diff --git a/docs/ISSUES.md b/docs/ISSUES.md
index 528b612b..52801566 100644
--- a/docs/ISSUES.md
+++ b/docs/ISSUES.md
@@ -46,9 +46,9 @@ owner accepted its look at the Stage-1 gate and re-keying changes it.
 gate, and retire `ActiveDayGroupMultiplier`. Validator must reject unknown
 kinds. Same class as the VM6 fix; do not guess the values.
 
-## #422 — Intermittent heap-corruption exit (0xC0000374) after a pack-on offline capture
+## #422 — Intermittent heap-corruption exit (0xC0000374) at process exit after an offline capture (pack on OR off)
 
-**Status:** OPEN — filed 2026-08-22 at Campaign VM VM3; **characterised at VM7 (2026-08-23): NOT REPRODUCIBLE on `1f151242` in 40 instrumented runs.** 16 runs with cdb attached during warm-up (`sxe` on bpe/av/0xC0000374/0xC0000409) and 24 runs launched under cdb with ntdll's debug heap (`tools/i422/loop-debugheap.ps1` → `tools/run-offline-pixel-gate.ps1 -DebuggerScript tools/cdb/i422-heap-launch.cdb`): every run captured, tore down and exited 0; no heap message, no break. At the filed 1-in-8 rate, 40 clean runs has P ≈ 0.5 %, so either the rate fell with the VM6 receiver-binding changes (`eec95535`–`1f151242` — the world pass now always binds the shadow/atmospheric blocks; a plausible teardown-order interaction, not proven) or the trigger is environmental. Evidence: `docs/research/evidence/vm7/i422-attached-16-runs.txt`, `i422-debugheap-24-runs.txt`. Carried as a watch item for the owner's VM7 visual matrix (an exit code `-1073740940` after any pack-on run re-opens it with the debug-heap loop as the first step); no longer blocks the merge.
+**Status:** OPEN — filed 2026-08-22 at Campaign VM VM3; **characterised at VM7 (2026-08-23) — rare, pack-INDEPENDENT, exit-time, not yet caught with a stack.** Facts: (1) it fired once more, on the **retail (pack-off)** row of `tools/run-atmospheric-performance-matrix.ps1` at 1920×1080 / 45 s warm-up / uncapped on `621a0edf` — the first launch after a fresh build — so "retail/off never reproduced it" is withdrawn and the title's "pack-on" is wrong: the exit is in the common teardown. (2) It did not fire in 16 runs with cdb attached (High, 720p, 12 s), 24 runs launched under cdb's debug heap (High, 720p, 12 s), 6 runs under the debug heap with the exact matrix recipe, or 10 plain runs with the exact recipe and a forced non-incremental rebuild before run 1 (`tools/i422/loop-debugheap.ps1`, `tools/i422/loop-plain.ps1`) — 1 in ~57 offline runs today, ~2 %. (3) The fail-fast leaves NO Application event-log entry and NO WER report on this machine (WerSvc is in its normal on-demand state, nothing disabled), so there is no dump to read; a per-user `HKCU\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\AcDream.App.exe` key (`DumpType=2`, `DumpFolder`) is the one-time user action that turns the next occurrence into a full dump — the project does not set registry keys itself. (4) The pre-campaign binary (`6c79d35c` + VM0 patches) CANNOT be tested with this tool: it predates the gate's in-process close verb, so every run ends in the gate's forced kill and never reaches the graceful-exit path where the fault lives (10/10 "automation close timed out") — whether the fault predates Campaign AR is therefore unknown, not disproven. Evidence: `docs/research/evidence/vm7/i422-*.txt`, `artifacts/vm7-matrix/uncapped-retail-1920x1080/` (the crashing run's log — managed shutdown complete, `MossTank disabled` last). Carried as a watch item for the owner's VM7 matrix; the owner decides whether a ~2 % exit-time fault blocks the merge.
 **Component:** rendering / render packs (Campaign AR) — native teardown
 
