From 508c6014ec36c14795034a84feeff77001a2be8c Mon Sep 17 00:00:00 2001 From: Erik Date: Sat, 5 Sep 2026 18:01:10 +0200 Subject: [PATCH] docs(overhaul): capture retail cathedral ramp membership --- ...-09-01-campaign-overhaul-world-solidity.md | 10 ++ .../c1a-bridge-audit-finding.md | 7 ++ .../c1a-retail-membership-capture.md | 110 ++++++++++++++++++ .../s5-consumers-material-closeout-packet.md | 19 +++ 4 files changed, 146 insertions(+) create mode 100644 docs/research/2026-09-01-overhaul/c1a-retail-membership-capture.md diff --git a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md index ef2159a6f..778df3e31 100644 --- a/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md +++ b/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md @@ -862,6 +862,16 @@ No production/FPS changes and no new intentional deviation. Full evidence: `477-cathedral-recurrence.md`. Actual initiating GPU fault and C1a retail membership closure remain unresolved; short clean runs do not close #477/G4. +**Direct retail membership2026-09-05 17:58+02:** owner-authorized paired2013 +read-only snapshots now prove the ramp's retained set is exactly +F4180112/F4180113/F4180009 (21 entries); loaded F4180114 has zero ramp parts. +Both installed source DAT pairs hash-identical. This contradicts the existing +complete-production four-cell/28-entry result and rules out blessing that +golden. `c1a-retail-membership-capture.md`, packet§61. AP159 repair still needs +its bounded scope/input/containment proof; no production change or new +intentional deviation, no AMD-cause inference. Debugger detached, both +owner-held clients remain open. FPS deferred; C1a/#477/G4 remain unclosed. + ## 14. Risk register (condensed) - **R1 second scene graph.** Graph records own only topology/membership facts; diff --git a/docs/research/2026-09-01-overhaul/c1a-bridge-audit-finding.md b/docs/research/2026-09-01-overhaul/c1a-bridge-audit-finding.md index a493849dd..e2db80846 100644 --- a/docs/research/2026-09-01-overhaul/c1a-bridge-audit-finding.md +++ b/docs/research/2026-09-01-overhaul/c1a-bridge-audit-finding.md @@ -1,5 +1,12 @@ # C1a bridge audit — contract finding, no golden or production change +**17:58+02 follow-up:** owner-authorized direct paired-retail snapshots now +establish F4180112/F4180113/F4180009,21 ramp entries; loaded F4180114 contains +zero ramp references. Both installed source DAT pairs hash-identical. +`c1a-retail-membership-capture.md` supersedes the unknown-live-set portion of +this earlier audit, not its unimplemented repair/scope boundary. No four-cell +golden, production repair, visual-cause or AMD-cause claim is justified. + 2026-09-05, after final lighting verification. The existing C1a test-only contract remains blocked as written. The complete publication setup calls `CacheBuildings`; the older three-cell comparator does not. Full production diff --git a/docs/research/2026-09-01-overhaul/c1a-retail-membership-capture.md b/docs/research/2026-09-01-overhaul/c1a-retail-membership-capture.md new file mode 100644 index 000000000..7ca4b1ce2 --- /dev/null +++ b/docs/research/2026-09-01-overhaul/c1a-retail-membership-capture.md @@ -0,0 +1,110 @@ +# C1a cathedral ramp — direct retail membership capture + +2026-09-05, 17:58 +02. Result: **retail retains three cells / 21 part entries, +not the complete-production diagnostic's four cells / 28 entries**. This +settles the previously unknown live retail set for this installed scene. It +does not identify the initiating AMD fault or close C1a/G4. + +## Authority and exact target + +Owner started retail and explicitly requested debugger attachment while their +manual AcDream check remained open. ACE UDP9000/PID13340, AcDream PID25724 +(17:51:27+02), retail PID35048 (17:52:32+02), and absence of another debugger +were checked first. No client launch, build, test suite, gameplay input, +memory write, breakpoint, target function call, or process closure was used. + +Retail executable: `C:\Turbine\Asheron's Call\acclient.exe`, SHA256 +`006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1`. +CodeView matches GUID `9e847e2f-777c-4bd9-886c-22256bb87f32`, age1. +Live `lmv` confirms image base00400000, private matching +`C:\Users\erikn\source\repos\acdream\refs\acclient.pdb`, version11.4186. + +Full SHA256 comparisons of both installed source directories +(`C:\Turbine\Asheron's Call` and `C:\Users\erikn\Documents\Asheron's Call`): + +| File | Identical SHA256 in both directories | +|---|---| +| client_cell_1.dat | 6DB0ABF00FBCEED62C3F1EE842EE7C1F423D732BED77A5B7C102EE89A52AB99E | +| client_portal.dat | DC6E500BA22E6B186DB7171E3F3345238B6444C85D798ADC85E550973B8D12E4 | + +Ordinary Get-FileHash could not share retail's open DAT handles; a read-only +FileStream with FileShare.ReadWrite completed both hashes without closing +retail or modifying files. No package regeneration or equivalence claim. + +## Method and result + +First inspect PDB layouts with non-invasive, non-suspending `cdb -pvr`. +Then take two brief coherent snapshots with non-invasive `cdb -pv`; each +command completed in under one second and ended at top-level `qd`. +No debugger remained afterward; both original client PIDs still existed. + +Named `CPhysicsObj::add_shadows_to_cells`00514AE0 copies the CELLARRAY count +and IDs into the retained owner array, then publishes each cell's part +shadows. PDB-confirmed offsets: CPhysicsObj part_array10, position48, +num_shadow_objects94, shadow_objects98; CShadowObj stride18, owner0C, +cell_id10, cell14; CPartArray setup54/parts_count58/parts5C; CObjCell +m_DID28/num_shadow_parts3C/shadow_part_list40; CShadowPart