feat(render): Campaign V slice V4t-2 — the world texture stack crosses to GpuTextureSlot

The rest of V4t. The composite, particle and shared-atlas texture paths now
hand out the device's GpuTextureSlot instead of a raw 64-bit
ARB_bindless_texture handle, and GroupKey, CachedBatch and ObjectRenderBatch
carry that slot. WbDrawDispatcher, EnvCellRenderer and ParticleRenderer retire
their interim GlBindlessHandleTable instances and share the device's one
table, exactly as V4t-1 did for terrain. Nothing about world submission
changes otherwise: these three renderers are still raw GL, still bind binding
9 themselves, and still draw the same geometry in the same order.

**What produces a slot now.** CompositeTextureArrayCache's GL backend interns
each array's handle when it makes it resident and retires the entry when it
makes it non-resident, so the pair is created and destroyed together and the
cache above it never learns a device exists — the fake backend its tests use
mints a stand-in slot. TextureCache.AcquireParticleTexture does the same for
the one-layer particle arrays it owns, including on its rollback path.
ObjectMeshManager registers each shared atlas's wrap/clamp handles at batch
upload; registration is idempotent by handle, so the many batches sharing an
atlas share its entry.

**Slot release is stricter than what it replaces, not looser.** The interim
tables never released anything — the class comment said so — and they grew
without bound. The device's table has a fixed 16,384-slot capacity, so an
unreleased entry is now a leak with an end. Every producer therefore retires
its entry: the composite backend at MakeNonResident, the particle backend at
MakeNonResident, and ObjectMeshManager when a retiring atlas's PHYSICAL
retirement completes — the point at which its handles are already non-resident
and its texture already deleted. That last one needs the handles snapshotted
at eviction, because ManagedGLTextureArray.Dispose zeroes its own copies as
its first act. Teardown deliberately does not release: the device is being torn
down alongside its callers, so there is nothing left to recycle a slot into,
and deferring work through a possibly-disposed retirement queue would turn a
clean shutdown into a throw.

**The default value became load-bearing, and that is the one real hazard here.**
BindlessTextureLocation could say "not resolved" with handle 0, because no
texture has handle 0. A slot index has no spare value — default(GpuTextureSlot)
is real slot 0 — so a positional record would have turned every
budget-rejected or still-uploading composite into a silent read of whichever
texture registered first. That is the magenta-placeholder failure shape one
layer down. The type is now a struct storing the slot one-based, so default IS
Unresolved, with a test pinning both halves: default is unresolved, and a
location naming slot 0 is resolved and distinguishable from it. Elsewhere the
sentinel is already exact — GpuTextureSlot.Unassigned is 0xFFFFFFFF, which is
common.glsl's ACDREAM_TEXTURE_NONE — so the classify path's "no texture yet"
test and the particle billboard's untextured branch are unchanged in meaning.

**GroupKey ordering is preserved because the key never ordered anything.**
Handle→slot is a bijection (the device interns one slot per resident handle),
so the same (entity, batch) pairs bucket together as before. The key reaches
equality, hashing and the scene-digest fingerprints — never a comparator:
opaque and translucent groups sort by cull mode then camera distance, the
delayed-alpha path by viewer distance then submission ordinal, and group
enumeration follows the persistent dictionary's insertion order, which a
changed hash does not disturb. The digests hash the slot index where they
hashed the handle; both sides of the render-shadow comparison compute them the
same way, so the value changing is invisible to it. Read
CompareOpaqueSubmissionOrder, CompareTransparentSubmissionOrder and
AlphaFingerprintComparer before doubting this — sort-order drift is a
pixel-visible regression class this project has hit, and it is why the check
was made before the retype rather than after.

**One visibility change, forced rather than chosen.** BindlessTextureLocation
was public and now holds an internal contract type, so it is internal;
ObjectRenderBatch.TextureSlot is internal on an otherwise public class for the
same reason. Nothing outside this assembly and its InternalsVisibleTo test
assemblies named either.

**SkyRenderer keeps its interim table**, and the report should say why: the
sky's textures are minted by SkyRenderer itself from TextureCache's raw GL
texture names, which this slice does not retype, so it would be the one
consumer registering handles it produced — a different shape from the world
stack. The offline gate also masks the sky band, so the one automated
instrument here cannot see a sky regression. V4f owns that renderer.

