the paired executable, then +production/gate-honesty against pass membership, range grouping, bounds, +allocation, mutations, scope, register, and gate output. The lead verifies +every finding. Only dual PASS authorizes landing the complete S4-c2 stack, +followed by a fresh campaign Release build and the graphical/soak gates. G3/G4 +remain unpassed until those later gates; nothing merges to main before G4.