part0C; +CPhysicsPart ownerE0/indexE4. These are hexadecimal offsets. + +Find F4180112 in `CEnvCell::visible_cell_table` (191 buckets/45 elements), +walk its four static objects, and match the actual CSetup DID020009A2. +Exactly one owner matches: 1AA34A00, physical rootF4180112, seven parts. +Part0 GfxObj01001FE8; parts1–6 GfxObj01001FE6. Viewer cellF4180109. +Read that owner's retained shadow array, then independently count references +to that exact owner in each cell's retained shadow-part list. This is not a +camera-visible draw subset, player FindCellList, or the old advisory PD cell. + +| Owner-array order | Cell | Ramp part entries | +|---|---|---| +| 0 | F4180112 | 7 | +| 1 | F4180113 | 7 | +| 2 | F4180009 | 7 | +| absent | F4180114 | 0 | + +Both snapshots independently return the same owner array and21 retained +entries. The confirmation additionally finds F4180114 at16F72178, +loaded=1, constructed_mesh17C6FA90, with84 total shadow parts and **zero +references to the ramp owner**. Thus absence is not merely an unloaded cell. +The raw18-dword owner array corroborates the three structured ID records. +Part-relative retained order is0,1,6,5,2,4,3 in each sampled member cell; +absolute slots and other-object counts change between snapshots. These are +observations, not a universal cross-owner ordering golden or a fresh-process +repeat. Interior shadows have num_planes1; outdoor shadows0. Do not equate +that count directly with our consumer's clipRequired flag. + +## Evidence, limits and next boundary + +All scripts and raw logs, including discarded attempts, are preserved under +`artifacts/s5-c1a-retail-membership-20260905/` in the campaign worktree. + +| Evidence file | SHA256 | +|---|---| +| cathedral-retail-recon-20260905-r3.log | B50BFAE97CF5E6217A3A630C5E2E514803A8F9F4E6FDE2EDC234D8F3BDE1B58D | +| cathedral-retail-roots-20260905.log | 3271C19A8D821EED6962B1D0151E20995A12CE47268631D063AF45EEF61E8002 | +| cathedral-retail-membership-20260905-r2.log | 88BA5336E404E5AB1048E3B55CF96D93FB30DB6FB46408F16193B46C63449962 | +| cathedral-retail-membership-20260905-confirm.log | A36DDA025BDD26B40D54AD2D0B919E47AD3E3BF9015C4F10D32907C571131DA7 | +| cathedral-retail-membership-20260905-confirm.cdb | FD27FFB12ECBCAB91AF823F84D0128B9D225FA93FF4E530B567D237C9031C37E | + +Discarded attempts: debugger rejected `-netsym:no` before attachment; +non-invasive mode rejected the redundant `-pd` before attachment; the first +membership script rejected C-style `&&` (MASM needs `and`), then detached. +None supplies membership evidence. The corrected snapshots above contain +one matching owner, complete end markers, no expression/memory-read error, +and explicit detach. No production implementation/fix round was consumed. + +Compared with the existing complete-publication result +F4180112/F4180113/F4180009/F4180114 (28 entries), this proves a retained-set +discrepancy for the ramp. Existing AP-159 identifies the sphere-only building +bridge as the suspect; this capture does not yet prove which exact bridge +predicate/input first diverges. It does not prove the owner's visual symptom +or AMD crash was caused by this extra membership. Known retail cathedral +visual quirks remain unchanged. + +Do not amend the witness to four cells. Preserve its three-cell expectation +and placeholder hash. A production bridge repair still needs its separately +bounded contract and independent input/containment checks described in +`c1a-bridge-audit-finding.md`; the direct live result supplies the missing +expected-set evidence, not the unimplemented repair. AP-159 remains open; +no new intentional deviation. FPS deferred. G4 FAIL, no main merge. +Both clients remain owner-held; no builds/tests/closure during their check. +This is a memory-capture result, not a graphical gate: no PNG PASS claimed. diff --git a/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md b/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md index a1781df08..0f0569dfd 100644 --- a/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md +++ b/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md @@ -5055,3 +5055,22 @@ FAIL/open: roughly2–3-minute diagnostic routes cannot clear the observed roughly16-minute ordinary crash. Next useful evidence is longer ordinary reproduction plus first-acquire-failure preservation under a bounded contract, not repeating the same short clean route. C1a remains independently unclosed. + +## 61. Direct retail cathedral membership — 2026-09-05 + +Owner opened retail and explicitly authorized read-only debugger attachment +alongside their manual AcDream check. Paired2013 executable/PDB confirmed; +two bounded non-invasive snapshots agree: Setup020009A2, physical rootF4180112, +seven parts, retained cells F4180112/F4180113/F4180009,21 entries. Loaded +F4180114 has84 other shadow parts and zero references to the ramp owner. +Both installed cell/portal DAT pairs hash-identical. The complete-production +four-cell/28-entry diagnostic therefore differs from directly observed retail; +do not amend the original three-cell witness to four. + +`c1a-retail-membership-capture.md` records exact offsets, artifacts/hashes, +discarded debugger-script attempts and limits. This supplies the missing +live expected set, not independent proof of the first divergent predicate or +a production AP159 repair. Neither a visual-cause nor AMD-cause claim follows. +No source/package/FPS change or new intentional deviation. Debugger detached; +AcDream25724 and retail35048 remain open for owner, ACE13340 stays up. No +builds/tests/closure while owner checks. C1a/AP159 and #477/G4 remain open.