**Gates.** GL offline pixel gate vs cb2a70b8, measured twice: 31 and 22
differing pixels of 563,200 (5.50e-05, 3.91e-05). The first is above the
plan's documented 15-23 px band, so a control was measured rather than
assumed: two same-commit captures at this tree differ by 19 px, and — the
decisive number — a capture at V4t-1 and a capture at this commit differ by
9 px, fewer than the same-commit control. Maximum channel delta is 41-52 in
every pair including the controls, i.e. the differing pixels are drawn from
one flickering population, not from moved geometry. tools/run-repeat-connected-gate.ps1
-Runs 3: 3/3 RENDERED on both the desktop witness and the client capture. One
Vulkan composition-host run with VK_LAYER_KHRONOS_validation proven inserted
by the loader: zero errors, zero warnings, converged ownership ledger. App
tests 4,077 / 3 skips and the complete Release suite 9,140 / 5 — both the
4,075 and 9,138 baselines plus the two tests added here.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/Rendering/CompositeTextureArrayCache.cs

@@ -1,3 +1,5 @@
+using AcDream.App.Rendering.Gpu;
+using AcDream.App.Rendering.Gpu.Gl;
 using AcDream.Core.Textures;
 using AcDream.Core.World;
 using Silk.NET.OpenGL;
@@ -5,10 +7,63 @@ using Silk.NET.OpenGL;
 namespace AcDream.App.Rendering;
 
 /// <summary>
-/// Location of one decoded entity-material composite in a resident bindless
-/// texture array. The modern mesh shader consumes this exact pair.
+/// Location of one decoded entity-material composite: the device texture-table
+/// slot of the array holding it, plus the layer within that array. The modern
+/// mesh shader consumes this exact pair.
+///
+/// <para>Campaign V slice V4t replaced the raw 64-bit
+/// <c>ARB_bindless_texture</c> handle with <see cref="GpuTextureSlot"/>, and
+/// that makes the DEFAULT value load-bearing. The old type could say "not
+/// resolved" with handle 0, because no texture ever has handle 0. A slot index
+/// has no such spare value — <c>default(GpuTextureSlot)</c> is real slot 0 — so
+/// a positional record would have turned every budget-rejected or
+/// still-uploading return into a silent read of whichever texture registered
+/// first. The slot is therefore stored one-based, which makes <c>default</c>
+/// exactly <see cref="Unresolved"/>. Same discipline, same reason, as
+/// <c>UiTextureTableHandle</c> on the UI path.</para>
+///
+/// <para>Internal rather than public because <see cref="GpuTextureSlot"/> is
+/// part of the internal RHI contract. Nothing outside this assembly and its
+/// InternalsVisibleTo test assemblies ever named this type.</para>
 /// </summary>
-public readonly record struct BindlessTextureLocation(ulong Handle, uint Layer);
+internal readonly struct BindlessTextureLocation : IEquatable<BindlessTextureLocation>
+{
+    private readonly uint _slotPlusOne;
+
+    public BindlessTextureLocation(GpuTextureSlot slot, uint layer)
+    {
+        _slotPlusOne = slot.IsAssigned ? slot.Index + 1 : 0;
+        Layer = layer;
+    }
+
+    /// <summary>The "no composite yet" value. Identical to <c>default</c>.</summary>
+    public static BindlessTextureLocation Unresolved => default;
+
+    /// <summary>Layer within the array. Meaningless unless <see cref="IsResolved"/>.</summary>
+    public uint Layer { get; }
+
+    public bool IsResolved => _slotPlusOne != 0;
+
+    public GpuTextureSlot Slot =>
+        _slotPlusOne == 0 ? GpuTextureSlot.Unassigned : new GpuTextureSlot(_slotPlusOne - 1);
+
+    public bool Equals(BindlessTextureLocation other) =>
+        _slotPlusOne == other._slotPlusOne && Layer == other.Layer;
+
+    public override bool Equals(object? obj) =>
+        obj is BindlessTextureLocation other && Equals(other);
+
+    public override int GetHashCode() => HashCode.Combine(_slotPlusOne, Layer);
+
+    public static bool operator ==(BindlessTextureLocation left, BindlessTextureLocation right) =>
+        left.Equals(right);
+
+    public static bool operator !=(BindlessTextureLocation left, BindlessTextureLocation right) =>
+        !left.Equals(right);
+
+    public override string ToString() =>
+        IsResolved ? $"{Slot}/layer{Layer}" : "unresolved";
+}
 
 internal enum CompositeTextureKind : byte
 {
@@ -74,6 +129,14 @@ internal sealed class CompositeTextureArrayResource
 {
     public required uint Name { get; init; }
     public required ulong Handle { get; init; }
+
+    /// <summary>
+    /// Campaign V slice V4t: this array's entry in the device texture table.
+    /// The backend that made <see cref="Handle"/> resident also interned it, so
+    /// the pair is created and retired together and the cache above never has
+    /// to know a backend exists.
+    /// </summary>
+    public required GpuTextureSlot Slot { get; init; }
     public required int Width { get; init; }
     public required int Height { get; init; }
     public required int Capacity { get; init; }
@@ -98,11 +161,13 @@ internal sealed unsafe class GlCompositeTextureArrayBackend : ICompositeTextureA
 {
     private readonly GL _gl;
     private readonly Wb.BindlessSupport _bindless;
+    private readonly GlGpuDevice _device;
 
