docs(overhaul): bound capture host-visibility fix and preserve first-frame gate

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -730,10 +730,14 @@ original AMD causation/ordinary soak and G4 remain open.
 intended, exact restoration, Release0W0E/92PASS. Wegener retail/behavior1 and
 James production/lifetime2 both PASS, no findings; one prior test-only F1.
 Reviewed scratch e58f3cc2c integrates with this ledger; architecture preserves
-#477.480-lead-verification.md records proof; connected hand-item PNG owed.
+#477; campaign4b9242d00 fresh Release0W0E/92PASS.
+480-lead-verification.md records proof; connected hand-item PNG owed.
 #476 returned twelve files; lead independent two mutations, exact restoration,
-Release0W0E/175PASS.476-lead-verification.md records proof; Rawls review1 in
-flight, production/lifetime2 follows. Capture fix not integrated yet. No new
+Release0W0E/175PASS.476-lead-verification.md records proof; Rawls review1 PASS.
+Wegener production2 found one inherited capture-to-host visibility gap, root
+confirmed.476-fix-round1-host-visibility.md bounds first F1; no broad allocator
+change, capture-local coherent restriction gets AD-121 at landing. Not integrated.
+Prepared first-request/two-real-resize/hand-item route is not run. No new
 client run; both clients absent and ACE9000 PID13340 up at latest preflight.
 Rynthid Recall6150→3032001C corroborates owner generation4; historical route
 labels are not location evidence (479-rynthid-location-evidence.md). #479

docs/research/2026-09-01-overhaul/476-fix-round1-host-visibility.md

@@ -0,0 +1,82 @@
+# #476 fix round 1 — native capture-to-host visibility
+
+Lead contract2026-09-05. Wegener production/lifetime review2 found one MAJOR
+inherited native gap. Phase/lifetime repair remains sound; landing is blocked
+until this narrow F1 is corrected. Rawls behavior/retail review1 passed.
+This is the first #476 fix round, not a reopening of #480 or a new world feature.
+
+## Independently verified finding
+
+Root read actual RecordBackbufferCapture: CmdCopyImageToBuffer writes the
+retained buffer, then RecordCopy marks it; no buffer host-read dependency
+follows. CaptureBackbuffer waits DeviceWaitIdle then VulkanGpuBuffer.Read
+copies MappedSpan. The later present barrier applies to the image, not this
+buffer. Completion is not host-domain visibility. See the
+[Khronos fence host-visibility rule](https://docs.vulkan.org/spec/latest/chapters/synchronization.html#synchronization-fences-waiting)
+and [CPU readback example](https://docs.vulkan.org/guide/latest/synchronization_examples.html#_cpu_read_back_of_data_written_by_a_compute_shader).
+Adapt the example's producer to COPY/TRANSFER_WRITE, not COMPUTE/SHADER_WRITE.
+
+Noncoherent memory is genuinely reachable: HostReadable preferences end with
+HostVisible-only; the allocator accepts/maps it and Read does not invalidate.
+Root independently read selection, allocation/map and Read. This existing
+general-buffer limitation must not be hidden by saying host-readable always
+means coherent. No current AMD/crash or observed PNG cause is newly established.
+
+## Exact repair, no allocator-policy expansion
+
+In the existing RecordBackbufferCapture, immediately after the actual copy,
+record one BufferMemoryBarrier2 for the SAME capture buffer, offset0 and exact
+copied byte count. Source COPY/TRANSFER_WRITE; destination HOST/HOST_READ;
+queue-family indices ignored. Existing successful-submission validity and
+DeviceWaitIdle remain; add no idle wait, copy, allocation, present change or
+new owner. CopyRecorded follows the dependency recording. Capture-off and
+size-mismatch paths still record neither copy nor barrier.
+
+Choose the conservative capture-local policy: CaptureBackbuffer must reject
+noncoherent retained memory with a precise NotSupportedException before waiting
+or reading any mapped bytes. Use the actual buffer's existing coherence property;
+do not guess from residency or preferred memory type. Keep request failure
+truthful; never write a successful PNG containing unsupported bytes. Do not
+change global heap preferences, allocator/suballocation, HostWritable behavior,
+generic buffer Read, or introduce whole-block invalidation that could affect
+neighbor allocations. Current preferred coherent capture remains supported.
+
+This is an explicit diagnostic capability restriction, not retail equivalence.
+Add AD-121 in retail-divergence-register.md in the same eventual landing commit:
+the modern opt-in retained Vulkan screenshot path rejects noncoherent capture
+memory until atom-safe isolated invalidation is supported. Record exact source,
+justification, unsupported-capture symptom and retail completed-front-buffer
+reference; update the AD active count from92 to93 without rewriting other rows.
+The gameplay renderer/default capture-off path is unaffected. Update only the
+relevant architecture capture paragraph and bounded outcome, not historical
+evidence. No new AC algorithm or new paired-binary claim is required.
+
+## Discriminating proof
+
+Extend the existing #476 Vulkan tests. Use the repository's existing test-local
+Silk native-context/interception pattern (see #477 synchronization tests) to
+execute ACTUAL RecordBackbufferCapture. Assert emitted image transition,
+image-to-buffer copy, exact buffer identity/range/stage/access/queue fields and
+host barrier order, including no-copy/off/mismatch branches. A production helper
+factory may organize fields, but testing an unused helper alone is insufficient.
+
+Exercise actual CaptureBackbuffer with submitted-valid fake native state and
+distinct mapped bytes: coherent succeeds through wait/read/format; noncoherent
+fails before native wait/read. Preserve existing no-submission/resize/zero-area/
+failure tests. No physical-GPU result may be inferred from interception tests.
+
+Two new actual-production mutations, separately restored: remove the real host
+barrier call (must fail emitted dependency/order) and bypass the real coherence
+rejection (must fail the unsupported-path witness, not setup/build). Retain the
+prior early-capture and premature-validity regression tests. Verify raw hashes,
+green Release, focused plus affected lanes and portable GPU lane without skips.
+Return exact commands/TRX/hashes. Root independently verifies these changes,
+then Wegener performs a narrow F1 re-review; do not restart unchanged broad lenses.
+
+Implement in the existing frozen s5-476-openai-impl scratch at6347e0f82 with
+its twelve-file round0 changes preserved. F1 source scope only capture portions
+of Resources partial, existing/new capture tests, architecture/register and this
+outcome if copied there. No edits to #477 scratch/campaign, no agent commits,
+clients or extra agents. Both clients absent before every build/test. Lead owns
+commit/integration; preserve #477's distinct partial changes. Prepared graphical
+route remains unrun until accepted integration and Release green.

