tools(gate): -ExeOverride and -DebuggerScript for the offline pixel gate; #422 characterised over 40 instrumented runs (Campaign VM VM7)

-ExeOverride runs another AcDream.App.exe through the SAME isolated
settings/scene/capture path so two binaries compare without mixing tool
versions (VM0's recorded fieldOfView trap). -DebuggerScript launches the
client under cdb so ntdll's debug heap validates every free and a heap
corruption breaks at the corrupting site with a stack.

#422 (1-in-8 STATUS_HEAP_CORRUPTION exit after a pack-on offline capture):
16 runs attached + 24 runs under the debug heap on 1f151242, all clean
(P ~ 0.5 % at the filed rate). Recorded as not reproducible on the current
binary, carried as a watch item for the owner's VM7 matrix with the loop as
the first step if it recurs; no longer a merge blocker. Evidence under
docs/research/evidence/vm7 alongside the final pack-off-vs-base+normals
robust diff (5-10 px, lifestone band only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ISSUES.md

@@ -48,7 +48,7 @@ kinds. Same class as the VM6 fix; do not guess the values.
 
 ## #422 — Intermittent heap-corruption exit (0xC0000374) after a pack-on offline capture
 
-**Status:** OPEN — filed 2026-08-22 at Campaign VM VM3; VM7 gate item (fix or characterise before merge).
+**Status:** OPEN — filed 2026-08-22 at Campaign VM VM3; **characterised at VM7 (2026-08-23): NOT REPRODUCIBLE on `1f151242` in 40 instrumented runs.** 16 runs with cdb attached during warm-up (`sxe` on bpe/av/0xC0000374/0xC0000409) and 24 runs launched under cdb with ntdll's debug heap (`tools/i422/loop-debugheap.ps1` → `tools/run-offline-pixel-gate.ps1 -DebuggerScript tools/cdb/i422-heap-launch.cdb`): every run captured, tore down and exited 0; no heap message, no break. At the filed 1-in-8 rate, 40 clean runs has P ≈ 0.5 %, so either the rate fell with the VM6 receiver-binding changes (`eec95535`–`1f151242` — the world pass now always binds the shadow/atmospheric blocks; a plausible teardown-order interaction, not proven) or the trigger is environmental. Evidence: `docs/research/evidence/vm7/i422-attached-16-runs.txt`, `i422-debugheap-24-runs.txt`. Carried as a watch item for the owner's VM7 visual matrix (an exit code `-1073740940` after any pack-on run re-opens it with the debug-heap loop as the first step); no longer blocks the merge.
 **Component:** rendering / render packs (Campaign AR) — native teardown
 
 **Description:** `tools/run-offline-pixel-gate.ps1 -RenderPackPreset high` (shipped

docs/research/evidence/vm7/i422-attached-16-runs.txt

@@ -0,0 +1,17 @@
+run,exit,cdbLog,heapMsg
+1,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-01\cdb.log,(6a58.6ce4): Break instruction exception - code 80000003 (first chance)
+2,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-02\cdb.log,(1d30.1574): Break instruction exception - code 80000003 (first chance)
+3,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-03\cdb.log,(58a0.197c): Break instruction exception - code 80000003 (first chance)
+4,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-04\cdb.log,(4374.6a90): Break instruction exception - code 80000003 (first chance)
+5,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-05\cdb.log,(2e5c.6e9c): Break instruction exception - code 80000003 (first chance)
+6,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-06\cdb.log,(682c.b3c): Break instruction exception - code 80000003 (first chance)
+7,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-07\cdb.log,(51a0.179c): Break instruction exception - code 80000003 (first chance)
+8,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-08\cdb.log,(7298.3210): Break instruction exception - code 80000003 (first chance)
+9,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-09\cdb.log,(4700.ab8): Break instruction exception - code 80000003 (first chance)
+10,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-10\cdb.log,(1d2c.5efc): Break instruction exception - code 80000003 (first chance)
+11,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-11\cdb.log,(1ee4.5d30): Break instruction exception - code 80000003 (first chance)
+12,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-12\cdb.log,(2c90.9a0): Break instruction exception - code 80000003 (first chance)
+13,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-13\cdb.log,(71b8.4568): Break instruction exception - code 80000003 (first chance)
+14,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-14\cdb.log,(4d24.2704): Break instruction exception - code 80000003 (first chance)
+15,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-15\cdb.log,(71ac.51a8): Break instruction exception - code 80000003 (first chance)
+16,,C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0\artifacts\i422\logs-16\cdb.log,(2594.1e28): Break instruction exception - code 80000003 (first chance)

docs/research/evidence/vm7/i422-debugheap-24-runs.txt

@@ -0,0 +1,25 @@
+run,gateExit,shutdownLine,heapLine
+1,0,,
+2,0,,
+3,0,,
+4,0,,
+5,0,,
+6,0,,
+7,0,,
+8,0,,
+9,0,,
+10,0,,
+11,0,,
+12,0,,
+13,0,,
+14,0,,
+15,0,,
+16,0,,
+17,0,,
+18,0,,
+19,0,,
+20,0,,
+21,0,,
+22,0,,
+23,0,,
+24,0,,