Sixteen DrawPortalPolyInternal attempts per frame, vertex-identical to
acdream's sixteen collect-time punches; twelve lie entirely on the local
y=12 plane and are rejected by the ±12 guard in both clients, so the hall
building's doorways are never punched in either.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Two live cdb captures on the paired 2013 client at the Holtburg doorway:
the blockset template (every Render::block_check call of one frame — 2,601
resident blocks x 2 exit views) proves retail tests a9c9 at ring slot
25,46 and returns PARTIALLY then OUTSIDE; the blockcheck template dumps
its four corner interval vectors (0 0 0 0 300.4|310.2 and 0 0 0 1001 ...,
slab 75..330). acdream's replay at the same P pose reproduces the sentinel
pattern, the four edge planes and both verdicts, drawing a9c9 once, with
clip heights 298.8/308.5 m — a 0.5 % plane difference (about 0.35 px of
projected door-vertex position). At the fixture pose that margin is what
flips the south-west corner from inside to outside on the fourth edge
plane, so retail's four-corner unanimity test says OUTSIDE where ours
says PartiallyInside. Not fixable bit-exactly short of D3D's x87
transform; the KnownFailure row stays with its comment rewritten, the
register carries AD-118, and the first filtered capture's silent miss
(cdb sign-extends poi() inside .if; use dwo()) is noted in the template.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The AM and PM breakpoint actions carried a single-backslash newline; cdb
needs the doubled form inside a quoted bp action, as the other lines use.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Recon script, three capture templates (walk / parts / alpha-depth),
runner, and operator README under tools/walk-oracle/oh/. FW0 line formats
are kept byte-identical; new EC/OC/PD/DM/AM/FL/PM/PC line kinds are
documented. Auto-detach uses the fall-through + top-level qd recipe; qd
never appears inside a breakpoint action. Lead-resolved: DBObj::m_DID is
+0x28 (header layout, first base of CGfxObj and CObjCell, matches the
proven FW0 cell reads); the three D3DPolyRender alpha functions are static
cdecl with stack arguments, uint8 arguments read with by().
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
