fix(app): #343 — a wounded render loop defers the native release instead of throwing over the real failure

Root cause pinned by IL-decompiling Silk.NET.Windowing.Common:
ViewImplementationBase._inRenderLoop is set at DoRender/DoUpdate entry
and cleared ONLY on normal return, so a throwing frame callback leaves
it armed forever and any later Dispose -> Reset throws "You cannot call
Reset inside of the render loop", exit 82, replacing the original
wounding exception in the report.

The fix mirrors Silk's own bracket exactly: GameWindow._renderLoopArmed
set at OnUpdate/OnRender entry, cleared only on their normal return —
deliberately NOT in a finally, so it tracks the wound the same way
Silk's private field does. ReleaseNativeWindow checks it before
disposing: armed -> best-effort Close() (swallowed so it can never
become the reported failure), no Dispose, and a new terminal status
CompleteWithDeferredNativeRelease with Error kept null — the original
exception stays the primary report. Healthy paths (OnClosing's
in-loop completion, Run()'s tail release) are byte-unchanged, and the
new PublishNativeWindow parameters default to null so every existing
caller and test behaves identically.

Sabotage: disabling the armed-check flipped the deferral test to
Expected CompleteWithDeferredNativeRelease / Actual Complete —
the guard is what the test exercises. Clean-room suite 11,262 / 6 / 1,
the 1 being #340's documented load flake (passed standalone; second
recorded firing noted in its entry).

Queue: #344 done, #343 done; next #345's instrumented mechanism
session, then #341's boundary hunt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.App/Rendering/GameWindow.cs

@@ -42,6 +42,18 @@ public sealed class GameWindow :
     private readonly WorldEvents _worldEvents;
     private readonly HostQuiescenceGate _hostQuiescence = new();
     private IWindow? _window;
+    // #343: mirrors Silk's own ViewImplementationBase._inRenderLoop guard,
+    // which we cannot read directly (it is a private field on Silk's
+    // internal type). Set true before OnUpdate/OnRender run and cleared
+    // only on their normal (non-throwing) return — exactly like Silk's own
+    // bracket around DoUpdate/DoRender — so a frame callback that throws
+    // leaves this stuck true, same as Silk's real guard. GameWindowLifetime
+    // reads it before disposing the native window, so a wounded loop defers
+    // the release instead of calling Reset() while Silk still thinks it is
+    // mid-frame (which throws "You cannot call `Reset` inside of the render
+    // loop!" and would otherwise bury whatever exception actually wounded
+    // the loop). See docs/ISSUES.md #343.
+    private bool _renderLoopArmed;
     private SilkWindowCallbackBinding? _windowCallbacks;
     private GameWindowGraphics? _graphics;
     // Campaign V slice V6h: borrowed, not owned — _graphics owns the context and
@@ -722,7 +734,11 @@ public sealed class GameWindow :
         _startupQuality = startup.Quality;
 
         _window = Window.Create(options);
-        _lifetime.PublishNativeWindow(_window);
+        IWindow window = _window;
+        _lifetime.PublishNativeWindow(
+            window,
+            isRenderLoopArmed: () => _renderLoopArmed,
+            requestClose: window.Close);
         _displayFramePacing.BindSurface(
             new SilkDisplayFramePacingSurface(_window));
         // The fixed binding preserves main Render before post-render pacing,
@@ -1505,15 +1521,24 @@ public sealed class GameWindow :
 
     private void OnUpdate(double dt)
     {
+        // #343: armed before the callback body runs, cleared only on normal
+        // return. Deliberately NOT a try/finally — if Tick throws, the flag
+        // must stay true (mirroring Silk's own stuck _inRenderLoop guard),
+        // not get cleared on the way out.
+        _renderLoopArmed = true;
         using var _updStage = _frameProfiler.BeginStage(
             AcDream.App.Diagnostics.FrameStage.Update);
         _frameGraphs.Tick(new AcDream.App.Update.UpdateFrameInput(dt));
+        _renderLoopArmed = false;
     }
 
     // Performance overlay state — updated every ~0.5s and written to the
     // window title so there's zero rendering cost (no font/overlay needed).
     private void OnRender(double deltaSeconds)
     {
+        // #343: see OnUpdate above — armed on entry, cleared on every normal
+        // exit path below, left stuck true if anything here throws.
+        _renderLoopArmed = true;
         Vector2D<int> size = _window!.Size;
         // Campaign V slice V6h: swapchain currency is the one piece of
         // presentation the RHI contract deliberately leaves to the host (plan
@@ -1521,7 +1546,10 @@ public sealed class GameWindow :
         // out-of-date one is recreated at a frame boundary, the only safe point.
         // The handoff below stays exactly one call on both backends.
         if (_vulkanGraphics is { } vulkan && !vulkan.PrepareFrame())
+        {
+            _renderLoopArmed = false;
             return;
+        }
         try
         {
             _frameGraphs.Render(
@@ -1535,10 +1563,12 @@ public sealed class GameWindow :
             when (_vulkanGraphics is not null)
         {
             _vulkanGraphics.RequestRecreate();
+            _renderLoopArmed = false;
             return;
         }
 
         _vulkanGraphics?.NoteFrameClosed();
+        _renderLoopArmed = false;
     }
 
     // IsEntityCurrentlyMoving REMOVED (2026-07-09): it powered a cache-bypass