docs(overhaul): contract issue 470 readback barrier

docs/ISSUES.md

@@ -68,11 +68,14 @@ inspection).
 
 ## #470 — Atmospheric ordered world draws use absolute transform indices for local sidecars
 
-**Status:** FIX ROUND 1 — renderer repair implemented at scratch `51f974da4`,
-but retail/behavior review pass 1/10 found its Vulkan hardware witness inside
-the portable gate; bounded evidence-lane repair is S5 packet §28; Campaign OVERHAUL v2
-renderer-solid/G4 scope. The residual predates S5-c3 and is present at least as
-far back as landed S4-c2 `252886e84`.
+**Status:** FIX ROUND 2 — renderer repair `51f974da4` is correct and evidence-
+lane fix `2cad9c84` passed narrow review pass 2/10. Full production review pass
+3/10 found one harness-only P2: the offscreen image-to-buffer readback has no
+transfer-write -> host-read memory dependency before mapping. The bounded
+barrier/test contract is S5 packet §29; landing and graphical A/B remain
+locked. Campaign OVERHAUL v2 renderer-solid/G4 scope. The production residual
+predates S5-c3 and is present at least as far back as landed S4-c2
+`252886e84`.
 
 **Evidence/mechanism:** `WbDrawDispatcher.PrepareOrderedStream` writes instance
 transforms into the shared directional-shadow transform arena and offsets every
@@ -106,6 +109,12 @@ and preserve active/inactive receiver selection/binding. Repeat a pinned-camera
 retail/off -> High -> retail/off graphical A/B without movement or resize. This
 can share #469's final graphical route, but its code contract remains separate.
 
+**Review-only harness tail (packet §29):** after the live image-to-buffer copy,
+record an exact readback-buffer barrier from `CopyBit`/`TransferWriteBit` to
+`HostBit`/`HostReadBit` before ending the command buffer, and pin both the live
+descriptor and copy -> barrier -> end order without initializing Vulkan. No
+renderer, shader, lane, recipe, or graphical policy changes.
+
 ## #469 — Atmospheric shadow-gate transition switches the whole outdoor lighting direction abruptly and can darken the world
 
