docs(overhaul): authorize bounded S4-c2 repair

Record the owner override after the required stop and bind the one-attempt repair to exact EnvCell pass membership, retail CLIP state, bounded source scratch, and production-path discriminators. Keep G3/G4 unpassed and the implementation unlanded pending dual review.

docs/research/2026-09-01-overhaul/2026-09-04-s4-handoff.md

@@ -1,11 +1,11 @@
-# Campaign OVERHAUL v2 — hand-off at S4 chunk 2 STOPPED UNLANDED after the final allowed round (2026-09-04)
+# Campaign OVERHAUL v2 — hand-off at S4 chunk 2 owner-authorized repair (2026-09-04)
 
-**2026-09-04 takeover closeout:** packet §12's final-fix implementation is
-`c4cbc1d0d` in `s4-c2-impl`, but both sequential final lenses FAIL on real
-EnvCell code/test/register defects. A further fix is round 3, so the campaign
-stop rule fired. The implementation is clean and deliberately UNLANDED; the
-campaign branch still contains S4-c1 renderer code `766f9e749`. Read packet
-§13 and this file's §3 before any stale “review then land” instruction below.
+**2026-09-04 owner override:** the §13 stop remains the audit record, but the
+owner explicitly replied “Ok do fix it.” Packet §14 is now the binding,
+one-attempt repair contract on clean evidence commit `c4cbc1d0d` in
+`s4-c2-impl`. The implementation remains UNLANDED; the campaign branch still
+contains S4-c1 renderer code `766f9e749`. Read packet §§13–14 and this file's
+§3 before any stale “review then land” instruction below.
 
 ## 0. Read order
 
@@ -55,7 +55,7 @@ Scratch worktrees (detached):
 
 | Worktree | At | Purpose |
 |---|---|---|
-| `s4-c2-impl` | `c4cbc1d0d` (final fix round) on `cc8e5677a` on `048d5b12f` on `766f9e749`; clean | **STOPPED evidence only; do not land** — packet §13 |
+| `s4-c2-impl` | `c4cbc1d0d` (final fix round) on `cc8e5677a` on `048d5b12f` on `766f9e749`; clean | owner-authorized bounded repair from packet §14; still do not land before dual review PASS |
 | `s4-c1-impl` | `9ba8f013e` | S4-c1 baseline BINARY, built (Release App + Cli) for the landing soak A/B; keep until S4-c2 lands |
 | `s2-final-ab` | `78068b2c` | S2-final binary for same-session perf A/B (keep) |
 | `s3-review-fix` | `6575cfcee` | pre-S4 control build; stalls at the foundry login (#462) — not usable as a control |
@@ -97,20 +97,19 @@ every deviation gets a register row in the same commit.
   chamber; the zoomed-out FRONT view from the stairwell (hall arches + sky);
   #458's far-block admission (AD-118, 0.5 % edge-plane precision).
 
-## 3. S4 chunk 2 — STOPPED UNLANDED after final-round review
+## 3. S4 chunk 2 — owner-authorized repair, still UNLANDED
 
 **Binding current state (supersedes the historical procedure later in this
 section):** lead contract `ac74fbd84` added packet §12. Final implementation
-`c4cbc1d0d` passed its implementer matrix, then the retail lens and the
-production/gate lens both returned FAIL. The blockers are: transparent
-EnvCell subsets still draw in the opaque pass before FIFO submission; CLIP
-and detail-immediate subsets use alpha/no-depth state rather than retail's
-clip-test/depth-writing state; the tests omit the preceding opaque draw and
-pipeline descriptors; source-owned EnvCell lists are not bounded under
-capacity rejection; the 0-B tests bypass the claimed scan/filter/RHI paths;
-AP-238/AP-240 and the result note are therefore false. Packet §13 is the full
-file:line/evidence record. A code/test/register repair is a forbidden third
-round. No cherry-pick, graphical gate, or soak ran. G3/G4 remain unpassed.
+`c4cbc1d0d` passed its implementer matrix, then both lenses failed for the
+defects recorded in packet §13. The stop rule fired and no chunk commit was
+landed or graphically gated. The owner has now explicitly authorized exactly
+one repair attempt; packet §14 is its bounded contract. It fixes opaque-pass
+membership, exact CLIP blend/alpha-reference/depth state and row-3 override,
+rejection-bounded source scratch, whole-leaf/RHI production pins, allocation
+truth, and AP-238/AP-240/result prose. Any new code/test/register finding after
+the §14 reviews stops again; no fourth round is implicit. G3/G4 remain
+unpassed.
 
