docs(overhaul): contract S5 c4 depth-state fix

docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

@@ -692,8 +692,8 @@ Update immediately when a slice changes state. Chat is not the ledger.
 | S5-c1 | **LANDED 2026-09-04 after the owner-authorized documentation/evidence exception.** Mandatory stop `efb075619` remains in history; final campaign tip `1718832e2`, reviewed scratch tip `b2d56f9e3`. | G4 UNPASSED | Narrow exception re-review PASS. Clean evidence: hermetic 16,760/16,760; inclusive InstalledDat 385 pass / the same documented 10 fail / 1 skip; both exact `d6592d3ac`, `WorktreeDirty=false`, manifests fully verified. Fresh campaign Release 0W/0E, Core 111/111, visibility 38/38, allocation/AP-116 4/4. Lead graphical portal-haze gate PROVISIONAL PASS, exit 0/graceful, 10 PNGs under `logs/selfgate-20260904-171137-s5c1-particle-visibility`; owner inspection pending. |
 | S5-c2 | **LANDED + REVIEW-CLOSED 2026-09-04; lead graphical gate PROVISIONAL PASS.** Campaign stack `a4de2efc4` -> `048027e71` -> `ef819eedf`; reviewed scratch tip `521f5edda54`; packet §§14–16. The opt-in IA-24 path borrows the exact prior-completed landscape set/flag, selects world casters through S2 CELLARRAY or building `EffectCellId`, selects authored terrain slots, and projects exact active instance runs without rebuilding retained topology. Pack-off remains unchanged. | G4 UNPASSED | Retail/deviation PASS; production's documentation-only fix round 1 narrowly re-reviewed PASS. Fresh campaign Release 0W/0E and affected 137/137. Official evidence: hermetic 16,768/16,768; broader InstalledDat 468 pass / 10 fail / 1 skip; canonical 385 pass / the same 10 fail / 1 skip; manifests and nonpassing identities exact. Valid lead gate `logs/selfgate-20260904-183925-s5c2-candidate-shadow-ab`: seven PNGs, exit 0, graceful logout, no fatal match, no client left. Exact parent `5c106bcdf` A/B at `s5-c2-ab-parent/logs/selfgate-20260904-183815-s5c2-parent-shadow-ab` proves the gate-visible dark lighting switch predates c2; #469/IA-24 carry it for resolution or explicit owner acceptance before G4. Owner PNG inspection pending. |
 | S5-c3 | **LANDED + REVIEW-CLOSED 2026-09-04** at `c673f767e` (reviewed scratch `01e5a15d0`; packet §§17–21). | **C3 SCOPE SELF-GATE PROVISIONAL PASS; whole-renderer finding #470 OPEN. G4 UNPASSED.** | OpenAI retail pass 3/10 PASS and production narrow re-review pass 5/10 PASS. Fix round 3 added ordinary landblock-lifetime ownership for every unique nonzero ladder GfxObj, rearmed walk-frame miss requests, and made the one-tick-before-BeginFrame proof discriminating. Fresh clean campaign: Release 0W/0E; focused 101/101; hermetic 16,811/16,811; InstalledDat 469 pass / the unchanged documented 10 fail / 1 skip; manifests 30/30. Self-gate `logs/selfgate-20260904-223345-s5c3-building-degrade` produced five PNGs, exited 0/gracefully, and left no client. The selected building shells are complete; the Holtburg frame also exposed pre-existing atmospheric ordered-draw sidecar defect #470, which is not a c3 regression and blocks renderer-solid/G4 until repaired. |
-| S5-c4 | **IMPLEMENTED; RETAIL REVIEW PASS 1/10 FAILED 2026-09-05. FIX ROUND 1 CONTRACTED** in packet §23. Scratch implementation `91fb80de6` remains unlanded. | G4 UNPASSED | The one-pass `a*qA²` material, explicit opacity, overlay deletion, and #471 ordered arm are correct. Review proved production did not carry exact raw SetSurface blend families, Wb final-`X` ClipMap reference, or raw-Additive fog disable; the existing table was partly a CPU-only oracle. §23 requires resolved extraction-to-command material state, production recordings, mutations, register correction, narrow retail re-review, then the full production lens. Nothing lands or launches yet. |
-| S5 | IN FLIGHT — c1–c3 landed/review-closed/provisionally self-gated; c4 fix round 1 contracted; c5, #469/#470 disposition, closeout, and G4 remain | G4 | Packet §§7 and 12–23 are binding. Next: implement S5-c4 fix round 1 on `91fb80de6`, then sequential review; never merge main before G4. |
+| S5-c4 | **IMPLEMENTED; RETAIL REVIEW PASSES 1–2/10 FAILED 2026-09-05. FIX ROUND 2 CONTRACTED** in packet §24. Scratch stack `91fb80de6` → `70751ef0e` remains unlanded. | G4 UNPASSED | Fix round 1 correctly carries raw blend/Clip/fog state through recipe 10 and passed clean hermetic 16,959/16,959 plus inclusive InstalledDat 469/10/1. Pass 2 found one remaining production mismatch: every blended+Clip row keeps depth writes off, while retail enables them whenever its alpha test remains armed. §24 requires depth-write-ON variants selected by the carried alpha-test state in both Wb/EnvCell, corrected real-pipeline oracles and mutations, narrow retail pass 3, then the full production lens. Nothing lands or launches yet. |
+| S5 | IN FLIGHT — c1–c3 landed/review-closed/provisionally self-gated; c4 fix round 2 contracted; c5, #469/#470 disposition, closeout, and G4 remain | G4 | Packet §§7 and 12–24 are binding. Next: implement S5-c4 fix round 2 on `70751ef0e`, then sequential review; never merge main before G4. |
 