docs/research/2026-09-01-overhaul/476-lead-verification.md

@@ -60,8 +60,24 @@ Root verified all twelve returned raw hashes and git diff --check. Key hashes:
 Named retail + paired-executable screenshot-boundary proof remains in
 476-capture-lifetime-diagnosis.md. Vulkan retained acquired-image copying is a
 modern adaptation; no new AC algorithm or intentional deviation is introduced.
-Rawls independent behavior/retail review1 in flight; sequential production/
-lifetime review2 follows. No integration or graphical freshness PASS yet.
+Rawls independent behavior/retail review1 PASS, no findings; independently
+checked named/paired byte windows and actual capture/failure paths. Wegener
+sequential production/lifetime review2 FAIL on one inherited native host-read
+visibility gap, independently confirmed by root. Phase/validity changes have no
+other findings.476-fix-round1-host-visibility.md binds the barrier plus explicit
+capture-local coherence restriction and AD-121; no integration or graphical
+freshness PASS yet. Prior proof above does not establish host-domain visibility.
 After review, merge capture-only portions without replacing #477's synchronization
 changes, rebuild, then preserve the first PNG and two real distinct-size captures.
 All visual results remain provisional until the owner looks; G4 still FAIL.
+
+Prepared route (NOT RUN): tools/overhaul-selfgate/route-476-capture-current-frame.txt.
+First command requests a screenshot without a readiness/warmup delay. Real
+1024x768 then1600x900 size changes immediately request their first PNG after
+the framebuffer condition; none is discarded or retried. Login/teleloc Neftet
+visible frames follow, then separate settled rest/combat-toggle/rest item views
+using the player's existing equipment. Those later sleeps are NOT first-frame
+capture evidence. Both toggles use the real input action; no attack or inventory
+mutation is requested. Gate after accepted integration and green Release, with
+both clients absent, ACE up, agent builds/tests paused, one runner invocation,
+same session-v10/High profile, core+sync validation retained to guard #477 merge.

docs/research/2026-09-01-overhaul/480-lead-verification.md

@@ -74,3 +74,11 @@ review, one prior evidence-only F1. Lead integrates the reviewed source/test/
 contract blobs; architecture merges only the equipped-child paragraph and keeps
 the already-landed #477 GPU paragraph. No new intentional deviation.
 Fresh integrated checks and a connected hand-item PNG remain next. G4 FAIL.
+
+Integrated4b9242d00f8239e914b1c1d84aa0df8e879d0c90: fresh Release0W0E
+(9.58s), same92/92 affected tests, zero skips. TRX
+artifacts/480-integrated/480-integrated92.trx SHA256
+4609261E2F4ABD2B733D59AFBD51A6D0FAC849776102D0142081B85336C0C345.
+All seven non-architecture changed blobs equal the reviewed scratch commit;
+the architecture diff contains only the intended child-publication paragraph
+relative to the campaign, retaining #477's existing GPU paragraph. No client run.

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -4765,3 +4765,14 @@ Rawls behavior/retail1 in flight; sequential production/lifetime2 follows.
 Capture not integrated/graphically accepted. Root will preserve #477's separate
 Vulkan changes during integration. Both clients absent; ACE9000 PID13340 up.
 No new graphical run. All §49 obligations and G4 FAIL remain current.
+
+Integrated480 campaign4b9242d00: fresh Release0W0E/92PASS; seven code/test/
+contract blobs identical, architecture merges only intended paragraph. #476
+Rawls review1 PASS; Wegener production2 FAIL on one inherited native readback
+visibility gap. Root confirmed actual missing transfer-to-host barrier and
+reachable noncoherent memory without invalidation.476-fix-round1-host-visibility.md
+binds one narrow F1: real capture-buffer barrier, explicit local coherent-memory
+requirement (AD-121 at landing), actual-command/coherence witnesses and mutations.
+No global allocator expansion; unchanged phase/lifetime review stays closed.
+Prepared route-476-capture-current-frame.txt preserves first request plus two
+real resizes, then settled hand-item views; NOT RUN. No new client launched.