 **Historical state before the final round (kept for audit; do not execute its
 landing procedure):**

docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md

@@ -807,3 +807,163 @@ the tested behavior only; they do not repair the missing discriminators.
   truth. That is a THIRD fix round and is NOT authorized by this campaign
   chunk. Resume only by an explicit owner decision that changes the process;
   otherwise S4-c2 is stopped and G3/G4 remain unpassed.
+
+## 14. S4-c2 owner-authorized repair after the stop (2026-09-04)
+
+**Authority and base.** The owner replied “Ok do fix it” after receiving the
+§13 stop explanation. That explicitly authorizes the otherwise-forbidden third
+fix round for this chunk only. It does not weaken plan §5's general two-round
+rule. Work from clean evidence commit `c4cbc1d0d` in `s4-c2-impl`; the campaign
+branch remains at stop record `dc971ea2b` with S4-c1 `766f9e749` as its latest
+renderer until both review lenses pass. This exception is one bounded repair:
+any new code/test/register finding after its reviews stops again and returns to
+the owner; there is no implicit fourth round.
+
+The lead re-read `docs/architecture/worldbuilder-inventory.md` before writing
+this contract and re-verified the surface state in the named retail decomp and
+the paired executable/PDB. `D3DPolyRender::SetSurface` @0x0059c4d0 does the
+following for a pure `Base1ClipMap` surface when `overrideClipmap == 0`:
+
+- @0x0059c724..0x0059c743 selects `BLEND_ONE/BLEND_INVSRCALPHA`, enables
+  alpha test, and leaves alpha blending enabled;
+- @0x0059c73c..0x0059c75d selects alpha-test reference 100 for a paletted
+  texture and 200 for a DDS/non-paletted texture; @0x0059c821..0x0059c838
+  uses `GREATER_EQUAL`;
+- @0x0059c7b7..0x0059c806 and the `SetDepthBufferMode` call @0x0059c866 keep
+  depth test and depth write enabled for this state.
+
+The existing prepared payload already preserves everything needed without a
+Content/package change: `RetailSurfaceMask` identifies the CLIP subset and
+`TextureKey.PaletteId` distinguishes the 100/255 versus 200/255 reference.
+`RetailAlphaMeshRouter.Route` is also decisive here: this EnvCell call site
+hardcodes `multiPassAlpha:false`, so ordinary mask `0x08` is row 3, CLIP,
+`OverrideClipmap=false`. The current hardcoded `true` is not an approximation.
+
+### 14.1 F3-1 — a deferred EnvCell subset is absent from the opaque turn
+
+Correct both pass-filter loops in `EnvCellRenderer.RenderModernMDIInternal`.
+`WbRenderPass.Opaque` admits only non-additive, non-transparent batches;
+`WbRenderPass.Transparent` admits the transparent/additive batches selected by
+the exact route filter. Do not change `SinglePass` behavior. Consequently,
+`WalkProductionLeafRenderer.DrawCellShell` may call `DrawOpaqueCellShells`
+before transparent dispatch, but canonical `F4180104` / surface `08000BFF`
+must produce no draw there, append one CLIP token, and draw exactly once at the
+next real queue drain.
+
+The required production pin calls the real leaf's `DrawCellShell`, not the
+static dispatcher in isolation. It records the complete sequence through the
+preceding opaque call, submission, and queue drain. Mutating either pass-filter
+loop back to the current predicate must first fail the “no pre-drain ClipMap
+draw” assertion. Keep a mixed opaque + `0x08` + `0x02` cell in the fixture so
+the opaque subset still draws once at the turn while CLIP and ALPHA do not.
+
+### 14.2 F3-2 — exact CLIP state and exact row-3 override
+
+Add the backend blend spelling for `ONE/ONE_MINUS_SRC_ALPHA` (normally named
+premultiplied/source-over) and map it explicitly in the Vulkan blend table.
+Add an EnvCell CLIP pipeline using the existing `mesh_modern` shader and world
+mesh layout: that blend, depth test ON, depth write ON, retail world compare,
+clockwise front face with the existing per-range cull override, alpha-to-
+coverage OFF. Do not add a shader.
+
+Extend the existing shader/pass-state input just enough to express retail's
+CLIP test: `GREATER_EQUAL 100/255` when `TextureKey.PaletteId != 0`, otherwise
+`GREATER_EQUAL 200/255`. Preserve ordinary opaque/alpha/additive behavior.
+Because one MDI run cannot carry two alpha references or two base states,
+range grouping must include the CLIP-vs-ALPHA/additive state and the applicable
+reference; it must not infer state from `IsTransparent` alone. Detail-active
+row-1 replay uses the same CLIP base state before the already-established
+detail combine and applies the same alpha reference. Do not route a pure
+ClipMap subset through `_alphaPipeline` or `_transparentDetailPipeline`'s
+no-depth base state.
+
+Queue submission for the ordinary mask-`0x08` EnvCell token carries
+`overrideClipmap:false`, exactly as the router decision says. Either retain the
+decision/flag in the EnvCell token or make the row-3-only invariant explicit
+and pinned; do not hardcode `true`, and do not add a generic flag that replay
+ignores.
+
+Production RHI pins inspect actual `GpuRecordedPipelineBind` calls and the
