feat(render): Campaign V slice V6i-1 - one descriptor set per renderer scope

Plan section 5.5.8 recorded, and deliberately did not fix, that pointing one
binding at a second buffer within a frame silently corrupts the draws already
recorded against it: the backend rewrote the descriptor in place, and a
descriptor set's contents are read when the command buffer EXECUTES, not when it
was recorded. Nothing fired it while the Vulkan frame held only the retained UI.
Section 5.5.11 handed it forward as the first thing the world arm would hit,
because WbDrawDispatcher, EnvCellRenderer and TerrainModernRenderer each own
their own instance, batch and indirect buffers and all three bind set 0 in one
frame.

It is closed here, as its own commit and BEFORE the world arm, so that a blank or
corrupt first Vulkan world frame cannot be this defect wearing another face. That
sequencing is the point: sections 5.5.1 to 5.5.3 cost this campaign three days
because an instrument that was "usually right" sat underneath the thing being
measured.

What changed. There is no longer one (set 0, set 1) pair per flight slot; there
is an arena of them. VulkanBindingScopeArena - pure bookkeeping, no Vulkan
handles, nine unit tests - answers two questions per bind: which pair, and do its
descriptors need writing. VulkanFrameBindings keeps the Vulkan half: allocating
pairs from a growable pool list and writing the twelve descriptors when told to.

The scope key is the descriptor state itself - the ten storage buffer identities
and ranges, the plain bindings' offsets, and the two uniform buffer identities
and ranges. Deriving it is a decision, not an economy. The pinned contract has
nowhere to name a scope: BindStorageBuffer takes a buffer, an offset and a size,
and section 3.3 is frozen. Deriving also gives two properties a declared scope
would not: a renderer cannot forget to declare one, and two renderers that
genuinely share every buffer correctly share one pair rather than being told to
differ. A renderer's buffers are stable for its lifetime, so "distinct descriptor
state" is exactly "renderer scope".

Dynamic offsets stay free. A ring allocation moving between draws rides
vkCmdBindDescriptorSets's dynamic-offset array, so it costs neither a new pair
nor a descriptor write - section 4.4's "zero descriptor writes per frame"
property survives a frame having more than one binding state in it. Entries are
not invalidated at BeginFrame either, because the slot's previous submission has
retired and its descriptors still say what this frame is about to say; a steady
frame therefore rewrites nothing at all. An entry matched from the previous frame
is swapped below the live cursor so the rest of the frame cannot take it for a
different state - the ordering property the sixth test pins, where two renderers
swap submission order between frames.

What this does NOT do is draw a world. The captured Vulkan frame is still V6h's
retained UI over the fog clear, so the arena's multi-scope path is exercised by
its tests and not yet by a frame. That is recorded in the plan rather than
implied.

The plan's section 5.5.12 also records two blockers measured while scoping the
world arm and not fixed here: terrain_modern.vert declares TerrainClip without
ACDREAM_UBO_SET, so under the Vulkan dialect it lands at set 0 binding 2 where
the layout declares a storage buffer - the same class of gap 5.5.8 recorded for
UniformSkyParams, invisible until a terrain pipeline is created; and the offline
gate's scene takes the retail PView path rather than the flat safety path,
because ClipRoot falls back to Buildings.OutdoorNode, which puts
RetailPViewPassExecutor on the critical path to the first Vulkan Dereth frame and
makes the "terrain only" intermediate no cheaper than the whole arm.

Gates. Strict GL offline pixel gate against b9ab5890: 1.60e-05, 9 differing
pixels of 563,200, at the low end of the documented 9-31 px band and 62x under
the threshold - expected, since no GL file is touched. GL connected
run-repeat-connected-gate.ps1 -Runs 3: 3/3 RENDERED on the desktop witness and
3/3 on the client capture. One offline Vulkan run with VK_LAYER_KHRONOS_validation
proven inserted by the loader: zero errors, zero warnings, captured frame, no
[shutdown] diagnostic on either stream. App tests 4,086 / 3 skips (baseline 4,077
plus nine); complete Release suite 9,149 / 5. Issue #250's
SurfaceOverrideFingerprint_DictionaryHotPathAllocatesNothing failed once in a
whole-suite run and passed run alone, as that issue documents.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.App.Tests/Rendering/Gpu/Vk/VulkanBindingScopeArenaTests.cs

