docs(overhaul): contract issue 470 readback barrier

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -2529,3 +2529,94 @@ depends on Vulkan, and prove the dedicated local and lavapipe routes cannot
 silently omit or pass the hardware witness. A PASS unlocks the full production
 review as pass 3/10; a FAIL receives another bounded contract within the ten-
 pass ceiling. Nothing lands or launches before both sequential lenses pass.
+
+## 29. S5-#470 fix round 2 — make the pixel readback host-visible
+
+### 29.1 Review result through pass 3/10
+
+Fix-round-1 scratch tip `2cad9c84c7508f714823d2bd44199071ac8d74f7`
+passed the narrow retail/gate-honesty re-review at pass 2/10. The reviewer
+proved the five-file change was evidence-only, ran the portable
+`Gpu.Vk&Lane!=Vulkan` set successfully with an invalid ICD, ran the exact
+`Lane=Vulkan` witness successfully on the current AMD device, proved the same
+dedicated lane fails rather than skips with an invalid ICD, and reproduced the
+trait, portable-filter, and dedicated-workflow mutations. The renderer, GLSL,
+SPIR-V, manifest, and witness body remained byte-identical to implementation
+`51f974da4`.
+
+Full production/gate-honesty review pass 3/10 then returned **FAIL** on one P2
+test-harness synchronization defect only. It found no renderer, descriptor-
+domain, shader, lane-ownership, allocation, or production-path defect. In
+`MeshModernSharedIndexOffscreenTests.ReadBack`, the image-to-buffer copy is
+followed by command-buffer completion, `QueueWaitIdle`, mapping, and a CPU
+read, but there is no device memory dependency from the transfer write to the
+host read. Host-coherent memory removes the need for invalidation; it does not
+make a transfer write available/visible to the host. Queue-idle/fence
+completion likewise does not replace that dependency. The locally passing
+pixel witness may therefore read stale data on another conformant device.
+
+The review independently restored both shader index-domain mutations and the
+lane-trait mutation, regenerated exact ordinary shader SHA-256
+`6194193764616BC88BF967D1FDC2BEA5F6F2D1EC2EF94FD492922137503F56E4`,
+passed the restored focused portable set 363/363, the dedicated witness 1/1,
+the invalid-ICD portable structural/ownership set 2/2, and a Release build at
+0 warnings / 0 errors. Both official manifests verify 30/30. The exact
+hermetic artifact is 16,975/0/0. The exact InstalledDat artifact used the
+canonical-inclusive filter `Lane=InstalledDat&Purpose!=Diagnostic` and is
+386 passed / the unchanged 10 accepted failures / 1 accepted skip; it is not
+the broader diagnostic-inclusive 469-pass lane.
+
+### 29.2 Bounded harness-only repair
+
+Change only the offscreen witness and its smallest test-side proof. Immediately
+after `CmdCopyImageToBuffer` and before `EndCommandBuffer`, record one
+`CmdPipelineBarrier2` whose actual `BufferMemoryBarrier2` covers the readback
+buffer and exact copied byte range:
+
+- source stage `CopyBit`, source access `TransferWriteBit`;
+- destination stage `HostBit`, destination access `HostReadBit`;
+- both queue-family indices `QueueFamilyIgnored`;
+- offset zero and size equal to the mapped/copied byte count; and
+- the exact readback buffer handle.
+
+Keep `QueueWaitIdle`, the host-visible/coherent allocation, map/unmap, copy
+geometry, render submission, pixel oracle, physical-device selection, and
+cleanup unchanged. Do not add an invalidate call to coherent memory, a second
+submission/fence, a staging owner, a production RHI helper, a device-specific
+workaround, or a skip/pass on unavailable Vulkan. Do not change renderer
+source, GLSL, SPIR-V, manifests, lane ownership, workflow, release-gate tool or
+documentation, package/recipe, issue/register policy, or graphical behavior.
+
+Add a portable, no-Vulkan-initialization guard over the **live** readback path.
+It must inspect the actual barrier descriptor and prove every stage/access,
+queue-family, buffer, offset, and size value above, and it must prove the live
+command order is copy -> that barrier -> end/submit. A source-only assertion
+that can be satisfied by an unused lookalike descriptor is insufficient.
+
+### 29.3 Fix return and narrow production re-review
+
+Apply and restore at least these mutations, recording the first discriminating
+failure for each in the fix commit body:
+
+1. remove the post-copy host-read barrier from the live readback path;
+2. change either side of the dependency (for example `TransferWriteBit` to
+   `TransferReadBit`, or `HostReadBit` to `HostWriteBit`); and
+3. move the otherwise-correct barrier before `CmdCopyImageToBuffer`.
+
+Return one clean fix-round-2 commit atop `2cad9c84`; exact changed-file and
+line counts; mutation first failures; both diff checks; the portable
+descriptor/order guard; the exact dedicated `Lane=Vulkan` witness on the
+current device; focused structural, recording, receiver, lane-ownership, and
+Vulkan-portable tests; Release solution build 0W/0E; a clean exact-tip
+portable hermetic artifact; and canonical-inclusive InstalledDat with all ten
+accepted failures and the one accepted skip named. No bake or graphical
+client launch.
+
+Because pass 3 found no production renderer or retail-behavior defect, only a
+narrow production/gate-honesty re-review runs next as pass 4/10. It must
+inspect the live recorded dependency and order, reproduce mutations 1–3,
+rerun the dedicated witness, verify the prior index-domain and lane-ownership
+proofs remain intact, and verify exact clean artifact provenance. A PASS
+unlocks landing and the pinned graphical A/B. A FAIL receives the next bounded
+contract within the owner-authorized ten-pass ceiling. Nothing lands or
+launches before PASS.