+created pipeline descriptions, not only MDI counts. They prove:
+
+- CLIP drain: the CLIP pipeline immediately precedes its draw; blend factors
+  are ONE/ONE_MINUS_SRC_ALPHA; depth test/write are true; A2C is false; the
+  paletted and DDS thresholds are 100/255 and 200/255;
+- ALPHA drain remains StraightAlpha with depth write off; mixed CLIP/ALPHA
+  replay does not cross-feed subsets;
+- detail ON draws at the leaf turn, queues nothing, and a pure ClipMap base
+  draw still uses CLIP/depth-writing state before its detail contribution;
+- the recorded queue entry for canonical row 3 has `OverrideClipmap=false`.
+
+Mutations selecting `_alphaPipeline` for CLIP, disabling CLIP depth write,
+swapping either alpha reference, using strict `GREATER` instead of
+`GREATER_EQUAL`, or restoring `overrideClipmap:true` must each fail a named
+assertion. Recompile the checked-in SPIR-V and run the shader contract/manifest
+lane if shader source changes.
+
+### 14.3 F3-3 — rejected payload cannot grow source scratch
+
+Keep the queue rule from §12.4: a rejected first-use source is registered and
+reset exactly once, and overflow drops rather than drawing immediately. Change
+the EnvCell reservation API so a failed `TryAppend` rolls back the just-
+reserved cell id (or equivalently never retains it after rejection). Accepted
+token indices remain stable. Pending, prepared, and draw scratch may retain
+warmed capacity, but each is bounded by the 3,000-entry list limit; repeated
+rejection cannot grow count or retained capacity beyond the one bounded
+geometric allocation needed for that limit.
+
+Pins use two sources and more than one full list's worth of rejected attempts.
+They assert the rejected source participates in flush/end/abort cleanup, never
+prepares/draws, its pending count returns to zero, and its retained capacity is
+bounded after the rejection storm. Restoring reserve-without-rollback must
+fail on the first bounded-count/capacity assertion.
+
+### 14.4 F3-4 — production-path allocation evidence, not delegate exercises
+
+Delete or relabel the two vacuous 0-B claims. The replacement EnvCell warmed
+measurement must execute the real route scan, the real leaf submission, the
+real list-filtered replay, and `EnvCellRenderer.SubmitRhi`. The particle
+measurement must execute `DrawImmediateParticleSubmissionRhi`. Instrumentation
+objects from `RecordingGpuDevice` are not production allocations; use a
+preallocated/no-recording test RHI if necessary, but do not replace the
+production method with a no-op delegate. After warm-up, the changed hot paths
+must report 0 managed bytes per iteration. If production itself allocates,
+fix the production path rather than weakening or rewording the assertion.
+
+### 14.5 F3-5 — truth, scope, gates, and return
+
+Correct the stale particle depth-bracket summary and the nonexistent
+`Assert.Empty(log)` comment. Rewrite AP-238, AP-240, and the §12 result so they
+state only what the repaired production path and tests prove. Any remaining
+modern translation (including an alpha-reference or detail-combine mismatch)
+gets a divergence-register row in the same implementation commit; do not bury
+it in prose. No new row is needed for an exact port.
+
+**Allowed files:** `src/AcDream.App/**`, `tests/AcDream.App.Tests/**`,
+`docs/architecture/retail-divergence-register.md`, and this packet. The
+prepared Content model/serializer and recipe-8 package format do not change;
+the existing `TextureKey.PaletteId` is the required source fact. One lead-made
+implementation commit on top of `c4cbc1d0d`; the implementer returns a clean
+diff and evidence but does not commit.
+
+**Must not:** reintroduce viewer distance or another flush site; change the
+two-list FIFO/strict-less valve; change ordinary Wb ClipMap A2C (AP-240); add
+particle A2C; add a shader; recover overflow with an immediate draw; run a
+graphical client from the implementation or review worktree; touch S4-c1's
+punch/seal behavior.
+
+**Automated return matrix:** Release solution build with zero warnings/errors;
+hermetic lane wholly green; InstalledDat exactly the expected known-failure
+set from §12 unless a named, evidenced count changes; shader classes and SPIR-V
+manifest green; focused queue/router/walk/particle/Wb/EnvCell/PView suite; the
+new whole-leaf, pipeline-state, rejection-storm, and real production allocation
+pins; register identity/count checks; `git diff --check`. The commit body names
+every mutation and its actual first failing assertion.
+
+**Sequential reviews:** first retail-faithful against
+`ConstructMesh`/`DrawMesh`/`SetSurface` and the paired executable, then
+production/gate-honesty against pass membership, range grouping, bounds,
+allocation, mutations, scope, register, and gate output. The lead verifies
+every finding. Only dual PASS authorizes landing the complete S4-c2 stack,
+followed by a fresh campaign Release build and the graphical/soak gates. G3/G4
+remain unpassed until those later gates; nothing merges to main before G4.