@@ -0,0 +1,235 @@
+using AcDream.App.Rendering.Gpu;
+using AcDream.App.Rendering.Gpu.Vk;
+
+namespace AcDream.App.Tests.Rendering.Gpu.Vk;
+
+/// <summary>
+/// Campaign V slice V6i. Plan §5.5.8's second recorded gap was that pointing one
+/// binding at a second buffer within a frame silently corrupts the draws already
+/// recorded against it, because a descriptor set is read when the command buffer
+/// executes and not when it was recorded. These tests pin the property that
+/// closes it: within one frame, an entry a draw is already bound to is never
+/// rewritten.
+/// </summary>
+public sealed class VulkanBindingScopeArenaTests
+{
+    private const ulong RingBuffer = 0x1000;
+    private const ulong DummyBuffer = 0x2000;
+    private const ulong DispatcherBuffer = 0x3000;
+    private const ulong EnvCellBuffer = 0x4000;
+
+    private static VulkanBindingScopeArena CreateArena()
+    {
+        var arena = new VulkanBindingScopeArena(
+            (int)GpuBindingModel.StorageBindingCount,
+            VulkanFrameBindings.UniformBindingCount,
+            VulkanPipelineLayouts.IsDynamicStorageBinding);
+        for (uint binding = 0; binding < GpuBindingModel.StorageBindingCount; binding++)
+            arena.SeedStorage(binding, DummyBuffer, offsetBytes: 0, rangeBytes: 65536);
+        for (uint binding = 0; binding < VulkanFrameBindings.UniformBindingCount; binding++)
+            arena.SeedUniform(binding, DummyBuffer, rangeBytes: 65536);
+        return arena;
+    }
+
+    [Fact]
+    public void TwoRenderersBindingTheSameBindingToDifferentBuffersGetDifferentEntries()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int firstIndex, _, bool firstWrite) = arena.Resolve();
+        arena.AssignSlot(firstIndex, slot: 0);
+        Assert.True(firstWrite);
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, EnvCellBuffer, 0, 4096);
+        (int secondIndex, _, bool secondWrite) = arena.Resolve();
+        arena.AssignSlot(secondIndex, slot: 1);
+
+        Assert.True(secondWrite);
+        Assert.NotEqual(firstIndex, secondIndex);
+        Assert.Equal(2, arena.Count);
+        Assert.Equal(2, arena.LiveCount);
+    }
+
+    [Fact]
+    public void ReturningToAnEarlierRenderersBuffersReusesItsEntryWithoutRewriting()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int dispatcher, _, _) = arena.Resolve();
+        arena.AssignSlot(dispatcher, slot: 0);
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, EnvCellBuffer, 0, 4096);
+        (int envCell, _, _) = arena.Resolve();
+        arena.AssignSlot(envCell, slot: 1);
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int again, int slot, bool needsWrite) = arena.Resolve();
+
+        Assert.Equal(dispatcher, again);
+        Assert.Equal(0, slot);
+        Assert.False(needsWrite);
+        Assert.Equal(2, arena.Count);
+    }
+
+    [Fact]
+    public void ADynamicBindingsMovingOffsetCostsNoNewEntryAndNoWrite()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, RingBuffer, 0, 4096);
+        (int index, _, _) = arena.Resolve();
+        arena.AssignSlot(index, slot: 0);
+
+        arena.SetStorage(GpuBindingModel.StorageInstances, RingBuffer, 8192, 4096);
+        (int second, _, bool needsWrite) = arena.Resolve();
+
+        Assert.Equal(index, second);
+        Assert.False(needsWrite);
+        Assert.Equal(1, arena.Count);
+        Assert.Equal(8192u, arena.StorageOffset(GpuBindingModel.StorageInstances));
+        // A dynamic descriptor addresses the whole range and slides with the
+        // bind call, so its descriptor offset stays zero.
+        Assert.Equal(0u, arena.StorageDescriptorOffset(GpuBindingModel.StorageInstances));
+    }
+
+    [Fact]
+    public void APlainBindingsMovingOffsetIsDescriptorVisibleAndTakesANewEntry()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        // Binding 4 (global lights) is plain: V6g's rule keeps only ring-fed
+        // bindings dynamic, so a plain binding's offset lives in its descriptor.
+        Assert.False(VulkanPipelineLayouts.IsDynamicStorageBinding(GpuBindingModel.StorageGlobalLights));
+
+        arena.SetStorage(GpuBindingModel.StorageGlobalLights, RingBuffer, 0, 256);
+        (int first, _, _) = arena.Resolve();
+        arena.AssignSlot(first, slot: 0);
+
+        arena.SetStorage(GpuBindingModel.StorageGlobalLights, RingBuffer, 512, 256);
+        (int second, _, bool needsWrite) = arena.Resolve();
+        arena.AssignSlot(second, slot: 1);