-    public GlCompositeTextureArrayBackend(GL gl, Wb.BindlessSupport bindless)
+    public GlCompositeTextureArrayBackend(GL gl, Wb.BindlessSupport bindless, GlGpuDevice device)
     {
         _gl = gl ?? throw new ArgumentNullException(nameof(gl));
         _bindless = bindless ?? throw new ArgumentNullException(nameof(bindless));
+        _device = device ?? throw new ArgumentNullException(nameof(device));
         _gl.GetInteger(GetPName.MaxArrayTextureLayers, out int maximumLayers);
         MaximumArrayLayers = Math.Max(1, maximumLayers);
     }
@@ -149,10 +214,15 @@ internal sealed unsafe class GlCompositeTextureArrayBackend : ICompositeTextureA
             Wb.GpuMemoryTracker.TrackResourceAllocation(Wb.GpuResourceType.Texture);
             Wb.GpuMemoryTracker.TrackAllocation(bytes, Wb.GpuResourceType.Texture);
             tracked = true;
+            // Campaign V slice V4t: intern the resident handle into the device's
+            // one texture table. A table-exhaustion throw here is caught by the
+            // same rollback below, and nothing was added to the table if it did.
+            GpuTextureSlot slot = _device.RegisterWorldTextureHandle(handle);
             return new CompositeTextureArrayResource
             {
                 Name = name,
                 Handle = handle,
+                Slot = slot,
                 Width = width,
                 Height = height,
                 Capacity = capacity,
@@ -248,6 +318,10 @@ internal sealed unsafe class GlCompositeTextureArrayBackend : ICompositeTextureA
         Wb.GLHelpers.ThrowOnResourceError(
             _gl,
             $"releasing composite texture handle {resource.Handle} (precondition)");
+        // Campaign V slice V4t: retire the table entry before the handle it
+        // names stops being resident. Idempotent, so this stays correct when
+        // the retryable release ledger re-runs the operation.
+        _device.ReleaseWorldTextureHandle(resource.Handle);
         _bindless.MakeNonResident(resource.Handle);
         Wb.GLHelpers.ThrowOnResourceError(_gl, $"releasing composite texture handle {resource.Handle}");
     }
@@ -341,13 +415,14 @@ internal sealed class CompositeTextureArrayCache : IDisposable
     public CompositeTextureArrayCache(
         GL gl,
         Wb.BindlessSupport bindless,
+        GlGpuDevice device,
         IGpuResourceRetirementQueue retirementQueue,
         long unownedBudgetBytes = DefaultUnownedBudgetBytes,
         long physicalBudgetBytes = DefaultPhysicalBudgetBytes,
         int maximumUploadsPerFrame = DefaultMaximumUploadsPerFrame,
         long maximumUploadBytesPerFrame = DefaultMaximumUploadBytesPerFrame)
         : this(
-            new GlCompositeTextureArrayBackend(gl, bindless),
+            new GlCompositeTextureArrayBackend(gl, bindless, device),
             retirementQueue,
             unownedBudgetBytes,
             physicalBudgetBytes,
@@ -508,7 +583,7 @@ internal sealed class CompositeTextureArrayCache : IDisposable
         ThrowIfUnavailable();
         if (!_entries.TryGetValue(key, out Entry? entry))
         {
-            location = default;
+            location = BindlessTextureLocation.Unresolved;
             return false;
         }
 
@@ -516,7 +591,7 @@ internal sealed class CompositeTextureArrayCache : IDisposable
         _unowned.MarkOwned(key);
         entry.Atlas.LastUseSequence = ++_useSequence;
         location = new BindlessTextureLocation(
-            entry.Atlas.Resource.Handle,
+            entry.Atlas.Resource.Slot,
             checked((uint)entry.Layer));
         return true;
     }
@@ -542,7 +617,7 @@ internal sealed class CompositeTextureArrayCache : IDisposable
             // does not fit, stop all later decodes this frame rather than
             // repeatedly allocating RGBA buffers that cannot be uploaded.
             _uploadBudgetBlocked = true;
-            location = default;
+            location = BindlessTextureLocation.Unresolved;
             return false;
         }
 
@@ -552,7 +627,7 @@ internal sealed class CompositeTextureArrayCache : IDisposable
             // this frame. Tick advances compatible reclamation before the next
             // frame retries the same logical composite.
             _uploadBudgetBlocked = true;
-            location = default;
+            location = BindlessTextureLocation.Unresolved;
             return false;
         }
 
@@ -585,7 +660,7 @@ internal sealed class CompositeTextureArrayCache : IDisposable
         _owners.Acquire(ownerLocalId, key);
         _frameUploadCount++;
         _frameUploadBytes = checked(_frameUploadBytes + bytes);
-        location = new BindlessTextureLocation(atlas.Resource.Handle, checked((uint)layer));
+        location = new BindlessTextureLocation(atlas.Resource.Slot, checked((uint)layer));
         return true;
     }