 **Description:** `tools/run-offline-pixel-gate.ps1 -RenderPackPreset high` (shipped
diff --git a/tools/i422/loop-debugheap.ps1 b/tools/i422/loop-debugheap.ps1
index 54ae28f7..e367681b 100644
--- a/tools/i422/loop-debugheap.ps1
+++ b/tools/i422/loop-debugheap.ps1
@@ -5,11 +5,18 @@
     summarised to artifacts/i422dh/summary.txt.
 .EXAMPLE
     pwsh tools/i422/loop-debugheap.ps1 -Runs 24
+    # the recipe that reproduced #422 at VM7 (retail preset, 1080p, 45 s warm-up):
+    pwsh tools/i422/loop-debugheap.ps1 -Runs 8 -Preset retail -Resolution 1920x1080 -WarmupMs 45000 -OutLeaf i422dh-retail1080
 #>
-param([int]$Runs = 24)
+param(
+    [int]$Runs = 24,
+    [ValidateSet('retail', 'low', 'medium', 'high', 'auto')][string]$Preset = 'high',
+    [string]$Resolution = '1280x720',
+    [int]$WarmupMs = 12000,
+    [string]$OutLeaf = 'i422dh')
 $ErrorActionPreference = 'Continue'
 $repo = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
-$root = Join-Path $repo 'artifacts\i422dh'
+$root = Join-Path $repo ('artifacts' + [IO.Path]::DirectorySeparatorChar + $OutLeaf)
 New-Item -ItemType Directory -Force $root | Out-Null
 $summary = Join-Path $root 'summary.txt'
 "run,gateExit,shutdownLine,heapLine" | Set-Content $summary
@@ -19,7 +26,7 @@ for ($i = 1; $i -le $Runs; $i++) {
     $gateErr = Join-Path $root ("gate-{0:D2}.err" -f $i)
     $gate = Start-Process -FilePath 'pwsh' -ArgumentList @(
         '-NoProfile', '-File', (Join-Path $repo 'tools\run-offline-pixel-gate.ps1'),
-        '-Out', $out, '-SkipBuild', '-RenderPackPreset', 'high', '-Uncapped',
+        '-Out', $out, '-SkipBuild', '-RenderPackPreset', $Preset, '-Resolution', $Resolution, '-WarmupMs', "$WarmupMs", '-Uncapped',
         '-DebuggerScript', (Join-Path $repo 'tools\cdb\i422-heap-launch.cdb')) `
         -PassThru -WindowStyle Hidden -RedirectStandardOutput $gateOut -RedirectStandardError $gateErr
     $gate.WaitForExit()
diff --git a/tools/i422/loop-plain.ps1 b/tools/i422/loop-plain.ps1
new file mode 100644
index 00000000..4af94d02
--- /dev/null
+++ b/tools/i422/loop-plain.ps1
@@ -0,0 +1,46 @@
+<#
+.SYNOPSIS
+    #422 rate measurement: N offline captures WITHOUT a debugger (the debug
+    heap can change allocation layout and mask a corruption), optionally
+    forcing a non-incremental Release rebuild of AcDream.App before run 1 so
+    run 1 is a genuine "first launch after a build" — the condition under
+    which the VM7 matrix reproduced the exit.
+.EXAMPLE
+    pwsh tools/i422/loop-plain.ps1 -Runs 12 -Preset retail -Resolution 1920x1080 -WarmupMs 45000 -RebuildFirst
+#>
+param(
+    [int]$Runs = 12,
+    [ValidateSet('retail', 'low', 'medium', 'high', 'auto')][string]$Preset = 'retail',
+    [string]$Resolution = '1920x1080',
+    [int]$WarmupMs = 45000,
+    [string]$OutLeaf = 'i422plain',
+    [switch]$RebuildFirst,
+    [string]$ExeOverride)
+$ErrorActionPreference = 'Continue'
+$repo = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$root = Join-Path $repo ('artifacts' + [IO.Path]::DirectorySeparatorChar + $OutLeaf)
+New-Item -ItemType Directory -Force $root | Out-Null
+$summary = Join-Path $root 'summary.txt'
+"run,gateExit,shutdownLine" | Set-Content $summary
+if ($RebuildFirst) {
+    & dotnet build (Join-Path $repo 'src\AcDream.App\AcDream.App.csproj') -c Release --no-incremental --nologo -v q | Select-Object -Last 2
+}
+for ($i = 1; $i -le $Runs; $i++) {
+    $out = Join-Path $root ("run-{0:D2}" -f $i)
+    $gateOut = Join-Path $root ("gate-{0:D2}.out" -f $i)
+    $gateErr = Join-Path $root ("gate-{0:D2}.err" -f $i)
+    $gateArgs = @(
+        '-NoProfile', '-File', (Join-Path $repo 'tools\run-offline-pixel-gate.ps1'),
+        '-Out', $out, '-SkipBuild', '-RenderPackPreset', $Preset, '-Resolution', $Resolution,
+        '-WarmupMs', "$WarmupMs", '-Uncapped')
+    if ($ExeOverride) { $gateArgs += @('-ExeOverride', $ExeOverride) }
+    $gate = Start-Process -FilePath 'pwsh' -ArgumentList $gateArgs `
+        -PassThru -WindowStyle Hidden -RedirectStandardOutput $gateOut -RedirectStandardError $gateErr
+    $gate.WaitForExit()
+    $shutdown = ''
+    $m = Select-String -Path $gateErr -Pattern 'exited with code|timed out|No screenshot' -ErrorAction SilentlyContinue | Select-Object -First 1
+    if ($m) { $shutdown = $m.Line.Trim() -replace ',', ';' }
+    "$i,$($gate.ExitCode),$shutdown" | Add-Content $summary
+    Write-Host ("run {0}: gate {1} {2}" -f $i, $gate.ExitCode, $shutdown)
+}
+Get-Content $summary