 **Status:** OPEN — found 2026-09-04 by the S5-c2 lead graphical gate; Campaign

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -693,8 +693,8 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S5-c2 | **LANDED + REVIEW-CLOSED 2026-09-04; lead graphical gate PROVISIONAL PASS.** Campaign stack `a4de2efc4` -> `048027e71` -> `ef819eedf`; reviewed scratch tip `521f5edda54`; packet §§14–16. The opt-in IA-24 path borrows the exact prior-completed landscape set/flag, selects world casters through S2 CELLARRAY or building `EffectCellId`, selects authored terrain slots, and projects exact active instance runs without rebuilding retained topology. Pack-off remains unchanged. | G4 UNPASSED | Retail/deviation PASS; production's documentation-only fix round 1 narrowly re-reviewed PASS. Fresh campaign Release 0W/0E and affected 137/137. Official evidence: hermetic 16,768/16,768; broader InstalledDat 468 pass / 10 fail / 1 skip; canonical 385 pass / the same 10 fail / 1 skip; manifests and nonpassing identities exact. Valid lead gate `logs/selfgate-20260904-183925-s5c2-candidate-shadow-ab`: seven PNGs, exit 0, graceful logout, no fatal match, no client left. Exact parent `5c106bcdf` A/B at `s5-c2-ab-parent/logs/selfgate-20260904-183815-s5c2-parent-shadow-ab` proves the gate-visible dark lighting switch predates c2; #469/IA-24 carry it for resolution or explicit owner acceptance before G4. Owner PNG inspection pending. |
 | S5-c3 | **LANDED + REVIEW-CLOSED 2026-09-04** at `c673f767e` (reviewed scratch `01e5a15d0`; packet §§17–21). | **C3 SCOPE SELF-GATE PROVISIONAL PASS; whole-renderer finding #470 OPEN. G4 UNPASSED.** | OpenAI retail pass 3/10 PASS and production narrow re-review pass 5/10 PASS. Fix round 3 added ordinary landblock-lifetime ownership for every unique nonzero ladder GfxObj, rearmed walk-frame miss requests, and made the one-tick-before-BeginFrame proof discriminating. Fresh clean campaign: Release 0W/0E; focused 101/101; hermetic 16,811/16,811; InstalledDat 469 pass / the unchanged documented 10 fail / 1 skip; manifests 30/30. Self-gate `logs/selfgate-20260904-223345-s5c3-building-degrade` produced five PNGs, exited 0/gracefully, and left no client. The selected building shells are complete; the Holtburg frame also exposed pre-existing atmospheric ordered-draw sidecar defect #470, which is not a c3 regression and blocks renderer-solid/G4 until repaired. |
 | S5-c4 | **LANDED + REVIEW-CLOSED 2026-09-05; LEAD GRAPHICAL GATE PROVISIONAL PASS.** Campaign stack `75664805f` -> `15ed57a1e` -> `d5cfd1c91` -> `03a108ffa`; reviewed scratch tip `db8136448`; packet §§22–26. | G4 UNPASSED | Retail/material pass 3/10 PASS. Full production pass 4/10 found one classic/private detail-off regression; fix round 3 restored the prior AlphaBlend/coalescing path, and narrow production pass 5/10 PASS reproduced all three mutations. Fresh campaign Release 0W/0E, App 245/245, Content 71/71; scratch hermetic 16,971/16,971 and InstalledDat 469/10/1 with both manifests 32/32. Full recipe-10 bake: 2,237,865 keys, zero failures, SHA `4E0FA6C5…29B59B`. Gate `logs/selfgate-20260905-020703-s5c4-onepass-detail`: 13/13 PNGs, exit 0, graceful, no client left; visual PASS provisional. #471 DONE; #470 narrowed to local-sidecar indexing. |
-| S5-#470 | **FIX ROUND 1 IN FLIGHT.** Renderer implementation `51f974da4` is correct; retail/behavior pass 1/10 found one blocking evidence-lane defect only: its physical-Vulkan witness was unconditionally inside the portable Release suite. Fix contract = packet §28. | G4 UNPASSED | Put the unchanged witness in explicit `Lane=Vulkan`, exclude that lane from the portable default, run it explicitly under the existing lavapipe CI job and current hardware, then narrow re-review pass 2/10 followed by full production pass 3/10. Nothing lands or launches yet. |
-| S5 | IN FLIGHT — c1–c4 landed/review-closed/provisionally self-gated; #470 fix round 1 contracted; #469, c5, closeout, and G4 remain | G4 | Packet §§7 and 12–28 are binding. Next: close #470's evidence-lane review finding, complete both sequential lenses, and run its pinned graphical A/B; after that #469, c5 cleanup, closeout, and G4. Never merge main before G4. |
+| S5-#470 | **FIX ROUND 2 IN FLIGHT.** Renderer implementation `51f974da4` is correct. Evidence-lane fix `2cad9c84` passed narrow retail/gate-honesty pass 2/10. Full production pass 3/10 found one harness-only P2: the image-to-buffer readback lacks the required transfer-write -> host-read dependency. Fix contract = packet §29. | G4 UNPASSED | Add the exact post-copy/pre-end buffer barrier and a live descriptor/order guard; no renderer/shader/lane change. Then narrow production re-review pass 4/10. Landing and the pinned graphical A/B remain locked until PASS. |
+| S5 | IN FLIGHT — c1–c4 landed/review-closed/provisionally self-gated; #470 fix round 2 contracted; #469, c5, closeout, and G4 remain | G4 | Packet §§7 and 12–29 are binding. Next: close #470's readback synchronization finding, narrow production re-review, land, and run its pinned graphical A/B; after that #469, c5 cleanup, closeout, and G4. Never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -2529,3 +2529,94 @@ depends on Vulkan, and prove the dedicated local and lavapipe routes cannot
 silently omit or pass the hardware witness. A PASS unlocks the full production
 review as pass 3/10; a FAIL receives another bounded contract within the ten-