 ---
 

docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

@@ -1993,3 +1993,131 @@ Retail/material narrow re-review is pass 2/10 and must independently reproduce
 the raw-state mappings, CLIP reference, fog rule, register truth, and at least
 three new mutations. Only after it passes may the full production/gate-honesty
 lens run. Nothing lands or launches graphically before both lenses pass.
+
+## 24. S5-c4 fix round 2 — alpha-tested blend families write depth
+
+### 24.1 Retail/material re-review pass 2/10
+
+Retail/material re-review of clean fix-round-1 tip
+`70751ef0e81200282323c0b08c6c52f40036ecd9` returned **FAIL** on one
+production state and one documentation-only correction. The reviewer and lead
+independently reproduced the code finding against the named retail decomp and
+paired executable:
+
+- `D3DPolyRender::SetSurface @0x0059C4D0` first selects the framebuffer blend
+  family. Its ClipMap arm at `0x0059C724..0x0059C761` retains an already-selected
+  blend family, except for the pure-Clip `ONE,INVSRCALPHA` case, and enables
+  `GREATER_EQUAL` alpha testing with the palette/DDS reference;
+- after the later Translucent override, the normal depth-state arm at
+  `0x0059C7EE..0x0059C801` selects depth-write `1` whenever alpha testing is
+  still enabled or blending is disabled, otherwise depth-write `0`;
+- `SetSurface @0x0059C85E..0x0059C866` passes that byte to
+  `RenderDeviceD3D::SetDepthBufferMode @0x005A2D10`; the callee at
+  `0x005A2D4B..0x005A2D6E` stores the third argument as
+  `m_State.DepthWriteEnable` and programs D3D render state `0x0E`; and
+- therefore Alpha+Clip, Alpha+Additive+Clip, raw Additive+Clip,
+  InvAlpha+Clip, and InvAlpha+Additive+Clip all retain their blend factors and
+  alpha reference **with depth writes ON**. The corresponding non-Clip blended
+  rows write no depth. `Translucent|ClipMap` is also depth-write off because
+  retail's late override disables its alpha test. Opaque and pure Clip remain
+  depth-write on.
+
+Fix round 1 instead creates all five blended Wb pipeline families with
+`depthWrite:false` in `WbDrawDispatcher.Rhi.cs` and selects only by blend
+family; EnvCell repeats the same collapse. Its three production-transcript
+oracles also encode the false rule that only Opaque/pure Clip writes depth.
+The result has the right blend, final-X cutoff, fog decision, and single-draw
+position, but accepted blended+Clip fragments do not populate depth as retail
+does.
+
+Everything else audited in fix round 1 passed: the shared PREMODULATE RGB and
+`X=a*qA*qA` result; 100/255 versus 200/255 final-X references; raw-Additive fog
+suppression; Translucent precedence; actual texture/palette provenance;
+recipe-10 state packing; Wb/EnvCell ordered state and reset; detail-off
+invariance; and AP-238/AP-239/AP-240/AP-244 preservation. Clean exact-tip
+evidence was also verified: focused App 242, Content 92, and Launcher 8 tests;
+hermetic 16,959/16,959; inclusive InstalledDat 469 pass / the same documented
+10 fail / 1 skip; and byte-identical 3/8-worker recipe-10 bakes with SHA-256
+`0D3194A3B834DC1E0DCF67647402723B30BD758A268B8E909EC737369B911FA7`.
+The register header in the fix commit says 160 active AP rows even though the
+physical table and existing recount establish 161, and its AP-232 correction
+temporarily overclaims exact combined-Clip state despite this depth mismatch.
+
+### 24.2 Bounded production repair
+
+On top of `70751ef0e`, add/select a depth-write-ON variant of every blended
+SetSurface family used by a **detail-active alpha-tested** command:
+
+1. Wb `StraightAlpha`, `AlphaAdditive`, raw `Additive`, `InverseAlpha`, and
+   `InverseAdditive`, across both backbuffer/offscreen sample counts and the
+   ordinary/atmospheric receiver pipeline sets; and
+2. the same five families in EnvCell.
+
+Select the depth-writing variant from the already-carried
+`RetailSetSurfaceMaterialState.AlphaTestEnabled`, not from raw Clip bits,