+
+        Assert.NotEqual(first, second);
+        Assert.True(needsWrite);
+        Assert.Equal(512u, arena.StorageDescriptorOffset(GpuBindingModel.StorageGlobalLights));
+    }
+
+    [Fact]
+    public void ASteadyFrameRewritesNothing()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+
+        arena.BeginFrame();
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int index, _, bool firstWrite) = arena.Resolve();
+        arena.AssignSlot(index, slot: 0);
+        Assert.True(firstWrite);
+
+        // The next frame on the same flight slot binds the same buffers. The
+        // previous frame has retired, so its entry is free to reclaim — and its
+        // descriptors already say exactly this, so nothing is written.
+        arena.BeginFrame();
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int reused, int slot, bool needsWrite) = arena.Resolve();
+
+        Assert.Equal(0, reused);
+        Assert.Equal(0, slot);
+        Assert.False(needsWrite);
+        Assert.Equal(1, arena.Count);
+    }
+
+    [Fact]
+    public void AnEntryReclaimedFromTheLastFrameIsProtectedForTheRestOfThisOne()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+
+        arena.BeginFrame();
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int dispatcher, _, _) = arena.Resolve();
+        arena.AssignSlot(dispatcher, slot: 0);
+        arena.SetStorage(GpuBindingModel.StorageInstances, EnvCellBuffer, 0, 4096);
+        (int envCell, _, _) = arena.Resolve();
+        arena.AssignSlot(envCell, slot: 1);
+
+        // Next frame, in the opposite order. The EnvCell entry is matched from
+        // above the cursor and swapped down; the dispatcher must then get the
+        // OTHER entry rather than overwriting the one EnvCell's draw is bound to.
+        arena.BeginFrame();
+        arena.SetStorage(GpuBindingModel.StorageInstances, EnvCellBuffer, 0, 4096);
+        (int reusedEnvCell, int envCellSlot, bool envCellWrite) = arena.Resolve();
+        arena.SetStorage(GpuBindingModel.StorageInstances, DispatcherBuffer, 0, 4096);
+        (int reusedDispatcher, int dispatcherSlot, bool dispatcherWrite) = arena.Resolve();
+
+        Assert.False(envCellWrite);
+        Assert.False(dispatcherWrite);
+        Assert.NotEqual(reusedEnvCell, reusedDispatcher);
+        Assert.NotEqual(envCellSlot, dispatcherSlot);
+        Assert.Equal(2, arena.Count);
+        Assert.Equal(2, arena.LiveCount);
+    }
+
+    [Fact]
+    public void AThirdDistinctStateInOneFrameMaterialisesAThirdEntry()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        Bind(arena, DispatcherBuffer, slot: 0);
+        Bind(arena, EnvCellBuffer, slot: 1);
+        Bind(arena, RingBuffer, slot: 2);
+
+        Assert.Equal(3, arena.Count);
+        Assert.Equal(3, arena.LiveCount);
+
+        static void Bind(VulkanBindingScopeArena arena, ulong buffer, int slot)
+        {
+            arena.SetStorage(GpuBindingModel.StorageInstances, buffer, 0, 4096);
+            (int index, int existing, bool needsWrite) = arena.Resolve();
+            Assert.True(needsWrite);
+            Assert.Equal(-1, existing);
+            arena.AssignSlot(index, slot);
+        }
+    }
+
+    [Fact]
+    public void AUniformBufferChangeAlsoSeparatesScopes()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        arena.SetUniform(GpuBindingModel.UniformSceneLighting, DispatcherBuffer, 0, 256);
+        (int first, _, _) = arena.Resolve();
+        arena.AssignSlot(first, slot: 0);
+
+        arena.SetUniform(GpuBindingModel.UniformTerrainTiling, EnvCellBuffer, 0, 576);
+        (int second, _, bool needsWrite) = arena.Resolve();
+        arena.AssignSlot(second, slot: 1);
+
+        Assert.NotEqual(first, second);
+        Assert.True(needsWrite);
+    }
+
+    [Fact]
+    public void AUniformBuffersMovingOffsetCostsNoNewEntry()
+    {
+        VulkanBindingScopeArena arena = CreateArena();
+        arena.BeginFrame();
+
+        arena.SetUniform(GpuBindingModel.UniformSceneLighting, RingBuffer, 0, 256);
+        (int index, _, _) = arena.Resolve();
+        arena.AssignSlot(index, slot: 0);
+
+        arena.SetUniform(GpuBindingModel.UniformSceneLighting, RingBuffer, 1024, 256);
+        (int second, _, bool needsWrite) = arena.Resolve();
+
+        Assert.Equal(index, second);
+        Assert.False(needsWrite);
+        Assert.Equal(1024u, arena.UniformOffset(GpuBindingModel.UniformSceneLighting));
+    }
+}