 pass ceiling. Nothing lands or launches before both sequential lenses pass.
+
+## 29. S5-#470 fix round 2 — make the pixel readback host-visible
+
+### 29.1 Review result through pass 3/10
+
+Fix-round-1 scratch tip `2cad9c84c7508f714823d2bd44199071ac8d74f7`
+passed the narrow retail/gate-honesty re-review at pass 2/10. The reviewer
+proved the five-file change was evidence-only, ran the portable
+`Gpu.Vk&Lane!=Vulkan` set successfully with an invalid ICD, ran the exact
+`Lane=Vulkan` witness successfully on the current AMD device, proved the same
+dedicated lane fails rather than skips with an invalid ICD, and reproduced the
+trait, portable-filter, and dedicated-workflow mutations. The renderer, GLSL,
+SPIR-V, manifest, and witness body remained byte-identical to implementation
+`51f974da4`.
+
+Full production/gate-honesty review pass 3/10 then returned **FAIL** on one P2
+test-harness synchronization defect only. It found no renderer, descriptor-
+domain, shader, lane-ownership, allocation, or production-path defect. In
+`MeshModernSharedIndexOffscreenTests.ReadBack`, the image-to-buffer copy is
+followed by command-buffer completion, `QueueWaitIdle`, mapping, and a CPU
+read, but there is no device memory dependency from the transfer write to the
+host read. Host-coherent memory removes the need for invalidation; it does not
+make a transfer write available/visible to the host. Queue-idle/fence
+completion likewise does not replace that dependency. The locally passing
+pixel witness may therefore read stale data on another conformant device.
+
+The review independently restored both shader index-domain mutations and the
+lane-trait mutation, regenerated exact ordinary shader SHA-256
+`6194193764616BC88BF967D1FDC2BEA5F6F2D1EC2EF94FD492922137503F56E4`,
+passed the restored focused portable set 363/363, the dedicated witness 1/1,
+the invalid-ICD portable structural/ownership set 2/2, and a Release build at
+0 warnings / 0 errors. Both official manifests verify 30/30. The exact
+hermetic artifact is 16,975/0/0. The exact InstalledDat artifact used the
+canonical-inclusive filter `Lane=InstalledDat&Purpose!=Diagnostic` and is
+386 passed / the unchanged 10 accepted failures / 1 accepted skip; it is not
+the broader diagnostic-inclusive 469-pass lane.
+
+### 29.2 Bounded harness-only repair
+
+Change only the offscreen witness and its smallest test-side proof. Immediately
+after `CmdCopyImageToBuffer` and before `EndCommandBuffer`, record one
+`CmdPipelineBarrier2` whose actual `BufferMemoryBarrier2` covers the readback
+buffer and exact copied byte range:
+
+- source stage `CopyBit`, source access `TransferWriteBit`;
+- destination stage `HostBit`, destination access `HostReadBit`;
+- both queue-family indices `QueueFamilyIgnored`;
+- offset zero and size equal to the mapped/copied byte count; and
+- the exact readback buffer handle.
+
+Keep `QueueWaitIdle`, the host-visible/coherent allocation, map/unmap, copy
+geometry, render submission, pixel oracle, physical-device selection, and
+cleanup unchanged. Do not add an invalidate call to coherent memory, a second
+submission/fence, a staging owner, a production RHI helper, a device-specific
+workaround, or a skip/pass on unavailable Vulkan. Do not change renderer
+source, GLSL, SPIR-V, manifests, lane ownership, workflow, release-gate tool or
+documentation, package/recipe, issue/register policy, or graphical behavior.
+
+Add a portable, no-Vulkan-initialization guard over the **live** readback path.
+It must inspect the actual barrier descriptor and prove every stage/access,
+queue-family, buffer, offset, and size value above, and it must prove the live
+command order is copy -> that barrier -> end/submit. A source-only assertion
+that can be satisfied by an unused lookalike descriptor is insufficient.
+
+### 29.3 Fix return and narrow production re-review
+
+Apply and restore at least these mutations, recording the first discriminating
+failure for each in the fix commit body:
+
+1. remove the post-copy host-read barrier from the live readback path;
+2. change either side of the dependency (for example `TransferWriteBit` to
+   `TransferReadBit`, or `HostReadBit` to `HostWriteBit`); and
+3. move the otherwise-correct barrier before `CmdCopyImageToBuffer`.
+
+Return one clean fix-round-2 commit atop `2cad9c84`; exact changed-file and
+line counts; mutation first failures; both diff checks; the portable
+descriptor/order guard; the exact dedicated `Lane=Vulkan` witness on the
+current device; focused structural, recording, receiver, lane-ownership, and
+Vulkan-portable tests; Release solution build 0W/0E; a clean exact-tip
+portable hermetic artifact; and canonical-inclusive InstalledDat with all ten
+accepted failures and the one accepted skip named. No bake or graphical
+client launch.
+
+Because pass 3 found no production renderer or retail-behavior defect, only a
+narrow production/gate-honesty re-review runs next as pass 4/10. It must
+inspect the live recorded dependency and order, reproduce mutations 1–3,
+rerun the dedicated witness, verify the prior index-domain and lane-ownership
+proofs remain intact, and verify exact clean artifact provenance. A PASS
+unlocks landing and the pinned graphical A/B. A FAIL receives the next bounded
+contract within the owner-authorized ten-pass ceiling. Nothing lands or
+launches before PASS.