+`TranslucencyKind`, queue identity, a DAT lookup, or a second state owner. A
+blend family with alpha testing disabled keeps its existing depth-write-OFF
+pipeline. Preserve Wb pure Clip on AP-240's opaque/A2C pipeline and EnvCell pure
+Clip on its existing `ONE,INVSRCALPHA`, depth-write-ON pipeline. Preserve the
+late `Translucent|ClipMap` override on straight alpha, test disabled, depth
+write off. Depth compare remains the existing world compare; this round changes
+only the write-enable bit.
+
+Do not change extraction, raw-state resolution, recipe-10 bytes, grouping or
+FIFO membership, draw count/order, `ParamB`, detail slot/tiling, fog flag,
+shared material equations, shader discard/equality behavior, geometry,
+transforms, local sidecars, cull, lighting, sampler/mips, #469, or #470. Do not
+add a per-frame allocation, map, DAT query, second draw, or overlay. Dispose
+every new pipeline in all ordinary/atmospheric and sample-count owners, with
+the existing partial-construction rollback behavior intact.
+
+Correct the AP header to the physical 161-row count and narrow the AP-232
+correction so it does not claim combined-Clip depth exactness until this fix is
+present. No new deviation row is needed: this is a required correction, while
+AP-240 and AP-244 remain the disclosed placement/detail-off residuals. The only
+documentation permitted in the implementation commit remains
+`docs/architecture/retail-divergence-register.md`.
+
+Allowed production scope is Wb/EnvCell pipeline-set construction, exact
+material-pipeline selection and disposal. Tests may change only for the
+directly affected production pipeline/state transcripts. No shader/SPIR-V,
+prepared-data, recipe, queue, routing, or unrelated documentation change is
+authorized; if one proves necessary, stop and return the exact reason.
+
+### 24.3 Discriminating proof and review return
+
+Correct the three false depth-write oracles and prove actual production
+pipeline descriptors, not a parallel policy model, for both Wb and EnvCell:
+
+- all five blended families with ClipMap/paletted or DDS alpha testing select
+  their exact blend factors, existing cutoff, and depth-write ON;
+- the same five families without alpha testing select the same factors and
+  depth-write OFF;
+- `Translucent|ClipMap` selects straight alpha, test disabled, depth-write OFF;
+- Wb pure Clip still selects its opaque/A2C, depth-write-ON AP-240 path, while
+  EnvCell pure Clip still selects premultiplied `ONE,INVSRCALPHA`, depth-write
+  ON; and
+- ordinary versus atmospheric Wb and an adjacent non-detail command select the
+  same write rule without stale pipeline/reference/fog state.
+
+Apply and independently restore at least these mutations, recording each first
+discriminating failure in the fix commit body:
+
+1. collapse one Wb blended+Clip row back to its depth-write-OFF variant;
+2. collapse a different EnvCell blended+Clip family to depth-write off;
+3. incorrectly select depth-write ON for the corresponding non-Clip blend; and
+4. incorrectly make the late `Translucent|ClipMap` override write depth.
+
+Return one clean fix-round-2 commit atop `70751ef0e`; exact file/line counts;
+`git diff --check`; Release solution 0W/0E; focused Wb/EnvCell material,
+pipeline-descriptor, ordered/atmospheric, disposal/rollback, allocation, shader
+invariance, and register-count tests; official hermetic lane; and inclusive
+InstalledDat with every accepted nonpassing identity named. The recipe remains
+10, so no fresh bake is required unless an unauthorized prepared-data change
+is discovered. No graphical client launch.
+
+Retail/material narrow re-review is pass 3/10 and must independently reproduce
+the depth-write rule from the paired binary, inspect real production pipeline
+descriptors, verify AP truth, and reproduce at least three new mutations. Only
+after it passes may the full production/gate-honesty lens run over the complete
+S5-c4 stack. Nothing lands or launches graphically before both lenses pass.